Savane PHP Frontend Developer Reference: register.php Source File

00001 <?php
00002 # This file is part of the Savane project
00003 # <http://gna.org/projects/savane/>
00004 #
00005 # $Id: register.php 5400 2006-02-16 14:15:55Z yeupou $
00006 #
00007 #
00008 #  Copyright 1999-2000 (c) The SourceForge Crew
00009 #  Copyright 2000-2003 (c) Free Software Foundation
00010 #
00011 #  Copyright 2003-2005 (c) Mathieu Roy <yeupou--gna.org>
00012 #
00013 # The Savane project is free software; you can redistribute it and/or
00014 # modify it under the terms of the GNU General Public License
00015 # as published by the Free Software Foundation; either version 2
00016 # of the License, or (at your option) any later version.
00017 #
00018 # The Savane project is distributed in the hope that it will be useful,
00019 # but WITHOUT ANY WARRANTY; without even the implied warranty of
00020 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
00021 # GNU General Public License for more details.
00022 #
00023 # You should have received a copy of the GNU General Public License
00024 # along with the Savane project; if not, write to the Free Software
00025 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
00026 
00027 
00028 require "../include/pre.php";
00029 require "../include/account.php";
00030 
00031 # ###### function register_valid()
00032 # ###### checks for valid register from form post
00033 
00034 function register_valid()
00035 {
00036   global $G_USER;
00037 
00038   #### Check for duplicates
00039   if (!form_check($_POST['form_id']))
00040     { return 0; }
00041 
00042   ##### Make sure every parameters are given
00043   if (!$_POST['form_loginname'])
00044     {
00045       fb(_("You must supply a username."),1);
00046       return 0;
00047     }
00048   if (!$_POST['form_pw'])
00049     {
00050       fb(_("You must supply a password."),1);
00051       return 0;
00052     }
00053   if (!$_POST['form_email'])
00054     {
00055       fb(_("You must supply a valid email address."),1);
00056       return 0;
00057     }
00058   if (!$_POST['form_realname'])
00059     {
00060       fb(_("You must supply a non-empty real name."),1);
00061       return 0;
00062     }
00063 
00064   # Remove quotes from the realname, we do not want to allow that but
00065   # it is not a blocker issue.
00066   $GLOBALS['form_realname'] = strtr($_POST['form_realname'], "\'\"\,", "     ");
00067 
00068   if ($GLOBALS['sys_use_pamauth'] != "yes" && $_POST['form_usepam'] !=1)
00069     {
00070       # Only do password sanity checks if user does not want
00071       # to authenticate via PAM
00072       if (!$_POST['form_pw'])
00073         {
00074           fb(_("You must supply a password."),1);
00075           return 0;
00076         }
00077       if ($_POST['form_pw'] != $_POST['form_pw2'])
00078         {
00079           fb(_("Passwords do not match."),1);
00080           return 0;
00081         }
00082       if (!account_pwvalid($_POST['form_pw']))
00083         {
00084           # feedback included by the check function
00085           return 0;
00086         }
00087     }
00088 
00089   if (!account_namevalid($_POST['form_loginname']))
00090     {
00091       # feedback included by the check function
00092       return 0;
00093     }
00094 
00095 
00096   if (!account_emailvalid($_POST['form_email']))
00097     {
00098       # feedback included by the check function
00099       return 0;
00100     }
00101 
00102 
00103   ##### Avoid duplicates
00104 
00105   if (db_numrows(db_query("SELECT user_id FROM user WHERE "
00106                           . "user_name LIKE '".addslashes($_POST[form_loginname])."'")) > 0)
00107     {
00108       fb(_("That username already exists."),1);
00109       return 0;
00110     }
00111   if (db_numrows(db_query("SELECT group_list_id FROM mail_group_list WHERE "
00112                           . "list_name LIKE '".addslashes($_POST[form_loginname])."'")) > 0)
00113     {
00114       fb(_("That username is blocked to avoid conflict with mailing-list addresses."),1);
00115       return 0;
00116     }
00117 
00118   ####
00119 
00120 
00121   if ($GLOBALS['sys_use_krb5'] == "yes")
00122     {
00123       $krb5ret = krb5_login($_POST['form_loginname'], $_POST['form_pw']);
00124       if($krb5ret == -1)
00125         { # KRB5_NOTOK
00126           fb(_("phpkrb5 module failure"),1);
00127           return 0;
00128         }
00129       elseif($krb5ret == 1)
00130         { # KRB5_BAD_PASSWORD
00131             fb(sprintf(_("User is a kerberos principal but password do not match. Please use your kerberos password for the first login and then change your %s password. This is necessary to prevent someone from stealing your account name."),$GLOBALS['sys_name']),1);
00132 
00133           return 0;
00134         }
00135       elseif ($krb5ret == "2")
00136         {
00137           # KRB5_BAD_USER
00138 
00139           /*
00140 
00141 FIXME : this is broken and seems to be due to the kerberos module.
00142         we did not changed anything about that and we get 2 as return
00143         for any name.
00144 
00145           if($_POST['form_loginname']."@".$GLOBALS['sys_lists_domain'])
00146             {
00147               $GLOBALS['register_error'] = sprintf(_("User %s is a known mail alias and cannot be used. If you own this alias (%s@%s) please create a another user (for instance xx%s) and ask %s@%s to rename it to %s."),
00148                                                    $_POST['form_loginname'],
00149                                                    $_POST['form_loginname'],
00150 
00151                                                    $GLOBALS['sys_lists_domain'],
00152                                                    $_POST['form_loginname'],
00153                                                    $GLOBALS['sys_admin_list'],
00154                                                    $GLOBALS['sys_lists_domain'],
00155                                                    $_POST['form_loginname']);
00156               return 0;
00157             }
00158           */
00159         }
00160     }
00161 
00162   # if we got this far, it must be good
00163 
00164   if ($GLOBALS['sys_use_pamauth'] == "yes" && $_POST['form_usepam']==1)
00165     {
00166       # if user chose PAM based authentication, set his encrypted
00167       # password to the specified string
00168       $passwd='PAM';
00169     }
00170   else
00171     {
00172       $passwd=md5($_POST[form_pw]);
00173     }
00174 
00175   $confirm_hash = substr(md5($session_hash . $passwd . time()),0,16);
00176 
00177   $result=db_query("INSERT INTO user (user_name,user_pw,realname,email,add_date,"
00178                    . "status,confirm_hash) "
00179                    . "VALUES ('"
00180                    . addslashes(strtolower($_POST[form_loginname]))."','"
00181                    . addslashes($passwd)."','"
00182                    . addslashes($GLOBALS[form_realname])."','"
00183                    . addslashes($GLOBALS[form_email])."',"
00184                    . time().","
00185                    . "'P','" # status
00186                    . $confirm_hash."')");
00187 
00188   if (!$result)
00189     {
00190       exit_error('error',db_error());
00191     }
00192   else
00193     {
00194 
00195       $GLOBALS['newuserid'] = db_insertid($result);
00196 
00197       # clean id
00198       form_clean($form_id);
00199 
00200       # send mail
00201       $message = sprintf(_("Thank you for registering on the %s web site."),$GLOBALS['sys_name'])."\n"
00202         .sprintf(_("Your login is: %s"), addslashes(strtolower($_POST[form_loginname])))."\n\n"
00203         ._("In order to complete your registration, visit the following URL:\n\n")
00204         . $GLOBALS['sys_https_url']
00205         . $GLOBALS['sys_home']
00206         . "account/verify.php?confirm_hash=$confirm_hash\n\n"
00207         ._("Enjoy the site").".\n\n"
00208         . sprintf(_("-- the %s team.")."\n",$GLOBALS['sys_name']);
00209 
00210       if ($krb5ret == KRB5_OK)
00211         {
00212           $message .= sprintf(_("P.S. Your kerberos password is now stored in encrypted form\nin the %s database."),$GLOBALS['sys_name']);
00213           $message .= sprintf(_("For better security we advise you\nto change your %s password as soon as possible.\n"),$GLOBALS['sys_name']);
00214         }
00215 
00216 
00217       sendmail_mail($GLOBALS['sys_replyto']."@".$GLOBALS['sys_lists_domain'],
00218                     $GLOBALS['form_email'],
00219                     $GLOBALS['sys_name']." "._("Account Registration"),
00220                     $message);
00221 
00222       return 1;
00223     }
00224 }
00225 
00226 
00227 # ###### first check for valid login, if so, congratulate
00228 
00229 if ($_POST['update'] && register_valid())
00230 {
00231 
00232   $HTML->header(array('title'=>_("Register Confirmation")));
00233 
00234   print '<h3>'.$GLOBALS['sys_name'].' : '._("New Account Registration Confirmation").'</h3>'
00235     .sprintf(_("Congratulations. You have registered on %s "),$GLOBALS['sys_name'])
00236     .sprintf(_("Your login is: %s"), '<strong>'.user_getname($newuserid).'</strong>');
00237 
00238   print '<p>'._("You are now being sent a confirmation email to verify your email address. Visiting the link sent to you in this email will activate your account.").' <span class="warn">'._("Accounts not confirmed after two days are deleted from the database.").'</span></p>';
00239 
00240 
00241 }
00242 else
00243 {
00244    # not valid registration, or first time to page
00245 
00246   site_header(array('title'=>_("User account registration"),'context'=>'account'));
00247 
00248 
00249   print form_header($PHP_SELF, $form_id);
00250   print '<p><span class="preinput">'._("Login Name:").'</span><br />&nbsp;&nbsp;';
00251   print form_input("text", "form_loginname", $form_loginname);
00252   print '<br /><span class="text">'.sprintf(_("If you have a %s account use that account name - dont use account name all numerical please."),$GLOBALS['sys_mail_domain']).'</span></p>';
00253 
00254   print '<p><span class="preinput">'._("Password:").'</span><br />&nbsp;&nbsp;';
00255   print form_input("password", "form_pw", $form_pw);
00256   print "</p>";
00257 
00258   print '<p><span class="preinput">'._("Re-type Password:").'</span><br />&nbsp;&nbsp;';
00259   print form_input("password", "form_pw2", $form_pw2);
00260   print "</p>";
00261 
00262   print '<p><span class="preinput">'._("Real Name:").'</span><br />&nbsp;&nbsp;';
00263   print '<input size="30" type="text" name="form_realname" value="'.$form_realname.'" /></p>';
00264 
00265   print '<p><span class="preinput">'._("Email Address:").'</span><br />&nbsp;&nbsp;';
00266   print '<input size="30" type="text" name="form_email" value="'.$form_email.'" />';
00267   print '<br /><span class="text">'._("This email address will be verified before account activation.").'</span></p>';
00268 
00269 
00270   # CERN_SPECIFIC: speech related to AFS
00271   # Extension for PAM authentication
00272   if ($sys_use_pamauth=="yes")
00273     {
00274       print "<p>Instead of providing a new Savannah password you
00275       may choose to authenticate via an <strong>AFS</strong> account you own
00276       at this site (this requires your Savannah login name to be the
00277       same as the AFS account name):";
00278 
00279       print '<p>&nbsp;&nbsp;&nbsp;<INPUT type="checkbox"
00280       name="form_usepam" value="1" > use AFS based authentication';
00281     }
00282   # CERN_SPECIFIC: speech related to AFS
00283 
00284 
00285   print form_footer();
00286 
00287 }
00288 
00289 $HTML->footer(array());
00290 ?>