Settings + Test Mail

core/Api/SendMail.class.php

@@ -11,12 +11,9 @@ class SendMail extends Request {
 
   public function __construct($user, $externalCall = false) {
     parent::__construct($user, $externalCall, array(
-      'from' => new Parameter('from', Parameter::TYPE_EMAIL),
       'to' => new Parameter('to', Parameter::TYPE_EMAIL),
       'subject'  => new StringType('subject', -1),
       'body' => new StringType('body', -1),
-      'fromName' => new StringType('fromName', -1, true, ''),
-      'replyTo' => new Parameter('to', Parameter::TYPE_EMAIL, true, ''),
     ));
     $this->isPublic = false;
   }
@@ -28,6 +25,7 @@ class SendMail extends Request {
 
     if ($this->success) {
       $settings = $req->getResult()["settings"];
+
       if (!isset($settings["mail_enabled"]) || $settings["mail_enabled"] !== "1") {
         $this->createError("Mail is not configured yet.");
         return null;
@@ -37,7 +35,9 @@ class SendMail extends Request {
       $port = intval($settings["mail_port"] ?? "25");
       $login = $settings["mail_username"] ?? "";
       $password = $settings["mail_password"] ?? "";
-      return new ConnectionData($host, $port, $login, $password);
+      $connectionData = new ConnectionData($host, $port, $login, $password);
+      $connectionData->setProperty("from", $settings["mail_from"] ?? "");
+      return $connectionData;
     }
 
     return null;
@@ -56,7 +56,7 @@ class SendMail extends Request {
     try {
       $mail = new PHPMailer;
       $mail->IsSMTP();
-      $mail->setFrom($this->getParam('from'), $this->getParam('fromName'));
+      $mail->setFrom($mailConfig->getProperty("from"));
       $mail->addAddress($this->getParam('to'));
       $mail->Subject = $this->getParam('subject');
       $mail->SMTPDebug = 0;
@@ -70,11 +70,6 @@ class SendMail extends Request {
       $mail->CharSet = 'UTF-8';
       $mail->Body = $this->getParam('body');
 
-      $replyTo = $this->getParam('replyTo');
-      if(!is_null($replyTo) && !empty($replyTo)) {
-        $mail->AddReplyTo($replyTo, $this->getParam('fromName'));
-      }
-
       $this->success = @$mail->Send();
       if (!$this->success) {
         $this->lastError = "Error sending Mail: $mail->ErrorInfo";

core/Api/SendTestMail.class.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Api;
+
+use Api\Parameter\Parameter;
+use Objects\User;
+
+class SendTestMail extends Request {
+
+  public function __construct(User $user, bool $externalCall = false) {
+    parent::__construct($user, $externalCall, array(
+      "receiver" => new Parameter("receiver", Parameter::TYPE_EMAIL)
+    ));
+  }
+
+  public function execute($values = array()) {
+    if (!parent::execute($values)) {
+      return false;
+    }
+
+    $receiver = $this->getParam("receiver");
+    $req = new SendMail($this->user);
+    $this->success = $req->execute(array(
+      "to" => $receiver,
+      "subject" => "Test E-Mail",
+      "body" => "Hey! If you receive this e-mail, your mail configuration seems to be working."
+    ));
+
+    $this->lastError = $req->getLastError();
+    return $this->success;
+  }
+
+}

core/Api/SettingsAPI.class.php

@@ -16,6 +16,7 @@ namespace Api\Settings {
   use Driver\SQL\Column\Column;
   use Driver\SQL\Condition\Compare;
   use Driver\SQL\Condition\CondLike;
+  use Driver\SQL\Condition\CondNot;
   use Driver\SQL\Condition\CondRegex;
   use Driver\SQL\Strategy\UpdateStrategy;
   use Objects\User;
@@ -42,11 +43,12 @@ namespace Api\Settings {
        $query = $sql->select("name", "value") ->from("Settings");
 
        if (!is_null($key) && !empty($key)) {
-         $query->where(new CondRegex($key, new Column("name")));
+         $query->where(new CondRegex(new Column("name"), $key));
        }
 
+       // filter sensitive values, if called from outside
        if ($this->isExternalCall()) {
-         $query->where(new Compare("name", "jwt_secret", "!="));
+         $query->where(new CondNot("private"));
        }
 
        $res = $query->execute();

core/Api/UserAPI.class.php

@@ -461,7 +461,8 @@ If the invitation was not intended, you can simply ignore this email.<br><br><a
               return $this->createError("Error creating Session: " . $sql->getLastError());
             } else {
               $this->result["loggedIn"] = true;
-              $this->result['logoutIn'] = $this->user->getSession()->getExpiresSeconds();
+              $this->result["logoutIn"] = $this->user->getSession()->getExpiresSeconds();
+              $this->result["csrf_token"] = $this->user->getSession()->getCsrfToken();
               $this->success = true;
             }
           } else {

core/Configuration/CreateDatabase.class.php

@@ -138,24 +138,64 @@ class CreateDatabase {
       ->addRow("^/register(/)?$", "dynamic", "\\Documents\\Account", "\\Views\\Account\\Register")
       ->addRow("^/confirmEmail(/)?$", "dynamic", "\\Documents\\Account", "\\Views\\Account\\ConfirmEmail")
       ->addRow("^/acceptInvite(/)?$", "dynamic", "\\Documents\\Account", "\\Views\\Account\\AcceptInvite")
+      ->addRow("^/resetPassword(/)?$", "dynamic", "\\Documents\\Account", "\\Views\\Account\\ResetPassword")
       ->addRow("^/$", "static", "/static/welcome.html", NULL);
 
     $queries[] = $sql->createTable("Settings")
       ->addString("name", 32)
       ->addString("value", 1024, true)
+      ->addBool("private", false)
       ->primaryKey("name");
 
-    $settingsQuery = $sql->insert("Settings", array("name", "value"))
+    $settingsQuery = $sql->insert("Settings", array("name", "value", "private"))
       // ->addRow("mail_enabled", "0") # this key will be set during installation
-      ->addRow("mail_host", "")
-      ->addRow("mail_port", "")
-      ->addRow("mail_username", "")
-      ->addRow("mail_password", "")
-      ->addRow("mail_from", "");
+      ->addRow("mail_host", "", false)
+      ->addRow("mail_port", "", false)
+      ->addRow("mail_username", "", false)
+      ->addRow("mail_password", "", true)
+      ->addRow("mail_from", "", false)
+      ->addRow("message_confirm_email", self::MessageConfirmEmail(), false)
+      ->addRow("message_accept_invite", self::MessageAcceptInvite(), false)
+      ->addRow("message_reset_password", self::MessageResetPassword(), false);
 
     (Settings::loadDefaults())->addRows($settingsQuery);
     $queries[] = $settingsQuery;
 
     return $queries;
   }
+
+  private static function MessageConfirmEmail() : string {
+    return str_replace("\n", "", intendCode(
+      "Hello {{username}},<br>
+            You recently created an account on {{site_name}}. Please click on the following link to 
+            confirm your email address and complete your registration. If you haven't registered an
+            account, you can simply ignore this email. The link is valid for the next 48 hours:<br><br>
+            <a href=\"{{link}}\">{{confirm_link}}</a><br><br>
+            Best Regards<br>
+            {{site_name}} Administration", false
+    ));
+  }
+
+  private static function MessageAcceptInvite() : string {
+    return str_replace("\n", "", intendCode(
+      "Hello {{username}},<br>
+            You were invited to create an account on {{site_name}}. Please click on the following link to 
+            confirm your email address and complete your registration by choosing a new password. 
+            If you want to decline the invitation, you can simply ignore this email. The link is valid for the next 48 hours:<br><br>
+            <a href=\"{{link}}\">{{link}}</a><br><br>
+            Best Regards<br>
+            {{site_name}} Administration", false
+    ));
+  }
+
+  private static function MessageResetPassword() : string {
+    return str_replace("\n", "", intendCode(
+      "Hello {{username}},<br>
+            you requested a password reset on {{sitename}}. Please click on the following link to 
+            choose a new password. If this request was not intended, you can simply ignore the email. The Link is valid for one hour:<br><br>
+            <a href=\"{{link}}\">{{link}}</a><br><br>
+            Best Regards<br>
+            {{site_name}} Administration", false
+    ));
+  }
 }

core/Configuration/Settings.class.php

@@ -62,10 +62,10 @@ class Settings {
   }
 
   public function addRows(Insert $query) {
-    $query->addRow("site_name", $this->siteName)
-      ->addRow("base_url", $this->baseUrl)
-      ->addRow("user_registration_enabled", $this->registrationAllowed ? "1" : "0")
-      ->addRow("installation_completed", $this->installationComplete ? "1" : "0")
-      ->addRow("jwt_secret", $this->jwtSecret);
+    $query->addRow("site_name", $this->siteName, false)
+      ->addRow("base_url", $this->baseUrl, false)
+      ->addRow("user_registration_enabled", $this->registrationAllowed ? "1" : "0", false)
+      ->addRow("installation_completed", $this->installationComplete ? "1" : "0", true)
+      ->addRow("jwt_secret", $this->jwtSecret, true);
   }
 }

core/Driver/SQL/Condition/CondNot.class.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace Driver\SQL\Condition;
+
+class CondNot extends Condition {
+
+  private $expression; // string or condition
+
+  public function __construct($expression) {
+    $this->expression = $expression;
+  }
+
+  public function getExpression() {
+    return $this->expression;
+  }
+}

core/Driver/SQL/SQL.class.php

@@ -6,7 +6,9 @@ use Driver\SQL\Column\Column;
 use Driver\SQL\Condition\Compare;
 use Driver\SQL\Condition\CondBool;
 use Driver\SQL\Condition\CondIn;
+use Driver\SQL\Condition\Condition;
 use Driver\SQL\Condition\CondKeyword;
+use Driver\SQL\Condition\CondNot;
 use Driver\SQL\Condition\CondOr;
 use Driver\SQL\Condition\CondRegex;
 use Driver\SQL\Constraint\Constraint;
@@ -339,6 +341,9 @@ abstract class SQL {
         return implode(" AND ", $conditions);
       }
     } else if($condition instanceof CondIn) {
+
+      $value = $condition->getValues();
+
       $values = array();
       foreach ($condition->getValues() as $value) {
         $values[] = $this->addValue($value, $params);
@@ -353,6 +358,15 @@ abstract class SQL {
       $left = ($left instanceof Column) ? $this->columnName($left->getName()) : $this->addValue($left, $params);
       $right = ($right instanceof Column) ? $this->columnName($right->getName()) : $this->addValue($right, $params);
       return "$left $keyword $right ";
+    } else if($condition instanceof CondNot) {
+      $expression = $condition->getExpression();
+      if ($expression instanceof Condition) {
+        $expression = $this->buildCondition($expression, $params);
+      } else {
+        $expression = $this->columnName($expression);
+      }
+
+      return "NOT $expression";
     } else {
       $this->lastError = "Unsupported condition type: " . get_class($condition);
       return false;