nextcloud/core/lostpassword/controller/lostcontroller.php

223 lines
5.1 KiB
PHP
Raw Normal View History

2014-05-28 01:09:08 +04:00
<?php
/**
* Copyright (c) 2012 Bart Visscher <bartv@thisnet.nl>
* This file is licensed under the Affero General Public License version 3 or
* later.
* See the COPYING-README file.
*/
2014-05-28 21:13:07 +04:00
2014-05-28 01:09:08 +04:00
namespace OC\Core\LostPassword\Controller;
use \OCP\AppFramework\Controller;
2014-05-28 21:13:07 +04:00
use \OCP\AppFramework\Http\JSONResponse;
2014-05-28 01:09:08 +04:00
use \OCP\AppFramework\Http\TemplateResponse;
2014-06-06 18:36:10 +04:00
use \OCP\IURLGenerator;
use \OCP\IRequest;
use \OCP\IL10N;
use \OCP\IConfig;
use \OCP\IUserSession;
2014-06-05 18:48:14 +04:00
use \OC\Core\LostPassword\EncryptedDataException;
2014-05-28 01:09:08 +04:00
class LostController extends Controller {
2014-06-06 18:36:10 +04:00
/**
* @var \OCP\IURLGenerator
*/
2014-05-28 01:09:08 +04:00
protected $urlGenerator;
/**
* @var \OCP\IUserManager
*/
2014-06-06 18:36:10 +04:00
protected $userManager;
/**
* @var \OC_Defaults
*/
2014-05-28 21:13:07 +04:00
protected $defaults;
/**
* @var IL10N
*/
2014-05-28 21:13:07 +04:00
protected $l10n;
protected $from;
protected $isDataEncrypted;
/**
* @var IConfig
*/
2014-06-06 18:36:10 +04:00
protected $config;
/**
* @var IUserSession
*/
2014-06-06 18:36:10 +04:00
protected $userSession;
public function __construct($appName,
IRequest $request,
IURLGenerator $urlGenerator,
$userManager,
$defaults,
IL10N $l10n,
IConfig $config,
IUserSession $userSession,
$from,
$isDataEncrypted) {
2014-05-28 01:09:08 +04:00
parent::__construct($appName, $request);
$this->urlGenerator = $urlGenerator;
2014-06-06 18:36:10 +04:00
$this->userManager = $userManager;
2014-05-28 21:13:07 +04:00
$this->defaults = $defaults;
$this->l10n = $l10n;
$this->from = $from;
$this->isDataEncrypted = $isDataEncrypted;
2014-06-06 18:36:10 +04:00
$this->config = $config;
$this->userSession = $userSession;
2014-05-28 01:09:08 +04:00
}
/**
2014-06-06 18:36:10 +04:00
* Someone wants to reset their password:
*
2014-05-28 01:09:08 +04:00
* @PublicPage
* @NoCSRFRequired
2014-06-06 18:36:10 +04:00
*
2014-05-28 21:13:07 +04:00
* @param string $token
2014-06-13 18:18:21 +04:00
* @param string $userId
2014-05-28 01:09:08 +04:00
*/
2014-06-13 18:18:21 +04:00
public function resetform($token, $userId) {
2014-06-06 18:36:10 +04:00
return new TemplateResponse(
'core/lostpassword',
'resetpassword',
array(
'isEncrypted' => $this->isDataEncrypted,
2014-06-13 18:18:21 +04:00
'link' => $this->getLink('core.lost.setPassword', $userId, $token),
2014-06-06 18:36:10 +04:00
),
'guest'
);
2014-05-28 01:09:08 +04:00
}
2014-06-06 18:36:10 +04:00
2014-06-06 18:51:58 +04:00
private function error($message, array $additional=array()) {
return array_merge(array('status' => 'error', 'msg' => $message), $additional);
2014-06-06 18:51:58 +04:00
}
private function success() {
return array('status'=>'success');
}
2014-05-28 21:13:07 +04:00
/**
* @PublicPage
2014-06-06 18:36:10 +04:00
*
* @param string $user
2014-05-28 21:13:07 +04:00
* @param bool $proceed
*/
2014-06-03 02:24:27 +04:00
public function email($user, $proceed){
2014-06-06 18:36:10 +04:00
// FIXME: use HTTP error codes
2014-05-28 21:13:07 +04:00
try {
$this->sendEmail($user, $proceed);
} catch (EncryptedDataException $e){
2014-06-06 18:51:58 +04:00
return $this->error('', array('encryption' => '1'));
2014-05-28 21:13:07 +04:00
} catch (\Exception $e){
2014-06-06 18:51:58 +04:00
return $this->error($e->getMessage());
2014-05-28 21:13:07 +04:00
}
2014-06-06 18:36:10 +04:00
2014-06-06 18:51:58 +04:00
return $this->success();
2014-05-28 21:13:07 +04:00
}
2014-06-06 18:36:10 +04:00
2014-05-28 21:13:07 +04:00
/**
* @PublicPage
*/
2014-06-06 18:51:58 +04:00
public function setPassword($token, $userId, $password) {
2014-05-28 21:13:07 +04:00
try {
2014-06-06 18:51:58 +04:00
$user = $this->userManager->get($userId);
2014-06-06 18:36:10 +04:00
if (!$this->checkToken($userId, $token)) {
throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid'));
}
if (!$user->setPassword($password)) {
2014-06-06 18:36:10 +04:00
throw new \Exception();
2014-05-28 21:13:07 +04:00
}
2014-06-06 18:36:10 +04:00
// FIXME: should be added to the all config at some point
2014-06-06 18:51:58 +04:00
\OC_Preferences::deleteKey($userId, 'owncloud', 'lostpassword');
2014-06-06 18:36:10 +04:00
$this->userSession->unsetMagicInCookie();
} catch (\Exception $e){
2014-06-06 18:51:58 +04:00
return $this->error($e->getMessage());
2014-05-28 21:13:07 +04:00
}
2014-06-06 18:36:10 +04:00
2014-06-06 18:51:58 +04:00
return $this->success();
2014-05-28 21:13:07 +04:00
}
2014-06-06 18:36:10 +04:00
2014-05-28 21:13:07 +04:00
protected function sendEmail($user, $proceed) {
2014-06-06 18:36:10 +04:00
if ($this->isDataEncrypted && !$proceed){
2014-05-28 21:13:07 +04:00
throw new EncryptedDataException();
}
2014-06-06 18:36:10 +04:00
if (!$this->userManager->userExists($user)) {
throw new \Exception(
2014-06-13 18:02:41 +04:00
$this->l10n->t('Couldn\'t send reset email. Please make sure '.
2014-06-06 18:36:10 +04:00
'your username is correct.'));
2014-05-28 21:13:07 +04:00
}
2014-06-06 18:36:10 +04:00
2014-05-28 21:13:07 +04:00
$token = hash('sha256', \OC_Util::generateRandomBytes(30));
2014-06-06 18:36:10 +04:00
// Hash the token again to prevent timing attacks
$this->config->setUserValue(
$user, 'owncloud', 'lostpassword', hash('sha256', $token)
);
$email = $this->config->getUserValue($user, 'settings', 'email');
2014-05-28 21:13:07 +04:00
if (empty($email)) {
2014-06-06 18:36:10 +04:00
throw new \Exception(
2014-06-13 18:02:41 +04:00
$this->l10n->t('Couldn\'t send reset email because there is no '.
2014-06-06 18:36:10 +04:00
'email address for this username. Please ' .
'contact your administrator.')
);
2014-05-28 21:13:07 +04:00
}
2014-06-06 18:36:10 +04:00
2014-06-03 02:24:27 +04:00
$link = $this->getLink('core.lost.resetform', $user, $token);
2014-06-06 18:36:10 +04:00
2014-05-28 21:13:07 +04:00
$tmpl = new \OC_Template('core/lostpassword', 'email');
$tmpl->assign('link', $link, false);
$msg = $tmpl->fetchPage();
2014-06-06 18:36:10 +04:00
2014-05-28 21:13:07 +04:00
try {
2014-06-06 18:51:58 +04:00
// FIXME: should be added to the container and injected in here
\OC_Mail::send(
$email,
$user,
$this->l10n->t('%s password reset', array($this->defaults->getName())),
$msg,
$this->from,
$this->defaults->getName()
);
2014-05-28 21:13:07 +04:00
} catch (\Exception $e) {
2014-06-06 18:51:58 +04:00
throw new \Exception($this->l10n->t(
2014-06-13 18:02:41 +04:00
'Couldn\'t send reset email. Please contact your administrator.'
2014-06-06 18:51:58 +04:00
));
2014-05-28 21:13:07 +04:00
}
}
2014-05-28 01:09:08 +04:00
2014-06-06 18:36:10 +04:00
2014-06-03 02:24:27 +04:00
protected function getLink($route, $user, $token){
2014-05-28 01:09:08 +04:00
$parameters = array(
2014-06-06 18:36:10 +04:00
'token' => $token,
2014-06-13 18:18:21 +04:00
'userId' => $user
2014-05-28 01:09:08 +04:00
);
2014-06-03 02:24:27 +04:00
$link = $this->urlGenerator->linkToRoute($route, $parameters);
2014-06-06 18:51:58 +04:00
2014-05-28 01:09:08 +04:00
return $this->urlGenerator->getAbsoluteUrl($link);
}
2014-06-06 18:36:10 +04:00
2014-05-28 21:13:07 +04:00
protected function checkToken($user, $token) {
2014-06-06 18:36:10 +04:00
return $this->config->getUserValue(
$user, 'owncloud', 'lostpassword'
) === hash('sha256', $token);
2014-05-28 01:09:08 +04:00
}
2014-06-06 18:36:10 +04:00
2014-06-06 18:51:58 +04:00
2014-05-28 01:09:08 +04:00
}