|
|
@@ -0,0 +1,148 @@
|
|
|
+<?php
|
|
|
+/**
|
|
|
+ * File for the login action.
|
|
|
+ *
|
|
|
+ * Implements an action function to be called from the {@see Controller}.
|
|
|
+ *
|
|
|
+ * @author Iñigo Valentin <i@inigovalentin.com>
|
|
|
+ * @license https://www.gnu.org/licenses/gpl-3.0.en.html GNU General Public License V3
|
|
|
+ * @package SWDB
|
|
|
+ */
|
|
|
+
|
|
|
+require_once(PATH::ACTION . "Action.php");
|
|
|
+
|
|
|
+/**
|
|
|
+ * Logs the user in.
|
|
|
+ *
|
|
|
+ * Reads the POST parameters looking for the following KEYS:
|
|
|
+ * uname: username.
|
|
|
+ * e-mail: e-mail.
|
|
|
+ * password: password.
|
|
|
+ * password_repeat: password.
|
|
|
+ * If there is a match, it generates a token and sets cookies and session variablesand
|
|
|
+ * redirects to the user homepage.
|
|
|
+ *
|
|
|
+ * @category Action
|
|
|
+ */
|
|
|
+class Register_Action extends Action{
|
|
|
+
|
|
|
+ /**
|
|
|
+ * Executes the action.
|
|
|
+ */
|
|
|
+ function execute(){
|
|
|
+
|
|
|
+ if (!isset($_POST['uname'])){
|
|
|
+ $this->code = 400;
|
|
|
+ $this->message = "Username is required.";
|
|
|
+ header("Location: " . URL::BASE . "register/");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if (!isset($_POST['password'])){
|
|
|
+ $this->code = 400;
|
|
|
+ $this->message = "Password is required.";
|
|
|
+ header("Location: " . URL::BASE . "register/");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if (!isset($_POST['password_repeat'])){
|
|
|
+ $this->code = 400;
|
|
|
+ $this->message = "Passwords do not match.";
|
|
|
+ header("Location: " . URL::BASE . "register/");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if (!isset($_POST['mail'])){
|
|
|
+ $this->code = 400;
|
|
|
+ $this->message = "eMail is required.";
|
|
|
+ header("Location: " . URL::BASE . "register/");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ $uname = SQLite3::escapeString($_POST['uname']);
|
|
|
+ if (strlen($uname) == 0){
|
|
|
+ $this->code = 400;
|
|
|
+ $this->message = "Username is required.";
|
|
|
+ header("Location: " . URL::BASE . "register/");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ $mail = SQLite3::escapeString($_POST['mail']);
|
|
|
+ // TODO: Validate email
|
|
|
+ if (strlen($mail) == 0){
|
|
|
+ $this->code = 400;
|
|
|
+ $this->message = "eMail is required.";
|
|
|
+ header("Location: " . URL::BASE . "register/");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ $password = SQLite3::escapeString($_POST['password']);
|
|
|
+ if (strlen($password) == 0){
|
|
|
+ $this->code = 400;
|
|
|
+ $this->message = "Password is required.";
|
|
|
+ header("Location: " . URL::BASE . "register/");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ $password_repeat = SQLite3::escapeString($_POST['password_repeat']);
|
|
|
+ if ($password_repeat != $password){
|
|
|
+ $this->code = 400;
|
|
|
+ $this->message = "Passwords do not match.";
|
|
|
+ header("Location: " . URL::BASE . "register/");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ $statement = get_context()->get_db()->prepare("
|
|
|
+ SELECT count(id) AS c
|
|
|
+ FROM user WHERE name = :name;
|
|
|
+ ");
|
|
|
+ $statement->bindValue(":name", $uname, SQLITE3_TEXT);
|
|
|
+ if ($statement->execute()->fetchArray(SQLITE3_ASSOC)["c"] != 0){
|
|
|
+ $this->code = 400;
|
|
|
+ $this->message = "Username already in use.";
|
|
|
+ header("Location: " . URL::BASE . "register/");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ $statement = get_context()->get_db()->prepare("
|
|
|
+ SELECT count(id) AS c
|
|
|
+ FROM user WHERE mail = :mail;
|
|
|
+ ");
|
|
|
+ $statement->bindValue(":mail", $mail, SQLITE3_TEXT);
|
|
|
+ if ($statement->execute()->fetchArray(SQLITE3_ASSOC)["c"] != 0){
|
|
|
+ $this->code = 400;
|
|
|
+ $this->message = "Mail address already in use.";
|
|
|
+ header("Location: " . URL::BASE . "register/");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+
|
|
|
+ // All data is correct
|
|
|
+
|
|
|
+ // Generate an API key
|
|
|
+ $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
|
|
|
+ $charactersLength = 16;
|
|
|
+ $api = '';
|
|
|
+ for ($i = 0; $i < $charactersLength; $i++) {
|
|
|
+ $api .= $characters[rand(0, $charactersLength - 1)];
|
|
|
+ }
|
|
|
+
|
|
|
+ // Encode password
|
|
|
+ $password = hash('sha256', $password);
|
|
|
+
|
|
|
+ // Insert
|
|
|
+ $statement = get_context()->get_db()->prepare("
|
|
|
+ INSERT INTO user (id, name, mail, password, api_key, admin)
|
|
|
+ VALUES(
|
|
|
+ (SELECT max(id) + 1 FROM user),
|
|
|
+ :name,
|
|
|
+ :mail,
|
|
|
+ :password,
|
|
|
+ :api_key,
|
|
|
+ :admin
|
|
|
+ );
|
|
|
+ ");
|
|
|
+ $statement->bindValue(":name", $uname, SQLITE3_TEXT);
|
|
|
+ $statement->bindValue(":mail", $uname, SQLITE3_TEXT);
|
|
|
+ $statement->bindValue(":password", $password, SQLITE3_TEXT);
|
|
|
+ $statement->bindValue(":api_key", $api, SQLITE3_TEXT);
|
|
|
+ $statement->bindValue(":admin", 0, SQLITE3_INTEGER);
|
|
|
+ $statement->execute();
|
|
|
+ $statement->execute();
|
|
|
+ // TODO: Redirect to login?
|
|
|
+ $this->code = 204;
|
|
|
+ $this->message = "No content.";
|
|
|
+ header("Location: " . URL::BASE);
|
|
|
+ return;
|
|
|
+ }
|
|
|
+}
|