[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3  *
   4  * This file is part of the phpBB Forum Software package.
   5  *
   6  * @copyright (c) phpBB Limited <https://www.phpbb.com>
   7  * @license GNU General Public License, version 2 (GPL-2.0)
   8  *
   9  * For full copyright and license information, please see
  10  * the docs/CREDITS.txt file.
  11  *
  12  */
  13  
  14  /**
  15  * @ignore
  16  */
  17  if (!defined('IN_PHPBB'))
  18  {
  19      exit;
  20  }
  21  
  22  /**
  23  * ucp_remind
  24  * Sending password reminders
  25  */
  26  class ucp_remind
  27  {
  28      var $u_action;
  29  
  30  	function main($id, $mode)
  31      {
  32          global $config, $phpbb_root_path, $phpEx;
  33          global $db, $user, $auth, $template, $phpbb_container, $phpbb_dispatcher;
  34  
  35          if (!$config['allow_password_reset'])
  36          {
  37              trigger_error($user->lang('UCP_PASSWORD_RESET_DISABLED', '<a href="mailto:' . htmlspecialchars($config['board_contact']) . '">', '</a>'));
  38          }
  39  
  40          $username    = request_var('username', '', true);
  41          $email        = strtolower(request_var('email', ''));
  42          $submit        = (isset($_POST['submit'])) ? true : false;
  43  
  44          add_form_key('ucp_remind');
  45  
  46          if ($submit)
  47          {
  48              if (!check_form_key('ucp_remind'))
  49              {
  50                  trigger_error('FORM_INVALID');
  51              }
  52  
  53              $sql_array = array(
  54                  'SELECT'    => 'user_id, username, user_permissions, user_email, user_jabber, user_notify_type, user_type, user_lang, user_inactive_reason',
  55                  'FROM'        => array(USERS_TABLE => 'u'),
  56                  'WHERE'        => "user_email_hash = '" . $db->sql_escape(phpbb_email_hash($email)) . "'
  57                                      AND username_clean = '" . $db->sql_escape(utf8_clean_string($username)) . "'"
  58              );
  59  
  60              /**
  61              * Change SQL query for fetching user data
  62              *
  63              * @event core.ucp_remind_modify_select_sql
  64              * @var    string    email        User's email from the form
  65              * @var    string    username    User's username from the form
  66              * @var    array    sql_array    Fully assembled SQL query with keys SELECT, FROM, WHERE
  67              * @since 3.1.11-RC1
  68              */
  69              $vars = array(
  70                  'email',
  71                  'username',
  72                  'sql_array',
  73              );
  74              extract($phpbb_dispatcher->trigger_event('core.ucp_remind_modify_select_sql', compact($vars)));
  75  
  76              $sql = $db->sql_build_query('SELECT', $sql_array);
  77              $result = $db->sql_query($sql);
  78              $user_row = $db->sql_fetchrow($result);
  79              $db->sql_freeresult($result);
  80  
  81              if (!$user_row)
  82              {
  83                  trigger_error('NO_EMAIL_USER');
  84              }
  85  
  86              if ($user_row['user_type'] == USER_IGNORE)
  87              {
  88                  trigger_error('NO_USER');
  89              }
  90  
  91              if ($user_row['user_type'] == USER_INACTIVE)
  92              {
  93                  if ($user_row['user_inactive_reason'] == INACTIVE_MANUAL)
  94                  {
  95                      trigger_error('ACCOUNT_DEACTIVATED');
  96                  }
  97                  else
  98                  {
  99                      trigger_error('ACCOUNT_NOT_ACTIVATED');
 100                  }
 101              }
 102  
 103              // Check users permissions
 104              $auth2 = new \phpbb\auth\auth();
 105              $auth2->acl($user_row);
 106  
 107              if (!$auth2->acl_get('u_chgpasswd'))
 108              {
 109                  trigger_error('NO_AUTH_PASSWORD_REMINDER');
 110              }
 111  
 112              $server_url = generate_board_url();
 113  
 114              // Make password at least 8 characters long, make it longer if admin wants to.
 115              // gen_rand_string() however has a limit of 12 or 13.
 116              $user_password = gen_rand_string_friendly(max(8, mt_rand((int) $config['min_pass_chars'], (int) $config['max_pass_chars'])));
 117  
 118              // For the activation key a random length between 6 and 10 will do.
 119              $user_actkey = gen_rand_string(mt_rand(6, 10));
 120  
 121              // Instantiate passwords manager
 122              $passwords_manager = $phpbb_container->get('passwords.manager');
 123  
 124              $sql = 'UPDATE ' . USERS_TABLE . "
 125                  SET user_newpasswd = '" . $db->sql_escape($passwords_manager->hash($user_password)) . "', user_actkey = '" . $db->sql_escape($user_actkey) . "'
 126                  WHERE user_id = " . $user_row['user_id'];
 127              $db->sql_query($sql);
 128  
 129              include_once($phpbb_root_path . 'includes/functions_messenger.' . $phpEx);
 130  
 131              $messenger = new messenger(false);
 132  
 133              $messenger->template('user_activate_passwd', $user_row['user_lang']);
 134  
 135              $messenger->set_addresses($user_row);
 136  
 137              $messenger->anti_abuse_headers($config, $user);
 138  
 139              $messenger->assign_vars(array(
 140                  'USERNAME'        => htmlspecialchars_decode($user_row['username']),
 141                  'PASSWORD'        => htmlspecialchars_decode($user_password),
 142                  'U_ACTIVATE'    => "$server_url/ucp.$phpEx?mode=activate&u={$user_row['user_id']}&k=$user_actkey")
 143              );
 144  
 145              $messenger->send($user_row['user_notify_type']);
 146  
 147              meta_refresh(3, append_sid("{$phpbb_root_path}index.$phpEx"));
 148  
 149              $message = $user->lang['PASSWORD_UPDATED'] . '<br /><br />' . sprintf($user->lang['RETURN_INDEX'], '<a href="' . append_sid("{$phpbb_root_path}index.$phpEx") . '">', '</a>');
 150              trigger_error($message);
 151          }
 152  
 153          $template->assign_vars(array(
 154              'USERNAME'            => $username,
 155              'EMAIL'                => $email,
 156              'S_PROFILE_ACTION'    => append_sid($phpbb_root_path . 'ucp.' . $phpEx, 'mode=sendpassword'))
 157          );
 158  
 159          $this->tpl_name = 'ucp_remind';
 160          $this->page_title = 'UCP_REMIND';
 161      }
 162  }