From a7fbd91e53be5f4fd68f035c999eaa3f187b9d3d Mon Sep 17 00:00:00 2001 From: Victor Dubiniuk Date: Wed, 28 May 2014 00:09:08 +0300 Subject: Use appframework --- core/lostpassword/ajaxcontroller.php | 45 ----------- core/lostpassword/controller.php | 101 ------------------------ core/lostpassword/controller/ajaxcontroller.php | 101 ++++++++++++++++++++++++ core/lostpassword/controller/lostcontroller.php | 66 ++++++++++++++++ core/lostpassword/templates/lostpassword.php | 45 ++++------- core/lostpassword/templates/resetpassword.php | 19 ++--- 6 files changed, 188 insertions(+), 189 deletions(-) delete mode 100644 core/lostpassword/ajaxcontroller.php delete mode 100644 core/lostpassword/controller.php create mode 100644 core/lostpassword/controller/ajaxcontroller.php create mode 100644 core/lostpassword/controller/lostcontroller.php (limited to 'core/lostpassword') diff --git a/core/lostpassword/ajaxcontroller.php b/core/lostpassword/ajaxcontroller.php deleted file mode 100644 index 3722681308b..00000000000 --- a/core/lostpassword/ajaxcontroller.php +++ /dev/null @@ -1,45 +0,0 @@ - '1') - ); - } catch (\Exception $e){ - \OCP\JSON::error( - array('msg'=> $e->getMessage()) - ); - } - - exit(); - } - - public static function resetPassword($args) { - \OCP\JSON::callCheck(); - try { - Controller::resetPassword($args); - \OCP\JSON::success(); - } catch (Exception $e){ - \OCP\JSON::error( - array('msg'=> $e->getMessage()) - ); - } - exit(); - } -} diff --git a/core/lostpassword/controller.php b/core/lostpassword/controller.php deleted file mode 100644 index 0c6ada4edce..00000000000 --- a/core/lostpassword/controller.php +++ /dev/null @@ -1,101 +0,0 @@ - - * This file is licensed under the Affero General Public License version 3 or - * later. - * See the COPYING-README file. - */ -namespace OC\Core\LostPassword; - -class Controller { - - /** - * @param boolean $error - * @param boolean $requested - */ - protected static function displayLostPasswordPage($error, $requested) { - $isEncrypted = \OC_App::isEnabled('files_encryption'); - \OC_Template::printGuestPage('core/lostpassword', 'lostpassword', - array('error' => $error, - 'requested' => $requested, - 'isEncrypted' => $isEncrypted)); - } - - /** - * @param boolean $success - */ - protected static function displayResetPasswordPage($success, $args) { - $route_args = array(); - $route_args['token'] = $args['token']; - $route_args['user'] = $args['user']; - \OC_Template::printGuestPage('core/lostpassword', 'resetpassword', - array('success' => $success, 'args' => $route_args)); - } - - protected static function checkToken($user, $token) { - return \OC_Preferences::getValue($user, 'owncloud', 'lostpassword') === hash('sha256', $token); - } - - public static function sendEmail($user, $proceed) { - $l = \OC_L10N::get('core'); - $isEncrypted = \OC_App::isEnabled('files_encryption'); - - if ($isEncrypted && $proceed !== 'Yes'){ - throw new EncryptedDataException(); - } - - if (!\OC_User::userExists($user)) { - throw new \Exception($l->t('Couldn’t send reset email. Please make sure your username is correct.')); - } - $token = hash('sha256', \OC_Util::generateRandomBytes(30).\OC_Config::getValue('passwordsalt', '')); - \OC_Preferences::setValue($user, 'owncloud', 'lostpassword', - hash('sha256', $token)); // Hash the token again to prevent timing attacks - $email = \OC_Preferences::getValue($user, 'settings', 'email', ''); - if (empty($email)) { - throw new \Exception($l->t('Couldn’t send reset email because there is no email address for this username. Please contact your administrator.')); - } - $link = \OC_Helper::linkToRoute('core_lostpassword_reset', - array('user' => $user, 'token' => $token)); - $link = \OC_Helper::makeURLAbsolute($link); - - $tmpl = new \OC_Template('core/lostpassword', 'email'); - $tmpl->assign('link', $link, false); - $msg = $tmpl->fetchPage(); - $from = \OCP\Util::getDefaultEmailAddress('lostpassword-noreply'); - try { - $defaults = new \OC_Defaults(); - \OC_Mail::send($email, $user, $l->t('%s password reset', array($defaults->getName())), $msg, $from, $defaults->getName()); - } catch (\Exception $e) { - throw new \Exception( $l->t('Couldn’t send reset email. Please contact your administrator.')); - } - } - - public static function reset($args) { - // Someone wants to reset their password: - if(self::checkToken($args['user'], $args['token'])) { - self::displayResetPasswordPage(false, $args); - } else { - // Someone lost their password - self::displayLostPasswordPage(false, false); - } - } - - public static function resetPassword($args) { - if (self::checkToken($args['user'], $args['token'])) { - if (isset($_POST['password'])) { - if (\OC_User::setPassword($args['user'], $_POST['password'])) { - \OC_Preferences::deleteKey($args['user'], 'owncloud', 'lostpassword'); - \OC_User::unsetMagicInCookie(); - self::displayResetPasswordPage(true, $args); - } else { - self::displayResetPasswordPage(false, $args); - } - } else { - self::reset($args); - } - } else { - // Someone lost their password - self::displayLostPasswordPage(false, false); - } - } -} diff --git a/core/lostpassword/controller/ajaxcontroller.php b/core/lostpassword/controller/ajaxcontroller.php new file mode 100644 index 00000000000..22fa0ce9126 --- /dev/null +++ b/core/lostpassword/controller/ajaxcontroller.php @@ -0,0 +1,101 @@ +'success')); + try { + $this->sendEmail($this->params('user', ''), $this->params('proceed', '')); + } catch (EncryptedDataException $e){ + $response->setData(array( + 'status' => 'error', + 'encryption' => '1' + )); + } catch (\Exception $e){ + $response->setData(array( + 'status' => 'error', + 'msg' => $e->getMessage() + )); + } + + return $response; + } + + /** + * @PublicPage + */ + public function resetPassword() { + $response = new JSONResponse(array('status'=>'success')); + try { + $user = $this->params('user'); + $newPassword = $this->params('password'); + if (!$this->checkToken()) { + throw new \RuntimeException(''); + } + if (!\OC_User::setPassword($user, $newPassword)) { + throw new \RuntimeException(''); + } + \OC_Preferences::deleteKey($user, 'owncloud', 'lostpassword'); + \OC_User::unsetMagicInCookie(); + } catch (Exception $e){ + $response->setData(array( + 'status' => 'error', + 'msg' => $e->getMessage() + )); + } + return $response; + } + + protected function sendEmail($user, $proceed) { + $l = \OC_L10N::get('core'); + $isEncrypted = \OC_App::isEnabled('files_encryption'); + + if ($isEncrypted && $proceed !== 'Yes'){ + throw new EncryptedDataException(); + } + + if (!\OC_User::userExists($user)) { + throw new \Exception($l->t('Couldn’t send reset email. Please make sure your username is correct.')); + } + $token = hash('sha256', \OC_Util::generateRandomBytes(30).\OC_Config::getValue('passwordsalt', '')); + \OC_Preferences::setValue($user, 'owncloud', 'lostpassword', + hash('sha256', $token)); // Hash the token again to prevent timing attacks + $email = \OC_Preferences::getValue($user, 'settings', 'email', ''); + if (empty($email)) { + throw new \Exception($l->t('Couldn’t send reset email because there is no email address for this username. Please contact your administrator.')); + } + + $parameters = array('token' => $token, 'user' => $user); + $link = $this->urlGenerator->linkToRoute('core.lost.reset', $parameters); + $link = $this->urlGenerator->getAbsoluteUrl($link); + + $tmpl = new \OC_Template('core/lostpassword', 'email'); + $tmpl->assign('link', $link, false); + $msg = $tmpl->fetchPage(); + echo $link; + $from = \OCP\Util::getDefaultEmailAddress('lostpassword-noreply'); + try { + $defaults = new \OC_Defaults(); + \OC_Mail::send($email, $user, $l->t('%s password reset', array($defaults->getName())), $msg, $from, $defaults->getName()); + } catch (\Exception $e) { + throw new \Exception( $l->t('Couldn’t send reset email. Please contact your administrator.')); + } + } + +} diff --git a/core/lostpassword/controller/lostcontroller.php b/core/lostpassword/controller/lostcontroller.php new file mode 100644 index 00000000000..0a28779259f --- /dev/null +++ b/core/lostpassword/controller/lostcontroller.php @@ -0,0 +1,66 @@ + + * This file is licensed under the Affero General Public License version 3 or + * later. + * See the COPYING-README file. + */ +namespace OC\Core\LostPassword\Controller; + +use \OCP\AppFramework\Controller; +use \OCP\AppFramework\Http\TemplateResponse; + +class LostController extends Controller { + + protected $urlGenerator; + + public function __construct($appName, IRequest $request, IURLGenerator $urlGenerator) { + parent::__construct($appName, $request); + $this->urlGenerator = $urlGenerator; + } + + /** + * @PublicPage + * @NoCSRFRequired + */ + public function reset() { + // Someone wants to reset their password: + if($this->checkToken()) { + return new TemplateResponse( + 'core/lostpassword', + 'resetpassword', + array( + 'link' => $link + ), + 'guest' + ); + } else { + // Someone lost their password + $isEncrypted = \OC_App::isEnabled('files_encryption'); + return new TemplateResponse( + 'core/lostpassword', + 'lostpassword', + array( + 'isEncrypted' => $isEncrypted, + 'link' => $this->getResetPasswordLink() + ), + 'guest' + ); + } + } + + protected function getResetPasswordLink(){ + $parameters = array( + 'token' => $this->params('token'), + 'user' => $this->params('user') + ); + $link = $this->urlGenerator->linkToRoute('core.ajax.reset', $parameters); + return $this->urlGenerator->getAbsoluteUrl($link); + } + + protected function checkToken() { + $user = $this->params('user'); + $token = $this->params('token'); + return \OC_Preferences::getValue($user, 'owncloud', 'lostpassword') === hash('sha256', $token); + } +} diff --git a/core/lostpassword/templates/lostpassword.php b/core/lostpassword/templates/lostpassword.php index 0c2c72b40ce..7548b4787ec 100644 --- a/core/lostpassword/templates/lostpassword.php +++ b/core/lostpassword/templates/lostpassword.php @@ -1,35 +1,20 @@ -

- t('The link to reset your password has been sent to your email.
If you do not receive it within a reasonable amount of time, check your spam/junk folders.
If it is not there ask your local administrator .')); - ?> -

- -
-
- -

- t('Request failed!
Did you make sure your email/username was right?')); ?> -

- -
t('You will receive a link to reset your password via Email.')); ?>
-

- - - - +OCP\Util::addStyle('lostpassword', 'lostpassword'); ?> + +

+
t('You will receive a link to reset your password via Email.')); ?>
+

+ + + +

t("Your files are encrypted. If you haven't enabled the recovery key, there will be no way to get your data back after your password is reset. If you are not sure what to do, please contact your administrator before you continue. Do you really want to continue?")); ?>
- t('Yes, I really want to reset my password now')); ?>

- -

- -
- - + t('Yes, I really want to reset my password now')); ?>

+ +

+ +
+ diff --git a/core/lostpassword/templates/resetpassword.php b/core/lostpassword/templates/resetpassword.php index 11dce9f112b..3f2cade08ce 100644 --- a/core/lostpassword/templates/resetpassword.php +++ b/core/lostpassword/templates/resetpassword.php @@ -1,16 +1,9 @@ -
+
- -

t('Your password was reset')); ?>

-

t('To login page')); ?>

- -

- - -

- - +

+ + +

+
-- cgit v1.2.3