flash/sakura
flash/sakura
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

deprecated global/information, closes #29

Browse source
This commit is contained in:
flash 2016-12-09 22:31:15 +01:00
parent cae6f22d37
commit c3a80ca7f9
12 changed files with 335 additions and 267 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/ActionCode.php
View file

@ -22,7 +22,7 @@ class ActionCode
public static function generate(string $action, int $user = 0): string
{
// Generate a code
$code = uniqid();
$code = bin2hex(random_bytes(8));
// Insert it
DB::table('actioncodes')

258
app/Controllers/AuthController.php
View file

@ -37,6 +37,23 @@ class AuthController extends Controller
]);
}
protected function authenticate(User $user): void
{
// Generate a session key
$session = CurrentSession::create(
$user->id,
Net::ip(),
get_country_code(),
clean_string($_SERVER['HTTP_USER_AGENT'] ?? '')
);
$cookiePrefix = config('cookie.prefix');
setcookie("{$cookiePrefix}id", $user->id, time() + 604800, '/');
setcookie("{$cookiePrefix}session", $session->key, time() + 604800, '/');
$this->touchRateLimit($user->id, true);
}
/**
* End the current session.
* @throws HttpMethodNotAllowedException
@ -99,19 +116,7 @@ class AuthController extends Controller
return $this->json(['error' => "Your account isn't activated, check your e-mail!"]);
}
// Generate a session key
$session = CurrentSession::create(
$user->id,
Net::ip(),
get_country_code(),
clean_string($_SERVER['HTTP_USER_AGENT'] ?? '')
);
$cookiePrefix = config('cookie.prefix');
setcookie("{$cookiePrefix}id", $user->id, time() + 604800, '/');
setcookie("{$cookiePrefix}session", $session->key, time() + 604800, '/');
$this->touchRateLimit($user->id, true);
$this->authenticate($user);
$msg = ['error' => null];
@ -124,78 +129,52 @@ class AuthController extends Controller
/**
* Do a registration attempt.
* @throws HttpMethodNotAllowedException
* @return string
*/
public function register(): string
{
// Preliminarily set registration to failed
$redirect = route('auth.register');
if (!session_check()) {
return view('auth/register', compact('registered_username'));
}
// Check if authentication is disallowed
if (config('user.disable_registration')) {
$message = 'Registration is disabled for security checkups! Try again later.';
return view('global/information', compact('message', 'redirect'));
return $this->json(['error' => 'Registration is currently disabled.']);
}
if (!session_check()) {
// Attempt to check if a user has already registered from the current IP
$getUserIP = DB::table('users')
->where('register_ip', Net::pton(Net::ip()))
->orWhere('last_ip', Net::pton(Net::ip()))
->get();
$vars = [];
if ($getUserIP) {
$vars = [
'haltRegistration' => count($getUserIP) > 1,
'haltName' => $getUserIP[array_rand($getUserIP)]->username,
];
}
return view('auth/register', $vars);
}
// Grab forms
$username = $_POST['username'] ?? null;
$password = $_POST['password'] ?? null;
$email = $_POST['email'] ?? null;
// Append username and email to the redirection url
$redirect .= "?username={$username}&email={$email}";
// Attempt to get account data
$user = User::construct(clean_string($username, true, true));
// Check if the username already exists
if ($user && $user->id !== 0) {
$message = "{$user->username} is already a member here!"
. " If this is you please use the password reset form instead of making a new account.";
return view('global/information', compact('message', 'redirect'));
. "\r\nIf this is you please use the password reset form instead of making a new account.";
return $this->json(['error' => $message]);
}
// Username too short
if (strlen($username) < config('user.name_min')) {
$message = 'Your name must be at least 3 characters long.';
return view('global/information', compact('message', 'redirect'));
return $this->json(['error' => 'Your name must be at least 3 characters long.']);
}
// Username too long
if (strlen($username) > config('user.name_max')) {
$message = 'Your name can\'t be longer than 16 characters.';
return view('global/information', compact('message', 'redirect'));
return $this->json(['error' => "Your name can't be longer than 16 characters."]);
}
// Check if the given email address is formatted properly
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$message = 'Your e-mail address is formatted incorrectly.';
return view('global/information', compact('message', 'redirect'));
return $this->json(['error' => 'Your e-mail address is formatted incorrectly.']);
}
// Check the MX record of the email
if (!check_mx_record($email)) {
$message = 'No valid MX-Record found on the e-mail address you supplied.';
return view('global/information', compact('message', 'redirect'));
return $this->json(['error' => 'No valid MX-Record found on the e-mail address you supplied.']);
}
// Check if the e-mail has already been used
@ -203,122 +182,81 @@ class AuthController extends Controller
->where('email', $email)
->count();
if ($emailCheck) {
$message = 'Someone already registered using this email!';
return view('global/information', compact('message', 'redirect'));
return $this->json(['error' => 'Someone already registered using this email!']);
}
// Check password entropy
if (password_entropy($password) < config('user.pass_min_entropy')) {
$message = 'Your password is too weak, try adding some special characters.';
return view('global/information', compact('message', 'redirect'));
return $this->json([
'error' => 'Your password is considered too weak, try adding some special characters.'
]);
}
$requireActive = boolval(config('user.require_activation'));
$user = User::create($username, $password, $email, !$requireActive);
$activation = boolval(config('user.require_activation'));
$user = User::create($username, $password, $email, !$activation);
// Check if we require e-mail activation
if ($requireActive) {
if ($activation) {
$message = 'Almost there, only activation is left! Please check your e-mail for the link.';
$this->sendActivationMail($user);
} else {
$this->authenticate($user);
}
// Return true with a specific message if needed
$redirect = route('main.index');
$message = 'Your registration went through!';
$message .= $requireActive ? ' An activation e-mail has been sent.' : ' Welcome to ' . config('general.name') . '!';
return view('global/information', compact('message', 'redirect'));
return $this->json(['text' => $message ?? null, 'go' => route('main.index')]);
}
/**
* Do a activation attempt.
* Do a (re)activation attempt.
* @return string
*/
public function activate(): string
{
// Preliminarily set activation to failed
$redirect = route('main.index');
// activation link handler
if (isset($_GET['u'], $_GET['k'])) {
$user = User::construct($_GET['u'] ?? null);
// Attempt to get the required GET parameters
$userId = $_GET['u'] ?? 0;
$key = $_GET['k'] ?? "";
// Attempt to create a user object
$user = User::construct($userId);
// Quit if the user ID is 0
if ($user->id === 0) {
$message = "This user does not exist! Contact us if you think this isn't right.";
return view('global/information', compact('message', 'redirect'));
}
// Check if the user is already active
if ($user->activated) {
$message = "Your account is already activated! Why are you here?";
return view('global/information', compact('message', 'redirect'));
}
// Validate the activation key
$action = ActionCode::validate('ACTIVATE', $key, $user->id);
if (!$action) {
$message = "Invalid activation code! Contact us if you think this isn't right.";
return view('global/information', compact('message', 'redirect'));
if ($user->id === 0
|| $user->activated
|| !ActionCode::validate('ACTIVATE', $_GET['k'] ?? null, $user->id)) {
return view('auth/activate_failed');
}
DB::table('users')
->where('user_id', $userId)
->where('user_id', $user->id)
->update(['user_activated' => 1]);
$redirect = route('main.index');
$message = "Your account is activated, welcome to " . config('general.name') . "!";
return view('global/information', compact('message', 'redirect'));
$this->authenticate($user);
return redirect(route('main.index'));
}
/**
* Do a reactivation preparation attempt.
* @return string
*/
public function reactivate(): string
{
// Validate session
if (!session_check()) {
return view('auth/reactivate');
// resend handler
if (session_check() && isset($_POST['username'], $_POST['email'])) {
$id = DB::table('users')
->where('username_clean', clean_string($_POST['username'], true))
->where('email', clean_string($_POST['email'], true))
->value('user_id');
if (!$id) {
return $this->json(['error' => "Couldn't find this username/e-mail combination, double check them!"]);
}
// Preliminarily set registration to failed
$redirect = route('auth.reactivate');
$user = User::construct($id);
// Grab forms
$username = isset($_POST['username']) ? clean_string($_POST['username'], true) : null;
$email = isset($_POST['email']) ? clean_string($_POST['email'], true) : null;
// Do database request
$getUser = DB::table('users')
->where('username_clean', $username)
->where('email', $email)
->get(['user_id']);
// Check if user exists
if (!$getUser) {
$message = "User not found! Double check your username and e-mail address!";
return view('global/information', compact('message', 'redirect'));
}
// Create user object
$user = User::construct($getUser[0]->user_id);
// Check if a user is activated
if ($user->activated) {
$message = "Your account is already activated! Why are you here?";
return view('global/information', compact('message', 'redirect'));
return $this->json(['error' => 'Your account is already activated! Why are you here?', 'go' => route('main.index')]);
}
// Send activation e-mail to user
$this->sendActivationMail($user);
$redirect = route('main.index');
$message = "Sent the e-mail! Make sure to check your spam folder as well!";
return view('global/information', compact('message', 'redirect'));
return $this->json([
'text' => "The e-mail should be on its way, don't forget to also check your spam folder!",
'go' => route('main.index')
]);
}
return view('auth/activate');
}
/**
@ -327,64 +265,54 @@ class AuthController extends Controller
*/
public function resetPassword(): string
{
// Validate session
if (!session_check()) {
return view('auth/resetpassword');
}
// Preliminarily set action to failed
$redirect = route('main.index');
// Attempt to get the various required GET parameters
if (session_check()) {
$userId = $_POST['user'] ?? 0;
$key = $_POST['key'] ?? "";
$password = $_POST['password'] ?? "";
$userName = clean_string($_POST['username'] ?? "", true);
$email = clean_string($_POST['email'] ?? "", true);
// Create user object
$user = User::construct($userId ? $userId : $userName);
// Quit if the user ID is 0
if ($user->id === 0 || ($email !== null ? $email !== $user->email : false)) {
$message = "This user does not exist! Contact us if you think this isn't right.";
return view('global/information', compact('message', 'redirect'));
if ($user->id === 0 || (strlen($email) > 0 ? $email !== $user->email : false)) {
return $this->json(['error' => "This user does not exist! Contact us if you think this isn't right."]);
}
// Check if the user is active
if (!$user->activated) {
$message = "Your account is deactivated, go activate it first...";
return view('global/information', compact('message', 'redirect'));
return $this->json([
'error' => "Your account isn't activated, go activate it first...",
'go' => route('auth.activate'),
]);
}
if ($key && $password) {
// Check password entropy
if (password_entropy($password) < config('user.pass_min_entropy')) {
$message = "Your password doesn't meet the strength requirements!";
return view('global/information', compact('message', 'redirect'));
return $this->json(['error' => "Your password doesn't meet the strength requirements!"]);
}
// Validate the activation key
$action = ActionCode::validate('LOST_PASS', $key, $user->id);
if (!$action) {
$message = "Invalid verification code! Contact us if you think this isn't right.";
return view('global/information', compact('message', 'redirect'));
return $this->json(['error' => "Invalid verification code! Contact us if you think this isn't right."]);
}
$user->setPassword($password);
$this->authenticate($user);
$message = "Changed your password! You may now log in.";
$redirect = route('main.index');
} else {
// Send the e-mail
$this->sendPasswordMail($user);
$message = "Sent the e-mail, keep an eye on your spam folder as well!";
$redirect = route('main.index');
return $this->json([
'text' => "Changed your password!",
'go' => route('main.index'),
]);
}
return view('global/information', compact('message', 'redirect'));
$this->sendPasswordMail($user);
return $this->json([
'text' => "The e-mail should be on its way, don't forget to also check your spam folder!",
'go' => route('main.index'),
]);
}
return view('auth/resetpassword');
}
/**

1
app/Controllers/Settings/AdvancedController.php
View file

@ -8,6 +8,7 @@ namespace Sakura\Controllers\Settings;
use Phroute\Phroute\Exception\HttpMethodNotAllowedException;
use Sakura\CurrentSession;
use Sakura\DB;
use Sakura\Session;
/**

4
app/Controllers/UserController.php
View file

@ -34,7 +34,7 @@ class UserController extends Controller
if ($profile->id === 0) {
// Fetch from username_history
$check = DB::table('username_history')
->where('username_old_clean', clean_string($id, true, true))
->where('username_old_clean', clean_string($id, true))
->orderBy('change_id', 'desc')
->first();
@ -55,7 +55,7 @@ class UserController extends Controller
public function resolve(string $name): string
{
$id = DB::table('users')
->where('username_clean', clean_string($name, true, true))
->where('username_clean', clean_string($name, true))
->value('user_id');
if (!$id) {

68
resources/views/yuuno/auth/activate.twig Normal file
View file

@ -0,0 +1,68 @@
{% extends 'master.twig' %}
{% set title = 'Request activation' %}
{% block js %}
<script>
function yuunoAttemptActivationResend(form) {
var client = new Sakura.AJAX,
sndBtn = Sakura.DOM.ID('snd-btn');
sndBtn.disabled = true;
sndBtn.innerHTML = '<i class="fa fa-spinner fa-spin"></i>';
Sakura.DOM.AddClass(sndBtn, ['input__button--disabled']);
client.SetUrl("{{ route('auth.activate') }}");
client.SetFormData(new FormData(form));
client.AddCallback(200, function () {
sndBtn.disabled = false;
sndBtn.innerHTML = '<i class="fa fa-envelope"></i> Resend e-mail';
Sakura.DOM.RemoveClass(sndBtn, ['input__button--disabled']);
var result = client.JSON();
if (result.error || result.text) {
var dialogue = new Sakura.Dialogue;
dialogue.Title = "Request activation";
dialogue.Text = result.error || result.text;
dialogue.AddCallback(Sakura.DialogueButton.Ok, function () {
this.Close();
if (result.go) {
window.location.assign(result.go);
}
});
dialogue.Display();
} else if (result.go) {
window.location.assign(result.go);
}
});
client.Start(Sakura.HTTPMethod.POST);
}
</script>
{% endblock %}
{% block content %}
<div class="auth content content--auth">
<div class="content__header">
Request activation
</div>
<form method="post" action="javascript:void(0)" onsubmit="yuunoAttemptActivationResend(this)">
<input type="hidden" name="session" value="{{ session_id() }}">
<label>
<div class="auth__label">Username</div>
<input class="input__text" type="text" name="username" autofocus placeholder="The username you signed up with">
</label>
<label>
<div class="auth__label">E-mail</div>
<input class="input__text" type="text" name="email" placeholder="The e-mail you signed up with">
</label>
<button class="input__button auth__button" id="snd-btn">
<i class="fa fa-envelope"></i> Resend e-mail
</button>
<div class="auth__subtext">
If you lost access to your e-mail account, <a href="{{ route('info.contact') }}">please contact us</a>.
</div>
</form>
</div>
{% endblock %}

24
resources/views/yuuno/auth/activate_failed.twig Normal file
View file

@ -0,0 +1,24 @@
{% extends 'master.twig' %}
{% set title = 'Activation failed' %}
{% block content %}
<div class="auth content content--auth">
<div class="content__header">
Activation failed
</div>
<div style="text-align: left; padding: 10px">
<p>Something went wrong while trying to activate your account!</p>
<p>This can be caused by the following things:</p>
<ul style="padding-left: 20px; list-style: square">
<li>Your account has been deleted in the time it took you to activate (+30 days).</li>
<li>Your account is already activated. In which case, why are you even here?</li>
<li>Your activation code somehow got invalidated. <a href="{{ route('info.contact') }}">Contact us</a> if you think this is the case.</li>
</ul>
<p>Or alternatively...</p>
</div>
<a class="input__button auth__button" href="{{ route('auth.activate') }}">
<i class="fa fa-repeat"></i> Resend activation e-mail
</a>
</div>
{% endblock %}

24
resources/views/yuuno/auth/reactivate.twig
View file

@ -1,24 +0,0 @@
{% extends 'master.twig' %}
{% set title = 'Reactivate account' %}
{% block content %}
<div class="auth content content--auth">
<div class="content__header">
Reactivate account
</div>
<form method="post" action="{{ route('auth.reactivate') }}">
<label>
<div class="auth__label">Username</div>
<input class="input__text" type="text" name="username" autofocus>
</label>
<label>
<div class="auth__label">E-mail</div>
<input class="input__text" type="text" name="email">
</label>
<button class="input__button auth__button" name="session" value="{{ session_id() }}">
Request Activation
</button>
</form>
</div>
{% endblock %}

63
resources/views/yuuno/auth/register.twig
View file

@ -2,36 +2,77 @@
{% set title = 'Register' %}
{% block js %}
<script>
function yuunoAttemptRegistration(form) {
var client = new Sakura.AJAX,
regBtn = Sakura.DOM.ID('reg-btn');
regBtn.disabled = true;
regBtn.innerHTML = '<i class="fa fa-spinner fa-spin"></i>';
Sakura.DOM.AddClass(regBtn, ['input__button--disabled']);
client.SetUrl("{{ route('auth.register') }}");
client.SetFormData(new FormData(form));
client.AddCallback(200, function () {
regBtn.disabled = false;
regBtn.innerHTML = '<i class="fa fa-magic"></i> Register';
Sakura.DOM.RemoveClass(regBtn, ['input__button--disabled']);
var result = client.JSON();
if (result.error || result.text) {
var dialogue = new Sakura.Dialogue;
dialogue.Title = "Registration";
dialogue.Text = result.error || result.text;
dialogue.AddCallback(Sakura.DialogueButton.Ok, function () {
this.Close();
if (result.go) {
window.location.assign(result.go);
}
});
dialogue.Display();
} else if (result.go) {
window.location.assign(result.go);
}
});
client.Start(Sakura.HTTPMethod.POST);
}
</script>
{% endblock %}
{% block content %}
<div class="auth content content--auth">
{% if config('user.disable_registration') %}
<div class="fa fa-remove fa-5x auth__blocked"></div>
<h1>Registration is disabled.</h1>
<p>Please try again later.</p>
{% else %}
<div class="content__header">
Register
</div>
<form id="registerForm" method="post" action="{{ route('auth.register') }}">
{% if config('user.disable_registration') %}
<div class="fa fa-remove fa-5x auth__blocked"></div>
<h1>You can't create an account right now!</h1>
<p>Please try again later, sorry for the inconvenience.</p>
{% else %}
<form id="registerForm" method="post" action="javascript:void(0)" onsubmit="yuunoAttemptRegistration(this)">
<input type="hidden" name="session" value="{{ session_id() }}">
<label>
<div class="auth__label">Username</div>
<input class="input__text" type="text" name="username" autofocus placeholder="Any character"{% if get.username is defined %} value="{{ get.username }}"{% endif %}>
<input class="input__text" type="text" name="username" required autofocus placeholder="Any character">
</label>
<label>
<div class="auth__label">E-mail</div>
<input class="input__text" type="text" name="email" placeholder="Used for e.g. password retrieval"{% if get.email is defined %} value="{{ get.email }}"{% endif %}>
<input class="input__text" type="text" name="email" required placeholder="Used for e.g. password retrieval">
</label>
<label>
<div class="auth__label">Password</div>
<input class="input__text" type="password" name="password" placeholder="Using special characters is recommended">
<input class="input__text" type="password" name="password" required placeholder="Using special characters is recommended">
</label>
<button class="input__button auth__button" name="session" value="{{ session_id() }}">
<button class="input__button auth__button" id="reg-btn">
<i class="fa fa-magic"></i> Register
</button>
<div class="auth__subtext">
By creating an account you agree to the <a href="{{ route('info.terms') }}">Terms of Service</a>.<br>
You are only allowed to make a single account.<br>
Didn't get your activation e-mail? <a href="{{ route('auth.reactivate') }}">Click here to resend it</a>!
Didn't get your activation e-mail? <a href="{{ route('auth.activate') }}">Click here to resend it</a>!
</div>
</form>
{% endif %}

57
resources/views/yuuno/auth/resetpassword.twig
View file

@ -1,15 +1,60 @@
{% extends 'master.twig' %}
{% set title = 'Reset Password' %}
{% set title = 'Reset password' %}
{% set verified = get.u is defined and get.k is defined %}
{% block js %}
<script>
function yuunoAttemptPasswordReset(form) {
var client = new Sakura.AJAX;
{% if not verified %}
var sndBtn = Sakura.DOM.ID('snd-btn');
sndBtn.disabled = true;
sndBtn.innerHTML = '<i class="fa fa-spinner fa-spin"></i>';
Sakura.DOM.AddClass(sndBtn, ['input__button--disabled']);
{% endif %}
client.SetUrl("{{ route('auth.resetpassword') }}");
client.SetFormData(new FormData(form));
client.AddCallback(200, function () {
{% if not verified %}
sndBtn.disabled = false;
sndBtn.innerHTML = '<i class="fa fa-envelope"></i> Send e-mail';
Sakura.DOM.RemoveClass(sndBtn, ['input__button--disabled']);
{% endif %}
var result = client.JSON();
if (result.error || result.text) {
var dialogue = new Sakura.Dialogue;
dialogue.Title = "Reset password";
dialogue.Text = result.error || result.text;
dialogue.AddCallback(Sakura.DialogueButton.Ok, function () {
this.Close();
if (result.go) {
window.location.assign(result.go);
}
});
dialogue.Display();
} else if (result.go) {
window.location.assign(result.go);
}
});
client.Start(Sakura.HTTPMethod.POST);
}
</script>
{% endblock %}
{% block content %}
<div class="auth content content--auth">
<div class="content__header">
Reset Password
Reset password
</div>
<form method="post" action="{{ route('auth.resetpassword') }}" id="passwordForm">
<form method="post" action="javascript:void(0)" onsubmit="yuunoAttemptPasswordReset(this)">
<input type="hidden" name="session" value="{{ session_id() }}">
{% if get.u is defined and get.k is defined %}
{% if verified %}
<input type="hidden" name="user" value="{{ get.u }}">
<input type="hidden" name="key" value="{{ get.k }}">
<label>
@ -28,8 +73,8 @@
<div class="auth__label">E-mail</div>
<input class="input__text" type="text" name="email">
</label>
<button class="input__button auth__button">
<i class="fa fa-envelope"></i> Request Change
<button class="input__button auth__button" id="snd-btn">
<i class="fa fa-envelope"></i> Send e-mail
</button>
<div class="auth__subtext">
<a href="{{ route('info.contact') }}">Contact us</a> if you lost access to your e-mail address!

14
resources/views/yuuno/global/information.twig
View file

@ -1,14 +0,0 @@
{% extends 'master.twig' %}
{% set title = 'Information' %}
{% block content %}
<div class="content content--alt">
<div>
<h1>Information</h1>
<hr>
{{ message|default('') }}
{% if redirect is defined %}<br><a href="{{ redirect }}">Click here if you aren't being redirected.</a>{% endif %}
</div>
</div>
{% endblock %}

2
resources/views/yuuno/user/profile.twig
View file

@ -175,7 +175,7 @@
<div style="padding: 20px;">
<h1>The requested user does not exist!</h1>
There are a few possible reasons for this:
<ul style="padding-left: 40px;">
<ul style="padding-left: 40px; list-style: square">
<li>They changed their username.</li>
<li>They may have been restricted.</li>
<li>You made a typo.</li>

3
routes.php
View file

@ -61,9 +61,8 @@ Router::group(['before' => 'maintenance'], function () {
Router::post('/register', 'AuthController@register', 'auth.register');
Router::get('/reset-password', 'AuthController@resetPassword', 'auth.resetpassword');
Router::post('/reset-password', 'AuthController@resetPassword', 'auth.resetpassword');
Router::get('/reactivate', 'AuthController@reactivate', 'auth.reactivate');
Router::post('/reactivate', 'AuthController@reactivate', 'auth.reactivate');
Router::get('/activate', 'AuthController@activate', 'auth.activate');
Router::post('/activate', 'AuthController@activate', 'auth.activate');
});
// Info