Merge branch 'master' of github.com:/krombel/matrix-register-bot

- add note to require php to be able to send mails
- explain operationMode

README.md

@@ -1,28 +1,34 @@
 # matrix-register-bot
 
-This bot provides a two-step-registration for matrix.
+This bot provides a two-step-registration for matrix ([synapse](https://github.com/matrix-org/synapse)).
 
 This is done in several steps:
-- potential new user registers on a bot-provided side
+- potential new user registers on a bot-provided site
+- user has to verify its mail address
 - bot sends a message to predefined room with a registration notification.
 - users in that room now can approve or decline the registration.
 - When approved
-  - the bot creates credentials
+  - the bot creates short time credentials
   - sends them to the user
-  - stores them encrypted in own database
-  - provides that credentials to [matrix-synapse-rest-auth](https://github.com/kamax-io/matrix-synapse-rest-auth#integrate) which has to be configured to query login.php
+  - stores them encrypted in own databas or uses that as initial password for registration
 
-2nd step: Implement the other apis to integrade [mxisd](https://github.com/kamax-io/mxisd/blob/master/docs/backends/rest.md)
+To configure synapse so that the users can login that were created via this bot you can either 
+- set `operationMode=synapse` so the bot uses the register api to push the new users to synapse or 
+- integrate it via [matrix-synapse-rest-auth](https://github.com/kamax-io/matrix-synapse-rest-auth#integrate) by configuring your system to point at `internal/login.php`.
+
+When using `operationMode=local` you can have the following benefits (some require [mxisd](https://github.com/kamax-io/mxisd/blob/master/docs/backends/rest.md))
+- Automatically set the display name based on first and last name on first login
+- Use the 3PID lookup for other users (only email)
+- Search for users that you have not seen yet
 
-This bot takes care for user accounts. So it stores the credentials itself and provides ways to access them via matrix-synapse-rest-auth or mxisd.
 ## How to install
 
 - Copy `config.sample.php` to `config.php` and configure the bot as you can find there
-- Configure your webserver to publish the folder `public`.
-  The folder `internal` contains files that can be accessed by mxisd or matrix-synapse-rest-auth or else via a reverse proxy
+- Configure your webserver to have the folder `public` accessible via web.
+  The folder `internal` contains files that only provide API access. They can be accessed by mxisd or matrix-synapse-rest-auth 
 - To integrate with [matrix-synapse-rest-auth](https://github.com/kamax-io/matrix-synapse-rest-auth):
   - `/_matrix-internal/identity/v1/check_credentials` should map to `internal/login.php`
-- To integrate with [mxisd](https://github.com/kamax-io/mxisd): Have a look at [the docs](https://github.com/kamax-io/mxisd/blob/master/docs/backends/rest.md) and apply as follows:
+- To integrate with [mxisd](https://github.com/kamax-io/mxisd): Have a look at [the docs of mxisd](https://github.com/kamax-io/mxisd/blob/master/docs/backends/rest.md) and apply as follows:
 
 
 | Key                            | file which handles that       | Description                                          |
@@ -33,15 +39,25 @@ This bot takes care for user accounts. So it stores the credentials itself and p
 | rest.endpoints.identity.bulk   | internal/identity_bulk.php    | Endpoint to query a list of 3PID                     |
 
 
-## Implement usage of additional features:
-### Use the ChangePasswortInterceptor:
+## Further notes:
 
-You need a reverse proxy which maps `/_matrix/client/r0/account/password` to `internal/intercept_change_password.php`.
+### This bot sends mails
+To allow the bot to verify the email address of the user and to interact with them e.g. in case of approval this bot needs a running mailserver configuration.
+This bot relies on php to be properly configured.
+
+### Use the ChangePasswortInterceptor (if `operationMode=local`)
+
+To allow users to change their pasword you need a reverse proxy which maps `/_matrix/client/r0/account/password` to `internal/intercept_change_password.php`.
 Here is an example for nginx:
-
 ```
         location /_matrix/client/r0/account/password {
                 proxy_pass http://localhost/mxbot/internal/intercept_change_password.php;
                 proxy_set_header X-Forwarded-For $remote_addr;
         }
 ```
+### The bot postpones some actions
+There is a cron.php which implements retries and database cleanups (e.g. to remove a username claim)
+For this run cron.php regularly with your system of choice.
+
+### Chat
+For further questions, comments, feedback and more come and talk in [#matrix-register-bot:msg-net.de](https://matrix.to/#/#matrix-register-bot:msg-net.de)

config.sample.php

@@ -14,7 +14,17 @@ $config = [
     // optional: Do you have a place where howTo's are located? If not leave this value out
     "howToURL" => "https://my-url-for-storing-howTos.net",
 
+    // set the mode of operation. Basically this defines where the data is stored:
+    // - synapse (using the register endpoint - so no further auth config necessary
+    // - local (recommended; using a table in the database to store credentials;
+    //   synapse has to be configured to use that)
+    "operationMode" => "local",
+
+    // This setting is only required for operationMode = synapse
+    "registration_shared_secret" => "SOME_SECRET_KEY_FROM_HOMESERVER_CONFIG",
+
     // When you want to collect the password on registration set this to true
+    // only evaluated when operationMode = local
     "getPasswordOnRegistration" => false,
 
     // default language: one of [ en-gb | de-de ]

cron.php

@@ -14,17 +14,16 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-require_once("config.php");
-require_once("mail_templates.php");
-require_once("database.php");
+require_once(__DIR__ . "/config.php");
+require_once(__DIR__ . "/language.php");
+require_once(__DIR__ . "/mail_templates.php");
+require_once(__DIR__ . "/database.php");
 
 $sql = "SELECT id, first_name, last_name, username, email, state, note, verify_token, admin_token FROM registrations "
         . "WHERE state = " . RegisterState::PendingEmailSend
         . " OR state = " . RegisterState::PendingAdminSend
         . " OR state = " . RegisterState::PendingRegistration
-        . " OR state = " . RegisterState::PendingSendRegistrationMail
-        . " OR state = " . RegisterState::RegistrationDeclined
-        . " OR state = " . RegisterState::AllDone . ";";
+        . " OR state = " . RegisterState::PendingSendRegistrationMail . ";";
 foreach ($mx_db->query($sql) as $row) {
     $first_name = $row["first_name"];
     $last_name = $row["last_name"];
@@ -46,16 +45,22 @@ foreach ($mx_db->query($sql) as $row) {
                 }
                 break;
             case RegisterState::PendingAdminSend:
-                require_once("MatrixConnection.php");
+                require_once(__DIR__ . "/MatrixConnection.php");
                 $adminUrl = $config["webroot"] . "/verify_admin.php?t=" . $row["admin_token"];
                 $mxConn = new MatrixConnection($config["homeserver"], $config["access_token"]);
                 $mxMsg = new MatrixMessage();
-                $mxMsg->set_body($first_name . ' ' . $last_name . " möchte sich registrieren und hat folgende Notiz hinterlassen:\r\n"
-                        . $row["note"] . "\r\n"
-                        . "Zum Bearbeiten hier klicken:\r\n" . $adminUrl);
-                $mxMsg->set_formatted_body($first_name . ' ' . $last_name . " möchte sich registrieren und hat folgende Notiz hinterlassen:<br />"
-                        . $row["note"] . "<br />"
-                        . "Zum Bearbeiten <a href=\"" . $adminUrl . "\">hier</a> klicken");
+                $mxMsg->set_body(strtr($language["MSG_USER_WANTS_REGISTER"], [
+                    "@name" => (strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username),
+                    "@note" => $note,
+                    "@adminUrl" => $adminUrl
+                ]));
+                if (isset($language["MSG_USER_WANTS_REGISTER_FORMATTED"])) {
+                    $mxMsg->set_formatted_body(strtr($language["MSG_USER_WANTS_REGISTER_FORMATTED"], [
+                        "@name" => (strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username),
+                        "@note" => $note,
+                        "@adminUrl" => $adminUrl
+                    ]));
+                }
                 $mxMsg->set_type("m.text");
                 $response = $mxConn->send($config["register_room"], $mxMsg);
 
@@ -69,11 +74,29 @@ foreach ($mx_db->query($sql) as $row) {
                 break;
             case RegisterState::PendingRegistration:
                 // Registration got accepted but registration failed
-
-                $password = $mx_db->addUser($row["first_name"], $row["last_name"], $row["username"], $row["email"]);
+                switch ($config["operationMode"]) {
+                    case "synapse":
+                        // register with registration_shared_secret
+                        // generate a password with 10 characters
+                        $password = bin2hex(openssl_random_pseudo_bytes(5));
+                        $res = $mxConn->register($row["username"], $password, $config["registration_shared_secret"]);
+                        if (!$res) {
+                            // something went wrong while registering
+                            $password = NULL;
+                        }
+                        break;
+                    case "local":
+                        // register by adding a user to the local database
+                        $password = $mx_db->addUser($row["first_name"], $row["last_name"], $row["username"], $row["email"]);
+                        break;
+                    default:
+                        throw new Exception("Unknown operationMode");
+                }
                 if ($password != NULL) {
                     // send registration_success
-                    $res = send_mail_registration_success($config["homeserver"], $first_name . " " . $last_name, $email, $username, $password, $config["howToURL"]);
+                    $res = send_mail_registration_success(
+                            $config["homeserver"], strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username, $email, $username, $password, $config["howToURL"]
+                    );
                     if ($res) {
                         $mx_db->setRegistrationStateById(RegisterState::AllDone, $row["id"]);
                     } else {
@@ -83,7 +106,9 @@ foreach ($mx_db->query($sql) as $row) {
                     send_mail_registration_allowed_but_failed($config["homeserver"], $first_name . " " . $last_name, $email);
                     $mxMsg = new MatrixMessage();
                     $mxMsg->set_type("m.text");
-                    $mxMsg->set_body("Fehler beim Registrieren von " . $first_name . " " . $last_name . ".");
+                    $mxMsg->set_body(strtr($language["REGISTRATION_FAILED_FOR"], [
+                        "@name" => strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username,
+                    ]));
                     $mxConn->send($config["register_room"], $mxMsg);
                     throw new Exception($language["REGISTRATION_FAILED"]);
                 }
@@ -91,14 +116,29 @@ foreach ($mx_db->query($sql) as $row) {
             case RegisterState::PendingSendRegistrationMail:
                 print ("Error: Unhandled state: PendingSendRegistrationMail for " . $first_name . " " . $last_name . " (" . $username . ")\n");
                 break;
-            case RegisterState::RegistrationDeclined:
-            case RegisterState::AllDone:
-                // do reqular cleanup
-                break;
         }
     } catch (Exception $e) {
         print("Error while handling cron for " . $first_name . " " . $last_name . " (" . $username . ")\n");
         print($e->getMessage());
     }
 }
+
+try {
+    //cleanup: all finished entries older than one month
+    $timestamp = date('Y-m-d H:m:s', strtotime("-1 month"));
+    $mx_db->query("DELETE FROM registrations "
+            . "WHERE request_date < '$timestamp'"
+            . " AND (state = " . RegisterState::RegistrationDeclined
+            . " OR state = " . RegisterState::AllDone . " );"
+    );
+    //cleanup: all entries which are pending email registration older than two days
+    $timestamp = date('Y-m-d H:m:s', strtotime("-2 days"));
+    $mx_db->query("DELETE FROM registrations "
+            . "WHERE request_date < '$timestamp'"
+            . " AND state = " . RegisterState::PendingEmailVerify . ";"
+    );
+} catch (Exception $e) {
+    print("Error while database cleanup\n");
+    print($e->getMessage());
+}
 ?>

database.php

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-require_once("config.php");
+require_once(__DIR__ . "/config.php");
 if (!isset($config["databaseURI"])) {
     throw new Exception("malformed configuration: databaseURI not defined");
 }
@@ -241,7 +241,7 @@ class mxDatabase {
         $res = $this->db->query($sql);
 
         if ($res->fetchColumn() > 0) {
-            $sql = "SELECT first_name, last_name, note, email, admin_token FROM registrations "
+            $sql = "SELECT first_name, last_name, note, email, username, admin_token FROM registrations "
                     . " WHERE verify_token = '" . $verify_token . "'"
                     . " AND state = " . RegisterState::PendingEmailVerify . " LIMIT 1;";
             foreach ($this->db->query($sql) as $row) {

internal/directory_search.php

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-require_once("../database.php");
+require_once(__DIR__ . "/../database.php");
 $response = [
     "limited" => false,
     "result" => [],
@@ -46,5 +46,5 @@ try {
     error_log("failed with error: " . $e->getMessage());
     $response["error"] = $e->getMessage();
 }
-print (json_encode($response, JSON_PRETTY_PRINT) . "\n");
+print (json_encode($response, JSON_PRETTY_PRINT));
 ?>

internal/identity_bulk.php

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-require_once("../database.php");
+require_once(__DIR__ . "/../database.php");
 $response = [
     "lookup" => []
 ];
@@ -66,5 +66,5 @@ try {
     error_log("ídentity_bulk failed with error: " . $e->getMessage());
     $response["error"] = $e->getMessage();
 }
-print (json_encode($response, JSON_PRETTY_PRINT) . "\n");
+print (json_encode($response, JSON_PRETTY_PRINT));
 ?>

internal/identity_single.php

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-require_once("../database.php");
+require_once(__DIR__ . "/../database.php");
 $response = new stdClass;
 try {
     $inputJSON = file_get_contents('php://input');
@@ -61,5 +61,5 @@ try {
         "error" => $e->getMessage()
     ];
 }
-print (json_encode($response, JSON_PRETTY_PRINT) . "\n");
+print (json_encode($response, JSON_PRETTY_PRINT));
 ?>

internal/intercept_change_password.php

@@ -44,14 +44,14 @@ try {
         throw new Exception('"new_password" is not defined');
     }
 
-    require_once("../helpers.php");
+    require_once(__DIR__ . "/../helpers.php");
     $localpart = stripLocalpart($input["auth"]["user"]);
 
     if (empty($localpart)) {
         throw new Exception("localpart cannot be identified");
     }
 
-    require_once("../database.php");
+    require_once(__DIR__ . "/../database.php");
     if (!$mx_db->updatePassword(
                     $localpart, $input["auth"]["password"], $input["new_password"]
             )) {

internal/login.php

@@ -20,7 +20,7 @@ $response = [
     ]
 ];
 
-require_once("../database.php");
+require_once(__DIR__ . "/../database.php");
 
 abstract class LoginRequester {
 
@@ -56,7 +56,7 @@ try {
     // prefer the localpart attribute of mxisd. But in case of matrix-synapse-rest-auth
     // we have to parse it on our own
     if (empty($localpart)) {
-        require_once("../helpers.php");
+        require_once(__DIR__ . "/../helpers.php");
         $localpart = stripLocalpart($mxid);
     }
 
@@ -108,5 +108,5 @@ try {
     error_log("Auth failed with error: " . $e->getMessage());
     $response["auth"]["error"] = $e->getMessage();
 }
-print (json_encode($response, JSON_PRETTY_PRINT) . "\n");
+print (json_encode($response, JSON_PRETTY_PRINT));
 ?>

lang/lang.de-de.php

@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Copyright 2018 Matthias Kesler
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -53,7 +54,8 @@ $language = array(
     "ADMIN_REGISTER_ACCEPTED_BODY" => "Die Registrierungsanfrage wurde akzeptiert. Der Nutzer wurde per Mail informiert.",
     "ADMIN_REGISTER_DECLINED_BODY" => "Die Registrierungsanfrage wurde angelehnt. Der Nutzer wurde per Mail informiert.",
     "JUMP_TO_HOMEPAGE" => "Zur Startseite",
-    "TOPIC_PLEASE_REGISTER" => "Bitte für @homeserver registrieren<small>2-Schritt-Registrierung</small>",
+    "TOPIC_PLEASE_REGISTER" => "Bitte für @homeserver registrieren",
+    "TOPIC_PLEASE_REGISTER_NOTE" => "2-Schritt-Registrierung",
     "NOTE_FOR_REGISTRATION" => "@homeserver ist ein geschlossenes Chat-Netzwerk in dem jeder Nutzer bestätigt werden muss.<br />
         Du bekommst eine E-Mail wenn jemand deine Mitgliedschaft bestätigt hat. An diese wird auch dein initiales Passwort gesendet.
         Hinterlasse also bitte einen Hinweis zu dir (den nur die Administratoren sehen werden).<br />

lang/lang.en-gb.php

@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Copyright 2018 Matthias Kesler
  * Licensed under the Apache License, Version 2.0 (the "License");

lang/mail.de-de.php

@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Copyright 2018 Matthias Kesler
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -14,15 +15,15 @@
  * limitations under the License.
  */
 function send_mail($receiver, $subject, $body) {
-	include("config.php");
-	$headers = "From: " . $config["register_email"] . "\r\n"
-		. "Content-Type: text/plain;charset=utf-8";
-	return mail($receiver, $subject, $body, $headers);
+    include(__DIR__ . "/../config.php");
+    $headers = "From: " . $config["register_email"] . "\r\n"
+            . "Content-Type: text/plain;charset=utf-8";
+    return mail($receiver, $subject, $body, $headers);
 }
 
 function send_mail_pending_verification($homeserver, $user, $receiver, $verify_url) {
-	$subject = "Bitte bestätige Registrierung auf $homeserver";
-	$body = "Guten Tag " . $user . ",
+    $subject = "Bitte bestätige Registrierung auf $homeserver";
+    $body = "Guten Tag " . $user . ",
 
 Du hast anscheinend versucht dich auf $homeserver zu registrieren.
 Hier gibt es eine zweistufige Registrierung.
@@ -39,12 +40,12 @@ Danach ist eine Re-Registrierung mit deinem gewünschten Nutzernamen für andere
 Vielen Dank für dein Verständnis.
 
 Das Administratoren-Team von " . $homeserver;
-	return send_mail($receiver, $subject, $body );
+    return send_mail($receiver, $subject, $body);
 }
 
 function send_mail_pending_approval($homeserver, $user, $receiver) {
-	$subject = "Registrierung wartet auf Bestätigung durch Administratoren";
-	$body = "Guten Tag " . $user . ",
+    $subject = "Registrierung wartet auf Bestätigung durch Administratoren";
+    $body = "Guten Tag " . $user . ",
 
 Deine Registrierungsanfrage wurde verifiziert und wird nun durch die Administratoren überprüft.
 
@@ -53,12 +54,12 @@ Du bekommst eine weitere E-Mail, sobald deine Registrierung bestätigt oder able
 Vielen Dank für dein Verständnis.
 
 Das Administratoren-Team von " . $homeserver;
-	return send_mail($receiver, $subject, $body );
+    return send_mail($receiver, $subject, $body);
 }
 
 function send_mail_registration_allowed_but_failed($homeserver, $user, $receiver) {
-	$subject = "Registrierung auf $homeserver genehmigt";
-	$body = "Guten Tag " . $user . ",
+    $subject = "Registrierung auf $homeserver genehmigt";
+    $body = "Guten Tag " . $user . ",
 
 Deine Registrierungsanfrage wurde durch die Administratoren bestätigt.
 
@@ -67,13 +68,12 @@ Wir hoffen, das Problem ist bald behoben.
 Wir melden uns, wenn die Registrierung erfolgreich war.
 
 Das Administratoren-Team von " . $homeserver;
-	return send_mail($receiver, $subject, $body);
-
+    return send_mail($receiver, $subject, $body);
 }
 
 function send_mail_registration_success($homeserver, $user, $receiver, $username, $password, $howToURL) {
-	$subject = "Registrierung auf $homeserver erfolgreich";
-	$body = "Guten Tag " . $user . ",
+    $subject = "Registrierung auf $homeserver erfolgreich";
+    $body = "Guten Tag " . $user . ",
 
 Deine Registrierungsanfrage wurde durch die Administratoren bestätigt.
 
@@ -84,41 +84,42 @@ Passwort: $password
 Hinweis: Das Passwort kannst du aktuell über die App selbst ändern. Auch wenn das Passwort nirgends
 im Klartext gespeichert wird, kann jemand Zugriff auf diese Mail erlangen und so den Zugriff bekommen.
 ";
-/*
-Wichtig: Bitte ändere das Passwort direkt nach der Anmeldung.
-Es wird zwar von unserer Seite nicht gespeichert, doch fremde könnten Zugriff auf diese E-Mail
-erhalten und so deinen Account kompromittieren.
- */
-if (!empty($howToURL)) {
-	$body .= "
+    /*
+      Wichtig: Bitte ändere das Passwort direkt nach der Anmeldung.
+      Es wird zwar von unserer Seite nicht gespeichert, doch fremde könnten Zugriff auf diese E-Mail
+      erhalten und so deinen Account kompromittieren.
+     */
+    if (!empty($howToURL)) {
+        $body .= "
 Zu weiteren Hilfestellungen findest du hier eine Auflistung von verschiedenen
 Anleitungen zu verschiedenen Clients:
 $howToURL\n";
-}
-	$body .= "
+    }
+    $body .= "
 Viel Spaß bei der Verwendung von $homeserver.
 Bei Fragen findest du nach der Anmeldung ein paar Räume in denen du sie stellen kannst.
 
 Das Administratoren-Team von " . $homeserver;
-	return send_mail($receiver, $subject, $body);
-
+    return send_mail($receiver, $subject, $body);
 }
+
 function send_mail_registration_decline($homeserver, $user, $receiver, $reason) {
-	$subject = "Registrierung auf $homeserver abgelehnt";
-	$body = "Guten Tag " . $user . ",
+    $subject = "Registrierung auf $homeserver abgelehnt";
+    $body = "Guten Tag " . $user . ",
 
 Deine Registrierungsanfrage wurde durch die Administratoren abgelehnt.\n";
 
-	if (empty($reason)) {
-		$body .= "\nEs wurde kein Grund angegeben\n";
-	} else {
-		$body .= "\nAls Grund wurde folgendes angegeben:\n$reason\n";
-	}
+    if (empty($reason)) {
+        $body .= "\nEs wurde kein Grund angegeben\n";
+    } else {
+        $body .= "\nAls Grund wurde folgendes angegeben:\n$reason\n";
+    }
 
-	$body .= "
+    $body .= "
 Wir hoffen, dass du dies akzeptieren kannst.
 
 Das Administratoren-Team von " . $homeserver;
-	return send_mail($receiver, $subject, $body );
+    return send_mail($receiver, $subject, $body);
 }
+
 ?>

lang/mail.en-gb.php

@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Copyright 2018 Matthias Kesler
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -14,15 +15,15 @@
  * limitations under the License.
  */
 function send_mail($receiver, $subject, $body) {
-	include("config.php");
-	$headers = "From: " . $config["register_email"] . "\r\n"
-		. "Content-Type: text/plain;charset=utf-8";
-	return mail($receiver, $subject, $body, $headers);
+    include(__DIR__ . "/../config.php");
+    $headers = "From: " . $config["register_email"] . "\r\n"
+            . "Content-Type: text/plain;charset=utf-8";
+    return mail($receiver, $subject, $body, $headers);
 }
 
 function send_mail_pending_verification($homeserver, $user, $receiver, $verify_url) {
-	$subject = "Pleast approve your registration request on $homeserver";
-	$body = "Dear " . $user . ",
+    $subject = "Pleast approve your registration request on $homeserver";
+    $body = "Dear " . $user . ",
 
 It seems that you tried to register on $homeserver.
 This homeserver requires a two step registration.
@@ -38,12 +39,12 @@ Others might take your username afterwards.
 Thanks for your patience.
 
 The admin team of " . $homeserver;
-	return send_mail($receiver, $subject, $body );
+    return send_mail($receiver, $subject, $body);
 }
 
 function send_mail_pending_approval($homeserver, $user, $receiver) {
-	$subject = "Registration is pending verification from an admin";
-	$body = "Dear " . $user . ",
+    $subject = "Registration is pending verification from an admin";
+    $body = "Dear " . $user . ",
 
 You have verified your registration request. The admins are now checking your request.
 
@@ -52,12 +53,12 @@ You will get an email once they approve or decline your request.
 Sincerely,
 
 The admin team of " . $homeserver;
-	return send_mail($receiver, $subject, $body );
+    return send_mail($receiver, $subject, $body);
 }
 
 function send_mail_registration_allowed_but_failed($homeserver, $user, $receiver) {
-	$subject = "Registration on $homeserver got approved";
-	$body = "Dear " . $user . ",
+    $subject = "Registration on $homeserver got approved";
+    $body = "Dear " . $user . ",
 
 Your registration request got approved by the admin team.
 
@@ -66,13 +67,12 @@ We hope that the issue will be fixed soon.
 You will get another email with initial credentials once the registration got handled completely.
 
 The admin team of " . $homeserver;
-	return send_mail($receiver, $subject, $body);
-
+    return send_mail($receiver, $subject, $body);
 }
 
 function send_mail_registration_success($homeserver, $user, $receiver, $username, $password, $howToURL) {
-	$subject = "Registration on $homeserver got approved";
-	$body = "Dear " . $user . ",
+    $subject = "Registration on $homeserver got approved";
+    $body = "Dear " . $user . ",
 
 Your registration request got verified by the admin team.
 
@@ -84,35 +84,36 @@ Important: Please change your password as soon as possible after your first logi
 The password is not stored in clear text on the server but people could get access to this mail
 and compromise your account.
 ";
-if (!empty($howToURL)) {
-	$body .= "
+    if (!empty($howToURL)) {
+        $body .= "
 You can find further help here::
 $howToURL\n";
-}
-	$body .= "
+    }
+    $body .= "
 Enjoy your usage of $homeserver.
 You can ask further questions inside of the chat system.
 
 The admin team of " . $homeserver;
-	return send_mail($receiver, $subject, $body);
-
+    return send_mail($receiver, $subject, $body);
 }
+
 function send_mail_registration_decline($homeserver, $user, $receiver, $reason) {
-	$subject = "Registration on $homeserver declined.";
-	$body = "Guten Tag " . $user . ",
+    $subject = "Registration on $homeserver declined.";
+    $body = "Guten Tag " . $user . ",
 
 Your registration request got declined by the admin team.\n";
 
-	if (empty($reason)) {
-		$body .= "\nThey did not provide any reason for this\n";
-	} else {
-		$body .= "\nThey provide following hint for you:\n$reason\n";
-	}
+    if (empty($reason)) {
+        $body .= "\nThey did not provide any reason for this\n";
+    } else {
+        $body .= "\nThey provide following hint for you:\n$reason\n";
+    }
 
-	$body .= "
+    $body .= "
 We hope that you can understand this reason.
 
 The admin team of " . $homeserver;
-	return send_mail($receiver, $subject, $body );
+    return send_mail($receiver, $subject, $body);
 }
+
 ?>

language.php

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-require_once("config.php");
+require_once(__DIR__ . "/config.php");
 $lang = $config["defaultLanguage"];
 
 if (isset($_GET['lang'])) {
@@ -25,7 +25,7 @@ if (!file_exists($lang_file)) {
     error_log("Translation for " . $lang . " not found. Fallback to 'de-de'");
     $lang = "de-de";
 }
-$lang_file = dirname(__FILE__) . "/lang/lang." . $lang . ".php";
+$lang_file = __DIR__ . "/lang/lang." . $lang . ".php";
 require_once($lang_file);
 unset($lang_file);
 ?>

mail_templates.php

@@ -14,16 +14,17 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-require_once("config.php");
+require_once(__DIR__ . "/config.php");
 $lang = $config["defaultLanguage"];
 if (isset($_GET['lang'])) {
     $lang = filter_var($_GET['lang'], FILTER_SANITIZE_STRING);
 }
-$lang_file = dirname(__FILE__) . "/lang/mail." . $lang . ".php";
+$lang_file = __DIR__ . "/lang/mail." . $lang . ".php";
 if (!file_exists($lang_file)) {
     error_log("Mail templates for '" . $lang . "' not found. Fallback to 'de-de'");
     $lang = "de-de";
 }
+$lang_file = __DIR__ . "/lang/mail." . $lang . ".php";
 require_once($lang_file);
 unset($lang_file);
 ?>

public/index.php

@@ -13,19 +13,31 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-require_once "../language.php";
-if (!file_exists("../config.php")) {
-    print($language["NO_CONFIGURATION"]);
-    exit();
-}
-require_once "../config.php";
-
 // enforce admin via https
 if (!isset($_SERVER['HTTPS'])) {
     header('Location: https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], true, 301);
     exit();
 }
 
+require_once(__DIR__ . "/../language.php");
+if (!file_exists("../config.php")) {
+    print($language["NO_CONFIGURATION"]);
+    exit();
+}
+require_once(__DIR__ . "/../config.php");
+
+// this values will not be used when using the register operation type
+$storeFirstLastName = false;
+if (isset($config["operationMode"]) && $config["operationMode"] === "local") {
+    $storeFirstLastName = true;
+}
+
+// currently the case to store the password on our own is the only supported one
+$storePassword = false;
+if (isset($config["getPasswordOnRegistration"]) && $config["getPasswordOnRegistration"] &&
+        isset($config["operationMode"]) && $config["operationMode"] === "synapse") {
+    $storePassword = true;
+}
 session_start();
 
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
@@ -53,23 +65,28 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
         if (!isset($_POST["email"]) || !filter_var($_POST["email"], FILTER_VALIDATE_EMAIL)) {
             throw new Exception("EMAIL_INVALID_FORMAT");
         }
-        if (isset($_POST["first_name"]) && !preg_match("/[A-Z][a-z]+/", $_POST["first_name"])) {
-            throw new Exception("FIRSTNAME_INVALID_FORMAT");
-        }
-        if (isset($_POST["last_name"]) && !preg_match("/[A-Z][a-z]+/", $_POST["last_name"])) {
-            throw new Exception("SIRNAME_INVALID_FORMAT");
+        if ($storeFirstLastName) {
+            // only require first_name and last_name when we will evaluate them
+            if (!isset($_POST["first_name"]) || !preg_match("/[A-Z][a-z]+/", $_POST["first_name"])) {
+                throw new Exception("FIRSTNAME_INVALID_FORMAT");
+            }
+            if (!isset($_POST["last_name"]) || !preg_match("/[A-Z][a-z]+/", $_POST["last_name"])) {
+                throw new Exception("SIRNAME_INVALID_FORMAT");
+            }
+            $first_name = filter_var($_POST["first_name"], FILTER_SANITIZE_STRING);
+            $last_name = filter_var($_POST["last_name"], FILTER_SANITIZE_STRING);
+        } else {
+            $first_name = $last_name = "";
         }
 
-        $first_name = filter_var($_POST["first_name"], FILTER_SANITIZE_STRING);
-        $last_name = filter_var($_POST["last_name"], FILTER_SANITIZE_STRING);
         $username = filter_var($_POST["username"], FILTER_SANITIZE_STRING);
-        if (isset($_POST["password"])) {
+        if ($storePassword && isset($_POST["password"])) {
             $password = filter_var($_POST["password"], FILTER_SANITIZE_STRING);
         }
         $note = filter_var($_POST["note"], FILTER_SANITIZE_STRING);
         $email = filter_var($_POST["email"], FILTER_VALIDATE_EMAIL);
 
-        require_once("../database.php");
+        require_once(__DIR__ . "/../database.php");
         $res = $mx_db->addRegistration($first_name, $last_name, $username, $note, $email);
 
         if (!isset($res["verify_token"])) {
@@ -79,9 +96,9 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
         $verify_token = $res["verify_token"];
 
         $verify_url = $config["webroot"] . "/verify.php?t=" . $verify_token;
-        require_once "../mail_templates.php";
+        require_once(__DIR__ . "/../mail_templates.php");
         $success = send_mail_pending_verification(
-                $config["homeserver"], $first_name . " " . $last_name, $email, $verify_url);
+                $config["homeserver"], $storeFirstLastName ? $first_name . " " . $last_name : $username, $email, $verify_url);
 
         $mx_db->setRegistrationStateVerify(
                 ($success ? RegisterState::PendingEmailVerify : RegisterState::PendingEmailSend), $verify_token);
@@ -105,7 +122,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
 } else {
     $_SESSION["token"] = bin2hex(random_bytes(16));
     ?>
-    <title>Registriere dich für <?php echo $config["homeserver"]; ?></title>
+    <title><?php echo strtr($language["TOPIC_PLEASE_REGISTER"], ["@homeserver" => $config["homeserver"]]); ?></title>
     <link href="//netdna.bootstrapcdn.com/bootstrap/3.1.0/css/bootstrap.min.css" rel="stylesheet">
     <style>
         body{
@@ -129,24 +146,29 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
             <div class="col-xs-12 col-sm-8 col-md-4 col-sm-offset-2 col-md-offset-4">
                 <div class="panel panel-default">
                     <div class="panel-heading">
-                        <h3 class="panel-title"><?php echo strtr($language["TOPIC_PLEASE_REGISTER"], [ "@homeserver" => $config["homeserver"] ]); ?></h3>
+                        <h3 class="panel-title"><?php
+                            echo strtr($language["TOPIC_PLEASE_REGISTER"], ["@homeserver" => $config["homeserver"]])
+                            . "<small>" . $language["TOPIC_PLEASE_REGISTER_NOTE"] . "</small>";
+                            ?></h3>
                     </div>
                     <div class="panel-body">
                         <form name="regForm" role="form" action="index.php" method="post">
-                            <div class="row">
-                                <div class="col-xs-6 col-sm-6 col-md-6">
-                                    <div class="form-group">
-                                        <input type="text" name="first_name" id="first_name" class="form-control input-sm"
-                                               placeholder="<?php echo $language["FIRST_NAME"]; ?>" pattern="[A-Z][a-z]+">
+                            <?php if ($storeFirstLastName) { ?>
+                                <div class="row">
+                                    <div class="col-xs-6 col-sm-6 col-md-6">
+                                        <div class="form-group">
+                                            <input type="text" name="first_name" id="first_name" class="form-control input-sm"
+                                                   placeholder="<?php echo $language["FIRST_NAME"]; ?>" pattern="[A-Z][a-z]+">
+                                        </div>
+                                    </div>
+                                    <div class="col-xs-6 col-sm-6 col-md-6">
+                                        <div class="form-group">
+                                            <input type="text" name="last_name" id="last_name" class="form-control input-sm"
+                                                   placeholder="<?php echo $language["LAST_NAME"]; ?>" pattern="[A-Z][a-z]+">
+                                        </div>
                                     </div>
                                 </div>
-                                <div class="col-xs-6 col-sm-6 col-md-6">
-                                    <div class="form-group">
-                                        <input type="text" name="last_name" id="last_name" class="form-control input-sm"
-                                               placeholder="<?php echo $language["LAST_NAME"]; ?>" pattern="[A-Z][a-z]+">
-                                    </div>
-                                </div>
-                            </div>
+                            <?php } ?>
 
                             <div class="form-group">
                                 <input type="email" name="email" id="email" class="form-control input-sm" placeholder="<?php echo $language["EMAIL_ADDRESS"]; ?>" required>
@@ -160,7 +182,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
                                 <input type="text" name="username" id="username" class="form-control input-sm"
                                        placeholder="<?php echo $language["USERNAME"]; ?>" pattern="[a-z1-9]{3,20}" required>
                             </div>
-                            <?php if (isset($config["getPasswordOnRegistration"]) && $config["getPasswordOnRegistration"]) { ?>
+                            <?php if ($storePassword) { ?>
                                 <div class="row">
                                     <div class="col-xs-6 col-sm-6 col-md-6">
                                         <div class="form-group">
@@ -178,31 +200,19 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
                             <input type="submit" value="<?php echo $language["REGISTER"]; ?>" class="btn btn-info btn-block">
 
                         </form>
-                        <?php if (isset($language["NOTE_FOR_REGISTRATION"])) {
-                            echo "<p>" .  $language["NOTE"] . ": <br />";
-                            echo strtr($language["NOTE_FOR_REGISTRATION"], [ "@homeserver" => $config["homeserver"] ]);
+                        <?php
+                        if (isset($language["NOTE_FOR_REGISTRATION"])) {
+                            echo "<p>" . $language["NOTE"] . ": <br />";
+                            echo strtr($language["NOTE_FOR_REGISTRATION"], ["@homeserver" => $config["homeserver"]]);
                             echo "</p>";
-                        } ?>
+                        }
+                        ?>
                     </div>
                 </div>
             </div>
         </div>
     </div>
     <script type="text/javascript">
-        var first_name = document.getElementById("first_name");
-        first_name.oninvalid = function (event) {
-            event.target.setCustomValidity("<?php echo $language["FIRSTNAME_INVALID_FORMAT"]; ?>");
-        }
-        first_name.onkeyup = function (event) {
-            event.target.setCustomValidity("");
-        }
-        var last_name = document.getElementById("last_name");
-        last_name.oninvalid = function (event) {
-            event.target.setCustomValidity("<?php echo $language["SIRNAME_INVALID_FORMAT"]; ?>");
-        }
-        last_name.onkeyup = function (event) {
-            event.target.setCustomValidity("");
-        }
         var user_name = document.getElementById("username");
         user_name.oninvalid = function (event) {
             event.target.setCustomValidity("<?php echo $language["USERNAME_LENGTH_INVALID"]; ?>");
@@ -210,7 +220,22 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
         user_name.onkeyup = function (event) {
             event.target.setCustomValidity("");
         }
-<?php if (isset($config["getPasswordOnRegistration"]) && $config["getPasswordOnRegistration"]) { ?>
+<?php if ($storeFirstLastName) { ?>
+            var first_name = document.getElementById("first_name");
+            first_name.oninvalid = function (event) {
+                event.target.setCustomValidity("<?php echo $language["FIRSTNAME_INVALID_FORMAT"]; ?>");
+            }
+            first_name.onkeyup = function (event) {
+                event.target.setCustomValidity("");
+            }
+            var last_name = document.getElementById("last_name");
+            last_name.oninvalid = function (event) {
+                event.target.setCustomValidity("<?php echo $language["SIRNAME_INVALID_FORMAT"]; ?>");
+            }
+            last_name.onkeyup = function (event) {
+                event.target.setCustomValidity("");
+            }
+<?php } if ($storePassword) { ?>
             var password = document.getElementById("password")
                     , confirm_password = document.getElementById("password_confirm");
             function validatePassword() {
@@ -225,5 +250,4 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
 <?php } ?>
     </script>
 <?php } ?>
-    </body>
-</html>
+</body></html>

public/verify.php

@@ -13,13 +13,13 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-require_once "../language.php";
+require_once(__DIR__ . "/../language.php");
 if (!file_exists("../config.php")) {
     print($language["NO_CONFIGURATION"]);
     exit();
 }
-require_once "../config.php";
-require_once "../mail_templates.php";
+require_once(__DIR__ . "/../config.php");
+require_once(__DIR__ . "/../mail_templates.php");
 
 // enforce admin via https
 if (!isset($_SERVER['HTTPS'])) {
@@ -38,7 +38,7 @@ try {
     }
     $token = filter_var($_GET["t"], FILTER_SANITIZE_STRING);
 
-    require_once("../database.php");
+    require_once(__DIR__ . "/../database.php");
 
     $user = $mx_db->getUserForVerify($token);
     if ($user == NULL) {
@@ -46,25 +46,26 @@ try {
     }
     $first_name = $user["first_name"];
     $last_name = $user["last_name"];
+    $username = $user["username"];
     $note = $user["note"];
     $email = $user["email"];
     $admin_token = $user["admin_token"];
 
-    require_once("../MatrixConnection.php");
+    require_once(__DIR__ . "/../MatrixConnection.php");
     $adminUrl = $config["webroot"] . "/verify_admin.php?t=" . $admin_token;
     $mxConn = new MatrixConnection($config["homeserver"], $config["access_token"]);
     $mxMsg = new MatrixMessage();
     $mxMsg->set_body(strtr($language["MSG_USER_WANTS_REGISTER"], [
-                "@name" => $first_name . ' ' . $last_name,
-                "@note" => $note,
-                "@adminUrl" => $adminUrl
-            ]));
+        "@name" => (strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username),
+        "@note" => $note,
+        "@adminUrl" => $adminUrl
+    ]));
     if (isset($language["MSG_USER_WANTS_REGISTER_FORMATTED"])) {
         $mxMsg->set_formatted_body(strtr($language["MSG_USER_WANTS_REGISTER_FORMATTED"], [
-                "@name" => $first_name . ' ' . $last_name,
-                "@note" => $note,
-                "@adminUrl" => $adminUrl
-            ]));
+            "@name" => (strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username),
+            "@note" => $note,
+            "@adminUrl" => $adminUrl
+        ]));
     }
     $mxMsg->set_type("m.text");
     $response = $mxConn->send($config["register_room"], $mxMsg);

public/verify_admin.php

@@ -13,13 +13,13 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-require_once "../language.php";
+require_once(__DIR__ . "/../language.php");
 if (!file_exists("../config.php")) {
     print($language["NO_CONFIGURATION"]);
     exit();
 }
-require_once "../config.php";
-require_once "../mail_templates.php";
+require_once(__DIR__ . "/../config.php");
+require_once(__DIR__ . "/../mail_templates.php");
 
 // enforce admin via https
 if (!isset($_SERVER['HTTPS'])) {
@@ -38,7 +38,7 @@ try {
     }
     $token = filter_var($_GET["t"], FILTER_SANITIZE_STRING);
 
-    require_once("../database.php");
+    require_once(__DIR__ . "/../database.php");
 
     $action = NULL;
     if (isset($_GET["allow"])) {
@@ -67,14 +67,33 @@ try {
         $mx_db->setRegistrationStateAdmin(RegisterState::PendingRegistration, $token);
 
         // register user
-        require_once("../MatrixConnection.php");
+        require_once(__DIR__ . "/../MatrixConnection.php");
         $mxConn = new MatrixConnection($config["homeserver"], $config["access_token"]);
 
-        // generate a password with 8 characters
-        $password = $mx_db->addUser($first_name, $last_name, $username, $email);
+        $password = NULL;
+        switch ($config["operationMode"]) {
+            case "synapse":
+                // register with registration_shared_secret
+                // generate a password with 10 characters
+                $password = bin2hex(openssl_random_pseudo_bytes(5));
+                $res = $mxConn->register($username, $password, $config["registration_shared_secret"]);
+                if (!$res) {
+                    // something went wrong while registering
+                    $password = NULL;
+                }
+                break;
+            case "local":
+                // register by adding a user to the local database
+                $password = $mx_db->addUser($first_name, $last_name, $username, $email);
+                break;
+            default:
+                throw new Exception("Unknown operationMode");
+        }
         if ($password != NULL) {
             // send registration_success
-            $res = send_mail_registration_success($config["homeserver"], $first_name . " " . $last_name, $email, $username, $password, $config["howToURL"]);
+            $res = send_mail_registration_success(
+                    $config["homeserver"], $first_name . " " . $last_name, $email, $username, $password, $config["howToURL"]
+            );
             if ($res) {
                 $mx_db->setRegistrationStateAdmin(RegisterState::AllDone, $token);
             } else {
@@ -84,7 +103,9 @@ try {
             send_mail_registration_allowed_but_failed($config["homeserver"], $first_name . " " . $last_name, $email);
             $mxMsg = new MatrixMessage();
             $mxMsg->set_type("m.text");
-            $mxMsg->set_body(strtr($language["REGISTRATION_FAILED_FOR"], [ "@name" => $first_name . " " . $last_name]));
+            $mxMsg->set_body(strtr($language["REGISTRATION_FAILED_FOR"], [
+                "@name" => strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username,
+            ]));
             $mxConn->send($config["register_room"], $mxMsg);
             throw new Exception("REGISTRATION_FAILED");
         }
@@ -95,7 +116,9 @@ try {
         print("<p>" . $language["ADMIN_REGISTER_ACCEPTED_BODY"] . "</p>");
     } elseif ($action == RegisterState::RegistrationDeclined) {
         $mx_db->setRegistrationStateAdmin(RegisterState::RegistrationDeclined, $token);
-        send_mail_registration_decline($config["homeserver"], $first_name . " " . $last_name, $email, $decline_reason);
+        send_mail_registration_decline(
+                $config["homeserver"], strlen($first_name . $last_name) > 0 ? $first_name . " " . $last_name : $username, $email, $decline_reason
+        );
         print("<title>" . $language["ADMIN_VERIFY_SITE_TITLE"] . "</title>");
         print("</head><body>");
         print("<h1>" . $language["ADMIN_VERIFY_SITE_TITLE"] . "</h1>");
@@ -131,21 +154,25 @@ try {
                         </div>
                         <div class="panel-body">
                             <form name="appForm" role="form" action="verify_admin.php" method="GET">
-                                <div class="row">
-                                    <div class="col-xs-6 col-sm-6 col-md-6">
-                                        <div class="form-group">
-                                            <input type="text" id="first_name" class="form-control input-sm"
-                                                   value="<?php echo $first_name; ?>" disabled=true>
+                                <?php
+                                if (isset($config["operationMode"]) && $config["operationMode"] === "local") {
+                                    // this values will not be used when using the register operation type
+                                    ?>
+                                    <div class="row">
+                                        <div class="col-xs-6 col-sm-6 col-md-6">
+                                            <div class="form-group">
+                                                <input type="text" id="first_name" class="form-control input-sm"
+                                                       value="<?php echo $first_name; ?>" disabled=true>
+                                            </div>
+                                        </div>
+                                        <div class="col-xs-6 col-sm-6 col-md-6">
+                                            <div class="form-group">
+                                                <input type="text" id="last_name" class="form-control input-sm"
+                                                       value="<?php echo $last_name; ?>" disabled=true>
+                                            </div>
                                         </div>
                                     </div>
-                                    <div class="col-xs-6 col-sm-6 col-md-6">
-                                        <div class="form-group">
-                                            <input type="text" id="last_name" class="form-control input-sm"
-                                                   value="<?php echo $last_name; ?>" disabled=true>
-                                        </div>
-                                    </div>
-                                </div>
-
+                                <?php } ?>
                                 <div class="form-group">
                                     <input type="text" id="note" class="form-control input-sm" value="<?php echo $note; ?>" disabled=true>
                                 </div>
@@ -157,7 +184,6 @@ try {
                                 <input type="hidden" name="t" id="token" value="<?php echo $token; ?>">
                                 <input type="submit" name="allow" value="<?php echo $language["ACCEPT"]; ?>" class="btn btn-info btn-block">
                                 <input type="submit" name="deny" value="<?php echo $language["DECLINE"]; ?>" class="btn btn-info btn-block">
-
                             </form>
                         </div>
                     </div>
@@ -180,5 +206,5 @@ try {
         print("<a href=\"" . $config["webroot"] . "/index.php" . "\">" . $language["JUMP_TO_HOMEPAGE"] . "</a>");
     }
     ?>
-                    < /body>
-         </html>
+    </body>
+</html>