<?php

/**!info**

{

  "Plugin Name"  : "plugin_specialuserfuncs_title",

  "Plugin URI"   : "http://enanocms.org/",

  "Description"  : "plugin_specialuserfuncs_desc",

  "Author"       : "Dan Fuhry",

  "Version"      : "1.1.6",

  "Author URI"   : "http://enanocms.org/"

}

**!*/

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Copyright (C) 2006-2009 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

global $db, $session, $paths, $template, $plugins; // Common objects

// $plugins->attachHook('session_started', 'SpecialUserFuncs_paths_init();');

function SpecialUserFuncs_paths_init()

{

  register_special_page('Login', 'specialpage_log_in');

  register_special_page('Logout', 'specialpage_log_out');

  register_special_page('Register', 'specialpage_register');

  register_special_page('Preferences', 'specialpage_preferences');

  register_special_page('Contributions', 'specialpage_contributions');

  register_special_page('ChangeStyle', 'specialpage_change_theme');

  register_special_page('ActivateAccount', 'specialpage_activate_account');

  register_special_page('Captcha', 'specialpage_captcha');

  register_special_page('PasswordReset', 'specialpage_password_reset');

  register_special_page('Memberlist', 'specialpage_member_list');

  register_special_page('LangExportJSON', 'specialpage_language_export', false);

  register_special_page('Avatar', 'specialpage_avatar', false);

}

// function names are IMPORTANT!!! The name pattern is: page_<namespace ID>_<page URLname, without namespace>

$__login_status = '';

function page_Special_Login()

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  global $login_result;

  global $lang, $output;

  // Determine which level we're going up to

  $level = ( isset($_GET['level']) && in_array($_GET['level'], array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9') ) ) ? intval($_GET['level']) : USER_LEVEL_MEMBER;

  if ( isset($_POST['login']) )

  {

    if ( in_array($_POST['level'], array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9') ) )

    {

      $level = intval($_POST['level']);

    }

  }

  // Don't allow going from guest straight to elevated

  // FIXME do we want to allow this with a CSRF check?

  if ( $level > USER_LEVEL_MEMBER && !$session->user_logged_in )

  {

    $level = USER_LEVEL_MEMBER;

  }

  // If we're already at or above this level, redirect to the target page or, if no target

  // specified, back to the main page.

  if ( $level <= USER_LEVEL_MEMBER && $session->user_logged_in )

  {

    if ( $target = $paths->getAllParams() )

    {

      redirect(makeUrl($target), '', '', 0);

    }

    $paths->main_page();

  }

  // Lockout aliasing

  $lockout =& $login_result['lockout'];

  $output->header();

  echo '<form action="' . makeUrl($paths->nslist['Special'].'Login') . '" method="post" name="loginform" onsubmit="try { return runEncryption(); } catch(e) { console.error(e); };">';

  if ( $p = $paths->getAllParams() )

  {

    echo '<input type="hidden" name="return_to" value="' . htmlspecialchars($p) . '" />';

  }

  else if ( isset($_POST['login']) && isset($_POST['return_to']) )

  {

    echo '<input type="hidden" name="return_to" value="' . htmlspecialchars($_POST['return_to']) . '" />';

  }

  // determine what the "remember me" checkbox should say

  $session_time = intval(getConfig('session_remember_time', '30'));

  if ( $session_time === 0 )

  {

    // sessions are infinite

    $text_remember = $lang->get('user_login_check_remember_infinite');

  }

  else

  {

    // is the number of days evenly divisible by 7? if so, use weeks

    if ( $session_time % 7 == 0 )

    {

      $session_time = $session_time / 7;

      $unit = 'week';

    }

    else

    {

      $unit = 'day';

    }

    // if it's not equal to 1, pluralize it

    if ( $session_time != 1 )

    {

      $unit .= $lang->get('meta_plural');

    }

    $text_remember = $lang->get('user_login_check_remember', array(

        'session_length' => $session_time,

        'length_units' => $lang->get("etc_unit_$unit")

      ));

  }

  if ( $error_text = login_get_error($login_result) )

  {

    echo '<div class="error-box-mini">' . htmlspecialchars($error_text) . '</div>';

  }

  //

  // START FORM

  //

  ?>

    <div class="tblholder">

      <table border="0" style="width: 100%;" cellspacing="1" cellpadding="4">

        <tr>

          <th colspan="3">

            <!-- Table header: "Please enter..." -->

            <?php echo ( $level > USER_LEVEL_MEMBER ) ? $lang->get('user_login_message_short_elev') : $lang->get('user_login_message_short'); ?>

          </th>

        </tr>

        <tr>

          <td colspan="3" class="row1">

            <!-- Introduction text -->

            <?php

            if ( $level <= USER_LEVEL_MEMBER )

              echo '<p>' . $lang->get('user_login_body', array('reg_link' => makeUrlNS('Special', 'Register'))) . '</p>';

            else

              echo '<p>' . $lang->get('user_login_body_elev') . '</p>';

            ?>

          </td>

        </tr>

        <tr>

          <!-- Username field -->

          <td class="row2">

            <?php echo $lang->get('user_login_field_username'); ?>:

          </td>

          <td class="row1">

            <input name="username" size="25" type="text" value="<?php echo $session->user_logged_in ? htmlspecialchars($session->username) : ''; ?>" />

          </td>

          <?php if ( $level <= USER_LEVEL_MEMBER ): ?>

          <!-- Forgot password / create account links -->

          <td rowspan="<?php echo ( ( $lockout['active'] && $lockout['policy'] == 'captcha' ) ) ? '4' : '2'; ?>" class="row3">

            <small><?php echo $lang->get('user_login_forgotpass_blurb', array('forgotpass_link' => makeUrlNS('Special', 'PasswordReset'))); ?><br />

            <?php echo $lang->get('user_login_createaccount_blurb', array('reg_link' => makeUrlNS('Special', 'Register'))); ?></small>

          </td>

          <?php endif; ?>

        </tr>

        <tr>

          <!-- Password field -->

          <td class="row2">

            <?php echo $lang->get('user_login_field_password'); ?>:

          </td><td class="row1"><input name="password" size="25" type="password" /></td>

         </tr>

         <?php

         // CAPTCHA?

         if ( $lockout['active'] && $lockout['policy'] == 'captcha' )

         {

           ?>

           <!-- CAPTCHA -->

           <tr>

             <td class="row2" rowspan="2">

               <?php echo $lang->get('user_login_field_captcha'); ?>:

               <br />

             </td>

             <td class="row1">

               <input type="hidden" name="captcha_hash" value="<?php echo $lockout['captcha']; ?>" />

               <input name="captcha_code" size="25" type="text" tabindex="<?php echo ( $level <= USER_LEVEL_MEMBER ) ? '3' : '4'; ?>" />

             </td>

           </tr>

           <tr>

             <td class="row3">

               <img src="<?php echo makeUrlNS('Special', 'Captcha/' . $lockout['captcha']) ?>" onclick="this.src=this.src+'/a';" style="cursor: pointer;" />

             </td>

           </tr>

           <?php

         }

         // Run hooks

         $code = $plugins->setHook('login_form_html');

         foreach ( $code as $cmd )

         {

           eval($cmd);

         }

         // level-2 only: "Remember me" switch

         if ( $level <= USER_LEVEL_MEMBER )

         {

           ?>

           <tr>

             <td class="row2">

               <?php echo $lang->get('user_login_field_remember'); ?>

             </td>

             <td class="row1" colspan="2">

               <label>

                 <input type="checkbox" name="remember" tabindex="3" />

                 <?php echo $text_remember; ?>

               </label>

             </td>

           </tr>

         <!-- Crypto notice -->

           <?php

         }

         // lol DeMorgan'd

         $crypto_disable = ( isset($_GET['use_crypt']) && $_GET['use_crypt'] == '0' );

         // Crypto disable: crypto on, normal login

         if ( $level <= USER_LEVEL_MEMBER && !$crypto_disable )

         {

           echo '<tr>

             <td class="row3" colspan="3">';

           $returnpage_link = ( $return = $paths->getAllParams() ) ? '/' . $return : '';

           $nocrypt_link = makeUrlNS('Special', "Login$returnpage_link", "level=$level&use_crypt=0", true);

           echo '<p><b>' . $lang->get('user_login_nocrypt_title') . '</b> ' . $lang->get('user_login_nocrypt_body', array('nocrypt_link' => $nocrypt_link)) . '</p>';

           echo '<p>' . $lang->get('user_login_nocrypt_countrylist') . '</p>';

           echo '  </td>

           </tr>';

         }

         // Crypto disable: crypto OFF, normal login

         else if ( $level <= USER_LEVEL_MEMBER && $crypto_disable )

         {

           echo '<tr>

             <td class="row3" colspan="3">';

           $returnpage_link = ( $return = $paths->getAllParams() ) ? '/' . $return : '';

           $usecrypt_link = makeUrlNS('Special', "Login$returnpage_link", "level=$level&use_crypt=1", true);

           echo '<p><b>' . $lang->get('user_login_usecrypt_title') . '</b> ' . $lang->get('user_login_usecrypt_body', array('usecrypt_link' => $usecrypt_link)) . '</p>';

           echo '<p>' . $lang->get('user_login_usecrypt_countrylist') . '</p>';

           echo '  </td>

           </tr>';

         }

         // Crypto disable: crypto on, ELEV login

         else if ( $level > USER_LEVEL_MEMBER && $GLOBALS['dh_supported'] )

         {

           echo '<tr>';

           echo '<td class="row3" colspan="3">';

           echo '<p>' . $lang->get('user_login_dh_notice') . '</p>';

           echo '</td>';

           echo '</tr>';

         }

         ?>

         <!-- Submit button -->

         <tr>

           <th colspan="3" style="text-align: center" class="subhead">

             <input type="hidden" name="login" value="true" />

             <input type="submit" value="<?php echo $lang->get('user_login_btn_log_in'); ?>" />

           </th>

         </tr>

      </table>

    </div>

      <input type="hidden" name="level" value="<?php echo (string)$level; ?>" />

      <?php if ( $level <= USER_LEVEL_MEMBER ): ?>

      <script type="text/javascript">

        document.forms.loginform.username.focus();

      </script>

      <?php else: ?>

      <script type="text/javascript">

        document.forms.loginform.pass.focus();

      </script>

      <?php endif; ?>

      <?php

      echo $session->generate_aes_form();

      // Any additional parameters that need to be passed back?

      if ( $p = $paths->getAllParams() )

      {

        // ... only if we have a return_to destination.

        $get_fwd = $_GET;

        unset($get_fwd['do']);

        if ( isset($get_fwd['target_do']) )

        {

          $get_fwd['do'] = $get_fwd['target_do'];

          unset($get_fwd['target_do']);

        }

        if ( isset($get_fwd['level']) )

          unset($get_fwd['level']);

        if ( isset($get_fwd['title']) )

          unset($get_fwd['title']);

        if ( !empty($get_fwd) )

        {

          $get_string = htmlspecialchars(enano_json_encode($get_fwd));

          echo '<input type="hidden" name="get_fwd" value="' . $get_string . '" />';

        }

      }

      else if ( isset($_POST['get_fwd']) )

      {

        echo '<input type="hidden" name="get_fwd" value="' . htmlspecialchars($_POST['get_fwd']) . '" />';

      }

      ?>

    </form>

    <?php

      if ( !$crypto_disable )

        echo $session->aes_javascript('loginform', 'password');

    ?>

  <?php

  $output->footer();

}

function page_Special_Login_preloader() // adding _preloader to the end of the function name calls the function before $session and $paths setup routines are called

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  global $login_result;

  global $lang;

  // Are we calling the JSON interface?

  $paths->fullpage = $GLOBALS['urlname'];

  if ( $paths->getParam(0) === 'action.json' )

  {

    if ( !isset($_POST['r']) )

      die('No request.');

    $request = $_POST['r'];

    try

    {

      $request = enano_json_decode($request);

    }

    catch ( Exception $e )

    {

      die(enano_json_encode(array(

          'mode' => 'error',

          'error' => 'ERR_JSON_PARSE_FAILED'

        )));

    }

    echo enano_json_encode($session->process_login_request($request));

    $db->close();

    exit;

  }

  // No. Process incoming results from the HTML version.

  if ( isset($_POST['login']) )

  {

    $_POST['password'] = $session->get_aes_post();

    $result = $session->process_login_request(array(

        'mode' => 'login_pt',

        'userinfo' => $_POST,

        'level' => $_POST['level'],

        'captcha_hash' => isset($_POST['captcha_hash']) ? $_POST['captcha_hash'] : false,

        'captcha_code' => isset($_POST['captcha_code']) ? $_POST['captcha_code'] : false

      ));

    if ( $result['mode'] === 'login_success' )

    {

      //

      // LOGIN SUCCESS.

      // Redirect as necessary.

      //

      // Load our preferences

      $session->start();

      // Decode get_add

      $get_add = false;

      if ( isset($_POST['get_fwd']) )

      {

        try

        {

          $get_fwd = enano_json_decode($_POST['get_fwd']);

          $get_add = '';

          foreach ( $get_fwd as $key => $value )

          {

            $get_add .= "&{$key}=" . urlencode($value);

          }

          $get_add = ltrim($get_add, '&');

        }

        catch ( Exception $e )

        {

        }

      }

      // Going to a user-specified page?

      if ( isset($_POST['return_to']) )

      {

        // yea

        $name = get_page_title($_POST['return_to']);

        $subst = array(

            'username' => $session->username,

            'redir_target' => $name

          );

        redirect( makeUrl($_POST['return_to'], $get_add), $lang->get('user_login_success_title'), $lang->get('user_login_success_body', $subst) );

      }

      else

      {

        // No, redirect them to the main page

        $subst = array(

            'username' => $session->username,

            'redir_target' => $lang->get('user_login_success_body_mainpage')

          );

        redirect( makeUrl(get_main_page(), $get_add), $lang->get('user_login_success_title'), $lang->get('user_login_success_body', $subst) );

      }

    }

    else if ( $result['mode'] === 'login_success_reset' )

    {

      // They logged in with a temporary password; send them to the reset form

      redirect($result['redirect_url'], '', '', 0);

    }

    // Otherwise, the result is likely an error.

    $login_result = $result;

  }

  else

  {

    $login_result = $session->process_login_request(array(

        'mode' => 'getkey'

      ));

  }

  // This is a bit of a hack. The login form generates AES and DiffieHellman keys on its

  // own, so we need to clean up the ones from the login request API.

  if ( !empty($login_result['crypto']) )

  {

    $session->process_login_request(array(

        'mode' => 'clean_key',

        'key_aes' => $login_result['crypto']['aes_key'],

        'key_dh' => $login_result['crypto']['dh_public_key'],

      ));

  }

}

/**

 * Given a Login API response, find the appropriate error text, if any.

 * @param array LoginAPI response

 * @return mixed Error string, or bool(false) if no error.

 */

function login_get_error($response)

{

  global $lang;

  if ( !empty($response['lockout']) )

  {

    // set this pluralality thing

    $response['lockout']['plural'] = $response['lockout']['time_rem'] == 1 ? '' : $lang->get('meta_plural');

  }

  if ( $response['mode'] == 'initial' )

  {

    // Just showing the box for the first time. If there's an error now, it's based on a preexisting lockout.

    if ( $response['lockout']['active'] )

    {

      return $lang->get('user_err_locked_out_initial_' . $response['lockout']['policy'], $response['lockout']);

    }

    return false;

  }

  else

  {

    // An attempt was made.

    switch($response['mode'])

    {

      case 'login_failure':

        // Generic login user error.

        $error = '';

        if ( ($x = $lang->get($response['error'])) != $response['error'] )

          $error = $x;

        else

          $error = $lang->get('user_err_' . $response['error']);

        if ( $response['lockout']['active'] && $response['lockout']['policy'] == 'lockout' )

        {

          // Lockout enforcement was just activated.

          return $lang->get('user_err_locked_out_initial_' . $response['lockout']['policy'], $response['lockout']);

        }