This repository has been archived on 2024-06-26. You can view files and clone it, but cannot push or open issues or pull requests.
sakura/public/authenticate.php

217 lines
7.9 KiB
PHP
Raw Normal View History

2015-04-06 21:23:54 +00:00
<?php
/*
* Sakura Authentication Page
*/
// Declare Namespace
namespace Sakura;
// Include components
require_once str_replace(basename(__DIR__), '', dirname(__FILE__)) . 'sakura.php';
2015-04-06 21:23:54 +00:00
2015-04-08 17:18:19 +00:00
// Page actions
if (isset($_REQUEST['mode'])) {
2015-04-17 22:51:53 +00:00
// Continue
$continue = true;
2015-04-08 17:18:19 +00:00
2015-09-14 21:41:43 +00:00
// Make sure we're not in activate mode since adding a timestamp
// and accessing the PHP session id is kind of hard when you're in an e-mail client
if (!isset($_REQUEST['mode']) || $_REQUEST['mode'] != 'activate') {
2015-04-19 13:00:32 +00:00
// Compare time and session so we know the link isn't forged
if (!isset($_REQUEST['time']) || $_REQUEST['time'] < time() - 1000) {
2015-04-19 13:00:32 +00:00
$renderData['page'] = [
'redirect' => $urls->format('AUTH_ACTION'),
'message' => 'Timestamps differ too much, refresh the page and try again.',
'success' => 0,
2015-04-19 13:00:32 +00:00
];
2015-04-19 13:00:32 +00:00
// Prevent
$continue = false;
}
2015-04-17 22:51:53 +00:00
2015-04-19 13:00:32 +00:00
// Match session ids for the same reason
if (!isset($_REQUEST['session']) || $_REQUEST['session'] != session_id()) {
2015-04-19 13:00:32 +00:00
$renderData['page'] = [
'redirect' => $urls->format('AUTH_ACTION'),
'message' => 'Invalid session, please try again.',
'success' => 0,
2015-04-19 13:00:32 +00:00
];
2015-04-17 22:51:53 +00:00
2015-04-19 13:00:32 +00:00
// Prevent
$continue = false;
}
2015-04-17 22:51:53 +00:00
}
2015-04-18 11:35:16 +00:00
// Login check
if (Users::checkLogin()) {
if (!in_array($_REQUEST['mode'], ['logout'])) {
2015-04-18 11:35:16 +00:00
$continue = false;
2015-04-25 20:08:44 +00:00
// Add page specific things
$renderData['page'] = [
'redirect' => $urls->format('SITE_HOME'),
'message' => 'You are already authenticated. Redirecting...',
'success' => 1,
2015-04-25 20:08:44 +00:00
];
}
2015-04-18 11:35:16 +00:00
}
if ($continue) {
switch ($_REQUEST['mode']) {
2015-04-21 14:23:28 +00:00
case 'changepassword':
2015-04-25 20:08:44 +00:00
// Attempt change
2015-09-14 21:41:43 +00:00
$passforget = Users::resetPassword(
$_REQUEST['verk'],
$_REQUEST['uid'],
$_REQUEST['newpw'],
$_REQUEST['verpw']
);
2015-04-25 20:08:44 +00:00
// Array containing "human understandable" messages
$messages = [
'INVALID_VERK' => 'The verification key supplied was invalid!',
'INVALID_CODE' => 'Invalid verification key, if you think this is an error contact the administrator.',
'INVALID_USER' => 'The used verification key is not designated for this user.',
'VERK_TOO_SHIT' => 'Your verification code is too weak, try adding some special characters.',
'PASS_TOO_SHIT' => 'Your password is too weak, try adding some special characters.',
'PASS_NOT_MATCH' => 'Passwords do not match.',
'SUCCESS' => 'Successfully changed your password, you may now log in.',
2015-04-25 20:08:44 +00:00
];
2015-04-21 14:23:28 +00:00
// Add page specific things
$renderData['page'] = [
2015-09-14 21:41:43 +00:00
'redirect' => (
$passforget[0] ?
$urls->format('SITE_LOGIN') :
$_SERVER['PHP_SELF'] . '?pw=true&uid=' . $_REQUEST['uid'] . '&verk=' . $_REQUEST['verk']
),
'message' => $messages[$passforget[1]],
'success' => $passforget[0],
2015-04-21 14:23:28 +00:00
];
break;
2015-04-19 13:00:32 +00:00
// Resending the activation e-mail
case 'resendactivemail':
// Attempt send
2015-04-21 14:23:28 +00:00
$resend = Users::resendActivationMail($_REQUEST['username'], $_REQUEST['email']);
// Array containing "human understandable" messages
$messages = [
'AUTH_LOCKED' => 'Authentication is currently not allowed, try again later.',
'USER_NOT_EXIST' => 'The user you tried to activate does not exist (confirm the username/email combination).',
'USER_ALREADY_ACTIVE' => 'The user you tried to activate is already active.',
'SUCCESS' => 'The activation e-mail has been sent to the address associated with your account.',
2015-04-21 14:23:28 +00:00
];
// Add page specific things
$renderData['page'] = [
'redirect' => $urls->format('SITE_HOME'),
'message' => $messages[$resend[1]],
'success' => $resend[0],
];
2015-04-19 13:00:32 +00:00
break;
2015-04-17 22:51:53 +00:00
// Unforgetting passwords
case 'forgotpassword':
2015-04-25 20:08:44 +00:00
// Attempt send
$passforgot = Users::sendPasswordForgot($_REQUEST['username'], $_REQUEST['email']);
// Array containing "human understandable" messages
$messages = [
'AUTH_LOCKED' => 'Authentication is currently not allowed, try again later.',
'USER_NOT_EXIST' => 'The requested user does not exist (confirm the username/email combination).',
'NOT_ALLOWED' => 'Your account does not have the required permissions to change your password.',
'SUCCESS' => 'The password reset e-mail has been sent to the address associated with your account.',
2015-04-25 20:08:44 +00:00
];
2015-04-17 22:51:53 +00:00
// Add page specific things
$renderData['page'] = [
'redirect' => $urls->format('SITE_FORGOT_PASSWORD'),
'message' => $messages[$passforgot[1]],
'success' => $passforgot[0],
2015-04-17 22:51:53 +00:00
];
break;
2015-04-08 17:18:19 +00:00
case 'logout':
$renderData['page'] = [
'redirect' => Router::route('main.index'),
'message' => 'Wrong logout page.',
'success' => 0,
];
break;
case 'login':
$renderData['page'] = [
'redirect' => Router::route('auth.login'),
'message' => 'Wrong login page.',
'success' => 0,
];
break;
case 'register':
$renderData['page'] = [
'redirect' => Router::route('auth.register'),
'message' => 'Wrong registration page.',
'success' => 0,
];
break;
2016-03-17 19:09:00 +00:00
case 'activate':
$renderData['page'] = [
'redirect' => Router::route('auth.activate'),
'message' => 'Wrong activation page.',
'success' => 0,
];
break;
2015-04-17 22:51:53 +00:00
}
2015-04-08 17:18:19 +00:00
}
// Print page contents or if the AJAX request is set only display the render data
if (isset($_REQUEST['ajax'])) {
echo $renderData['page']['message'] . '|' .
$renderData['page']['success'] . '|' .
$renderData['page']['redirect'];
} else {
2016-02-04 20:56:40 +00:00
Template::vars($renderData);
echo Template::render('global/information');
}
2015-04-08 19:27:51 +00:00
exit;
2015-04-08 17:18:19 +00:00
}
2015-04-06 21:23:54 +00:00
// Add page specific things
$renderData['auth'] = [
'redirect' => isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : $urls->format('SITE_HOME'),
2015-04-06 21:23:54 +00:00
];
2015-04-25 20:08:44 +00:00
// Check if the user is already logged in
if (Users::checkLogin()) {
2015-04-25 20:08:44 +00:00
// Add page specific things
$renderData['page'] = [
'redirect' => $urls->format('SITE_HOME'),
'message' => 'You are already logged in, log out to access this page.',
2015-04-25 20:08:44 +00:00
];
2016-02-04 20:56:40 +00:00
Template::vars($renderData);
echo Template::render('global/information');
2015-04-25 20:08:44 +00:00
exit;
}
2015-04-21 14:23:28 +00:00
// If password forgot things are set display password forget thing
if (isset($_REQUEST['pw']) && $_REQUEST['pw']) {
2015-04-21 14:23:28 +00:00
$renderData['auth']['changingPass'] = true;
$renderData['auth']['userId'] = $_REQUEST['uid'];
2015-04-21 14:23:28 +00:00
if (isset($_REQUEST['key'])) {
2015-04-21 14:23:28 +00:00
$renderData['auth']['forgotKey'] = $_REQUEST['key'];
}
2015-04-21 14:23:28 +00:00
2016-02-04 20:56:40 +00:00
Template::vars($renderData);
echo Template::render('main/forgotpassword');
2015-04-21 14:23:28 +00:00
exit;
}
2015-04-06 21:23:54 +00:00
// Print page contents
2016-02-04 20:56:40 +00:00
Template::vars($renderData);
echo Template::render('main/authenticate');