Prevent same user to make the same request again Signed-off-by: Eric Poirier <eric@eclipse.org>
diff --git a/eclipse.org-common/classes/users/siteLogin.class.php b/eclipse.org-common/classes/users/siteLogin.class.php index d7f5875..364f30d 100644 --- a/eclipse.org-common/classes/users/siteLogin.class.php +++ b/eclipse.org-common/classes/users/siteLogin.class.php
@@ -426,7 +426,10 @@ } private function _confirmAccount() { - $sql = "SELECT /* USE MASTER */ COUNT(1) AS RecordCount FROM account_requests WHERE token IN ('TOKEN_FAILED', 'CONFIRM_SUCCESS') AND ip = " . $this->App->returnQuotedString($_SERVER['REMOTE_ADDR']); + $sql = "SELECT /* USE MASTER */ COUNT(1) AS RecordCount + FROM account_requests + WHERE token IN ('TOKEN_FAILED', 'CONFIRM_SUCCESS') + AND ip = " . $this->App->returnQuotedString($_SERVER['REMOTE_ADDR']); $rs = $this->App->eclipse_sql($sql); $myrow = mysql_fetch_assoc($rs); if ($myrow['RecordCount'] > 0) { @@ -505,15 +508,35 @@ mail('webmaster@eclipse.org', "Denied Account: Possible spammer", $mail, $headers); return FALSE; } - # Create an account. Check to ensure this IP address hasn't flooded us with requests - # or that this email address doesn't already have an account - $sql = "SELECT /* USE MASTER */ COUNT(1) AS RecordCount FROM account_requests WHERE ip = " . $this->App->returnQuotedString($_SERVER['REMOTE_ADDR']); + + // Select entries that are only created on an account creation + $sql = "SELECT /* USE MASTER */ email + FROM account_requests + WHERE ip = " . $this->App->returnQuotedString($_SERVER['REMOTE_ADDR']) . " + AND fname NOT IN ('MAILCHANGE','RESET') + AND lname NOT IN ('MAILCHANGE','RESET') + AND password = '' + AND new_email = '' + AND token NOT IN ('CLA_SIGNED','CLA_INVALIDATED','TOKEN_FAILED')"; $rs = $this->App->eclipse_sql($sql); - $myrow = mysql_fetch_assoc($rs); - if ($myrow['RecordCount'] >= 25) { + + $list_of_emails = array(); + while ($row = mysql_fetch_array($rs)) { + $list_of_emails[] = $row['email']; + } + + // Check if there are more than 25 request coming from the same ip address + if (count($list_of_emails) >= 25) { $this->messages['create']['danger'][] = "You have already submitted a request. Please check your email inbox and spam folders to respond to the previous request. (8723s)"; } - else { + + // Check if there are more than one request from the same email address + if (!empty($list_of_emails) && in_array($this->username, $list_of_emails)) { + $this->messages['create']['danger'][] = "You have already submitted a request. Please check your email inbox and spam folders to respond to the previous request. (8724s)"; + } + + // If there are no errors, we can insert in the account_request table + if (empty($this->messages['create']['danger'])) { # Check LDAP if(!$this->Ldapconn->checkEmailAvailable($this->username)) { $this->messages['create']['danger'][] = "That account already exists. If you cannot remember your password, please use the password reset option below. (8725s)"; @@ -1002,15 +1025,29 @@ $this->messages['myaccount']['danger'][] = "- Your email address is not formatted correctly<br />"; } else { - # Check that someone isn't piling on a bunch of requests for mail changes just to piss everyone off - $sql = "SELECT /* USE MASTER */ COUNT(1) AS RecordCount FROM account_requests WHERE ip = " . $this->App->returnQuotedString($_SERVER['REMOTE_ADDR']); - $sql .= "OR email = " . $this->App->returnQuotedString($oldmail); + $sql = "SELECT /* USE MASTER */ email + FROM account_requests + WHERE ip = " . $this->App->returnQuotedString($_SERVER['REMOTE_ADDR']) . " + AND fname = 'MAILCHANGE' + AND lname = 'MAILCHANGE'"; $rs = $this->App->eclipse_sql($sql); - $myrow = mysql_fetch_assoc($rs); - if ($myrow['RecordCount'] > 3) { + + $list_of_emails = array(); + while ($row = mysql_fetch_array($rs)) { + $list_of_emails[] = $row['email']; + } + + // Check if there are more than 3 request coming from the same ip address + if (count($list_of_emails) > 3) { $this->messages['myaccount']['danger'][] = "<b>You have already submitted a request. Please check your email inbox and spam folders to respond to the previous request.</b>"; } - else { + + // Check if there are more than one request from the same email address + if (!empty($list_of_emails) && in_array($this->username, $list_of_emails)) { + $this->messages['myaccount']['danger'][] = "<b>You have already submitted a request. Please check your email inbox and spam folders to respond to the previous request.</b>"; + } + + if (empty($this->messages['myaccount']['danger'])) { # Toss in a request to change the email address $this->messages['myaccount']['success'][] = " Please check your Inbox for a confirmation email with instructions to complete the email address change. Your email address will not be updated until the process is complete."; $this->t = $this->t = $this->App->getAlphaCode(64); @@ -1037,7 +1074,8 @@ $this->_sendNotice("Email address","from: " . $oldmail . " to: " . $this->username ); } } - } else if ($this->is_committer && $this->changed_employer === "") { + } + else if ($this->is_committer && $this->changed_employer === "") { $this->messages['myaccount']['danger'][] = "You must indicate if you have changed employers in order to save changes to your email address."; return; } @@ -1068,53 +1106,73 @@ # reset stage 1. We got an email address, create token and email to user # make sure someone isn't blasting us. We disregard "token failed" since a common use-case # is to click the reset link after it has expired. - $sql = "SELECT /* USE MASTER */ COUNT(1) AS RecordCount FROM account_requests WHERE token <> 'TOKEN_FAILED' AND fname = 'RESET' AND lname = 'RESET' AND ip = " . $this->App->returnQuotedString($_SERVER['REMOTE_ADDR']); + $sql = "SELECT /* USE MASTER */ email + FROM account_requests + WHERE token <> 'TOKEN_FAILED' + AND fname = 'RESET' + AND lname = 'RESET' + AND ip = " . $this->App->returnQuotedString($_SERVER['REMOTE_ADDR']); $rs = $this->App->eclipse_sql($sql); - $myrow = mysql_fetch_assoc($rs); - if ($myrow['RecordCount'] >= 13) { + + $list_of_emails = array(); + while ($row = mysql_fetch_array($rs)) { + $list_of_emails[] = $row['email']; + } + + // Check if a valid email has been provided + if (!preg_match(SITELOGIN_EMAIL_REGEXP, $this->username)) { + $this->messages['reset']['danger'][] = "<b>Your email address is not formatted correctly.</b><br />"; + } + + // Check if the provided email is in LDAP + if ($this->Ldapconn->checkEmailAvailable($this->username)) { + $this->messages['reset']['danger'][] = "<b>We were unable to determine your identity with the information you've supplied.</b> Perhaps you don't have an Eclipse.org account, or your account is under a different email address.(8x27s)"; + } + + // Check if there are more than 13 request coming from the same ip address + if (count($list_of_emails) >= 13) { $this->messages['reset']['danger'][] = "<b>We were unable to determine your identity after several attempts. Subsequent inquiries will be ignored for our protection. Please try later, or contact webmaster@eclipse.org for support.</b> (8727s)"; } - else { - if (!preg_match(SITELOGIN_EMAIL_REGEXP, $this->username)) { - $this->messages['reset']['danger'][] = "<b>Your email address is not formatted correctly.</b><br />"; - } - elseif ($this->Ldapconn->checkEmailAvailable($this->username)) { - $this->messages['reset']['danger'][] = "<b>We were unable to determine your identity with the information you've supplied.</b> Perhaps you don't have an Eclipse.org account, or your account is under a different email address.(8x27s)"; - } - else { - # Check to see if we're trying to reset the password of a valid account. - $this->t = $this->App->getAlphaCode(64); - $this->App->eclipse_sql("INSERT IGNORE INTO account_requests VALUES (" . $this->App->returnQuotedString($this->App->sqlSanitize($this->username)) . ", - '', - " . $this->App->returnQuotedString("RESET") . ", - " . $this->App->returnQuotedString("RESET") . ", - '', - " . $this->App->returnQuotedString($_SERVER['REMOTE_ADDR']) . ", - NOW(), - " . $this->App->returnQuotedString($this->t) . ")"); - # Send mail to dest - $mail = "You (or someone pretending to be you) has requested a password reset from:\n"; - $mail .= " " . $_SERVER['REMOTE_ADDR'] . "\n\n"; - $mail .= "To change your password, please visit this URL:\nhttps://dev.eclipse.org/site_login/token.php?p=p&t=$this->t\n\n"; - $mail .= "If you have not requested this change, you can safely let it expire. If you have any problems signing in please contact webmaster@eclipse.org\n\n"; - $mail .= " -- Eclipse webmaster\n"; - $headers = 'From: Eclipse Webmaster (automated) <webmaster@eclipse.org>'; - mail($this->username, "Eclipse Account Password Reset", $mail, $headers); - $this->messages['reset']['success'][] = '<strong>Password Recovery:</strong> A token has been emailed to you to allow - you to reset your Eclipse.org password. Please check your Trash and Junk/Spam - folders if you do not see this email in your inbox.'; + // Check if there are more than one request from the same email address + if (!empty($list_of_emails) && in_array($this->username, $list_of_emails)) { + $this->messages['reset']['danger'][] = "<b>There's already a reset password request associated to this email address. Please try later, or contact webmaster@eclipse.org for support.</b> (8728s)"; + } - # Debug - //print $mail; + // If there are no errors we can proceed + if (empty($this->messages['reset']['danger'])) { + # Check to see if we're trying to reset the password of a valid account. + $this->t = $this->App->getAlphaCode(64); + $this->App->eclipse_sql("INSERT IGNORE INTO account_requests VALUES (" . $this->App->returnQuotedString($this->App->sqlSanitize($this->username)) . ", + '', + " . $this->App->returnQuotedString("RESET") . ", + " . $this->App->returnQuotedString("RESET") . ", + '', + " . $this->App->returnQuotedString($_SERVER['REMOTE_ADDR']) . ", + NOW(), + " . $this->App->returnQuotedString($this->t) . ")"); - $EventLog = new EvtLog(); - $EventLog->setLogTable("__ldap"); - $EventLog->setPK1($this->t); - $EventLog->setPK2($_SERVER['REMOTE_ADDR']); - $EventLog->setLogAction("PASSWD_RESET_REQ"); - $EventLog->insertModLog($this->username); - } + # Send mail to dest + $mail = "You (or someone pretending to be you) has requested a password reset from:\n"; + $mail .= " " . $_SERVER['REMOTE_ADDR'] . "\n\n"; + $mail .= "To change your password, please visit this URL:\nhttps://dev.eclipse.org/site_login/token.php?p=p&t=$this->t\n\n"; + $mail .= "If you have not requested this change, you can safely let it expire. If you have any problems signing in please contact webmaster@eclipse.org\n\n"; + $mail .= " -- Eclipse webmaster\n"; + $headers = 'From: Eclipse Webmaster (automated) <webmaster@eclipse.org>'; + mail($this->username, "Eclipse Account Password Reset", $mail, $headers); + $this->messages['reset']['success'][] = '<strong>Password Recovery:</strong> A token has been emailed to you to allow + you to reset your Eclipse.org password. Please check your Trash and Junk/Spam + folders if you do not see this email in your inbox.'; + + # Debug + //print $mail; + + $EventLog = new EvtLog(); + $EventLog->setLogTable("__ldap"); + $EventLog->setPK1($this->t); + $EventLog->setPK2($_SERVER['REMOTE_ADDR']); + $EventLog->setLogAction("PASSWD_RESET_REQ"); + $EventLog->insertModLog($this->username); } }