[Mapbender-commits] r10381 - in trunk/mapbender/http: classes frames php
svn_mapbender at osgeo.org
svn_mapbender at osgeo.org
Fri Dec 20 02:44:14 PST 2019
Author: hollsandre
Date: 2019-12-20 02:44:14 -0800 (Fri, 20 Dec 2019)
New Revision: 10381
Modified:
trunk/mapbender/http/classes/class_user.php
trunk/mapbender/http/frames/login.php
trunk/mapbender/http/php/mod_activateUserAccount.php
Log:
deactivate account after five wrong password inputs and send reactivation email
Modified: trunk/mapbender/http/classes/class_user.php
===================================================================
--- trunk/mapbender/http/classes/class_user.php 2019-12-19 13:39:39 UTC (rev 10380)
+++ trunk/mapbender/http/classes/class_user.php 2019-12-20 10:44:14 UTC (rev 10381)
@@ -1,8 +1,8 @@
<?php
# License:
# Copyright (c) 2009, Open Source Geospatial Foundation
-# This program is dual licensed under the GNU General Public License
-# and Simplified BSD license.
+# This program is dual licensed under the GNU General Public License
+# and Simplified BSD license.
# http://svn.osgeo.org/mapbender/trunk/mapbender/license/license.txt
require_once(dirname(__FILE__)."/../../core/globalSettings.php");
@@ -19,8 +19,8 @@
*/
var $id;
var $name = "";
- // var $password = ""; // password is readonly,
- var $owner = 0;
+ // var $password = ""; // password is readonly,
+ var $owner = 0;
var $description ="";
var $loginCount;
var $email = "";
@@ -41,23 +41,23 @@
var $houseNumber = "";
var $reference = "";
var $forAttentionOf = "";
- var $validFrom = null;
- var $validTo = null;
- var $passwordTicket = "";
+ var $validFrom = null;
+ var $validTo = null;
+ var $passwordTicket = "";
var $firstName = "";
var $lastName = "";
var $academicTitle = "";
- var $activationKey = "";
+ var $activationKey = "";
var $isActive = 'f';
var $createDigest = 'f';
var $preferredGui = '';
-
- static $displayName = "User";
- static $internalName = "user";
-
+
+ static $displayName = "User";
+ static $internalName = "user";
+
/**
* Constructor
- * @param $userId Integer the ID of the user that is represented by
+ * @param $userId Integer the ID of the user that is represented by
* this object.
*/
public function __construct () {
@@ -74,10 +74,10 @@
try{
$this->load();
}
- catch(Exception $E) {
+ catch(Exception $E) {
new mb_exception($E->getMessage());
}
-
+
$this->returnObject = new stdClass(); // default object for returning information from function calls
/*
//maybe helpful: https://docs.ckan.org/en/ckan-2.7.3/api/
@@ -101,18 +101,18 @@
[
{"key1": "value1"},
{"key2": "value1"}
- ]
+ ]
}
*/
- }
+ }
-
+
/**
* @return String the ID of this user
*/
public function __toString () {
- return (string) $this->id;
+ return (string) $this->id;
}
@@ -123,25 +123,25 @@
$result = array(
"name" => $this->name,
"password" => "*************",
- "owner" => $this->owner,
- "description" => $this->description,
- "loginCount" => $this->loginCount,
- "email" => $this->email,
- "phone" => $this->phone,
- "department" => $this->department,
- "resolution" => $this->resolution,
- "organization" => $this->organization,
- "position" => $this->position,
- "phone1" => $this->phone1,
- "fax" => $this->fax,
- "deliveryPoint" => $this->deliveryPoint,
- "city" => $this->city,
- "postalCode" => $this->postalCode,
- "country" => $this->country,
+ "owner" => $this->owner,
+ "description" => $this->description,
+ "loginCount" => $this->loginCount,
+ "email" => $this->email,
+ "phone" => $this->phone,
+ "department" => $this->department,
+ "resolution" => $this->resolution,
+ "organization" => $this->organization,
+ "position" => $this->position,
+ "phone1" => $this->phone1,
+ "fax" => $this->fax,
+ "deliveryPoint" => $this->deliveryPoint,
+ "city" => $this->city,
+ "postalCode" => $this->postalCode,
+ "country" => $this->country,
"url" => $this->url,
"realName" => $this->realName,
"street" => $this->street,
- "houseNumber" => $this->houseNumber,
+ "houseNumber" => $this->houseNumber,
"reference" => $this->reference,
"forAttentionOf" => $this->forAttentionOf,
"validFrom" => $this->validFrom,
@@ -152,7 +152,7 @@
"academicTitle" => $this->academicTitle,
"activationKey" => $this->activationKey,
"isActive" => $this->isActive,
- "createDigest" => $this->createDigest,
+ "createDigest" => $this->createDigest,
"preferredGui" => $this->preferredGui
);
return $result;
@@ -170,26 +170,26 @@
$v = array($this->id);
$t = array("i");
$result = db_prep_query($sql,$v,$t);
-
+
$groupArray = array();
while ($row = db_fetch_array($result)) {
$groupArray[]= intval($row["fkey_mb_group_id"]);
}
- return $groupArray;
+ return $groupArray;
}
public function create() {
- if ($this->name === "") {
+ if ($this->name === "") {
$e = new Exception("Can' t create user without name");
}
$uuid = new Uuid();
-
+
$sql_user_create = "INSERT INTO mb_user (mb_user_name, uuid, activation_key, is_active) VALUES ( $1 , $2 , $3, $4)";
$v = array($this->name, $uuid, md5($uuid), 'f');
$t = array("s","s","s","b");
-
+
db_begin();
-
+
$insert_result = db_prep_query($sql_user_create, $v, $t);
if($insert_result == false) {
db_rollback();
@@ -200,7 +200,7 @@
if ($id != 0) {
$this->id = $id;
}
-
+
$commit_result = $this->commit();
if($commit_result == false) {
try {
@@ -286,10 +286,10 @@
"mb_user_valid_from = $22, ".
"mb_user_valid_to = $23, ".
"mb_user_password_ticket = $24, ".
- "mb_user_firstname = $25, " .
- "mb_user_lastname = $26, " .
- "mb_user_academictitle = $27, " .
- "mb_user_login_count = $28, " .
+ "mb_user_firstname = $25, " .
+ "mb_user_lastname = $26, " .
+ "mb_user_academictitle = $27, " .
+ "mb_user_login_count = $28, " .
"activation_key = $29, " .
"is_active = $30, " .
"create_digest = $31, " .
@@ -318,7 +318,7 @@
$this->url !== "" ? $this->url : null,
$this->realName !== "" ? $this->realName : null,
$this->street !== "" ? $this->street : null,
- $this->houseNumber !== "" ? $this->houseNumber : null,
+ $this->houseNumber !== "" ? $this->houseNumber : null,
$this->reference !== "" ? $this->reference : null,
$this->forAttentionOf !== "" ? $this->forAttentionOf : null,
$this->validFrom,
@@ -336,11 +336,11 @@
);
$t = array(
- "s", "i", "s", "s", "s",
- "s", "i", "s", "s", "s",
- "s", "s", "s", "i", "s",
- "s", "s", "s", "s", "s",
+ "s", "i", "s", "s", "s",
+ "s", "i", "s", "s", "s",
+ "s", "s", "s", "i", "s",
"s", "s", "s", "s", "s",
+ "s", "s", "s", "s", "s",
"s", "s", "i", "s", "b", "b", "s", "i"
);
@@ -358,7 +358,7 @@
$v = array($this->id);
$t = array("i");
$result = db_prep_query($sql_user_remove,$v,$t);
-
+
if($result == false) {
$e = new mb_exception("Database error deleting user");
}
@@ -390,7 +390,7 @@
$this->url = $row['mb_user_online_resource'];
$this->realName = $row['mb_user_realname'];
$this->street = $row['mb_user_street'];
- $this->houseNumber = $row['mb_user_housenumber'];
+ $this->houseNumber = $row['mb_user_housenumber'];
$this->reference = $row['mb_user_reference'];
$this->forAttentionOf = $row['mb_user_for_attention_of'];
$this->validFrom = $row['mb_user_valid_from'];
@@ -404,7 +404,7 @@
case "f":
$this->isActive = 'f';
break;
- default:
+ default:
$this->isActive = 'f';
break;
}
@@ -415,7 +415,7 @@
case "f":
$this->createDigest = 'f';
break;
- default:
+ default:
$this->createDigest = 'f';
break;
}
@@ -430,7 +430,7 @@
}
return true;
}
-
+
/*
* @param $userId the Mapbender user id
* @param $userTicket a user password ticket
@@ -452,7 +452,7 @@
}
return true;
}
-
+
/*
* @param $newPassword values of the new password
* @param $newPassword Mapbender user id
@@ -503,14 +503,14 @@
return true;
}
-
+
public function setNewUserPasswordTicket () {
- $sql = "UPDATE mb_user SET mb_user_password_ticket = $1";
+ $sql = "UPDATE mb_user SET mb_user_password_ticket = $1";
$sql.=" WHERE mb_user_id = $2";
$passwordTicket = substr(md5(uniqid(rand())),0,30);
$v = array($passwordTicket,$this->id);
- $t = array('s','i');
- $res = db_prep_query($sql,$v,$t);
+ $t = array('s','i');
+ $res = db_prep_query($sql,$v,$t);
if(!$res){
$e= new mb_exception(1);
throw new Exception("Error setting new user password ticket");
@@ -519,23 +519,65 @@
$this->passwordTicket = $passwordTicket;
return true;
}
-
- public function sendUserLoginMail () {
+
+ public function checkDjango(){
+ if (defined("DJANGO_PORTAL") && DJANGO_PORTAL == true) {
+ //TODO - get url from django!
+ if($_SERVER["HTTPS"] != "on") {
+ $loginRedirectUrl = "http://".$_SERVER['HTTP_HOST']."/login/";
+ $activateRedirectUrl = "http://".$_SERVER['HTTP_HOST']."/activate/";
+ $registerRedirectUrl = "http://".$_SERVER['HTTP_HOST']."/register/";
+ } else {
+ $loginRedirectUrl = "https://".$_SERVER['HTTP_HOST']."/login/";
+ $activateRedirectUrl = "https://".$_SERVER['HTTP_HOST']."/activate/";
+ $registerRedirectUrl = "https://".$_SERVER['HTTP_HOST']."/register/";
+ }
+ } else {
+ $loginRedirectUrl = LOGIN;
+ $activateRedirectUrl = MAPBENDER_PATH."/php/mod_activateUserAccount.php?activationKey=";
+ $registerRedirectUrl = LOGIN;
+ }
+ return array($loginRedirectUrl,$activateRedirectUrl,$registerRedirectUrl);
+
+ }
+
+ public function sendUserLoginMail ($email = "",$name = "",$activation_key= "") {
+ list($loginRedirectUrl,$activateRedirectUrl,$registerRedirectUrl) = $this->checkDjango();
+ $e = new mb_exception("send email function!");
$admin = new administration();
- $userMessage = _mb("Activation mail for Mapbender Geoportal")."\n";
- $userMessage .= _mb("Your login name is").": ".$this->name."\n";
- $userMessage .= _mb("Please activate your account by click on following link").": \n";
- $mbUrl = MAPBENDER_PATH."/";
- $userMessage .= $mbUrl."php/mod_activateUserAccount.php?activationKey=".$this->activationKey."\n";
- $userMessage .= _mb("Follow this link to login to Mapbender").": \n";
- $userMessage .= LOGIN."\n";
- $userMail = $admin->getEmailByUserId($this->id);
- if(!$admin->sendEmail('', '', $userMail, $this->name, utf8_decode(_mb("Your Mapbender Geoportal account")), utf8_decode($userMessage), $error_msg)) {
- return _mb("Registration data could not be send. Please check the given mail address.");
+
+ if (defined("DJANGO_PORTAL") && DJANGO_PORTAL == true) {
+ $userMessage = _mb("Activation mail for Geoportal")."\n";
+ $userMessage .= _mb("Your login name is").": ".$name."\n";
+ $userMessage .= _mb("Please activate your account by click on following link").": \n";
+ $userMessage .= $activateRedirectUrl.$activation_key."\n";
+ $e = new mb_exception("sending email to name=".$name." email=".$email." key=".$activation_key);
+ if(!$admin->sendEmail("", "", $email, $name, utf8_decode(_mb("Your Geoportal account")), utf8_decode($userMessage), $error_msg)) {
+ return _mb("Registry data could not be send. Please check mail address.");
+ $e = new mb_exception("MAIL FAIL!");
+ }
+ return _mb("Registry data has been sent successfully.");
+ $e = new mb_exception("MAIL SUCCESS!");
+
+ }else {
+
+ $userMessage = _mb("Activation mail for Mapbender Geoportal")."\n";
+ $userMessage .= _mb("Your login name is").": ".$this->name."\n";
+ $userMessage .= _mb("Please activate your account by click on following link").": \n";
+ $mbUrl = MAPBENDER_PATH."/";
+ $userMessage .= $mbUrl."php/mod_activateUserAccount.php?activationKey=".$this->activationKey."\n";
+ $userMessage .= _mb("Follow this link to login to Mapbender").": \n";
+ $userMessage .= LOGIN."\n";
+ $userMail = $admin->getEmailByUserId($this->id);
+ if(!$admin->sendEmail("", "", $userMail, $this->name, utf8_decode(_mb("Your Mapbender Geoportal account")), utf8_decode($userMessage), $error_msg)) {
+ return _mb("Registry data could not be send. Please check mail address.");
+ $e = new mb_exception("MAIL FAIL!");
+ }
+ return _mb("Registry data has been sent successfully.");
+ $e = new mb_exception("MAIL SUCCESS!");
}
- return _mb("Registration data has been sent successfully - please control your mail Account to activate your account!");
}
-
+
/*
* @return Array of Users
* @param $filter UNUSED! string that must be contained in the username
@@ -584,7 +626,7 @@
*/
public static function byName($name) {
-
+
if($name == null) { return new User(null); }
$sql_user = "SELECT mb_user_id FROM mb_user WHERE mb_user_name = '$name'";
@@ -601,9 +643,9 @@
* new 2019 - tries to initialize a userobject from a register form and store it in the mapbender database
* @return An json string. The information of the mb_user table is in resultObject->result if the registration was successful.
* To get the assoc array do following: $userArray = json_decode(json_encode($returnObject->result), JSON_OBJECT_AS_ARRAY);
- * @params:
- * {"user_attributes": {"mbUserName": {"mapbenderDbColumn":"mb_user_name", "mandatory": true, "type": "string", "default": null}}, {"mbUserEmail", {"mapbenderDbColumn":"mb_user_email", "mandatory": true, "type": "string", "default": null}}, {"mbUserOrganization", {"mapbenderDbColumn":"mb_user_organization_name", "mandatory": false, "type": "string", "default": null}}, {"mbUserDepartment", {"mapbenderDbColumn":"mb_user_department", "mandatory": false, "type": "string", "default": null}}, {"mbUserPhone", {"mapbenderDbColumn":"mb_user_phone", "mandatory": false, "type": "string", "default": null}}, {"mbUserNewsletter", {"mapbenderDbColumn":"mb_user_newsletter", "mandatory": true, "type": "boolean", "default": false}}, {"mbUserAllowSurvey", {"mapbenderDbColumn":"mb_user_allow_survey", "mandatory": true, "type": "boolean", "default": false}}, {"timestampDsgvoAccepted", {"mapbenderDbColumn":"timestamp_dsgvo_accepted", "mandatory": true, "type": "string", "default": null}}, {"mbUserHash
Algo", {"mapbenderDbColumn":"mb_user_digest_hash", "mandatory": false, "type": "string", "default": "MD5"}}}
- *
+ * @params:
+ * {"user_attributes": {"mbUserName": {"mapbenderDbColumn":"mb_user_name", "mandatory": true, "type": "string", "default": null}}, {"mbUserEmail", {"mapbenderDbColumn":"mb_user_email", "mandatory": true, "type": "string", "default": null}}, {"mbUserOrganization", {"mapbenderDbColumn":"mb_user_organization_name", "mandatory": false, "type": "string", "default": null}}, {"mbUserDepartment", {"mapbenderDbColumn":"mb_user_department", "mandatory": false, "type": "string", "default": null}}, {"mbUserPhone", {"mapbenderDbColumn":"mb_user_phone", "mandatory": false, "type": "string", "default": null}}, {"mbUserNewsletter", {"mapbenderDbColumn":"mb_user_newsletter", "mandatory": true, "type": "boolean", "default": false}}, {"mbUserAllowSurvey", {"mapbenderDbColumn":"mb_user_allow_survey", "mandatory": true, "type": "boolean", "default": false}}, {"timestampDsgvoAccepted", {"mapbenderDbColumn":"timestamp_dsgvo_accepted", "mandatory": true, "type": "string", "default": null}}, {"mbUserHash
Algo", {"mapbenderDbColumn":"mb_user_digest_hash", "mandatory": false, "type": "string", "default": "MD5"}}}
+ *
*/
public function selfRegisterNewUser($mbUserName, $mbUserEmail, $mbUserPassword, $mbUserOrganization, $mbUserDepartment, $mbUserPhone, $mbUserNewsletter=false, $mbUserAllowSurvey=false, $timestampDsgvoAccepted=0, $mbUserHashAlgo = 'MD5') {
//check if user with name already exists - if so return false
@@ -685,7 +727,7 @@
$this->returnObject->error->message = "An error occured when trying to insert user '".$mbUserName."' into mapbender mb_user table!";
$this->returnObject->error->{__type} = "Database exception";
return json_encode($this->returnObject);
- }
+ }
//get id from user with initial uuid
$sql = "SELECT * FROM mb_user WHERE uuid = $1";
$v = array($mb_user_uuid);
@@ -706,7 +748,7 @@
$this->returnObject->error->message = "An error occured when trying to insert user '".$row['mb_user_id']."' into group '".$publicGroupId."' of mapbender mb_group table!";
$this->returnObject->error->{__type} = "Database exception";
return json_encode($this->returnObject);
- }
+ }
//return result
$this->returnObject->success = true;
$this->returnObject->help = "class_user.php:selfRegisterNewUser()";
@@ -719,7 +761,7 @@
* @return An json string. The information of the mb_user table is in resultObject->result if the registration was successful.
* To get the assoc array do following: $userArray = json_decode(json_encode($returnObject->result), JSON_OBJECT_AS_ARRAY);
* @params: $userName, $userPassword
- *
+ *
*/
public function authenticateUserByName($mbUserName, $userPassword, $mbUserHashAlgo = 'MD5') {
$sql = "SELECT * FROM mb_user WHERE mb_user_name = $1";
@@ -737,34 +779,14 @@
}
$row = db_fetch_array($res);
$mbUserEmail = $row['mb_user_email'];
- //check all
+ list($loginRedirectUrl,$activateRedirectUrl,$registerRedirectUrl) = $this->checkDjango();
+ //check all
//first login on new system, set (salt - maybe later - and ) new password when password column is empty, delete old unsecure md5 hash
//Test if account has already been activated by the user
if ($row['is_active'] == "f"){
//$URLAdd="?status=notactive";
//TODO - use right URL!- from mapbender.conf
- /*if($_SERVER["HTTPS"] != "on") {
- header ("Location: http://".$_SERVER['HTTP_HOST'].$URLAdd);
- } else {
- header ("Location: https://".$_SERVER['HTTP_HOST'].$URLAdd);
- }*/
- if (defined("DJANGO_PORTAL") && DJANGO_PORTAL == true) {
- //TODO - get url from django!
- if($_SERVER["HTTPS"] != "on") {
- $loginRedirectUrl = "http://".$_SERVER['HTTP_HOST']."/login/";
- $activateRedirectUrl = "http://".$_SERVER['HTTP_HOST']."/login/";
- $registerRedirectUrl = "http://".$_SERVER['HTTP_HOST']."/register/";
- } else {
- $loginRedirectUrl = "https://".$_SERVER['HTTP_HOST']."/login/";
- $activateRedirectUrl = "https://".$_SERVER['HTTP_HOST']."/login/";
- $registerRedirectUrl = "https://".$_SERVER['HTTP_HOST']."/register/";
- }
- } else {
- $loginRedirectUrl = LOGIN;
- $activateRedirectUrl = MAPBENDER_PATH."/php/mod_activateUserAccount.php?activationKey=".$row['activation_key'];
- $registerRedirectUrl = LOGIN;
- }
-
+
$e = new mb_notice("classes/class_user.php: "."Account for user ".$mbUserName. " is not activated til now - redirect to activation!");
$this->returnObject->success = false;
unset($this->returnObject->result);
@@ -838,7 +860,12 @@
$t = array('s','s','s','i');
$res = db_prep_query($sql,$v,$t);
}
- //
+ //successful login
+ $sql = "UPDATE mb_user SET mb_user_login_count = 0 WHERE mb_user_name = $1";
+ $v = array($mbUserName);
+ $t = array('s');
+ $res = db_prep_query($sql,$v,$t);
+
$sql = "SELECT * FROM mb_user WHERE mb_user_name = $1";
$v = array($mbUserName);
$t = array('s');
@@ -851,14 +878,61 @@
return json_encode($this->returnObject);
}
}
- $e = new mb_exception("classes/class_user.php: "."Account for activated user ".$mbUserName. " could not be authenticated with given password!");
- $this->returnObject->success = false;
- unset($this->returnObject->result);
- $this->returnObject->help = "class_user.php:authenticateUserByName()";
- $this->returnObject->error->message = "Account for activated user with name: ".$mbUserName." could not be authenticated with given password!";
- $this->returnObject->error->{__type} = "Access denied";
- return json_encode($this->returnObject);
- } else {
+
+ # name = true ; pw = false tree
+ # check if user has to be locked
+ if($row['mb_user_login_count'] > 3){
+
+ $permitted_chars = '0123456789abcdefghijklmnopqrstuvwxyz';
+
+ $sql = "UPDATE mb_user SET is_active = False WHERE mb_user_name = $1";
+ $v = array($mbUserName);
+ $t = array('s');
+ $res = db_prep_query($sql,$v,$t);
+ $activation_key = substr(str_shuffle($permitted_chars), 0, 50);
+
+ $sql = "UPDATE mb_user SET activation_key = $1 WHERE mb_user_name = $2";
+ $v = array($activation_key,$mbUserName);
+ $t = array('s','s');
+ $res = db_prep_query($sql,$v,$t);
+
+ $e = new mb_exception("classes/class_user.php: "."Password failed third time for ".$mbUserName. ". Account is now locked! Reactivation Mail was sent!");
+ $this->returnObject->success = false;
+ unset($this->returnObject->result);
+ $this->returnObject->help = "class_user.php:authenticateUserByName()";
+ $this->returnObject->error->message = "Password failed third time for ".$mbUserName. ". Account is now locked! Reactivation Mail was sent!";
+ $this->returnObject->error->{__type} = "Access denied";
+ # send reactivationmail
+ $e = new mb_exception("sending email to name=".$row['mb_user_name']." email=".$row['mb_user_email']." key=".$activation_key);
+ if (defined("DJANGO_PORTAL") && DJANGO_PORTAL == true) {
+ $e = new mb_exception("Mail Content: ".$activateRedirectUrl.$activation_key." Account is now locked! Reactivation Mail was sent!");
+ $this->sendUserLoginMail($row['mb_user_email'],$row['mb_user_name'],$activation_key);
+ }else{
+ $this->sendUserLoginMail();
+ $e = new mb_exception("Mail Content: ".$activateRedirectUrl." Account is now locked! Reactivation Mail was sent!");
+ }
+
+ return json_encode($this->returnObject);
+
+ }else{
+
+ $sql = "UPDATE mb_user SET mb_user_login_count = mb_user_login_count + 1 WHERE mb_user_name = $1";
+ $v = array($mbUserName);
+ $t = array('s');
+ $res = db_prep_query($sql,$v,$t);
+
+ $e = new mb_exception("classes/class_user.php: "."Account for activated user ".$mbUserName. " could not be authenticated with given password!");
+ $this->returnObject->success = false;
+ unset($this->returnObject->result);
+ $this->returnObject->help = "class_user.php:authenticateUserByName()";
+ $this->returnObject->error->message = "Account for activated user with name: ".$mbUserName." could not be authenticated with given password!";
+ $this->returnObject->error->{__type} = "Access denied";
+ return json_encode($this->returnObject);
+
+ }
+
+
+ } else {
$e = new mb_exception("classes/class_user.php: "."Account for user ".$mbUserName. " (not active!) could not be authenticated with given password!");
$this->returnObject->success = false;
unset($this->returnObject->result);
@@ -871,9 +945,9 @@
/**
* Returns an array of application IDs that the user is allowed to access.
- *
+ *
* @return Array an array of application IDs
- * @param $ignorePublic boolean whether or not to ignore
+ * @param $ignorePublic boolean whether or not to ignore
* public applications (?)
* @param $categoryFilter false or id of category to filter guis - only return those guis, that are in that category
*/
@@ -941,12 +1015,12 @@
}
}
return $arrayGuis;
- }
-
+ }
+
public function filterApplicationsForWmcApi ($guiArray) {
$sql = "SELECT gui_id, gui_public FROM gui INNER JOIN gui_element WHERE gui_id in (";
//TODO - if needed for application metadata editor!
- $sql .= ");";
+ $sql .= ");";
}
@@ -959,7 +1033,7 @@
}
return $wfsIdArray;
}
-
+
public function getWfsByPermission () {
$wfsArray = array();
$appArray = $this->getApplicationsByPermission();
@@ -968,28 +1042,28 @@
$t = array();
$sql = "SELECT DISTINCT fkey_wfs_id FROM gui_wfs WHERE fkey_gui_id IN (";
for ($i = 0; $i < count($appArray); $i++) {
- if($i > 0) {
+ if($i > 0) {
$sql .= ",";
}
$sql .= "$".strval($i+1);
-
+
array_push($v, $appArray[$i]);
array_push($t, "s");
}
$sql .= ") ORDER BY fkey_wfs_id";
-
+
$res = db_prep_query($sql,$v,$t);
while($row = db_fetch_array($res)){
$wfsArray[]= intval($row['fkey_wfs_id']);
- }
+ }
}
return $wfsArray;
}
-
+
public function getWfsConfByWfsOwner () {
$wfsConfIdArray = array();
- $sql = "SELECT * FROM wfs_conf, wfs WHERE wfs.wfs_owner = $1 AND " .
+ $sql = "SELECT * FROM wfs_conf, wfs WHERE wfs.wfs_owner = $1 AND " .
"wfs_conf.fkey_wfs_id = wfs.wfs_id ORDER BY wfs_conf.wfs_conf_id";
$v = array($this->id);
$t = array('i');
@@ -1000,10 +1074,10 @@
return $wfsConfIdArray;
}
/** check if feature typenames of a WFS requests are accessible - that means, that
- * a wfs_conf for each featuretype exists and the user has access to a gui in which this wfs_conf
+ * a wfs_conf for each featuretype exists and the user has access to a gui in which this wfs_conf
* is integrated
* @params String typenames [csv], Integer wfsId
- * @return boolean
+ * @return boolean
* TODO!!!!!!
*/
public function areFeaturetypesAccessible ($typenames, $wfsId) {
@@ -1021,9 +1095,9 @@
$c = 2;
$featuretypeArray = explode(",", $typenames);
$numberOfFeaturetypes = count($featuretypeArray);
- //test for string or array?
+ //test for string or array?
for ($i = 0; $i < $numberOfFeaturetypes; $i++) {
- if ($i > 0) {
+ if ($i > 0) {
$sql .= ",";
}
$sql .= "$".$c;
@@ -1033,7 +1107,7 @@
}
$sql .= ") AND featuretype_id IN (SELECT fkey_featuretype_id FROM wfs_conf WHERE wfs_conf_id IN (SELECT fkey_wfs_conf_id FROM gui_wfs_conf WHERE fkey_gui_id IN (";
for ($i = 0; $i < count($array_guis); $i++) {
- if ($i > 0) {
+ if ($i > 0) {
$sql .= ",";
}
$sql .= "$".$c;
@@ -1069,7 +1143,7 @@
}
/** identifies the IDs of WFS confs where the user is owner
- *
+ *
* @param Array appIdArray [optional] restrict to certain applications
* @return integer[] the IDs of the wfs_conf-table
*/
@@ -1079,7 +1153,7 @@
// 1.
$adm = new administration();
$guisByPer = $adm->getGuisByPermission($userid, true);
-
+
if (func_num_args() === 1) {
$arg1 = func_get_arg(0);
if (!is_array($arg1)) {
@@ -1090,10 +1164,10 @@
$guisByPer = array_intersect($guisByPer, $appIdArray);
$guisByPer = array_keys(array_flip($guisByPer));
}
-
+
// $e = new mb_exception(serialize($guisByPer));
-
-// 2.
+
+// 2.
$ownWFSconfs = array();
if(count($guisByPer)>0){
$v = array();
@@ -1104,12 +1178,12 @@
for($i=0; $i<count($guisByPer); $i++){
if($i>0){ $sql .= ",";}
$sql .= "$".strval($i+1);
-
+
array_push($v, $guisByPer[$i]);
array_push($t, "s");
}
$sql .= ") GROUP BY wfs_conf.wfs_conf_id ORDER BY wfs_conf.wfs_conf_id";
-
+
$res = db_prep_query($sql,$v,$t);
$i=0;
while($row = db_fetch_array($res)){
@@ -1119,10 +1193,10 @@
}
return $ownWFSconfs;
}
-
+
/**
* Returns all WMCs that this user owns
- *
+ *
* @return integer[] an array of WMC ids; ids from table mb_user_wmc
*/
public function getWmcByOwner () {
@@ -1141,7 +1215,7 @@
/**
* Returns all WMCs with some further information that this user owns
- *
+ *
* @return obj an array of WMC information; ids, titles, abstracts from table mb_user_wmc
*/
public function getWmcInfoByOwner ($ignorePublic = false) {
@@ -1163,7 +1237,7 @@
}
return $wmcArray;
}
-
+
public function isLayerAccessible ($layerId) {
$array_guis = $this->getApplicationsByPermission();
$v = array();
@@ -1171,7 +1245,7 @@
$sql = "SELECT * FROM gui_layer WHERE fkey_gui_id IN (";
$c = 1;
for ($i = 0; $i < count($array_guis); $i++) {
- if ($i > 0) {
+ if ($i > 0) {
$sql .= ",";
}
$sql .= "$".$c;
@@ -1183,7 +1257,7 @@
array_push($v,$layerId);
array_push($t,'i');
$res = db_prep_query($sql,$v,$t);
-
+
return ($row = db_fetch_array($res)) ? true : false;
}
@@ -1197,7 +1271,7 @@
$sql = "SELECT DISTINCT fkey_layer_id FROM gui_layer WHERE fkey_gui_id IN (";
$c = 1;
for ($i = 0; $i < count($array_guis); $i++) {
- if ($i > 0) {
+ if ($i > 0) {
$sql .= ",";
}
$sql .= "$".$c;
@@ -1216,7 +1290,7 @@
}
$sql .= "$".$c;
$c++;
- $j++;
+ $j++;
array_push($v, $layerId);
array_push($t, 'i');
}
@@ -1225,10 +1299,10 @@
$allowedLayerIdArray = array();
while ($row = db_fetch_array($res)) {
$allowedLayerIdArray[] = $row["fkey_layer_id"];
- }
+ }
return $allowedLayerIdArray;
}
-
+
public function isWmsAccessible ($wms_id) {
$array_guis = $this->getApplicationsByPermission();
$v = array();
@@ -1236,7 +1310,7 @@
$sql = "SELECT * FROM gui_wms WHERE fkey_gui_id IN (";
$c = 1;
for ($i = 0; $i < count($array_guis); $i++) {
- if ($i > 0) {
+ if ($i > 0) {
$sql .= ",";
}
$sql .= "$".$c;
@@ -1250,7 +1324,7 @@
$res = db_prep_query($sql, $v, $t);
return ($row = db_fetch_array($res)) ? true : false;
}
-
+
public function getOwnedMetadata ($type = false) {
if ($type == 'application') {
$sql = "SELECT metadata_id FROM mb_metadata WHERE type = 'application' AND fkey_mb_user_id = $1";
@@ -1320,7 +1394,7 @@
$sql .= " WHERE gui_mb_user.mb_user_type = 'owner'";
$sql .= " AND gui_mb_user.fkey_gui_id IN (";
for ($i = 0; $i < count($gui); $i++) {
- if ($i > 0) {
+ if ($i > 0) {
$sql .= ",";
}
$sql .= "$".$c;
@@ -1336,7 +1410,7 @@
$sql .= " AND gui_mb_group.fkey_gui_id IN (";
for ($j = 0; $j < count($gui); $j++) {
- if ($j > 0) {
+ if ($j > 0) {
$sql .= ",";
}
$sql .= "$".$c;
@@ -1354,10 +1428,10 @@
}
if (in_array($this->id, $user)) {
return true;
- }
+ }
return false;
}
-
+
private function addSingleSubscription ($id, $serviceType = "WMS") {
if (!is_numeric($id)) {
$e = new mb_exception("class_user.php: addSingleSubscription: ".$serviceType." Id is not a number.");
@@ -1370,7 +1444,7 @@
$sql = "INSERT INTO mb_user_abo_ows (fkey_mb_user_id, fkey_wms_id) VALUES ($1, $2)";
break;
case "WFS":
- $sql = "INSERT INTO mb_user_abo_ows (fkey_mb_user_id, fkey_wfs_id) VALUES ($1, $2)";
+ $sql = "INSERT INTO mb_user_abo_ows (fkey_mb_user_id, fkey_wfs_id) VALUES ($1, $2)";
break;
}
$v = array($this->id, $id);
@@ -1380,7 +1454,7 @@
}
return false;
}
-
+
private function cancelSingleSubscription ($id, $serviceType = "WMS") {
if (!is_numeric($id)) {
$e = new mb_exception("class_user.php: cancelSingleSubscription: ".$serviceType." Id not a number.");
@@ -1389,20 +1463,20 @@
$id = intval($id);
switch ($serviceType) {
case "WMS":
- $sql = "DELETE FROM mb_user_abo_ows WHERE fkey_wms_id = $1 " .
- "AND fkey_mb_user_id = $2";
+ $sql = "DELETE FROM mb_user_abo_ows WHERE fkey_wms_id = $1 " .
+ "AND fkey_mb_user_id = $2";
break;
case "WFS":
- $sql = "DELETE FROM mb_user_abo_ows WHERE fkey_wfs_id = $1 " .
- "AND fkey_mb_user_id = $2";
+ $sql = "DELETE FROM mb_user_abo_ows WHERE fkey_wfs_id = $1 " .
+ "AND fkey_mb_user_id = $2";
break;
}
$v = array($id, $this->id);
$t = array('i', 'i');
- $res = db_prep_query($sql, $v, $t);
+ $res = db_prep_query($sql, $v, $t);
return ($res) ? true : false;
}
-
+
public function addSubscription ($services, $serviceType = "WMS") {
if (is_array($services)) {
foreach ($services as $serviceId) {
@@ -1433,11 +1507,11 @@
$id = intval($serviceId);
switch ($serviceType) {
case "WMS":
- $sql = "SELECT * FROM mb_user_abo_ows WHERE fkey_wms_id = $1 AND " .
+ $sql = "SELECT * FROM mb_user_abo_ows WHERE fkey_wms_id = $1 AND " .
"fkey_mb_user_id = $2 LIMIT 1";
break;
case "WFS":
- $sql = "SELECT * FROM mb_user_abo_ows WHERE fkey_wfs_id = $1 AND " .
+ $sql = "SELECT * FROM mb_user_abo_ows WHERE fkey_wfs_id = $1 AND " .
"fkey_mb_user_id = $2 LIMIT 1";
break;
}
@@ -1459,7 +1533,7 @@
}
return true;
}
-
+
public function isValid () {
if (!is_null($this->name) && $this->name !== "") {
return true;
@@ -1466,6 +1540,6 @@
}
return false;
}
-
+
}
?>
Modified: trunk/mapbender/http/frames/login.php
===================================================================
--- trunk/mapbender/http/frames/login.php 2019-12-19 13:39:39 UTC (rev 10380)
+++ trunk/mapbender/http/frames/login.php 2019-12-20 10:44:14 UTC (rev 10381)
@@ -1,6 +1,6 @@
<?php
# $Id$
-# Copyright (C) 2002 CCGIS
+# Copyright (C) 2002 CCGIS
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -44,11 +44,11 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
-<!--
+<!--
Licensing: See the GNU General Public License for more details.
http://www.gnu.org/copyleft/gpl.html
or:
-mapbender/licence/
+mapbender/licence/
-->
<meta http-equiv="cache-control" content="no-cache">
<meta http-equiv="pragma" content="no-cache">
@@ -56,7 +56,7 @@
<META http-equiv="Content-Style-Type" content="text/css">
<META http-equiv="Content-Script-Type" content="text/javascript">
<?php
-echo '<meta http-equiv="Content-Type" content="text/html; charset='.CHARSET.'">';
+echo '<meta http-equiv="Content-Type" content="text/html; charset='.CHARSET.'">';
?>
<title>Login</title>
<script type="text/javascript" src="../extensions/jquery-ui-1.8.1.custom/js/jquery-1.4.2.min.js"></script>
@@ -105,12 +105,12 @@
});
//$("a", ".gui_list").button();
//$("a", ".gui_list").click(function() { return false; });
-
+
});
});
</script>
-<?php
+<?php
echo "</head>";
echo "<body onload='setFocus()'>";
@@ -138,16 +138,16 @@
die;
}
}
-
+
require_once dirname(__FILE__)."/../../lib/class_Mapbender.php";
require_once dirname(__FILE__)."/../../lib/class_Mapbender_session.php";
$row = auth_user($name, $password);
-
+
// if given user data is found in database, set session data (db_fetch_array returns false if no row is found)
if($row){
require_once dirname(__FILE__) . "/../../core/globalSettings.php";
-# These lines will create a new session if a user logs in who is not the owner
-# of the session. However, in Geoportal-RLP this is intended,
+# These lines will create a new session if a user logs in who is not the owner
+# of the session. However, in Geoportal-RLP this is intended,
#
# if (Mapbender::session()->get("mb_user_id") !== false && $row["mb_user_id"] !== Mapbender::session()->get("mb_user_id")) {
# session_write_close();
@@ -156,10 +156,11 @@
# }
include(dirname(__FILE__) . "/../../conf/session.conf");
} else {
- $sql_set_cnt = "UPDATE mb_user SET mb_user_login_count = (mb_user_login_count + 1) WHERE mb_user_name = $1";
- $v = array($name);
- $t = array('s');
- db_prep_query($sql_set_cnt,$v,$t);
+ # not needed anymore, this is done in class user
+ #$sql_set_cnt = "UPDATE mb_user SET mb_user_login_count = (mb_user_login_count + 1) WHERE mb_user_name = $1";
+ #$v = array($name);
+ #$t = array('s');
+ #db_prep_query($sql_set_cnt,$v,$t);
redirectToLogin($name);
}
if(Mapbender::session()->get("mb_user_id")){
@@ -190,14 +191,14 @@
# remove name and password from url, because url params are parsed later and written in javascript
$cleanUrl = preg_replace("/name=[^&]*&/","",$_SERVER["QUERY_STRING"]);
$cleanUrl = preg_replace("/password=[^&]*&/","",$cleanUrl);
-
+
$myURL .= "&".$cleanUrl;
-
+
header ($myURL);
die;
}
# list all guis of this user and his groups
- else{
+ else{
require_once(dirname(__FILE__)."/../php/mb_listGUIs.php");
mb_listGUIs($arrayGUIs);
}
@@ -207,7 +208,7 @@
$sql_set_cnt = "UPDATE mb_user SET mb_user_login_count = (mb_user_login_count + 1) WHERE mb_user_name = $1";
$v = array($name);
$t = array('s');
- db_prep_query($sql_set_cnt,$v,$t);
+ db_prep_query($sql_set_cnt,$v,$t);
redirectToLogin($name);
}
}
Modified: trunk/mapbender/http/php/mod_activateUserAccount.php
===================================================================
--- trunk/mapbender/http/php/mod_activateUserAccount.php 2019-12-19 13:39:39 UTC (rev 10380)
+++ trunk/mapbender/http/php/mod_activateUserAccount.php 2019-12-20 10:44:14 UTC (rev 10381)
@@ -1,5 +1,5 @@
<?php
-# $Id:
+# $Id:
# http://www.mapbender.org/index.php
#
# This program is free software; you can redistribute it and/or modify
@@ -18,7 +18,7 @@
require_once(dirname(__FILE__)."/../../core/globalSettings.php");
//require_once(dirname(__FILE__)."/../classes/class_user.php");
$returnObject = new stdClass();
-if (defined("DJANGO_PORTAL") && DJANGO_PORTAL == true) {
+if (defined("DJANGO_PORTAL") && DJANGO_PORTAL == true) {
if($_SERVER["HTTPS"] != "on") {
$loginRedirectUrl = "http://".$_SERVER['HTTP_HOST']."/login/";
$registerRedirectUrl = "http://".$_SERVER['HTTP_HOST']."/register/";
@@ -33,15 +33,15 @@
if (isset($_REQUEST["activationKey"]) & $_REQUEST["activationKey"] != "") {
$testMatch = $_REQUEST["activationKey"];
- $pattern = '/^([a-z]|[0-9])*$/';
- if (!preg_match($pattern,$testMatch)){
- echo 'Parameter <b>activationKey</b> is not valid.<br/>';
- die();
+ $pattern = '/^([a-z]|[0-9])*$/';
+ if (!preg_match($pattern,$testMatch)){
+ echo 'Parameter <b>activationKey</b> is not valid.<br/>';
+ die();
}
$activationKey = $testMatch;
$testMatch = NULL;
}
-//select account
+//select account
$sql = "SELECT mb_user_id FROM mb_user WHERE activation_key = $1";
$v = array($activationKey);
$t = array('s');
@@ -73,6 +73,7 @@
header("Location: ".$loginRedirectUrl);
die();
} else {
+
$sql = "UPDATE mb_user SET is_active = true WHERE activation_key = $1";
$v = array($activationKey);
$t = array('s');
@@ -87,6 +88,12 @@
echo json_encode($this->returnObject);
die();
} else {
+
+ $sql = "UPDATE mb_user SET mb_user_login_count = 0 WHERE activation_key = $1";
+ $v = array($activationKey);
+ $t = array('s');
+ $res = db_prep_query($sql,$v,$t);
+
$e = new mb_exception("php/mod_activateUserAccount.php: User account successfully activated!");
$returnObject->success = true;
unset($returnObject->error);
More information about the Mapbender_commits
mailing list