510 lines
15 KiB
Perl
510 lines
15 KiB
Perl
package Lemonldap::NG::Portal::Plugins::MailReset;
|
|
|
|
use strict;
|
|
use Encode;
|
|
use Mouse;
|
|
use POSIX qw(strftime);
|
|
use Lemonldap::NG::Portal::Main::Constants qw(
|
|
PE_BADCREDENTIALS
|
|
PE_BADMAILTOKEN
|
|
PE_CAPTCHAEMPTY
|
|
PE_CAPTCHAERROR
|
|
PE_MAILCONFIRMATION_ALREADY_SENT
|
|
PE_MAILCONFIRMOK
|
|
PE_MAILERROR
|
|
PE_MAILFIRSTACCESS
|
|
PE_MAILFORMEMPTY
|
|
PE_MAILNOTFOUND
|
|
PE_MAILOK
|
|
PE_MALFORMEDUSER
|
|
PE_NOTOKEN
|
|
PE_OK
|
|
PE_PASSWORDFIRSTACCESS
|
|
PE_PASSWORDFORMEMPTY
|
|
PE_PASSWORD_OK
|
|
PE_TOKENEXPIRED
|
|
PE_USERNOTFOUND
|
|
);
|
|
|
|
our $VERSION = '2.0.0';
|
|
|
|
extends 'Lemonldap::NG::Portal::Main::Plugin',
|
|
'Lemonldap::NG::Portal::Lib::SMTP';
|
|
|
|
# PROPERTIES
|
|
|
|
# Mail timeout token generator
|
|
has mailott => (
|
|
is => 'rw',
|
|
default => sub {
|
|
my $ott =
|
|
$_[0]->{p}->loadModule('Lemonldap::NG::Portal::Lib::OneTimeToken');
|
|
$ott->timeout( $_[0]->conf->{mailTimeout} || $_[0]->conf->{timeout} );
|
|
return $ott;
|
|
}
|
|
);
|
|
|
|
# Form timout token generator (used if requireToken is set)
|
|
has ott => ( is => 'rw' );
|
|
|
|
# Captcha generator
|
|
has captcha => ( is => 'rw' );
|
|
|
|
# INITIALIZATION
|
|
|
|
sub init {
|
|
my ($self) = @_;
|
|
|
|
# Declare REST route
|
|
$self->addUnauthRoute( resetpwd => 'resetPwd', [ 'POST', 'GET' ] );
|
|
|
|
# Initialize Captcha if needed
|
|
if ( $self->conf->{captcha_mail_enabled} ) {
|
|
$self->captcha( $self->p->loadModule('::Lib::Captcha') ) or return 0;
|
|
}
|
|
|
|
# Initialize form token if needed (captcha provides also a token)
|
|
elsif ( $self->conf->{requireToken} ) {
|
|
$_[0]->ott(
|
|
$_[0]->p->loadModule('Lemonldap::NG::Portal::Lib::OneTimeToken') )
|
|
or return 0;
|
|
$_[0]->ott->timeout( $_[0]->conf->{formTimeout} );
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
# RUNNIG METHODS
|
|
|
|
# Handle reset requests
|
|
sub resetPwd {
|
|
my ( $self, $req ) = @_;
|
|
|
|
# Check parameters
|
|
$req->error( $self->_reset($req) );
|
|
|
|
# Display form
|
|
my ( $tpl, $prms ) = $self->display($req);
|
|
return $self->p->sendHtml( $req, $tpl, params => $prms );
|
|
}
|
|
|
|
sub _reset {
|
|
my ( $self, $req ) = @_;
|
|
my ( $mailToken, $newPwd, $confirmPwd );
|
|
|
|
# Check for first access
|
|
$mailToken = $req->datas->{mailToken} = $req->param('mail_token');
|
|
unless ( $req->param('mail') || $mailToken ) {
|
|
$self->setSecurity($req);
|
|
return PE_MAILFIRSTACCESS if ( $req->method eq 'GET' );
|
|
return PE_MAILFORMEMPTY;
|
|
}
|
|
|
|
# Check for mail link
|
|
if ($mailToken) {
|
|
$self->lmLog( "Token given for password reset: " . $mailToken,
|
|
'debug' );
|
|
|
|
# Check if token is valid
|
|
my $mailSession = $self->mailott->getToken($mailToken);
|
|
unless ($mailSession) {
|
|
$self->p->userNotice('Bad reset token');
|
|
return PE_BADMAILTOKEN;
|
|
}
|
|
|
|
$req->{mail} = $mailSession->{user};
|
|
$req->datas->{mailAddress} =
|
|
$mailSession->{ $self->conf->{mailSessionKey} };
|
|
$self->lmLog( 'User associated to: ' . $req->{mail}, 'debug' );
|
|
}
|
|
|
|
# Check for values posted
|
|
else {
|
|
|
|
# Use submitted value
|
|
$req->{mail} = $req->param('mail');
|
|
|
|
# Check if token exists
|
|
my $token;
|
|
if ( $self->ott or $self->captcha ) {
|
|
$token = $req->param('token');
|
|
unless ($token) {
|
|
$self->setSecurity($req);
|
|
$self->p->userNotice('Reset try without token');
|
|
return PE_NOTOKEN;
|
|
}
|
|
}
|
|
|
|
# Captcha for register form
|
|
if ( $self->captcha ) {
|
|
my $captcha = $req->param('captcha');
|
|
|
|
unless ($captcha) {
|
|
$self->p->userNotice('Reset try with captcha not filled');
|
|
|
|
# Set captcha or token
|
|
$self->setSecurity($req);
|
|
return PE_CAPTCHAEMPTY;
|
|
}
|
|
|
|
# Check captcha
|
|
unless ( $self->captcha->validateCaptcha( $token, $captcha ) ) {
|
|
$self->p->userInfo('Captcha failed: wrong code');
|
|
|
|
# Set captcha or token
|
|
$self->setSecurity($req);
|
|
return PE_CAPTCHAERROR;
|
|
}
|
|
$self->lmLog( "Captcha code verified", 'debug' );
|
|
}
|
|
elsif ( $self->ott ) {
|
|
unless ( $self->ott->getToken($token) ) {
|
|
$self->setSecurity($req);
|
|
$self->p->userNotice('Reset try with expired/bas token');
|
|
return PE_TOKENEXPIRED;
|
|
}
|
|
}
|
|
unless ( $req->{mail} =~ /$self->{conf}->{userControl}/o ) {
|
|
$self->setSecurity($req);
|
|
return PE_MALFORMEDUSER;
|
|
}
|
|
}
|
|
|
|
# Search user in database
|
|
#$req->user( $req->{mail} );
|
|
$req->steps(
|
|
[
|
|
'getUser', 'setSessionInfo',
|
|
'setMacros', 'setGroups',
|
|
'setPersistentSessionInfo', 'setLocalGroups'
|
|
]
|
|
);
|
|
if ( my $error = $self->p->process($req) ) {
|
|
if ( $error == PE_USERNOTFOUND or $error = PE_BADCREDENTIALS ) {
|
|
$self->p->userNotice(
|
|
"Reset asked for a unvalid user ($req->{mail})");
|
|
|
|
# To avoid mail enumeration, return OK
|
|
return PE_MAILCONFIRMOK;
|
|
}
|
|
return $error;
|
|
}
|
|
|
|
# Build temporary session
|
|
my $mailSession = $self->getMailSession( $req->{mail} );
|
|
unless ( $mailSession or $mailToken ) {
|
|
|
|
# Create a new session
|
|
|
|
my $infos = {};
|
|
|
|
$mailSession = $self->p->getApacheSession();
|
|
|
|
# Set _utime for session autoremove
|
|
# Use default session timeout and mail session timeout to compute it
|
|
my $time = time();
|
|
my $timeout = $self->conf->{timeout};
|
|
my $mailTimeout = $self->conf->{mailTimeout} || $timeout;
|
|
|
|
$infos->{_utime} = $time + ( $mailTimeout - $timeout );
|
|
|
|
# Store expiration timestamp for further use
|
|
$infos->{mailSessionTimeoutTimestamp} = $time + $mailTimeout;
|
|
|
|
# Store start timestamp for further use
|
|
$infos->{mailSessionStartTimestamp} = $time;
|
|
|
|
# Store mail
|
|
$infos->{ $self->conf->{mailSessionKey} } =
|
|
$self->p->getFirstValue(
|
|
$req->{sessionInfo}->{ $self->conf->{mailSessionKey} } );
|
|
|
|
# Store user
|
|
$infos->{user} = $req->{mail};
|
|
|
|
# Store type
|
|
$infos->{_type} = "mail";
|
|
|
|
# Update session
|
|
$mailSession->update($infos);
|
|
$req->id($mailSession->id);
|
|
}
|
|
elsif($mailSession) {
|
|
$self->lmLog( 'Mail session found: ' . $mailSession->id, 'debug' );
|
|
$req->datas->{mailAlreadySent} = 1;
|
|
}
|
|
|
|
# Send confirmation mail
|
|
unless ($mailToken) {
|
|
|
|
# Mail session expiration date
|
|
my $expTimestamp = $mailSession->data->{mailSessionTimeoutTimestamp};
|
|
|
|
$self->lmLog( "Mail expiration timestamp: $expTimestamp", 'debug' );
|
|
|
|
$req->datas->{expMailDate} =
|
|
strftime( "%d/%m/%Y", localtime $expTimestamp );
|
|
$req->datas->{expMailTime} =
|
|
strftime( "%H:%M", localtime $expTimestamp );
|
|
|
|
# Mail session start date
|
|
my $startTimestamp = $mailSession->data->{mailSessionStartTimestamp};
|
|
|
|
$self->lmLog( "Mail start timestamp: $startTimestamp", 'debug' );
|
|
$req->datas->{startMailDate} =
|
|
strftime( "%d/%m/%Y", localtime $startTimestamp );
|
|
$req->datas->{startMailTime} =
|
|
strftime( "%H:%M", localtime $startTimestamp );
|
|
|
|
# Ask if user want another confirmation email
|
|
if ( $req->datas->{mailAlreadySent}
|
|
and !$req->param('resendconfirmation') )
|
|
{
|
|
$self->p->userNotice(
|
|
'Reset mail already sent to ' . $req->{mail} );
|
|
|
|
# To avoid enumeration, return OK
|
|
return PE_MAILCONFIRMOK;
|
|
}
|
|
|
|
# Get mail address
|
|
$req->datas->{mailAddress} ||=
|
|
$self->p->getFirstValue(
|
|
$req->{sessionInfo}->{ $self->conf->{mailSessionKey} } );
|
|
return PE_MAILERROR unless($req->datas->{mailAddress});
|
|
|
|
# Build confirmation url
|
|
my $url =
|
|
$self->conf->{mailUrl}
|
|
. "?mail_token="
|
|
. $req->{id}
|
|
. '&skin='
|
|
. $self->p->getSkin($req);
|
|
$url .= '&'
|
|
. $self->conf->{authChoiceParam} . '='
|
|
. $req->datas->{_authChoice}
|
|
if ( $req->datas->{_authChoice} );
|
|
|
|
# Build mail content
|
|
my $subject = $self->conf->{mailConfirmSubject};
|
|
my $body;
|
|
my $html;
|
|
if ( $self->conf->{mailConfirmBody} ) {
|
|
|
|
# We use a specific text message, no html
|
|
$body = $self->{mailConfirmBody};
|
|
}
|
|
else {
|
|
|
|
# Use HTML template
|
|
my $tplfile =
|
|
$self->conf->{templateDir} . '/'
|
|
. $self->conf->{portalSkin}
|
|
. '/mail_confirm.tpl';
|
|
$tplfile = $self->conf->{templateDir} . '/common/mail_confirm.tpl'
|
|
unless ( -e $tplfile );
|
|
my $template = HTML::Template->new( filename => $tplfile, );
|
|
$body = $template->output();
|
|
$html = 1;
|
|
}
|
|
|
|
# Replace variables in body
|
|
$body =~ s/\$expMailDate/$req->datas->{expMailDate}/ge;
|
|
$body =~ s/\$expMailTime/$req->datas->{expMailTime}/ge;
|
|
$body =~ s/\$url/$url/g;
|
|
$body =~ s/\$(\w+)/decode("utf8",$req->{sessionInfo}->{$1})/ge;
|
|
|
|
# Send mail
|
|
unless (
|
|
$self->send_mail( $req->datas->{mailAddress}, $subject, $body, $html ) )
|
|
{
|
|
$self->lmLog( 'Unable to send reset mail', 'debug' );
|
|
|
|
# Don't return an error here to avoid enumeration
|
|
}
|
|
return PE_MAILCONFIRMOK;
|
|
}
|
|
|
|
# mailToken is valid, time to change password
|
|
|
|
# Check if user wants to generate the new password
|
|
if ( $req->param('reset') ) {
|
|
$self->lmLog(
|
|
"Reset password request for " . $req->{sessionInfo}->{_user},
|
|
'debug' );
|
|
|
|
# Generate a complex password
|
|
my $password =
|
|
$self->gen_password( $self->conf->{randomPasswordRegexp} );
|
|
|
|
$self->lmLog( "Generated password: " . $password, 'debug' );
|
|
|
|
$req->datas->{newpassword} = $password;
|
|
$req->datas->{confirmpassword} = $password;
|
|
$req->datas->{forceReset} = 1;
|
|
}
|
|
|
|
# Else a password is required in request
|
|
else {
|
|
$req->datas->{newpassword} = $req->param('newpassword');
|
|
$req->datas->{confirmpassword} = $req->param('confirmpassword');
|
|
unless ( $req->datas->{newpassword} && $req->datas->{confirmpassword} )
|
|
{
|
|
return PE_PASSWORDFIRSTACCESS if ( $req->method eq 'GET' );
|
|
return PE_PASSWORDFORMEMPTY;
|
|
}
|
|
|
|
# Modify the password TODO: change this
|
|
my $tmp = $self->conf->{portalRequireOldPassword};
|
|
$self->conf->{portalRequireOldPassword} = 0;
|
|
my $result = $self->p->_passwordDB->modifyPassword($req);
|
|
|
|
# Mail token can be used only one time, delete the session if all is ok
|
|
return $result unless ( $result == PE_PASSWORD_OK or $result == PE_OK );
|
|
}
|
|
|
|
# Send mail containing the new password
|
|
$req->datas->{mailAddress} ||=
|
|
$self->p->getFirstValue(
|
|
$req->{sessionInfo}->{ $self->conf->{mailSessionKey} } );
|
|
|
|
# Build mail content
|
|
my $subject = $self->conf->{mailSubject};
|
|
my $body;
|
|
my $html;
|
|
if ( $self->conf->{mailBody} ) {
|
|
|
|
# We use a specific text message, no html
|
|
$body = $self->{mailBody};
|
|
}
|
|
else {
|
|
|
|
# Use HTML template
|
|
my $tplfile =
|
|
$self->conf->{templateDir} . '/'
|
|
. $self->conf->{portalSkin}
|
|
. '/mail_password.tpl';
|
|
$tplfile = $self->conf->{templateDir} . '/common/mail_password.tpl'
|
|
unless ( -e $tplfile );
|
|
my $template = HTML::Template->new( filename => $tplfile, );
|
|
$body = $template->output();
|
|
$html = 1;
|
|
}
|
|
|
|
# Replace variables in body
|
|
my $password = $req->datas->{newpassword};
|
|
$body =~ s/\$password/$password/g;
|
|
$body =~ s/\$(\w+)/decode("utf8",$req->{sessionInfo}->{$1})/ge;
|
|
|
|
# Send mail
|
|
return PE_MAILERROR
|
|
unless $self->send_mail( $self->{mailAddress}, $subject, $body, $html );
|
|
|
|
PE_MAILOK;
|
|
}
|
|
|
|
sub setSecurity {
|
|
my ( $self, $req ) = @_;
|
|
if ( $self->captcha ) {
|
|
$self->captcha->setCaptcha($req);
|
|
}
|
|
elsif ( $self->ott ) {
|
|
$self->ott->setToken($req);
|
|
}
|
|
}
|
|
|
|
sub display {
|
|
my ( $self, $req ) = @_;
|
|
my %tplPrm = (
|
|
PORTAL_URL => $self->conf->{portal},
|
|
SKIN_PATH => '/static',
|
|
SKIN => $self->conf->{portalSkin},
|
|
SKIN_BG => $self->conf->{portalSkinBackground},
|
|
AUTH_ERROR => $req->error,
|
|
AUTH_ERROR_TYPE => $req->error_type,
|
|
CHOICE_PARAM => $self->conf->{authChoiceParam},
|
|
CHOICE_VALUE => $req->{_authChoice},
|
|
EXPMAILDATE => $req->datas->{expMailDate},
|
|
EXPMAILTIME => $req->datas->{expMailTime},
|
|
STARTMAILDATE => $req->datas->{startMailDate},
|
|
STARTMAILTIME => $req->datas->{startMailTime},
|
|
MAILALREADYSENT => $req->datas->{mailAlreadySent},
|
|
MAIL => (
|
|
$self->p->checkXSSAttack( 'mail', $req->{mail} ) ? ""
|
|
: $self->{mail}
|
|
),
|
|
MAIL_TOKEN => (
|
|
$self->p->checkXSSAttack( 'mail_token', $req->datas->{mailToken} )
|
|
? ""
|
|
: $req->datas->{mailToken}
|
|
),
|
|
DISPLAY_FORM => 0,
|
|
DISPLAY_RESEND_FORM => 0,
|
|
DISPLAY_CONFIRMMAILSENT => 0,
|
|
DISPLAY_MAILSENT => 0,
|
|
DISPLAY_PASSWORD_FORM => 0,
|
|
);
|
|
|
|
# Display captcha if it's enabled
|
|
if ( $req->captcha ) {
|
|
$tplPrm{CAPTCHA_SRC} = $req->captcha;
|
|
$tplPrm{CAPTCHA_SIZE} = $self->conf->{captcha_size};
|
|
}
|
|
if ( $req->token ) {
|
|
$tplPrm{TOKEN} = $req->token;
|
|
}
|
|
|
|
# Display form the first time
|
|
if (
|
|
(
|
|
$req->error == PE_MAILFORMEMPTY
|
|
or $req->error == PE_MAILFIRSTACCESS
|
|
or $req->error == PE_MAILNOTFOUND
|
|
or $req->error == PE_CAPTCHAERROR
|
|
or $req->error == PE_CAPTCHAEMPTY
|
|
)
|
|
and !$req->datas->{mailToken}
|
|
)
|
|
{
|
|
$self->lmLog('Display form','debug');
|
|
$tplPrm{DISPLAY_FORM} = 1;
|
|
}
|
|
|
|
# Display mail confirmation resent form
|
|
elsif ( $req->error == PE_MAILCONFIRMATION_ALREADY_SENT ) {
|
|
$self->lmLog('Display resend form','debug');
|
|
$tplPrm{DISPLAY_RESEND_FORM} = 1;
|
|
}
|
|
|
|
# Display confirmation mail sent
|
|
elsif ( $req->error == PE_MAILCONFIRMOK ) {
|
|
$self->lmLog('Display "confirm mail sent"','debug');
|
|
$tplPrm{DISPLAY_CONFIRMMAILSENT} = 1;
|
|
}
|
|
|
|
# Display mail sent
|
|
elsif ( $req->error == PE_MAILOK ) {
|
|
$self->lmLog('Display "mail sent"','debug');
|
|
$tplPrm{DISPLAY_MAILSENT} = 1;
|
|
}
|
|
|
|
# Display password change form
|
|
elsif ( $req->datas->{mailToken}
|
|
and $req->error != PE_MAILERROR
|
|
and $req->error != PE_BADMAILTOKEN
|
|
and $req->error != PE_MAILOK )
|
|
{
|
|
$self->lmLog('Display password form','debug');
|
|
$tplPrm{DISPLAY_PASSWORD_FORM} = 1;
|
|
}
|
|
|
|
# Custom template parameters
|
|
if ( my $customParams = $self->p->getCustomTemplateParameters() ) {
|
|
foreach ( keys %$customParams ) {
|
|
$tplPrm{$_} = $customParams->{$_};
|
|
}
|
|
}
|
|
return 'mail', \%tplPrm;
|
|
}
|
|
|
|
1;
|