/user/plugins/login/classes/Controller.php
PHP | 524 lines | 300 code | 87 blank | 137 comment | 42 complexity | 0d19fd1832716d92bdedbc37e9e04c5f MD5 | raw file
- <?php
- namespace Grav\Plugin\Login;
- <<<<<<< HEAD
- use Grav\Common\Grav;
- use Grav\Common\Utils;
- use Grav\Plugin\Login\RememberMe;
- use Birke\Rememberme\Cookie;
- class Controller implements ControllerInterface
- =======
- use Grav\Common\Config\Config;
- use Grav\Common\Grav;
- use Grav\Plugin\Login\RememberMe;
- use Grav\Common\Language\Language;
- use Grav\Common\User\User;
- use Grav\Common\Utils;
- use Grav\Plugin\Email\Utils as EmailUtils;
- use Birke\Rememberme\Cookie;
- use RocketTheme\Toolbox\Session\Message;
- /**
- * Class Controller
- * @package Grav\Plugin\Login
- */
- class Controller
- >>>>>>> update grav cms
- {
- /**
- * @var \Grav\Common\Grav
- */
- public $grav;
- /**
- * @var string
- */
- public $action;
- /**
- * @var array
- */
- public $post;
- /**
- * @var string
- */
- protected $redirect;
- /**
- * @var int
- */
- protected $redirectCode;
- /**
- * @var string
- */
- <<<<<<< HEAD
- protected $prefix = 'do';
- =======
- protected $prefix = 'task';
- >>>>>>> update grav cms
- /**
- * @var \Birke\Rememberme\Authenticator
- */
- protected $rememberMe;
- /**
- <<<<<<< HEAD
- =======
- * @var Login
- */
- protected $login;
- /**
- >>>>>>> update grav cms
- * @param Grav $grav
- * @param string $action
- * @param array $post
- */
- public function __construct(Grav $grav, $action, $post = null)
- {
- $this->grav = $grav;
- $this->action = $action;
- <<<<<<< HEAD
- =======
- $this->login = isset($this->grav['login']) ? $this->grav['login'] : '';
- >>>>>>> update grav cms
- $this->post = $this->getPost($post);
- $this->rememberMe();
- }
- /**
- * Performs an action.
- */
- public function execute()
- {
- // Set redirect if available.
- if (isset($this->post['_redirect'])) {
- $redirect = $this->post['_redirect'];
- unset($this->post['_redirect']);
- }
- $success = false;
- $method = $this->prefix . ucfirst($this->action);
- if (!method_exists($this, $method)) {
- throw new \RuntimeException('Page Not Found', 404);
- }
- try {
- <<<<<<< HEAD
- $success = call_user_func(array($this, $method));
- =======
- $success = call_user_func([$this, $method]);
- >>>>>>> update grav cms
- } catch (\RuntimeException $e) {
- $this->setMessage($e->getMessage(), 'error');
- }
- if (!$this->redirect && isset($redirect)) {
- $this->setRedirect($redirect);
- }
- return $success;
- }
- /**
- <<<<<<< HEAD
- =======
- * Handle login.
- *
- * @return bool True if the action was performed.
- */
- public function taskLogin()
- {
- /** @var Language $t */
- $t = $this->grav['language'];
- if ($this->authenticate($this->post)) {
- $this->login->setMessage($t->translate('PLUGIN_LOGIN.LOGIN_SUCCESSFUL'));
- $redirect = $this->grav['config']->get('plugins.login.redirect_after_login');
- if (!$redirect) {
- $redirect = $this->grav['uri']->referrer('/');
- }
- $this->setRedirect($redirect);
- } else {
- $user = $this->grav['user'];
- if ($user->username) {
- $this->setMessage($t->translate('PLUGIN_LOGIN.ACCESS_DENIED'), 'error');
- } else {
- $this->setMessage($t->translate('PLUGIN_LOGIN.LOGIN_FAILED'), 'error');
- }
- }
- return true;
- }
- /**
- * Handle logout.
- *
- * @return bool True if the action was performed.
- */
- public function taskLogout()
- {
- /** @var User $user */
- $user = $this->grav['user'];
- if (!$this->rememberMe->login()) {
- $credentials = $user->get('username');
- $this->rememberMe->getStorage()->cleanAllTriplets($credentials);
- }
- $this->rememberMe->clearCookie();
- $this->grav['session']->invalidate()->start();
- $this->setRedirect('/');
- return true;
- }
- /**
- * Handle the email password recovery procedure.
- *
- * @return bool True if the action was performed.
- */
- protected function taskForgot()
- {
- $param_sep = $this->grav['config']->get('system.param_sep', ':');
- $data = $this->post;
- $username = isset($data['username']) ? $data['username'] : '';
- $user = !empty($username) ? User::load($username) : null;
- /** @var Language $l */
- $language = $this->grav['language'];
- $messages = $this->grav['messages'];
- if (!isset($this->grav['Email'])) {
- $messages->add($language->translate('PLUGIN_LOGIN.FORGOT_EMAIL_NOT_CONFIGURED'), 'error');
- $this->setRedirect('/');
- return true;
- }
- if (!$user || !$user->exists()) {
- $messages->add($language->translate(['PLUGIN_LOGIN.FORGOT_USERNAME_DOES_NOT_EXIST', $username]), 'error');
- $this->setRedirect($this->grav['config']->get('plugins.login.route_forgot'));
- return true;
- }
- if (empty($user->email)) {
- $messages->add($language->translate(['PLUGIN_LOGIN.FORGOT_CANNOT_RESET_EMAIL_NO_EMAIL', $username]),
- 'error');
- $this->setRedirect($this->grav['config']->get('plugins.login.route_forgot'));
- return true;
- }
- $token = md5(uniqid(mt_rand(), true));
- $expire = time() + 604800; // next week
- $user->reset = $token . '::' . $expire;
- $user->save();
- $author = $this->grav['config']->get('site.author.name', '');
- $fullname = $user->fullname ?: $username;
- $reset_link = $this->grav['base_url_absolute'] . $this->grav['config']->get('plugins.login.route_reset') . '/task:login.reset/token' . $param_sep . $token . '/user' . $param_sep . $username . '/nonce' . $param_sep . Utils::getNonce('reset-form');
- $sitename = $this->grav['config']->get('site.title', 'Website');
- $from = $this->grav['config']->get('plugins.email.from');
- if (empty($from)) {
- $messages->add($language->translate('PLUGIN_LOGIN.FORGOT_EMAIL_NOT_CONFIGURED'), 'error');
- $this->setRedirect($this->grav['config']->get('plugins.login.route_forgot'));
- return true;
- }
- $to = $user->email;
- $subject = $language->translate(['PLUGIN_LOGIN.FORGOT_EMAIL_SUBJECT', $sitename]);
- $content = $language->translate(['PLUGIN_LOGIN.FORGOT_EMAIL_BODY', $fullname, $reset_link, $author, $sitename]);
- $sent = EmailUtils::sendEmail($subject, $content, $to);
- if ($sent < 1) {
- $messages->add($language->translate('PLUGIN_LOGIN.FORGOT_FAILED_TO_EMAIL'), 'error');
- } else {
- $messages->add($language->translate(['PLUGIN_LOGIN.FORGOT_INSTRUCTIONS_SENT_VIA_EMAIL', $to]), 'info');
- }
- $this->setRedirect('/');
- return true;
- }
- /**
- * Handle the reset password action.
- *
- * @return bool True if the action was performed.
- */
- public function taskReset()
- {
- $data = $this->post;
- $language = $this->grav['language'];
- $messages = $this->grav['messages'];
- if (isset($data['password'])) {
- $username = isset($data['username']) ? $data['username'] : null;
- $user = !empty($username) ? User::load($username) : null;
- $password = isset($data['password']) ? $data['password'] : null;
- $token = isset($data['token']) ? $data['token'] : null;
- if (!empty($user) && $user->exists() && !empty($user->reset)) {
- list($good_token, $expire) = explode('::', $user->reset);
- if ($good_token === $token) {
- if (time() > $expire) {
- $messages->add($language->translate('PLUGIN_LOGIN.RESET_LINK_EXPIRED'), 'error');
- $this->grav->redirect($this->grav['config']->get('plugins.login.route_forgot'));
- return true;
- }
- unset($user->hashed_password);
- unset($user->reset);
- $user->password = $password;
- $user->validate();
- $user->filter();
- $user->save();
- $messages->add($language->translate('PLUGIN_LOGIN.RESET_PASSWORD_RESET'), 'info');
- $this->grav->redirect('/');
- return true;
- }
- }
- $messages->add($language->translate('PLUGIN_LOGIN.RESET_INVALID_LINK'), 'error');
- $this->grav->redirect($this->grav['config']->get('plugins.login.route_forgot'));
- return true;
- } else {
- $user = $this->grav['uri']->param('user');
- $token = $this->grav['uri']->param('token');
- if (empty($user) || empty($token)) {
- $messages->add($language->translate('PLUGIN_LOGIN.RESET_INVALID_LINK'), 'error');
- $this->grav->redirect($this->grav['config']->get('plugins.login.route_forgot'));
- return true;
- }
- }
- return true;
- }
- /**
- * Authenticate user.
- *
- * @param array $form Form fields.
- *
- * @return bool
- */
- protected function authenticate($form)
- {
- /** @var User $user */
- $user = $this->grav['user'];
- if (!$user->authenticated) {
- $username = isset($form['username']) ? $form['username'] : $this->rememberMe->login();
- // Normal login process
- $user = User::load($username);
- if ($user->exists()) {
- if (!empty($form['username']) && !empty($form['password'])) {
- // Authenticate user
- $user->authenticated = $user->authenticate($form['password']);
- if ($user->authenticated) {
- $this->grav['session']->user = $user;
- unset($this->grav['user']);
- $this->grav['user'] = $user;
- // If the user wants to be remembered, create Rememberme cookie
- if (!empty($form['rememberme'])) {
- $this->rememberMe->createCookie($form['username']);
- } else {
- $this->rememberMe->clearCookie();
- $this->rememberMe->getStorage()->cleanAllTriplets($user->get('username'));
- }
- }
- }
- }
- }
- // Authorize against user ACL
- $user_authorized = $user->authorize('site.login');
- $user->authenticated = ($user->authenticated && $user_authorized);
- return $user->authenticated;
- }
- /**
- >>>>>>> update grav cms
- * Redirects an action
- */
- public function redirect()
- {
- if ($this->redirect) {
- $this->grav->redirect($this->redirect, $this->redirectCode);
- <<<<<<< HEAD
- } else if ($redirect = $this->grav['config']->get('plugins.login.redirect')) {
- $this->grav->redirect($redirect, $this->redirectCode);
- =======
- >>>>>>> update grav cms
- }
- }
- /**
- * Set redirect.
- *
- <<<<<<< HEAD
- * @param $path
- =======
- * @param $path
- >>>>>>> update grav cms
- * @param int $code
- */
- public function setRedirect($path, $code = 303)
- {
- $this->redirect = $path;
- <<<<<<< HEAD
- $this->code = $code;
- =======
- $this->redirectCode = $code;
- >>>>>>> update grav cms
- }
- /**
- * Add message into the session queue.
- *
- * @param string $msg
- * @param string $type
- */
- public function setMessage($msg, $type = 'info')
- {
- /** @var Message $messages */
- $messages = $this->grav['messages'];
- $messages->add($msg, $type);
- }
- /**
- * Gets and sets the RememberMe class
- *
- <<<<<<< HEAD
- * @param mixed $var A rememberMe instance to set
- *
- * @return Authenticator Returns the current rememberMe instance
- =======
- * @param mixed $var A rememberMe instance to set
- *
- * @return RememberMe\RememberMe Returns the current rememberMe instance
- >>>>>>> update grav cms
- */
- public function rememberMe($var = null)
- {
- if ($var !== null) {
- $this->rememberMe = $var;
- }
- <<<<<<< HEAD
- =======
- >>>>>>> update grav cms
- if (!$this->rememberMe) {
- /** @var Config $config */
- $config = $this->grav['config'];
- // Setup storage for RememberMe cookies
- $storage = new RememberMe\TokenStorage();
- $this->rememberMe = new RememberMe\RememberMe($storage);
- $this->rememberMe->setCookieName($config->get('plugins.login.rememberme.name'));
- $this->rememberMe->setExpireTime($config->get('plugins.login.rememberme.timeout'));
- // Hardening cookies with user-agent and random salt or
- // fallback to use system based cache key
- <<<<<<< HEAD
- $data = $_SERVER['HTTP_USER_AGENT'] . $config->get('security.salt', $this->grav['cache']->getKey());
- =======
- $server_agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : 'unknown';
- $data = $server_agent . $config->get('security.salt', $this->grav['cache']->getKey());
- >>>>>>> update grav cms
- $this->rememberMe->setSalt(hash('sha512', $data));
- // Set cookie with correct base path of Grav install
- $cookie = new Cookie();
- $cookie->setPath($this->grav['base_url_relative']);
- $this->rememberMe->setCookie($cookie);
- }
- return $this->rememberMe;
- }
- /**
- * Prepare and return POST data.
- *
- * @param array $post
- <<<<<<< HEAD
- =======
- *
- >>>>>>> update grav cms
- * @return array
- */
- protected function &getPost($post)
- {
- unset($post[$this->prefix]);
- // Decode JSON encoded fields and merge them to data.
- if (isset($post['_json'])) {
- $post = array_merge_recursive($post, $this->jsonDecode($post['_json']));
- unset($post['_json']);
- }
- <<<<<<< HEAD
- =======
- >>>>>>> update grav cms
- return $post;
- }
- /**
- * Recursively JSON decode data.
- *
- * @param array $data
- <<<<<<< HEAD
- =======
- *
- >>>>>>> update grav cms
- * @return array
- */
- protected function jsonDecode(array $data)
- {
- foreach ($data as &$value) {
- if (is_array($value)) {
- $value = $this->jsonDecode($value);
- } else {
- $value = json_decode($value, true);
- }
- }
- <<<<<<< HEAD
- =======
- >>>>>>> update grav cms
- return $data;
- }
- }