/** * Method to display the view. * * @param string The template file to include * @since 1.5 */ function display($tpl = null) { // This name will be used to get the model $name = $this->getLayout(); // Check that the name is valid - has an associated model. if (!in_array($name, array('confirm', 'complete'))) { $name = 'default'; } if ('default' == $name) { $formname = 'Form'; } else { $formname = ucfirst($this->_name) . ucfirst($name) . 'Form'; } // Get the view data. $this->form = $this->get($formname); $this->state = $this->get('State'); $this->params = $this->state->params; // Check for errors. if (count($errors = $this->get('Errors'))) { App::abort(500, implode('<br />', $errors)); return false; } //Escape strings for HTML output $this->pageclass_sfx = htmlspecialchars($this->params->get('pageclass_sfx')); $this->prepareDocument(); $password_rules = \Hubzero\Password\Rule::getRules(); $this->password_rules = array(); foreach ($password_rules as $rule) { if (!empty($rule['description'])) { $this->password_rules[] = $rule['description']; } } parent::display($tpl); }
/** * Processes the password set form * * @return void */ public function settingpasswordTask() { // Check for request forgeries Session::checkToken('post') or exit(Lang::txt('JINVALID_TOKEN')); // Get the token and user id from the verification process $token = User::getState('com_users.reset.token', null); $id = User::getState('com_users.reset.user', null); $no_html = Request::getInt('no_html', 0); // Check the token and user id if (empty($token) || empty($id)) { throw new Exception(Lang::txt('COM_MEMBERS_CREDENTIALS_ERROR_TOKENS_MISSING'), 403); } // Get the user object $user = \Hubzero\User\User::oneOrFail($id); // Check for a user and that the tokens match if ($user->tokens()->latest()->token !== $token) { App::redirect(Route::url('index.php?option=' . $this->_option . '&task=setpassword', false), Lang::txt('COM_MEMBERS_CREDENTIALS_ERROR_USER_NOT_FOUND'), 'warning'); return; } // Make sure the user isn't blocked if ($user->get('block')) { App::redirect(Route::url('index.php?option=' . $this->_option . '&task=setpassword', false), Lang::txt('COM_MEMBERS_CREDENTIALS_ERROR_USER_NOT_FOUND'), 'warning'); return; } if (\Hubzero\User\Helper::isXDomainUser($user->get('id'))) { throw new Exception(Lang::txt('COM_MEMBERS_CREDENTIALS_ERROR_LINKED_ACCOUNT'), 403); } $password_rules = \Hubzero\Password\Rule::all()->whereEquals('enabled', 1)->rows(); $password1 = trim(Request::getVar('password1', null)); $password2 = trim(Request::getVar('password2', null)); if (!empty($password1)) { $msg = \Hubzero\Password\Rule::verify($password1, $password_rules, $user->get('username')); } else { $msg = array(); } require_once dirname(dirname(__DIR__)) . DS . 'helpers' . DS . 'utility.php'; $error = false; $changing = true; if (!$password1 || !$password2) { $error = Lang::txt('COM_MEMBERS_CREDENTIALS_ERROR_PASSWORD_TWICE'); } elseif ($password1 != $password2) { $error = Lang::txt('COM_MEMBERS_CREDENTIALS_ERROR_PASSWORD_DONT_MATCH'); } elseif (!\Components\Members\Helpers\Utility::validpassword($password1)) { $error = Lang::txt('COM_MEMBERS_CREDENTIALS_ERROR_PASSWORD_INVALID'); } elseif (!empty($msg)) { $error = Lang::txt('COM_MEMBERS_CREDENTIALS_ERROR_PASSWORD_FAILS_REQUIREMENTS'); } // If we're resetting password to the current password, just return true // That way you can't reset the counter on your current password, or invalidate it by putting it into history if (\Hubzero\User\Password::passwordMatches($user->get('id'), $password1)) { $error = false; $changing = false; $result = true; } if ($error) { if ($no_html) { $response = array('success' => false, 'message' => $error); echo json_encode($response); die; } else { App::redirect(Route::url('index.php?option=' . $this->_option . '&task=setpassword', false), $error, 'warning'); return; } } if ($changing) { // Encrypt the password and update the profile $result = \Hubzero\User\Password::changePassword($user->get('username'), $password1); } // Save the changes if (!$result) { if ($no_html) { $response = array('success' => false, 'message' => Lang::txt('COM_MEMBERS_CREDENTIALS_ERROR_GENERIC')); echo json_encode($response); die; } else { App::redirect(Route::url('index.php?option=' . $this->_option . '&task=setpassword', false), Lang::txt('COM_MEMBERS_CREDENTIALS_ERROR_GENERIC'), 'warning'); return; } } // Flush the user data from the session User::setState('com_users.reset.token', null); User::setState('com_users.reset.user', null); if ($no_html) { $response = array('success' => true, 'redirect' => Route::url('index.php?option=com_users&view=login', false)); echo json_encode($response); die; } else { // Everything went well...go to the login page App::redirect(Route::url('index.php?option=com_users&view=login', false), Lang::txt('COM_MEMBERS_CREDENTIALS_PASSWORD_RESET_COMPLETE'), 'passed'); } }
/** * Check data * * @param string $task * @param integer $id * @return boolean */ public function check($task = 'create', $id = 0, $field_to_check = array()) { $sitename = Config::get('sitename'); if ($id == 0) { $id = User::get('id'); } $registration = $this->_registration; if ($task == 'proxy') { $task = 'proxycreate'; } $this->_missing = array(); $this->_invalid = array(); $registrationUsername = $this->registrationField('registrationUsername', 'RROO', $task); $registrationPassword = $this->registrationField('registrationPassword', 'RRHH', $task); $registrationConfirmPassword = $this->registrationField('registrationConfirmPassword', 'RRHH', $task); $registrationFullname = $this->registrationField('registrationFullname', 'RRRR', $task); $registrationEmail = $this->registrationField('registrationEmail', 'RRRR', $task); $registrationConfirmEmail = $this->registrationField('registrationConfirmEmail', 'RRRR', $task); $registrationOptIn = $this->registrationField('registrationOptIn', 'HHHH', $task); $registrationCAPTCHA = $this->registrationField('registrationCAPTCHA', 'HHHH', $task); $registrationTOU = $this->registrationField('registrationTOU', 'HHHH', $task); if ($task == 'update') { if (empty($registration['login'])) { $registrationUsername = REG_REQUIRED; } else { $registrationUsername = REG_READONLY; } $registrationPassword = REG_HIDE; $registrationConfirmPassword = REG_HIDE; if (empty($registration['email'])) { $registrationEmail = REG_REQUIRED; } } if ($task == 'edit') { $registrationUsername = REG_READONLY; $registrationPassword = REG_HIDE; $registrationConfirmPassword = REG_HIDE; } if (User::get('auth_link_id') && $task == 'create') { $registrationPassword = REG_HIDE; $registrationConfirmPassword = REG_HIDE; } $login = $registration['login']; $email = $registration['email']; $confirmEmail = $registration['confirmEmail']; if ($registrationUsername == REG_REQUIRED) { if (empty($login)) { $this->_missing['login'] = '******'; $this->_invalid['login'] = '******'; } } if ($registrationUsername != REG_HIDE) { $allowNumericFirstCharacter = $task == 'update' ? true : false; if (!empty($login) && !Helpers\Utility::validlogin($login, $allowNumericFirstCharacter)) { $this->_invalid['login'] = '******'; } } if (!empty($login) && ($task == 'create' || $task == 'proxycreate' || $task == 'update')) { $uid = User::getInstance($login)->get('id'); if ($uid && $uid != $id) { $this->_invalid['login'] = '******' . htmlentities($login) . '" already exists. Please try another.'; } if (\Hubzero\Utility\Validate::reserved('username', $login)) { $this->_invalid['login'] = '******' . htmlentities($login) . '" already exists. Please try another.'; } // system username check $puser = posix_getpwnam($login); if (!empty($puser) && $uid && $uid != $puser['uid']) { // log error and display error to user \Log::error('System username/userid does not match DB username/password for user: '******'login'] = '******'; } } if ($registrationPassword == REG_REQUIRED) { if (empty($registration['password'])) { $this->_missing['password'] = '******'; $this->_invalid['password'] = '******'; } } /* if ($registrationPassword != REG_HIDE) { if (!empty($registration['password'])) { $result = Helpers\Utility::valid_password($registration['password']); if ($result) $this->_invalid['password'] = $result; } } */ if ($registrationConfirmPassword == REG_REQUIRED) { if (empty($registration['confirmPassword'])) { $this->_missing['confirmPassword'] = '******'; $this->_invalid['confirmPassword'] = '******'; } } if ($registrationPassword != REG_HIDE && $registrationConfirmPassword != REG_HIDE) { if ($registration['password'] != $registration['confirmPassword']) { $this->_invalid['confirmPassword'] = '******'; } } if ($registrationPassword == REG_REQUIRED) { $score = $this->scorePassword($registration['password'], $registration['login']); if ($score < PASS_SCORE_MEDIOCRE) { $this->_invalid['password'] = '******'; } else { if ($score >= PASS_SCORE_MEDIOCRE && $score < PASS_SCORE_GOOD) { // Mediocre pass } else { if ($score >= PASS_SCORE_GOOD && $score < PASS_SCORE_STRONG) { // Good pass } else { if ($score >= PASS_SCORE_STRONG) { // Strong pass } } } } $rules = \Hubzero\Password\Rule::all()->whereEquals('enabled', 1)->rows(); $msg = \Hubzero\Password\Rule::verify($registration['password'], $rules, $login, $registration['name']); if (!empty($msg)) { $this->_invalid['password'] = $msg; } } if ($registrationFullname == REG_REQUIRED) { if (empty($registration['name'])) { $this->_missing['name'] = 'Full Name'; $this->_invalid['name'] = 'Please provide a name.'; } else { $bits = explode(' ', $registration['name']); $surname = null; $middleName = null; $givenName = null; if (count($bits) == 1) { $givenName = array_shift($bits); } else { $surname = array_pop($bits); if (count($bits) >= 1) { $givenName = array_shift($bits); } if (count($bits) >= 1) { $middleName = implode(' ', $bits); } } if (!$givenName || !$surname) { $this->_missing['name'] = 'Full Name'; $this->_invalid['name'] = 'Please provide a name.'; } } } if ($registrationFullname != REG_HIDE) { if (!empty($registration['name']) && !Helpers\Utility::validname($registration['name'])) { $this->_invalid['name'] = 'Invalid name. You may be using characters that are not allowed.'; } } if ($registrationEmail == REG_REQUIRED) { if (empty($email)) { $this->_missing['email'] = 'Valid Email'; $this->_invalid['email'] = 'Please provide a valid e-mail address.'; } } if ($registrationEmail != REG_HIDE) { if (empty($email)) { $this->_missing['email'] = 'Valid Email'; } elseif (!Helpers\Utility::validemail($email)) { $this->_invalid['email'] = 'Invalid email address. Please correct and try again.'; } else { $usersConfig = \Component::params('com_users'); $allow_duplicate_emails = $usersConfig->get('allow_duplicate_emails'); // Check if the email is already in use $row = \Hubzero\User\User::all()->whereEquals('email', $email)->where('id', '!=', (int) $id)->row(); $xid = intval($row->get('id')); // 0 = not allowed // 1 = allowed (i.e. no check needed) // 2 = only existing accounts (grandfathered) if ($xid && ($allow_duplicate_emails == 0 || $allow_duplicate_emails == 2)) { if ($allow_duplicate_emails == 0) { $this->_invalid['email'] = 'An existing account is already using this e-mail address.'; } else { if ($allow_duplicate_emails == 2) { // If duplicates are only allowed in grandfathered accounts, // then new accounts shouldn't be created with the same email. if ($task == 'create' || $task == 'proxycreate') { $this->_invalid['email'] = 'An existing account is already using this e-mail address.'; } else { // We also need to catch existing users who might try to change their // email to an existing email address on the hub. For that, we need to // check and see if their email address is changing with this save. $row = \Hubzero\User\User::oneOrNew((int) $id); $currentEmail = $row->get('email'); if ($currentEmail != $email) { $this->_invalid['email'] = 'An existing account is already using this e-mail address.'; } } } } } } } if ($registrationConfirmEmail == REG_REQUIRED) { if (empty($confirmEmail) && empty($this->_invalid['email'])) { $this->_missing['confirmEmail'] = 'Valid Email Confirmation'; $this->_invalid['confirmEmail'] = 'Please provide a valid e-mail address again.'; } } if ($registrationConfirmEmail != REG_HIDE) { if ($email != $confirmEmail) { if (empty($this->_invalid['email'])) { $this->_invalid['confirmEmail'] = 'Email addresses do not match. Please correct and try again.'; $this->_invalid['email'] = 'Email addresses do not match. Please correct and try again.'; } } } if ($registrationOptIn == REG_REQUIRED) { if (is_null($registration['sendEmail']) || intval($registration['sendEmail']) < 0) { $this->_missing['sendEmail'] = 'Receive Email Updates'; $this->_invalid['sendEmail'] = 'Receive Email Updates has not been selected'; } } if ($registrationCAPTCHA == REG_REQUIRED) { $botcheck = Request::getVar('botcheck', ''); if ($botcheck) { $this->_invalid['captcha'] = 'Error: Invalid CAPTCHA response.'; } $validcaptchas = Event::trigger('captcha.onCheckAnswer'); if (count($validcaptchas) > 0) { foreach ($validcaptchas as $validcaptcha) { if (!$validcaptcha) { $this->_invalid['captcha'] = 'Error: Invalid CAPTCHA response.'; } } } } if ($registrationTOU == REG_REQUIRED) { if (empty($registration['usageAgreement'])) { $this->_missing['usageAgreement'] = 'Usage Agreement'; $this->_invalid['usageAgreement'] = 'Registration requires acceptance of the usage agreement'; } } /* Everything below is currently done elsewhere @TODO Move code to here or refactor? if ($registrationAddress == REG_REQUIRED) { if (count($registration['address']) == 0) { $this->_missing['address'] = 'Member Address'; $this->_invalid['address'] = 'Member Address'; } } // Load all fields not hidden $fields = Field::all() ->including(['options', function ($option){ $option ->select('*') ->ordered(); }]) ->where('action_' . $task, '!=', Field::STATE_HIDDEN) ->ordered() ->rows(); if (!isset($registration['_profile'])) { $registration['_profile'] = array(); } // Find missing required fields foreach ($fields as $field) { if ($field->get('type') != 'hidden') { if (!isset($registration['_profile'][$field->get('name')])) { continue; } $value = $registration['_profile'][$field->get('name')]; if (empty($value) && $field->get('action_' . $task) == Field::STATE_REQUIRED) { $this->_missing[$field->get('name')] = $field->get('label'); } } } // Validate input $form = new \Hubzero\Form\Form('profile', array('control' => 'profile')); $form->load(Field::toXml($fields, $action)); $form->bind(new \Hubzero\Config\Registry($registration['_profile'])); if (!$form->validate($registration['_profile'])) { foreach ($form->getErrors() as $error) { $this->_invalid[] = $error; } }*/ // Filter out fields if (!empty($field_to_check)) { if ($this->_missing) { foreach ($this->_missing as $k => $v) { if (!in_array($k, $field_to_check)) { unset($this->_missing[$k]); } } } if ($this->_invalid) { foreach ($this->_invalid as $k => $v) { if (!in_array($k, $field_to_check)) { unset($this->_invalid[$k]); } } } } if (empty($this->_missing) && empty($this->_invalid)) { return true; } return false; }
/** * Short description for 'check' * * Long description (if any) ... * * @param string $task Parameter description (if any) ... * @param integer $id Parameter description (if any) ... * @return boolean Return description (if any) ... */ public function check($task = 'create', $id = 0, $field_to_check = array()) { $sitename = Config::get('sitename'); if ($id == 0) { $id = User::get('id'); } $registration = $this->_registration; if ($task == 'proxy') { $task = 'proxycreate'; } $this->_missing = array(); $_invalid = array(); $registrationUsername = $this->registrationField('registrationUsername', 'RROO', $task); $registrationPassword = $this->registrationField('registrationPassword', 'RRHH', $task); $registrationConfirmPassword = $this->registrationField('registrationConfirmPassword', 'RRHH', $task); $registrationFullname = $this->registrationField('registrationFullname', 'RRRR', $task); $registrationEmail = $this->registrationField('registrationEmail', 'RRRR', $task); $registrationConfirmEmail = $this->registrationField('registrationConfirmEmail', 'RRRR', $task); $registrationURL = $this->registrationField('registrationURL', 'HHHH', $task); $registrationPhone = $this->registrationField('registrationPhone', 'HHHH', $task); $registrationEmployment = $this->registrationField('registrationEmployment', 'HHHH', $task); $registrationOrganization = $this->registrationField('registrationOrganization', 'HHHH', $task); $registrationCitizenship = $this->registrationField('registrationCitizenship', 'HHHH', $task); $registrationResidency = $this->registrationField('registrationResidency', 'HHHH', $task); $registrationSex = $this->registrationField('registrationSex', 'HHHH', $task); $registrationDisability = $this->registrationField('registrationDisability', 'HHHH', $task); $registrationHispanic = $this->registrationField('registrationHispanic', 'HHHH', $task); $registrationRace = $this->registrationField('registrationRace', 'HHHH', $task); $registrationInterests = $this->registrationField('registrationInterests', 'HHHH', $task); $registrationReason = $this->registrationField('registrationReason', 'HHHH', $task); $registrationOptIn = $this->registrationField('registrationOptIn', 'HHHH', $task); $registrationCAPTCHA = $this->registrationField('registrationCAPTCHA', 'HHHH', $task); $registrationTOU = $this->registrationField('registrationTOU', 'HHHH', $task); $registrationAddress = $this->registrationField('registrationAddress', 'OOOO', $task); $registrationORCID = $this->registrationField('registrationORCID', 'HHHO', $task); if ($task == 'update') { if (empty($registration['login'])) { $registrationUsername = REG_REQUIRED; } else { $registrationUsername = REG_READONLY; } $registrationPassword = REG_HIDE; $registrationConfirmPassword = REG_HIDE; if (empty($registration['email'])) { $registrationEmail = REG_REQUIRED; } } if ($task == 'edit') { $registrationUsername = REG_READONLY; $registrationPassword = REG_HIDE; $registrationConfirmPassword = REG_HIDE; } if (User::get('auth_link_id') && $task == 'create') { $registrationPassword = REG_HIDE; $registrationConfirmPassword = REG_HIDE; } $login = $registration['login']; $email = $registration['email']; $confirmEmail = $registration['confirmEmail']; if ($registrationUsername == REG_REQUIRED) { if (empty($login)) { $this->_missing['login'] = '******'; $this->_invalid['login'] = '******'; } } if ($registrationUsername != REG_HIDE) { $allowNumericFirstCharacter = $task == 'update' ? true : false; if (!empty($login) && !Helpers\Utility::validlogin($login, $allowNumericFirstCharacter)) { $this->_invalid['login'] = '******'; } } if (!empty($login) && ($task == 'create' || $task == 'proxycreate' || $task == 'update')) { jimport('joomla.user.helper'); $uid = \JUserHelper::getUserId($login); if ($uid && $uid != $id) { $this->_invalid['login'] = '******' . htmlentities($login) . '" already exists. Please try another.'; } if (\Hubzero\Utility\Validate::reserved('username', $login)) { $this->_invalid['login'] = '******' . htmlentities($login) . '" already exists. Please try another.'; } // system username check $puser = posix_getpwnam($login); if (!empty($puser) && $uid && $uid != $puser['uid']) { // log error and display error to user \Log::error('System username/userid does not match DB username/password for user: '******'login'] = '******'; } } if ($registrationPassword == REG_REQUIRED) { if (empty($registration['password'])) { $this->_missing['password'] = '******'; $this->_invalid['password'] = '******'; } } /* if ($registrationPassword != REG_HIDE) { if (!empty($registration['password'])) { $result = Helpers\Utility::valid_password($registration['password']); if ($result) $this->_invalid['password'] = $result; } } */ if ($registrationConfirmPassword == REG_REQUIRED) { if (empty($registration['confirmPassword'])) { $this->_missing['confirmPassword'] = '******'; $this->_invalid['confirmPassword'] = '******'; } } if ($registrationPassword != REG_HIDE && $registrationConfirmPassword != REG_HIDE) { if ($registration['password'] != $registration['confirmPassword']) { $this->_invalid['confirmPassword'] = '******'; } } if ($registrationPassword == REG_REQUIRED) { $score = $this->scorePassword($registration['password'], $registration['login']); if ($score < PASS_SCORE_MEDIOCRE) { $this->_invalid['password'] = '******'; } else { if ($score >= PASS_SCORE_MEDIOCRE && $score < PASS_SCORE_GOOD) { // Mediocre pass } else { if ($score >= PASS_SCORE_GOOD && $score < PASS_SCORE_STRONG) { // Good pass } else { if ($score >= PASS_SCORE_STRONG) { // Strong pass } } } } $rules = \Hubzero\Password\Rule::getRules(); $msg = \Hubzero\Password\Rule::validate($registration['password'], $rules, $login, $registration['name']); if (!empty($msg)) { $this->_invalid['password'] = $msg; } } if ($registrationFullname == REG_REQUIRED) { if (empty($registration['name'])) { $this->_missing['name'] = 'Full Name'; $this->_invalid['name'] = 'Please provide a name.'; } else { $bits = explode(' ', $registration['name']); $surname = null; $middleName = null; $givenName = null; if (count($bits) == 1) { $givenName = array_shift($bits); } else { $surname = array_pop($bits); if (count($bits) >= 1) { $givenName = array_shift($bits); } if (count($bits) >= 1) { $middleName = implode(' ', $bits); } } if (!$givenName) { $this->_missing['name'] = 'Full Name'; $this->_invalid['name'] = 'Please provide a name.'; } } } if ($registrationFullname != REG_HIDE) { if (!empty($registration['name']) && !Helpers\Utility::validname($registration['name'])) { $this->_invalid['name'] = 'Invalid name. You may be using characters that are not allowed.'; } } if ($registrationEmail == REG_REQUIRED) { if (empty($email)) { $this->_missing['email'] = 'Valid Email'; $this->_invalid['email'] = 'Please provide a valid e-mail address.'; } } if ($registrationEmail != REG_HIDE) { if (empty($email)) { $this->_missing['email'] = 'Valid Email'; } elseif (!Helpers\Utility::validemail($email)) { $this->_invalid['email'] = 'Invalid email address. Please correct and try again.'; } else { $usersConfig = \Component::params('com_users'); $allow_duplicate_emails = $usersConfig->get('allow_duplicate_emails'); // Check if the email is already in use $db = \App::get('db'); $query = "SELECT `id` FROM `#__users` WHERE `email` = " . $db->quote($email) . " AND `id` != " . (int) $id; $db->setQuery($query); $xid = intval($db->loadResult()); // 0 = not allowed // 1 = allowed (i.e. no check needed) // 2 = only existing accounts (grandfathered) if ($xid && ($allow_duplicate_emails == 0 || $allow_duplicate_emails == 2)) { if ($allow_duplicate_emails == 0) { $this->_invalid['email'] = 'An existing account is already using this e-mail address.'; } else { if ($allow_duplicate_emails == 2) { // If duplicates are only allowed in grandfathered accounts, // then new accounts shouldn't be created with the same email. if ($task == 'create' || $task == 'proxycreate') { $this->_invalid['email'] = 'An existing account is already using this e-mail address.'; } else { // We also need to catch existing users who might try to change their // email to an existing email address on the hub. For that, we need to // check and see if their email address is changing with this save. $db = \App::get('db'); $query = "SELECT `email` FROM `#__users` WHERE `id` = " . (int) $id; $db->setQuery($query); $currentEmail = $db->loadResult(); if ($currentEmail != $email) { $this->_invalid['email'] = 'An existing account is already using this e-mail address.'; } } } } } } } if ($registrationConfirmEmail == REG_REQUIRED) { if (empty($confirmEmail) && empty($this->_invalid['email'])) { $this->_missing['confirmEmail'] = 'Valid Email Confirmation'; $this->_invalid['confirmEmail'] = 'Please provide a valid e-mail address again.'; } } if ($registrationConfirmEmail != REG_HIDE) { if ($email != $confirmEmail) { if (empty($this->_invalid['email'])) { $this->_invalid['confirmEmail'] = 'Email addresses do not match. Please correct and try again.'; $this->_invalid['email'] = 'Email addresses do not match. Please correct and try again.'; } } } if ($registrationURL == REG_REQUIRED) { if (empty($registration['web'])) { $this->_missing['web'] = 'Personal Web Page'; $this->_invalid['web'] = 'Please provide a valid website URL'; } } if ($registrationURL != REG_HIDE) { $registration['web'] = trim($registration['web']); if (!empty($registration['web']) && (strstr($registration['web'], ' ') || !Helpers\Utility::validurl($registration['web']))) { $this->_invalid['web'] = 'Invalid web site URL. You may be using characters that are not allowed.'; } } if ($registrationORCID == REG_REQUIRED) { if (empty($registration['orcid'])) { $this->_missing['orcid'] = 'ORCID'; $this->_invalid['orcid'] = 'Please provide a valid ORCID'; } } if ($registrationORCID != REG_HIDE) { if (!empty($registration['orcid']) && !Helpers\Utility::validorcid($registration['orcid'])) { $this->_invalid['orcid'] = 'Invalid ORCID. It should be in the form of XXXX-XXXX-XXXX-XXXX.'; } } if ($registrationPhone == REG_REQUIRED) { if (empty($registration['phone'])) { $this->_missing['phone'] = 'Phone Number'; $this->_invalid['phone'] = 'Please provide a valid phone number'; } } if ($registrationPhone != REG_HIDE) { if (!empty($registration['phone']) && !Helpers\Utility::validphone($registration['phone'])) { $this->_invalid['phone'] = 'Invalid phone number. You may be using characters that are not allowed.'; } } if ($registrationEmployment == REG_REQUIRED) { if (empty($registration['orgtype'])) { $this->_missing['orgtype'] = 'Employment Type'; $this->_invalid['orgtype'] = 'Please make an employment type selection'; } } /* if ($registrationEmployment != REG_HIDE) if (empty($registration['orgtype'])) { //if (!Helpers\Utility::validateOrgType($registration['orgtype']) ) $this->_invalid['orgtype'] = 'Invalid employment status. Please make a new selection.'; } */ if ($registrationOrganization == REG_REQUIRED) { if (empty($registration['org']) && empty($registration['orgtext'])) { $this->_missing['org'] = 'Organization'; $this->_invalid['org'] = 'Invalid affiliation'; } } if ($registrationOrganization != REG_HIDE) { if (!empty($registration['org']) && !Helpers\Utility::validtext($registration['org'])) { $this->_invalid['org'] = 'Invalid affiliation. You may be using characters that are not allowed.'; } elseif (!empty($registration['orgtext']) && !Helpers\Utility::validtext($registration['orgtext'])) { $this->_invalid['org'] = 'Invalid affiliation. You may be using characters that are not allowed.'; } } if ($registrationCitizenship == REG_REQUIRED) { if (empty($registration['countryorigin'])) { $this->_missing['countryorigin'] = 'Country of Citizenship / Permanent Residence'; $this->_invalid['countryorigin'] = 'Invalid country of origin.'; } } if ($registrationCitizenship != REG_HIDE) { if (!empty($registration['countryorigin']) && !Helpers\Utility::validtext($registration['countryorigin'])) { $this->_invalid['countryorigin'] = 'Invalid country of origin. You may be using characters that are not allowed.'; } } if ($registrationResidency == REG_REQUIRED) { if (empty($registration['countryresident'])) { $this->_missing['countryresident'] = 'Country of Current Residence'; $this->_invalid['countryresident'] = 'Invalid country of residency'; } } if ($registrationResidency != REG_HIDE) { if (!empty($registration['countryresident']) && !Helpers\Utility::validtext($registration['countryresident'])) { $this->_invalid['countryresident'] = 'Invalid country of residency. You may be using characters that are not allowed.'; } } if ($registrationSex == REG_REQUIRED) { if (empty($registration['sex'])) { $this->_missing['sex'] = 'Gender'; $this->_invalid['sex'] = 'Please select gender.'; } } if ($registrationSex != REG_HIDE) { if (!empty($registration['sex']) && !Helpers\Utility::validtext($registration['sex'])) { $this->_invalid['sex'] = 'Invalid gender selection.'; } } if ($registrationDisability == REG_REQUIRED) { if (empty($registration['disability'])) { $this->_missing['disability'] = 'Disability Information'; $this->_invalid['disability'] = 'Please indicate any disabilities you may have.'; } } if ($registrationDisability != REG_HIDE) { if (!empty($registration['disability']) && in_array('yes', $registration['disability'])) { $this->_invalid['disability'] = 'Invalid disability selection.'; } } if ($registrationHispanic == REG_REQUIRED) { if (empty($registration['hispanic'])) { $this->_missing['hispanic'] = 'Hispanic Ethnic Heritage'; $this->_invalid['hispanic'] = 'Please make a selection or choose not to reveal.'; } } /* if ($registrationHispanic != REG_HIDE) { if (empty($registration['hispanic'])) { $this->_invalid['hispanic'] = 'Invalid hispanic heritage selection.'; } } */ if ($registrationRace == REG_REQUIRED) { if ($task == 'edit') { $corigin_incoming = in_array('countryorigin', $field_to_check) ? true : false; $profile = \Hubzero\User\Profile::getInstance(User::get('id')); } else { $corigin_incoming = true; } if (empty($registration['race']) && ($corigin_incoming && strtolower($registration['countryorigin']) == 'us' || !$corigin_incoming && isset($profile) && strtolower($profile->get('countryorigin')) == 'us')) { $this->_missing['race'] = 'Racial Background'; $this->_invalid['race'] = 'Please make a selection or choose not to reveal.'; } } /* if ($registrationRace != REG_HIDE) { if (!empty($registration['race']) || !Helpers\Utility::validtext($registration['race'])) { $this->_invalid['race'] = 'Invalid racial selection.'; } } */ if ($registrationInterests == REG_REQUIRED) { if (empty($registration['interests']) || $registration['interests'] == '') { $this->_missing['interests'] = 'Interests'; $this->_invalid['interests'] = 'Please select materials your are interested in'; } } /* if ($registrationInterests != REG_HIDE) { if (!empty($registration['edulevel']) && !Helpers\Utility::validtext($registration['edulevel'])) $this->_invalid['interests'] = 'Invalid interest selection.'; if (!empty($registration['role']) && !Helpers\Utility::validtext($registration['role'])) $this->_invalid['interests'] = 'Invalid interest selection.'; } */ if ($registrationReason == REG_REQUIRED) { if (empty($registration['reason']) && empty($registration['reasontxt'])) { $this->_missing['reason'] = 'Reason for registering'; $this->_invalid['reason'] = 'Reason for registering'; } } if ($registrationReason != REG_HIDE) { if (!empty($registration['reason']) && !Helpers\Utility::validtext($registration['reason'])) { $this->_invalid['reason'] = 'Invalid reason text. You may be using characters that are not allowed.'; } if (!empty($registration['reasontxt']) && !Helpers\Utility::validtext($registration['reasontxt'])) { $this->_invalid['reason'] = 'Invalid reason text. You may be using characters that are not allowed.'; } } if ($registrationOptIn == REG_REQUIRED) { if (is_null($registration['mailPreferenceOption']) || intval($registration['mailPreferenceOption']) < 0) { $this->_missing['mailPreferenceOption'] = 'Receive Email Updates'; $this->_invalid['mailPreferenceOption'] = 'Receive Email Updates has not been selected'; } } if ($registrationCAPTCHA == REG_REQUIRED) { $botcheck = Request::getVar('botcheck', ''); if ($botcheck) { $this->_invalid['captcha'] = 'Error: Invalid CAPTCHA response.'; } $validcaptchas = Event::trigger('hubzero.onValidateCaptcha'); if (count($validcaptchas) > 0) { foreach ($validcaptchas as $validcaptcha) { if (!$validcaptcha) { $this->_invalid['captcha'] = 'Error: Invalid CAPTCHA response.'; } } } } if ($registrationTOU == REG_REQUIRED) { if (empty($registration['usageAgreement'])) { $this->_missing['usageAgreement'] = 'Usage Agreement'; $this->_invalid['usageAgreement'] = 'Registration requires acceptance of the usage agreement'; } } /* if ($registrationTOU != REG_HIDE) if (!empty($registration['usageAgreement'])) $this->_invalid['usageAgreement'] = 'Usage Agreement has not been Read and Accepted'; */ if ($registrationAddress == REG_REQUIRED) { if (count($registration['address']) == 0) { $this->_missing['address'] = 'Member Address'; $this->_invalid['address'] = 'Member Address'; } } if (!empty($field_to_check)) { if ($this->_missing) { foreach ($this->_missing as $k => $v) { if (!in_array($k, $field_to_check)) { unset($this->_missing[$k]); } } } if ($this->_invalid) { foreach ($this->_invalid as $k => $v) { if (!in_array($k, $field_to_check)) { unset($this->_invalid[$k]); } } } } if (empty($this->_missing) && empty($this->_invalid)) { return true; } return false; }
/** * @since 1.6 */ function processResetComplete($data) { // Get the form. $form = $this->getResetCompleteForm(); // Check for an error. if ($form instanceof Exception) { return $form; } // Filter and validate the form data. $data = $form->filter($data); $return = $form->validate($data); // Check for an error. if ($return instanceof Exception) { return $return; } // Check the validation results. if ($return === false) { // Get the validation messages from the form. foreach ($form->getErrors() as $message) { $this->setError($message); } return false; } // Get the token and user id from the confirmation process. $app = JFactory::getApplication(); $token = $app->getUserState('com_users.reset.token', null); $id = $app->getUserState('com_users.reset.user', null); // Check the token and user id. if (empty($token) || empty($id)) { return new Exception(Lang::txt('COM_USERS_RESET_COMPLETE_TOKENS_MISSING'), 403); } // Get the user object. $user = User::getInstance($id); // Check for a user and that the tokens match. if (empty($user) || $user->activation !== $token) { $this->setError(Lang::txt('COM_USERS_USER_NOT_FOUND')); return false; } // Make sure the user isn't blocked. if ($user->block) { $this->setError(Lang::txt('COM_USERS_USER_BLOCKED')); return false; } // Initiate profile classs $profile = User::getInstance($id); if (\Hubzero\User\Helper::isXDomainUser($user->get('id'))) { App::abort(403, Lang::txt('This is a linked account. To change your password you must change it using the procedures available where the account you are linked to is managed.')); return; } $password_rules = \Hubzero\Password\Rule::all()->whereEquals('enabled', 1)->rows(); $password1 = $data['password1']; $password2 = $data['password2']; if (!empty($password1)) { $msg = \Hubzero\Password\Rule::verify($password1, $password_rules, $profile->get('username')); } else { $msg = array(); } include_once PATH_CORE . DS . 'components' . DS . 'com_members' . DS . 'helpers' . DS . 'utility.php'; if (!$password1 || !$password2) { $this->setError(Lang::txt('you must enter your new password twice to ensure we have it correct')); } elseif ($password1 != $password2) { $this->setError(Lang::txt('the new password and confirmation you entered do not match. Please try again')); } elseif (!\Components\Members\Helpers\Utility::validpassword($password1)) { $this->setError(Lang::txt('the password you entered was invalid password. You may be using characters that are not allowed')); } elseif (!empty($msg)) { $this->setError(Lang::txt('the password does not meet site password requirements. Please choose a password meeting all the requirements listed below.')); } if ($this->getError()) { $this->setError($this->getError()); return false; } // Encrypt the password and update the profile $result = \Hubzero\User\Password::changePassword($profile->get('username'), $password1); // Save the changes if (!$result) { $this->setError(Lang::txt('There was an error changing your password.')); return false; } // Flush the user data from the session. $app->setUserState('com_users.reset.token', null); $app->setUserState('com_users.reset.user', null); return true; }
/** * Check password fuction for ajax password rules validation * * @return string - html rules section with classes for passed/error on each rule */ public function checkPass() { // Get the password rules $password_rules = \Hubzero\Password\Rule::getRules(); $pw_rules = array(); // Get the password rule descriptions foreach ($password_rules as $rule) { if (!empty($rule['description'])) { $pw_rules[] = $rule['description']; } } // Get the password $pw = Request::getVar('password1', null, 'post'); // Validate the password if (!empty($pw)) { $msg = \Hubzero\Password\Rule::validate($pw, $password_rules, $this->member->get('username')); } else { $msg = array(); } // Iterate through the rules and add the appropriate classes (passed/error) if (count($pw_rules) > 0) { foreach ($pw_rules as $rule) { if (!empty($rule)) { if (!empty($msg) && is_array($msg)) { $err = in_array($rule, $msg); } else { $err = ''; } $mclass = $err ? ' class="error"' : 'class="passed"'; echo "<li {$mclass}>" . $rule . "</li>"; } } if (!empty($msg) && is_array($msg)) { foreach ($msg as $message) { if (!in_array($message, $pw_rules)) { echo '<li class="error">' . $message . "</li>"; } } } } // Exit - don't go any further (i.e. no joomla template stuff) exit; }
/** * Display the form for registering an account * * @param object &$xregistration * @param string $task * @return void */ private function _show_registration_form(&$xregistration = null, $task = 'create') { $this->view->setLayout('default'); $this->view->title = Lang::txt('COM_MEMBERS_REGISTER'); $this->view->sitename = Config::get('sitename'); $username = Request::getVar('username', User::get('username'), 'get'); $this->view->self = User::get('username') == $username; // Get the registration object if (!is_object($xregistration)) { $this->view->xregistration = new \Components\Members\Models\Registration(); } else { $this->view->xregistration = $xregistration; } // Push some values to the view $password_rules = \Hubzero\Password\Rule::getRules(); $this->view->password_rules = array(); foreach ($password_rules as $rule) { if (!empty($rule['description'])) { $this->view->password_rules[] = $rule['description']; } } $this->view->showMissing = true; $this->view->registration = $this->view->xregistration->_registration; $this->view->registrationUsername = $this->_registrationField('registrationUsername', 'RROO', $task); $this->view->registrationPassword = $this->_registrationField('registrationPassword', 'RRHH', $task); $this->view->registrationConfirmPassword = $this->_registrationField('registrationConfirmPassword', 'RRHH', $task); $this->view->registrationFullname = $this->_registrationField('registrationFullname', 'RRRR', $task); $this->view->registrationEmail = $this->_registrationField('registrationEmail', 'RRRR', $task); $this->view->registrationConfirmEmail = $this->_registrationField('registrationConfirmEmail', 'RRRR', $task); $this->view->registrationURL = $this->_registrationField('registrationURL', 'HHHH', $task); $this->view->registrationPhone = $this->_registrationField('registrationPhone', 'HHHH', $task); $this->view->registrationEmployment = $this->_registrationField('registrationEmployment', 'HHHH', $task); $this->view->registrationOrganization = $this->_registrationField('registrationOrganization', 'HHHH', $task); $this->view->registrationCitizenship = $this->_registrationField('registrationCitizenship', 'HHHH', $task); $this->view->registrationResidency = $this->_registrationField('registrationResidency', 'HHHH', $task); $this->view->registrationSex = $this->_registrationField('registrationSex', 'HHHH', $task); $this->view->registrationDisability = $this->_registrationField('registrationDisability', 'HHHH', $task); $this->view->registrationHispanic = $this->_registrationField('registrationHispanic', 'HHHH', $task); $this->view->registrationRace = $this->_registrationField('registrationRace', 'HHHH', $task); $this->view->registrationInterests = $this->_registrationField('registrationInterests', 'HHHH', $task); $this->view->registrationReason = $this->_registrationField('registrationReason', 'HHHH', $task); $this->view->registrationOptIn = $this->_registrationField('registrationOptIn', 'HHHH', $task); $this->view->registrationCAPTCHA = $this->_registrationField('registrationCAPTCHA', 'HHHH', $task); $this->view->registrationTOU = $this->_registrationField('registrationTOU', 'HHHH', $task); $this->view->registrationORCID = $this->_registrationField('registrationORCID', 'OOOO', $task); if ($this->view->task == 'update') { if (empty($this->view->xregistration->login)) { $this->view->registrationUsername = REG_REQUIRED; } else { $this->view->registrationUsername = REG_READONLY; } $this->view->registrationPassword = REG_HIDE; $this->view->registrationConfirmPassword = REG_HIDE; } if ($this->view->task == 'edit') { $this->view->registrationUsername = REG_READONLY; $this->view->registrationPassword = REG_HIDE; $this->view->registrationConfirmPassword = REG_HIDE; } if (User::get('auth_link_id') && $this->view->task == 'create') { $this->view->registrationPassword = REG_HIDE; $this->view->registrationConfirmPassword = REG_HIDE; } /* if ($this->view->registrationEmail == REG_REQUIRED || $this->view->registrationEmail == REG_OPTIONAL) { if (!empty($this->view->xregistration->email)) { $this->view->registration['email'] = $this->view->xregistration->_encoded['email']; } } if ($this->view->registrationConfirmEmail == REG_REQUIRED || $this->view->registrationConfirmEmail == REG_OPTIONAL) { if (!empty($this->view->xregistration->_encoded['email'])) { $this->view->registration['confirmEmail'] = $this->view->xregistration->_encoded['email']; } } */ // Display the view if ($this->getError()) { $this->view->setError($this->getError()); } $this->view->config = $this->config; $this->view->display(); }
/** * Removes [a] password rule(s) * * @return void */ public function removeTask() { // Check for request forgeries Request::checkToken(); if (!User::authorise('core.manage', $this->_option) && !User::authorise('core.admin', $this->_option) && !User::authorise('core.delete', $this->_option)) { App::abort(403, Lang::txt('JERROR_ALERTNOAUTHOR')); } // Incoming $ids = Request::getVar('id', array()); if (!is_array($ids)) { $ids = array($ids); } $i = 0; // Do we have any IDs? if (!empty($ids)) { // Loop through each ID and delete the necessary items foreach ($ids as $id) { $id = intval($id); $row = Rule::oneOrFail($id); // Remove the record if (!$row->destroy()) { Notify::error($row->getError()); continue; } $i++; } } else { Notify::warning(Lang::txt('COM_MEMBERS_PASSWORD_RULES_DELETE_NO_ROW_SELECTED')); } // Output messsage and redirect if ($i) { Notify::success(Lang::txt('COM_MEMBERS_PASSWORD_RULES_DELETE_SUCCESS')); } $this->cancelTask(); }
/** * Check password * * @apiMethod GET * @apiUri /members/checkpass * @apiParameter { * "name": "password1", * "description": "Password to validate", * "type": "string", * "required": true, * "default": null * } * @return void */ public function checkpassTask() { $userid = App::get('authn')['user_id']; if (!isset($userid) || empty($userid)) { // We don't have a logged in user, but this may be a password reset // If so, check session for a user id $session = App::get('session'); $registry = $session->get('registry'); $userid = !is_null($registry) ? $registry->get('com_users.reset.user', null) : null; } // Get the password rules $password_rules = \Hubzero\Password\Rule::getRules(); $pw_rules = array(); // Get the password rule descriptions foreach ($password_rules as $rule) { if (!empty($rule['description'])) { $pw_rules[] = $rule['description']; } } // Get the password $pw = Request::getCmd('password1', null, 'post'); // Validate the password if (!empty($pw)) { $msg = \Hubzero\Password\Rule::validate($pw, $password_rules, $userid); } else { $msg = array(); } $html = ''; // Iterate through the rules and add the appropriate classes (passed/error) if (count($pw_rules) > 0) { foreach ($pw_rules as $rule) { if (!empty($rule)) { if (!empty($msg) && is_array($msg)) { $err = in_array($rule, $msg); } else { $err = ''; } $mclass = $err ? ' class="error"' : 'class="passed"'; $html .= "<li {$mclass}>" . $rule . '</li>'; } } if (!empty($msg) && is_array($msg)) { foreach ($msg as $message) { if (!in_array($message, $pw_rules)) { $html .= '<li class="error">' . $message . '</li>'; } } } } // Encode sessions for return $object = new stdClass(); $object->html = $html; $this->send($object); }
/** * Display the form for registering an account * * @param object &$xregistration * @param string $task * @return void */ private function _show_registration_form(&$xregistration = null, $task = 'create') { $username = Request::getVar('username', User::get('username'), 'get'); $isSelf = User::get('username') == $username; // Get the registration object if (!is_object($xregistration)) { $xregistration = new \Components\Members\Models\Registration(); } // Push some values to the view $rules = \Hubzero\Password\Rule::all()->whereEquals('enabled', 1)->rows(); $password_rules = array(); foreach ($rules as $rule) { if (!empty($rule['description'])) { $password_rules[] = $rule['description']; } } $this->view->registrationUsername = Field::state('registrationUsername', 'RROO', $task); $this->view->registrationPassword = Field::state('registrationPassword', 'RRHH', $task); $this->view->registrationConfirmPassword = Field::state('registrationConfirmPassword', 'RRHH', $task); $this->view->registrationFullname = Field::state('registrationFullname', 'RRRR', $task); $this->view->registrationEmail = Field::state('registrationEmail', 'RRRR', $task); $this->view->registrationConfirmEmail = Field::state('registrationConfirmEmail', 'RRRR', $task); $this->view->registrationOptIn = Field::state('registrationOptIn', 'HHHH', $task); $this->view->registrationCAPTCHA = Field::state('registrationCAPTCHA', 'HHHH', $task); $this->view->registrationTOU = Field::state('registrationTOU', 'HHHH', $task); if ($task == 'update') { if (empty($this->view->xregistration->login)) { $this->view->registrationUsername = Field::STATE_REQUIRED; } else { $this->view->registrationUsername = Field::STATE_READONLY; } $this->view->registrationPassword = Field::STATE_HIDDEN; $this->view->registrationConfirmPassword = Field::STATE_HIDDEN; } if ($task == 'edit') { $this->view->registrationUsername = Field::STATE_READONLY; $this->view->registrationPassword = Field::STATE_HIDDEN; $this->view->registrationConfirmPassword = Field::STATE_HIDDEN; } if (User::get('auth_link_id') && $task == 'create') { $this->view->registrationPassword = Field::STATE_HIDDEN; $this->view->registrationConfirmPassword = Field::STATE_HIDDEN; } $fields = Field::all()->including(['options', function ($option) { $option->select('*')->ordered(); }])->where('action_' . $task, '!=', Field::STATE_HIDDEN)->ordered()->rows(); // Display the view $this->view->set('title', Lang::txt('COM_MEMBERS_REGISTER'))->set('sitename', Config::get('sitename'))->set('config', $this->config)->set('task', $task)->set('fields', $fields)->set('showMissing', true)->set('isSelf', $isSelf)->set('password_rules', $password_rules)->set('xregistration', $xregistration)->set('registration', $xregistration->_registration)->setLayout('default')->setErrors($this->getErrors())->display(); }
/** * This method should handle any authentication and report back to the subject * * @param array $credentials Array holding the user credentials * @param array $options Array of extra options * @param object $response Authentication response object * @return boolean */ public function onUserAuthenticate($credentials, $options, &$response) { jimport('joomla.user.helper'); // For JLog $response->type = 'hubzero'; // HUBzero does not like blank passwords if (empty($credentials['password'])) { $response->status = \Hubzero\Auth\Status::FAILURE; $response->error_message = Lang::txt('PLG_AUTHENTICATION_HUBZERO_ERROR_EMPTY_PASS'); return false; } // Initialize variables $conditions = ''; // Get a database object $db = \App::get('db'); // Determine if attempting to log in via username or email address if (strpos($credentials['username'], '@')) { $conditions = ' WHERE email=' . $db->Quote($credentials['username']); } else { $conditions = ' WHERE username='******'username']); } $query = 'SELECT `id`, `username`, `password`' . ' FROM `#__users`' . $conditions . ' AND `block` != 1'; $db->setQuery($query); $result = $db->loadObjectList(); if (is_array($result) && count($result) > 1) { $response->status = \Hubzero\Auth\Status::FAILURE; $response->error_message = Lang::txt('PLG_AUTHENTICATION_HUBZERO_UNKNOWN_USER'); return false; } elseif (is_array($result) && isset($result[0])) { $result = $result[0]; } // Now make sure they haven't made too many failed login attempts if (\Hubzero\User\User::oneOrFail($result->id)->hasExceededLoginLimit()) { $response->status = \Hubzero\Auth\Status::FAILURE; $response->error_message = Lang::txt('PLG_AUTHENTICATION_HUBZERO_TOO_MANY_ATTEMPTS'); return false; } if ($result) { if (\Hubzero\User\Password::passwordMatches($result->username, $credentials['password'], true)) { $user = User::getInstance($result->id); $response->username = $user->username; $response->email = $user->email; $response->fullname = $user->name; $response->status = \Hubzero\Auth\Status::SUCCESS; $response->error_message = ''; // Check validity and age of password $password_rules = \Hubzero\Password\Rule::getRules(); $msg = \Hubzero\Password\Rule::validate($credentials['password'], $password_rules, $result->username); if (is_array($msg) && !empty($msg[0])) { App::get('session')->set('badpassword', '1'); } if (\Hubzero\User\Password::isPasswordExpired($result->username)) { App::get('session')->set('expiredpassword', '1'); } // Set cookie with login preference info $prefs = array('user_id' => $user->get('id'), 'user_img' => \Hubzero\User\Profile::getInstance($user->get('id'))->getPicture(0, false), 'authenticator' => 'hubzero'); $namespace = 'authenticator'; $lifetime = time() + 365 * 24 * 60 * 60; \Hubzero\Utility\Cookie::bake($namespace, $lifetime, $prefs); } else { $response->status = \Hubzero\Auth\Status::FAILURE; $response->error_message = Lang::txt('PLG_AUTHENTICATION_HUBZERO_AUTHENTICATION_FAILED'); } } else { $response->status = \Hubzero\Auth\Status::FAILURE; $response->error_message = Lang::txt('PLG_AUTHENTICATION_HUBZERO_AUTHENTICATION_FAILED'); } }
/** * Save an entry and return to main listing * * @return void */ public function saveTask() { // Check for request forgeries Request::checkToken(); if (!User::authorise('core.manage', $this->_option) && !User::authorise('core.admin', $this->_option) && !User::authorise('core.create', $this->_option) && !User::authorise('core.edit', $this->_option)) { App::abort(403, Lang::txt('JERROR_ALERTNOAUTHOR')); } // Incoming profile edits $fields = Request::getVar('fields', array(), 'post', 'none', 2); // Load the profile $user = Member::oneOrNew($fields['id']); // Get the user before changes so we can // compare how data changed later on $prev = clone $user; // Set the incoming data $user->set($fields); if ($user->isNew()) { $newUsertype = $this->config->get('new_usertype'); if (!$newUsertype) { $newUsertype = Accessgroup::oneByTitle('Registered')->get('id'); } $user->set('accessgroups', array($newUsertype)); // Check that username is filled if (!Validate::username($user->get('username'))) { Notify::error(Lang::txt('COM_MEMBERS_MEMBER_USERNAME_INVALID')); return $this->editTask($user); } // Check email is valid if (!Validate::email($user->get('email'))) { Notify::error(Lang::txt('COM_MEMBERS_MEMBER_EMAIL_INVALID')); return $this->editTask($user); } // Set home directory $hubHomeDir = rtrim($this->config->get('homedir'), '/'); if (!$hubHomeDir) { // try to deduce a viable home directory based on sitename or live_site $sitename = strtolower(Config::get('sitename')); $sitename = preg_replace('/^http[s]{0,1}:\\/\\//', '', $sitename, 1); $sitename = trim($sitename, '/ '); $sitename_e = explode('.', $sitename, 2); if (isset($sitename_e[1])) { $sitename = $sitename_e[0]; } if (!preg_match("/^[a-zA-Z]+[\\-_0-9a-zA-Z\\.]+\$/i", $sitename)) { $sitename = ''; } if (empty($sitename)) { $sitename = strtolower(Request::base()); $sitename = preg_replace('/^http[s]{0,1}:\\/\\//', '', $sitename, 1); $sitename = trim($sitename, '/ '); $sitename_e = explode('.', $sitename, 2); if (isset($sitename_e[1])) { $sitename = $sitename_e[0]; } if (!preg_match("/^[a-zA-Z]+[\\-_0-9a-zA-Z\\.]+\$/i", $sitename)) { $sitename = ''; } } $hubHomeDir = DS . 'home'; if (!empty($sitename)) { $hubHomeDir .= DS . $sitename; } } $user->set('homeDirectory', $hubHomeDir . DS . $user->get('username')); $user->set('loginShell', '/bin/bash'); $user->set('ftpShell', '/usr/lib/sftp-server'); $user->set('registerDate', Date::toSql()); } // Set the new info $user->set('givenName', preg_replace('/\\s+/', ' ', trim($fields['givenName']))); $user->set('middleName', preg_replace('/\\s+/', ' ', trim($fields['middleName']))); $user->set('surname', preg_replace('/\\s+/', ' ', trim($fields['surname']))); $name = array($user->get('givenName'), $user->get('middleName'), $user->get('surname')); $name = implode(' ', $name); $name = preg_replace('/\\s+/', ' ', $name); $user->set('name', $name); $user->set('modifiedDate', Date::toSql()); if ($ec = Request::getInt('activation', 0, 'post')) { $user->set('activation', $ec); } else { $user->set('activation', Helpers\Utility::genemailconfirm()); } // Can't block yourself if ($user->get('block') && $user->get('id') == User::get('id') && !User::get('block')) { Notify::error(Lang::txt('COM_USERS_USERS_ERROR_CANNOT_BLOCK_SELF')); return $this->editTask($user); } // Make sure that we are not removing ourself from Super Admin group $iAmSuperAdmin = User::authorise('core.admin'); if ($iAmSuperAdmin && User::get('id') == $user->get('id')) { // Check that at least one of our new groups is Super Admin $stillSuperAdmin = false; foreach ($fields['accessgroups'] as $group) { $stillSuperAdmin = $stillSuperAdmin ? $stillSuperAdmin : \JAccess::checkGroup($group, 'core.admin'); } if (!$stillSuperAdmin) { Notify::error(Lang::txt('COM_USERS_USERS_ERROR_CANNOT_DEMOTE_SELF')); return $this->editTask($user); } } // Save the changes if (!$user->save()) { Notify::error($user->getError()); return $this->editTask($user); } // Save profile data $profile = Request::getVar('profile', array(), 'post', 'none', 2); $access = Request::getVar('profileaccess', array(), 'post', 'none', 2); foreach ($profile as $key => $data) { if (isset($profile[$key]) && is_array($profile[$key])) { $profile[$key] = array_filter($profile[$key]); } if (isset($profile[$key . '_other']) && trim($profile[$key . '_other'])) { if (is_array($profile[$key])) { $profile[$key][] = $profile[$key . '_other']; } else { $profile[$key] = $profile[$key . '_other']; } unset($profile[$key . '_other']); } } if (!$user->saveProfile($profile, $access)) { Notify::error($user->getError()); return $this->editTask($user); } // Do we have a new pass? $newpass = trim(Request::getVar('newpass', '', 'post')); if ($newpass) { // Get password rules and validate $password_rules = \Hubzero\Password\Rule::all()->whereEquals('enabled', 1)->rows(); $validated = \Hubzero\Password\Rule::verify($newpass, $password_rules, $user->get('id')); if (!empty($validated)) { // Set error Notify::error(Lang::txt('COM_MEMBERS_PASSWORD_DOES_NOT_MEET_REQUIREMENTS')); $this->validated = $validated; $this->_task = 'apply'; } else { // Save password \Hubzero\User\Password::changePassword($user->get('username'), $newpass); } } $passinfo = \Hubzero\User\Password::getInstance($user->get('id')); if (is_object($passinfo)) { // Do we have shadow info to change? $shadowMax = Request::getInt('shadowMax', false, 'post'); $shadowWarning = Request::getInt('shadowWarning', false, 'post'); $shadowExpire = Request::getVar('shadowExpire', '', 'post'); if ($shadowMax || $shadowWarning || !is_null($passinfo->get('shadowExpire')) && empty($shadowExpire)) { if ($shadowMax) { $passinfo->set('shadowMax', $shadowMax); } if ($shadowExpire || !is_null($passinfo->get('shadowExpire')) && empty($shadowExpire)) { if (preg_match("/[0-9]{4}-[0-9]{2}-[0-9]{2}/", $shadowExpire)) { $shadowExpire = strtotime($shadowExpire) / 86400; $passinfo->set('shadowExpire', $shadowExpire); } elseif (preg_match("/[0-9]+/", $shadowExpire)) { $passinfo->set('shadowExpire', $shadowExpire); } elseif (empty($shadowExpire)) { $passinfo->set('shadowExpire', NULL); } } if ($shadowWarning) { $passinfo->set('shadowWarning', $shadowWarning); } $passinfo->update(); } } // Check for spam count $reputation = Request::getVar('spam_count', null, 'post'); if (!is_null($reputation)) { $user->reputation->set('spam_count', $reputation); $user->reputation->save(); } // Email the user that their account has been approved if (!$prev->get('approved') && $this->config->get('useractivation_email')) { if (!$this->emailApprovedUser($user)) { Notify::error(Lang::txt('COM_MEMBERS_ERROR_EMAIL_FAILED')); } } // Set success message Notify::success(Lang::txt('COM_MEMBERS_MEMBER_SAVED')); // Drop through to edit form? if ($this->getTask() == 'apply') { return $this->editTask($user); } // Redirect $this->cancelTask(); }
/** * Save an entry and return to main listing * * @param integer $redirect Redirect to main listing? * @return void */ public function saveTask($redirect = 1) { // Check for request forgeries Request::checkToken(); // Incoming user ID $id = Request::getInt('id', 0, 'post'); // Do we have an ID? if (!$id) { App::abort(500, Lang::txt('COM_MEMBERS_NO_ID')); return; } // Incoming profile edits $p = Request::getVar('profile', array(), 'post', 'none', 2); // Load the profile $profile = new Profile(); $profile->load($id); // Set the new info $profile->set('givenName', preg_replace('/\\s+/', ' ', trim($p['givenName']))); $profile->set('middleName', preg_replace('/\\s+/', ' ', trim($p['middleName']))); $profile->set('surname', preg_replace('/\\s+/', ' ', trim($p['surname']))); $name = trim($p['givenName']) . ' '; $name .= trim($p['middleName']) != '' ? trim($p['middleName']) . ' ' : ''; $name .= trim($p['surname']); $name = preg_replace('/\\s+/', ' ', $name); $profile->set('name', $name); if (isset($p['vip'])) { $profile->set('vip', $p['vip']); } else { $profile->set('vip', 0); } $profile->set('orcid', trim($p['orcid'])); $profile->set('url', trim($p['url'])); $profile->set('phone', trim($p['phone'])); $profile->set('orgtype', trim($p['orgtype'])); $profile->set('organization', trim($p['organization'])); $profile->set('bio', trim($p['bio'])); if (isset($p['public'])) { $profile->set('public', $p['public']); } else { $profile->set('public', 0); } $profile->set('modifiedDate', Date::toSql()); $profile->set('homeDirectory', trim($p['homeDirectory'])); $profile->set('loginShell', trim($p['loginShell'])); $ec = Request::getInt('emailConfirmed', 0, 'post'); if ($ec) { $profile->set('emailConfirmed', $ec); } else { $confirm = Helpers\Utility::genemailconfirm(); $profile->set('emailConfirmed', $confirm); } if (isset($p['email'])) { $profile->set('email', trim($p['email'])); } if (isset($p['mailPreferenceOption'])) { $profile->set('mailPreferenceOption', trim($p['mailPreferenceOption'])); } else { $profile->set('mailPreferenceOption', -1); } if (!empty($p['gender'])) { $profile->set('gender', trim($p['gender'])); } if (!empty($p['disability'])) { if ($p['disability'] == 'yes') { if (!is_array($p['disabilities'])) { $p['disabilities'] = array(); } if (count($p['disabilities']) == 1 && isset($p['disabilities']['other']) && empty($p['disabilities']['other'])) { $profile->set('disability', array('no')); } else { $profile->set('disability', $p['disabilities']); } } else { $profile->set('disability', array($p['disability'])); } } if (!empty($p['hispanic'])) { if ($p['hispanic'] == 'yes') { if (!is_array($p['hispanics'])) { $p['hispanics'] = array(); } if (count($p['hispanics']) == 1 && isset($p['hispanics']['other']) && empty($p['hispanics']['other'])) { $profile->set('hispanic', array('no')); } else { $profile->set('hispanic', $p['hispanics']); } } else { $profile->set('hispanic', array($p['hispanic'])); } } if (isset($p['race']) && is_array($p['race'])) { $profile->set('race', $p['race']); } // Save the changes if (!$profile->update()) { App::abort(500, $profile->getError()); return false; } // Do we have a new pass? $newpass = trim(Request::getVar('newpass', '', 'post')); if ($newpass != '') { // Get password rules and validate $password_rules = \Hubzero\Password\Rule::getRules(); $validated = \Hubzero\Password\Rule::validate($newpass, $password_rules, $profile->get('uidNumber')); if (!empty($validated)) { // Set error $this->setError(Lang::txt('COM_MEMBERS_PASSWORD_DOES_NOT_MEET_REQUIREMENTS')); $this->validated = $validated; $redirect = false; } else { // Save password \Hubzero\User\Password::changePassword($profile->get('username'), $newpass); } } $passinfo = \Hubzero\User\Password::getInstance($id); if (is_object($passinfo)) { // Do we have shadow info to change? $shadowMax = Request::getInt('shadowMax', false, 'post'); $shadowWarning = Request::getInt('shadowWarning', false, 'post'); $shadowExpire = Request::getVar('shadowExpire', '', 'post'); if ($shadowMax || $shadowWarning || !is_null($passinfo->get('shadowExpire')) && empty($shadowExpire)) { if ($shadowMax) { $passinfo->set('shadowMax', $shadowMax); } if ($shadowExpire || !is_null($passinfo->get('shadowExpire')) && empty($shadowExpire)) { if (preg_match("/[0-9]{4}-[0-9]{2}-[0-9]{2}/", $shadowExpire)) { $shadowExpire = strtotime($shadowExpire) / 86400; $passinfo->set('shadowExpire', $shadowExpire); } elseif (preg_match("/[0-9]+/", $shadowExpire)) { $passinfo->set('shadowExpire', $shadowExpire); } elseif (empty($shadowExpire)) { $passinfo->set('shadowExpire', NULL); } } if ($shadowWarning) { $passinfo->set('shadowWarning', $shadowWarning); } $passinfo->update(); } } // Get the user's interests (tags) $tags = trim(Request::getVar('tags', '')); // Process tags include_once dirname(dirname(__DIR__)) . DS . 'models' . DS . 'tags.php'; $mt = new \Components\Members\Models\Tags($id); $mt->setTags($tags, $id); // Make sure certain changes make it back to the user table $user = User::getInstance($id); $user->set('name', $name); $user->set('email', $profile->get('email')); if (!$user->save()) { App::abort('', Lang::txt($user->getError())); return false; } if ($redirect) { // Redirect App::redirect(Route::url('index.php?option=' . $this->_option), Lang::txt('COM_MEMBERS_MEMBER_SAVED')); } else { $this->editTask($id); } }
/** * Show a form for changing user password * * @return void */ public function changepasswordTask() { // Check if they're logged in if (User::isGuest()) { $rtrn = Request::getVar('REQUEST_URI', Route::url('index.php?option=' . $this->_controller . '&task=changepassword', false, true), 'server'); App::redirect(Route::url('index.php?option=com_users&view=login&return=' . base64_encode($rtrn), false)); } // Incoming $id = Request::getInt('id', 0); $id = $id ?: User::get('id'); // Ensure we have an ID if (!$id) { App::abort(404, Lang::txt('COM_MEMBERS_NO_ID')); } // Check authorization if (!User::authorise('core.manage', $this->_option) && User::get('id') != $id) { App::abort(403, Lang::txt('MEMBERS_NOT_AUTH')); } // Initiate profile class $profile = Member::oneOrFail($id); // Ensure we have a member if (!$profile->get('id')) { App::abort(404, Lang::txt('COM_MEMBERS_NOT_FOUND')); } // Set the page title $title = Lang::txt(strtoupper($this->_option)); $title .= $this->_task ? ': ' . Lang::txt(strtoupper($this->_option . '_' . $this->_task)) : ''; Document::setTitle($title); // Set the pathway if (Pathway::count() <= 0) { Pathway::append(Lang::txt(strtoupper($this->_option)), 'index.php?option=' . $this->_option); } Pathway::append(stripslashes($profile->get('name')), 'index.php?option=' . $this->_option . '&id=' . $profile->get('id')); Pathway::append(Lang::txt('COM_MEMBERS_' . strtoupper($this->_task)), 'index.php?option=' . $this->_option . '&id=' . $profile->get('id') . '&task=' . $this->_task); // Load some needed libraries if (\Hubzero\User\Helper::isXDomainUser(User::get('id'))) { App::abort(403, Lang::txt('COM_MEMBERS_PASS_CHANGE_LINKED_ACCOUNT')); } // Incoming data $change = Request::getVar('change', '', 'post'); $oldpass = Request::getVar('oldpass', '', 'post'); $newpass = Request::getVar('newpass', '', 'post'); $newpass2 = Request::getVar('newpass2', '', 'post'); $message = Request::getVar('message', ''); if (!empty($message)) { $this->setError($message); } $this->view->title = $title; $this->view->profile = $profile; $this->view->change = $change; $this->view->oldpass = $oldpass; $this->view->newpass = $newpass; $this->view->newpass2 = $newpass2; $this->view->validated = true; $password_rules = \Hubzero\Password\Rule::all()->whereEquals('enabled', 1)->rows(); $this->view->password_rules = array(); foreach ($password_rules as $rule) { if (!empty($rule['description'])) { $this->view->password_rules[] = $rule['description']; } } if (!empty($newpass)) { $msg = \Hubzero\Password\Rule::verify($newpass, $password_rules, $profile->get('username')); } else { $msg = array(); } // Blank form request (no data submitted) if (empty($change)) { $this->view->setErrors($this->getErrors())->display(); return; } $passrules = false; if (!\Hubzero\User\Password::passwordMatches($profile->get('id'), $oldpass, true)) { $this->setError(Lang::txt('COM_MEMBERS_PASS_INCORRECT')); } elseif (!$newpass || !$newpass2) { $this->setError(Lang::txt('COM_MEMBERS_PASS_MUST_BE_ENTERED_TWICE')); } elseif ($newpass != $newpass2) { $this->setError(Lang::txt('COM_MEMBERS_PASS_NEW_CONFIRMATION_MISMATCH')); } elseif ($oldpass == $newpass) { // make sure the current password and new password are not the same // this should really be done in the password rules validation step $this->setError(Lang::txt('Your new password must be different from your current password')); } elseif (!empty($msg)) { $this->setError(Lang::txt('Password does not meet site password requirements. Please choose a password meeting all the requirements listed below.')); $this->view->set('validated', $msg); $passrules = true; } if ($this->getError()) { $change = array(); $change['_missing']['password'] = $this->getError(); if (!empty($msg) && $passrules) { $change['_missing']['password'] .= '<ul>'; foreach ($msg as $m) { $change['_missing']['password'] .= '<li>'; $change['_missing']['password'] .= $m; $change['_missing']['password'] .= '</li>'; } $change['_missing']['password'] .= '</ul>'; } if (Request::getInt('no_html', 0)) { echo json_encode($change); exit; } else { $this->view->setError($this->getError())->display(); return; } } // Encrypt the password and update the profile $result = \Hubzero\User\Password::changePassword($profile->get('id'), $newpass); // Save the changes if (!$result) { $this->view->setError(Lang::txt('MEMBERS_PASS_CHANGE_FAILED'))->display(); return; } // Redirect user back to main account page $return = base64_decode(Request::getVar('return', '', 'method', 'base64')); $this->_redirect = $return ? $return : Route::url('index.php?option=' . $this->_option . '&id=' . $id); $session = App::get('session'); // Redirect user back to main account page if (Request::getInt('no_html', 0)) { if ($session->get('badpassword', '0') || $session->get('expiredpassword', '0')) { $session->set('badpassword', '0'); $session->set('expiredpassword', '0'); } echo json_encode(array("success" => true)); exit; } else { if ($session->get('badpassword', '0') || $session->get('expiredpassword', '0')) { $session->set('badpassword', '0'); $session->set('expiredpassword', '0'); } } }