<?php

/*

Plugin Name: Special user/login-related pages

Plugin URI: http://enanocms.org/

Description: Provides the pages Special:Login, Special:Logout, Special:Register, and Special:Preferences.

Author: Dan Fuhry

Version: 1.0.1

Author URI: http://enanocms.org/

*/

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Version 1.0 release candidate 2

 * Copyright (C) 2006-2007 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

global $db, $session, $paths, $template, $plugins; // Common objects

$plugins->attachHook('base_classes_initted', '

  global $paths;

    $paths->add_page(Array(

      \'name\'=>\'Log in\',

      \'urlname\'=>\'Login\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Log out\',

      \'urlname\'=>\'Logout\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Register\',

      \'urlname\'=>\'Register\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Edit Profile\',

      \'urlname\'=>\'Preferences\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Contributions\',

      \'urlname\'=>\'Contributions\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Change style\',

      \'urlname\'=>\'ChangeStyle\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Activate user account\',

      \'urlname\'=>\'ActivateAccount\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Captcha\',

      \'urlname\'=>\'Captcha\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Forgot password\',

      \'urlname\'=>\'PasswordReset\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Member list\',

      \'urlname\'=>\'Memberlist\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>1,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    ');

// function names are IMPORTANT!!! The name pattern is: page_<namespace ID>_<page URLname, without namespace>

$__login_status = '';

function page_Special_Login()

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  global $__login_status;

  $pubkey = $session->rijndael_genkey();

  $challenge = $session->dss_rand();

  $locked_out = false;

  // are we locked out?

  $threshold = ( $_ = getConfig('lockout_threshold') ) ? intval($_) : 5;

  $duration  = ( $_ = getConfig('lockout_duration') ) ? intval($_) : 15;

  // convert to minutes

  $duration  = $duration * 60;

  $policy = ( $x = getConfig('lockout_policy') && in_array(getConfig('lockout_policy'), array('lockout', 'disable', 'captcha')) ) ? getConfig('lockout_policy') : 'lockout';

  if ( $policy != 'disable' )

  {

    $ipaddr = $db->escape($_SERVER['REMOTE_ADDR']);

    $timestamp_cutoff = time() - $duration;

    $q = $session->sql('SELECT timestamp FROM '.table_prefix.'lockout WHERE timestamp > ' . $timestamp_cutoff . ' AND ipaddr = \'' . $ipaddr . '\' ORDER BY timestamp DESC;');

    $fails = $db->numrows();

    if ( $fails >= $threshold )

    {

      $row = $db->fetchrow();

      $locked_out = true;

      $lockdata = array(

          'locked_out' => true,

          'lockout_threshold' => $threshold,

          'lockout_duration' => ( $duration / 60 ),

          'lockout_fails' => $fails,

          'lockout_policy' => $policy,

          'lockout_last_time' => $row['timestamp'],

          'time_rem' => ( $duration / 60 ) - round( ( time() - $row['timestamp'] ) / 60 ),

          'captcha' => ''

        );

      if ( $policy == 'captcha' )

      {

        $lockdata['captcha'] = $session->make_captcha();

      }

    }

    $db->free_result();

  }

  if ( isset($_GET['act']) && $_GET['act'] == 'getkey' )

  {

    $username = ( $session->user_logged_in ) ? $session->username : false;

    $response = Array(

      'username' => $username,

      'key' => $pubkey,

      'challenge' => $challenge,

      'locked_out' => false

      );

    if ( $locked_out )

    {

      foreach ( $lockdata as $x => $y )

      {

        $response[$x] = $y;

      }

      unset($x, $y);

    }

    $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);

    $response = $json->encode($response);

    echo $response;

    return null;

  }

  $level = ( isset($_GET['level']) && in_array($_GET['level'], array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9') ) ) ? intval($_GET['level']) : USER_LEVEL_MEMBER;

  if ( isset($_POST['login']) )

  {

    if ( in_array($_POST['auth_level'], array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9') ) )

    {

      $level = intval($_POST['auth_level']);

    }

  }

  if ( $level > USER_LEVEL_MEMBER && !$session->user_logged_in )

  {

    $level = USER_LEVEL_MEMBER;

  }

  if ( $level <= USER_LEVEL_MEMBER && $session->user_logged_in )

    $paths->main_page();

  $template->header();

  echo '<form action="'.makeUrl($paths->nslist['Special'].'Login').'" method="post" name="loginform" onsubmit="runEncryption();">';

  if ( isset($_POST['login']) )

  {

    $errstring = $__login_status['error'];

    switch($__login_status['error'])

    {

      case 'key_not_found':

        break;

      case 'key_wrong_length':

        break;

      case 'too_big_for_britches':

        break;

      case 'invalid_credentials':

        if ( $__login_status['lockout_policy'] == 'lockout' )

        {

        }

        else if ( $__login_status['lockout_policy'] == 'captcha' )

        {

        }

        break;

      case 'backend_fail':

        break;

      case 'locked_out':

        $attempts = intval($__login_status['lockout_fails']);

        if ( $attempts > $__login_status['lockout_threshold'])

          $attempts = $__login_status['lockout_threshold'];

        $server_time = time();

        break;

    }

    echo '<div class="error-box-mini">'.$errstring.'</div>';

  }

  if ( $p = $paths->getAllParams() )

  {

    echo '<input type="hidden" name="return_to" value="'.$p.'" />';

  }

  else if ( isset($_POST['login']) && isset($_POST['return_to']) )

  {

    echo '<input type="hidden" name="return_to" value="'.htmlspecialchars($_POST['return_to']).'" />';

  }

  ?>

    <div class="tblholder">

      <table border="0" style="width: 100%;" cellspacing="1" cellpadding="4">

        <tr>

          <th colspan="3"><?php echo $header; ?></th>

        </tr>

        <tr>

          <td colspan="3" class="row1">

            <?php

            if ( $level <= USER_LEVEL_MEMBER )

            {

            }

            else

            {

            }

            ?>

          </td>

        </tr>

        <tr>

          <td class="row2">

          </td>

          <td class="row1">

            <input name="username" size="25" type="text" <?php

              if ( $level <= USER_LEVEL_MEMBER )

              {

                echo 'tabindex="1" ';

              }

              else

              {

                echo 'tabindex="3" ';

              }

              if ( $session->user_logged_in )

              {

                echo 'value="' . $session->username . '"';

              }

              ?> />

          </td>

          <?php if ( $level <= USER_LEVEL_MEMBER ) { ?>

          <td rowspan="<?php echo ( ( $locked_out && $lockdata['lockout_policy'] == 'captcha' ) ) ? '4' : '2'; ?>" class="row3">

          </td>

          <?php } ?>

        </tr>

        <tr>

         </tr>

         <?php

         if ( $locked_out && $lockdata['lockout_policy'] == 'captcha' )

         {

           ?>

           <tr>

           </tr>

           <tr>

             <td class="row3">

               <img src="<?php echo makeUrlNS('Special', 'Captcha/' . $lockdata['captcha']) ?>" onclick="this.src=this.src+'/a';" style="cursor: pointer;" />

             </td>

           </tr>

           <?php

         }

         ?>

         <?php if ( $level <= USER_LEVEL_MEMBER ) { ?>

         <tr>

           <td class="row3" colspan="3">

           </td>

         </tr>

         <?php } ?>

         <tr>

           <th colspan="3" style="text-align: center" class="subhead"><input type="submit" name="login" value="Log in" tabindex="<?php echo ( $level <= USER_LEVEL_MEMBER ) ? '3' : '2'; ?>" /></th>

         </tr>

      </table>

    </div>

      <input type="hidden" name="challenge_data" value="<?php echo $challenge; ?>" />

      <input type="hidden" name="use_crypt" value="no" />

      <input type="hidden" name="crypt_key" value="<?php echo $pubkey; ?>" />

      <input type="hidden" name="crypt_data" value="" />

      <input type="hidden" name="auth_level" value="<?php echo (string)$level; ?>" />

      <?php if ( $level <= USER_LEVEL_MEMBER ): ?>

      <script type="text/javascript">

        document.forms.loginform.username.focus();

      </script>

      <?php else: ?>

      <script type="text/javascript">

        document.forms.loginform.pass.focus();

      </script>

      <?php endif; ?>

    </form>

    <?php

      echo $session->aes_javascript('loginform', 'pass', 'use_crypt', 'crypt_key', 'crypt_data', 'challenge_data');

    ?>

  <?php

  $template->footer();

}

function page_Special_Login_preloader() // adding _preloader to the end of the function name calls the function before $session and $paths setup routines are called

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  global $__login_status;

  if ( isset($_GET['act']) && $_GET['act'] == 'ajaxlogin' )

  {

    $plugins->attachHook('login_password_reset', 'SpecialLogin_SendResponse_PasswordReset($row[\'user_id\'], $row[\'temp_password\']);');

    $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);

    $data = $json->decode($_POST['params']);

    $captcha_hash = ( isset($data['captcha_hash']) ) ? $data['captcha_hash'] : false;

    $captcha_code = ( isset($data['captcha_code']) ) ? $data['captcha_code'] : false;

    $level = ( isset($data['level']) ) ? intval($data['level']) : USER_LEVEL_MEMBER;

    $result = $session->login_with_crypto($data['username'], $data['crypt_data'], $data['crypt_key'], $data['challenge'], $level, $captcha_hash, $captcha_code);

    $session->start();

    if ( $result['success'] )

    {

      $response = Array(

          'result' => 'success',

          'key' => $session->sid_super // ( ( $session->sid_super ) ? $session->sid_super : $session->sid )

        );

    }

    else

    {

      $captcha = '';

      if ( $result['error'] == 'locked_out' && $result['lockout_policy'] == 'captcha' )

      {

        $session->kill_captcha();

        $captcha = $session->make_captcha();

      }

      $response = Array(

          'result' => 'error',

          'data' => $result,

          'captcha' => $captcha

        );

    }

    $response = $json->encode($response);

    echo $response;

    $db->close();

    exit;

  }

  if(isset($_POST['login'])) {

    $captcha_hash = ( isset($_POST['captcha_hash']) ) ? $_POST['captcha_hash'] : false;

    $captcha_code = ( isset($_POST['captcha_code']) ) ? $_POST['captcha_code'] : false;

    if($_POST['use_crypt'] == 'yes')

    {

      $result = $session->login_with_crypto($_POST['username'], $_POST['crypt_data'], $_POST['crypt_key'], $_POST['challenge_data'], intval($_POST['auth_level']), $captcha_hash, $captcha_code);

    }

    else

    {

      $result = $session->login_without_crypto($_POST['username'], $_POST['pass'], false, intval($_POST['auth_level']), $captcha_hash, $captcha_code);

    }

    $session->start();

    $paths->init();

    if($result['success'])

    {

      $template->load_theme($session->theme, $session->style);

      if(isset($_POST['return_to']))

      {

        $name = ( isset($paths->pages[$_POST['return_to']]['name']) ) ? $paths->pages[$_POST['return_to']]['name'] : $_POST['return_to'];

        redirect( makeUrl($_POST['return_to'], false, true), 'Login successful', 'You have successfully logged into the '.getConfig('site_name').' site as "'.$session->username.'". Redirecting to ' . $name . '...' );

      }

      else

      {

        redirect( makeUrl(getConfig('main_page'), false, true), 'Login successful', 'You have successfully logged into the '.getConfig('site_name').' site as "'.$session->username.'". Redirecting to the main page...' );

      }

    }

    else

    {

      $GLOBALS['__login_status'] = $result;

    }

  }

}

function SpecialLogin_SendResponse_PasswordReset($user_id, $passkey)

{

  $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE);

  $response = Array(

      'result' => 'success_reset',

      'user_id' => $user_id,

      'temppass' => $passkey

    );

  $response = $json->encode($response);

  echo $response;

  $db->close();

  exit;

}

function page_Special_Logout() {

  global $db, $session, $paths, $template, $plugins; // Common objects

  if ( !$session->user_logged_in )

    $paths->main_page();

  $l = $session->logout();

  if ( $l == 'success' )

  {

    redirect(makeUrl(getConfig('main_page'), false, true), 'Logged out', 'You have been successfully logged out, and all cookies have been cleared. You will now be transferred to the main page.', 4);

  }

  $template->header();

  echo '<h3>An error occurred during the logout process.</h3><p>'.$l.'</p>';

  $template->footer();

}

function page_Special_Register()

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  // form field trackers

  $username = '';

  $email = '';

  $realname = '';

  if(getConfig('account_activation') == 'disable' && ( ( $session->user_level >= USER_LEVEL_ADMIN && !isset($_GET['IWannaPlayToo']) ) || $session->user_level < USER_LEVEL_ADMIN || !$session->user_logged_in ))

  {

    $s = ($session->user_level >= USER_LEVEL_ADMIN) ? '<p>Oops...it seems that you <em>are</em> the administrator...hehe...you can also <a href="'.makeUrl($paths->page, 'IWannaPlayToo', true).'">force account registration to work</a>.</p>' : '';

    die_friendly('Registration disabled', '<p>The administrator has disabled new user registration on this site.</p>' . $s);

  }

  if ( $session->user_level < USER_LEVEL_ADMIN && $session->user_logged_in )

  {

    $paths->main_page();

  }

  if(isset($_POST['submit'])) 

  {

    $_GET['coppa'] = ( isset($_POST['coppa']) ) ? $_POST['coppa'] : 'x';

    $captcharesult = $session->get_captcha($_POST['captchahash']);

    if($captcharesult != $_POST['captchacode'])

    {

      $s = 'The confirmation code you entered was incorrect.';

    }

    else

    {

      if ( getConfig('enable_coppa') == '1' && ( !isset($_POST['coppa']) || ( isset($_POST['coppa']) && !in_array($_POST['coppa'], array('yes', 'no')) ) ) )

      {

        $s = 'Invalid COPPA input';

      }

      else

      {

        $coppa = ( isset($_POST['coppa']) && $_POST['coppa'] == 'yes' );

        $s = false;

        // decrypt password

        // as with the change pass form, we aren't going to bother checking the confirmation code because if the passwords didn't match

        // and yet the password got encrypted, that means the user screwed with the code, and if the user screwed with the code and thus

        // forgot his password, that's his problem.

        if ( $_POST['use_crypt'] == 'yes' )

        {

          $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);

          $crypt_key = $session->fetch_public_key($_POST['crypt_key']);

          if ( !$crypt_key )

          {

            $s = 'Couldn\'t look up public encryption key';

          }

          else

          {

            $data = $_POST['crypt_data'];