<?php

/**!info**

{

	"Plugin Name"  : "plugin_specialuserfuncs_title",

	"Plugin URI"   : "http://enanocms.org/",

	"Description"  : "plugin_specialuserfuncs_desc",

	"Author"       : "Dan Fuhry",

	"Version"      : "1.1.6",

	"Author URI"   : "http://enanocms.org/"

}

**!*/

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Copyright (C) 2006-2009 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

global $db, $session, $paths, $template, $plugins; // Common objects

// $plugins->attachHook('session_started', 'SpecialUserFuncs_paths_init();');

function SpecialUserFuncs_paths_init()

{

	register_special_page('Login', 'specialpage_log_in');

	register_special_page('Logout', 'specialpage_log_out');

	register_special_page('Register', 'specialpage_register');

	register_special_page('Preferences', 'specialpage_preferences');

	register_special_page('Contributions', 'specialpage_contributions');

	register_special_page('ChangeStyle', 'specialpage_change_theme');

	register_special_page('ActivateAccount', 'specialpage_activate_account');

	register_special_page('Captcha', 'specialpage_captcha');

	register_special_page('PasswordReset', 'specialpage_password_reset');

	register_special_page('Memberlist', 'specialpage_member_list');

	register_special_page('LangExportJSON', 'specialpage_language_export', false);

	register_special_page('Avatar', 'specialpage_avatar', false);

}

// function names are IMPORTANT!!! The name pattern is: page_<namespace ID>_<page URLname, without namespace>

$__login_status = '';

function page_Special_Login()

{

	global $db, $session, $paths, $template, $plugins; // Common objects

	global $login_result;

	global $lang, $output;

	// Determine which level we're going up to

	$level = ( isset($_GET['level']) && in_array($_GET['level'], array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9') ) ) ? intval($_GET['level']) : USER_LEVEL_MEMBER;

	if ( isset($_POST['login']) )

	{

		if ( in_array($_POST['level'], array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9') ) )

		{

			$level = intval($_POST['level']);

		}

	}

	// Don't allow going from guest straight to elevated

	// FIXME do we want to allow this with a CSRF check?

	if ( $level > USER_LEVEL_MEMBER && !$session->user_logged_in )

	{

		$level = USER_LEVEL_MEMBER;

	}

	// If we're already at or above this level, redirect to the target page or, if no target

	// specified, back to the main page.

	if ( $level <= USER_LEVEL_MEMBER && $session->user_logged_in )

	{

		if ( $target = $paths->getAllParams() )

		{

			redirect(makeUrl($target), '', '', 0);

		}

		$paths->main_page();

	}

	// Lockout aliasing

	$lockout =& $login_result['lockout'];

	$output->header();

	echo '<form action="' . makeUrl($paths->nslist['Special'].'Login') . '" method="post" name="loginform" onsubmit="try { return runEncryption(); } catch(e) { console.error(e); };">';

	if ( $p = $paths->getAllParams() )

	{

		echo '<input type="hidden" name="return_to" value="' . htmlspecialchars($p) . '" />';

	}

	else if ( isset($_POST['login']) && isset($_POST['return_to']) )

	{

		echo '<input type="hidden" name="return_to" value="' . htmlspecialchars($_POST['return_to']) . '" />';

	}

	// determine what the "remember me" checkbox should say

	$session_time = intval(getConfig('session_remember_time', '30'));

	if ( $session_time === 0 )

	{

		// sessions are infinite

		$text_remember = $lang->get('user_login_check_remember_infinite');

	}

	else

	{

		// is the number of days evenly divisible by 7? if so, use weeks

		if ( $session_time % 7 == 0 )

		{

			$session_time = $session_time / 7;

			$unit = 'week';

		}

		else

		{

			$unit = 'day';

		}

		// if it's not equal to 1, pluralize it

		if ( $session_time != 1 )

		{

			$unit .= $lang->get('meta_plural');

		}

		$text_remember = $lang->get('user_login_check_remember', array(

				'session_length' => $session_time,

				'length_units' => $lang->get("etc_unit_$unit")

			));

	}

	if ( $error_text = login_get_error($login_result) )

	{

		echo '<div class="error-box-mini">' . htmlspecialchars($error_text) . '</div>';

	}

	//

	// START FORM

	//

	?>

		<div class="tblholder">

			<table border="0" style="width: 100%;" cellspacing="1" cellpadding="4">

				<tr>

					<th colspan="3">

						<!-- Table header: "Please enter..." -->

						<?php echo ( $level > USER_LEVEL_MEMBER ) ? $lang->get('user_login_message_short_elev') : $lang->get('user_login_message_short'); ?>

					</th>

				</tr>

				<tr>

					<td colspan="3" class="row1">

						<!-- Introduction text -->

						<?php

						if ( $level <= USER_LEVEL_MEMBER )

							echo '<p>' . $lang->get('user_login_body', array('reg_link' => makeUrlNS('Special', 'Register'))) . '</p>';

						else

							echo '<p>' . $lang->get('user_login_body_elev') . '</p>';

						?>

					</td>

				</tr>

				<tr>

					<!-- Username field -->

					<td class="row2">

						<?php echo $lang->get('user_login_field_username'); ?>:

					</td>

					<td class="row1">

						<input name="username" size="25" type="text" value="<?php echo $session->user_logged_in ? htmlspecialchars($session->username) : ''; ?>" />

					</td>

					<?php if ( $level <= USER_LEVEL_MEMBER ): ?>

					<!-- Forgot password / create account links -->

					<td rowspan="<?php echo ( ( $lockout['active'] && $lockout['policy'] == 'captcha' ) ) ? '4' : '2'; ?>" class="row3">

						<small><?php echo $lang->get('user_login_forgotpass_blurb', array('forgotpass_link' => makeUrlNS('Special', 'PasswordReset'))); ?><br />

						<?php echo $lang->get('user_login_createaccount_blurb', array('reg_link' => makeUrlNS('Special', 'Register'))); ?></small>

					</td>

					<?php endif; ?>

				</tr>

				<tr>

					<!-- Password field -->

					<td class="row2">

						<?php echo $lang->get('user_login_field_password'); ?>:

					</td><td class="row1"><input name="password" size="25" type="password" /></td>

 				</tr>

 				<?php

 				// CAPTCHA?

 				if ( $lockout['active'] && $lockout['policy'] == 'captcha' )

 				{

 					?>

 					<!-- CAPTCHA -->

 					<tr>

 						<td class="row2" rowspan="2">

 							<?php echo $lang->get('user_login_field_captcha'); ?>:

 							<br />

 						</td>

 						<td class="row1">

 							<input type="hidden" name="captcha_hash" value="<?php echo $lockout['captcha']; ?>" />

 							<input name="captcha_code" size="25" type="text" tabindex="<?php echo ( $level <= USER_LEVEL_MEMBER ) ? '3' : '4'; ?>" />

 						</td>

 					</tr>

 					<tr>

 						<td class="row3">

 							<img src="<?php echo makeUrlNS('Special', 'Captcha/' . $lockout['captcha']) ?>" onclick="this.src=this.src+'/a';" style="cursor: pointer;" />

 						</td>

 					</tr>

 					<?php

 				}

 				// Run hooks

 				$code = $plugins->setHook('login_form_html');

 				foreach ( $code as $cmd )

 				{

 					eval($cmd);

 				}

 				// level-2 only: "Remember me" switch

 				if ( $level <= USER_LEVEL_MEMBER )

 				{

 					?>

 					<tr>

 						<td class="row2">

 							<?php echo $lang->get('user_login_field_remember'); ?>

 						</td>

 						<td class="row1" colspan="2">

 							<label>

 								<input type="checkbox" name="remember" tabindex="3" />

 								<?php echo $text_remember; ?>

 							</label>

 						</td>

 					</tr>

 				<!-- Crypto notice -->

 					<?php

 				}

 				// lol DeMorgan'd

 				$crypto_disable = ( isset($_GET['use_crypt']) && $_GET['use_crypt'] == '0' );

 				// Crypto disable: crypto on, normal login

 				if ( $level <= USER_LEVEL_MEMBER && !$crypto_disable )

 				{

 					echo '<tr>

 						<td class="row3" colspan="3">';

 					$returnpage_link = ( $return = $paths->getAllParams() ) ? '/' . $return : '';

 					$nocrypt_link = makeUrlNS('Special', "Login$returnpage_link", "level=$level&use_crypt=0", true);

 					echo '<p><b>' . $lang->get('user_login_nocrypt_title') . '</b> ' . $lang->get('user_login_nocrypt_body', array('nocrypt_link' => $nocrypt_link)) . '</p>';

 					echo '<p>' . $lang->get('user_login_nocrypt_countrylist') . '</p>';

 					echo '  </td>

 					</tr>';

 				}

 				// Crypto disable: crypto OFF, normal login

 				else if ( $level <= USER_LEVEL_MEMBER && $crypto_disable )

 				{

 					echo '<tr>

 						<td class="row3" colspan="3">';

 					$returnpage_link = ( $return = $paths->getAllParams() ) ? '/' . $return : '';

 					$usecrypt_link = makeUrlNS('Special', "Login$returnpage_link", "level=$level&use_crypt=1", true);

 					echo '<p><b>' . $lang->get('user_login_usecrypt_title') . '</b> ' . $lang->get('user_login_usecrypt_body', array('usecrypt_link' => $usecrypt_link)) . '</p>';

 					echo '<p>' . $lang->get('user_login_usecrypt_countrylist') . '</p>';

 					echo '  </td>

 					</tr>';

 				}

 				// Crypto disable: crypto on, ELEV login

 				else if ( $level > USER_LEVEL_MEMBER && $GLOBALS['dh_supported'] )

 				{

 					echo '<tr>';

 					echo '<td class="row3" colspan="3">';

 					echo '<p>' . $lang->get('user_login_dh_notice') . '</p>';

 					echo '</td>';

 					echo '</tr>';

 				}

 				?>

 				<!-- Submit button -->

 				<tr>

 					<th colspan="3" style="text-align: center" class="subhead">

 						<input type="hidden" name="login" value="true" />

 						<input type="submit" value="<?php echo $lang->get('user_login_btn_log_in'); ?>" />

 					</th>

 				</tr>

			</table>

		</div>

			<input type="hidden" name="level" value="<?php echo (string)$level; ?>" />

			<?php if ( $level <= USER_LEVEL_MEMBER ): ?>

			<script type="text/javascript">

				document.forms.loginform.username.focus();

			</script>

			<?php else: ?>

			<script type="text/javascript">

				document.forms.loginform.pass.focus();

			</script>

			<?php endif; ?>

			<?php

			echo $session->generate_aes_form();

			// Any additional parameters that need to be passed back?

			if ( $p = $paths->getAllParams() )

			{

				// ... only if we have a return_to destination.

				$get_fwd = $_GET;

				unset($get_fwd['do']);

				if ( isset($get_fwd['target_do']) )

				{

					$get_fwd['do'] = $get_fwd['target_do'];

					unset($get_fwd['target_do']);

				}

				if ( isset($get_fwd['level']) )

					unset($get_fwd['level']);

				if ( isset($get_fwd['title']) )

					unset($get_fwd['title']);

				if ( !empty($get_fwd) )

				{

					$get_string = htmlspecialchars(enano_json_encode($get_fwd));

					echo '<input type="hidden" name="get_fwd" value="' . $get_string . '" />';

				}

			}

			else if ( isset($_POST['get_fwd']) )

			{

				echo '<input type="hidden" name="get_fwd" value="' . htmlspecialchars($_POST['get_fwd']) . '" />';

			}

			?>

		</form>

		<?php

			if ( !$crypto_disable )

				echo $session->aes_javascript('loginform', 'password');

		?>

	<?php

	$output->footer();

}

function page_Special_Login_preloader() // adding _preloader to the end of the function name calls the function before $session and $paths setup routines are called

{

	global $db, $session, $paths, $template, $plugins; // Common objects

	global $login_result;

	global $lang;

	// Are we calling the JSON interface?

	$paths->fullpage = $GLOBALS['urlname'];

	if ( $paths->getParam(0) === 'action.json' )

	{

		if ( !isset($_POST['r']) )

			die('No request.');

		$request = $_POST['r'];

		try

		{

			$request = enano_json_decode($request);

		}

		catch ( Exception $e )

		{

			die(enano_json_encode(array(

					'mode' => 'error',

					'error' => 'ERR_JSON_PARSE_FAILED'

				)));

		}

		echo enano_json_encode($session->process_login_request($request));

		$db->close();

		exit;

	}

	// No. Process incoming results from the HTML version.

	if ( isset($_POST['login']) )

	{

		$_POST['password'] = $session->get_aes_post();

		$result = $session->process_login_request(array(

				'mode' => 'login_pt',

				'userinfo' => $_POST,

				'level' => $_POST['level'],

				'captcha_hash' => isset($_POST['captcha_hash']) ? $_POST['captcha_hash'] : false,

				'captcha_code' => isset($_POST['captcha_code']) ? $_POST['captcha_code'] : false

			));

		if ( $result['mode'] === 'login_success' )

		{

			//

			// LOGIN SUCCESS.

			// Redirect as necessary.

			//

			// Load our preferences

			$session->start();

			// Decode get_add

			$get_add = false;

			if ( isset($_POST['get_fwd']) )

			{

				try

				{

					$get_fwd = enano_json_decode($_POST['get_fwd']);

					$get_add = '';

					foreach ( $get_fwd as $key => $value )

					{

						$get_add .= "&{$key}=" . urlencode($value);

					}

					$get_add = ltrim($get_add, '&');

				}

				catch ( Exception $e )

				{

				}

			}

			// Going to a user-specified page?

			if ( isset($_POST['return_to']) )

			{

				// yea

				$name = get_page_title($_POST['return_to']);

				$subst = array(

						'username' => $session->username,

						'redir_target' => $name

					);

				redirect( makeUrl($_POST['return_to'], $get_add), $lang->get('user_login_success_title'), $lang->get('user_login_success_body', $subst) );

			}

			else

			{

				// No, redirect them to the main page

				$subst = array(

						'username' => $session->username,

						'redir_target' => $lang->get('user_login_success_body_mainpage')

					);

				redirect( makeUrl(get_main_page(), $get_add), $lang->get('user_login_success_title'), $lang->get('user_login_success_body', $subst) );

			}

		}

		else if ( $result['mode'] === 'login_success_reset' )

		{

			// They logged in with a temporary password; send them to the reset form

			redirect($result['redirect_url'], '', '', 0);

		}

		// Otherwise, the result is likely an error.

		$login_result = $result;

	}

	else

	{

		$login_result = $session->process_login_request(array(

				'mode' => 'getkey'

			));

	}

	// This is a bit of a hack. The login form generates AES and DiffieHellman keys on its

	// own, so we need to clean up the ones from the login request API.

	if ( !empty($login_result['crypto']) )

	{

		$session->process_login_request(array(

				'mode' => 'clean_key',

				'key_aes' => $login_result['crypto']['aes_key'],

				'key_dh' => $login_result['crypto']['dh_public_key'],

			));

	}

}

/**

 * Given a Login API response, find the appropriate error text, if any.

 * @param array LoginAPI response

 * @return mixed Error string, or bool(false) if no error.

 */

function login_get_error($response)

{

	global $lang;

	if ( !empty($response['lockout']) )

	{

		// set this pluralality thing

		$response['lockout']['plural'] = $response['lockout']['time_rem'] == 1 ? '' : $lang->get('meta_plural');

	}

	if ( $response['mode'] == 'initial' )

	{

		// Just showing the box for the first time. If there's an error now, it's based on a preexisting lockout.

		if ( $response['lockout']['active'] )

		{

			return $lang->get('user_err_locked_out_initial_' . $response['lockout']['policy'], $response['lockout']);

		}

		return false;

	}

	else

	{

		// An attempt was made.

		switch($response['mode'])

		{

			case 'login_failure':

				// Generic login user error.

				$error = '';

				if ( ($x = $lang->get($response['error'])) != $response['error'] )

					$error = $x;

				else

					$error = $lang->get('user_err_' . $response['error']);

				if ( $response['lockout']['active'] && $response['lockout']['policy'] == 'lockout' )

				{

					// Lockout enforcement was just activated.

					return $lang->get('user_err_locked_out_initial_' . $response['lockout']['policy'], $response['lockout']);

				}

				else if ( $response['lockout']['policy'] != 'disable' && !$response['lockout']['active'] && $response['lockout']['fails'] > 0 )

				{

					// Lockout is in a warning state.

					$error .= ' ' . $lang->get('user_err_invalid_credentials_' . $response['lockout']['policy'], $response['lockout']);