recoverpassword.php 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352
  1. <?php
  2. /*
  3. * StatusNet - the distributed open-source microblogging tool
  4. * Copyright (C) 2008, 2009, StatusNet, Inc.
  5. *
  6. * This program is free software: you can redistribute it and/or modify
  7. * it under the terms of the GNU Affero General Public License as published by
  8. * the Free Software Foundation, either version 3 of the License, or
  9. * (at your option) any later version.
  10. *
  11. * This program is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU Affero General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU Affero General Public License
  17. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  18. */
  19. if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
  20. // You have 24 hours to claim your password
  21. define('MAX_RECOVERY_TIME', 24 * 60 * 60);
  22. class RecoverpasswordAction extends Action
  23. {
  24. var $mode = null;
  25. var $msg = null;
  26. var $success = null;
  27. function handle()
  28. {
  29. parent::handle();
  30. if (common_logged_in()) {
  31. // TRANS: Client error displayed trying to recover password while already logged in.
  32. $this->clientError(_('You are already logged in!'));
  33. } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
  34. if ($this->arg('recover')) {
  35. $this->recoverPassword();
  36. } else if ($this->arg('reset')) {
  37. $this->resetPassword();
  38. } else {
  39. // TRANS: Client error displayed when unexpected data is posted in the password recovery form.
  40. $this->clientError(_('Unexpected form submission.'));
  41. }
  42. } else {
  43. if ($this->trimmed('code')) {
  44. $this->checkCode();
  45. } else {
  46. $this->showForm();
  47. }
  48. }
  49. }
  50. function checkCode()
  51. {
  52. $code = $this->trimmed('code');
  53. $confirm = Confirm_address::getKV('code', $code);
  54. if (!$confirm) {
  55. // TRANS: Client error displayed when password recovery code is not correct.
  56. $this->clientError(_('No such recovery code.'));
  57. }
  58. if ($confirm->address_type != 'recover') {
  59. // TRANS: Client error displayed when no proper password recovery code was submitted.
  60. $this->clientError(_('Not a recovery code.'));
  61. }
  62. $user = User::getKV($confirm->user_id);
  63. if (!$user) {
  64. // TRANS: Server error displayed trying to recover password without providing a user.
  65. $this->serverError(_('Recovery code for unknown user.'));
  66. }
  67. $touched = strtotime($confirm->modified);
  68. $email = $confirm->address;
  69. // Burn this code
  70. $confirm->delete();
  71. // These should be reaped, but for now we just check mod time
  72. // Note: it's still deleted; let's avoid a second attempt!
  73. if ((time() - $touched) > MAX_RECOVERY_TIME) {
  74. common_log(LOG_WARNING,
  75. 'Attempted redemption on recovery code ' .
  76. 'that is ' . $touched . ' seconds old. ');
  77. // TRANS: Client error displayed trying to recover password with too old a recovery code.
  78. $this->clientError(_('This confirmation code is too old. ' .
  79. 'Please start again.'));
  80. }
  81. // If we used an outstanding confirmation to send the email,
  82. // it's been confirmed at this point.
  83. if (!$user->email) {
  84. $orig = clone($user);
  85. $user->email = $email;
  86. // Throws exception on failure.
  87. $user->updateWithKeys($orig);
  88. }
  89. // Success!
  90. $this->setTempUser($user);
  91. $this->showPasswordForm();
  92. }
  93. function setTempUser(&$user)
  94. {
  95. common_ensure_session();
  96. $_SESSION['tempuser'] = $user->id;
  97. }
  98. function getTempUser()
  99. {
  100. common_ensure_session();
  101. $user_id = $_SESSION['tempuser'];
  102. if ($user_id) {
  103. $user = User::getKV($user_id);
  104. }
  105. return $user;
  106. }
  107. function clearTempUser()
  108. {
  109. common_ensure_session();
  110. unset($_SESSION['tempuser']);
  111. }
  112. function showPageNotice()
  113. {
  114. if ($this->msg) {
  115. $this->element('div', ($this->success) ? 'success' : 'error', $this->msg);
  116. } else {
  117. $this->elementStart('div', 'instructions');
  118. if ($this->mode == 'recover') {
  119. $this->element('p', null,
  120. // TRANS: Page notice for password recovery page.
  121. _('If you have forgotten or lost your' .
  122. ' password, you can get a new one sent to' .
  123. ' the email address you have stored' .
  124. ' in your account.'));
  125. } else if ($this->mode == 'reset') {
  126. $this->element('p', null,
  127. // TRANS: Page notice for password change page.
  128. _('You have been identified. Enter a' .
  129. ' new password below.'));
  130. }
  131. $this->elementEnd('div');
  132. }
  133. }
  134. function showForm($msg=null)
  135. {
  136. $this->msg = $msg;
  137. $this->mode = 'recover';
  138. $this->showPage();
  139. }
  140. function showContent()
  141. {
  142. if ($this->mode == 'recover') {
  143. $this->showRecoverForm();
  144. } else if ($this->mode == 'reset') {
  145. $this->showResetForm();
  146. }
  147. }
  148. function showRecoverForm()
  149. {
  150. $this->elementStart('form', array('method' => 'post',
  151. 'id' => 'form_password_recover',
  152. 'class' => 'form_settings',
  153. 'action' => common_local_url('recoverpassword')));
  154. $this->elementStart('fieldset');
  155. // TRANS: Fieldset legend for password recovery page.
  156. $this->element('legend', null, _('Password recovery'));
  157. $this->elementStart('ul', 'form_data');
  158. $this->elementStart('li');
  159. // TRANS: Field label on password recovery page.
  160. $this->input('nicknameoremail', _('Nickname or email address'),
  161. $this->trimmed('nicknameoremail'),
  162. // TRANS: Title for field label on password recovery page.
  163. _('Your nickname on this server, ' .
  164. 'or your registered email address.'));
  165. $this->elementEnd('li');
  166. $this->elementEnd('ul');
  167. $this->element('input', array('name' => 'recover',
  168. 'type' => 'hidden',
  169. // TRANS: Field label on password recovery page.
  170. 'value' => _('Recover')));
  171. // TRANS: Button text on password recovery page.
  172. $this->submit('recover', _m('BUTTON','Recover'));
  173. $this->elementEnd('fieldset');
  174. $this->elementEnd('form');
  175. }
  176. function title()
  177. {
  178. switch ($this->mode) {
  179. // TRANS: Title for password recovery page in password reset mode.
  180. case 'reset': return _('Reset password');
  181. // TRANS: Title for password recovery page in password recover mode.
  182. case 'recover': return _('Recover password');
  183. // TRANS: Title for password recovery page in email sent mode.
  184. case 'sent': return _('Password recovery requested');
  185. // TRANS: Title for password recovery page in password saved mode.
  186. case 'saved': return _('Password saved');
  187. default:
  188. // TRANS: Title for password recovery page when an unknown action has been specified.
  189. return _('Unknown action');
  190. }
  191. }
  192. function showPasswordForm($msg=null)
  193. {
  194. $this->msg = $msg;
  195. $this->mode = 'reset';
  196. $this->showPage();
  197. }
  198. function showResetForm()
  199. {
  200. $this->elementStart('form', array('method' => 'post',
  201. 'id' => 'form_password_change',
  202. 'class' => 'form_settings',
  203. 'action' => common_local_url('recoverpassword')));
  204. $this->elementStart('fieldset');
  205. // TRANS: Fieldset legend for password reset form.
  206. $this->element('legend', null, _('Password change'));
  207. $this->hidden('token', common_session_token());
  208. $this->elementStart('ul', 'form_data');
  209. $this->elementStart('li');
  210. // TRANS: Field label for password reset form.
  211. $this->password('newpassword', _('New password'),
  212. // TRANS: Title for field label for password reset form.
  213. _('6 or more characters, and do not forget it!'));
  214. $this->elementEnd('li');
  215. $this->elementStart('li');
  216. // TRANS: Field label for password reset form where the password has to be typed again.
  217. $this->password('confirm', _('Confirm'),
  218. // TRANS: Title for field label for password reset form where the password has to be typed again.
  219. _('Same as password above.'));
  220. $this->elementEnd('li');
  221. $this->elementEnd('ul');
  222. // TRANS: Button text for password reset form.
  223. $this->submit('reset', _m('BUTTON','Reset'));
  224. $this->elementEnd('fieldset');
  225. $this->elementEnd('form');
  226. }
  227. function recoverPassword()
  228. {
  229. $nore = $this->trimmed('nicknameoremail');
  230. if (!$nore) {
  231. // TRANS: Form instructions for password recovery form.
  232. $this->showForm(_('Enter a nickname or email address.'));
  233. return;
  234. }
  235. try {
  236. User::recoverPassword($nore);
  237. $this->mode = 'sent';
  238. if (common_is_email($nore) && common_config('site', 'fakeaddressrecovery')) {
  239. // TRANS: User notification when recovering password by giving email address,
  240. // regardless if the mail was sent or not (to hide registered email status).
  241. $this->msg = _('If the email address you provided was found in the database, a recovery mail with instructions has been sent there.');
  242. } else {
  243. // TRANS: User notification after an e-mail with instructions was sent from the password recovery form.
  244. $this->msg = _('Instructions for recovering your password ' .
  245. 'have been sent to the email address registered to your ' .
  246. 'account.');
  247. }
  248. $this->success = true;
  249. } catch (Exception $e) {
  250. $this->success = false;
  251. $this->msg = $e->getMessage();
  252. }
  253. $this->showPage();
  254. }
  255. function resetPassword()
  256. {
  257. // CSRF protection
  258. $token = $this->trimmed('token');
  259. if (!$token || $token != common_session_token()) {
  260. // TRANS: Form validation error message.
  261. $this->showForm(_('There was a problem with your session token. Try again, please.'));
  262. return;
  263. }
  264. $user = $this->getTempUser();
  265. if (!$user) {
  266. // TRANS: Client error displayed when trying to reset as password without providing a user.
  267. $this->clientError(_('Unexpected password reset.'));
  268. }
  269. $newpassword = $this->trimmed('newpassword');
  270. $confirm = $this->trimmed('confirm');
  271. if (!$newpassword || strlen($newpassword) < 6) {
  272. // TRANS: Reset password form validation error message.
  273. $this->showPasswordForm(_('Password must be 6 characters or more.'));
  274. return;
  275. }
  276. if ($newpassword != $confirm) {
  277. // TRANS: Reset password form validation error message.
  278. $this->showPasswordForm(_('Password and confirmation do not match.'));
  279. return;
  280. }
  281. // OK, we're ready to go
  282. $user->setPassword($newpassword);
  283. $this->clearTempUser();
  284. if (!common_set_user($user->nickname)) {
  285. // TRANS: Server error displayed when something does wrong with the user object during password reset.
  286. $this->serverError(_('Error setting user.'));
  287. }
  288. common_real_login(true);
  289. $this->mode = 'saved';
  290. // TRANS: Success message for user after password reset.
  291. $this->msg = _('New password successfully saved. ' .
  292. 'You are now logged in.');
  293. $this->success = true;
  294. $this->showPage();
  295. }
  296. /**
  297. * A local menu
  298. *
  299. * Shows different login/register actions.
  300. *
  301. * @return void
  302. */
  303. function showLocalNav()
  304. {
  305. $nav = new LoginGroupNav($this);
  306. $nav->show();
  307. }
  308. }