From aef4cc0a59276938f0f0aec4d67374f578f2117a Mon Sep 17 00:00:00 2001 From: Zach Copley Date: Thu, 3 Dec 2009 17:06:58 -0800 Subject: Make it impossible to block (and thus unsubscribe from your self-subscription) via the API. Additionally, make it impossible to block yourself or unsubscribe from yourself, period. I also made User use the subs.php helper function for unsubscribing during a block. Hopefully, these changes will get rid of the problem of people accidentally deleting their self-subscriptions once and for all (knock on wood). --- classes/User.php | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-) (limited to 'classes') diff --git a/classes/User.php b/classes/User.php index f905ea2b7..4838fe1c7 100644 --- a/classes/User.php +++ b/classes/User.php @@ -502,6 +502,19 @@ class User extends Memcached_DataObject { // Add a new block record + // no blocking (and thus unsubbing from) yourself + + if ($this->id == $other->id) { + common_log(LOG_WARNING, + sprintf( + "Profile ID %d (%s) tried to block his or herself.", + $profile->id, + $profile->nickname + ) + ); + return false; + } + $block = new Profile_block(); // Begin a transaction @@ -520,15 +533,20 @@ class User extends Memcached_DataObject // Cancel their subscription, if it exists - $sub = Subscription::pkeyGet(array('subscriber' => $other->id, - 'subscribed' => $this->id)); - - if ($sub) { - $result = $sub->delete(); - if (!$result) { - common_log_db_error($sub, 'DELETE', __FILE__); - return false; - } + $result = subs_unsubscribe_to($this, $other); + + if ($result !== true) { + common_log(LOG_WARNING, + sprintf( + "Error trying to unsubscribe profile ID %d (%s) from user ID %d (%s): %s", + $other->id, + $other->nickname, + $this->id, + $this->nickname, + $result + ) + ); + return false; } $block->query('COMMIT'); -- cgit v1.2.3-54-g00ecf From d2b42577de54204d83eb8eac565c25edd4205542 Mon Sep 17 00:00:00 2001 From: Zach Copley Date: Thu, 3 Dec 2009 17:44:34 -0800 Subject: Was deleting wrong subscription during block. Now deletes the blockee's sub if it exists. --- classes/User.php | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) (limited to 'classes') diff --git a/classes/User.php b/classes/User.php index 4838fe1c7..2a4fab7d4 100644 --- a/classes/User.php +++ b/classes/User.php @@ -533,21 +533,7 @@ class User extends Memcached_DataObject // Cancel their subscription, if it exists - $result = subs_unsubscribe_to($this, $other); - - if ($result !== true) { - common_log(LOG_WARNING, - sprintf( - "Error trying to unsubscribe profile ID %d (%s) from user ID %d (%s): %s", - $other->id, - $other->nickname, - $this->id, - $this->nickname, - $result - ) - ); - return false; - } + subs_unsubscribe_to($other->getUser(),$this->getProfile()); $block->query('COMMIT'); -- cgit v1.2.3-54-g00ecf From d31b1d774e5fcbb424ec60688ff4c76badc2b136 Mon Sep 17 00:00:00 2001 From: Craig Andrews Date: Fri, 4 Dec 2009 20:20:44 -0500 Subject: use the new htmloutputter->style() function --- classes/Design.php | 2 +- plugins/Recaptcha/RecaptchaPlugin.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'classes') diff --git a/classes/Design.php b/classes/Design.php index 89ae50c8c..4e7d7dfb2 100644 --- a/classes/Design.php +++ b/classes/Design.php @@ -101,7 +101,7 @@ class Design extends Memcached_DataObject } if (0 != mb_strlen($css)) { - $out->element('style', array('type' => 'text/css'), $css); + $out->style($css); } } diff --git a/plugins/Recaptcha/RecaptchaPlugin.php b/plugins/Recaptcha/RecaptchaPlugin.php index 1a51b16be..3a510ef11 100644 --- a/plugins/Recaptcha/RecaptchaPlugin.php +++ b/plugins/Recaptcha/RecaptchaPlugin.php @@ -69,7 +69,7 @@ class RecaptchaPlugin extends Plugin $action->startXML('html'); - $action->raw(''); + $action->style('#recaptcha_area{float:left;}'); return false; } -- cgit v1.2.3-54-g00ecf From 75cac0fd6b94f77ec8ff32ebc89ec513ee102831 Mon Sep 17 00:00:00 2001 From: Craig Andrews Date: Sat, 5 Dec 2009 21:03:27 -0500 Subject: Added 'login' command that gives you a link that can be used to login to the website --- actions/login.php | 9 +++------ classes/Login_token.php | 42 ++++++++++++++++++++++++++++++++++++++++++ classes/statusnet.ini | 1 + db/08to09.sql | 11 ++++++++++- db/08to09_pg.sql | 10 +++++++++- db/statusnet.sql | 10 ++++++++++ db/statusnet_pg.sql | 12 +++++++++++- lib/command.php | 27 +++++++++++++++++++++++++++ lib/commandinterpreter.php | 6 ++++++ lib/router.php | 2 ++ 10 files changed, 121 insertions(+), 9 deletions(-) create mode 100644 classes/Login_token.php (limited to 'classes') diff --git a/actions/login.php b/actions/login.php index cd1326813..cee29fd09 100644 --- a/actions/login.php +++ b/actions/login.php @@ -79,6 +79,8 @@ class LoginAction extends Action $this->clientError(_('Already logged in.')); } else if ($_SERVER['REQUEST_METHOD'] == 'POST') { $this->checkLogin(); + } else if (isset($args['user_id']) && isset($args['token'])){ + $this->checkLogin($args['user_id'],$args['token']); } else { common_ensure_session(); $this->showForm(); @@ -95,7 +97,7 @@ class LoginAction extends Action * @return void */ - function checkLogin() + function checkLogin($user_id=null, $token=null) { if(isset($token) && isset($user_id)){ //Token based login (from the LoginCommand) @@ -137,11 +139,6 @@ class LoginAction extends Action $user = common_check_user($nickname, $password); } - $nickname = common_canonical_nickname($this->trimmed('nickname')); - $password = $this->arg('password'); - - $user = common_check_user($nickname, $password); - if (!$user) { $this->showForm(_('Incorrect username or password.')); return; diff --git a/classes/Login_token.php b/classes/Login_token.php new file mode 100644 index 000000000..c172b30ab --- /dev/null +++ b/classes/Login_token.php @@ -0,0 +1,42 @@ +. + */ + +if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); } + +require_once INSTALLDIR.'/classes/Memcached_DataObject.php'; + +class Login_token extends Memcached_DataObject +{ + ###START_AUTOCODE + /* the code below is auto generated do not remove the above tag */ + + public $__table = 'login_token'; // table name + public $user_id; // int(4) primary_key not_null + public $token; // char(32) not_null + public $created; // datetime() not_null + public $modified; // timestamp() not_null default_CURRENT_TIMESTAMP + + /* Static get */ + function staticGet($k,$v=NULL) { return DB_DataObject::staticGet('Login_token',$k,$v); } + + /* the code above is auto generated do not remove the tag below */ + ###END_AUTOCODE +} diff --git a/classes/statusnet.ini b/classes/statusnet.ini index 835faeb0b..253f45879 100644 --- a/classes/statusnet.ini +++ b/classes/statusnet.ini @@ -260,6 +260,7 @@ modified = 384 [login_token__keys] user_id = K +token = K [message] id = 129 diff --git a/db/08to09.sql b/db/08to09.sql index 8d463fab4..64640f4ce 100644 --- a/db/08to09.sql +++ b/db/08to09.sql @@ -72,4 +72,13 @@ create table location_namespace ( created datetime not null comment 'date the record was created', modified timestamp comment 'date this record was modified' -) ENGINE=InnoDB CHARACTER SET utf8 COLLATE utf8_bin; \ No newline at end of file +) ENGINE=InnoDB CHARACTER SET utf8 COLLATE utf8_bin; + +create table login_token ( + user_id integer not null comment 'user owning this token' references user (id), + token char(32) not null comment 'token useable for logging in', + created datetime not null comment 'date this record was created', + modified timestamp comment 'date this record was modified', + + constraint primary key (user_id) +) ENGINE=InnoDB CHARACTER SET utf8 COLLATE utf8_bin; diff --git a/db/08to09_pg.sql b/db/08to09_pg.sql index b312d47dd..0bd47dea5 100644 --- a/db/08to09_pg.sql +++ b/db/08to09_pg.sql @@ -39,6 +39,15 @@ create table profile_role ( ); +create table login_token ( + user_id integer not null /* comment 'user owning this token'*/ references "user" (id), + token char(32) not null /* comment 'token useable for logging in'*/, + created timestamp not null DEFAULT CURRENT_TIMESTAMP /* comment 'date this record was created'*/, + modified timestamp /* comment 'date this record was modified'*/, + + primary key (user_id) +); + DROP index fave_user_id_idx; CREATE index fave_user_id_idx on fave (user_id,modified); @@ -60,4 +69,3 @@ ALTER TABLE profile ADD COLUMN lat decimal(10,7) /*comment 'latitude'*/ ; ALTER TABLE profile ADD COLUMN lon decimal(10,7) /*comment 'longitude'*/; ALTER TABLE profile ADD COLUMN location_id integer /* comment 'location id if possible'*/; ALTER TABLE profile ADD COLUMN location_ns integer /* comment 'namespace for location'*/; - \ No newline at end of file diff --git a/db/statusnet.sql b/db/statusnet.sql index f7b3b113b..18abcdfdb 100644 --- a/db/statusnet.sql +++ b/db/statusnet.sql @@ -575,3 +575,13 @@ create table location_namespace ( modified timestamp comment 'date this record was modified' ) ENGINE=InnoDB CHARACTER SET utf8 COLLATE utf8_bin; + +create table login_token ( + user_id integer not null comment 'user owning this token' references user (id), + token char(32) not null comment 'token useable for logging in', + created datetime not null comment 'date this record was created', + modified timestamp comment 'date this record was modified', + + constraint primary key (user_id) +) ENGINE=InnoDB CHARACTER SET utf8 COLLATE utf8_bin; + diff --git a/db/statusnet_pg.sql b/db/statusnet_pg.sql index cd72d66ea..81b329d1e 100644 --- a/db/statusnet_pg.sql +++ b/db/statusnet_pg.sql @@ -570,4 +570,14 @@ create table profile_role ( primary key (profile_id, role) -); \ No newline at end of file +); + +create table login_token ( + user_id integer not null /* comment 'user owning this token'*/ references "user" (id), + token char(32) not null /* comment 'token useable for logging in'*/, + created timestamp not null DEFAULT CURRENT_TIMESTAMP /* comment 'date this record was created'*/, + modified timestamp /* comment 'date this record was modified'*/, + + primary key (user_id) +); + diff --git a/lib/command.php b/lib/command.php index bcc551c81..7e98156b6 100644 --- a/lib/command.php +++ b/lib/command.php @@ -579,6 +579,32 @@ class OnCommand extends Command } } +class LoginCommand extends Command +{ + function execute($channel) + { + $login_token = Login_token::staticGet('user_id',$this->user->id); + if($login_token){ + $login_token->delete(); + } + $login_token = new Login_token(); + $login_token->user_id = $this->user->id; + $login_token->token = common_good_rand(16); + $login_token->created = common_sql_now(); + $result = $login_token->insert(); + if (!$result) { + common_log_db_error($login_token, 'INSERT', __FILE__); + $channel->error($this->user, sprintf(_('Could not create login token for %s'), + $this->user->nickname)); + return; + } + $channel->output($this->user, + sprintf(_('This link is useable only once, and is good for only 2 minutes: %s'), + common_local_url('login', + array('user_id'=>$login_token->user_id, 'token'=>$login_token->token)))); + } +} + class SubscriptionsCommand extends Command { function execute($channel) @@ -666,6 +692,7 @@ class HelpCommand extends Command "reply # - reply to notice with a given id\n". "reply - reply to the last notice from user\n". "join - join group\n". + "login - Get a link to login to the web interface\n". "drop - leave group\n". "stats - get your stats\n". "stop - same as 'off'\n". diff --git a/lib/commandinterpreter.php b/lib/commandinterpreter.php index 25f2e4b3e..665015afc 100644 --- a/lib/commandinterpreter.php +++ b/lib/commandinterpreter.php @@ -41,6 +41,12 @@ class CommandInterpreter return null; } return new HelpCommand($user); + case 'login': + if ($arg) { + return null; + } else { + return new LoginCommand($user); + } case 'subscribers': if ($arg) { return null; diff --git a/lib/router.php b/lib/router.php index 1a090861e..37525319f 100644 --- a/lib/router.php +++ b/lib/router.php @@ -88,6 +88,8 @@ class Router $m->connect('doc/:title', array('action' => 'doc')); + $m->connect('main/login?user_id=:user_id&token=:token', array('action'=>'login'), array('user_id'=> '[0-9]+', 'token'=>'.+')); + // main stuff is repetitive $main = array('login', 'logout', 'register', 'subscribe', -- cgit v1.2.3-54-g00ecf