source: extensions/NBC_UserAdvManager/trunk/main.inc.php @ 4290

Last change on this file since 4290 was 4290, checked in by Eric, 14 years ago

[NBC_UserAdvManager]

  • Escaping all characters in login or username.
  • Using mysql_fetch_assoc instead of mysql_fetch_array
  • Property svn:eol-style set to LF
File size: 20.5 KB
Line 
1<?php
2/*
3Plugin Name: NBC UserAdvManager
4Version: 2.12.7
5Description: Renforcer les possibilités de gestion des utilisateurs - Enforce users management
6Plugin URI: http://fr.piwigo.org/ext/extension_view.php?eid=216
7Author: Nicco, Eric
8Author URI: http://gallery-nicco.no-ip.org, http://www.infernoweb.net
9*/
10
11/*
12 ***** Plugin history (branch 2.10)*****
13
14-- 2.10.0-beta : Initial beta release for Piwigo compatibility
15-- 2.10.1-beta : Small correction on generated path
16-- 2.10.2-beta : Bug resolved on register validation page
17
18-- 2.10.3 : Final and fully functional release
19                                                Bug resolved on plugin activation
20
21-- 2.10.4 : Bug fixed on profiles update
22
23-- 2.10.5 : Improved code on profiles update
24
25-- 2.10.6 : Old language packs (iso) deleted (forget from PWG 1.7.x version)
26
27-- 2.10.7 : Bug fixed on user's validation email sending
28
29-- 2.10.8 : ConfirmMail page looks better (Sylvia theme only)
30                                                Improved code for checking author on guest comments
31
32-- 2.10.9 : Bug fixed - Missing english translation
33                                                Bug fixed - Notice on forbidden characters function use
34                                                Bug fixed - Audit on forbidden characters in username didn't work
35                                                Adding of email provider exclusion (like *@hotmail.com) - Warning ! -> Known bug : This feature doesn't work on user profile page. So, already registered users can change their email address to a forbiden one.
36
37-- 2.10.9a : Email provider exclusion is no longer case sensitive
38
39-- 2.10.9b : Bug fixed - Home icon wasn't linked to gallery url in ConfirmMail page. If GALLERY_URL is not set, Home icon gets the pwg root path.
40
41-- 2.10.9c : Bug fixed - If Email provider exclusion is set off, new registered user will have a PHP notice on "Undefined variable: ncsemail"
42
43-- 2.10.9d : Code simplification - need no more ""template"" sub-directory in plugin directory for enhance "back link" icon in ConfirMail.tpl
44
45-- 2.10.9e : Compatibility improvement with PHP 5.3 - Some old functions will be deprecated like :
46                                                        ereg replaced by preg_match
47                                                        eregi replace by preg_match with "i" moderator
48                                                        split replace by preg_split
49                               
50-- 2.10.9f : Compatibility bug fixed when used with DynamicRecentPeriod plugin
51
52
53 ***** Plugin history (branch 2.11)*****
54
55-- 2.11.0 : New tabsheet menu to manage ConfirMail functions (setting a timeout without validation, Cleanup expired user's accounts, Force confirmation, Renew validation key, list unvalidated users,...)
56                                                Beautify plugin's main admin panel
57                                               
58-- 2.11.1 : Bug fixed with install and upgrade functions
59                                                Language files correction
60
61-- 2.11.2 : Bug fixed on bad query for unvalidated users display in unvalidated users list
62                                                Bug fixed : Sql syntax error on plugin activation
63
64-- 2.11.3 : On Patricia's request (french forum and bug 1173), the unvalidated users management tab shows users according with the settings of unvalidated group and / or unvalidated status.
65                                                Feature 1172 added : Email providers exclusion list can be set with CR/LF between each entry. The comma seperator (,) is still mandatory.
66                                                Bug 1175 fixed : Bad translation tag in french language file.
67                                                Improvement of unvalidated users management tab (feature 1174)- Expired users are displayed in red color text.
68
69-- 2.11.4 : Bug 1177 fixed : Width of excluded email providers list reset to ancient value (80 col)
70                                                Bug 1179 fixed : Adding a notice in plugin inline documentation for use of validation groups and status. A default group must be set in Piwigo's groups settings and the "Guest" (or another user) must be set as default for status values.
71                                                Bug 1182 fixed : Language tag missing in confirmation email generation
72
73-- 2.11.5 : Bug 1195 fixed : Registration displays the good title
74
75
76 ***** Plugin history (branch 2.12)*****
77
78-- 2.12.0 : Bug 1206 fixed : All plugin functionnalities work in user's profile page
79                Plugin's core code and admin panel refactoring
80                Password control and enforcement : A complexity score is computed on user registration. If this score is less than the goal set by admin, the password choosen is rejected.
81                Feature 1194 "Ghost Tracker" added : New plugin tab displays users who don't comes back to the gallery since x days. Ability to send email reminders and to delete reminded but "dead" users. It's the reason why this feature is called "Ghost Tracker".
82
83-- 2.12.1 : Rollback on admin panel improvement (it was a bad idea)
84
85-- 2.12.2 : Bug 1221 fixed - Adding of a new funtion to populate the lastvisit table on Ghost Tracker activation
86            Bug 1224 fixed - Error in database after plugin activation
87            Bug 1225 fixed - "Reminder" status don't change from "false" to "true" after the sent of a reminder email
88            Some code beautify (SQL requests and HTML 4 strict for tpl)
89
90-- 2.12.3 : Bug 1226 fixed - "duplicate key error" when lastvisit table is not empty and on using Ghost Tracker init function
91
92-- 2.12.4 : Adding a password field control for SendMail2User - Neighborhood plugin compatibility improvement
93            Bug 1229 fixed - Email was no longer mandatory when plugin was active, even if Piwigo's email madatory option was set.
94
95-- 2.12.5 : Bug 1233 fixed -  "duplicate key error" when a user wants to register with an existing username. In fact, all standard Piwigo's register controls didn't work when plugin was activated. That fixes this too.
96            Adding DE, ES and IT languages. All translations are not finalized and could be improved.
97            Adding of description.txt file in language directories.
98
99-- 2.12.6 : Bug 1236 fixed -  Admins was unable to add a new user in the user_list page.
100            Beginning of IT translations
101           
102-- 2.12.7 : Bug 1238 fixed -  Simple custom email text wasn't send when Extended Description plugin wasn't set.
103            Ending of IT translations
104            Escaping all special characters typed in login name and recover them
105*/
106
107/*
108
109 ***** TODO List *****
110++ No validation needed for admins users comments (new trigger needed in comments.php ?)
111
112++ No single email check for admins (new trigger needed in functions_user.inc.php ?)
113
114++ Password control and enforcement
115  ?? Can not be the same as username -> Could password score control be sufficient ?
116 
117++ Security : Blocking brut-force attacks !
118              -> Way to do that : Count the number of failed attempts to connect and lock the targetted account after x attempts. Where x will be settable by admin.
119              To unlock the locked account :
120               -> A new table in admin's plugin panel which would display the locked accounts.
121               -> Sending an email to account owner to inform him his account is blocked due to multiple failed connexions attempts. This email could have a link with a security key to unlock the account.
122               -> Both of above solutions ?
123
124++ Opportunity to copy a registered user for new user creation
125  ++ new copied user will (or not) belong to the same groups
126  ++ new copied user will (or not) get the same status (visitor, admin, webmaster, guest (??))
127  ++ new copied user will (or not) get the same properties
128  ++ new copied user will (or not) get the same language
129  ... and so on
130 
131*/
132
133
134if (!defined('PHPWG_ROOT_PATH'))
135{
136  die('Hacking attempt!');
137}
138
139define('NBC_UserAdvManager_DIR' , basename(dirname(__FILE__)));
140define('NBC_UserAdvManager_PATH' , PHPWG_PLUGINS_PATH.basename(dirname(__FILE__)).'/');
141
142include_once (NBC_UserAdvManager_PATH.'include/constants.php');
143include_once (NBC_UserAdvManager_PATH.'include/functions_UserAdvManager.inc.php');
144
145load_language('plugin.lang', NBC_UserAdvManager_PATH);
146
147
148/* Plugin admin */
149add_event_handler('get_admin_plugin_menu_links', 'nbc_UserAdvManager_admin_menu');
150
151function nbc_UserAdvManager_admin_menu($menu)
152{
153  array_push($menu,
154    array(
155      'NAME' => 'UserAdvManager',
156      'URL'  => get_admin_plugin_menu_link(NBC_UserAdvManager_PATH.'/admin/UserAdvManager_admin.php')
157    )
158  );
159
160  return $menu;
161}
162
163
164add_event_handler('loc_begin_index', 'UserAdvManager_GhostTracker');
165
166function UserAdvManager_GhostTracker()
167{
168  global $conf, $user;
169 
170  $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
171
172  if (isset($conf_nbc_UserAdvManager[17]) and $conf_nbc_UserAdvManager[17] == 'true' and !is_admin() and !is_a_guest())
173  {
174
175    $userid = get_userid($user['username']);
176         
177    /* Looking for existing entry in last visit table */
178    $query = '
179SELECT *
180  FROM '.USER_LASTVISIT_TABLE.'
181WHERE user_id = '.$userid.'
182;';
183       
184    $count = mysql_num_rows(pwg_query($query));
185         
186    if ($count == 0)
187    {
188      /* If not, data are inserted in table */
189      $query = '
190INSERT INTO '.USER_LASTVISIT_TABLE.' (user_id, lastvisit, reminder)
191VALUES ('.$userid.', now(), "false")
192;';
193      pwg_query($query);
194    }
195    else if ($count > 0)
196    {
197      /* If yes, data are updated in table */
198      $query = '
199UPDATE '.USER_LASTVISIT_TABLE.'
200SET lastvisit = now(), reminder = "false"
201WHERE user_id = '.$userid.'
202LIMIT 1
203;';
204      pwg_query($query);
205    }
206  }
207}
208
209
210/* User creation */
211add_event_handler('register_user', 'UserAdvManager_Adduser');
212
213function UserAdvManager_Adduser($register_user)
214{
215  global $conf;
216 
217  $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
218 
219  /* Sending registration confirmation by email */
220  if ((isset($conf_nbc_UserAdvManager[0]) and $conf_nbc_UserAdvManager[0] == 'true') or (isset($conf_nbc_UserAdvManager[2]) and $conf_nbc_UserAdvManager[2] == 'true'))
221  {
222    $passwd = (isset($_POST['password'])) ? $_POST['password'] : '';
223    SendMail2User(1, $register_user['id'], $register_user['username'], $passwd, $register_user['email'], true);
224  }
225}
226
227
228
229/* User deletion */
230add_event_handler('delete_user', 'UserAdvManager_Deluser');
231
232function UserAdvManager_Deluser($user_id)
233{
234  /* Cleanup for ConfirmMail table */
235  DeleteConfirmMail($user_id);
236  /* Cleanup for LastVisit table */
237  DeleteLastVisit($user_id);
238}
239
240
241/* Check users registration */
242add_event_handler('register_user_check', 'UserAdvManager_RegistrationCheck', EVENT_HANDLER_PRIORITY_NEUTRAL, 2);
243
244function UserAdvManager_RegistrationCheck($err, $user)
245{
246  global $errors, $conf;
247
248/* *********************************************************** */
249/* We need to reset the standard Piwigo's register controls    */
250/* because the call of register_user_check trigger resets them */
251/* *********************************************************** */
252  /* ********************************** */
253  /* Standard Piwigo's username control */
254  /* ********************************** */
255  if ($_POST['login'] == '')
256  {
257    return l10n('reg_err_login1');
258  }
259  if (preg_match('/^.* $/', $_POST['login']))
260  {
261    return l10n('reg_err_login2');
262  }
263  if (preg_match('/^ .*$/', $_POST['login']))
264  {
265    return l10n('reg_err_login3');
266  }
267  if (get_userid($_POST['login']))
268  {
269    return l10n('reg_err_login5');
270  }
271
272  if (script_basename() == 'admin' and isset($_GET['page']) and $_GET['page'] == 'user_list') /* not the same email variable if we are on users registration page or on admin's user registration page*/
273  {
274    /* ***************************** */
275    /* Standard Piwigo's email check */
276    /* ***************************** */
277    $atom   = '[-a-z0-9!#$%&\'*+\\/=?^_`{|}~]';   // before  arobase
278    $domain = '([a-z0-9]([-a-z0-9]*[a-z0-9]+)?)'; // domain name
279    $regex = '/^' . $atom . '+' . '(\.' . $atom . '+)*' . '@' . '(' . $domain . '{1,63}\.)+' . $domain . '{2,63}$/i';
280 
281    if (!preg_match($regex, $_POST['email']))
282    {
283      return l10n('reg_err_mail_address');
284    }
285   
286    if (!empty($_POST['email']))
287    {
288      $query = '
289select count(*)
290from '.USERS_TABLE.'
291where upper('.$conf['user_fields']['email'].') = upper(\''.$_POST['email'].'\');';
292      list($count) = mysql_fetch_assoc(pwg_query($query));
293      if ($count != 0)
294      {
295        return l10n('reg_err_mail_address_dbl');
296      }
297    }
298  }
299  else
300  {
301    /* ***************************** */
302    /* Standard Piwigo's email check */
303    /* ***************************** */
304    $atom   = '[-a-z0-9!#$%&\'*+\\/=?^_`{|}~]';   // before  arobase
305    $domain = '([a-z0-9]([-a-z0-9]*[a-z0-9]+)?)'; // domain name
306    $regex = '/^' . $atom . '+' . '(\.' . $atom . '+)*' . '@' . '(' . $domain . '{1,63}\.)+' . $domain . '{2,63}$/i';
307
308    if (!preg_match($regex, $_POST['mail_address']))
309    {
310      return l10n('reg_err_mail_address');
311    }
312   
313    if (!empty($_POST['mail_address']))
314    {
315      $query = '
316select count(*)
317from '.USERS_TABLE.'
318where upper('.$conf['user_fields']['email'].') = upper(\''.$_POST['mail_address'].'\');';
319      list($count) = mysql_fetch_assoc(pwg_query($query));
320      if ($count != 0)
321      {
322        return l10n('reg_err_mail_address_dbl');
323      }
324    }
325  }
326/* ****************************************** */
327/* End of Piwigo's standard register controls */
328/* ****************************************** */
329
330
331/* ****************************************** */
332/* Here begins the advanced register controls */
333/* ****************************************** */
334  $PasswordCheck = 0;
335 
336  $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
337
338  /* Password enforcement control */
339  if (isset($conf_nbc_UserAdvManager[14]) and $conf_nbc_UserAdvManager[14] == 'true' and !empty($conf_nbc_UserAdvManager[15]))
340  {
341    if (!empty($user['password']) and !is_admin())
342    {
343      $PasswordCheck = testpassword($user['password']);
344 
345      if ($PasswordCheck < $conf_nbc_UserAdvManager[15])
346      {
347        $message = get_l10n_args('reg_err_login4_%s', $PasswordCheck);
348        return($lang['reg_err_pass'] = l10n_args($message).$conf_nbc_UserAdvManager[15]);
349      }
350    }
351    else if (!empty($user['password']) and is_admin() and isset($conf_nbc_UserAdvManager[16]) and $conf_nbc_UserAdvManager[16] == 'true')
352    { 
353      $PasswordCheck = testpassword($user['password']);
354 
355      if ($PasswordCheck < $conf_nbc_UserAdvManager[15])
356      {
357        $message = get_l10n_args('reg_err_login4_%s', $PasswordCheck);
358        return($lang['reg_err_pass'] = l10n_args($message).$conf_nbc_UserAdvManager[15]);
359      }
360    }
361  }
362
363  /* Username non case sensitive */
364  if (isset($conf_nbc_UserAdvManager[1]) and $conf_nbc_UserAdvManager[1] == 'true')
365  {
366    $new_username =  NotSensibleSearchUsername($_POST['login']);
367    $_POST['login'] = $new_username == '' ? $_POST['login'] : $new_username;
368  }
369
370  /* Username without forbidden keys */
371  if (isset($conf_nbc_UserAdvManager[7]) and $conf_nbc_UserAdvManager[7] == 'true' and !empty($_POST['login']) and !ValidateUsername($_POST['login']))
372  {
373    $_POST['login'] = '';
374    return($lang['reg_err_login1'] = l10n('reg_err_login6')."'".$conf_nbc_UserAdvManager[8]."'");
375  }
376
377  /* Email without forbidden domains */
378  if (isset($conf_nbc_UserAdvManager[12]) and $conf_nbc_UserAdvManager[12] == 'true' and !empty($_POST['mail_address']) and !ValidateEmailProvider($_POST['mail_address']))
379  {
380    //$_POST['mail_address'] = '';
381    return($lang['reg_err_login1'] = l10n('reg_err_login7')."'".$conf_nbc_UserAdvManager[13]."'");
382  }
383}
384
385
386if (script_basename() == 'profile')
387{
388  add_event_handler('loc_begin_profile', 'UserAdvManager_Profile_Init');
389
390  function UserAdvManager_Profile_Init()
391  {
392    global $conf, $user, $template;
393
394    $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
395
396    if (isset($_POST['validate']))
397    {
398      /* Email without forbidden domains */
399      if (isset($conf_nbc_UserAdvManager[12]) and $conf_nbc_UserAdvManager[12] == 'true' and !empty($_POST['mail_address']))
400      {
401        if (!ValidateEmailProvider($_POST['mail_address']))
402        {
403          $template->append('errors', l10n('reg_err_login7')."'".$conf_nbc_UserAdvManager[13]."'");
404          unset($_POST['validate']);
405        }
406      }
407
408      $typemail = 3;
409     
410      if (!empty($_POST['use_new_pwd']))
411      {
412        $typemail = 2;
413       
414        /* Password enforcement control */
415        if (isset($conf_nbc_UserAdvManager[14]) and $conf_nbc_UserAdvManager[14] == 'true' and !empty($conf_nbc_UserAdvManager[15]))
416        {
417          $PasswordCheck = testpassword($_POST['use_new_pwd']);
418         
419          if ($PasswordCheck < $conf_nbc_UserAdvManager[15])
420          {
421            $message = get_l10n_args('reg_err_login4_%s', $PasswordCheck);
422            $template->append('errors', l10n_args($message).$conf_nbc_UserAdvManager[15]);
423            unset($_POST['use_new_pwd']);
424            unset($_POST['validate']);
425          }
426        }
427      }
428     
429      /* Sending registration confirmation by email */
430      if (( isset($conf_nbc_UserAdvManager[0]) and $conf_nbc_UserAdvManager[0] == 'true') or ( isset($conf_nbc_UserAdvManager[2]) and $conf_nbc_UserAdvManager[2] == 'true'))
431      {
432        $confirm_mail_need = false;
433             
434        if (!empty($_POST['mail_address']) and ValidateEmailProvider($_POST['mail_address']))
435        {
436          $query = '
437SELECT '.$conf['user_fields']['email'].' AS email
438FROM '.USERS_TABLE.'
439WHERE '.$conf['user_fields']['id'].' = \''.$user['id'].'\'
440;';
441         
442          list($current_email) = mysql_fetch_row(pwg_query($query));
443     
444          if ( $_POST['mail_address'] != $current_email and ( isset($conf_nbc_UserAdvManager[2]) and $conf_nbc_UserAdvManager[2] == 'true') )
445       
446            $confirm_mail_need = true;
447        }
448       
449        if ((!empty($_POST['use_new_pwd']) and ( isset($conf_nbc_UserAdvManager[0]) and $conf_nbc_UserAdvManager[0] == 'true') or $confirm_mail_need) )
450        {
451          $query = '
452SELECT '.$conf['user_fields']['username'].'
453FROM '.USERS_TABLE.'
454WHERE '.$conf['user_fields']['id'].' = \''.$user['id'].'\'
455;';
456       
457          list($username) = mysql_fetch_row(pwg_query($query));
458
459          SendMail2User($typemail, $user['id'], $username, $_POST['use_new_pwd'], $_POST['mail_address'], $confirm_mail_need);
460        }
461      }
462    }
463  }
464}
465
466
467add_event_handler('init', 'UserAdvManager_InitPage');
468 
469function UserAdvManager_InitPage()
470{
471  load_language('plugin.lang', NBC_UserAdvManager_PATH);
472  global $conf, $template, $page, $lang, $errors;
473
474  $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
475 
476  /* Username non case sensitive */
477  if (isset($conf_nbc_UserAdvManager[1]) and $conf_nbc_UserAdvManager[1] == 'true')
478  {
479    $lang['reg_err_login5'] = l10n('reg_err_login5');
480  }
481 
482
483 
484/* User identification */
485  if (script_basename() == 'identification')
486  {
487    if (isset($_POST['login']))
488    {
489      /* User non case sensitive */
490      if (isset($conf_nbc_UserAdvManager[1]) and $conf_nbc_UserAdvManager[1] == 'true' )
491      {
492        $new_username =  NotSensibleSearchUsername($_POST['username']);
493        $_POST['username'] = $new_username == '' ? $_POST['username'] : $new_username;
494      }
495    }
496  }
497
498
499/* Admin user management */
500  if (script_basename() == 'admin' and isset($_GET['page']) and $_GET['page'] == 'user_list')
501  {
502    if (isset($_POST['submit_add']))
503    {
504      /* User non case sensitive */
505      if (isset($conf_nbc_UserAdvManager[1]) and $conf_nbc_UserAdvManager[1] == 'true' )
506      {
507        $new_username =  NotSensibleSearchUsername($_POST['login']);
508        $_POST['login'] = $new_username == '' ? $_POST['login'] : $new_username;
509      }
510
511      /* Username without forbidden keys */
512      if (isset($conf_nbc_UserAdvManager[7]) and $conf_nbc_UserAdvManager[7] == 'true' and !empty($_POST['login']) and !ValidateUsername($_POST['login']))
513      {
514        $template->append('errors', l10n('reg_err_login6')."'".$conf_nbc_UserAdvManager[8]."'");
515        unset($_POST['submit_add']);
516      }
517
518      /* Email without forbidden domains */
519      if (isset($conf_nbc_UserAdvManager[12]) and $conf_nbc_UserAdvManager[12] == 'true' and !empty($_POST['email']) and !ValidateEmailProvider($_POST['email']))
520      {
521        $template->append('errors', l10n('reg_err_login7')."'".$conf_nbc_UserAdvManager[13]."'");
522        unset($_POST['submit_add']);
523      }
524    }
525  }
526}
527
528
529add_event_handler('user_comment_check', 'UserAdvManager_CheckEmptyCommentAuthor', 50, 2);
530
531function UserAdvManager_CheckEmptyCommentAuthor($comment_action, $comm)
532{
533  load_language('plugin.lang', NBC_UserAdvManager_PATH);
534  global $infos, $conf, $template;
535
536  $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
537
538/* User creation OR update */
539  if (isset($conf_nbc_UserAdvManager[6]) and $conf_nbc_UserAdvManager[6] == 'true' and $conf['comments_forall'] == 'true' and $comm['author'] == 'guest')
540  {
541    $comment_action = 'reject';
542
543    array_push($infos, l10n('UserAdvManager_Empty Author'));
544  }
545
546  return $comment_action;
547}
548
549?>
Note: See TracBrowser for help on using the repository browser.