Skip to content

Xnetevents non x subscription #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
godefv wants to merge 10 commits into
base: master
Choose a base branch
from
Open

Xnetevents non x subscription #26

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
8786f80
xnetevents - draft to allow non x users to subscribe to xnet events
godefv Jan 25, 2017
8b97f15
Rename SQL update script
fishilico Jan 25, 2017
e0e2a7e
Use an option list to select the access control
fishilico Jan 25, 2017
f7fec11
Add XorgSession::logAsUser
fishilico Jan 25, 2017
4fd14b6
Destory session before creating it
fishilico Jan 25, 2017
6fc7a66
xnetevents - allow non x users to subscribe to xnet events
godefv Jan 25, 2017
422fe0d
xnetevents - removed forgotten var_dump
godefv Jan 30, 2017
16c1676
xnetevents - ensured that new non x users from open events have uniqu…
godefv Jan 30, 2017
af8b5c6
xnetevents - avoid user collisions better
godefv Jan 30, 2017
66632e9
xnetevents - improved security for unlogged subscription to events
godefv Jan 30, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 26 additions & 3 deletions modules/xnetevents.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,10 +244,33 @@ function handler_sub($page, $eid = null)

//if we arrived here via a confirmation email, process it
if(Get::has('nom') && Get::has('prenom') && Get::has('email') && Get::has('token')){
if(Get::v('token')!=make_confirmation_token($nom,$prenom,$email)){
if(Get::v('token')!=$this->make_confirmation_token(Get::v('nom'),Get::v('prenom'),Get::v('email'))){
$page->kill('Ce lien n\'est pas valide.');
}
XDB::execute('INSERT INTO accounts SET firstname={?}, lastname={?}, hruid={?}, email={?}', Get::v('prenom'), Get::v('nom'), Get::v('prenom').".".Get::v('nom'), Get::v('email'));

//check if the email address is already registered
$res=XDB::query("SELECT hruid FROM accounts WHERE email={?}", Get::v('email'));
Copy link
Copy Markdown
Member

@fishilico fishilico Jan 30, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We may want to check the email redirections too


if($res->numRows()>0){
//the email address is already registered, use the registered account
$hruid=(string)$res->fetchOneCell();
}else{
//the email address is not registered, create a new user
require_once 'name.func.inc.php';
list($local_part, $domain) = explode('@', strtolower(Get::v('email')));
$firstname=Get::v('prenom');
$lastname=Get::v('nom');
$hruid = User::makeHrid($local_part, $domain, 'ext');
$full_name = build_full_name($firstname, $lastname);
$directory_name = build_directory_name($firstname, $lastname);
$sort_name = build_sort_name($firstname, $lastname);
XDB::execute('INSERT INTO accounts SET firstname={?}, lastname={?}, full_name={?}, directory_name={?}, sort_name={?}, hruid={?}, email={?}, type={?}, state={?}', $firstname, $lastname, $full_name, $directory_name, $sort_name, $hruid, Get::v('email'), "xnet", "active");
Copy link
Copy Markdown
Member

@fishilico fishilico Jan 30, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may break if an hruid already exists for the given email address? User::makeHrid (https://github.com/Polytechnique-org/platal/blob/core/1.1.16/maint/classes/pluser.php#L431) is not injective. For example:

makeHrid("example++test@example.org") == makeHrid("example+test@example.org")

A possible solution would be to add a counter when a collision happens

}
$user=User::get($hruid);
var_dump($user);
if(!Platal::session()->logAsUser($user)){
$page->kill("Authentication failed for $hruid.");
}
}

if (S::logged()) {
Expand Down Expand Up @@ -360,7 +383,7 @@ function handler_sub($page, $eid = null)
$nom=Post::v('nom');
$prenom=Post::v('prenom');
$email=Post::v('email');
$token=make_confirmation_token($nom,$prenom,$email);
$token=$this->make_confirmation_token($nom,$prenom,$email);
$base = $globals->baseurl . '/' . $platal->ns . $globals->asso('diminutif');
$url = "$base/events/sub/$eid?nom=".urlencode($nom)."&prenom=".urlencode($prenom)."&email=".urlencode($email)."&token=$token";

Expand Down