Exemple #1
0
function content()
{
    if (!user_logged_in()) {
        return must_log_in();
    }
    $user = fetch_one_or_none('users', 'id', user_logged_in());
    if (!array_key_exists('token', $_GET) || !$_GET['token'] || $_GET['token'] != sha1($user->new_email_address)) {
        $errors[] = 'Invalid reset token';
    }
    # This can happen if two accounts try to change address at similar times.
    if (count($errors) == 0 && count(fetch_all('users', 'email_address', $user->new_email_address))) {
        $errors[] = "A user with this email address already exists";
    }
    if (count($errors) == 0) {
        update_all('users', array('email_address' => $user->new_email_address, 'new_email_address' => null), 'id', user_logged_in());
        ?>
    <h2>Address changed</h2>
    <p>Your email address has been changed to
      <tt><?php 
        esc($user->new_email_address);
        ?>
</tt>.</p>
    <?php 
        return;
    }
    page_header('Address verification failed');
    show_error_list($errors);
}
Exemple #2
0
function content()
{
    if (!user_logged_in()) {
        return must_log_in();
    }
    $user = fetch_one_or_none('users', 'id', user_logged_in());
    $errors = array();
    if (array_key_exists('change', $_POST)) {
        if (!isset($_POST['email']) || !$_POST['email']) {
            $errors[] = "Please enter an email address";
        } else {
            $email = $_POST['email'];
            if ($email && !validate_email_address($email)) {
                $errors[] = "Invalid email address";
            }
            if (count($errors) == 0 && count(fetch_all('users', 'email_address', $email))) {
                $errors[] = "A user with this email address already exists";
            }
            if (count($errors) == 0) {
                update_all('users', array('new_email_address' => $email), 'id', user_logged_in());
                send_email_change_email($email, $user->name);
                ?>
        <p>We have sent an email to your new address requesting that you
          confirm that change of address.</p>
        <?php 
                return;
            }
        }
    }
    $fields = array();
    page_header('Change email address');
    show_error_list($errors);
    ?>
 
    <form method="post" action="" accept-charset="UTF-8">
      <div class="fieldrow">
        <div class="field">
          <label>Current address:</label>
          <div><tt><?php 
    esc($user->email_address);
    ?>
</tt></div>
        </div>
      </div>

      <div class="fieldrow">
        <?php 
    text_field($fields, 'email', 'New address');
    ?>
      </div>

      <div class="fieldrow">
        <input type="submit" name="change" value="Change"/>
      </div>
    </form>
  <?php 
}
Exemple #3
0
function content()
{
    global $errors;
    ?>

  <h2>Login</h2>

  <p>If you have not yet registered for an account, you will need to
    <a href="register">register</a> before you can log in.
    If you have have forgotten your password, you can
    <a href="request-reset">reset it</a>.</p>

  <?php 
    show_error_list($errors);
    ?>

    <form method="post" action="" accept-charset="UTF-8">
      <div class="fieldrow">
        <?php 
    text_field($_POST, 'email', 'Email address');
    ?>
      </div>

      <div class="fieldrow">
        <div>
          <label for="password">Password</label>
          <input type="password" id="password" name="password" />
        </div>
      </div>

      <div class="fieldrow">
        <input type="checkbox" id="forever" name="forever" value="1"
               checked="checked" />
        <label for="forever">Stay logged in?
          <br/><span class="label-extra">If you are using a shared computer,
          you should not set this option.</span></label>
      </div>

      <div class="fieldrow">
        <input type="submit" name="login" value="Login" />
        <br/><span class="note">(This sets a cookie,
          which logging out clears.)</span>
      </div>
      <?php 
    if (array_key_exists('return', $_GET)) {
        hidden_field('return', $_GET['return']);
    } elseif (array_key_exists('return', $_POST)) {
        hidden_field('return', $_POST['return']);
    }
    ?>
    </form>
<?php 
}
Exemple #4
0
function content()
{
    $errors = array();
    if (!array_key_exists('token', $_GET) || !$_GET['token']) {
        $errors[] = 'Invalid activation token';
    }
    $token = $_GET['token'];
    $user = fetch_one_or_none('users', 'activation_token', $_GET['token']);
    if (!$user) {
        $errors[] = 'Invalid activation token';
    }
    if (count($errors)) {
        page_header('Activation failed');
        show_error_list($errors);
        return;
    }
    $admins = fetch_wol('*', 'users', 'date_verified IS NOT NULL AND date_approved IS NOT NULL', 'id ASC');
    $sets = array('activation_token' => null, 'date_verified' => date('Y-m-d H:i:s'));
    # Auto-approve user 1.
    if (count($admins) == 0) {
        $sets['date_approved'] = $sets['date_verified'];
        $sets['approved_by'] = 1;
    }
    update_all('users', $sets, 'id', $user->id);
    page_header('Account activated');
    if (count($admins)) {
        send_approval_request($user, $admins);
        ?>

    <p>Thank you for activating your account.
      Your request for an account has been forwarded to a site administrator
      for approval.  You will be notified by email when it is approved.</p>

  <?php 
    } else {
        register_user_rdf($user);
        # Don't set login cookie now.  This is to prevent someone hijacking
        # a login token, using it, and benefiting from a pre-logged-in session.
        # This way, they still need a password.
        global $config;
        ?>

    <p>Thank you for activating your account.
      You shouldn't need to do that again.  You may now want to 
      <a href="<?php 
        esc($config['http_path']);
        ?>
account/login">log in</a>.</p>

  <?php 
    }
}
Exemple #5
0
function content()
{
    $errors = array();
    page_header('Request password reset');
    if (array_key_exists('reset', $_POST)) {
        if (!isset($_POST['email']) || !$_POST['email']) {
            $errors[] = "Please enter an email address";
        } else {
            $user = fetch_one_or_none('users', 'email_address', $_POST['email']);
            if (!$user) {
                $errors[] = "Incorrect email address supplied";
            }
            if (count($errors) == 0) {
                $token = make_random_token();
                update_all('users', array('activation_token' => $token), 'id', $user->id);
                send_reset_email($user->email_address, $user->name, $token);
                ?>
        <p>We have sent you an email containing a link allowing you to reset 
          your password.</p>
        <?php 
                return;
            }
        }
    }
    ?>
    <p>If you have forgotten your password and need it resetting, please 
      enter your email address below and we will send you an email allowing 
      you to reset your password.</p>

    <?php 
    show_error_list($errors);
    ?>
 
    <form method="post" action="" accept-charset="UTF-8">
      <div class="fieldrow">
        <?php 
    text_field($_POST, 'email', 'Email address');
    ?>
      </div>

      <div class="fieldrow">
        <input type="submit" name="reset" value="Reset" />
      </div>
    </form>
<?php 
}
Exemple #6
0
function content()
{
    global $config;
    if (!user_logged_in()) {
        return must_log_in();
    }
    $errors = array();
    if (!array_key_exists('id', $_GET)) {
        $errors[] = 'No user ID';
    }
    if (count($errors) == 0) {
        $user = fetch_one_or_none('users', 'id', $_GET['id']);
        if (!$user) {
            $errors[] = 'No such user';
        }
        if (!$user->date_verified) {
            $errors[] = 'User has not yet been verified';
        }
        if ($user->date_approved) {
            $errors[] = 'User has already been approved';
        }
    }
    if (count($errors)) {
        page_header("Error approving account");
        show_error_list($errors);
        return;
    }
    if (!$user->date_approved) {
        update_all('users', array('date_approved' => date('Y-m-d H:i:s'), 'approved_by' => user_logged_in()), 'id', $user->id);
    }
    $root = 'http://' . $config['domain'] . $config['http_path'];
    $msg = "Your " . $config['title'] . " account has been approved.  " . "To log in, please follow \n" . "the following link:\n" . "\n" . "  {$root}account/login\n" . "\n";
    mail(sprintf('"%s" <%s>', $user->name, $user->email_address), $config['title'] . " account approved", $msg) or die('Unable to send email');
    register_user_rdf($user);
    page_header("Account approved");
    ?>

  <p>Thank you for approving <?php 
    esc($user->name);
    ?>
's account.</p>

<?php 
}
Exemple #7
0
function content()
{
    if (!user_logged_in()) {
        return must_log_in();
    }
    $errors = array();
    if (array_key_exists('upload', $_POST)) {
        if (!array_key_exists('file', $_FILES) || filesize($_FILES['file']['tmp_name']) == 0) {
            $errors[] = 'Please supply a file';
        }
        if (count($errors) == 0) {
            preg_match('/\\.([^\\/.]+)$/', $_FILES['file']['name'], $matches);
            $file_id = do_upload($_FILES['file']['tmp_name'], $_FILES['file']['type'], $matches[1], $_FILES['file']['size']);
            page_header('File uploaded');
            ?>


      <?php 
            return;
        }
    }
    page_header('Upload file');
    show_error_list($errors);
    ?>

    <form enctype="multipart/form-data" action="" method="post">
      <div class="fieldrow">
        <div>
          <label for="file">Select an image 
            <span class="label-extra">(size limit: 8MB)</span></label>
          <input id="file" name="file" type="file" />
        </div>
      </div>

  
      <div class="fieldrow">
        <input type="submit" name="upload" value="Upload" />
      </div>
    </form>

<?php 
}
Exemple #8
0
function content()
{
    $errors = array();
    if (user_logged_in()) {
        $uid = user_logged_in();
    } else {
        if (!array_key_exists('token', $_GET) || !$_GET['token']) {
            $errors[] = 'Invalid reset token';
        }
        $token = $_GET['token'];
        $user = fetch_one_or_none('users', 'activation_token', $_GET['token']);
        if (count($user) != 1) {
            $errors[] = 'Invalid reset token';
        }
        if (count($errors)) {
            page_header('Reset failed');
            show_error_list($errors);
            return;
        }
        $uid = $user->id;
    }
    page_header('Reset password');
    if (array_key_exists('reset', $_POST)) {
        if (!isset($_POST['password']) || !isset($_POST['password2']) || !$_POST['password']) {
            $errors[] = "Please provide a password";
        } else {
            $password = $_POST['password'];
            $password2 = $_POST['password2'];
            if ($password != $password2) {
                $errors[] = "Passwords do not match";
            } else {
                update_all('users', array('password_crypt' => crypt($password), 'activation_token' => null), 'id', $uid);
                ?>
        <p>Your password has been reset.<?php 
                if (!user_logged_in()) {
                    ?>
          You may now wish to <a href="login">log in</a>.<?php 
                }
                ?>
</p>
        <?php 
                return;
            }
        }
        show_error_list($errors);
    }
    ?>

    <form method="post" action="" accept-charset="UTF-8">
       <div class="fieldrow">
        <div>
          <label for="password">Password</label>
          <input type="password" id="password" name="password" 
            value="<?php 
    esc($_POST['password']);
    ?>
" />
        </div>
        <div>
          <label for="password2">Confirm password</label>
          <input type="password" id="password2" name="password2" 
            value="<?php 
    esc($_POST['password2']);
    ?>
" />
        </div>
      </div>

      <div class="fieldrow">
        <input type="submit" name="reset" value="Reset" />
      </div>
    </form>
<?php 
}
Exemple #9
0
function content()
{
    $errors = array();
    if (array_key_exists('register', $_POST)) {
        $name = $_POST['name'];
        $email = $_POST['email'];
        $password = $_POST['password'];
        $password2 = $_POST['password2'];
        if (!$name || !$email || !$password || !$password2) {
            $errors[] = "Please fill in all the fields";
        }
        if ($password && $password2 && $password != $password2) {
            $errors[] = "Passwords do not match";
            $_POST['password'] = '';
            $_POST['password2'] = '';
        }
        if ($email && !validate_email_address($email)) {
            error_log("Invalid email address <{$email}> while registering");
            $errors[] = "Invalid email address";
        }
        if (count($errors) == 0 && count(fetch_all('users', 'email_address', $email))) {
            $errors[] = "A user with this email address already exists";
        }
        if (count($errors) == 0) {
            $token = make_random_token();
            $data = array('name' => $name, 'email_address' => $email, 'password_crypt' => crypt($password), 'date_registered' => date('Y-m-d H:i:s'), 'activation_token' => $token);
            insert_array_contents('users', $data);
            send_activation_email($email, $name, $token);
            ?>

      <h2>Account registered</h2>

      <p>An email has just been sent to the email address you supplied.  This
        contains a link which you should follow to activate your account.</p>
      
      <?php 
            return;
        }
    }
    page_header('Register for an account');
    show_error_list($errors);
    ?>

    <form method="post" action="" accept-charset="UTF-8">
      <div class="fieldrow">
        <?php 
    text_field($_POST, 'name', 'Name', 'publicly visible');
    ?>
      </div>

      <div class="fieldrow">
        <?php 
    text_field($_POST, 'email', 'Email address');
    ?>
      </div>

      <div class="fieldrow">
        <div>
          <label for="password">Password</label>
          <input type="password" id="password" name="password" 
            value="<?php 
    esc($_POST['password']);
    ?>
" />
        </div>
        <div>
          <label for="password2">Confirm password</label>
          <input type="password" id="password2" name="password2" 
            value="<?php 
    esc($_POST['password2']);
    ?>
" />
        </div>
      </div>

      <div class="fieldrow">
        <input type="submit" name="register" value="Register" />
      </div>
    </form>
  <?php 
}
function show_fatal($errors)
{
    print "<html>\n<head><title>Error</title></head>\n\n\t   <body>\n<p>There were problems with your submission.</p>\n";
    show_error_list($errors);
    print "This may be through no fault of your own and is probably not\n\t   immediately correctable.  Please come back and try again later.\n\t   </p>\n</body>\n</html>\n";
}
Exemple #11
0
function content()
{
    if (!user_logged_in()) {
        return must_log_in();
    }
    $user = fetch_one_or_none('users', 'id', user_logged_in());
    page_header('Account');
    $errors = array();
    if (array_key_exists('apply', $_POST)) {
        if (!isset($_POST['name']) || !$_POST['name']) {
            $errors[] = "Please provide a name";
        }
        if (count($errors) == 0) {
            $sets = array('name' => $_POST['name']);
            update_all('users', $sets, 'id', $user->id);
            update_local_object($user, $sets);
            ?>
      <p>Your changes have been applied.  
        Return to <a href=".">account</a> page.</p> 
      <?php 
            return;
        }
        show_error_list($errors);
    }
    $fields = array('name' => $user->name, 'email' => $user->email_address);
    ?>

    <form method="post" action="" accept-charset="UTF-8">
      <fieldset>
        <legend>Details</legend>
        <div class="fieldrow">
          <?php 
    text_field($fields, 'name', 'Name', 'publicly visible');
    ?>
        </div>
        <div class="fieldrow">
          <div class="field">
            <label>Email address</label>
            <div><tt><?php 
    esc($fields['email']);
    ?>
</tt>
            <a class="control small" style="padding-left: 1em" 
               href="change-email">Change</a></div>
          </div>
        </div>
        <div class="fieldrow">
          <div class="field">
            <label>Password</label>
            <div><tt>********</tt>
            <a class="control small" style="padding-left: 1em" 
               href="reset-password">Change</a></div>
          </div>
        </div>
        <div class="fieldrow">
          <input type="submit" name="apply" value="Update"/>
        </div>
      </fieldset>

      <fieldset>
        <legend>Contact details</legend>
        <p>Any details entered here will be made publicly available.</p>
<?php 
    /*NAME, ADDR, PHON, EMAIL, FAX, WWW, OBJE, LANG, RFN, RIN, NOTE, CHAN*/
    ?>
      </fieldset>
    </form>
<?php 
}