lib/pkp/pages/login/PKPLoginHandler.inc.php

   1 <?php
   2
   3 /**
   4  * @file PKPLoginHandler.inc.php
   5  *
   6  * Copyright (c) 2000-2009 John Willinsky
   7  * Distributed under the GNU GPL v2. For full terms see the file docs/COPYING.
   8  *
   9  * @class PKPLoginHandler
  10  * @ingroup pages_login
  11  *
  12  * @brief Handle login/logout requests.
  13  */
  14
  15 // $Id: PKPLoginHandler.inc.php,v 1.17 2009/09/22 21:18:27 asmecher Exp $
  16
  17
  18 import('handler.Handler');
  19
  20 class PKPLoginHandler extends Handler {
  21
  22         /**
  23          * Display user login form.
  24          * Redirect to user index page if user is already validated.
  25          */
  26         function index() {
  27                 $this->validate();
  28                 $this->setupTemplate();
  29                 if (Validation::isLoggedIn()) {
  30                         PKPRequest::redirect(null, 'user');
  31                 }
  32
  33                 if (Config::getVar('security', 'force_login_ssl') && Request::getProtocol() != 'https') {
  34                         // Force SSL connections for login
  35                         PKPRequest::redirectSSL();
  36                 }
  37
  38                 $sessionManager =& SessionManager::getManager();
  39                 $session =& $sessionManager->getUserSession();
  40
  41                 $templateMgr =& TemplateManager::getManager();
  42
  43                 // If the user wasn't expecting a login page, i.e. if they're new to the
  44                 // site and want to submit a paper, it helps to explain why they need to
  45                 // register.
  46                 if(Request::getUserVar('loginMessage'))
  47                         $templateMgr->assign('loginMessage', Request::getUserVar('loginMessage'));
  48
  49                 $templateMgr->assign('username', $session->getSessionVar('username'));
  50                 $templateMgr->assign('remember', Request::getUserVar('remember'));
  51                 $templateMgr->assign('source', Request::getUserVar('source'));
  52                 $templateMgr->assign('showRemember', Config::getVar('general', 'session_lifetime') > 0);
  53                 $templateMgr->display('user/login.tpl');
  54         }
  55
  56         /**
  57          * Handle login when implicitAuth is enabled.
  58          * If the user came in on a non-ssl url - then redirect back to the ssl url
  59          */
  60         function implicitAuthLogin() {
  61                 if (Request::getProtocol() != 'https')
  62                         PKPRequest::redirectSSL();
  63
  64                 $wayf_url = Config::getVar("security", "implicit_auth_wayf_url");
  65
  66                 if ($wayf_url == "")
  67                         die("Error in implicit authentication. WAYF URL not set in config file.");
  68
  69                 $url = $wayf_url . "?target=https://" . Request::getServerHost() . Request::getBasePath() . '/index.php/index/login/implicitAuthReturn';
  70
  71                 PKPRequest::redirectUrl($url);
  72         }
  73
  74         /**
  75          * This is the function that Shibboleth redirects to - after the user has authenticated.
  76          */
  77         function implicitAuthReturn() {
  78                 $this->validate();
  79
  80                 if (Validation::isLoggedIn()) {
  81                         PKPRequest::redirect(null, 'user');
  82                 }
  83
  84                 // Login - set remember to false
  85                 $user = Validation::login(Request::getUserVar('username'), Request::getUserVar('password'), $reason, false);
  86
  87                 PKPRequest::redirect(null, 'user');
  88         }
  89
  90         /**
  91          * Validate a user's credentials and log the user in.
  92          */
  93         function signIn() {
  94                 $this->validate();
  95                 $this->setupTemplate();
  96                 if (Validation::isLoggedIn()) {
  97                         PKPRequest::redirect(null, 'user');
  98                 }
  99
 100                 if (Config::getVar('security', 'force_login_ssl') && Request::getProtocol() != 'https') {
 101                         // Force SSL connections for login
 102                         PKPRequest::redirectSSL();
 103                 }
 104
 105                 $user = Validation::login(Request::getUserVar('username'), Request::getUserVar('password'), $reason, Request::getUserVar('remember') == null ? false : true);
 106                 if ($user !== false) {
 107                         if (Config::getVar('security', 'force_login_ssl') && !Config::getVar('security', 'force_ssl')) {
 108                                 // Redirect back to HTTP if forcing SSL for login only
 109                                 PKPRequest::redirectNonSSL();
 110
 111                         } else if ($user->getMustChangePassword()) {
 112                                 // User must change their password in order to log in
 113                                 Validation::logout();
 114                                 PKPRequest::redirect(null, null, 'changePassword', $user->getUsername());
 115
 116                         } else {
 117                                 $source = Request::getUserVar('source');
 118                                 if (isset($source) && !empty($source)) {
 119                                         PKPRequest::redirectUrl(Request::getProtocol() . '://' . Request::getServerHost() . $source, false);
 120                                 } else {
 121                                         Request::redirectHome();
 122                                 }
 123                         }
 124
 125                 } else {
 126                         $sessionManager =& SessionManager::getManager();
 127                         $session =& $sessionManager->getUserSession();
 128
 129                         $templateMgr =& TemplateManager::getManager();
 130                         $templateMgr->assign('username', Request::getUserVar('username'));
 131                         $templateMgr->assign('remember', Request::getUserVar('remember'));
 132                         $templateMgr->assign('source', Request::getUserVar('source'));
 133                         $templateMgr->assign('showRemember', Config::getVar('general', 'session_lifetime') > 0);
 134                         $templateMgr->assign('error', $reason===null?'user.login.loginError':($reason===''?'user.login.accountDisabled':'user.login.accountDisabledWithReason'));
 135                         $templateMgr->assign('reason', $reason);
 136                         $templateMgr->display('user/login.tpl');
 137                 }
 138         }
 139
 140         /**
 141          * Log a user out.
 142          */
 143         function signOut() {
 144                 $this->validate();
 145                 $this->setupTemplate();
 146                 if (Validation::isLoggedIn()) {
 147                         Validation::logout();
 148                 }
 149
 150                 $source = Request::getUserVar('source');
 151                 if (isset($source) && !empty($source)) {
 152                         PKPRequest::redirectUrl(Request::getProtocol() . '://' . Request::getServerHost() . $source, false);
 153                 } else {
 154                         PKPRequest::redirect(null, Request::getRequestedPage());
 155                 }
 156         }
 157
 158         /**
 159          * Display form to reset a user's password.
 160          */
 161         function lostPassword() {
 162                 $this->validate();
 163                 $this->setupTemplate();
 164                 $templateMgr =& TemplateManager::getManager();
 165                 $templateMgr->display('user/lostPassword.tpl');
 166         }
 167
 168         /**
 169          * Send a request to reset a user's password
 170          */
 171         function requestResetPassword() {
 172                 $this->validate();
 173                 $this->setupTemplate();
 174                 $templateMgr =& TemplateManager::getManager();
 175
 176                 $email = Request::getUserVar('email');
 177                 $userDao =& DAORegistry::getDAO('UserDAO');
 178                 $user =& $userDao->getUserByEmail($email);
 179
 180                 if ($user == null || ($hash = Validation::generatePasswordResetHash($user->getId())) == false) {
 181                         $templateMgr->assign('error', 'user.login.lostPassword.invalidUser');
 182                         $templateMgr->display('user/lostPassword.tpl');
 183
 184                 } else {
 185                         $site =& Request::getSite();
 186
 187                         // Send email confirming password reset
 188                         import('mail.MailTemplate');
 189                         $mail = new MailTemplate('PASSWORD_RESET_CONFIRM');
 190                         $this->_setMailFrom($mail);
 191                         $mail->assignParams(array(
 192                                 'url' => PKPRequest::url(null, 'login', 'resetPassword', $user->getUsername(), array('confirm' => $hash)),
 193                                 'siteTitle' => $site->getLocalizedTitle()
 194                         ));
 195                         $mail->addRecipient($user->getEmail(), $user->getFullName());
 196                         $mail->send();
 197                         $templateMgr->assign('pageTitle',  'user.login.resetPassword');
 198                         $templateMgr->assign('message', 'user.login.lostPassword.confirmationSent');
 199                         $templateMgr->assign('backLink', PKPRequest::url(null, Request::getRequestedPage()));
 200                         $templateMgr->assign('backLinkLabel',  'user.login');
 201                         $templateMgr->display('common/message.tpl');
 202                 }
 203         }
 204
 205         /**
 206          * Reset a user's password
 207          * @param $args array first param contains the username of the user whose password is to be reset
 208          */
 209         function resetPassword($args) {
 210                 $this->validate();
 211                 $this->setupTemplate();
 212
 213                 $username = isset($args[0]) ? $args[0] : null;
 214                 $userDao =& DAORegistry::getDAO('UserDAO');
 215                 $confirmHash = Request::getUserVar('confirm');
 216
 217                 if ($username == null || ($user =& $userDao->getUserByUsername($username)) == null) {
 218                         PKPRequest::redirect(null, null, 'lostPassword');
 219                         return;
 220                 }
 221
 222                 $templateMgr =& TemplateManager::getManager();
 223
 224                 $hash = Validation::generatePasswordResetHash($user->getId());
 225                 if ($hash == false || $confirmHash != $hash) {
 226                         $templateMgr->assign('errorMsg', 'user.login.lostPassword.invalidHash');
 227                         $templateMgr->assign('backLink', PKPRequest::url(null, null, 'lostPassword'));
 228                         $templateMgr->assign('backLinkLabel',  'user.login.resetPassword');
 229                         $templateMgr->display('common/error.tpl');
 230
 231                 } else {
 232                         // Reset password
 233                         $newPassword = Validation::generatePassword();
 234
 235                         if ($user->getAuthId()) {
 236                                 $authDao =& DAORegistry::getDAO('AuthSourceDAO');
 237                                 $auth =& $authDao->getPlugin($user->getAuthId());
 238                         }
 239
 240                         if (isset($auth)) {
 241                                 $auth->doSetUserPassword($user->getUsername(), $newPassword);
 242                                 $user->setPassword(Validation::encryptCredentials($user->getId(), Validation::generatePassword())); // Used for PW reset hash only
 243                         } else {
 244                                 $user->setPassword(Validation::encryptCredentials($user->getUsername(), $newPassword));
 245                         }
 246
 247                         $user->setMustChangePassword(1);
 248                         $userDao->updateObject($user);
 249
 250                         // Send email with new password
 251                         $site =& Request::getSite();
 252                         import('mail.MailTemplate');
 253                         $mail = new MailTemplate('PASSWORD_RESET');
 254                         $this->_setMailFrom($mail);
 255                         $mail->assignParams(array(
 256                                 'username' => $user->getUsername(),
 257                                 'password' => $newPassword,
 258                                 'siteTitle' => $site->getLocalizedTitle()
 259                         ));
 260                         $mail->addRecipient($user->getEmail(), $user->getFullName());
 261                         $mail->send();
 262                         $templateMgr->assign('pageTitle',  'user.login.resetPassword');
 263                         $templateMgr->assign('message', 'user.login.lostPassword.passwordSent');
 264                         $templateMgr->assign('backLink', PKPRequest::url(null, Request::getRequestedPage()));
 265                         $templateMgr->assign('backLinkLabel',  'user.login');
 266                         $templateMgr->display('common/message.tpl');
 267                 }
 268         }
 269
 270         /**
 271          * Display form to change user's password.
 272          * @param $args array first argument may contain user's username
 273          */
 274         function changePassword($args = array()) {
 275                 $this->validate();
 276                 $this->setupTemplate();
 277
 278                 import('user.form.LoginChangePasswordForm');
 279
 280                 $passwordForm = new LoginChangePasswordForm();
 281                 $passwordForm->initData();
 282                 if (isset($args[0])) {
 283                         $passwordForm->setData('username', $args[0]);
 284                 }
 285                 $passwordForm->display();
 286         }
 287
 288         /**
 289          * Save user's new password.
 290          */
 291         function savePassword() {
 292                 $this->validate();
 293                 $this->setupTemplate();
 294
 295                 import('user.form.LoginChangePasswordForm');
 296
 297                 $passwordForm = new LoginChangePasswordForm();
 298                 $passwordForm->readInputData();
 299
 300                 if ($passwordForm->validate()) {
 301                         if ($passwordForm->execute()) {
 302                                 $user = Validation::login($passwordForm->getData('username'), $passwordForm->getData('password'), $reason);
 303                         }
 304                         PKPRequest::redirect(null, 'user');
 305
 306                 } else {
 307                         $passwordForm->display();
 308                 }
 309         }
 310
 311         /**
 312          * Helper function - set mail From
 313          * can be overriden by child classes
 314          * @param MailTemplate $mail
 315          */
 316         function _setMailFrom(&$mail) {
 317                 $site =& Request::getSite();
 318                 $mail->setFrom($site->getLocalizedContactEmail(), $site->getLocalizedContactName());
 319                 return true;
 320         }
 321 }
 322
 323 ?>