1: <?php
  2: /**
  3:  * This file contains the the password request class.
  4:  *
  5:  * @package Core
  6:  * @subpackage Backend
  7:  * @version SVN Revision $Rev:$
  8:  *
  9:  * @author Timo Trautmann
 10:  * @copyright four for business AG <www.4fb.de>
 11:  * @license http://www.contenido.org/license/LIZENZ.txt
 12:  * @link http://www.4fb.de
 13:  * @link http://www.contenido.org
 14:  */
 15: 
 16: defined('CON_FRAMEWORK') || die('Illegal call: Missing framework initialization - request aborted.');
 17: 
 18: /**
 19:  * Class for handling passwort recovery for backend users.
 20:  * If a user has set his e-mail address, this class
 21:  * generates a new Password for user and submits to his e-mail adress.
 22:  * Submitting a new Password is
 23:  * only possible every 30 minutes Mailsender, Mailsendername and Mailserver are
 24:  * set into system properties.
 25:  * There it is also possible to deactivate this feature.
 26:  *
 27:  * @package Core
 28:  * @subpackage Backend
 29:  */
 30: class cPasswordRequest {
 31: 
 32:     /**
 33:      * The CONTENIDO database object
 34:      *
 35:      * @var cDb
 36:      */
 37:     protected $_db;
 38: 
 39:     /**
 40:      * The CONTENIDO configuration array
 41:      *
 42:      * @var array
 43:      */
 44:     protected $_cfg;
 45: 
 46:     /**
 47:      * The CONTENIDO template object
 48:      *
 49:      * @var cTemplate
 50:      */
 51:     protected $_tpl;
 52: 
 53:     /**
 54:      * Username of user which requests password
 55:      *
 56:      * @var string
 57:      */
 58:     protected $_username;
 59: 
 60:     /**
 61:      * E-mail address of user which requests password
 62:      *
 63:      * @var string
 64:      */
 65:     protected $_email;
 66: 
 67:     /**
 68:      * Time in minutes after which user is allowed to request a new password
 69:      *
 70:      * @var int
 71:      */
 72:     protected $_reloadTime;
 73: 
 74:     /**
 75:      * Length of new passwort, which is generated automatically
 76:      *
 77:      * @var int
 78:      */
 79:     protected $_passLength;
 80: 
 81:     /**
 82:      * Defines if passwort request is enabled or disabled.
 83:      * Default: This feature is enabled
 84:      *
 85:      * @var bool
 86:      */
 87:     protected $_isEnabled;
 88: 
 89:     /**
 90:      * E-mail address of the sender
 91:      *
 92:      * @var string
 93:      */
 94:     protected $_sendermail;
 95: 
 96:     /**
 97:      * Name of the sender
 98:      *
 99:      * @var string
100:      */
101:     protected $_sendername;
102: 
103:     /**
104:      * Host of mailserver, which sends new password via mail
105:      *
106:      * @var string
107:      */
108:     protected $_mailhost;
109: 
110:     /**
111:      * Constructor of RequestPassword initializes class variables
112:      *
113:      * @param cDb $db The CONTENIDO database object
114:      * @param array $cfg The CONTENIDO configuration array
115:      */
116:     public function __construct($db, $cfg) {
117:         // generate new dbobject, if it does not exist
118:         if (!is_object($db)) {
119:             $this->_db = cRegistry::getDb();
120:         } else {
121:             $this->_db = $db;
122:         }
123: 
124:         // init class variables
125:         $this->_cfg = $cfg;
126:         $this->_tpl = new cTemplate();
127:         $this->_username = '';
128:         $this->_email = '';
129: 
130:         // set reload to 30 minutes
131:         $this->_reloadTime = 30;
132: 
133:         // set pass length to 14 chars
134:         $this->_passLength = 14;
135: 
136:         // get systemproperty, which definies if password request is enabled
137:         // (true) or disabled (false) : default to enabled
138:         $sEnable = getSystemProperty('pw_request', 'enable');
139:         if ($sEnable == 'false') {
140:             $this->_isEnabled = false;
141:         } else {
142:             $this->_isEnabled = true;
143:         }
144: 
145:         // get systemproperty for senders mail and validate mailadress, if not
146:         // set use standard sender
147:         $sendermail = getSystemProperty('system', 'mail_sender');
148:         if (preg_match("/^.+@.+\.([A-Za-z0-9\-_]{1,20})$/", $sendermail)) {
149:             $this->_sendermail = $sendermail;
150:         } else {
151:             $this->_sendermail = 'info@contenido.org';
152:         }
153: 
154:         // get systemproperty for senders name, if not set use CONTENIDO Backend
155:         $sendername = getSystemProperty('system', 'mail_sender_name');
156:         if ($sendername != '') {
157:             $this->_sendername = $sendername;
158:         } else {
159:             $this->_sendername = 'CONTENIDO Backend';
160:         }
161: 
162:         // get systemproperty for location of mailserver, if not set use
163:         // localhost
164:         $mailhost = getSystemProperty('system', 'mail_host');
165:         if ($mailhost != '') {
166:             $this->_mailhost = $mailhost;
167:         } else {
168:             $this->_mailhost = 'localhost';
169:         }
170:     }
171: 
172:     /**
173:      * Function displays form for password request and sets new password, if
174:      * password is submitted this function also starts the passwort change an
175:      * sending process
176:      *
177:      * @param bool $return Return or print template
178:      * @return string rendered HTML code
179:      */
180:     public function renderForm($return = 0) {
181:         // if feature is not enabled, do nothing
182:         if (!$this->_isEnabled) {
183:             return '';
184:         }
185: 
186:         $message = '';
187: 
188:         // if form is sumbitted call function handleNewPassword() and set
189:         // submitted username to class variable $sUsername
190:         if (isset($_POST['action']) && $_POST['action'] == 'request_pw') {
191:             // avoid SQL-Injection, first check if submitted vars are escaped
192:             // automatically
193:             $this->_username = $_POST['request_username'];
194: 
195:             $message = $this->_handleNewPassword();
196:             // if form is submitted, show corresponding password request layer
197:             $this->_tpl->set('s', 'JS_CALL', 'showRequestLayer();');
198:         } else {
199:             // by default request layer is invisible so da nothing
200:             $this->_tpl->set('s', 'JS_CALL', '');
201:         }
202: 
203:         // generate new form
204:         $form = new cHTMLForm('request_pw', 'index.php', 'post');
205: 
206:         // generate input for username
207:         $inputUsername = new cHTMLTextbox('request_username', stripslashes($_POST['request_username']), '', '', 'request_username');
208:         $inputUsername->setStyle('width:215px;');
209: 
210:         // set request action and current language
211:         $form->setVar('action', 'request_pw');
212:         $form->setVar('belang', $GLOBALS['belang']);
213: 
214:         // generate submitbutton and fill the form
215:         $form->setContent('<input class="password_request_input" type="image" src="images/submit.gif" alt="' . i18n('Submit') . '" title="' . i18n('Submit') . '">' . $inputUsername->render());
216:         $this->_tpl->set('s', 'FORM', $form->render());
217:         $this->_tpl->set('s', 'MESSAGE', $message);
218:         $this->_tpl->set('s', 'LABEL', i18n('Please enter your login') . ':');
219: 
220:         // if handleNewPassword() returns a message, display it
221:         if ($return) {
222:             return $this->_tpl->generate($this->_cfg['path']['contenido'] . $this->_cfg['path']['templates'] . $this->_cfg['templates']['request_password'], 1);
223:         } else {
224:             return $this->_tpl->generate($this->_cfg['path']['contenido'] . $this->_cfg['path']['templates'] . $this->_cfg['templates']['request_password']);
225:         }
226:     }
227: 
228:     /**
229:      * Function checks password request for errors an delegate request to
230:      * setNewPassword() if there is no error
231:      *
232:      * @return string
233:      */
234:     protected function _handleNewPassword() {
235:         // notification message, which is returned to caller
236:         $message = '';
237:         $this->_username = stripslashes($this->_username);
238: 
239:         // check if requested username exists, also get email and timestamp when
240:         // user last requests a new password (last_pw_request)
241:         $sql = "SELECT username, last_pw_request, email FROM " . $this->_cfg['tab']['user'] . "
242:                  WHERE username = '" . $this->_db->escape($this->_username) . "'
243:                  AND (valid_from <= NOW() OR valid_from = '0000-00-00' OR valid_from IS NULL)
244:                  AND (valid_to >= NOW() OR valid_to = '0000-00-00' OR valid_to IS NULL)";
245: 
246:         $this->_db->query($sql);
247:         if ($this->_db->nextRecord() && md5($this->_username) == md5($this->_db->f('username'))) {
248:             // by default user is allowed to request new password
249:             $isAllowed = true;
250:             $lastPwRequest = $this->_db->f('last_pw_request');
251:             // store users mail adress to class variable
252:             $this->_email = $this->_db->f('email');
253: 
254:             // check if there is a correct last request date
255:             if (preg_match('/^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})$/', $lastPwRequest, $aMatches)) {
256:                 $lastRequest = mktime($aMatches[4], $aMatches[5], $aMatches[6], $aMatches[2], $aMatches[3], $aMatches[1]);
257: 
258:                 // check if this last request is longer ago then timelimit.
259:                 if ((time() - $lastRequest) < (60 * $this->_reloadTime)) {
260:                     // user is not allowed to request new password, he has to
261:                     // wait
262:                     $isAllowed = false;
263:                     $message = sprintf(i18n('Password requests are allowed every %s minutes.'), $this->_reloadTime);
264:                 }
265:             }
266: 
267:             // check if syntax of users mail adress is correct and there is no
268:             // standard mailadress like admin_kunde@IhreSite.de or
269:             // sysadmin@IhreSite.de
270:             if ((!preg_match("/^.+@.+\.([A-Za-z0-9\-_]{1,20})$/", $this->_email) || $this->_email == 'sysadmin@IhreSite.de' || $this->_email == 'admin_kunde@IhreSite.de') && $isAllowed) {
271:                 $isAllowed = false;
272:                 // $sMessage = i18n('The requested user has no valid e-mail
273:                 // address. Submitting new password is not possible. Please
274:                 // contact your system- administrator for further support.');
275:                 $message = i18n('No matching data found. Please contact your systemadministrator.');
276:             }
277: 
278:             // if there are no errors, call function setNewPassword(), else wait
279:             // a while, then return error message
280:             if ($isAllowed) {
281:                 $this->_setNewPassword();
282:                 $message = i18n('New password was submitted to your e-mail address.');
283:             } else {
284:                 sleep(5);
285:             }
286:         } else {
287:             // slepp a while, then return error message
288:             // $sMessage = i18n('This user does not exist.');
289:             $message = i18n('No matching data found. Please contact your systemadministrator.');
290:             sleep(5);
291:         }
292:         return $message;
293:     }
294: 
295:     /**
296:      * Function sets new password for user and sets last request time to now
297:      */
298:     protected function _setNewPassword() {
299:         // generate new password, using generatePassword()
300:         $password = $this->_generatePassword();
301: 
302:         // get salt
303:         $sql = "SELECT salt FROM " . $this->_cfg['tab']['user'] . " WHERE username = '" . $this->_username . "'";
304:         $this->_db->query($sql);
305:         $this->_db->nextRecord();
306: 
307:         // hash password
308:         $password_hash = hash("sha256", md5($password) . $this->_db->f("salt"));
309: 
310:         // update database entry, set new password and last_pw_request time
311:         $sql = "UPDATE " . $this->_cfg['tab']['user'] . "
312:                 SET last_pw_request = '" . date('Y-m-d H:i:s') . "',
313:                 tmp_pw_request = '" . $password_hash . "',
314:                 password = '" . $password_hash . "'
315:                 WHERE username = '" . $this->_username . "'";
316:         $this->_db->query($sql);
317: 
318:         // call function submitMail(), which sends new password to user
319:         $this->_submitMail($password);
320:     }
321: 
322:     /**
323:      * Function submits new password to users mail adress
324:      *
325:      * @param string $password The new password
326:      */
327:     protected function _submitMail($password) {
328:         $cfg = cRegistry::getConfig();
329: 
330:         $password = (string) $password;
331: 
332:         // get translation for mailbody and insert username and new password
333:         $mailBody = sprintf(i18n("Dear CONTENIDO-User %s,\n\nYour password to log in Content Management System CONTENIDO is: %s\n\nBest regards\n\nYour CONTENIDO sysadmin"), $this->_username, $password);
334: 
335:         $mailer = new cMailer();
336:         $from = array(
337:             $this->_sendermail => $this->_sendername
338:         );
339: 
340:         // Decoding and encoding for charsets (without UTF-8)
341:         if ($cfg['php_settings']['default_charset'] != 'UTF-8') {
342:             $subject = utf8_encode(conHtmlEntityDecode(stripslashes(i18n('Your new password for CONTENIDO Backend')), '', $cfg['php_settings']['default_charset']));
343:             $body = utf8_encode(conHtmlEntityDecode($mailBody, '', $cfg['php_settings']['default_charset']));
344:         } else {
345:             $subject = conHtmlEntityDecode(stripslashes(i18n('Your new password for CONTENIDO Backend')));
346:             $body = conHtmlEntityDecode($mailBody);
347:         }
348: 
349:         $mailer->sendMail($from, $this->_email, $subject, $body);
350:     }
351: 
352:     /**
353:      * Function generates new password
354:      *
355:      * @return string The new password
356:      */
357:     protected function _generatePassword() {
358:         // possible chars which were used in password
359:         $chars = "ABCDEFGHJKLMNOPQRSTUVWXYZabcdefghjkmnopqrstuvwxyz123456789";
360: 
361:         $password = "";
362: 
363:         // for each character of password choose one from $sChars randomly
364:         for ($i = 0; $i < $this->_passLength; $i++) {
365:             $password .= $chars[rand(0, strlen($chars))];
366:         }
367: 
368:         return $password;
369:     }
370: }
371: