web-base/Core/API/UserAPI.class.php

1610 lines
53 KiB
PHP
Raw Normal View History

2020-06-20 20:13:51 +02:00
<?php
2022-11-18 18:06:46 +01:00
namespace Core\API {
2020-06-20 20:13:51 +02:00
2022-11-18 18:06:46 +01:00
use Core\Driver\SQL\Condition\Compare;
use Core\Objects\Context;
use Core\Objects\DatabaseEntity\Language;
2022-11-19 01:15:34 +01:00
use Core\Objects\DatabaseEntity\User;
use Core\Objects\DatabaseEntity\UserToken;
2020-06-22 21:50:58 +02:00
abstract class UserAPI extends Request {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false, array $params = array()) {
parent::__construct($context, $externalCall, $params);
}
2022-03-08 11:50:18 +01:00
protected function checkUserExists(?string $username, ?string $email = null): bool {
2020-06-23 17:55:52 +02:00
$conditions = array();
2021-04-02 21:58:06 +02:00
if ($username) {
2020-06-23 17:55:52 +02:00
$conditions[] = new Compare("User.name", $username);
}
2021-04-02 21:58:06 +02:00
if ($email) {
2020-06-23 17:55:52 +02:00
$conditions[] = new Compare("User.email", $email);
}
if (empty($conditions)) {
return true;
}
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2020-06-22 21:50:58 +02:00
$res = $sql->select("User.name", "User.email")
->from("User")
2020-06-23 17:55:52 +02:00
->where(...$conditions)
2020-06-22 21:50:58 +02:00
->execute();
$this->success = ($res !== FALSE);
$this->lastError = $sql->getLastError();
if ($this->success && !empty($res)) {
$row = $res[0];
if (strcasecmp($username, $row['name']) === 0) {
return $this->createError("This username is already taken.");
2020-07-01 22:13:50 +02:00
} else if (strcasecmp($email, $row['email']) === 0) {
2020-06-22 21:50:58 +02:00
return $this->createError("This email address is already in use.");
}
2020-06-20 20:13:51 +02:00
}
2020-06-22 21:50:58 +02:00
return $this->success;
2020-06-20 20:13:51 +02:00
}
2021-12-08 16:53:43 +01:00
protected function checkPasswordRequirements($password, $confirmPassword): bool {
if ((($password === null) !== ($confirmPassword === null)) || strcmp($password, $confirmPassword) !== 0) {
2020-06-29 16:47:02 +02:00
return $this->createError("The given passwords do not match");
2022-06-20 19:52:31 +02:00
} else if (strlen($password) < 6) {
2020-06-29 16:47:02 +02:00
return $this->createError("The password should be at least 6 characters long");
}
return true;
}
2021-11-11 14:25:26 +01:00
protected function checkUsernameRequirements($username): bool {
if (strlen($username) < 5 || strlen($username) > 32) {
2020-06-29 16:47:02 +02:00
return $this->createError("The username should be between 5 and 32 characters long");
2021-11-11 14:25:26 +01:00
} else if (!preg_match("/[a-zA-Z0-9_\-]+/", $username)) {
return $this->createError("The username should only contain the following characters: a-z A-Z 0-9 _ -");
2020-06-29 16:47:02 +02:00
}
2021-11-11 14:25:26 +01:00
return true;
}
protected function checkRequirements($username, $password, $confirmPassword): bool {
return $this->checkUsernameRequirements($username) &&
$this->checkPasswordRequirements($password, $confirmPassword);
2020-06-29 16:47:02 +02:00
}
2022-11-20 17:13:53 +01:00
protected function insertUser(string $username, ?string $email, string $password, bool $confirmed, string $fullName = "", array $groups = []): bool|User {
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2022-11-19 01:15:34 +01:00
$user = new User();
2022-06-20 19:52:31 +02:00
$user->language = Language::DEFAULT_LANGUAGE(false);
$user->registeredAt = new \DateTime();
$user->password = $this->hashPassword($password);
$user->name = $username;
$user->email = $email;
$user->confirmed = $confirmed;
$user->fullName = $fullName ?? "";
2022-11-20 17:13:53 +01:00
$user->groups = $groups;
2022-06-20 19:52:31 +02:00
$this->success = ($user->save($sql) !== FALSE);
2020-06-22 21:50:58 +02:00
$this->lastError = $sql->getLastError();
2020-06-20 20:13:51 +02:00
2022-11-19 01:15:34 +01:00
return $this->success ? $user : false;
2020-06-20 20:13:51 +02:00
}
2022-06-20 19:52:31 +02:00
protected function hashPassword($password): string {
2020-06-23 18:40:43 +02:00
return password_hash($password, PASSWORD_BCRYPT);
2020-06-22 21:50:58 +02:00
}
2022-11-19 01:15:34 +01:00
protected function formatDuration(int $count, string $string): string {
if ($count === 1) {
return $string;
} else {
return "the next $count ${string}s";
}
2020-06-29 16:50:36 +02:00
}
2021-11-11 14:25:26 +01:00
2022-11-19 01:15:34 +01:00
protected function checkToken(string $token) : UserToken|bool {
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2022-11-20 17:13:53 +01:00
$userToken = UserToken::findBy(UserToken::createBuilder($sql, true)
->whereEq("UserToken.token", $token)
->whereGt("UserToken.valid_until", $sql->now())
->whereFalse("UserToken.used")
2022-11-20 17:13:53 +01:00
->fetchEntities());
2021-11-11 14:25:26 +01:00
2022-11-19 01:15:34 +01:00
if ($userToken === false) {
return $this->createError("Error verifying token: " . $sql->getLastError());
} else if ($userToken === null) {
return $this->createError("This token does not exist or is no longer valid");
2021-12-08 16:53:43 +01:00
} else {
2022-11-19 01:15:34 +01:00
return $userToken;
2021-12-08 16:53:43 +01:00
}
}
2020-06-20 20:13:51 +02:00
}
}
2022-11-18 18:06:46 +01:00
namespace Core\API\User {
2020-06-20 20:13:51 +02:00
2022-11-20 17:13:53 +01:00
use Core\API\Parameter\ArrayType;
2022-11-18 18:06:46 +01:00
use Core\API\Parameter\Parameter;
use Core\API\Parameter\StringType;
use Core\API\Template\Render;
use Core\API\Traits\Pagination;
2022-11-18 18:06:46 +01:00
use Core\API\UserAPI;
use Core\API\VerifyCaptcha;
2022-11-20 17:13:53 +01:00
use Core\Driver\SQL\Condition\CondBool;
use Core\Driver\SQL\Condition\CondOr;
use Core\Driver\SQL\Expression\Alias;
2023-01-16 21:47:23 +01:00
use Core\Driver\SQL\Query\Insert;
2022-11-20 17:13:53 +01:00
use Core\Objects\DatabaseEntity\Group;
2022-11-19 01:15:34 +01:00
use Core\Objects\DatabaseEntity\UserToken;
2022-11-18 18:06:46 +01:00
use Core\Driver\SQL\Column\Column;
use Core\Driver\SQL\Condition\Compare;
use Core\Driver\SQL\Condition\CondIn;
use Core\Driver\SQL\Expression\JsonArrayAgg;
2021-12-08 16:53:43 +01:00
use ImagickException;
2022-11-18 18:06:46 +01:00
use Core\Objects\Context;
use Core\Objects\DatabaseEntity\GpgKey;
use Core\Objects\TwoFactor\KeyBasedTwoFactorToken;
use Core\Objects\DatabaseEntity\User;
2020-06-20 20:13:51 +02:00
2020-06-22 21:50:58 +02:00
class Create extends UserAPI {
2020-06-20 20:13:51 +02:00
2022-11-20 17:13:53 +01:00
private User $user;
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
parent::__construct($context, $externalCall, array(
2020-06-22 21:50:58 +02:00
'username' => new StringType('username', 32),
2020-06-24 01:09:08 +02:00
'email' => new Parameter('email', Parameter::TYPE_EMAIL, true, NULL),
2020-06-22 21:50:58 +02:00
'password' => new StringType('password'),
'confirmPassword' => new StringType('confirmPassword'),
2022-11-20 17:13:53 +01:00
'groups' => new ArrayType("groups", Parameter::TYPE_INT, true, true, [])
2020-06-22 21:50:58 +02:00
));
2020-06-22 21:50:58 +02:00
$this->loginRequired = true;
2020-06-20 20:13:51 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-20 20:13:51 +02:00
2020-06-22 21:50:58 +02:00
$username = $this->getParam('username');
$email = $this->getParam('email');
2020-06-23 18:40:43 +02:00
$password = $this->getParam('password');
$confirmPassword = $this->getParam('confirmPassword');
2020-06-29 16:47:02 +02:00
if (!$this->checkRequirements($username, $password, $confirmPassword)) {
return false;
2020-06-23 18:40:43 +02:00
}
2022-03-08 11:50:18 +01:00
if (!$this->checkUserExists($username, $email)) {
2020-06-22 21:50:58 +02:00
return false;
}
2020-06-20 20:13:51 +02:00
2022-11-20 17:13:53 +01:00
$groups = [];
$sql = $this->context->getSQL();
2023-01-16 21:47:23 +01:00
// TODO: Currently low-privileged users can request any groups here, so a simple privilege escalation is possible. \
// what do? limit access to user/create to admins only?
2022-11-20 17:13:53 +01:00
$requestedGroups = array_unique($this->getParam("groups"));
if (!empty($requestedGroups)) {
$groups = Group::findAll($sql, new CondIn(new Column("id"), $requestedGroups));
foreach ($requestedGroups as $groupId) {
if (!isset($groups[$groupId])) {
return $this->createError("Group with id=$groupId does not exist.");
}
}
}
2020-06-23 21:18:45 +02:00
// prevent duplicate keys
$email = (!is_null($email) && empty($email)) ? null : $email;
2022-11-20 17:13:53 +01:00
$user = $this->insertUser($username, $email, $password, true, "", $groups);
2022-11-19 01:15:34 +01:00
if ($user !== false) {
2022-11-20 17:13:53 +01:00
$this->user = $user;
2022-11-19 01:15:34 +01:00
$this->result["userId"] = $user->getId();
2020-06-22 21:50:58 +02:00
}
2020-06-20 20:13:51 +02:00
2020-06-23 18:40:43 +02:00
return $this->success;
2020-06-22 21:50:58 +02:00
}
2022-11-20 17:13:53 +01:00
public function getUser(): User {
return $this->user;
}
2023-01-16 21:47:23 +01:00
public static function getDefaultACL(Insert $insert): void {
$insert->addRow(self::getEndpoint(), [Group::ADMIN], "Allows users to create new users");
}
2020-06-22 21:50:58 +02:00
}
2020-06-20 20:13:51 +02:00
2020-06-22 21:50:58 +02:00
class Fetch extends UserAPI {
2020-06-20 20:13:51 +02:00
use Pagination;
2020-06-20 20:13:51 +02:00
public function __construct(Context $context, $externalCall = false) {
parent::__construct($context, $externalCall,
2023-03-05 15:30:06 +01:00
self::getPaginationParameters(['id', 'name', 'fullName', 'email', 'groups', 'registeredAt', 'confirmed'],
'id', 'asc')
);
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-20 20:13:51 +02:00
$currentUser = $this->context->getUser();
$fullInfo = ($currentUser->hasGroup(Group::ADMIN) ||
$currentUser->hasGroup(Group::SUPPORT));
2020-06-20 20:13:51 +02:00
$orderBy = $this->getParam("orderBy");
2022-11-20 17:13:53 +01:00
$condition = null;
if (!$fullInfo) {
$condition = new CondOr(
new Compare("User.id", $currentUser->getId()),
new CondBool("User.confirmed")
);
2023-01-07 15:34:05 +01:00
if ($orderBy && !$currentUser->canAccess(User::class, $orderBy)) {
return $this->createError("Insufficient permissions for sorting by field '$orderBy'");
}
2020-06-22 21:50:58 +02:00
}
2020-06-20 20:13:51 +02:00
2022-11-20 17:13:53 +01:00
$sql = $this->context->getSQL();
if (!$this->initPagination($sql, User::class, $condition)) {
return false;
}
$groupNames = new Alias(
$sql->select(new JsonArrayAgg("name"))->from("Group")
->leftJoin("NM_User_groups", "NM_User_groups.group_id", "Group.id")
->whereEq("NM_User_groups.user_id", new Column("User.id")),
"groups"
);
2020-06-22 21:50:58 +02:00
$userQuery = $this->createPaginationQuery($sql, [$groupNames]);
2022-11-20 17:13:53 +01:00
$users = User::findBy($userQuery);
if ($users !== false && $users !== null) {
2022-11-20 17:13:53 +01:00
$this->result["users"] = [];
2023-01-07 15:34:05 +01:00
foreach ($users as $user) {
$this->result["users"][] = $user->jsonSerialize();
2020-06-22 21:50:58 +02:00
}
2022-11-20 17:13:53 +01:00
} else {
return $this->createError("Error fetching users: " . $sql->getLastError());
2020-06-22 21:50:58 +02:00
}
2020-06-20 20:13:51 +02:00
2020-06-22 21:50:58 +02:00
return $this->success;
2020-06-20 20:13:51 +02:00
}
2023-01-16 21:47:23 +01:00
public static function getDefaultACL(Insert $insert): void {
$insert->addRow(self::getEndpoint(), [Group::ADMIN, Group::SUPPORT], "Allows users to fetch all users");
}
2020-06-22 21:50:58 +02:00
}
2020-06-23 16:26:04 +02:00
class Get extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
parent::__construct($context, $externalCall, array(
2020-06-23 16:26:04 +02:00
'id' => new Parameter('id', Parameter::TYPE_INT)
));
2021-12-08 16:53:43 +01:00
$this->loginRequired = true;
2020-06-23 16:26:04 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-23 16:26:04 +02:00
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2021-12-08 16:53:43 +01:00
$userId = $this->getParam("id");
2022-11-19 01:15:34 +01:00
$user = User::find($sql, $userId, true);
if ($user === false) {
return $this->createError("Error querying user: " . $sql->getLastError());
} else if ($user === null) {
return $this->createError("User not found");
} else {
2021-12-08 16:53:43 +01:00
2022-11-19 01:15:34 +01:00
$queriedUser = $user->jsonSerialize();
$currentUser = $this->context->getUser();
2021-12-08 16:53:43 +01:00
2022-11-19 01:15:34 +01:00
// full info only when we have administrative privileges, or we are querying ourselves
$fullInfo = ($userId === $currentUser->getId() ||
2022-11-20 17:13:53 +01:00
$currentUser->hasGroup(Group::ADMIN) ||
$currentUser->hasGroup(Group::SUPPORT));
2021-12-08 16:53:43 +01:00
2023-01-07 15:34:05 +01:00
if (!$fullInfo && !$queriedUser["confirmed"]) {
return $this->createError("No permissions to access this user");
2020-06-23 16:26:04 +02:00
}
2022-11-19 01:15:34 +01:00
$this->result["user"] = $queriedUser;
2020-06-23 16:26:04 +02:00
}
return $this->success;
}
2023-01-16 21:47:23 +01:00
public static function getDefaultACL(Insert $insert): void {
$insert->addRow(self::getEndpoint(), [Group::ADMIN, Group::SUPPORT], "Allows users to get details about a user");
}
2020-06-23 16:26:04 +02:00
}
2020-06-22 21:50:58 +02:00
class Info extends UserAPI {
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
parent::__construct($context, $externalCall, array());
$this->csrfTokenRequired = false;
2020-06-20 20:13:51 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
$currentUser = $this->context->getUser();
2023-01-16 21:47:23 +01:00
$language = $this->context->getLanguage();
$this->result["language"] = $language->jsonSerialize();
2022-06-20 19:52:31 +02:00
if (!$currentUser) {
2020-06-22 21:50:58 +02:00
$this->result["loggedIn"] = false;
2023-01-16 21:47:23 +01:00
$userGroups = [];
2020-06-22 21:50:58 +02:00
} else {
$this->result["loggedIn"] = true;
2022-06-20 19:52:31 +02:00
$userGroups = array_keys($currentUser->getGroups());
$this->result["user"] = $currentUser->jsonSerialize();
2023-03-05 15:30:06 +01:00
$this->result["session"] = $this->context->getSession()->jsonSerialize([
"id", "expires", "stayLoggedIn", "data", "csrfToken"
]);
2020-06-22 21:50:58 +02:00
}
2020-06-20 20:13:51 +02:00
2023-01-16 21:47:23 +01:00
$sql = $this->context->getSQL();
$res = $sql->select("method", "groups")
->from("ApiPermission")
->execute();
$this->result["permissions"] = [];
if (is_array($res)) {
foreach ($res as $row) {
$requiredGroups = json_decode($row["groups"], true);
if (empty($requiredGroups) || !empty(array_intersect($requiredGroups, $userGroups))) {
$this->result["permissions"][] = $row["method"];
}
}
}
2020-06-22 21:50:58 +02:00
return $this->success;
}
2020-06-20 20:13:51 +02:00
}
2020-06-22 21:50:58 +02:00
class Invite extends UserAPI {
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
parent::__construct($context, $externalCall, array(
2020-06-22 21:50:58 +02:00
'username' => new StringType('username', 32),
'email' => new StringType('email', 64),
));
2020-06-22 21:50:58 +02:00
$this->loginRequired = true;
2020-06-20 20:13:51 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-22 21:50:58 +02:00
$username = $this->getParam('username');
$email = $this->getParam('email');
2022-03-08 11:50:18 +01:00
if (!$this->checkUserExists($username, $email)) {
2020-06-22 21:50:58 +02:00
return false;
}
2020-06-29 16:47:02 +02:00
// Create user
2022-11-19 01:15:34 +01:00
$user = $this->insertUser($username, $email, "", false);
if ($user === false) {
2020-06-29 16:47:02 +02:00
return false;
}
// Create Token
2020-06-22 21:50:58 +02:00
$token = generateRandomString(36);
2021-12-08 16:53:43 +01:00
$validDays = 7;
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2022-11-19 01:15:34 +01:00
$userToken = new UserToken($user, $token, UserToken::TYPE_INVITE, $validDays * 24);
2020-06-26 18:24:23 +02:00
2022-11-19 01:15:34 +01:00
if ($userToken->save($sql)) {
//send validation mail
2022-06-20 19:52:31 +02:00
$settings = $this->context->getSettings();
2021-12-08 16:53:43 +01:00
$baseUrl = $settings->getBaseUrl();
$siteName = $settings->getSiteName();
2022-06-20 19:52:31 +02:00
$req = new Render($this->context);
2021-12-08 16:53:43 +01:00
$this->success = $req->execute([
"file" => "mail/accept_invite.twig",
"parameters" => [
"link" => "$baseUrl/acceptInvite?token=$token",
"site_name" => $siteName,
"base_url" => $baseUrl,
"username" => $username,
"valid_time" => $this->formatDuration($validDays, "day")
]
]);
$this->lastError = $req->getLastError();
2020-06-26 18:24:23 +02:00
2021-12-08 16:53:43 +01:00
if ($this->success) {
$messageBody = $req->getResult()["html"];
2022-11-18 18:06:46 +01:00
$request = new \Core\API\Mail\Send($this->context);
2021-12-08 16:53:43 +01:00
$this->success = $request->execute(array(
"to" => $email,
"subject" => "[$siteName] Account Invitation",
"body" => $messageBody
));
2020-06-26 18:24:23 +02:00
2021-12-08 16:53:43 +01:00
$this->lastError = $request->getLastError();
2020-06-29 16:47:02 +02:00
}
2020-06-26 18:24:23 +02:00
if (!$this->success) {
2022-05-31 16:14:49 +02:00
$this->logger->error("Could not deliver email to=$email type=invite reason=" . $this->lastError);
2020-06-26 18:24:23 +02:00
$this->lastError = "The invitation was created but the confirmation email could not be sent. " .
2022-05-31 16:14:49 +02:00
"Please contact the server administration. This issue has been automatically logged. Reason: " . $this->lastError;
2020-06-26 18:24:23 +02:00
}
2020-06-22 21:50:58 +02:00
}
2020-06-29 16:47:02 +02:00
2022-11-19 01:15:34 +01:00
$this->logger->info("Created new user with id=" . $user->getId());
2020-06-29 16:47:02 +02:00
return $this->success;
}
2023-01-16 21:47:23 +01:00
public static function getDefaultACL(Insert $insert): void {
$insert->addRow(self::getEndpoint(), [Group::ADMIN, Group::SUPPORT], "Allows users to invite new users");
}
2020-06-29 16:47:02 +02:00
}
class AcceptInvite extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
parent::__construct($context, $externalCall, array(
2020-06-29 16:47:02 +02:00
'token' => new StringType('token', 36),
'password' => new StringType('password'),
'confirmPassword' => new StringType('confirmPassword'),
));
2020-07-02 00:47:45 +02:00
$this->csrfTokenRequired = false;
2020-06-29 16:47:02 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-29 16:47:02 +02:00
2022-06-20 19:52:31 +02:00
if ($this->context->getUser()) {
2020-06-29 16:47:02 +02:00
return $this->createError("You are already logged in.");
}
2022-11-19 01:15:34 +01:00
$sql = $this->context->getSQL();
2020-06-29 16:47:02 +02:00
$token = $this->getParam("token");
$password = $this->getParam("password");
$confirmPassword = $this->getParam("confirmPassword");
2022-11-19 01:15:34 +01:00
$userToken = $this->checkToken($token);
if ($userToken === false) {
2020-06-29 16:47:02 +02:00
return false;
2022-11-19 01:15:34 +01:00
} else if ($userToken->getType() !== UserToken::TYPE_INVITE) {
return $this->createError("Invalid token type");
2020-06-29 16:47:02 +02:00
}
2022-11-19 01:15:34 +01:00
$user = $userToken->getUser();
if ($user->confirmed) {
2020-06-29 16:47:02 +02:00
return $this->createError("Your email address is already confirmed.");
} else if (!$this->checkPasswordRequirements($password, $confirmPassword)) {
return false;
} else {
2022-11-19 01:15:34 +01:00
$user->password = $this->hashPassword($password);
$user->confirmed = true;
2022-11-29 14:17:11 +01:00
if ($user->save($sql, ["password", "confirmed"])) {
2022-11-19 01:15:34 +01:00
$userToken->invalidate($sql);
return true;
} else {
return $this->createError("Unable to update user details: " . $sql->getLastError());
}
2020-06-29 16:47:02 +02:00
}
}
}
class ConfirmEmail extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
parent::__construct($context, $externalCall, array(
2020-06-29 16:47:02 +02:00
'token' => new StringType('token', 36)
));
2021-11-11 14:25:26 +01:00
$this->csrfTokenRequired = false;
2020-06-29 16:47:02 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-29 16:47:02 +02:00
2022-06-20 19:52:31 +02:00
if ($this->context->getUser()) {
2020-06-29 16:47:02 +02:00
return $this->createError("You are already logged in.");
}
2022-11-19 01:15:34 +01:00
$sql = $this->context->getSQL();
2020-06-29 16:47:02 +02:00
$token = $this->getParam("token");
2022-11-19 01:15:34 +01:00
$userToken = $this->checkToken($token);
if ($userToken === false) {
return false;
} else if ($userToken->getType() !== UserToken::TYPE_EMAIL_CONFIRM) {
return $this->createError("Invalid token type");
}
2020-06-29 16:47:02 +02:00
2022-11-19 01:15:34 +01:00
$user = $userToken->getUser();
if ($user->confirmed) {
return $this->createError("Your email address is already confirmed.");
} else {
$user->confirmed = true;
2022-11-29 14:17:11 +01:00
if ($user->save($sql, ["confirmed"])) {
2022-11-19 01:15:34 +01:00
$userToken->invalidate($sql);
2020-07-01 23:07:00 +02:00
return true;
2022-11-19 01:15:34 +01:00
} else {
return $this->createError("Unable to update user details: " . $sql->getLastError());
2020-07-01 23:07:00 +02:00
}
2020-06-29 16:47:02 +02:00
}
}
2020-06-20 20:13:51 +02:00
}
2020-06-22 21:50:58 +02:00
class Login extends UserAPI {
2020-06-20 20:13:51 +02:00
2020-06-22 21:50:58 +02:00
private int $startedAt;
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
parent::__construct($context, $externalCall, array(
2021-12-08 16:53:43 +01:00
'username' => new StringType('username'),
2020-06-22 21:50:58 +02:00
'password' => new StringType('password'),
2022-02-20 16:53:26 +01:00
'stayLoggedIn' => new Parameter('stayLoggedIn', Parameter::TYPE_BOOLEAN, true, false)
2020-06-22 21:50:58 +02:00
));
$this->forbidMethod("GET");
2020-06-20 20:13:51 +02:00
}
2021-11-11 14:25:26 +01:00
private function wrongCredentials(): bool {
2020-06-22 21:50:58 +02:00
$runtime = microtime(true) - $this->startedAt;
$sleepTime = round(3e6 - $runtime);
if ($sleepTime > 0) usleep($sleepTime);
return $this->createError(L('Wrong username or password'));
2020-06-20 20:13:51 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
if ($this->context->getUser()) {
2020-06-22 21:50:58 +02:00
$this->lastError = L('You are already logged in');
$this->success = true;
2023-01-16 21:47:23 +01:00
$tfaToken = $this->context->getUser()->getTwoFactorToken();
if ($tfaToken && $tfaToken->isConfirmed() && !$tfaToken->isAuthenticated()) {
$this->result["twoFactorToken"] = $tfaToken->jsonSerialize([
"type", "challenge", "authenticated", "confirmed", "credentialID"
]);
}
2020-06-22 21:50:58 +02:00
return true;
}
2020-06-20 20:13:51 +02:00
2020-06-22 21:50:58 +02:00
$this->startedAt = microtime(true);
$this->success = false;
$username = $this->getParam('username');
$password = $this->getParam('password');
$stayLoggedIn = $this->getParam('stayLoggedIn');
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2022-11-20 17:13:53 +01:00
$user = User::findBy(User::createBuilder($sql, true)
2021-12-08 16:53:43 +01:00
->where(new Compare("User.name", $username), new Compare("User.email", $username))
2022-11-20 17:13:53 +01:00
->fetchEntities());
2020-06-22 21:50:58 +02:00
2022-11-19 01:15:34 +01:00
if ($user !== false) {
if ($user === null) {
2020-06-22 21:50:58 +02:00
return $this->wrongCredentials();
} else {
2022-11-19 01:15:34 +01:00
if (password_verify($password, $user->password)) {
if (!$user->confirmed) {
2021-11-11 14:25:26 +01:00
$this->result["emailConfirmed"] = false;
2020-06-29 16:47:02 +02:00
return $this->createError("Your email address has not been confirmed yet.");
2022-11-19 01:15:34 +01:00
} else if (!($session = $this->context->createSession($user, $stayLoggedIn))) {
2020-06-22 21:50:58 +02:00
return $this->createError("Error creating Session: " . $sql->getLastError());
} else {
2022-11-19 01:15:34 +01:00
$tfaToken = $user->getTwoFactorToken();
2023-01-16 21:47:23 +01:00
2020-06-22 21:50:58 +02:00
$this->result["loggedIn"] = true;
2023-01-16 21:47:23 +01:00
$this->result["user"] = $user->jsonSerialize();
$this->result["session"] = $session->jsonSerialize();
2022-06-20 19:52:31 +02:00
$this->result["logoutIn"] = $session->getExpiresSeconds();
$this->check2FA($tfaToken);
2020-06-22 21:50:58 +02:00
$this->success = true;
}
2020-06-20 20:13:51 +02:00
} else {
2020-06-22 21:50:58 +02:00
return $this->wrongCredentials();
2020-06-20 20:13:51 +02:00
}
}
2022-11-19 01:15:34 +01:00
} else {
return $this->createError("Error fetching user details: " . $sql->getLastError());
2020-06-20 20:13:51 +02:00
}
2020-06-22 21:50:58 +02:00
return $this->success;
}
2020-06-20 20:13:51 +02:00
}
2020-06-22 21:50:58 +02:00
class Logout extends UserAPI {
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
parent::__construct($context, $externalCall);
2022-02-20 16:53:26 +01:00
$this->loginRequired = false;
2020-06-22 21:50:58 +02:00
$this->apiKeyAllowed = false;
2022-02-20 16:53:26 +01:00
$this->forbidMethod("GET");
2020-06-20 20:13:51 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
$session = $this->context->getSession();
if (!$session) {
2022-02-20 16:53:26 +01:00
return $this->createError("You are not logged in.");
}
2022-06-20 19:52:31 +02:00
$this->success = $session->destroy();
$this->lastError = $this->context->getSQL()->getLastError();
2020-06-22 21:50:58 +02:00
return $this->success;
}
2020-06-20 20:13:51 +02:00
}
2020-06-22 21:50:58 +02:00
class Register extends UserAPI {
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
2020-06-26 23:32:45 +02:00
$parameters = array(
2020-06-22 21:50:58 +02:00
"username" => new StringType("username", 32),
2020-06-24 01:09:08 +02:00
'email' => new Parameter('email', Parameter::TYPE_EMAIL),
2020-06-22 21:50:58 +02:00
"password" => new StringType("password"),
"confirmPassword" => new StringType("confirmPassword"),
2020-06-26 23:32:45 +02:00
);
2022-06-20 19:52:31 +02:00
$settings = $context->getSettings();
2020-06-26 23:32:45 +02:00
if ($settings->isRecaptchaEnabled()) {
$parameters["captcha"] = new StringType("captcha");
}
2022-06-20 19:52:31 +02:00
parent::__construct($context, $externalCall, $parameters);
2020-07-01 22:13:50 +02:00
$this->csrfTokenRequired = false;
2020-06-20 20:13:51 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
if ($this->context->getUser()) {
2020-06-26 01:47:43 +02:00
return $this->createError(L('You are already logged in'));
}
2022-06-20 19:52:31 +02:00
$settings = $this->context->getSettings();
$registrationAllowed = $settings->isRegistrationAllowed();
if (!$registrationAllowed) {
2020-06-26 01:47:43 +02:00
return $this->createError("User Registration is not enabled.");
}
2020-06-26 23:32:45 +02:00
if ($settings->isRecaptchaEnabled()) {
$captcha = $this->getParam("captcha");
2022-06-20 19:52:31 +02:00
$req = new VerifyCaptcha($this->context);
2020-06-26 23:32:45 +02:00
if (!$req->execute(array("captcha" => $captcha, "action" => "register"))) {
return $this->createError($req->getLastError());
}
}
2020-06-22 21:50:58 +02:00
$username = $this->getParam("username");
$email = $this->getParam('email');
2020-06-29 16:47:02 +02:00
$password = $this->getParam("password");
$confirmPassword = $this->getParam("confirmPassword");
2022-03-08 11:50:18 +01:00
if (!$this->checkUserExists($username, $email)) {
2020-06-22 21:50:58 +02:00
return false;
}
2020-06-20 20:13:51 +02:00
2022-06-20 19:52:31 +02:00
if (!$this->checkRequirements($username, $password, $confirmPassword)) {
2020-06-29 16:47:02 +02:00
return false;
2020-06-22 21:50:58 +02:00
}
2022-02-20 16:53:26 +01:00
$fullName = substr($email, 0, strrpos($email, "@"));
$fullName = implode(" ", array_map(function ($part) {
2022-06-20 19:52:31 +02:00
return ucfirst(strtolower($part));
2022-02-20 16:53:26 +01:00
}, explode(".", $fullName))
);
2022-11-19 01:15:34 +01:00
$sql = $this->context->getSQL();
$user = $this->insertUser($username, $email, $password, false, $fullName);
if ($user === false) {
2020-06-22 21:50:58 +02:00
return false;
}
2021-12-08 16:53:43 +01:00
$validHours = 48;
2022-11-19 01:15:34 +01:00
$token = generateRandomString(36);
$userToken = new UserToken($user, $token, UserToken::TYPE_EMAIL_CONFIRM, $validHours);
if ($userToken->save($sql)) {
2020-06-26 18:24:23 +02:00
2021-12-08 16:53:43 +01:00
$baseUrl = $settings->getBaseUrl();
$siteName = $settings->getSiteName();
2022-06-20 19:52:31 +02:00
$req = new Render($this->context);
2021-12-08 16:53:43 +01:00
$this->success = $req->execute([
"file" => "mail/confirm_email.twig",
"parameters" => [
2022-11-19 01:15:34 +01:00
"link" => "$baseUrl/confirmEmail?token=$token",
2020-07-01 22:13:50 +02:00
"site_name" => $siteName,
"base_url" => $baseUrl,
2021-12-08 16:53:43 +01:00
"username" => $username,
"valid_time" => $this->formatDuration($validHours, "hour")
]
]);
$this->lastError = $req->getLastError();
2020-06-26 18:24:23 +02:00
2021-12-08 16:53:43 +01:00
if ($this->success) {
$messageBody = $req->getResult()["html"];
2022-11-18 18:06:46 +01:00
$request = new \Core\API\Mail\Send($this->context);
2020-07-01 22:13:50 +02:00
$this->success = $request->execute(array(
2020-06-26 18:24:23 +02:00
"to" => $email,
"subject" => "[$siteName] E-Mail Confirmation",
2022-05-31 16:14:49 +02:00
"body" => $messageBody,
2020-07-01 22:13:50 +02:00
));
$this->lastError = $request->getLastError();
}
2022-11-19 01:15:34 +01:00
} else {
$this->lastError = "Could create user token: " . $sql->getLastError();
$this->success = false;
2020-06-26 18:24:23 +02:00
}
2020-06-20 20:13:51 +02:00
2020-06-22 21:50:58 +02:00
if (!$this->success) {
2022-05-31 16:14:49 +02:00
$this->logger->error("Could not deliver email to=$email type=register reason=" . $this->lastError);
2020-06-22 21:50:58 +02:00
$this->lastError = "Your account was registered but the confirmation email could not be sent. " .
2022-05-31 16:14:49 +02:00
"Please contact the server administration. This issue has been automatically logged. Reason: " . $this->lastError;
2020-06-22 21:50:58 +02:00
}
2020-06-20 20:13:51 +02:00
2022-11-19 01:15:34 +01:00
$this->logger->info("Registered new user with id=" . $user->getId());
2020-06-22 21:50:58 +02:00
return $this->success;
2020-06-22 21:03:30 +02:00
}
2020-06-22 21:50:58 +02:00
}
2020-06-22 21:03:30 +02:00
2020-06-23 17:55:52 +02:00
class Edit extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, array(
2020-06-23 17:55:52 +02:00
'id' => new Parameter('id', Parameter::TYPE_INT),
'username' => new StringType('username', 32, true, NULL),
2021-12-08 16:53:43 +01:00
'fullName' => new StringType('fullName', 64, true, NULL),
2020-06-24 01:09:08 +02:00
'email' => new Parameter('email', Parameter::TYPE_EMAIL, true, NULL),
2020-06-23 17:55:52 +02:00
'password' => new StringType('password', -1, true, NULL),
'groups' => new Parameter('groups', Parameter::TYPE_ARRAY, true, NULL),
2020-07-02 00:47:45 +02:00
'confirmed' => new Parameter('confirmed', Parameter::TYPE_BOOLEAN, true, NULL)
2020-06-23 17:55:52 +02:00
));
$this->loginRequired = true;
2021-11-11 14:25:26 +01:00
$this->forbidMethod("GET");
2020-06-23 17:55:52 +02:00
}
2020-06-22 21:15:41 +02:00
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-23 17:55:52 +02:00
2022-11-19 01:15:34 +01:00
$sql = $this->context->getSQL();
$currentUser = $this->context->getUser();
2020-06-23 17:55:52 +02:00
$id = $this->getParam("id");
2022-11-19 01:15:34 +01:00
$user = User::find($sql, $id, true);
2020-06-23 17:55:52 +02:00
2022-11-19 01:15:34 +01:00
if ($user !== false) {
if ($user === null) {
2020-06-23 17:55:52 +02:00
return $this->createError("User not found");
}
$username = $this->getParam("username");
2021-12-08 16:53:43 +01:00
$fullName = $this->getParam("fullName");
2020-06-23 17:55:52 +02:00
$email = $this->getParam("email");
$password = $this->getParam("password");
$groups = $this->getParam("groups");
2020-07-02 00:47:45 +02:00
$confirmed = $this->getParam("confirmed");
2020-06-23 17:55:52 +02:00
2020-06-23 21:18:45 +02:00
$email = (!is_null($email) && empty($email)) ? null : $email;
2020-06-23 20:57:54 +02:00
$groupIds = array();
2020-06-23 17:55:52 +02:00
if (!is_null($groups)) {
2020-06-23 20:57:54 +02:00
$param = new Parameter('groupId', Parameter::TYPE_INT);
2022-06-20 19:52:31 +02:00
foreach ($groups as $groupId) {
2020-06-23 20:57:54 +02:00
if (!$param->parseParam($groupId)) {
$value = print_r($groupId, true);
return $this->createError("Invalid Type for groupId in parameter groups: '$value' (Required: " . $param->getTypeName() . ")");
}
$groupIds[] = $param->value;
}
2022-11-20 17:13:53 +01:00
if ($id === $currentUser->getId() && !in_array(Group::ADMIN, $groupIds)) {
2020-06-23 17:55:52 +02:00
return $this->createError("Cannot remove Administrator group from own user.");
}
}
// Check for duplicate username, email
2022-11-19 01:15:34 +01:00
$usernameChanged = !is_null($username) && strcasecmp($username, $user->name) !== 0;
$fullNameChanged = !is_null($fullName) && strcasecmp($fullName, $user->fullName) !== 0;
$emailChanged = !is_null($email) && strcasecmp($email, $user->email) !== 0;
2022-06-20 19:52:31 +02:00
if ($usernameChanged || $emailChanged) {
2022-03-08 11:50:18 +01:00
if (!$this->checkUserExists($usernameChanged ? $username : NULL, $emailChanged ? $email : NULL)) {
2020-06-23 17:55:52 +02:00
return false;
}
}
2022-11-29 14:17:11 +01:00
$columnsToUpdate = [];
if ($usernameChanged) {
$user->name = $username;
$columnsToUpdate[] = "name";
}
if ($fullNameChanged) {
$user->fullName = $fullName;
$columnsToUpdate[] = "full_name";
}
if ($emailChanged) {
$user->email = $email;
$columnsToUpdate[] = "email";
}
if (!is_null($password)) {
$user->password = $this->hashPassword($password);
$columnsToUpdate[] = "password";
}
2020-06-23 17:55:52 +02:00
2020-07-02 00:47:45 +02:00
if (!is_null($confirmed)) {
2022-11-19 01:15:34 +01:00
if ($id === $currentUser->getId() && $confirmed === false) {
2020-07-02 00:47:45 +02:00
return $this->createError("Cannot make own account unconfirmed.");
} else {
2022-11-19 01:15:34 +01:00
$user->confirmed = $confirmed;
2022-11-29 14:17:11 +01:00
$columnsToUpdate[] = "confirmed";
2020-07-02 00:47:45 +02:00
}
}
2022-11-29 14:17:11 +01:00
if (empty($columnsToUpdate) || $user->save($sql, $columnsToUpdate)) {
2020-06-23 17:55:52 +02:00
$deleteQuery = $sql->delete("UserGroup")->whereEq("user_id", $id);
2020-06-23 17:55:52 +02:00
$insertQuery = $sql->insert("UserGroup", array("user_id", "group_id"));
2022-06-20 19:52:31 +02:00
foreach ($groupIds as $groupId) {
2020-06-23 20:57:54 +02:00
$insertQuery->addRow($id, $groupId);
2020-06-23 17:55:52 +02:00
}
2021-11-11 14:25:26 +01:00
$this->success = ($deleteQuery->execute() !== FALSE) && (empty($groupIds) || $insertQuery->execute() !== FALSE);
2020-06-23 17:55:52 +02:00
$this->lastError = $sql->getLastError();
}
2022-11-19 01:15:34 +01:00
} else {
return $this->createError("Error fetching user details: " . $sql->getLastError());
2020-06-23 17:55:52 +02:00
}
return $this->success;
}
2023-01-16 21:47:23 +01:00
public static function getDefaultACL(Insert $insert): void {
$insert->addRow(self::getEndpoint(), [Group::ADMIN], "Allows users to modify other user's details");
}
2020-06-23 17:55:52 +02:00
}
class Delete extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, array(
'id' => new Parameter('id', Parameter::TYPE_INT)
));
$this->loginRequired = true;
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2022-11-19 01:15:34 +01:00
$currentUser = $this->context->getUser();
$id = $this->getParam("id");
2022-11-19 01:15:34 +01:00
if ($id === $currentUser->getId()) {
return $this->createError("You cannot delete your own user.");
}
2022-11-19 01:15:34 +01:00
$sql = $this->context->getSQL();
$user = User::find($sql, $id);
if ($user !== false) {
if ($user === null) {
return $this->createError("User not found");
} else {
2022-06-20 19:52:31 +02:00
$this->success = ($user->delete($sql) !== FALSE);
$this->lastError = $sql->getLastError();
}
}
return $this->success;
}
2023-01-16 21:47:23 +01:00
public static function getDefaultACL(Insert $insert): void {
$insert->addRow(self::getEndpoint(), [Group::ADMIN], "Allows users to delete other users");
}
}
2020-06-29 16:47:02 +02:00
2020-07-02 00:47:45 +02:00
class RequestPasswordReset extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
2020-06-29 16:47:02 +02:00
$parameters = array(
'email' => new Parameter('email', Parameter::TYPE_EMAIL),
);
2022-06-20 19:52:31 +02:00
$settings = $context->getSettings();
2020-06-29 16:47:02 +02:00
if ($settings->isRecaptchaEnabled()) {
$parameters["captcha"] = new StringType("captcha");
}
2022-06-20 19:52:31 +02:00
parent::__construct($context, $externalCall, $parameters);
2020-06-29 16:47:02 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-29 16:47:02 +02:00
2022-06-20 19:52:31 +02:00
if ($this->context->getUser()) {
2020-06-29 16:47:02 +02:00
return $this->createError("You already logged in.");
}
2022-06-20 19:52:31 +02:00
$settings = $this->context->getSettings();
2022-06-01 09:47:31 +02:00
if (!$settings->isMailEnabled()) {
return $this->createError("The mail service is not enabled, please contact the server administration.");
}
2020-06-29 16:47:02 +02:00
if ($settings->isRecaptchaEnabled()) {
$captcha = $this->getParam("captcha");
2022-06-20 19:52:31 +02:00
$req = new VerifyCaptcha($this->context);
2020-06-29 16:47:02 +02:00
if (!$req->execute(array("captcha" => $captcha, "action" => "resetPassword"))) {
return $this->createError($req->getLastError());
}
}
2022-11-19 01:15:34 +01:00
$sql = $this->context->getSQL();
2020-06-29 16:47:02 +02:00
$email = $this->getParam("email");
2022-11-20 17:13:53 +01:00
$user = User::findBy(User::createBuilder($sql, true)
->whereEq("email", $email)
2022-11-20 17:13:53 +01:00
->fetchEntities());
2022-11-19 01:15:34 +01:00
if ($user === false) {
return $this->createError("Could not fetch user details: " . $sql->getLastError());
} else if ($user !== null) {
2021-12-08 16:53:43 +01:00
$validHours = 1;
2020-06-29 16:47:02 +02:00
$token = generateRandomString(36);
2022-11-19 01:15:34 +01:00
$userToken = new UserToken($user, $token, UserToken::TYPE_PASSWORD_RESET, $validHours);
if (!$userToken->save($sql)) {
return $this->createError("Could not create user token: " . $sql->getLastError());
2020-06-29 16:47:02 +02:00
}
2021-12-08 16:53:43 +01:00
$baseUrl = $settings->getBaseUrl();
$siteName = $settings->getSiteName();
2020-06-29 16:47:02 +02:00
2022-06-20 19:52:31 +02:00
$req = new Render($this->context);
2021-12-08 16:53:43 +01:00
$this->success = $req->execute([
"file" => "mail/reset_password.twig",
"parameters" => [
"link" => "$baseUrl/resetPassword?token=$token",
"site_name" => $siteName,
"base_url" => $baseUrl,
2022-11-19 01:15:34 +01:00
"username" => $user->name,
2021-12-08 16:53:43 +01:00
"valid_time" => $this->formatDuration($validHours, "hour")
]
]);
$this->lastError = $req->getLastError();
2020-06-29 16:47:02 +02:00
2021-12-08 16:53:43 +01:00
if ($this->success) {
$messageBody = $req->getResult()["html"];
2022-02-20 16:53:26 +01:00
2022-11-19 01:15:34 +01:00
$gpgKey = $user->getGPG();
$gpgFingerprint = ($gpgKey && $gpgKey->isConfirmed()) ? $gpgKey->getFingerprint() : null;
2022-11-18 18:06:46 +01:00
$request = new \Core\API\Mail\Send($this->context);
2021-12-08 16:53:43 +01:00
$this->success = $request->execute(array(
"to" => $email,
"subject" => "[$siteName] Password Reset",
2022-02-20 16:53:26 +01:00
"body" => $messageBody,
"gpgFingerprint" => $gpgFingerprint
2021-12-08 16:53:43 +01:00
));
$this->lastError = $request->getLastError();
2022-11-19 01:15:34 +01:00
$this->logger->info("Requested password reset for user id=" . $user->getId() . " by ip_address=" . $_SERVER["REMOTE_ADDR"]);
2020-06-29 16:47:02 +02:00
}
}
return $this->success;
}
2021-11-11 14:25:26 +01:00
}
class ResendConfirmEmail extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
2021-11-11 14:25:26 +01:00
$parameters = array(
'email' => new Parameter('email', Parameter::TYPE_EMAIL),
);
2022-06-20 19:52:31 +02:00
$settings = $context->getSettings();
2021-11-11 14:25:26 +01:00
if ($settings->isRecaptchaEnabled()) {
$parameters["captcha"] = new StringType("captcha");
}
2022-06-20 19:52:31 +02:00
parent::__construct($context, $externalCall, $parameters);
2021-11-11 14:25:26 +01:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2021-11-11 14:25:26 +01:00
2022-06-20 19:52:31 +02:00
if ($this->context->getUser()) {
2021-11-11 14:25:26 +01:00
return $this->createError("You already logged in.");
}
2022-06-20 19:52:31 +02:00
$settings = $this->context->getSettings();
2021-11-11 14:25:26 +01:00
if ($settings->isRecaptchaEnabled()) {
$captcha = $this->getParam("captcha");
2022-06-20 19:52:31 +02:00
$req = new VerifyCaptcha($this->context);
2021-11-11 14:25:26 +01:00
if (!$req->execute(array("captcha" => $captcha, "action" => "resendConfirmation"))) {
return $this->createError($req->getLastError());
}
}
$email = $this->getParam("email");
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2022-11-20 17:13:53 +01:00
$user = User::findBy(User::createBuilder($sql, true)
->whereEq("User.email", $email)
->whereFalse("User.confirmed"));
2020-06-29 16:47:02 +02:00
2022-11-19 01:15:34 +01:00
if ($user === false) {
return $this->createError("Error retrieving user details: " . $sql->getLastError());
} else if ($user === null) {
// token does not exist: ignore!
2021-11-11 14:25:26 +01:00
return true;
}
2022-11-20 17:13:53 +01:00
$userToken = UserToken::findBy(UserToken::createBuilder($sql, true)
->whereFalse("used")
2023-03-05 15:30:06 +01:00
->whereEq("token_type", UserToken::TYPE_EMAIL_CONFIRM)
->whereEq("user_id", $user->getId()));
2021-11-11 14:25:26 +01:00
2021-12-08 16:53:43 +01:00
$validHours = 48;
2022-11-19 01:15:34 +01:00
if ($userToken === false) {
return $this->createError("Error retrieving token details: " . $sql->getLastError());
} else if ($userToken === null) {
2021-11-11 14:25:26 +01:00
// no token generated yet, let's generate one
$token = generateRandomString(36);
2022-11-19 01:15:34 +01:00
$userToken = new UserToken($user, $token, UserToken::TYPE_EMAIL_CONFIRM, $validHours);
if (!$userToken->save($sql)) {
return $this->createError("Error generating new token: " . $sql->getLastError());
2021-11-11 14:25:26 +01:00
}
2021-12-08 16:53:43 +01:00
} else {
2022-11-19 01:15:34 +01:00
$userToken->updateDurability($sql, $validHours);
2021-11-11 14:25:26 +01:00
}
2022-11-19 01:15:34 +01:00
$username = $user->name;
2021-12-08 16:53:43 +01:00
$baseUrl = $settings->getBaseUrl();
$siteName = $settings->getSiteName();
2022-06-20 19:52:31 +02:00
$req = new Render($this->context);
2021-12-08 16:53:43 +01:00
$this->success = $req->execute([
"file" => "mail/confirm_email.twig",
"parameters" => [
2022-11-19 01:15:34 +01:00
"link" => "$baseUrl/confirmEmail?token=" . $userToken->getToken(),
2021-12-08 16:53:43 +01:00
"site_name" => $siteName,
"base_url" => $baseUrl,
"username" => $username,
"valid_time" => $this->formatDuration($validHours, "hour")
]
]);
$this->lastError = $req->getLastError();
2021-11-11 14:25:26 +01:00
2021-12-08 16:53:43 +01:00
if ($this->success) {
$messageBody = $req->getResult()["html"];
2022-11-18 18:06:46 +01:00
$request = new \Core\API\Mail\Send($this->context);
2021-12-08 16:53:43 +01:00
$this->success = $request->execute(array(
"to" => $email,
"subject" => "[$siteName] E-Mail Confirmation",
"body" => $messageBody
));
2021-11-11 14:25:26 +01:00
2021-12-08 16:53:43 +01:00
$this->lastError = $request->getLastError();
}
2021-11-11 14:25:26 +01:00
2020-06-29 16:47:02 +02:00
return $this->success;
}
}
class ResetPassword extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, $externalCall = false) {
parent::__construct($context, $externalCall, array(
2020-06-29 16:47:02 +02:00
'token' => new StringType('token', 36),
'password' => new StringType('password'),
'confirmPassword' => new StringType('confirmPassword'),
));
2020-07-02 00:47:45 +02:00
$this->csrfTokenRequired = false;
2020-06-29 16:47:02 +02:00
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-29 16:47:02 +02:00
2022-06-20 19:52:31 +02:00
if ($this->context->getUser()) {
2020-06-29 16:47:02 +02:00
return $this->createError("You are already logged in.");
}
2022-11-19 01:15:34 +01:00
$sql = $this->context->getSQL();
2020-06-29 16:47:02 +02:00
$token = $this->getParam("token");
$password = $this->getParam("password");
$confirmPassword = $this->getParam("confirmPassword");
2022-11-19 01:15:34 +01:00
$userToken = $this->checkToken($token);
if ($userToken === false) {
2020-06-29 16:47:02 +02:00
return false;
2022-11-19 01:15:34 +01:00
} else if ($userToken->getType() !== UserToken::TYPE_PASSWORD_RESET) {
return $this->createError("Invalid token type");
2020-06-29 16:47:02 +02:00
}
2022-11-19 01:15:34 +01:00
$user = $token->getUser();
if (!$this->checkPasswordRequirements($password, $confirmPassword)) {
2020-06-29 16:47:02 +02:00
return false;
} else {
2022-11-19 01:15:34 +01:00
$user->password = $this->hashPassword($password);
if ($user->save($sql)) {
$this->logger->info("Issued password reset for user id=" . $user->getId());
$userToken->invalidate($sql);
$this->context->invalidateSessions(false);
2022-11-19 01:15:34 +01:00
return true;
} else {
return $this->createError("Error updating user details: " . $sql->getLastError());
}
2020-06-29 16:47:02 +02:00
}
}
}
2021-11-11 14:25:26 +01:00
class UpdateProfile extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, array(
2021-11-11 14:25:26 +01:00
'username' => new StringType('username', 32, true, NULL),
2021-12-08 16:53:43 +01:00
'fullName' => new StringType('fullName', 64, true, NULL),
2021-11-11 14:25:26 +01:00
'password' => new StringType('password', -1, true, NULL),
2021-12-08 16:53:43 +01:00
'confirmPassword' => new StringType('confirmPassword', -1, true, NULL),
'oldPassword' => new StringType('oldPassword', -1, true, NULL),
2021-11-11 14:25:26 +01:00
));
$this->loginRequired = true;
$this->csrfTokenRequired = true;
$this->forbidMethod("GET");
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2021-11-11 14:25:26 +01:00
$newUsername = $this->getParam("username");
2021-12-08 16:53:43 +01:00
$oldPassword = $this->getParam("oldPassword");
2021-11-11 14:25:26 +01:00
$newPassword = $this->getParam("password");
2021-12-08 16:53:43 +01:00
$newPasswordConfirm = $this->getParam("confirmPassword");
$newFullName = $this->getParam("fullName");
2021-11-11 14:25:26 +01:00
2021-12-08 16:53:43 +01:00
if ($newUsername === null && $newPassword === null && $newPasswordConfirm === null && $newFullName === null) {
return $this->createError("You must either provide an updated username, fullName or password");
2021-11-11 14:25:26 +01:00
}
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
$updateFields = [];
2022-11-19 01:15:34 +01:00
$currentUser = $this->context->getUser();
2021-11-11 14:25:26 +01:00
if ($newUsername !== null) {
2022-03-08 11:50:18 +01:00
if (!$this->checkUsernameRequirements($newUsername) || !$this->checkUserExists($newUsername)) {
2021-11-11 14:25:26 +01:00
return false;
} else {
2022-11-19 01:15:34 +01:00
$currentUser->name = $newUsername;
$updateFields[] = "name";
2021-11-11 14:25:26 +01:00
}
}
2021-12-08 16:53:43 +01:00
if ($newFullName !== null) {
2022-11-19 01:15:34 +01:00
$currentUser->fullName = $newFullName;
$updateFields[] = "fullName";
2021-12-08 16:53:43 +01:00
}
if ($newPassword !== null || $newPasswordConfirm !== null) {
if (!$this->checkPasswordRequirements($newPassword, $newPasswordConfirm)) {
2021-11-11 14:25:26 +01:00
return false;
} else {
2022-11-19 01:15:34 +01:00
if (!password_verify($oldPassword, $currentUser->password)) {
2021-12-08 16:53:43 +01:00
return $this->createError("Wrong password");
}
2022-11-19 01:15:34 +01:00
$currentUser->password = $this->hashPassword($newPassword);
$updateFields[] = "password";
2021-11-11 14:25:26 +01:00
}
}
if (!empty($updateFields)) {
$this->success = $currentUser->save($sql, $updateFields) !== false;
$this->lastError = $sql->getLastError();
if ($this->success && in_array("password", $updateFields)) {
$this->context->invalidateSessions(true);
}
}
2021-11-11 14:25:26 +01:00
return $this->success;
}
}
2021-12-08 16:53:43 +01:00
2022-02-20 16:53:26 +01:00
class ImportGPG extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, array(
2022-02-20 16:53:26 +01:00
"pubkey" => new StringType("pubkey")
));
$this->loginRequired = true;
$this->forbidMethod("GET");
}
private function testKey(string $keyString) {
$res = GpgKey::getKeyInfo($keyString);
if (!$res["success"]) {
2022-11-19 01:15:34 +01:00
return $this->createError($res["error"] ?? $res["msg"]);
2022-02-20 16:53:26 +01:00
}
$keyData = $res["data"];
$keyType = $keyData["type"];
$expires = $keyData["expires"];
if ($keyType === "sec#") {
return self::createError("ATTENTION! It seems like you've imported a PGP PRIVATE KEY instead of a public key.
It is recommended to immediately revoke your private key and create a new key pair.");
} else if ($keyType !== "pub") {
return self::createError("Unknown key type: $keyType");
} else if (isInPast($expires)) {
return self::createError("It seems like the gpg key is already expired.");
} else {
return $keyData;
}
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2022-02-20 16:53:26 +01:00
2022-06-20 19:52:31 +02:00
$currentUser = $this->context->getUser();
$gpgKey = $currentUser->getGPG();
2022-02-20 16:53:26 +01:00
if ($gpgKey) {
return $this->createError("You already added a GPG key to your account.");
2023-01-18 14:37:34 +01:00
} else if (!$currentUser->getEmail()) {
return $this->createError("You do not have an e-mail address");
2022-02-20 16:53:26 +01:00
}
// fix key first, enforce a newline after
$keyString = $this->getParam("pubkey");
$keyString = preg_replace("/(-{2,})\n([^\n])/", "$1\n\n$2", $keyString);
$keyData = $this->testKey($keyString);
if ($keyData === false) {
return false;
}
$res = GpgKey::importKey($keyString);
if (!$res["success"]) {
return $this->createError($res["error"]);
}
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2022-11-19 01:15:34 +01:00
$gpgKey = new GpgKey($keyData["fingerprint"], $keyData["algorithm"], $keyData["expires"]);
if (!$gpgKey->save($sql)) {
return $this->createError("Error creating gpg key: " . $sql->getLastError());
2022-02-20 16:53:26 +01:00
}
$token = generateRandomString(36);
2022-11-19 01:15:34 +01:00
$userToken = new UserToken($currentUser, $token, UserToken::TYPE_GPG_CONFIRM, 1);
if (!$userToken->save($sql)) {
return $this->createError("Error saving user token: " . $sql->getLastError());
2022-02-20 16:53:26 +01:00
}
2022-06-20 19:52:31 +02:00
$name = htmlspecialchars($currentUser->getFullName());
2022-02-20 16:53:26 +01:00
if (!$name) {
2022-06-20 19:52:31 +02:00
$name = htmlspecialchars($currentUser->getUsername());
2022-02-20 16:53:26 +01:00
}
2022-06-20 19:52:31 +02:00
$settings = $this->context->getSettings();
2022-02-20 16:53:26 +01:00
$baseUrl = htmlspecialchars($settings->getBaseUrl());
$token = htmlspecialchars(urlencode($token));
2023-01-25 14:15:34 +01:00
$url = "$baseUrl/confirmGPG?token=$token";
2022-02-20 16:53:26 +01:00
$mailBody = "Hello $name,<br><br>" .
"you imported a GPG public key for end-to-end encrypted mail communication. " .
"To confirm the key and verify, you own the corresponding private key, please click on the following link. " .
"The link is active for one hour.<br><br>" .
2022-05-31 16:14:49 +02:00
"<a href='$url'>$url</a><br>
2022-11-19 01:15:34 +01:00
Best Regards<br>" .
$settings->getSiteName() . " Administration";
2022-02-20 16:53:26 +01:00
2022-11-18 18:06:46 +01:00
$sendMail = new \Core\API\Mail\Send($this->context);
2022-02-20 16:53:26 +01:00
$this->success = $sendMail->execute(array(
2022-06-20 19:52:31 +02:00
"to" => $currentUser->getEmail(),
2022-11-19 01:15:34 +01:00
"subject" => $settings->getSiteName() . " - Confirm GPG-Key",
2022-02-20 16:53:26 +01:00
"body" => $mailBody,
2022-11-19 01:15:34 +01:00
"gpgFingerprint" => $gpgKey->getFingerprint()
2022-02-20 16:53:26 +01:00
));
$this->lastError = $sendMail->getLastError();
if ($this->success) {
2022-11-19 01:15:34 +01:00
$currentUser->gpgKey = $gpgKey;
2023-01-09 14:21:11 +01:00
if ($currentUser->save($sql, ["gpgKey"])) {
2023-01-18 14:37:34 +01:00
$this->result["gpgKey"] = $gpgKey->jsonSerialize();
2022-11-19 01:15:34 +01:00
} else {
return $this->createError("Error updating user details: " . $sql->getLastError());
}
2022-02-20 16:53:26 +01:00
}
return $this->success;
}
}
class RemoveGPG extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, array(
2022-02-20 16:53:26 +01:00
"password" => new StringType("password")
));
$this->loginRequired = true;
$this->forbidMethod("GET");
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2022-02-20 16:53:26 +01:00
2022-06-20 19:52:31 +02:00
$currentUser = $this->context->getUser();
$gpgKey = $currentUser->getGPG();
2022-02-20 16:53:26 +01:00
if (!$gpgKey) {
return $this->createError("You have not added a GPG public key to your account yet.");
}
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2022-11-19 01:15:34 +01:00
$password = $this->getParam("password");
if (!password_verify($password, $currentUser->password)) {
return $this->createError("Incorrect password.");
} else if (!$gpgKey->delete($sql)) {
return $this->createError("Error deleting gpg key: " . $sql->getLastError());
2022-02-20 16:53:26 +01:00
}
return $this->success;
}
}
class ConfirmGPG extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, [
2022-02-20 16:53:26 +01:00
"token" => new StringType("token", 36)
]);
$this->loginRequired = true;
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2022-02-20 16:53:26 +01:00
2022-06-20 19:52:31 +02:00
$currentUser = $this->context->getUser();
$gpgKey = $currentUser->getGPG();
2022-02-20 16:53:26 +01:00
if (!$gpgKey) {
return $this->createError("You have not added a GPG key yet.");
} else if ($gpgKey->isConfirmed()) {
return $this->createError("Your GPG key is already confirmed");
}
$token = $this->getParam("token");
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2022-11-19 01:15:34 +01:00
2022-11-20 17:13:53 +01:00
$userToken = UserToken::findBy(UserToken::createBuilder($sql, true)
->whereEq("token", $token)
2022-02-20 16:53:26 +01:00
->where(new Compare("valid_until", $sql->now(), ">="))
->whereEq("user_id", $currentUser->getId())
->whereEq("token_type", UserToken::TYPE_GPG_CONFIRM));
2022-02-20 16:53:26 +01:00
2022-11-19 01:15:34 +01:00
if ($userToken !== false) {
if ($userToken === null) {
2022-02-20 16:53:26 +01:00
return $this->createError("Invalid token");
} else {
2022-11-19 01:15:34 +01:00
if (!$gpgKey->confirm($sql)) {
return $this->createError("Error updating gpg key: " . $sql->getLastError());
2022-02-20 16:53:26 +01:00
}
2022-11-19 01:15:34 +01:00
$userToken->invalidate($sql);
2022-02-20 16:53:26 +01:00
}
2022-11-19 01:15:34 +01:00
} else {
return $this->createError("Error validating token: " . $sql->getLastError());
2022-02-20 16:53:26 +01:00
}
return $this->success;
}
}
class DownloadGPG extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, array(
2022-02-20 16:53:26 +01:00
"id" => new Parameter("id", Parameter::TYPE_INT, true, null),
"format" => new StringType("format", 16, true, "ascii")
));
$this->loginRequired = true;
$this->csrfTokenRequired = false;
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2022-02-20 16:53:26 +01:00
$allowedFormats = ["json", "ascii", "gpg"];
$format = $this->getParam("format");
if (!in_array($format, $allowedFormats)) {
return $this->getParam("Invalid requested format. Allowed formats: " . implode(",", $allowedFormats));
}
2022-06-20 19:52:31 +02:00
$currentUser = $this->context->getUser();
2022-02-20 16:53:26 +01:00
$userId = $this->getParam("id");
2022-06-20 19:52:31 +02:00
if ($userId === null || $userId == $currentUser->getId()) {
$gpgKey = $currentUser->getGPG();
2022-02-20 16:53:26 +01:00
if (!$gpgKey) {
return $this->createError("You did not add a gpg key yet.");
}
2022-06-20 19:52:31 +02:00
$email = $currentUser->getEmail();
2022-02-20 16:53:26 +01:00
} else {
2022-11-19 01:15:34 +01:00
$sql = $this->context->getSQL();
$user = User::find($sql, $userId, true);
if ($user === false) {
return $this->createError("Error fetching user details: " . $sql->getLastError());
} else if ($user === null) {
return $this->createError("User not found");
2022-02-20 16:53:26 +01:00
}
2022-11-19 01:15:34 +01:00
$email = $user->getEmail();
$gpgKey = $user->getGPG();
if (!$gpgKey || !$gpgKey->isConfirmed()) {
return $this->createError("This user has not added a gpg key yet or has not confirmed it yet.");
2022-02-20 16:53:26 +01:00
}
}
2022-11-19 01:15:34 +01:00
$res = GpgKey::export($gpgKey->getFingerprint(), $format !== "gpg");
2022-02-20 16:53:26 +01:00
if (!$res["success"]) {
return $this->createError($res["error"]);
}
$key = $res["data"];
if ($format === "json") {
$this->result["key"] = $key;
return true;
} else if ($format === "ascii") {
$contentType = "application/pgp-keys";
$ext = "asc";
} else if ($format === "gpg") {
$contentType = "application/octet-stream";
$ext = "gpg";
} else {
die("Invalid format");
}
$fileName = "$email.$ext";
header("Content-Type: $contentType");
header("Content-Length: " . strlen($key));
header("Content-Disposition: attachment; filename=\"$fileName\"");
die($key);
}
}
2021-12-08 16:53:43 +01:00
class UploadPicture extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, [
2021-12-08 16:53:43 +01:00
"scale" => new Parameter("scale", Parameter::TYPE_FLOAT, true, NULL),
]);
$this->loginRequired = true;
$this->forbidMethod("GET");
}
/**
* @throws ImagickException
*/
protected function onTransform(\Imagick $im, $uploadDir) {
$minSize = 75;
$maxSize = 500;
$width = $im->getImageWidth();
$height = $im->getImageHeight();
$doResize = false;
if ($width < $minSize || $height < $minSize) {
if ($width < $height) {
$newWidth = $minSize;
$newHeight = intval(($minSize / $width) * $height);
} else {
$newHeight = $minSize;
$newWidth = intval(($minSize / $height) * $width);
}
$doResize = true;
} else if ($width > $maxSize || $height > $maxSize) {
if ($width > $height) {
$newWidth = $maxSize;
$newHeight = intval($height * ($maxSize / $width));
} else {
$newHeight = $maxSize;
$newWidth = intval($width * ($maxSize / $height));
}
$doResize = true;
} else {
$newWidth = $width;
$newHeight = $height;
}
if ($width < $minSize || $height < $minSize) {
return $this->createError("Error processing image. Bad dimensions.");
}
if ($doResize) {
$width = $newWidth;
$height = $newHeight;
$im->resizeImage($width, $height, \Imagick::FILTER_SINC, 1);
}
$size = $this->getParam("size");
if (is_null($size)) {
$size = min($width, $height);
}
$offset = [$this->getParam("offsetX"), $this->getParam("offsetY")];
if ($size < $minSize or $size > $maxSize) {
return $this->createError("Invalid size. Must be in range of $minSize-$maxSize.");
}/* else if ($offset[0] < 0 || $offset[1] < 0 || $offset[0]+$size > $width || $offset[1]+$size > $height) {
return $this->createError("Offsets out of bounds.");
}*/
if ($offset[0] !== 0 || $offset[1] !== 0 || $size !== $width || $size !== $height) {
$im->cropImage($size, $size, $offset[0], $offset[1]);
}
$fileName = uuidv4() . ".jpg";
$im->writeImage("$uploadDir/$fileName");
$im->destroy();
return $fileName;
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2021-12-08 16:53:43 +01:00
2022-06-20 19:52:31 +02:00
$currentUser = $this->context->getUser();
$userId = $currentUser->getId();
2021-12-08 16:53:43 +01:00
$uploadDir = WEBROOT . "/img/uploads/user/$userId";
2022-06-20 19:52:31 +02:00
list ($fileName, $imageName) = $this->processImageUpload($uploadDir, ["png", "jpg", "jpeg"], "onTransform");
2021-12-08 16:53:43 +01:00
if (!$this->success) {
return false;
}
2022-06-20 19:52:31 +02:00
$oldPfp = $currentUser->getProfilePicture();
2021-12-08 16:53:43 +01:00
if ($oldPfp) {
$path = "$uploadDir/$oldPfp";
if (is_file($path)) {
@unlink($path);
}
}
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2022-11-19 01:15:34 +01:00
$currentUser->profilePicture = $fileName;
2023-01-09 14:21:11 +01:00
if ($currentUser->save($sql, ["profilePicture"])) {
2021-12-08 16:53:43 +01:00
$this->result["profilePicture"] = $fileName;
2022-11-19 01:15:34 +01:00
} else {
return $this->createError("Error updating user details: " . $sql->getLastError());
2021-12-08 16:53:43 +01:00
}
return $this->success;
}
}
class RemovePicture extends UserAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, []);
2021-12-08 16:53:43 +01:00
$this->loginRequired = true;
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2021-12-08 16:53:43 +01:00
2022-11-19 01:15:34 +01:00
$sql = $this->context->getSQL();
2022-06-20 19:52:31 +02:00
$currentUser = $this->context->getUser();
2022-11-19 01:15:34 +01:00
$userId = $currentUser->getId();
2022-06-20 19:52:31 +02:00
$pfp = $currentUser->getProfilePicture();
2021-12-08 16:53:43 +01:00
if (!$pfp) {
return $this->createError("You did not upload a profile picture yet");
}
2022-11-19 01:15:34 +01:00
$currentUser->profilePicture = null;
2023-01-09 14:21:11 +01:00
if (!$currentUser->save($sql, ["profilePicture"])) {
2022-11-19 01:15:34 +01:00
return $this->createError("Error updating user details: " . $sql->getLastError());
}
2021-12-08 16:53:43 +01:00
2022-11-19 01:15:34 +01:00
$path = WEBROOT . "/img/uploads/user/$userId/$pfp";
if (is_file($path)) {
@unlink($path);
2021-12-08 16:53:43 +01:00
}
return $this->success;
}
}
2022-11-30 16:42:24 +01:00
class CheckToken extends UserAPI {
private ?UserToken $userToken;
public function __construct($user, $externalCall = false) {
parent::__construct($user, $externalCall, array(
'token' => new StringType('token', 36),
));
$this->userToken = null;
}
public function getToken(): ?UserToken {
return $this->userToken;
}
public function _execute(): bool {
$token = $this->getParam('token');
$userToken = $this->checkToken($token);
if ($userToken === false) {
return false;
}
$this->userToken = $userToken;
$this->result["token"] = $userToken->jsonSerialize();
return $this->success;
}
}
2020-06-20 20:13:51 +02:00
}