From c1f5f4d4515f4939d27522ebf31763b64f7de9ce Mon Sep 17 00:00:00 2001 From: Krombel Date: Sat, 10 Feb 2018 18:01:42 +0100 Subject: [PATCH 01/19] first WIP implementation --- .gitignore | 1 + MatrixConnection.php | 77 +++++++++++++++++ config.sample.php | 6 ++ functions.php | 52 +++++++++++ lang.de.php | 13 +++ language.php | 7 ++ register.php | 200 +++++++++++++++++++++++++++++++++++++++++++ 7 files changed, 356 insertions(+) create mode 100644 .gitignore create mode 100644 MatrixConnection.php create mode 100644 config.sample.php create mode 100644 functions.php create mode 100644 lang.de.php create mode 100644 language.php create mode 100644 register.php diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4f4773f --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +config.php diff --git a/MatrixConnection.php b/MatrixConnection.php new file mode 100644 index 0000000..55c2ee3 --- /dev/null +++ b/MatrixConnection.php @@ -0,0 +1,77 @@ +hs = $homeserver; + $this->at = $access_token; + } + + function send($room_id, $message) { + $send_message = NULL; + if (!$message) { + error_log("no message to send"); + } elseif(is_array($message)) { + $send_message = $message; + } elseif ($message instanceof MatrixMessage) { + $sendmessage = $message->get_object(); + } else { + error_log("message is of not valid type\n"); + return false; + } + + $url="https://".$this->hs."/_matrix/client/r0/rooms/" + . urlencode($room_id) ."/send/m.room.message?access_token=".$this->at; + $handle = curl_init($url); + curl_setopt($handle, CURLOPT_RETURNTRANSFER, true); + curl_setopt($handle, CURLOPT_CONNECTTIMEOUT, 5); + curl_setopt($handle, CURLOPT_TIMEOUT, 60); + curl_setopt($handle, CURLOPT_POSTFIELDS, json_encode($message)); + curl_setopt($handle, CURLOPT_HTTPHEADER, array("Content-Type: application/json")); + + return exec_curl_request($handle); + } + + function send_msg($room_id, $message) { + return $this->send($room_id, array( + "msgtype" => "m.notice", + "body" => $message + ) + ); + } +} + +class MatrixMessage +{ + private $message; + + function __construct() { + $this->message = array( + "msgtype" => "m.notice", + ); + } + + function set_type($msgtype) { + $this->$message["msgtype"] = $msgtype; + } + + function set_format($format) { + $this->message["format"] = $format; + } + + function set_body($body) { + $this->message["body"] = $body; + } + + function set_formatted_body($fbody, $format="org.matrix.custom.html") { + $this->message["formatted_body"] = $fbody; + $this->message["format"] = $format; + } + + function get_object() { + return $this->message; + } +} +?> diff --git a/config.sample.php b/config.sample.php new file mode 100644 index 0000000..e998fdb --- /dev/null +++ b/config.sample.php @@ -0,0 +1,6 @@ + diff --git a/functions.php b/functions.php new file mode 100644 index 0000000..949df06 --- /dev/null +++ b/functions.php @@ -0,0 +1,52 @@ + false, + "message" => $msg + ); + echo json_encode($response); + print("\n"); + exit(); +} + +function exec_curl_request($handle) +{ + $response = curl_exec($handle); + + if ($response === false) { + $errno = curl_errno($handle); + $error = curl_error($handle); + error_log("Curl returned error $errno: $error\n"); + curl_close($handle); + return false; + } + + $http_code = intval(curl_getinfo($handle, CURLINFO_HTTP_CODE)); + curl_close($handle); + + if ($http_code >= 500) { + // do not want to DDOS server if something goes wrong + sleep(10); + return false; + } else if ($http_code != 200) { + $response = json_decode($response, true); + error_log("Request has failed with error {$response['error']}\n"); + if ($http_code == 401) { + throw new Exception('Invalid access token provided'); + } + return false; + } else { + $response = json_decode($response, true); + if (isset($response["event_id"])) { + $response = true; + } else { + $response = false; + } + } + + return $response; + +} +?> diff --git a/lang.de.php b/lang.de.php new file mode 100644 index 0000000..c1f4489 --- /dev/null +++ b/lang.de.php @@ -0,0 +1,13 @@ + "Sitzungstoken nicht vorhanden oder ungültig.", +"UNKNOWN_USER_OR_PASSWORD" => "Nutzername und/oder Passwort(-Wiederholung) fehlen", +"USERNAME_LENGTH_INVALID" => "Entweder mehr als 20 oder weniger als 3 Zeichen für den Nutzernamen verwendet", +"USERNAME_NOT_ALNUM" => "Nutzername ist nicht alphanumerisch", +"PASSWORD_NOT_MATCH" => "Passwörter stimmen nicht überein", +"NOTE_LENGTH_EXEEDED" => "Notiz ist länger als die erlaubten 50 Zeichen", +"EMAIL_INVALID_FORMAT" => "Keine valide E-Mail-Adresse angegeben", +"FIRSTNAME_INVALID_FORMAT" => "Vorname hat ungültiges Format", +"SIRNAME_INVALID_FORMAT" => "Nachname hat ungültiges Format", +); +?> diff --git a/language.php b/language.php new file mode 100644 index 0000000..17c3004 --- /dev/null +++ b/language.php @@ -0,0 +1,7 @@ + diff --git a/register.php b/register.php new file mode 100644 index 0000000..92683dd --- /dev/null +++ b/register.php @@ -0,0 +1,200 @@ + + + 20 || strlen($_POST["username"]) < 3)) { + $message = $language["USERNAME_LENGTH_INVALID"]; + } + elseif (ctype_alnum($_POST['username']) != true) { + $message = $language["USERNAME_NOT_ALNUM"]; + } + elseif ($_POST["password"] != $_POST["password_confirm"]) { + $message = $language["PASSWORD_NOT_MATCH"]; + } + elseif (isset($_POST["note"]) && strlen($_POST["note"]) > 50) { + $message = $language["NOTE_LENGTH_EXEEDED"]; + } + elseif (!isset($_POST["email"]) || !filter_var($_POST["email"], FILTER_VALIDATE_EMAIL)) { + $message = $language["EMAIL_INVALID_FORMAT"]; + } + elseif (isset($_POST["first_name"]) && ! preg_match("/[A-Z][a-z]+/", $_POST["first_name"])) { + $message = $language["FIRSTNAME_INVALID_FORMAT"]; + } + elseif (isset($_POST["last_name"]) && ! preg_match("/[A-Z][a-z]+/", $_POST["last_name"])) { + $message = $language["SIRNAME_INVALID_FORMAT"]; + } + else { + // check valid password + + $first = filter_var($_POST["first_name"], FILTER_SANITIZE_STRING); + $last = filter_var($_POST["last_name"], FILTER_SANITIZE_STRING); + $user = filter_var($_POST["username"], FILTER_SANITIZE_STRING); + $pass = filter_var($_POST["password"], FILTER_SANITIZE_STRING); + $email = filter_var($_POST["email"], FILTER_VALIDATE_EMAIL); + $note = filter_var($_POST["note"], FILTER_SANITIZE_STRING); + + + $success = true; + } + if ($success) { + print("Erfolgreich"); + print(""); + print("

Erfolgreich

"); + print("

Bitte überprüfe deine E-Mails um deine E-Mail-Adresse zu bestätigen.

"); + print("Zur Registrierungsseite"); + } else { + print("".$message.""); + print(""); + print("

" . $message . "

"); + print("Zur Registrierungsseite"); + } +} else { + $_SESSION["token"] = bin2hex(random_bytes(16)); +?> + Registriere dich für cg-s.tk + + + + + + +
+
+
+
+
+

Bitte für registrieren2-Schritt-Registrierung

+
+
+
+
+
+
+ +
+
+
+
+ +
+
+
+ +
+ +
+ +
+ +
+ +
+ +
+ +
+
+ +
+
+
+
+ +
+
+
+ */ ?> + "> + + + +

Hinweis:
+ cg-s.tk is ein geschlossenes Chat-Netzwerk in dem jeder Nutzer bestätigt werden muss.
+ Du bekommst eine E-Mail wenn jemand deine Mitgliedschaft bestätigt hat. An diese wird auch dein initiales Passwort gesendet. + Hinterlasse also bitte einen Hinweis zu dir (der nur den entsprechenden Personen gezeigt wird).
+ Liebe Grüße vom Team von cg-s.tk +

+
+
+
+
+ + + + From b56798dc35a68f409bd5ea857c089fadf9e526eb Mon Sep 17 00:00:00 2001 From: Krombel Date: Sun, 11 Feb 2018 19:47:35 +0100 Subject: [PATCH 02/19] move language to lang-directory --- lang.de.php => lang/lang.de.php | 0 language.php | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename lang.de.php => lang/lang.de.php (100%) diff --git a/lang.de.php b/lang/lang.de.php similarity index 100% rename from lang.de.php rename to lang/lang.de.php diff --git a/language.php b/language.php index 17c3004..d44568c 100644 --- a/language.php +++ b/language.php @@ -3,5 +3,5 @@ $lang = "en"; if(isset($_GET['lang'])){ $lang = $_GET['lang']; } -require_once("lang.".$lang.".php"); +require_once("lang/lang.".$lang.".php"); ?> From f306dda4f91d32e4c24adc6d022604854e5a7028 Mon Sep 17 00:00:00 2001 From: Krombel Date: Sun, 11 Feb 2018 19:48:38 +0100 Subject: [PATCH 03/19] do not request password on register request the aim is that the initial password is generated and send on register approval --- lang/lang.de.php | 2 +- register.php | 24 ++---------------------- 2 files changed, 3 insertions(+), 23 deletions(-) diff --git a/lang/lang.de.php b/lang/lang.de.php index c1f4489..4ba80f9 100644 --- a/lang/lang.de.php +++ b/lang/lang.de.php @@ -1,7 +1,7 @@ "Sitzungstoken nicht vorhanden oder ungültig.", -"UNKNOWN_USER_OR_PASSWORD" => "Nutzername und/oder Passwort(-Wiederholung) fehlen", +"UNKNOWN_USERNAME" => "Nutzername fehlt", "USERNAME_LENGTH_INVALID" => "Entweder mehr als 20 oder weniger als 3 Zeichen für den Nutzernamen verwendet", "USERNAME_NOT_ALNUM" => "Nutzername ist nicht alphanumerisch", "PASSWORD_NOT_MATCH" => "Passwörter stimmen nicht überein", diff --git a/register.php b/register.php index 92683dd..eb177b4 100644 --- a/register.php +++ b/register.php @@ -18,8 +18,8 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") { // token not present or invalid $message = $language["UNKNOWN_SESSION"]; } - elseif (!isset($_POST["username"], $_POST["password"], $_POST["password_confirm"])) { - $message = $language["UNKNOWN_USER_OR_PASSWORD"]; + elseif (!isset($_POST["username"])) { + $message = $language["UNKNOWN_USERNAME"]; } elseif (strlen($_POST["username"] > 20 || strlen($_POST["username"]) < 3)) { $message = $language["USERNAME_LENGTH_INVALID"]; @@ -27,9 +27,6 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") { elseif (ctype_alnum($_POST['username']) != true) { $message = $language["USERNAME_NOT_ALNUM"]; } - elseif ($_POST["password"] != $_POST["password_confirm"]) { - $message = $language["PASSWORD_NOT_MATCH"]; - } elseif (isset($_POST["note"]) && strlen($_POST["note"]) > 50) { $message = $language["NOTE_LENGTH_EXEEDED"]; } @@ -178,23 +175,6 @@ user_name.oninvalid = function(event) { user_name.onkeyup = function (event) { event.target.setCustomValidity(""); } - From bd06342ccf295e370febdf44203f4ad2098987d3 Mon Sep 17 00:00:00 2001 From: Krombel Date: Sun, 11 Feb 2018 20:22:40 +0100 Subject: [PATCH 04/19] add saving registrations to sqlite --- config.sample.php | 2 +- database.php | 29 +++++++++++++++++++++++++++++ register.php | 15 +++++++++++---- 3 files changed, 41 insertions(+), 5 deletions(-) create mode 100644 database.php diff --git a/config.sample.php b/config.sample.php index e998fdb..72f7162 100644 --- a/config.sample.php +++ b/config.sample.php @@ -1,6 +1,6 @@ diff --git a/database.php b/database.php new file mode 100644 index 0000000..3bd1b81 --- /dev/null +++ b/database.php @@ -0,0 +1,29 @@ +exec("CREATE TABLE registrations( + id INTEGER PRIMARY KEY AUTOINCREMENT, + first_name TEXT, + last_name TEXT, + username TEXT, + note TEXT, + email TEXT, + verify_token TEXT, + request_date TIMESTAMP DEFAULT CURRENT_TIMESTAMP)"); +} +else { + // establish connection + $db = new PDO('sqlite:' . $db_file); + $ins_stmt = $db->prepare("INSERT INTO registrations + (first_name, last_name, note, email, username, verify_token) + VALUES (:first_name, :last_name, :note, :email, :username, :verify_token); +} + +// set writeable when not set already +if (!is_writable($db_file)) { + chmod($db_file, 0777); +} +?> \ No newline at end of file diff --git a/register.php b/register.php index eb177b4..02ccca9 100644 --- a/register.php +++ b/register.php @@ -41,15 +41,22 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") { } else { // check valid password + require_once("../database.php"); + $ins_stmt->bindParam(':first_name', $first); + $ins_stmt->bindParam(':last_name', $last); + $ins_stmt->bindParam(':username', $user); + $ins_stmt->bindParam(':note', $note); + $ins_stmt->bindParam(':email', $email); + $ins_stmt->bindParam(':verify_token ', $vToken); $first = filter_var($_POST["first_name"], FILTER_SANITIZE_STRING); $last = filter_var($_POST["last_name"], FILTER_SANITIZE_STRING); $user = filter_var($_POST["username"], FILTER_SANITIZE_STRING); - $pass = filter_var($_POST["password"], FILTER_SANITIZE_STRING); - $email = filter_var($_POST["email"], FILTER_VALIDATE_EMAIL); $note = filter_var($_POST["note"], FILTER_SANITIZE_STRING); + $email = filter_var($_POST["email"], FILTER_VALIDATE_EMAIL); + $vToken= bin2hex(random_bytes(16)); - + $ins_stmt->execute(); $success = true; } if ($success) { @@ -67,7 +74,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") { } else { $_SESSION["token"] = bin2hex(random_bytes(16)); ?> - Registriere dich für cg-s.tk + Registriere dich für <?php echo $homeserver; ?> + + + + +
+
+
+
+
+

+
+
+
+
+
+
+ +
+
+
+
+ +
+
+
+ +
+ +
+ +
+ +
+ + + + +
+
+
+
+
+
+ - - - -
+ + + + +
-
-
-
-

-
-
-
-
-
-
- -
-
-
-
- -
-
-
- -
- -
- -
- -
- - - - -
-
-
-
+
+
+
+

+
+
+
+
+
+
+ +
+
+
+
+ +
+
-
-