source: extensions/NBC_UserAdvManager/trunk/main.inc.php @ 4415

Last change on this file since 4415 was 4415, checked in by Eric, 14 years ago

[NBC_UserAdvManager]

  • Bug 1302 fixed : Re-coded double email check on registration.
  • Bug 1304 fixed : Adding of plugin version in plugin admin panel title.
  • Property svn:eol-style set to LF
File size: 13.7 KB
Line 
1<?php
2/*
3Plugin Name: NBC UserAdvManager
4Version: 2.13.1
5Description: Renforcer les possibilités de gestion des utilisateurs - Enforce users management
6Plugin URI: http://fr.piwigo.org/ext/extension_view.php?eid=216
7Author: Nicco, Eric
8Author URI: http://gallery-nicco.no-ip.org, http://www.infernoweb.net
9*/
10
11/* History:  NBC_UserAdvManager_PATH.'Changelog.txt.php' */
12
13/*
14 ***** TODO List *****
15++ Adding ASC and DESC ordering for user's lists tables (Ghost Tracker, UserList and Unvalidated)
16
17++ No validation needed for admins users comments (new trigger needed in comments.php ?)
18
19++ No single email check for admins (new trigger needed in functions_user.inc.php ?)
20
21++ Password control and enforcement
22  ?? Can not be the same as username -> Could password score control be sufficient ?
23 
24++ Security : Blocking brut-force attacks !
25              -> Way to do that : Count the number of failed attempts to connect and lock the targetted account after x attempts. Where x will be settable by admin.
26              To unlock the locked account :
27               -> A new table in admin's plugin panel which would display the locked accounts.
28               -> Sending an email to account owner to inform him his account is blocked due to multiple failed connexions attempts. This email could have a link with a security key to unlock the account.
29               -> Both of above solutions ?
30
31++ Opportunity to copy a registered user for new user creation
32  ++ new copied user will (or not) belong to the same groups
33  ++ new copied user will (or not) get the same status (visitor, admin, webmaster, guest (??))
34  ++ new copied user will (or not) get the same properties
35  ++ new copied user will (or not) get the same language
36  ... and so on
37*/
38
39
40if (!defined('PHPWG_ROOT_PATH'))
41{
42  die('Hacking attempt!');
43}
44
45define('NBC_UserAdvManager_DIR' , basename(dirname(__FILE__)));
46define('NBC_UserAdvManager_PATH' , PHPWG_PLUGINS_PATH.basename(dirname(__FILE__)).'/');
47
48include_once (NBC_UserAdvManager_PATH.'include/constants.php');
49include_once (NBC_UserAdvManager_PATH.'include/functions_UserAdvManager.inc.php');
50
51load_language('plugin.lang', NBC_UserAdvManager_PATH);
52
53
54/* Plugin admin */
55add_event_handler('get_admin_plugin_menu_links', 'nbc_UserAdvManager_admin_menu');
56
57function nbc_UserAdvManager_admin_menu($menu)
58{
59  array_push($menu,
60    array(
61      'NAME' => 'UserAdvManager',
62      'URL'  => get_admin_plugin_menu_link(NBC_UserAdvManager_PATH.'/admin/UserAdvManager_admin.php')
63    )
64  );
65
66  return $menu;
67}
68
69
70add_event_handler('loc_begin_index', 'UserAdvManager_GhostTracker');
71
72function UserAdvManager_GhostTracker()
73{
74  global $conf, $user;
75 
76  $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
77
78  if (isset($conf_nbc_UserAdvManager[17]) and $conf_nbc_UserAdvManager[17] == 'true' and !is_admin() and !is_a_guest())
79  {
80
81    $userid = get_userid($user['username']);
82         
83    /* Looking for existing entry in last visit table */
84    $query = '
85SELECT *
86  FROM '.USER_LASTVISIT_TABLE.'
87WHERE user_id = '.$userid.'
88;';
89       
90    $count = mysql_num_rows(pwg_query($query));
91         
92    if ($count == 0)
93    {
94      /* If not, data are inserted in table */
95      $query = '
96INSERT INTO '.USER_LASTVISIT_TABLE.' (user_id, lastvisit, reminder)
97VALUES ('.$userid.', now(), "false")
98;';
99      pwg_query($query);
100    }
101    else if ($count > 0)
102    {
103      /* If yes, data are updated in table */
104      $query = '
105UPDATE '.USER_LASTVISIT_TABLE.'
106SET lastvisit = now(), reminder = "false"
107WHERE user_id = '.$userid.'
108LIMIT 1
109;';
110      pwg_query($query);
111    }
112  }
113}
114
115
116/* User creation */
117add_event_handler('register_user', 'UserAdvManager_Adduser');
118
119function UserAdvManager_Adduser($register_user)
120{
121  global $conf;
122 
123  $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
124 
125  /* Sending registration confirmation by email */
126  if ((isset($conf_nbc_UserAdvManager[0]) and $conf_nbc_UserAdvManager[0] == 'true') or (isset($conf_nbc_UserAdvManager[2]) and $conf_nbc_UserAdvManager[2] == 'true'))
127  {
128    $passwd = (isset($_POST['password'])) ? $_POST['password'] : '';
129    SendMail2User(1, $register_user['id'], $register_user['username'], $passwd, $register_user['email'], true);
130  }
131}
132
133
134
135/* User deletion */
136add_event_handler('delete_user', 'UserAdvManager_Deluser');
137
138function UserAdvManager_Deluser($user_id)
139{
140  /* Cleanup for ConfirmMail table */
141  DeleteConfirmMail($user_id);
142  /* Cleanup for LastVisit table */
143  DeleteLastVisit($user_id);
144}
145
146
147/* Check users registration */
148add_event_handler('register_user_check', 'UserAdvManager_RegistrationCheck', EVENT_HANDLER_PRIORITY_NEUTRAL, 2);
149
150function UserAdvManager_RegistrationCheck($err, $user)
151{
152  global $errors, $conf;
153
154/* *********************************************************** */
155/* We need to reset the standard Piwigo's register controls    */
156/* because the call of register_user_check trigger resets them */
157/* *********************************************************** */
158  /* ********************************** */
159  /* Standard Piwigo's username control */
160  /* ********************************** */
161  if ($_POST['login'] == '')
162  {
163    return l10n('reg_err_login1');
164  }
165  if (preg_match('/^.* $/', $_POST['login']))
166  {
167    return l10n('reg_err_login2');
168  }
169  if (preg_match('/^ .*$/', $_POST['login']))
170  {
171    return l10n('reg_err_login3');
172  }
173  if (get_userid($_POST['login']))
174  {
175    return l10n('reg_err_login5');
176  }
177 
178  if (script_basename() == 'admin' and isset($_GET['page']) and $_GET['page'] == 'user_list') /* not the same email variable if we are on users registration page or on admin's user registration page*/
179  {
180  /* Email doblons check */
181    $atom   = '[-a-z0-9!#$%&\'*+\\/=?^_`{|}~]';   // before  arobase
182    $domain = '([a-z0-9]([-a-z0-9]*[a-z0-9]+)?)'; // domain name
183    $regex = '/^' . $atom . '+' . '(\.' . $atom . '+)*' . '@' . '(' . $domain . '{1,63}\.)+' . $domain . '{2,63}$/i';
184 
185    if (!preg_match($regex, $_POST['email']))
186    {
187      return l10n('reg_err_mail_address');
188    }
189   
190    $query = '
191SELECT count(*)
192FROM '.USERS_TABLE.'
193WHERE upper('.$conf['user_fields']['email'].') = upper(\''.$_POST['email'].'\')
194;';
195    list($count) = mysql_fetch_array(pwg_query($query));
196    if ($count != 0)
197    {
198      return l10n('reg_err_mail_address_dbl');
199    }
200  }
201
202  if (script_basename() == 'register') /* not the same email variable if we are on users registration page or on admin's user registration page*/
203  {
204  /* Email doblons check */
205    $atom   = '[-a-z0-9!#$%&\'*+\\/=?^_`{|}~]';   // before  arobase
206    $domain = '([a-z0-9]([-a-z0-9]*[a-z0-9]+)?)'; // domain name
207    $regex = '/^' . $atom . '+' . '(\.' . $atom . '+)*' . '@' . '(' . $domain . '{1,63}\.)+' . $domain . '{2,63}$/i';
208 
209    if (!preg_match($regex, $_POST['mail_address']))
210    {
211      return l10n('reg_err_mail_address');
212    }
213   
214    $query = '
215SELECT count(*)
216FROM '.USERS_TABLE.'
217WHERE upper('.$conf['user_fields']['email'].') = upper(\''.$_POST['mail_address'].'\')
218;';
219    list($count) = mysql_fetch_array(pwg_query($query));
220    if ($count != 0)
221    {
222      return l10n('reg_err_mail_address_dbl');
223    }
224  }
225/* ****************************************** */
226/* End of Piwigo's standard register controls */
227/* ****************************************** */
228
229
230/* ****************************************** */
231/* Here begins the advanced register controls */
232/* ****************************************** */
233  $PasswordCheck = 0;
234 
235  $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
236
237  /* Password enforcement control */
238  if (isset($conf_nbc_UserAdvManager[14]) and $conf_nbc_UserAdvManager[14] == 'true' and !empty($conf_nbc_UserAdvManager[15]))
239  {
240    if (!empty($user['password']) and !is_admin())
241    {
242      $PasswordCheck = testpassword($user['password']);
243 
244      if ($PasswordCheck < $conf_nbc_UserAdvManager[15])
245      {
246        $message = get_l10n_args('reg_err_login4_%s', $PasswordCheck);
247        return($lang['reg_err_pass'] = l10n_args($message).$conf_nbc_UserAdvManager[15]);
248      }
249    }
250    else if (!empty($user['password']) and is_admin() and isset($conf_nbc_UserAdvManager[16]) and $conf_nbc_UserAdvManager[16] == 'true')
251    { 
252      $PasswordCheck = testpassword($user['password']);
253 
254      if ($PasswordCheck < $conf_nbc_UserAdvManager[15])
255      {
256        $message = get_l10n_args('reg_err_login4_%s', $PasswordCheck);
257        return($lang['reg_err_pass'] = l10n_args($message).$conf_nbc_UserAdvManager[15]);
258      }
259    }
260  }
261
262  /* Username non case sensitive */
263  if (isset($conf_nbc_UserAdvManager[1]) and $conf_nbc_UserAdvManager[1] == 'true' and NotSensibleSearchUsername($_POST['login']))
264  {
265    return($lang['reg_err_login5'] = l10n('reg_err_login5'));
266  }
267
268  /* Username without forbidden keys */
269  if (isset($conf_nbc_UserAdvManager[7]) and $conf_nbc_UserAdvManager[7] == 'true' and !empty($_POST['login']) and ValidateUsername($_POST['login']))
270  {
271    $_POST['login'] = '';
272    return($lang['reg_err_login1'] = l10n('reg_err_login6')."'".$conf_nbc_UserAdvManager[8]."'");
273  }
274
275  /* Email without forbidden domains */
276  if (isset($conf_nbc_UserAdvManager[12]) and $conf_nbc_UserAdvManager[12] == 'true' and !empty($_POST['mail_address']) and ValidateEmailProvider($_POST['mail_address']))
277  {
278    $_POST['mail_address'] = '';
279    return($lang['reg_err_login1'] = l10n('reg_err_login7')."'".$conf_nbc_UserAdvManager[13]."'");
280  }
281}
282
283
284if (script_basename() == 'profile')
285{
286  add_event_handler('loc_begin_profile', 'UserAdvManager_Profile_Init');
287
288  function UserAdvManager_Profile_Init()
289  {
290    global $conf, $user, $template;
291
292    $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
293
294    if (isset($_POST['validate']))
295    {
296      /* Email without forbidden domains */
297      if (isset($conf_nbc_UserAdvManager[12]) and $conf_nbc_UserAdvManager[12] == 'true' and !empty($_POST['mail_address']))
298      {
299        if (ValidateEmailProvider($_POST['mail_address']))
300        {
301          $template->append('errors', l10n('reg_err_login7')."'".$conf_nbc_UserAdvManager[13]."'");
302          unset($_POST['validate']);
303        }
304      }
305
306      $typemail = 3;
307     
308      if (!empty($_POST['use_new_pwd']))
309      {
310        $typemail = 2;
311       
312        /* Password enforcement control */
313        if (isset($conf_nbc_UserAdvManager[14]) and $conf_nbc_UserAdvManager[14] == 'true' and !empty($conf_nbc_UserAdvManager[15]))
314        {
315          $PasswordCheck = testpassword($_POST['use_new_pwd']);
316         
317          if ($PasswordCheck < $conf_nbc_UserAdvManager[15])
318          {
319            $message = get_l10n_args('reg_err_login4_%s', $PasswordCheck);
320            $template->append('errors', l10n_args($message).$conf_nbc_UserAdvManager[15]);
321            unset($_POST['use_new_pwd']);
322            unset($_POST['validate']);
323          }
324        }
325      }
326     
327      /* Sending registration confirmation by email */
328      if ((isset($conf_nbc_UserAdvManager[0]) and $conf_nbc_UserAdvManager[0] == 'true') or (isset($conf_nbc_UserAdvManager[2]) and $conf_nbc_UserAdvManager[2] == 'true'))
329      {
330        $confirm_mail_need = false;
331             
332        if (!empty($_POST['mail_address']))
333        {
334          $query = '
335SELECT '.$conf['user_fields']['email'].' AS email
336FROM '.USERS_TABLE.'
337WHERE '.$conf['user_fields']['id'].' = \''.$user['id'].'\'
338;';
339         
340          list($current_email) = mysql_fetch_row(pwg_query($query));
341     
342          if ($_POST['mail_address'] != $current_email and ( isset($conf_nbc_UserAdvManager[2]) and $conf_nbc_UserAdvManager[2] == 'true'))
343       
344            $confirm_mail_need = true;
345        }
346       
347        if ((!empty($_POST['use_new_pwd']) and (isset($conf_nbc_UserAdvManager[0]) and $conf_nbc_UserAdvManager[0] == 'true') or $confirm_mail_need))
348        {
349          $query = '
350SELECT '.$conf['user_fields']['username'].'
351FROM '.USERS_TABLE.'
352WHERE '.$conf['user_fields']['id'].' = \''.$user['id'].'\'
353;';
354       
355          list($username) = mysql_fetch_row(pwg_query($query));
356
357          SendMail2User($typemail, $user['id'], $username, $_POST['use_new_pwd'], $_POST['mail_address'], $confirm_mail_need);
358        }
359      }
360    }
361  }
362}
363
364
365add_event_handler('init', 'UserAdvManager_InitPage');
366/* *** Important ! This is necessary to make email exclusion work in admin's users management panel *** */
367function UserAdvManager_InitPage()
368{
369  load_language('plugin.lang', NBC_UserAdvManager_PATH);
370  global $conf, $template, $page, $lang, $errors;
371
372  $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
373
374/* Admin user management */
375  if (script_basename() == 'admin' and isset($_GET['page']) and $_GET['page'] == 'user_list')
376  {
377    if (isset($_POST['submit_add']))
378    {
379      /* Email without forbidden domains */
380      if (isset($conf_nbc_UserAdvManager[12]) and $conf_nbc_UserAdvManager[12] == 'true' and !empty($_POST['email']) and ValidateEmailProvider($_POST['email']))
381      {
382        $template->append('errors', l10n('reg_err_login7')."'".$conf_nbc_UserAdvManager[13]."'");
383        unset($_POST['submit_add']);
384      }
385    }
386  }
387}
388
389
390add_event_handler('user_comment_check', 'UserAdvManager_CheckEmptyCommentAuthor', 50, 2);
391
392function UserAdvManager_CheckEmptyCommentAuthor($comment_action, $comm)
393{
394  load_language('plugin.lang', NBC_UserAdvManager_PATH);
395  global $infos, $conf, $template;
396
397  $conf_nbc_UserAdvManager = isset($conf['nbc_UserAdvManager']) ? explode(";" , $conf['nbc_UserAdvManager']) : array();
398
399/* User creation OR update */
400  if (isset($conf_nbc_UserAdvManager[6]) and $conf_nbc_UserAdvManager[6] == 'true' and $conf['comments_forall'] == 'true' and $comm['author'] == 'guest')
401  {
402    $comment_action = 'reject';
403
404    array_push($infos, l10n('UserAdvManager_Empty Author'));
405  }
406
407  return $comment_action;
408}
409?>
Note: See TracBrowser for help on using the repository browser.