Implement decline with reason (now with radio buttons)

Fix broken links to mxisd docs

.gitignore

@@ -1,2 +1,5 @@
 config.php
 db_file.sqlite
+
+# do not track sources which will be built by composer
+/vendor/

MatrixConnection.php

@@ -14,6 +14,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
+require_once(__DIR__ . "/helpers.php");
+
 class MatrixConnection {
 
     private $hs;
@@ -45,12 +48,8 @@ class MatrixConnection {
 
         $url = "https://" . $this->hs . "/_matrix/client/r0/rooms/"
                 . urlencode($room_id) . "/send/m.room.message?access_token=" . $this->at;
-        $handle = curl_init($url);
-        curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
-        curl_setopt($handle, CURLOPT_CONNECTTIMEOUT, 5);
-        curl_setopt($handle, CURLOPT_TIMEOUT, 60);
+        $handle = getCurlHandle($url);
         curl_setopt($handle, CURLOPT_POSTFIELDS, json_encode($send_message));
-        curl_setopt($handle, CURLOPT_HTTPHEADER, array("Content-Type: application/json"));
 
         $response = $this->exec_curl_request($handle);
         return isset($response["event_id"]);
@@ -70,40 +69,62 @@ class MatrixConnection {
         }
 
         $url = "https://" . $this->hs . "/_matrix/client/r0/profile/@" . $username . ":" . $this->hs;
-        $handle = curl_init($url);
-        curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
-        curl_setopt($handle, CURLOPT_CONNECTTIMEOUT, 5);
-        curl_setopt($handle, CURLOPT_TIMEOUT, 60);
-        curl_setopt($handle, CURLOPT_HTTPHEADER, array("Content-Type: application/json"));
+        $handle = getCurlHandle($url);
 
         $res = $this->exec_curl_request($handle);
         return !(isset($res["errcode"]) && $res["errcode"] == "M_UNKNOWN");
     }
 
+    function getRegisterNonce() {
+        $url = "https://" . $this->hs . "/_matrix/client/r0/admin/register";
+        $handle = getCurlHandle($url);
+
+        try {
+            $response = $this->exec_curl_request($handle);
+            if (is_array($response) && isset($response["nonce"])) {
+                return $response["nonce"];
+            }
+            throw new Exception("INVALID_RESPONSE_FROM_SERVER");
+        } catch (Exception $e) {
+            if (strcmp("AUTHENTICATION_FAILED", $e->getMessage()) == 0) {
+                throw new Exception("WRONG_REGISTRATION_SHARED_SECRET");
+            } else {
+                throw $e;
+            }
+        }
+    }
+
     function register($username, $password, $shared_secret) {
         if (!$username) {
             error_log("no username provided");
         }
         if (!$password) {
-            error_log("no message to send");
+            error_log("no password provided");
         }
-
-        $mac = hash_hmac('sha1', $username, $shared_secret);
+        $nonce = $this->getRegisterNonce();
+        //TODO allow registering of admin.
+        $hmac_content = $nonce . "\x00" . $username . "\x00" . $password . "\x00notadmin";
+        $mac = hash_hmac('sha1', $hmac_content, $shared_secret);
 
         $data = array(
+            "nonce" => $nonce,
             "username" => $username,
             "password" => $password,
             "mac" => $mac,
         );
-        $url = "https://" . $this->hs . "/_matrix/client/v2_alpha/register";
-        $handle = curl_init($url);
-        curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
-        curl_setopt($handle, CURLOPT_CONNECTTIMEOUT, 5);
-        curl_setopt($handle, CURLOPT_TIMEOUT, 60);
-        curl_setopt($handle, CURLOPT_HTTPHEADER, array("Content-Type: application/json"));
+        $url = "https://" . $this->hs . "/_matrix/client/r0/admin/register";
+        $handle = getCurlHandle($url);
         curl_setopt($handle, CURLOPT_POSTFIELDS, json_encode($data));
 
+        try {
             return $this->exec_curl_request($handle);
+        } catch (Exception $e) {
+            if (strcmp("AUTHENTICATION_FAILED", $e->getMessage()) == 0) {
+                throw new Exception("WRONG_REGISTRATION_SHARED_SECRET");
+            } else {
+                throw $e;
+            }
+        }
     }
 
     function exec_curl_request($handle) {
@@ -126,7 +147,7 @@ class MatrixConnection {
             $response = json_decode($response, true);
             error_log("Request has failed with error {$response['error']}\n");
             if ($http_code == 401) {
-                throw new Exception('Invalid access token provided');
+                throw new Exception("AUTHENTICATION_FAILED");
             }
         } else {
             $response = json_decode($response, true);
@@ -164,7 +185,6 @@ class MatrixMessage {
     function get_object() {
         return $this->message;
     }
-
 }
 
 ?>

README.md

@@ -1,4 +1,6 @@
 # matrix-register-bot
+![state: alpha](https://img.shields.io/badge/state-alpha-yellowgreen.svg)
+[![#matrix-register-bot:msg-net.de](https://img.shields.io/badge/matrix-%23matrix--register--bot%3Amsg--net.de-brightgreen.svg)](https://matrix.to/#/#matrix-register-bot:msg-net.de)
 
 This bot provides a two-step-registration for matrix ([synapse](https://github.com/matrix-org/synapse)).
 
@@ -12,23 +14,42 @@ This is done in several steps:
   - sends them to the user
   - stores them encrypted in own databas or uses that as initial password for registration
 
-To configure synapse so that the users can login that were created via this bot you can either 
-- set `operationMode=synapse` so the bot uses the register api to push the new users to synapse or 
-- integrate it via [matrix-synapse-rest-auth](https://github.com/kamax-io/matrix-synapse-rest-auth#integrate) by configuring your system to point at `internal/login.php`.
+There are two operation modes available:
+- `operationMode=synapse`
+    - No adjustments on your running environment are required. This bot uses the the [Shared-Secret Registration of synapse](https://github.com/matrix-org/synapse/blob/master/docs/admin_api/register_api.rst) to register the users.
+- `operationMode=local`:
+    - Bot handles user management. Therefore it stores the user-data and uses [matrix-synapse-rest-auth](https://github.com/kamax-io/matrix-synapse-rest-auth#integrate) to authenticate the users.
+    - This way it is possible to set the display name of a user on first login (first- and lastname instead of username)
+    - The email address of the user can be used to implement third party lookup (requires [mxisd](https://github.com/kamax-io/mxisd/blob/master/docs/stores/rest.md))
+    - search for users you have not seen yet but are available on the server
 
-When using `operationMode=local` you can have the following benefits (some require [mxisd](https://github.com/kamax-io/mxisd/blob/master/docs/backends/rest.md))
-- Automatically set the display name based on first and last name on first login
-- Use the 3PID lookup for other users (only email)
-- Search for users that you have not seen yet
+## Requirements
+
+- Working PHP environment with
+  - database connection provider \[one of sqlite, mysql, postgres\]
+  - curl extension
+  - mail capability to interact with the users (verification, approval (+ initial password), notifications)
+      - either via sendmail or with credentials
+- [composer](https://getcomposer.org) installed
+- [matrix-synapse-rest-auth](https://github.com/kamax-io/matrix-synapse-rest-auth) when using `operationMode=local`
 
 ## How to install
 
-- Copy `config.sample.php` to `config.php` and configure the bot as you can find there
+```
+git clone https://github.com/krombel/matrix-register-bot
+cd matrix-register-bot
+composer install
+cp config.sample.php config.php
+editor config.php
+```
 - Configure your webserver to have the folder `public` accessible via web.
-  The folder `internal` contains files that only provide API access. They can be accessed by mxisd or matrix-synapse-rest-auth 
+
+
+When running `operationMode=local`:
+- Configure your webserver to provide the folder `internal` internally. This is only meant to be accessible by mxisd and matrix-synapse-rest-auth 
 - To integrate with [matrix-synapse-rest-auth](https://github.com/kamax-io/matrix-synapse-rest-auth):
   - `/_matrix-internal/identity/v1/check_credentials` should map to `internal/login.php`
-- To integrate with [mxisd](https://github.com/kamax-io/mxisd): Have a look at [the docs of mxisd](https://github.com/kamax-io/mxisd/blob/master/docs/backends/rest.md) and apply as follows:
+- To integrate with [mxisd](https://github.com/kamax-io/mxisd): Have a look at [the docs of mxisd](https://github.com/kamax-io/mxisd/blob/master/docs/stores/rest.md) and apply as follows:
 
 
 | Key                            | file which handles that       | Description                                          |
@@ -41,9 +62,11 @@ When using `operationMode=local` you can have the following benefits (some requi
 
 ## Further notes:
 
-### This bot sends mails
-To allow the bot to verify the email address of the user and to interact with them e.g. in case of approval this bot needs a running mailserver configuration.
-This bot relies on php to be properly configured.
+### Security: Passwords from registration form are stored in clear text
+Currently the passwords which are typed in while capturing the register request are stored in clear text.
+The bot needs to access them to trigger a register request with correct credentials.
+It is currently strongly recommended to set `"getPasswordOnRegistration" => false` in your config!
+This leads to autocreating passwords which will then be send to the users directly without storing it.
 
 ### Use the ChangePasswortInterceptor (if `operationMode=local`)
 
@@ -55,5 +78,7 @@ Here is an example for nginx:
                 proxy_set_header X-Forwarded-For $remote_addr;
         }
 ```
-### Chat
-For further questions, comments, feedback and more come and talk in [#matrix-register-bot:msg-net.de](https://matrix.to/#/#matrix-register-bot:msg-net.de)
+### The bot postpones some actions
+There is a cron.php which implements retries and database cleanups (e.g. to remove a username claim)
+For this run cron.php regularly with your system of choice.
+A suggested interval is once per day

composer.json

@@ -0,0 +1,15 @@
+{
+    "name": "krombel/matrix-register-bot",
+    "description": "Register-Bot which implements a 2-factor registration for synapse servers to take part on matrix-communication",
+    "type": "project",
+    "require": {
+        "phpmailer/phpmailer": "^6.0"
+    },
+    "license": "Apache-2.0",
+    "authors": [
+        {
+            "name": "Krombel",
+            "email": "krombel@krombel.de"
+        }
+    ]
+}

composer.lock

@@ -0,0 +1,84 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state",
+        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
+        "This file is @generated automatically"
+    ],
+    "content-hash": "6d67203b6e9fc952ae681c538683a497",
+    "packages": [
+        {
+            "name": "phpmailer/phpmailer",
+            "version": "v6.0.6",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/PHPMailer/PHPMailer.git",
+                "reference": "8190d73eb5def11a43cfb020b7f36db65330698c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/8190d73eb5def11a43cfb020b7f36db65330698c",
+                "reference": "8190d73eb5def11a43cfb020b7f36db65330698c",
+                "shasum": ""
+            },
+            "require": {
+                "ext-ctype": "*",
+                "ext-filter": "*",
+                "php": ">=5.5.0"
+            },
+            "require-dev": {
+                "doctrine/annotations": "1.2.*",
+                "friendsofphp/php-cs-fixer": "^2.2",
+                "phpdocumentor/phpdocumentor": "2.*",
+                "phpunit/phpunit": "^4.8 || ^5.7",
+                "zendframework/zend-eventmanager": "3.0.*",
+                "zendframework/zend-i18n": "2.7.3",
+                "zendframework/zend-serializer": "2.7.*"
+            },
+            "suggest": {
+                "ext-mbstring": "Needed to send email in multibyte encoding charset",
+                "hayageek/oauth2-yahoo": "Needed for Yahoo XOAUTH2 authentication",
+                "league/oauth2-google": "Needed for Google XOAUTH2 authentication",
+                "psr/log": "For optional PSR-3 debug logging",
+                "stevenmaguire/oauth2-microsoft": "Needed for Microsoft XOAUTH2 authentication",
+                "symfony/polyfill-mbstring": "To support UTF-8 if the Mbstring PHP extension is not enabled (^1.2)"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "PHPMailer\\PHPMailer\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "LGPL-2.1"
+            ],
+            "authors": [
+                {
+                    "name": "Jim Jagielski",
+                    "email": "jimjag@gmail.com"
+                },
+                {
+                    "name": "Marcus Bointon",
+                    "email": "phpmailer@synchromedia.co.uk"
+                },
+                {
+                    "name": "Andy Prevost",
+                    "email": "codeworxtech@users.sourceforge.net"
+                },
+                {
+                    "name": "Brent R. Matzelle"
+                }
+            ],
+            "description": "PHPMailer is a full-featured email creation and transfer class for PHP",
+            "time": "2018-11-16T00:41:32+00:00"
+        }
+    ],
+    "packages-dev": [],
+    "aliases": [],
+    "minimum-stability": "stable",
+    "stability-flags": [],
+    "prefer-stable": false,
+    "prefer-lowest": false,
+    "platform": [],
+    "platform-dev": []
+}

config.sample.php

@@ -5,6 +5,18 @@ $config = [
 
     // Which e-mail-adresse shall the bot use to send e-mails?
     "register_email" => 'register_bot@example.com',
+
+    // which settings should be used to send via SMTP Gateway?
+    "smtp" => [
+        "host" => "localhost",
+        "port" => "25",
+        // use authentication?
+        "user" => "register@example.com",
+        "password" => "SecretEMailPassword",
+        // Use some encryption to SMTP-Server? [ssl, tls] or unset
+        "encryption" => False
+    ],
+
     // Where should the bot post registration requests to?
     "register_room" => '$registerRoomID:example.com',
 

cron.php

@@ -19,7 +19,9 @@ require_once(__DIR__ . "/language.php");
 require_once(__DIR__ . "/mail_templates.php");
 require_once(__DIR__ . "/database.php");
 
-$sql = "SELECT id, first_name, last_name, username, email, state, note, verify_token, admin_token FROM registrations "
+$sql = "SELECT id, first_name, last_name, username, password, email,"
+        . " state, note, verify_token, admin_token "
+        . "FROM registrations "
         . "WHERE state = " . RegisterState::PendingEmailSend
         . " OR state = " . RegisterState::PendingAdminSend
         . " OR state = " . RegisterState::PendingRegistration
@@ -87,7 +89,7 @@ foreach ($mx_db->query($sql) as $row) {
                         break;
                     case "local":
                         // register by adding a user to the local database
-                        $password = $mx_db->addUser($row["first_name"], $row["last_name"], $row["username"], $row["email"]);
+                        $password = $mx_db->addUser($row["first_name"], $row["last_name"], $row["username"], $row["password"], $row["email"]);
                         break;
                     default:
                         throw new Exception("Unknown operationMode");

database.php

@@ -78,7 +78,7 @@ class mxDatabase {
 			first_name TEXT,
 			last_name TEXT,
 			username TEXT,
-			password_hash TEXT DEFAULT '',
+			password TEXT DEFAULT '',
 			note TEXT,
 			email TEXT,
 			verify_token TEXT,
@@ -98,7 +98,7 @@ class mxDatabase {
 			)");
         // make sure the bot is allowed to login
         if (!$this->userRegistered("register_bot")) {
-            $password = $this->addUser("Register", "Bot", "register_bot", $config["register_email"]);
+            $password = $this->addUser("Register", "Bot", "register_bot", NULL, $config["register_email"]);
             $config["register_password"] = $password;
             $myfile = fopen(dirname(__FILE__) . "/config.json", "w");
             fwrite($myfile, json_encode($config, JSON_PRETTY_PRINT));
@@ -184,7 +184,7 @@ class mxDatabase {
      *
      * @return ["verify_token"]
      */
-    function addRegistration($first_name, $last_name, $username, $note, $email) {
+    function addRegistration($first_name, $last_name, $username, $password, $note, $email) {
         if ($this->userPendingRegistrations($username)) {
             throw new Exception("USERNAME_PENDING_REGISTRATION");
         }
@@ -196,8 +196,9 @@ class mxDatabase {
         $admin_token = bin2hex(random_bytes(16));
 
         $this->db->exec("INSERT INTO registrations
-			(first_name, last_name, username, note, email, verify_token, admin_token)
-			VALUES ('" . $first_name . "','" . $last_name . "','" . $username . "','" . $note . "','"
+                (first_name, last_name, username, password, note, email, verify_token, admin_token)
+		VALUES ('" . $first_name . "','" . $last_name . "','"
+                . $username . "','" . $password . "','" . $note . "','"
                 . $email . "','" . $verify_token . "','" . $admin_token . "')");
 
         return [
@@ -217,7 +218,7 @@ class mxDatabase {
         $res = $this->db->query($sql);
 
         if ($res->fetchColumn() > 0) {
-            $sql = "SELECT first_name, last_name, username, note, email FROM registrations"
+            $sql = "SELECT first_name, last_name, username, password, note, email FROM registrations"
                     . " WHERE admin_token = '" . $admin_token . "'"
                     . " AND state = " . RegisterState::PendingAdminVerify
                     . " LIMIT 1;";
@@ -282,14 +283,16 @@ class mxDatabase {
      * 			NULL when failed
      *
      */
-    function addUser($first_name, $last_name, $username, $email) {
+    function addUser($first_name, $last_name, $username, $password, $email) {
         // check if user already exists and abort in that case
         if ($this->userRegistered($username)) {
             return NULL;
         }
 
+        if ($password == NULL) {
             // generate a password with 10 characters
             $password = bin2hex(openssl_random_pseudo_bytes(5));
+        }
         $password_hash = password_hash($password, PASSWORD_BCRYPT, ["cost" => 12]);
 
         $sql = "INSERT INTO logins (first_name, last_name, localpart, password_hash, email) VALUES "

helpers.php

@@ -30,4 +30,13 @@ function stripLocalpart($mxid) {
     return $localpart;
 }
 
+function getCurlHandle($url) {
+    $handle = curl_init($url);
+    curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
+    curl_setopt($handle, CURLOPT_CONNECTTIMEOUT, 5);
+    curl_setopt($handle, CURLOPT_TIMEOUT, 60);
+    curl_setopt($handle, CURLOPT_HTTPHEADER, array("Content-Type: application/json"));
+    return $handle;
+}
+
 ?>

lang/lang.de-de.php

@@ -17,6 +17,9 @@
 $language = array(
     "ACCEPT" => "Akzeptieren",
     "DECLINE" => "Ablehnen",
+    "DECLINE_REASON" => "Grund für die Ablehnung",
+    "SUBMIT" => "Abschicken",
+    "MAKE_A_SELECTION" => "Treffe eine Auswahl",
     "SUCCESS" => "Erfolgreich",
     "FIRST_NAME" => "Vorname",
     "LAST_NAME" => "Nachname",
@@ -31,10 +34,13 @@ $language = array(
     "UNKNOWN_SESSION" => "Sitzungstoken nicht vorhanden oder ungültig.",
     "UNKNOWN_USERNAME" => "Nutzername fehlt",
     "UNKNOWN_TOKEN" => "Token ist unbekannt",
-    "USERNAME_LENGTH_INVALID" => "Entweder mehr als 20 oder weniger als 3 Zeichen für den Nutzernamen verwendet",
+    "AUTHENTICATION_FAILED" => "Authentifizierung fehlgeschlagen",
+    "WRONG_REGISTRATION_SHARED_SECRET" => "registration_shared_secret fehlerhaft",
+    "USERNAME_INVALID" => "Nutzername muss aus 3 bis 20 Kleinbuchstaben und Zahlen bestehen",
     "USERNAME_NOT_ALNUM" => "Nutzername ist nicht alphanumerisch",
     "USERNAME_PENDING_REGISTRATION" => "Dieser Nutzername wurde bereits zur Registrierung vorgemerkt. Versuche es später noch einmal oder wähle einen anderen Nutzernamen",
     "USERNAME_REGISTERED" => "Dieser Nutzername wurde bereits registriert. Bitte wähle einen anderen Nutzernamen",
+    "PASSWORD_NOT_PROVIDED" => "Ein oder beide Passwörter wurden nicht gesetzt",
     "PASSWORD_NOT_MATCH" => "Passwörter stimmen nicht überein",
     "NOTE_LENGTH_EXEEDED" => "Notiz ist länger als die erlaubten 50 Zeichen",
     "PLACEHOLDER_NOTE_ABOUT_YOURSELF" => "Notiz zu dir (max. 50 Zeichen)",

lang/lang.en-gb.php

@@ -17,6 +17,9 @@
 $language = array(
     "ACCEPT" => "Accept",
     "DECLINE" => "Decline",
+    "DECLINE_REASON" => "Reason for declining",
+    "SUBMIT" => "Submit",
+    "MAKE_A_SELECTION" => "Make a selection",
     "SUCCESS" => "Success",
     "FIRST_NAME" => "First name",
     "LAST_NAME" => "Last name",
@@ -31,10 +34,13 @@ $language = array(
     "UNKNOWN_SESSION" => "Session token not found of invalid.",
     "UNKNOWN_USERNAME" => "username unknown",
     "UNKNOWN_TOKEN" => "Token is unknown",
-    "USERNAME_LENGTH_INVALID" => "Username cpnsists pf more than 20 or less than 3 characters",
+    "AUTHENTICATION_FAILED" => "Authentication failed",
+    "WRONG_REGISTRATION_SHARED_SECRET" => "wrong registration_shared_secret",
+    "USERNAME_INVALID" => "Username has to consist of 3 to 20 small letters and numbers",
     "USERNAME_NOT_ALNUM" => "Username is not alphanumeric",
     "USERNAME_PENDING_REGISTRATION" => "This username is locked for registration. Try again later or try again with a different username",
     "USERNAME_REGISTERED" => "This username is already registered. Please try again with another username",
+    "PASSWORD_NOT_PROVIDED" => "One or both passwords are not provided",
     "PASSWORD_NOT_MATCH" => "passwords do not match",
     "NOTE_LENGTH_EXEEDED" => "Note consists of more than 50 characters",
     "PLACEHOLDER_NOTE_ABOUT_YOURSELF" => "Note about yourself (max. 50 characters)",
@@ -54,7 +60,8 @@ $language = array(
     "ADMIN_REGISTER_ACCEPTED_BODY" => "The registration request got accepted. The user got notified per email.",
     "ADMIN_REGISTER_DECLINED_BODY" => "The registration request got declined. The user got notified per email.",
     "JUMP_TO_HOMEPAGE" => "To homepage",
-    "TOPIC_PLEASE_REGISTER" => "Please register for @homeserver<small>2-Step-Registration</small>",
+    "TOPIC_PLEASE_REGISTER" => "Please register for @homeserver",
+    "TOPIC_PLEASE_REGISTER_NOTE" => "2-Step-Registration",
     "NOTE_FOR_REGISTRATION" => "@homeserver is a closed chat network where every user has to be confirmed.<br />
         You will get an email once sb. approved your registration. An initial password will be send to you afterwards.
         Please leave a note about yourself (that will only be shown to the admins).<br />

lang/mail.de-de.php

@@ -14,13 +14,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function send_mail($receiver, $subject, $body) {
-    include(__DIR__ . "/../config.php");
-    $headers = "From: " . $config["register_email"] . "\r\n"
-            . "Content-Type: text/plain;charset=utf-8";
-    return mail($receiver, $subject, $body, $headers);
-}
-
 function send_mail_pending_verification($homeserver, $user, $receiver, $verify_url) {
     $subject = "Bitte bestätige Registrierung auf $homeserver";
     $body = "Guten Tag " . $user . ",
@@ -79,7 +72,7 @@ Deine Registrierungsanfrage wurde durch die Administratoren bestätigt.
 
 Zum Anmelden kannst du folgende Zugangsdaten verwenden:
 Nutzername: $username
-Passwort: $password
+Passwort: " . (empty($password) ? "wie selbst gesetzt": $password) . "
 
 Hinweis: Das Passwort kannst du aktuell über die App selbst ändern. Auch wenn das Passwort nirgends
 im Klartext gespeichert wird, kann jemand Zugriff auf diese Mail erlangen und so den Zugriff bekommen.

lang/mail.en-gb.php

@@ -14,13 +14,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-function send_mail($receiver, $subject, $body) {
-    include(__DIR__ . "/../config.php");
-    $headers = "From: " . $config["register_email"] . "\r\n"
-            . "Content-Type: text/plain;charset=utf-8";
-    return mail($receiver, $subject, $body, $headers);
-}
-
 function send_mail_pending_verification($homeserver, $user, $receiver, $verify_url) {
     $subject = "Pleast approve your registration request on $homeserver";
     $body = "Dear " . $user . ",
@@ -78,7 +71,7 @@ Your registration request got verified by the admin team.
 
 To log in you can use the following credentials::
 Username: $username
-Password: $password
+Passwort: " . (empty($password) ? "as self-set": $password) . "
 
 Important: Please change your password as soon as possible after your first login.
 The password is not stored in clear text on the server but people could get access to this mail

mail_templates.php

@@ -15,6 +15,54 @@
  * limitations under the License.
  */
 require_once(__DIR__ . "/config.php");
+
+use PHPMailer\PHPMailer\PHPMailer;
+use PHPMailer\PHPMailer\Exception;
+require_once(__DIR__ . "/vendor/autoload.php");
+
+// standard mail implementation
+function send_mail($receiver, $subject, $body) {
+    // somehow $config is not available when called again => reinit here
+    include(__DIR__ . "/config.php");
+
+    $mail = new PHPMailer(true);
+    try {
+        $mail->CharSet = 'utf-8';                             // Enable utf-8 support for umlauts
+
+        if (is_array($config["smtp"])) {
+            $smtp_conf = $config["smtp"];
+            $mail->isSMTP();                                  // Set mailer to use SMTP
+            $mail->Host = $smtp_conf["host"];                 // Specify main and backup SMTP servers
+            $mail->Port = $smtp_conf["port"];                 // TCP port to connect to
+            if (!empty($smtp_conf["user"])) {
+                $mail->SMTPAuth = true;                       // Enable SMTP authentication
+                $mail->Username = $smtp_conf["user"];         // SMTP username
+                if (!empty($smtp_conf["password"])) {
+                    $mail->Password = $smtp_conf["password"]; // SMTP password
+                }
+            }
+            if (!empty($smtp_conf["encryption"])) {
+                $mail->SMTPSecure = $smtp_conf["encryption"]; // Enable TLS encryption, `ssl` also accepted
+            }
+        } else {
+            // fallback to sendmail functionality (as before)
+            $mail->isSendmail();
+        }
+
+        //Recipients
+        $mail->setFrom($config["register_email"], 'Register Service');
+        $mail->addAddress($receiver);
+        $mail->Subject = $subject;
+        $mail->Body    = $body;
+
+        $mail->send();
+        return True;
+    } catch (Exception $e) {
+        error_log('Message could not be sent. Mailer Error: ' . $mail->ErrorInfo);
+        return False;
+    }
+}
+
 $lang = $config["defaultLanguage"];
 if (isset($_GET['lang'])) {
     $lang = filter_var($_GET['lang'], FILTER_SANITIZE_STRING);

public/index.php

@@ -20,7 +20,7 @@ if (!isset($_SERVER['HTTPS'])) {
 }
 
 require_once(__DIR__ . "/../language.php");
-if (!file_exists("../config.php")) {
+if (!file_exists(__DIR__ . "/../config.php")) {
     print($language["NO_CONFIGURATION"]);
     exit();
 }
@@ -46,17 +46,23 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
             // token not present or invalid
             throw new Exception("UNKNOWN_SESSION");
         }
-        if (!isset($_POST["username"])) {
+        $username = filter_input(INPUT_POST, "username", FILTER_SANITIZE_STRING);
+        if (empty($username)) {
             throw new Exception("UNKNOWN_USERNAME");
         }
-        if (strlen($_POST["username"] > 20 || strlen($_POST["username"]) < 3)) {
-            throw new Exception("USERNAME_LENGTH_INVALID");
+        if (strlen($username) > 20 || strlen($username) < 3) {
+            throw new Exception("USERNAME_INVALID");
         }
-        if (ctype_alnum($_POST['username']) != true) {
+        if (!ctype_alnum($username)) {
             throw new Exception("USERNAME_NOT_ALNUM");
         }
-        if (isset($config["getPasswordOnRegistration"]) && $config["getPasswordOnRegistration"] &&
-                $_POST["password"] != $_POST["password_confirm"]) {
+        if (strcmp($username, strtolower($username)) !== 0) {
+            throw new Exception("USERNAME_INVALID");
+        }
+        if ($storePassword && (!isset($_POST["password"]) || !isset($_POST["password_confirm"]))) {
+                throw new Exception("PASSWORD_NOT_PROVIDED");
+        }
+        if ($storePassword && $_POST["password"] != $_POST["password_confirm"]) {
             throw new Exception("PASSWORD_NOT_MATCH");
         }
         if (isset($_POST["note"]) && strlen($_POST["note"]) > 50) {
@@ -79,7 +85,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
             $first_name = $last_name = "";
         }
 
-        $username = filter_var($_POST["username"], FILTER_SANITIZE_STRING);
+        $password = "";
         if ($storePassword && isset($_POST["password"])) {
             $password = filter_var($_POST["password"], FILTER_SANITIZE_STRING);
         }
@@ -87,7 +93,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
         $email = filter_var($_POST["email"], FILTER_VALIDATE_EMAIL);
 
         require_once(__DIR__ . "/../database.php");
-        $res = $mx_db->addRegistration($first_name, $last_name, $username, $note, $email);
+        $res = $mx_db->addRegistration($first_name, $last_name, $username, $password, $note, $email);
 
         if (!isset($res["verify_token"])) {
             error_log("sth. went wrong. registration did not throw but admin_token not set");
@@ -215,7 +221,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
     <script type="text/javascript">
         var user_name = document.getElementById("username");
         user_name.oninvalid = function (event) {
-            event.target.setCustomValidity("<?php echo $language["USERNAME_LENGTH_INVALID"]; ?>");
+            event.target.setCustomValidity("<?php echo $language["USERNAME_INVALID"]; ?>");
         }
         user_name.onkeyup = function (event) {
             event.target.setCustomValidity("");

public/verify.php

@@ -51,18 +51,21 @@ try {
     $email = $user["email"];
     $admin_token = $user["admin_token"];
 
+    // we have 2 cases: first and last name or just the username
+    $call_name = strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username;
+
     require_once(__DIR__ . "/../MatrixConnection.php");
     $adminUrl = $config["webroot"] . "/verify_admin.php?t=" . $admin_token;
     $mxConn = new MatrixConnection($config["homeserver"], $config["access_token"]);
     $mxMsg = new MatrixMessage();
     $mxMsg->set_body(strtr($language["MSG_USER_WANTS_REGISTER"], [
-        "@name" => (strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username),
+        "@name" => $call_name,
         "@note" => $note,
         "@adminUrl" => $adminUrl
     ]));
     if (isset($language["MSG_USER_WANTS_REGISTER_FORMATTED"])) {
         $mxMsg->set_formatted_body(strtr($language["MSG_USER_WANTS_REGISTER_FORMATTED"], [
-            "@name" => (strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username),
+            "@name" => $call_name,
             "@note" => $note,
             "@adminUrl" => $adminUrl
         ]));
@@ -76,7 +79,7 @@ try {
     $mx_db->setRegistrationStateVerify(
             ($response ? RegisterState::PendingAdminVerify : RegisterState::PendingAdminSend), $token);
 
-    send_mail_pending_approval($config["homeserver"], $first_name . " " . $last_name, $email);
+    send_mail_pending_approval($config["homeserver"], $call_name, $email);
 
     print("<title>" . $language["VERIFICATION_SUCEEDED"] . "</title>");
     print("</head><body>");

public/verify_admin.php

@@ -33,23 +33,19 @@ try {
     if ($_SERVER["REQUEST_METHOD"] != "GET") {
         throw new Exception("Method not allowed");
     }
-    if (!isset($_GET["t"])) {
+    $token = filter_input(INPUT_GET, "t", FILTER_SANITIZE_STRING);
+    if (empty($token)) {
         throw new Exception("UNKNOWN_TOKEN");
     }
-    $token = filter_var($_GET["t"], FILTER_SANITIZE_STRING);
 
     require_once(__DIR__ . "/../database.php");
 
-    $action = NULL;
-    if (isset($_GET["allow"])) {
+    $param_action = filter_input(INPUT_GET, "d", FILTER_SANITIZE_STRING);
+    if ($param_action == "allow") {
         $action = RegisterState::RegistrationAccepted;
-    }
-    $decline_reason = NULL;
-    if (isset($_GET["deny"])) {
+    } elseif ($param_action == "deny") {
         $action = RegisterState::RegistrationDeclined;
-        if (isset($_GET["reason"])) {
-            $decline_reason = filter_var($_GET["reason"], FILTER_SANITIZE_STRING);
-        }
+        $decline_reason = filter_input(INPUT_GET, "decline_reason", FILTER_SANITIZE_STRING);
     }
 
     $user = $mx_db->getUserForApproval($token);
@@ -60,6 +56,9 @@ try {
     $first_name = $user["first_name"];
     $last_name = $user["last_name"];
     $username = $user["username"];
+    // we have 2 cases: first and last name or just the username
+    $call_name = strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username;
+
     $note = $user["note"];
     $email = $user["email"];
 
@@ -71,11 +70,17 @@ try {
         $mxConn = new MatrixConnection($config["homeserver"], $config["access_token"]);
 
         $password = NULL;
+        $use_db_password = (isset($config["getPasswordOnRegistration"]) && $config["getPasswordOnRegistration"]);
+        if ($use_db_password && isset($user["password"]) && strlen($user["password"]) > 0) {
+            $password = $user["password"];
+        } else {
+            $use_db_password = false;
+            // generate a password with 10 characters
+            $password = bin2hex(openssl_random_pseudo_bytes(5));
+        }
         switch ($config["operationMode"]) {
             case "synapse":
                 // register with registration_shared_secret
-                // generate a password with 10 characters
-                $password = bin2hex(openssl_random_pseudo_bytes(5));
                 $res = $mxConn->register($username, $password, $config["registration_shared_secret"]);
                 if (!$res) {
                     // something went wrong while registering
@@ -84,7 +89,7 @@ try {
                 break;
             case "local":
                 // register by adding a user to the local database
-                $password = $mx_db->addUser($first_name, $last_name, $username, $email);
+                $password = $mx_db->addUser($first_name, $last_name, $username, $password, $email);
                 break;
             default:
                 throw new Exception("Unknown operationMode");
@@ -92,7 +97,13 @@ try {
         if ($password != NULL) {
             // send registration_success
             $res = send_mail_registration_success(
-                    $config["homeserver"], $first_name . " " . $last_name, $email, $username, $password, $config["howToURL"]
+                    $config["homeserver"],
+                    $call_name,
+                    $email,
+                    $username,
+                    // only send password when auto-created
+                    ($use_db_password ? NULL : $password),
+                    $config["howToURL"]
             );
             if ($res) {
                 $mx_db->setRegistrationStateAdmin(RegisterState::AllDone, $token);
@@ -100,11 +111,11 @@ try {
                 $mx_db->setRegistrationStateAdmin(RegisterState::PendingSendRegistrationMail, $token);
             }
         } else {
-            send_mail_registration_allowed_but_failed($config["homeserver"], $first_name . " " . $last_name, $email);
+            send_mail_registration_allowed_but_failed($config["homeserver"], $call_name, $email);
             $mxMsg = new MatrixMessage();
             $mxMsg->set_type("m.text");
             $mxMsg->set_body(strtr($language["REGISTRATION_FAILED_FOR"], [
-                "@name" => strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username,
+                "@name" => $call_name,
             ]));
             $mxConn->send($config["register_room"], $mxMsg);
             throw new Exception("REGISTRATION_FAILED");
@@ -117,14 +128,13 @@ try {
     } elseif ($action == RegisterState::RegistrationDeclined) {
         $mx_db->setRegistrationStateAdmin(RegisterState::RegistrationDeclined, $token);
         send_mail_registration_decline(
-                $config["homeserver"], strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username, $email, $decline_reason
+                $config["homeserver"], $call_name, $email, $decline_reason
         );
         print("<title>" . $language["ADMIN_VERIFY_SITE_TITLE"] . "</title>");
         print("</head><body>");
         print("<h1>" . $language["ADMIN_VERIFY_SITE_TITLE"] . "</h1>");
         print("<p>" . $language["ADMIN_REGISTER_DECLINED_BODY"] . "</p>");
     } else {
-
         print("<title>" . $language["ADMIN_VERIFY_SITE_TITLE"] . "</title>");
         ?>
         <link href="//netdna.bootstrapcdn.com/bootstrap/3.1.0/css/bootstrap.min.css" rel="stylesheet">
@@ -153,7 +163,7 @@ try {
                             <h3 class="panel-title"><?php echo $language["ADMIN_VERIFY_SITE_TITLE"]; ?></h3>
                         </div>
                         <div class="panel-body">
-                            <form name="appForm" role="form" action="verify_admin.php" method="GET">
+                            <form name="appForm" role="form" onsubmit="return submitForm()" action="verify_admin.php" method="GET">
                                 <?php
                                 if (isset($config["operationMode"]) && $config["operationMode"] === "local") {
                                     // this values will not be used when using the register operation type
@@ -181,9 +191,16 @@ try {
                                     <input type="text" id="username" class="form-control input-sm"
                                            value="<?php echo $username; ?>" disabled=true>
                                 </div>
+                                <div class="form-group">
+                                    <input type="hidden" name="decline_reason" class="form-control input-sm"
+                                           placeholder="<?php echo $language["DECLINE_REASON"]; ?>">
+                                </div>
                                 <input type="hidden" name="t" id="token" value="<?php echo $token; ?>">
-                                <input type="submit" name="allow" value="<?php echo $language["ACCEPT"]; ?>" class="btn btn-info btn-block">
-                                <input type="submit" name="deny" value="<?php echo $language["DECLINE"]; ?>" class="btn btn-info btn-block">
+                                <div class="form-group">
+                                    <input type="radio" name="d" value="allow"><?php echo $language["ACCEPT"]; ?>
+                                    <input type="radio" name="d" value="deny"><?php echo $language["DECLINE"]; ?>
+                                </div>
+                                <input type="submit" value="<?php echo $language["SUBMIT"]; ?>" class="btn btn-info btn-block">
                             </form>
                         </div>
                     </div>
@@ -191,7 +208,30 @@ try {
             </div>
         </div>
         <script type="text/javascript">
-
+            var rad = document.appForm.d;
+            function isSelected() {
+                for (var i=0; i<rad.length; i++)
+                    if (rad[i].checked)
+                        return true;
+                return false;
+            }
+            function submitForm() {
+                if (isSelected()) {
+                    return true;
+                }
+                alert("<?php echo $language["MAKE_A_SELECTION"];?>");
+                return false;
+            }
+            for(var i = 0; i < rad.length; i++) {
+                rad[i].onclick = function() {
+                    if (this.value === "deny") {
+                        document.appForm.decline_reason.type = "text";
+                    } else {
+                        document.appForm.decline_reason.type = "hidden";
+                    }
+                };
+            }
+        </script>
             <?php
         } // else - no action provided
     } catch (Exception $e) {