diff --git a/core/js/lostpassword.js b/core/js/lostpassword.js index 00dfe71be6..0c50f858ec 100644 --- a/core/js/lostpassword.js +++ b/core/js/lostpassword.js @@ -46,8 +46,6 @@ OC.Lostpassword = { } else { if (result && result.msg){ var sendErrorMsg = result.msg; - } else if (result && result.encryption) { - var sendErrorMsg = OC.Lostpassword.encryptedMsg; } else { var sendErrorMsg = OC.Lostpassword.sendErrorMsg; } @@ -103,6 +101,8 @@ OC.Lostpassword = { } else { if (result && result.msg){ var resetErrorMsg = result.msg; + } else if (result && result.encryption) { + var sendErrorMsg = OC.Lostpassword.encryptedMsg; } else { var resetErrorMsg = OC.Lostpassword.resetErrorMsg; } diff --git a/core/lostpassword/ajaxcontroller.php b/core/lostpassword/ajaxcontroller.php deleted file mode 100644 index 3722681308..0000000000 --- a/core/lostpassword/ajaxcontroller.php +++ /dev/null @@ -1,45 +0,0 @@ - '1') - ); - } catch (\Exception $e){ - \OCP\JSON::error( - array('msg'=> $e->getMessage()) - ); - } - - exit(); - } - - public static function resetPassword($args) { - \OCP\JSON::callCheck(); - try { - Controller::resetPassword($args); - \OCP\JSON::success(); - } catch (Exception $e){ - \OCP\JSON::error( - array('msg'=> $e->getMessage()) - ); - } - exit(); - } -} diff --git a/core/lostpassword/controller.php b/core/lostpassword/controller.php deleted file mode 100644 index 0c6ada4edc..0000000000 --- a/core/lostpassword/controller.php +++ /dev/null @@ -1,101 +0,0 @@ - - * This file is licensed under the Affero General Public License version 3 or - * later. - * See the COPYING-README file. - */ -namespace OC\Core\LostPassword; - -class Controller { - - /** - * @param boolean $error - * @param boolean $requested - */ - protected static function displayLostPasswordPage($error, $requested) { - $isEncrypted = \OC_App::isEnabled('files_encryption'); - \OC_Template::printGuestPage('core/lostpassword', 'lostpassword', - array('error' => $error, - 'requested' => $requested, - 'isEncrypted' => $isEncrypted)); - } - - /** - * @param boolean $success - */ - protected static function displayResetPasswordPage($success, $args) { - $route_args = array(); - $route_args['token'] = $args['token']; - $route_args['user'] = $args['user']; - \OC_Template::printGuestPage('core/lostpassword', 'resetpassword', - array('success' => $success, 'args' => $route_args)); - } - - protected static function checkToken($user, $token) { - return \OC_Preferences::getValue($user, 'owncloud', 'lostpassword') === hash('sha256', $token); - } - - public static function sendEmail($user, $proceed) { - $l = \OC_L10N::get('core'); - $isEncrypted = \OC_App::isEnabled('files_encryption'); - - if ($isEncrypted && $proceed !== 'Yes'){ - throw new EncryptedDataException(); - } - - if (!\OC_User::userExists($user)) { - throw new \Exception($l->t('Couldn’t send reset email. Please make sure your username is correct.')); - } - $token = hash('sha256', \OC_Util::generateRandomBytes(30).\OC_Config::getValue('passwordsalt', '')); - \OC_Preferences::setValue($user, 'owncloud', 'lostpassword', - hash('sha256', $token)); // Hash the token again to prevent timing attacks - $email = \OC_Preferences::getValue($user, 'settings', 'email', ''); - if (empty($email)) { - throw new \Exception($l->t('Couldn’t send reset email because there is no email address for this username. Please contact your administrator.')); - } - $link = \OC_Helper::linkToRoute('core_lostpassword_reset', - array('user' => $user, 'token' => $token)); - $link = \OC_Helper::makeURLAbsolute($link); - - $tmpl = new \OC_Template('core/lostpassword', 'email'); - $tmpl->assign('link', $link, false); - $msg = $tmpl->fetchPage(); - $from = \OCP\Util::getDefaultEmailAddress('lostpassword-noreply'); - try { - $defaults = new \OC_Defaults(); - \OC_Mail::send($email, $user, $l->t('%s password reset', array($defaults->getName())), $msg, $from, $defaults->getName()); - } catch (\Exception $e) { - throw new \Exception( $l->t('Couldn’t send reset email. Please contact your administrator.')); - } - } - - public static function reset($args) { - // Someone wants to reset their password: - if(self::checkToken($args['user'], $args['token'])) { - self::displayResetPasswordPage(false, $args); - } else { - // Someone lost their password - self::displayLostPasswordPage(false, false); - } - } - - public static function resetPassword($args) { - if (self::checkToken($args['user'], $args['token'])) { - if (isset($_POST['password'])) { - if (\OC_User::setPassword($args['user'], $_POST['password'])) { - \OC_Preferences::deleteKey($args['user'], 'owncloud', 'lostpassword'); - \OC_User::unsetMagicInCookie(); - self::displayResetPasswordPage(true, $args); - } else { - self::displayResetPasswordPage(false, $args); - } - } else { - self::reset($args); - } - } else { - // Someone lost their password - self::displayLostPasswordPage(false, false); - } - } -} diff --git a/core/lostpassword/controller/ajaxcontroller.php b/core/lostpassword/controller/ajaxcontroller.php new file mode 100644 index 0000000000..22fa0ce912 --- /dev/null +++ b/core/lostpassword/controller/ajaxcontroller.php @@ -0,0 +1,101 @@ +'success')); + try { + $this->sendEmail($this->params('user', ''), $this->params('proceed', '')); + } catch (EncryptedDataException $e){ + $response->setData(array( + 'status' => 'error', + 'encryption' => '1' + )); + } catch (\Exception $e){ + $response->setData(array( + 'status' => 'error', + 'msg' => $e->getMessage() + )); + } + + return $response; + } + + /** + * @PublicPage + */ + public function resetPassword() { + $response = new JSONResponse(array('status'=>'success')); + try { + $user = $this->params('user'); + $newPassword = $this->params('password'); + if (!$this->checkToken()) { + throw new \RuntimeException(''); + } + if (!\OC_User::setPassword($user, $newPassword)) { + throw new \RuntimeException(''); + } + \OC_Preferences::deleteKey($user, 'owncloud', 'lostpassword'); + \OC_User::unsetMagicInCookie(); + } catch (Exception $e){ + $response->setData(array( + 'status' => 'error', + 'msg' => $e->getMessage() + )); + } + return $response; + } + + protected function sendEmail($user, $proceed) { + $l = \OC_L10N::get('core'); + $isEncrypted = \OC_App::isEnabled('files_encryption'); + + if ($isEncrypted && $proceed !== 'Yes'){ + throw new EncryptedDataException(); + } + + if (!\OC_User::userExists($user)) { + throw new \Exception($l->t('Couldn’t send reset email. Please make sure your username is correct.')); + } + $token = hash('sha256', \OC_Util::generateRandomBytes(30).\OC_Config::getValue('passwordsalt', '')); + \OC_Preferences::setValue($user, 'owncloud', 'lostpassword', + hash('sha256', $token)); // Hash the token again to prevent timing attacks + $email = \OC_Preferences::getValue($user, 'settings', 'email', ''); + if (empty($email)) { + throw new \Exception($l->t('Couldn’t send reset email because there is no email address for this username. Please contact your administrator.')); + } + + $parameters = array('token' => $token, 'user' => $user); + $link = $this->urlGenerator->linkToRoute('core.lost.reset', $parameters); + $link = $this->urlGenerator->getAbsoluteUrl($link); + + $tmpl = new \OC_Template('core/lostpassword', 'email'); + $tmpl->assign('link', $link, false); + $msg = $tmpl->fetchPage(); + echo $link; + $from = \OCP\Util::getDefaultEmailAddress('lostpassword-noreply'); + try { + $defaults = new \OC_Defaults(); + \OC_Mail::send($email, $user, $l->t('%s password reset', array($defaults->getName())), $msg, $from, $defaults->getName()); + } catch (\Exception $e) { + throw new \Exception( $l->t('Couldn’t send reset email. Please contact your administrator.')); + } + } + +} diff --git a/core/lostpassword/controller/lostcontroller.php b/core/lostpassword/controller/lostcontroller.php new file mode 100644 index 0000000000..0a28779259 --- /dev/null +++ b/core/lostpassword/controller/lostcontroller.php @@ -0,0 +1,66 @@ + + * This file is licensed under the Affero General Public License version 3 or + * later. + * See the COPYING-README file. + */ +namespace OC\Core\LostPassword\Controller; + +use \OCP\AppFramework\Controller; +use \OCP\AppFramework\Http\TemplateResponse; + +class LostController extends Controller { + + protected $urlGenerator; + + public function __construct($appName, IRequest $request, IURLGenerator $urlGenerator) { + parent::__construct($appName, $request); + $this->urlGenerator = $urlGenerator; + } + + /** + * @PublicPage + * @NoCSRFRequired + */ + public function reset() { + // Someone wants to reset their password: + if($this->checkToken()) { + return new TemplateResponse( + 'core/lostpassword', + 'resetpassword', + array( + 'link' => $link + ), + 'guest' + ); + } else { + // Someone lost their password + $isEncrypted = \OC_App::isEnabled('files_encryption'); + return new TemplateResponse( + 'core/lostpassword', + 'lostpassword', + array( + 'isEncrypted' => $isEncrypted, + 'link' => $this->getResetPasswordLink() + ), + 'guest' + ); + } + } + + protected function getResetPasswordLink(){ + $parameters = array( + 'token' => $this->params('token'), + 'user' => $this->params('user') + ); + $link = $this->urlGenerator->linkToRoute('core.ajax.reset', $parameters); + return $this->urlGenerator->getAbsoluteUrl($link); + } + + protected function checkToken() { + $user = $this->params('user'); + $token = $this->params('token'); + return \OC_Preferences::getValue($user, 'owncloud', 'lostpassword') === hash('sha256', $token); + } +} diff --git a/core/lostpassword/templates/lostpassword.php b/core/lostpassword/templates/lostpassword.php index 0c2c72b40c..7548b4787e 100644 --- a/core/lostpassword/templates/lostpassword.php +++ b/core/lostpassword/templates/lostpassword.php @@ -1,35 +1,20 @@ -
- t('The link to reset your password has been sent to your email.
If you do not receive it within a reasonable amount of time, check your spam/junk folders.
If it is not there ask your local administrator .'));
- ?>
-