| <?php require_once($_SERVER['DOCUMENT_ROOT'] . "/eclipse.org-common/system/app.class.php"); require_once($_SERVER['DOCUMENT_ROOT'] . "/eclipse.org-common/system/nav.class.php"); require_once($_SERVER['DOCUMENT_ROOT'] . "/eclipse.org-common/system/menu.class.php"); $App = new App(); $Nav = new Nav(); $Menu = new Menu(); include("_projectCommon.php"); # All on the same line to unclutter the user's desktop' |
| /******************************************************************************* |
| * Copyright (c) 2012 Eclipse Foundation and others. |
| * All rights reserved. This program and the accompanying materials |
| * are made available under the terms of the Eclipse Public License v1.0 |
| * which accompanies this distribution, and is available at |
| * http://www.eclipse.org/legal/epl-v10.html |
| * |
| * Contributors: |
| * Denis Roy (Eclipse Foundation)- initial API and implementation |
| *******************************************************************************/ |
| $App->preventCaching(); |
| |
| $pageTitle = "Eclipse.org account"; |
| $pageKeywords = "eclipse,friends,login,account,signon,sign-on,register"; |
| $pageAuthor = "Eclipse Foundation, Inc."; |
| header("Content-type: text/html; charset=utf-8"); |
| header("Cache-Control: no-cache, must-revalidate"); |
| |
| $username = $App->getHTTPParameter("username", "POST"); |
| $submit = $App->getHTTPParameter("submit", "POST"); |
| $fname = $App->getHTTPParameter("fname", "POST"); |
| $lname = $App->getHTTPParameter("lname", "POST"); |
| $password1 = $App->getHTTPParameter("password1", "POST"); |
| $password2 = $App->getHTTPParameter("password2", "POST"); |
| $skill = $App->getHTTPParameter("skill", "POST"); |
| $agree = $App->getHTTPParameter("agree", "POST"); |
| $stage = $App->getHTTPParameter("stage"); |
| $token = $App->getHTTPParameter("t"); |
| $p = $App->getHTTPParameter("p"); |
| |
| $error = ""; |
| $reset_error = ""; |
| |
| |
| # Sanitize for XSS |
| $username = preg_replace($xss_patterns, '', $username); |
| $fname = preg_replace($name_regexp, '', $fname); |
| $lname = preg_replace($name_regexp, '', $lname); |
| $password1 = preg_replace($xss_patterns, '', $password1); |
| $password2 = preg_replace($xss_patterns, '', $password2); |
| $token = preg_replace("/[^a-zA-Z0-9]/", "", $token); |
| |
| if($token != "" && $stage == "") { |
| $stage = "confirm"; |
| } |
| |
| if($token != "" && $p == "p") { |
| $stage = "reset2"; |
| } |
| if($token != "" && $password1 != "") { |
| $stage = "reset3"; |
| } |
| |
| $includefile = "content/en_" . $App->getScriptName(); |
| if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) { |
| $password1 = stripslashes($password1); |
| } |
| |
| require_once($_SERVER['DOCUMENT_ROOT'] . "/eclipse.org-common/classes/friends/friend.class.php"); |
| require_once($_SERVER['DOCUMENT_ROOT'] . "/eclipse.org-common/system/session.class.php"); |
| require_once '/home/data/httpd/eclipse-php-classes/system/ldapconnection.class.php'; |
| $Friend = new Friend(); |
| |
| if($stage == "create") { |
| if($username != "" && $fname != "" && $lname != "" && $password1 != "") { |
| # Create an account. Check to ensure this IP address hasn't flooded us with requests |
| # or that this email address doesn't already have an account |
| $SQL = "SELECT /* USE MASTER */ COUNT(1) AS RecordCount FROM account_requests WHERE ip = " . $App->returnQuotedString($_SERVER['REMOTE_ADDR']); |
| $rs = $App->eclipse_sql($SQL); |
| $myrow = mysql_fetch_assoc($rs); |
| if($myrow['RecordCount'] >= 25) { |
| $error = "<b>You have already submitted a request. Please check your email inbox and spam folders to respond to the previous request.</b> (8723s)"; |
| } |
| else { |
| $error = "<b>An unknown error has ocurred. Please try later."; |
| # Check LDAP |
| $ldap = new LDAPConnection(); |
| if(! $ldap->checkEmailAvailable($username)) { |
| $error = "<b>That account already exists. If you cannot remember your password, please use the password reset option below.</b> (8725s)"; |
| # Jot this down to avoid repetitively polling ldap |
| $App->eclipse_sql("INSERT INTO account_requests VALUES (" . $App->returnQuotedString($App->sqlSanitize($username)) . ", |
| '', |
| " . $App->returnQuotedString($App->sqlSanitize($fname)) . ", |
| " . $App->returnQuotedString($App->sqlSanitize($lname)) . ", |
| '', |
| " . $App->returnQuotedString($_SERVER['REMOTE_ADDR']) . ", |
| NOW(), |
| " . $App->returnQuotedString("CREATE_FAILED") . ")"); |
| |
| $EventLog = new EvtLog(); |
| $EventLog->setLogTable("__ldap"); |
| $EventLog->setPK1($username); |
| $EventLog->setPK2($_SERVER['REMOTE_ADDR']); |
| $EventLog->setLogAction("ACCT_CREATE_ALREADY_EXISTS"); |
| $EventLog->insertModLog("apache"); |
| } |
| else { |
| $error = ""; |
| if($agree != 1) { |
| $error .= "- You must agree to the terms and contitions of use<br />"; |
| } |
| |
| if(!preg_match($email_regexp, $username)) { |
| $error .= "- Your email address is not formatted correctly<br />"; |
| } |
| |
| if($skill != 16) { |
| $error .= "- You haven't answered the mathematical question correctly<br />"; |
| } |
| if(!preg_match("/(?=^.{6,}$)(?=.*[\d|\W])(?=.*[A-Za-z]).*$/", $password1)) { |
| $error .= "- Your password does not meet the complexity requirements. It must be at least 6 characters long, and contain one number or one symbol.<br />"; |
| } |
| |
| # Houston, we have a problem. |
| if($error != "") { |
| $error = "<b>Your request could not be processed for the following reason(s):<br/>" . $error . "</b>"; |
| } |
| else { |
| # Add request to database |
| $token = $App->getAlphaCode(64); |
| mysql_set_charset('utf8'); |
| $App->eclipse_sql("INSERT INTO account_requests VALUES (" . $App->returnQuotedString($App->sqlSanitize(trim($username))) . ", |
| '', |
| " . $App->returnQuotedString($App->sqlSanitize(trim($fname))) . ", |
| " . $App->returnQuotedString($App->sqlSanitize(trim($lname))) . ", |
| '" . $App->sqlSanitize($password1) . "', |
| " . $App->returnQuotedString($_SERVER['REMOTE_ADDR']) . ", |
| NOW(), |
| " . $App->returnQuotedString($token) . ")"); |
| |
| $EventLog = new EvtLog(); |
| $EventLog->setLogTable("__ldap"); |
| $EventLog->setPK1($token); |
| $EventLog->setPK2($_SERVER['REMOTE_ADDR']); |
| $EventLog->setLogAction("ACCT_CREATE_REQ_SUCCESS"); |
| $EventLog->insertModLog($username); |
| |
| # Send mail to dest |
| $mail = "Dear $fname,\n\n"; |
| $mail .= "Thank you for registering for an account at Eclipse.org. Before we can activate your account one last step must be taken to complete your registration.\n\n"; |
| $mail .= "To complete your registration, please visit this URL:\nhttps://dev.eclipse.org/site_login/r.php?t=$token\n\n"; |
| $mail .= "Your Username is: $username\n\n"; |
| $mail .= "If you have any problems signing up please contact webmaster@eclipse.org\n\n"; |
| $mail .= " -- Eclipse webmaster\n"; |
| $headers = 'From: Eclipse Webmaster (automated) <webmaster@eclipse.org>' . "\n" . 'Content-Type: text/plain; charset=UTF-8'; |
| mail($username, "Eclipse Account Registration", $mail, $headers); |
| |
| $includefile = "content/en_createsuccess.php"; |
| } |
| } |
| ldap_close($ds); |
| } |
| } |
| else { |
| $error = "An error occurred while processing your request. Please ensure that all the required fields are entered correctly and try again. (8726s)"; |
| } |
| } |
| if($stage == "reset") { |
| # reset stage 1. We got an email address, create token and email to user |
| # make sure someone isn't blasting us. We disregard "token failed" since a common use-case |
| # is to click the reset link after it has expired. |
| $SQL = "SELECT /* USE MASTER */ COUNT(1) AS RecordCount FROM account_requests WHERE token <> 'TOKEN_FAILED' AND fname = 'RESET' AND lname = 'RESET' AND ip = " . $App->returnQuotedString($_SERVER['REMOTE_ADDR']); |
| $rs = $App->eclipse_sql($SQL); |
| $myrow = mysql_fetch_assoc($rs); |
| if($myrow['RecordCount'] >= 13) { |
| $error = "<b>We were unable to determine your identity after several attempts. Subsequent inquiries will be ignored for our protection. Please try later, or contact webmaster@eclipse.org for support.</b> (8727s)"; |
| $includefile = "content/en_reset_error.php"; |
| } |
| else { |
| # Check to see if we're trying to reset the password of a valid account. |
| $ldap = new LDAPConnection(); |
| $token = $App->getAlphaCode(64); |
| $App->eclipse_sql("INSERT IGNORE INTO account_requests VALUES (" . $App->returnQuotedString($App->sqlSanitize($username)) . ", |
| '', |
| " . $App->returnQuotedString("RESET") . ", |
| " . $App->returnQuotedString("RESET") . ", |
| '" . $App->sqlSanitize($password1) . "', |
| " . $App->returnQuotedString($_SERVER['REMOTE_ADDR']) . ", |
| NOW(), |
| " . $App->returnQuotedString($token) . ")"); |
| |
| if(!preg_match($email_regexp, $username)) { |
| $reset_error = "<b>Your email address is not formatted correctly.</b><br />"; |
| } |
| elseif($ldap->checkEmailAvailable($username)) { |
| $reset_error = "<b>We were unable to determine your identity with the information you've supplied.</b> Perhaps you don't have an Eclipse.org account, or your account is under a different email address.(8x27s)"; |
| } |
| else { |
| # Send mail to dest |
| $mail = "You (or someone pretending to be you) has requested a password reset from:\n"; |
| $mail .= " " . $_SERVER['REMOTE_ADDR'] . "\n\n"; |
| $mail .= "To change your password, please visit this URL:\nhttps://dev.eclipse.org/site_login/p.php?t=$token\n\n"; |
| $mail .= "If you have not requested this change, you can safely let it expire. If you have any problems signing in please contact webmaster@eclipse.org\n\n"; |
| $mail .= " -- Eclipse webmaster\n"; |
| $headers = 'From: Eclipse Webmaster (automated) <webmaster@eclipse.org>'; |
| mail($username, "Eclipse Account Password Reset", $mail, $headers); |
| $pageTitle = "Password reset"; |
| $includefile = "content/en_reset.php"; |
| |
| $EventLog = new EvtLog(); |
| $EventLog->setLogTable("__ldap"); |
| $EventLog->setPK1($token); |
| $EventLog->setPK2($_SERVER['REMOTE_ADDR']); |
| $EventLog->setLogAction("PASSWD_RESET_REQ"); |
| $EventLog->insertModLog($username); |
| } |
| } |
| } |
| if($stage == "reset2") { |
| # reset stage 2. We got an token back. If we find a record, allow user to reset password, then proceed to stage3 |
| $includefile = "content/en_reset.php"; |
| if($token != "") { |
| $SQL = "SELECT /* USE MASTER */ email, COUNT(1) AS RecordCount FROM account_requests WHERE token = " . $App->returnQuotedString($App->sqlSanitize($token)); |
| $rs = $App->eclipse_sql($SQL); |
| $myrow = mysql_fetch_assoc($rs); |
| if($myrow['RecordCount'] <= 0) { |
| $error = "<b>The supplied reset token is invalid; perhaps it has expired? Please wait 5 minutes and try to <a href='createaccount.php'>reset your password again</a>. If the problem persits, please contact webmaster@eclipse.org.</b> (8129rs)"; |
| $includefile = "content/en_reset_error.php"; |
| # If we can't find a record, insert a record preventing this dude from bombing us |
| $token = $App->getAlphaCode(64); |
| $App->eclipse_sql("INSERT INTO account_requests VALUES (" . $App->returnQuotedString($App->sqlSanitize($token)) . ", |
| '', |
| 'token_failed', |
| 'token_failed', |
| 'token_failed', |
| " . $App->returnQuotedString($_SERVER['REMOTE_ADDR']) . ", |
| NOW(), |
| 'TOKEN_FAILED')" |
| ); |
| } |
| else { |
| # display password reset page. |
| $includefile = "content/en_reset.php"; |
| $EventLog = new EvtLog(); |
| $EventLog->setLogTable("__ldap"); |
| $EventLog->setPK1($token); |
| $EventLog->setPK2($_SERVER['REMOTE_ADDR']); |
| $EventLog->setLogAction("PASSWD_RESET_CONF"); |
| $EventLog->insertModLog($myrow['email']); |
| # Update this row, change IP address to reflect that of the person who successfully confirmed this email to avoid bombing |
| # $SQL = "UPDATE account_requests SET token = 'CONFIRM_SUCCESS', ip = " . $App->returnQuotedString($App->sqlSanitize($_SERVER['REMOTE_ADDR'])) |
| # . " WHERE token = " . $App->returnQuotedString($App->sqlSanitize($token)); |
| #$rs = $App->eclipse_sql($SQL); |
| } |
| } |
| } |
| if($stage == "reset3") { |
| # reset stage 3. We got a token back, and user is submitting a password. |
| $includefile = "content/en_reset.php"; |
| if($token != "" && $password1 != "") { |
| $SQL = "SELECT /* USE MASTER */ email, COUNT(1) AS RecordCount FROM account_requests WHERE token = " . $App->returnQuotedString($App->sqlSanitize($token)); |
| $rs = $App->eclipse_sql($SQL); |
| $myrow = mysql_fetch_assoc($rs); |
| if($myrow['RecordCount'] <= 0) { |
| $error = "<b>We were unable to validate your request. The supplied token is invalid; perhaps it has expired? Please try to <a href='createaccount.php'>reset your password again</a>. If the problem persits, please contact webmaster@eclipse.org.</b> (8329rs)"; |
| # If we can't find a record, insert a record preventing this dude from bombing us |
| $token = $App->getAlphaCode(64); |
| $App->eclipse_sql("INSERT INTO account_requests VALUES (" . $App->returnQuotedString($App->sqlSanitize($token)) . ", |
| '', |
| 'token_failed', |
| 'token_failed', |
| 'token_failed', |
| " . $App->returnQuotedString($_SERVER['REMOTE_ADDR']) . ", |
| NOW(), |
| 'TOKEN_FAILED')" |
| ); |
| } |
| else { |
| if(!preg_match("/(?=^.{6,}$)(?=.*\d)(?=.*[A-Za-z]).*$/", $password1)) { |
| $error .= "- Your password does not meet the complexity requirements<br />"; |
| } |
| else { |
| # Update this row, change IP address to reflect that of the person who successfully confirmed this password to avoid bombing |
| $SQL = "UPDATE account_requests SET token = 'PASSWORD_SUCCESS', password='" . $App->sqlSanitize($password1) . "', ip = " . $App->returnQuotedString($App->sqlSanitize($_SERVER['REMOTE_ADDR'])) |
| . " WHERE token = " . $App->returnQuotedString($App->sqlSanitize($token)); |
| $rs = $App->eclipse_sql($SQL); |
| |
| $bzpass = &generateBugzillaSHA256Password($password1); |
| $SQL = "UPDATE profiles SET cryptpassword='" . $App->sqlSanitize($bzpass) . "' WHERE login_name = " . $App->returnQuotedString($App->sqlSanitize($myrow['email'])) . " LIMIT 1"; |
| $App->bugzilla_sql($SQL); |
| $App->ipzilla_sql($SQL); |
| |
| $EventLog = new EvtLog(); |
| $EventLog->setLogTable("__ldap"); |
| $EventLog->setPK1($token); |
| $EventLog->setPK2($_SERVER['REMOTE_ADDR']); |
| $EventLog->setLogAction("PASSWD_RESET_SUCCESS"); |
| $EventLog->insertModLog($myrow['email']); |
| } |
| } |
| } |
| } |
| if($stage == "confirm") { |
| $includefile = "content/en_confirm.php"; |
| $SQL = "SELECT /* USE MASTER */ COUNT(1) AS RecordCount FROM account_requests WHERE token IN ('TOKEN_FAILED', 'CONFIRM_SUCCESS') AND ip = " . $App->returnQuotedString($_SERVER['REMOTE_ADDR']); |
| $rs = $App->eclipse_sql($SQL); |
| $myrow = mysql_fetch_assoc($rs); |
| if($myrow['RecordCount'] > 0) { |
| $error = "<b>You have already submitted a request. Please check your email inbox and spam folders to respond to the previous request.</b> (8728s)"; |
| } |
| else { |
| if($token != "") { |
| $SQL = "SELECT /* USE MASTER */ email, COUNT(1) AS RecordCount FROM account_requests WHERE token = " . $App->returnQuotedString($App->sqlSanitize($token)); |
| $rs = $App->eclipse_sql($SQL); |
| $myrow = mysql_fetch_assoc($rs); |
| if($myrow['RecordCount'] <= 0) { |
| $error = "<b>We were unable to validate your request. The supplied token is invalid; perhaps it has expired? Please try creating your account again, and contact webmaster@eclipse.org if the problem persists.</b> (8729s)"; |
| # If we can't find a record, insert a record preventing this dude from bombing us |
| $token = $App->getAlphaCode(64); |
| $App->eclipse_sql("INSERT INTO account_requests VALUES (" . $App->returnQuotedString($App->sqlSanitize($token)) . ", |
| '', |
| 'token_failed', |
| 'token_failed', |
| 'token_failed', |
| " . $App->returnQuotedString($_SERVER['REMOTE_ADDR']) . ", |
| NOW(), |
| 'TOKEN_FAILED')" |
| ); |
| $EventLog = new EvtLog(); |
| $EventLog->setLogTable("__ldap"); |
| $EventLog->setPK1($App->sqlSanitize($token)); |
| $EventLog->setPK2($_SERVER['REMOTE_ADDR']); |
| $EventLog->setLogAction("ACCT_CREATE_TOKEN_FAILED"); |
| $EventLog->insertModLog("apache"); |
| } |
| else { |
| # Update this row, change IP address to reflect that of the person who successfully confirmed this email to avoid bombing |
| $SQL = "UPDATE account_requests SET token = 'CONFIRM_SUCCESS', ip = " . $App->returnQuotedString($App->sqlSanitize($_SERVER['REMOTE_ADDR'])) |
| . " WHERE token = " . $App->returnQuotedString($App->sqlSanitize($token)); |
| $rs = $App->eclipse_sql($SQL); |
| |
| $EventLog = new EvtLog(); |
| $EventLog->setLogTable("__ldap"); |
| $EventLog->setPK1($App->sqlSanitize($token)); |
| $EventLog->setPK2($_SERVER['REMOTE_ADDR']); |
| $EventLog->setLogAction("ACCT_CREATE_CONFIRM_SUCCESS"); |
| $EventLog->insertModLog($myrow['email']); |
| } |
| } |
| else { |
| $error = "<b>We were unable to validate your request. The supplied token is invalid. Please contact webmaster@eclipse.org.</b>"; |
| } |
| } |
| } |
| |
| include($includefile); |
| # Generate the web page |
| $App->generatePage($theme, $Menu, $Nav, $pageAuthor, $pageKeywords, $pageTitle, $html); |
| |
| function generatePassword($_num_chars) { |
| global $App; |
| $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1023456789,.;:/@#$%^&*()-_=+"; |
| srand((double)microtime()*1000000); |
| $loopcount = 0; |
| $rValue = ""; |
| while (!preg_match("/(?=^.{6,}$)(?=.*\d)(?=.*[A-Za-z]).*$/", $rValue)) { |
| $rValue = ""; |
| $i = 0; |
| $loopcount++; |
| srand((double)microtime()*1000000); |
| while ($i <= $_num_chars) { |
| $num = rand() % strlen($chars); |
| $rValue .= substr($chars, $num, 1); |
| $i++; |
| } |
| # antilooper |
| if($loopcount > 1000) { |
| $rValue = "aA1$" . $App->getAlphaCode(4); |
| } |
| } |
| return $rValue; |
| } |
| |
| |
| ?> |
