<?php

/*

Plugin Name: Special user/login-related pages

Plugin URI: http://enanocms.org/

Description: Provides the pages Special:Login, Special:Logout, Special:Register, and Special:Preferences.

Author: Dan Fuhry

Version: 1.0.1

Author URI: http://enanocms.org/

*/

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Version 1.0 release candidate 2

 * Copyright (C) 2006-2007 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

global $db, $session, $paths, $template, $plugins; // Common objects

$plugins->attachHook('base_classes_initted', '

  global $paths;

    $paths->add_page(Array(

      \'name\'=>\'Log in\',

      \'urlname\'=>\'Login\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Log out\',

      \'urlname\'=>\'Logout\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Register\',

      \'urlname\'=>\'Register\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Edit Profile\',

      \'urlname\'=>\'Preferences\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Contributions\',

      \'urlname\'=>\'Contributions\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Change style\',

      \'urlname\'=>\'ChangeStyle\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Activate user account\',

      \'urlname\'=>\'ActivateAccount\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Captcha\',

      \'urlname\'=>\'Captcha\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Forgot password\',

      \'urlname\'=>\'PasswordReset\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Member list\',

      \'urlname\'=>\'Memberlist\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    ');

// function names are IMPORTANT!!! The name pattern is: page_<namespace ID>_<page URLname, without namespace>

$__login_status = '';

function page_Special_Login()

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  global $__login_status;

  $pubkey = $session->rijndael_genkey();

  $challenge = $session->dss_rand();

  $locked_out = false;

  // are we locked out?

  $threshold = ( $_ = getConfig('lockout_threshold') ) ? intval($_) : 5;

  $duration  = ( $_ = getConfig('lockout_duration') ) ? intval($_) : 15;

  // convert to minutes

  $duration  = $duration * 60;

  $policy = ( $x = getConfig('lockout_policy') && in_array(getConfig('lockout_policy'), array('lockout', 'disable', 'captcha')) ) ? getConfig('lockout_policy') : 'lockout';

  if ( $policy != 'disable' )

  {

    $ipaddr = $db->escape($_SERVER['REMOTE_ADDR']);

    $timestamp_cutoff = time() - $duration;

    $q = $session->sql('SELECT timestamp FROM '.table_prefix.'lockout WHERE timestamp > ' . $timestamp_cutoff . ' AND ipaddr = \'' . $ipaddr . '\' ORDER BY timestamp DESC;');

    $fails = $db->numrows();

    if ( $fails >= $threshold )

    {

      $row = $db->fetchrow();

      $locked_out = true;

      $lockdata = array(

          'locked_out' => true,

          'lockout_threshold' => $threshold,

          'lockout_duration' => ( $duration / 60 ),

          'lockout_fails' => $fails,

          'lockout_policy' => $policy,

          'lockout_last_time' => $row['timestamp'],

          'time_rem' => ( $duration / 60 ) - round( ( time() - $row['timestamp'] ) / 60 ),

          'captcha' => ''

        );

      if ( $policy == 'captcha' )

      {

        $lockdata['captcha'] = $session->make_captcha();

      }

    }

    $db->free_result();

  }

  if ( isset($_GET['act']) && $_GET['act'] == 'getkey' )

  {

    $username = ( $session->user_logged_in ) ? $session->username : false;

    $response = Array(

      'username' => $username,

      'key' => $pubkey,

      'challenge' => $challenge,

      'locked_out' => false

      );

    if ( $locked_out )

    {

      foreach ( $lockdata as $x => $y )

      {

        $response[$x] = $y;

      }

      unset($x, $y);

    }

    $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);

    $response = $json->encode($response);

    echo $response;

    return null;

  }

  $level = ( isset($_GET['level']) && in_array($_GET['level'], array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9') ) ) ? intval($_GET['level']) : USER_LEVEL_MEMBER;

  if ( isset($_POST['login']) )

  {

    if ( in_array($_POST['auth_level'], array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9') ) )

    {

      $level = intval($_POST['auth_level']);

    }

  }

  if ( $level > USER_LEVEL_MEMBER && !$session->user_logged_in )

  {

    $level = USER_LEVEL_MEMBER;

  }

  if ( $level <= USER_LEVEL_MEMBER && $session->user_logged_in )

    $paths->main_page();

  $template->header();

  echo '<form action="'.makeUrl($paths->nslist['Special'].'Login').'" method="post" name="loginform" onsubmit="runEncryption();">';

  if ( isset($_POST['login']) )

  {

    $errstring = $__login_status['error'];

    switch($__login_status['error'])

    {

      case 'key_not_found':

        break;

      case 'key_wrong_length':

        break;

      case 'too_big_for_britches':

        break;

      case 'invalid_credentials':

        if ( $__login_status['lockout_policy'] == 'lockout' )

        {

        }

        else if ( $__login_status['lockout_policy'] == 'captcha' )

        {

        }

        break;

      case 'backend_fail':

        break;

      case 'locked_out':

        $attempts = intval($__login_status['lockout_fails']);

        if ( $attempts > $__login_status['lockout_threshold'])

          $attempts = $__login_status['lockout_threshold'];

        $server_time = time();

        break;

    }

    echo '<div class="error-box-mini">'.$errstring.'</div>';

  }

  if ( $p = $paths->getAllParams() )

  {

    echo '<input type="hidden" name="return_to" value="'.$p.'" />';

  }

  else if ( isset($_POST['login']) && isset($_POST['return_to']) )

  {

    echo '<input type="hidden" name="return_to" value="'.htmlspecialchars($_POST['return_to']).'" />';

  }

  ?>

    <div class="tblholder">

      <table border="0" style="width: 100%;" cellspacing="1" cellpadding="4">

        <tr>

          <th colspan="3"><?php echo $header; ?></th>

        </tr>

        <tr>

          <td colspan="3" class="row1">

            <?php

            if ( $level <= USER_LEVEL_MEMBER )

            {

            }

            else

            {

            }

            ?>

          </td>

        </tr>

        <tr>

          <td class="row2">

          </td>

          <td class="row1">

            <input name="username" size="25" type="text" <?php

              if ( $level <= USER_LEVEL_MEMBER )

              {

                echo 'tabindex="1" ';

              }

              else

              {

                echo 'tabindex="3" ';

              }

              if ( $session->user_logged_in )

              {

                echo 'value="' . $session->username . '"';

              }

              ?> />

          </td>

          <?php if ( $level <= USER_LEVEL_MEMBER ) { ?>

          <td rowspan="<?php echo ( ( $locked_out && $lockdata['lockout_policy'] == 'captcha' ) ) ? '4' : '2'; ?>" class="row3">

          </td>

          <?php } ?>

        </tr>

        <tr>

         </tr>

         <?php

         if ( $locked_out && $lockdata['lockout_policy'] == 'captcha' )

         {

           ?>

           <tr>

           </tr>

           <tr>

             <td class="row3">

               <img src="<?php echo makeUrlNS('Special', 'Captcha/' . $lockdata['captcha']) ?>" onclick="this.src=this.src+'/a';" style="cursor: pointer;" />

             </td>

           </tr>

           <?php

         }

         ?>

         <?php if ( $level <= USER_LEVEL_MEMBER ) { ?>

         <tr>

           <td class="row3" colspan="3">

           </td>

         </tr>

         <?php } ?>

         <tr>

           <th colspan="3" style="text-align: center" class="subhead"><input type="submit" name="login" value="Log in" tabindex="<?php echo ( $level <= USER_LEVEL_MEMBER ) ? '3' : '2'; ?>" /></th>

         </tr>

      </table>

    </div>

      <input type="hidden" name="challenge_data" value="<?php echo $challenge; ?>" />

      <input type="hidden" name="use_crypt" value="no" />

      <input type="hidden" name="crypt_key" value="<?php echo $pubkey; ?>" />

      <input type="hidden" name="crypt_data" value="" />

      <input type="hidden" name="auth_level" value="<?php echo (string)$level; ?>" />

      <?php if ( $level <= USER_LEVEL_MEMBER ): ?>

      <script type="text/javascript">

        document.forms.loginform.username.focus();

      </script>

      <?php else: ?>

      <script type="text/javascript">

        document.forms.loginform.pass.focus();

      </script>

      <?php endif; ?>

    </form>

    <?php

      echo $session->aes_javascript('loginform', 'pass', 'use_crypt', 'crypt_key', 'crypt_data', 'challenge_data');

    ?>

  <?php

  $template->footer();

}

function page_Special_Login_preloader() // adding _preloader to the end of the function name calls the function before $session and $paths setup routines are called

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  global $__login_status;

  if ( isset($_GET['act']) && $_GET['act'] == 'ajaxlogin' )

  {

    $plugins->attachHook('login_password_reset', 'SpecialLogin_SendResponse_PasswordReset($row[\'user_id\'], $row[\'temp_password\']);');

    $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);

    $data = $json->decode($_POST['params']);

    $captcha_hash = ( isset($data['captcha_hash']) ) ? $data['captcha_hash'] : false;

    $captcha_code = ( isset($data['captcha_code']) ) ? $data['captcha_code'] : false;

    $level = ( isset($data['level']) ) ? intval($data['level']) : USER_LEVEL_MEMBER;

    $result = $session->login_with_crypto($data['username'], $data['crypt_data'], $data['crypt_key'], $data['challenge'], $level, $captcha_hash, $captcha_code);

    $session->start();

    if ( $result['success'] )

    {

      $response = Array(

          'result' => 'success',

          'key' => $session->sid_super // ( ( $session->sid_super ) ? $session->sid_super : $session->sid )

        );

    }

    else

    {

      $captcha = '';

      if ( $result['error'] == 'locked_out' && $result['lockout_policy'] == 'captcha' )

      {

        $session->kill_captcha();

        $captcha = $session->make_captcha();

      }

      $response = Array(

          'result' => 'error',

          'data' => $result,

          'captcha' => $captcha

        );

    }

    $response = $json->encode($response);

    echo $response;

    $db->close();

    exit;

  }

  if(isset($_POST['login'])) {

    $captcha_hash = ( isset($_POST['captcha_hash']) ) ? $_POST['captcha_hash'] : false;

    $captcha_code = ( isset($_POST['captcha_code']) ) ? $_POST['captcha_code'] : false;

    if($_POST['use_crypt'] == 'yes')

    {

      $result = $session->login_with_crypto($_POST['username'], $_POST['crypt_data'], $_POST['crypt_key'], $_POST['challenge_data'], intval($_POST['auth_level']), $captcha_hash, $captcha_code);

    }

    else

    {

      $result = $session->login_without_crypto($_POST['username'], $_POST['pass'], false, intval($_POST['auth_level']), $captcha_hash, $captcha_code);

    }

    $session->start();

    $paths->init();

    if($result['success'])

    {

      $template->load_theme($session->theme, $session->style);

      if(isset($_POST['return_to']))