// Add alerts for any failed input validation
foreach ($validator->errors as $error) {
addAlert("danger", $error);
}
if (count($validator->errors) > 0) {
apiReturnError($ajax, getReferralPage());
}
if ($user_id) {
// Special case to load groups for the logged in user
if ($user_id == "0") {
$user_id = $loggedInUser->user_id;
}
// Attempt to load group information for the specified user.
if (!($results = loadUserGroups($user_id))) {
apiReturnError($ajax, getReferralPage());
}
} else {
if ($group_id) {
// Attempt to load information for the specified group.
if (!($results = loadGroup($group_id))) {
apiReturnError($ajax, getReferralPage());
}
} else {
// Attempt to load information for all groups
if (!($results = loadGroups())) {
apiReturnError($ajax, getReferralPage());
}
}
}
restore_error_handler();
echo json_encode($results);
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
*/
require_once "models/config.php";
setReferralPage(getAbsoluteDocumentPath(__FILE__));
//Prevent the user visiting the logged in page if he/she is already logged in
if (isUserLoggedIn()) {
addAlert("danger", "I'm sorry, you cannot request an activation email while logged in. Please log out first.");
apiReturnError(false, SITE_ROOT);
}
?>
<!DOCTYPE html>
<html lang="en">
<?php
echo renderTemplate("head.html", array("#SITE_ROOT#" => SITE_ROOT, "#SITE_TITLE#" => SITE_TITLE, "#PAGE_TITLE#" => "Resend Activation"));
?>
<body>
<div class="container">
<div class="header">
<ul class="nav nav-pills navbar pull-right">
</ul>
<h3 class="text-muted">UserFrosting</h3>
}
}
$deny = $validate->optionalGetVar('deny');
// Code below should work on this page without any input and redirect the user back to login.php
// User has denied this request
if (!empty($deny)) {
$token = trim($deny);
if ($token == "" || !validateLostPasswordToken($token)) {
$errors[] = lang("FORGOTPASS_INVALID_TOKEN");
} else {
$userdetails = fetchUserAuthByActivationToken($token);
if (!flagLostPasswordRequest($userdetails["user_name"], 0)) {
$errors[] = lang("SQL_ERROR");
} else {
$successes[] = lang("FORGOTPASS_REQUEST_CANNED");
}
}
}
restore_error_handler();
foreach ($errors as $error) {
addAlert("danger", $error);
}
foreach ($successes as $success) {
addAlert("success", $success);
}
// Send to login page if failure
if (count($errors) > 0) {
apiReturnError($ajax, SITE_ROOT . "login.php");
} else {
apiReturnSuccess($ajax, SITE_ROOT . "forgot_password.php");
}
function checkCSRF($ajax, $csrf_token)
{
global $loggedInUser;
if ($csrf_token) {
if (!$loggedInUser->csrf_validate(trim($csrf_token))) {
addAlert("danger", lang("ACCESS_DENIED"));
if (LOG_AUTH_FAILURES) {
error_log("CSRF token failure - invalid token.");
}
apiReturnError($ajax, $failure_landing_page);
}
} else {
addAlert("danger", lang("ACCESS_DENIED"));
if (LOG_AUTH_FAILURES) {
error_log("CSRF token failure - token not specified.");
}
apiReturnError($ajax, $failure_landing_page);
}
}
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
*/
// Resend the activation email for a user that has registered an account. Note that this is enabled regardless of whether or not email activation is enabled.
// This is to prevent "orphaned" accounts, who registered while email activation was still required.
// Request method: POST
require_once "../models/config.php";
set_error_handler('logAllErrors');
//Prevent the user visiting the logged in page if he/she is already logged in
if (isUserLoggedIn()) {
addAlert("danger", "I'm sorry, you cannot register for an account while logged in. Please log out first.");
apiReturnError($ajax, ACCOUNT_ROOT);
}
//Forms posted
if (!empty($_POST)) {
$email = $_POST["email"];
$username = $_POST["username"];
//Perform some validation
//Feel free to edit / change as required
if (trim($email) == "") {
$errors[] = lang("ACCOUNT_SPECIFY_EMAIL");
} else {
if (!isValidEmail($email) || !emailExists($email)) {
$errors[] = lang("ACCOUNT_INVALID_EMAIL");
}
}
if (trim($username) == "") {
<?php
// UserCake authentication
require_once "../models/config.php";
require_once "./committee_crud.php";
require_once "./info_crud.php";
require_once "./ipEssayAns_crud.php";
require_once "./result_crud.php";
// Request method: GET
$ajax = checkRequestMode("get");
if (!securePage(__FILE__)) {
apiReturnError($ajax);
}
setReferralPage(getAbsoluteDocumentPath(__FILE__));
// Admin page
?>
<!DOCTYPE html>
<html lang="en">
<?php
echo renderAccountPageHeader(array("#SITE_ROOT#" => SITE_ROOT, "#SITE_TITLE#" => SITE_TITLE, "#PAGE_TITLE#" => "Admin Dashboard"));
?>
<head>
<!-- DataTables CSS -->
<link rel="stylesheet" type="text/css" href="//cdn.datatables.net/1.10.7/css/jquery.dataTables.css">
<!-- include jquery library -->
<script src="http://code.jquery.com/jquery-2.1.4.js"></script>
<!-- DataTables -->
<script type="text/javascript" charset="utf8" src="//cdn.datatables.net/1.10.7/js/jquery.dataTables.js"></script>
$addition_count += addUserToGroup($new_user_id, $group_id);
}
// Set primary group
if (!empty($primary_group_id)) {
if (updateUserPrimaryGroup($new_user_id, $primary_group_id)) {
// Account creation was successful!
addAlert("success", lang("ACCOUNT_PRIMARY_GROUP_SET"));
addAlert("success", lang("ACCOUNT_CREATION_COMPLETE", array($user_name)));
} else {
$error_count++;
}
}
// Otherwise, add default groups and set primary group for new users
} else {
if (dbAddUserToDefaultGroups($new_user_id)) {
if ($require_activation) {
// Activation required
addAlert("success", lang("ACCOUNT_REGISTRATION_COMPLETE_TYPE2"));
} else {
// No activation required
addAlert("success", lang("ACCOUNT_REGISTRATION_COMPLETE_TYPE1"));
}
} else {
apiReturnError($ajax, $admin == "true" ? ACCOUNT_ROOT : SITE_ROOT);
}
}
} else {
apiReturnError($ajax, $admin == "true" ? ACCOUNT_ROOT : SITE_ROOT);
}
restore_error_handler();
apiReturnSuccess($ajax, $admin == "true" ? ACCOUNT_ROOT : SITE_ROOT);
if (!$mail->newTemplateMsg("resend-activation.txt", $hooks)) {
$errors[] = lang("MAIL_TEMPLATE_BUILD_ERROR");
} else {
if (!$mail->sendMail($userdetails["email"], "Activate your " . $websiteName . " Account")) {
$errors[] = lang("MAIL_ERROR");
} else {
//Success, user details have been updated in the db now mail this information out.
$successes[] = lang("ACCOUNT_NEW_ACTIVATION_SENT");
}
}
}
}
}
}
}
} else {
$errors[] = lang("NO_DATA");
}
restore_error_handler();
foreach ($errors as $error) {
addAlert("danger", $error);
}
foreach ($successes as $success) {
addAlert("success", $success);
}
// Send to home page if failure
if (count($errors) > 0) {
apiReturnError($ajax, SITE_ROOT . "index.php");
} else {
apiReturnSuccess($ajax, SITE_ROOT . "resend_activation.php");
}
function apiSecurityCheck($method = "post", $field_name = "csrf_token", $failure_landing_page = "404.php")
{
$csrf_token = "";
$ajax = false;
if ($method == "post") {
// Confirm that data has been submitted via POST
if (!($_SERVER['REQUEST_METHOD'] == 'POST')) {
addAlert("danger", "Error: data must be submitted via POST.");
apiReturnError(false, $failure_landing_page);
} else {
if (isset($_POST['ajaxMode']) and $_POST['ajaxMode'] == "true") {
$ajax = true;
}
}
// Request must be from a logged in user. Do we want to make this customizable?
if (!isUserLoggedIn()) {
addAlert("danger", "You must be logged in to access this resource.");
apiReturnError($ajax, $failure_landing_page);
}
if (isset($_POST[$field_name])) {
$csrf_token = htmlentities($_POST[$field_name]);
if (!$_SESSION["userCakeUser"]->csrf_validate(trim($csrf_token))) {
addAlert("danger", lang("ACCESS_DENIED"));
apiReturnError($ajax, $failure_landing_page);
}
} else {
addAlert("danger", lang("ACCESS_DENIED"));
apiReturnError($ajax, $failure_landing_page);
}
} else {
// Confirm that data has been submitted via GET
if (!($_SERVER['REQUEST_METHOD'] == 'GET')) {
addAlert("danger", "Error: data must be submitted via GET.");
apiReturnError(false, $failure_landing_page);
} else {
if (isset($_GET['ajaxMode']) and $_GET['ajaxMode'] == "true") {
$ajax = true;
}
}
// Request must be from a logged in user. Do we want to make this customizable?
if (!isUserLoggedIn()) {
addAlert("danger", "You must be logged in to access this resource.");
apiReturnError($ajax, $failure_landing_page);
}
if (isset($_GET[$field_name])) {
$csrf_token = htmlentities($_GET[$field_name]);
if (!$loggedInUser->csrf_validate(trim($csrf_token))) {
addAlert("danger", lang("ACCESS_DENIED"));
apiReturnError($ajax, $failure_landing_page);
}
} else {
addAlert("danger", lang("ACCESS_DENIED"));
apiReturnError($ajax, $failure_landing_page);
}
}
}
function renderMenu($highlighted_item_class)
{
// User must be logged in
if (!isUserLoggedIn()) {
addAlert("danger", lang("LOGIN_REQUIRED"));
apiReturnError(false, SITE_ROOT . "login.php");
}
global $loggedInUser, $master_account;
$hooks = array("#USERNAME#" => $loggedInUser->username, "#WEBSITENAME#" => SITE_TITLE);
// Special case for root account
if ($loggedInUser->user_id == $master_account) {
$hooks['#HEADERMESSAGE#'] = "<span class='navbar-center navbar-brand'>YOU ARE CURRENTLY LOGGED IN AS ROOT USER</span>";
} else {
$hooks['#HEADERMESSAGE#'] = "";
}
$menu = fetchMenu($loggedInUser->user_id);
$html = '
<!-- Brand and toggle get grouped for better mobile display -->
<nav class="navbar navbar-inverse navbar-fixed-top" role="navigation">
<div class="navbar-header">
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-ex1-collapse">
<span class="sr-only">Toggle navigation</span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</button>
<a class="navbar-brand" href="../account/index.php">#WEBSITENAME#</a>
#HEADERMESSAGE#
</div>
<div class="collapse navbar-collapse navbar-ex1-collapse">
<!-- Collect the nav links, forms, and other content for toggling -->
<ul class="nav navbar-nav side-nav">';
foreach ($menu as $r => $v) {
// Split the highlighted classes into an array to allow us to set left-sub menus to active
$highlighted_classes = explode(" ", $highlighted_item_class);
// Set active class if this item is currently selected
$active = $highlighted_item_class == $v['class_name'] ? "active" : "";
if ($v['menu'] == 'left' and $v['menu'] != 'left-sub') {
$html .= "<li class='navitem-" . $v['class_name'] . " {$active}'><a href='../" . $v['page'] . "'><i class='" . $v['icon'] . "'></i> " . $v['name'] . "</a></li>";
}
if ($v['menu'] == 'left-sub' and $v['parent_id'] == 0) {
$open = in_array($v['class_name'], $highlighted_classes) ? "open" : "";
$html .= "<li class='dropdown navitem-" . $v['class_name'] . " {$open}'>\n <a href='#' class='dropdown-toggle' data-toggle='dropdown'><i class='" . $v['icon'] . "'></i> " . $v['name'] . " <b class='caret'></b></a>\n <ul class='dropdown-menu'>";
// Grab submenu items based on parent_id = $v['menu_id']
$subs = gatherSubMenuItems($v['menu_id']);
// If subs are found print them out to the parent element
foreach ($subs as $s) {
$sub_active = in_array($s['class_name'], $highlighted_classes) ? "active" : "";
$html .= "<li class='navitem-" . $s['class_name'] . " {$sub_active}'><a href='../" . $s['page'] . "'><i class='" . $s['icon'] . "'></i> " . $s['name'] . "</a></li>";
}
$html .= '</ul></li>';
}
}
$html .= '</ul>';
//top nav bar
$html .= '<ul class="nav navbar-master navbar-nav navbar-right">';
foreach ($menu as $r => $v) {
if ($v['menu'] == 'top-main' and $v['menu'] != 'top-main-sub') {
$html .= "<li class='navitem-" . $v['class_name'] . "'><a href='../" . $v['page'] . "'><i class='" . $v['icon'] . "'></i> " . $v['name'] . "</a></li>";
}
if ($v['menu'] == 'top-main-sub' and $v['parent_id'] == 0) {
$html .= "<li class='dropdown'>\n <a href='#' class='dropdown-toggle' data-toggle='dropdown'><i class='" . $v['icon'] . "'></i> " . $v['name'] . " <b class='caret'></b></a>\n <ul class='dropdown-menu'>";
// Grab submenu items based on parent_id = $v['menu_id']
$subs = gatherSubMenuItems($v['menu_id']);
// If subs are found print them out to the parent element
foreach ($subs as $s) {
$html .= "<li class='navitem-" . $s['class_name'] . "'><a href='../" . $s['page'] . "'><i class='" . $s['icon'] . "'></i> " . $s['name'] . "</a></li>";
}
$html .= '</ul></li>';
}
}
$html .= '
</ul></div>
</nav>';
$find = array_keys($hooks);
$replace = array_values($hooks);
//Replace hooks
$contents = str_replace($find, $replace, $html);
return $contents;
}
