page_password_reset.inc

<?php
require_once SQ_CORE_PACKAGE_PATH.'/page/page.inc';
require_once SQ_FUDGE_PATH.'/general/text.inc';
require_once SQ_LIB_PATH.'/html_form/html_form.inc';

class Page_Password_Reset extends Page
{

    var $default_state = 'request';


    function __construct($assetid=0)
    {
        $this->_ser_attrs = TRUE;
        parent::__construct($assetid);

    }//end constructor


    function create(&$link)
    {
        // Set default value for email format attr
        $val = Array();
        $val['subject'] = translate('cms_password_reset_email_subject');
        $val['text_format'] = translate('cms_password_reset_email_msg', '%asset_attribute_username%', '%password_reset_url%');
        $val['html_format'] = '<p>'.translate('cms_password_reset_email_msg', '%asset_attribute_username%', '<a href="%password_reset_url%">%password_reset_url%</a>').'</p>';
        $val['from'] = SQ_CONF_SYSTEM_NAME.' <'.SQ_CONF_DEFAULT_EMAIL.'>';
        $this->setAttrVAlue('request_email_format', $val);

        return parent::create($link);

    }//end create()


    function _createAdditional(&$link)
    {
        if (!parent::_createAdditional($link)) return FALSE;

        // Add a group of users
        $GLOBALS['SQ_SYSTEM']->am->includeAsset('user_group');
        $group_link = Array('asset' => &$this, 'link_type' => SQ_LINK_TYPE_2, 'is_dependant' => 1, 'is_exclusive' => 1, 'value' => 'pending_accounts');

        $group = new User_Group();

        $group->setAttrValue('name', translate('cms_password_reset_pending_group'));
        if (!$group->create($group_link)) return FALSE;
        $GLOBALS['SQ_SYSTEM']->am->forgetAsset($group);

        // Add a bodycopy to this page when creating
        $GLOBALS['SQ_SYSTEM']->am->includeAsset('bodycopy');
        $copy_link = Array('asset' => &$this, 'link_type' => SQ_LINK_TYPE_2, 'is_dependant' => 1, 'is_exclusive' => 1, 'value' => '');

        foreach ($this->_getBodycopies() as $value => $details) {
            $bodycopy = new Bodycopy();
            $copy_link['value'] = $value;

            $bodycopy->setAttrValue('name', $details['name']);
            unset($details['name']);
            if (!$bodycopy->create($copy_link, $details)) {
                 return FALSE;
            }
            $GLOBALS['SQ_SYSTEM']->am->forgetAsset($bodycopy);
        }
        return TRUE;

    }//end _createAdditional()


    function _getAllowedLinks()
    {
        $allowed_links = parent::_getAllowedLinks();

        $allowed_links[SQ_LINK_TYPE_2]['bodycopy'] = Array('card' => count($this->_getBodycopies()), 'exclusive' => TRUE);
        $allowed_links[SQ_LINK_TYPE_2]['user_group']    = Array('card' => '1', 'exclusive'  => TRUE);

        return $allowed_links;

    }//end _getAllowedLinks()


    function printBody()
    {
        // Since we are going a lot of changes here, tie the paint and process
        // together using db2
        $GLOBALS['SQ_SYSTEM']->changeDatabaseConnection('db2');

        $password_reset_action = $this->default_state;
        if (isset($_REQUEST['action'])) { // Handle form submission.
            $password_reset_action = $_REQUEST['action'];
        }
        echo $this->_printContents($password_reset_action);

        $GLOBALS['SQ_SYSTEM']->restoreDatabaseConnection();

    }//end printBody()


    function onRequestKeywords(&$broadcaster, $vars=Array())
    {
        if (!isset($vars['keywords'])) return;

        // which bodycopy?
        $parents = $GLOBALS['SQ_SYSTEM']->am->getParents($broadcaster->id, 'bodycopy', TRUE);
        $type_links = $GLOBALS['SQ_SYSTEM']->am->getLinks($this->id, SQ_LINK_TYPE_2, 'bodycopy');
        foreach ($type_links as $link_info) {
            if (isset($parents[$link_info['minorid']])) {
                $bodycopy_type = $link_info['value'];
            }
        }

        // Make sure this is a bodycopy we can replace keywords for...?
        if (!isset($bodycopy_type) || empty($bodycopy_type)) {
            return;
        }
        if (!in_array($bodycopy_type, array_keys($this->_getBodycopies()))) {
            return;
        }

        // Generate the name of the function we should call for keywords
        $tmp_type = strtr($bodycopy_type, '_', ' ');
        $tmp_type = ucwords($tmp_type);
        $tmp_type = preg_replace('/\s+/', '', $tmp_type);
        $type_func = '_get'.$tmp_type.'Keywords';

        if (method_exists($this, $type_func)) {
            $vars['keywords'] = array_merge($vars['keywords'], $this->$type_func());
        }

    }//end onRequestKeywords()


    function _printContents($action)
    {
        if (empty($action)) $action = $this->default_state;

        // Generate the name of the function we should call for processing
        $tmp_process = strtr($action, '_', ' ');
        $tmp_process = ucwords($tmp_process);
        $tmp_process = preg_replace('/\s+/', '', $tmp_process);
        $process_func = '_print'.$tmp_process.'Action';

        if (method_exists($this, $process_func)) {
            return $this->$process_func();
        }
        return;

    }//end _printContents()


    function _printRequestAction()
    {
        $replacements['password_reset_error'] = '';

        return $this->_buildContents('request', $replacements);

    }//end _printRequestAction()


    function _printRequestReceiptAction()
    {
        $replacements = Array();
        if (!isset($_POST['username']) || empty($_POST['username'])) {
            $replacements['password_reset_error'] = translate('cms_password_reset_message_empty_username');
            return $this->_buildContents('request', $replacements);
        } else {
            $username = $_POST['username'];
            $auth_folder = $GLOBALS['SQ_SYSTEM']->am->getSystemAsset('authentication_folder');
            if (is_null($auth_folder)) {
                trigger_localised_error('SYS0249', E_USER_ERROR);
                return Array();
            }
            $auth_systems = $auth_folder->getAuthSystems();

            $user = NULL;
            foreach ($auth_systems as $systemid) {
                $system = $GLOBALS['SQ_SYSTEM']->am->getAsset($systemid);
                if (is_null($system)) continue;

                if (method_exists($system, 'locateUser')) {
                    $user = $system->locateUser($username);
                    if (!is_null($user) && $user->canLogin()) {
                        break;
                    }
                }
            }

            $failure = FALSE;
            if (is_null($user)) {
                $failure = TRUE;
                // Shall we tell that the given user doesn't exits?
                if ($this->attr('invalid_user_error')) {
                    $replacements['password_reset_error'] = translate('cms_password_reset_message_invalid_username');
                    return $this->_buildContents('request', $replacements);
                }

            } else {
                foreach ($user->getAvailableKeywords() as $keyword => $description) {
                    $replacements[$keyword] = $user->getKeywordReplacement($keyword);
                }
                $user_hash = $this->_createResetLink($user->id);
                if (!$user_hash) $failure = TRUE;
            }

            // Do not attempt to send mail to anyone if we're not going to go ahead with this, especially
            // if we did't create any link!
            if (!$failure) {
                $email_replacements = $replacements;
                $email_replacements['password_reset_url'] = current_url().'?action=reset&prid='.$user_hash;

                $email_attr = $this->getAttribute('request_email_format');
                $email_value = unserialize($email_attr->value);
                $email_value['to'][] = $user->attr('email');
                $email_attr->value = serialize($email_value);

                @$email_attr->sendMail($email_replacements);
            }

        }//end else

        return $this->_buildContents('request_receipt', $replacements);

    }//end _printRequestReceiptAction()


    function _printResetAction()
    {
        $replacements = Array();
        $replacements['password_reset_error'] = '';

        $action = 'request';

        if (!isset($_REQUEST['prid']) || empty($_REQUEST['prid'])) {
                $replacements['password_reset_error'] = translate('cms_password_reset_message_no_prid');
        } else {
            $prid = $_REQUEST['prid'];
            $user_link = $this->_getResetLink($prid);
            if (empty($user_link)) {
                $replacements['password_reset_error'] = translate('cms_password_reset_message_invalid_prid');
            } else {
                $userid = $user_link['minorid'];
                $user = $GLOBALS['SQ_SYSTEM']->am->getAsset($userid);
                if (is_null($user)) {
                    $replacements['password_reset_error'] = translate('cms_password_reset_message_no_user');
                } else {
                    foreach ($user->getAvailableKeywords() as $keyword => $description) {
                        $replacements[$keyword] = $user->getKeywordReplacement($keyword);
                    }
                    $action = 'reset';
                }
            }
        }
        return $this->_buildContents($action, $replacements);

    }//end _printResetAction()


    function _printResetReceiptAction()
    {
        $replacements = Array();
        $replacements['password_reset_error'] = '';

        $action = 'request';

        if (!isset($_POST['password']) || empty($_POST['password'])) {
            $replacements['password_reset_error'] = translate('cms_password_reset_message_empty_password');
        } else if (!isset($_REQUEST['prid']) || empty($_REQUEST['prid'])) {
            $replacements['password_reset_error'] = translate('cms_password_reset_message_no_prid');
        } else {
            $password_parts = array_unique($_POST['password']);

            $prid = $_REQUEST['prid'];
            $user_link = $this->_getResetLink($prid);
            if (empty($user_link)) {
                $replacements['password_reset_error'] = translate('cms_password_reset_message_invalid_prid');
            } else {
                $userid = $user_link['minorid'];
                $user = $GLOBALS['SQ_SYSTEM']->am->getAsset($userid);
                if (is_null($user)) {
                    $replacements['password_reset_error'] = translate('cms_password_reset_message_no_user');
                } else {
                    foreach ($user->getAvailableKeywords() as $keyword => $description) {
                        $replacements[$keyword] = $user->getKeywordReplacement($keyword);
                    }
                    $action = 'reset';
                }
            }
            if (count($password_parts) == 1) {
                if ($this->_resetPassword($user, reset($password_parts))) {
                    // The password was reset sucessfully!
                    $action = 'reset_receipt';
                } else {
                    $replacements['password_reset_error'] = translate('cms_password_reset_message_generic_password_error');
                }
            } else {
                $replacements['password_reset_error'] = translate('cms_password_reset_message_different_passwords');
            }
        }

        $field = '';
        if (isset($prid)) {
            ob_start();
                hidden_field('prid', $prid);
            $field = ob_get_clean();
        }
        return $this->_buildContents($action, $replacements, $field);

    }//end _printResetReceiptAction()


    function _buildContents($action, $new_replacements=Array(), $extra='')
    {
        $replacements = Array();

        ob_start();
            $bodycopy = $this->_getBodycopy($action);
            $keywords = $bodycopy->getKeywords();

            foreach ($keywords as $keyword) {
                if (!in_array($keyword, array_keys($new_replacements))) {
                    $replacements[$keyword] = $this->getKeywordReplacement($keyword);
                } else {
                    $replacements[$keyword] = $new_replacements[$keyword];
                }
            }
            $bodycopy->setKeywordReplacements($replacements);
            $bodycopy->printBody();

            echo $extra;

            if (in_array($action, Array('request', 'reset'))) {
                return $this->_buildForm(ob_get_clean(), $action.'_receipt');
            }
        return ob_get_clean();

    }//end _buildContents()


    function _buildForm($body_contents, $action)
    {
        ob_start();
            ?><form id="<?php echo $this->getPrefix() ?>_<?php echo $action; ?>_form" method="post" action="<?php echo htmlentities(replace_query_string_vars(Array())); ?>" enctype="multipart/form-data">
                <?php echo hidden_field('action', $action); ?>
                <?php echo $body_contents; ?>
            </form><?php
        return ob_get_clean();

    }//end _buildForm()


    function _resetPassword(&$user, $new_password)
    {
        $GLOBALS['SQ_SYSTEM']->setRunLevel(SQ_RUN_LEVEL_FORCED);
            $result = @$user->setAttrValue('password', $new_password);

            if ($result) {
                $user->saveAttributes();

                $parentid = $this->_getPendingAccountsGroupId();
                if ($parentid == 0) return FALSE;

                $parent = $GLOBALS['SQ_SYSTEM']->am->getAsset($parentid, 'user_group');
                if (is_null($parent)) return FALSE;

                // Remove this user completly from our pending reset group.
                $links = $GLOBALS['SQ_SYSTEM']->am->getLinkByAsset($parentid, $user->id, SQ_LINK_TYPE_1, NULL, 'major', TRUE);
                foreach ($links as $link) {
                    $parent->deleteLink($link['linkid']);
                }
            }
        $GLOBALS['SQ_SYSTEM']->restoreRunLevel();

        // There should probably be an attribute that turns this functionality on/off.
        $GLOBALS['SQ_SYSTEM']->loginUser($user);

        return $result;

    }//end _resetPassword()


    function _createResetLink($assetid)
    {
        if (empty($assetid)) return FALSE;

        // The user asset.
        $asset = $GLOBALS['SQ_SYSTEM']->am->getAsset($assetid);
        if (is_null($asset)) return FALSE;

        $parentid = $this->_getPendingAccountsGroupId();
        if ($parentid == 0) return FALSE;

        // The user group asset.
        $parent = $GLOBALS['SQ_SYSTEM']->am->getAsset($parentid, 'user_group');
        if (is_null($parent)) return FALSE;

        $GLOBALS['SQ_SYSTEM']->setRunLevel(SQ_RUN_LEVEL_FORCED);
            $GLOBALS['SQ_SYSTEM']->changeDatabaseConnection('db2');

            // That's right, delete any existing links.
            $links = $GLOBALS['SQ_SYSTEM']->am->getLinkByAsset($parent->id, $assetid, SQ_LINK_TYPE_1, NULL, 'major', TRUE);
            foreach ($links as $link) {
                $GLOBALS['SQ_SYSTEM']->am->deleteAssetLink($link['linkid']);
            }

            $hash_value = MD5(implode('::', Array($this->id, $asset->id, $asset->name, (time() * rand()))));

            $return_value = FALSE;
            if ($parent->createLink($asset, SQ_LINK_TYPE_1, $hash_value)) {
                $return_value = $hash_value;
            }

            $GLOBALS['SQ_SYSTEM']->restoreDatabaseConnection();
        $GLOBALS['SQ_SYSTEM']->restoreRunLevel();


        return $return_value;

    }//end _createResetLink()


    function _getResetLink($value)
    {
        if (empty($value)) return Array();

        $parentid = $this->_getPendingAccountsGroupId();
        if ($parentid == 0) return FALSE;

        // This should return just the one link hopefully, otherwise we're in trouble ($value is a hash
        // and should be very unique).
        return $GLOBALS['SQ_SYSTEM']->am->getLink($parentid, SQ_LINK_TYPE_1, '', FALSE, $value);

    }//end _getResetLink()


    function _getStandardKeywords()
    {
        $keywords = Array();

        $keywords['submit_button'] = 'The submit button';
        $keywords['password_reset_error'] = 'Error messages';

        return $keywords;

    }//end _getStandardKeywords()


    function _getRequestKeywords()
    {
        $keywords = $this->_getStandardKeywords();

        $keywords['username_input'] = 'The input field for username';

        return $keywords;

    }//end _getRequestKeywords()


    function _getRequestReceiptKeywords()
    {
        $keywords = $this->_getStandardKeywords();

        return $keywords;

    }//end _getRequestReceiptKeywords()


    function _getResetKeywords()
    {
        $keywords = $this->_getStandardKeywords();

        $keywords['password_input'] = 'The input fields for password reset (new and confirmation password input fields)';
        $keywords['password_new'] = 'Input field for the new password';
        $keywords['password_confirmation'] = 'Input field for the Confirmation of the new password';

        return $keywords;

    }//end _getResetKeywords()


    function _getResetReceiptKeywords()
    {
        $keywords = $this->_getStandardKeywords();

        return $keywords;

    }//end _getResetReceiptKeywords()


    function getUsernameInputKeywordReplacement()
    {
        $value = '';
        if (isset($_POST['username'])) {
            $value = $_POST['username'];
        }

        ob_start();
            text_box('username', '');
        return ob_get_clean();

    }//end getUsernameInputKeywordReplacement()


    function getPasswordInputKeywordReplacement()
    {
        ob_start();
            password_box('password[]');
            password_box('password[]');
        return ob_get_clean();

    }//end getPasswordInputKeywordReplacement()


    function getPasswordNewKeywordReplacement()
    {
        ob_start();
            password_box('password[]');
        return ob_get_clean();

    }//end getPasswordNewKeywordReplacement()


    function getPasswordConfirmationKeywordReplacement()
    {
        ob_start();
            password_box('password[]');
        return ob_get_clean();

    }//end getPasswordConfirmationKeywordReplacement()


    function getSubmitButtonKeywordReplacement()
    {
        ob_start();
            submit_button('', translate('submit'));
        return ob_get_clean();

    }//end getSubmitButtonKeywordReplacement()


    function _getPendingAccountsGroupId()
    {
        $link = $GLOBALS['SQ_SYSTEM']->am->getLink($this->id, SQ_LINK_TYPE_2, 'user_group', FALSE, 'pending_accounts');
        if (empty($link)) return 0;

        return $link['minorid'];

    }//end _getPendingAccountsGroupId()


    function &_getBodycopy($link_value)
    {
        $null = NULL;

        $bodycopy_data = $GLOBALS['SQ_SYSTEM']->am->getLink($this->id, SQ_LINK_TYPE_2, 'bodycopy', TRUE, $link_value, 'major', '1');
        if (empty($bodycopy_data)) $null;

        $bodycopy = $GLOBALS['SQ_SYSTEM']->am->getAsset($bodycopy_data['minorid'], $bodycopy_data['minor_type_code']);
        if (is_null($bodycopy)) $null;

        return $bodycopy;

    }//end _getBodycopy()


    function _getBodycopies()
    {
        $res = Array();
        $res['request']['name'] = translate('cms_password_reset_request');
        $res['request']['content'] = '<p>%password_reset_error%</p><p>'.translate('cms_password_reset_request_msg').'</p><p>%username_input% %submit_button% </p>';

        $res['request_receipt']['name'] = translate('cms_password_reset_request_receipt');
        $res['request_receipt']['content'] = '<p>'.translate('cms_password_reset_request_receipt_msg').'</p>';

        $res['reset']['name'] = translate('cms_password_reset_reset');
        $res['reset']['content'] = '<p>%password_reset_error%</p><p>'.translate('cms_password_reset_reset_msg').'</p><p>%password_input%&nbsp;%submit_button%</p>';

        $res['reset_receipt']['name'] = translate('cms_password_reset_reset_receipt');
        $res['reset_receipt']['content'] = '<p>'.translate('cms_password_reset_reset_receipt_msg').'</p>';

        return $res;

    }//end _getBodycopies()


}//end class