ZwiiCMS-Team/ZwiiCMS
ZwiiCMS-Team/ZwiiCMS
10
9
Fork 3
Code Releases 153 Activity

param null login

Browse Source
This commit is contained in:
Fred Tempez 2022-10-05 18:16:49 +02:00
parent b0fec2951a
commit 1cf62d4140
1 changed files with 168 additions and 150 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

148
core/module/user/user.php
View File

@ -13,7 +13,8 @@
* @link http://zwiicms.fr/
*/
class user extends common {
class user extends common
{
public static $actions = [
'add' => self::GROUP_ADMIN,
@ -50,7 +51,8 @@ class user extends common {
/**
* Ajout
*/
public function add() {
public function add()
{
// Soumission du formulaire
if ($this->isPost()) {
$check = true;
@ -122,13 +124,14 @@ class user extends common {
/**
* Suppression
*/
public function delete() {
public function delete()
{
// Accès refusé
if (
// L'utilisateur n'existe pas
$this->getData(['user', $this->getUrl(2)]) === null
// Groupe insuffisant
AND ($this->getUrl('group') < self::GROUP_MODERATOR)
and ($this->getUrl('group') < self::GROUP_MODERATOR)
) {
// Valeurs en sortie
$this->addOutput([
@ -166,9 +169,12 @@ class user extends common {
/**
* Édition
*/
public function edit() {
if ($this->getUrl(3) !== $_SESSION['csrf'] &&
$this->getUrl(4) !== $_SESSION['csrf']) {
public function edit()
{
if (
$this->getUrl(3) !== $_SESSION['csrf'] &&
$this->getUrl(4) !== $_SESSION['csrf']
) {
// Valeurs en sortie
$this->addOutput([
'redirect' => helper::baseUrl() . 'user',
@ -180,14 +186,13 @@ class user extends common {
// L'utilisateur n'existe pas
$this->getData(['user', $this->getUrl(2)]) === null
// Droit d'édition
AND (
and (
// Impossible de s'auto-éditer
(
$this->getUser('id') === $this->getUrl(2)
AND $this->getUrl('group') <= self::GROUP_VISITOR
($this->getUser('id') === $this->getUrl(2)
and $this->getUrl('group') <= self::GROUP_VISITOR
)
// Impossible d'éditer un autre utilisateur
OR ($this->getUrl('group') < self::GROUP_MODERATOR)
or ($this->getUrl('group') < self::GROUP_MODERATOR)
)
) {
// Valeurs en sortie
@ -212,31 +217,27 @@ class user extends common {
helper::deleteCookie('ZWII_USER_ID');
helper::deleteCookie('ZWII_USER_PASSWORD');
}
}
else {
} else {
self::$inputNotices['userEditConfirmPassword'] = 'Incorrect';
}
}
else {
} else {
self::$inputNotices['userEditOldPassword'] = 'Incorrect';
}
}
// Modification du groupe
if (
$this->getUser('group') === self::GROUP_ADMIN
AND $this->getUrl(2) !== $this->getUser('id')
and $this->getUrl(2) !== $this->getUser('id')
) {
$newGroup = $this->getInput('userEditGroup', helper::FILTER_INT, true);
}
else {
} else {
$newGroup = $this->getData(['user', $this->getUrl(2), 'group']);
}
// Modification de nom Prénom
if ($this->getUser('group') === self::GROUP_ADMIN) {
$newfirstname = $this->getInput('userEditFirstname', helper::FILTER_STRING_SHORT, true);
$newlastname = $this->getInput('userEditLastname', helper::FILTER_STRING_SHORT, true);
}
else{
} else {
$newfirstname = $this->getData(['user', $this->getUrl(2), 'firstname']);
$newlastname = $this->getData(['user', $this->getUrl(2), 'lastname']);
}
@ -262,7 +263,7 @@ class user extends common {
]
]);
// Redirection spécifique si l'utilisateur change son mot de passe
if($this->getUser('id') === $this->getUrl(2) AND $this->getInput('userEditNewPassword')) {
if ($this->getUser('id') === $this->getUrl(2) and $this->getInput('userEditNewPassword')) {
$redirect = helper::baseUrl() . 'user/login/' . str_replace('/', '_', $this->getUrl());
}
// Redirection si retour en arrière possible
@ -291,7 +292,8 @@ class user extends common {
/**
* Mot de passe perdu
*/
public function forgot() {
public function forgot()
{
// Soumission du formulaire
if ($this->isPost()) {
$userId = $this->getInput('userForgotId', helper::FILTER_ID, true);
@ -335,7 +337,8 @@ class user extends common {
/**
* Liste des utilisateurs
*/
public function index() {
public function index()
{
$userIdsFirstnames = helper::arrayColumn($this->getData(['user']), 'firstname');
ksort($userIdsFirstnames);
foreach ($userIdsFirstnames as $userId => $userFirstname) {
@ -366,7 +369,8 @@ class user extends common {
/**
* Connexion
*/
public function login() {
public function login()
{
// Soumission du formulaire
$logStatus = '';
if ($this->isPost()) {
@ -375,8 +379,8 @@ class user extends common {
// Check le captcha
if (
$this->getData(['config', 'connect', 'captcha'])
AND password_verify($this->getInput('userLoginCaptcha', helper::FILTER_INT), $this->getInput('userLoginCaptchaResult') ) === false )
{
and password_verify($this->getInput('userLoginCaptcha', helper::FILTER_INT), $this->getInput('userLoginCaptchaResult')) === false
) {
$captcha = false;
} else {
$captcha = true;
@ -398,8 +402,10 @@ class user extends common {
]);
// Verrouillage des IP
$ipBlackList = helper::arrayColumn($this->getData(['blacklist']), 'ip');
if ( $this->getData(['blacklist',$userId,'connectFail']) >= $this->getData(['config', 'connect', 'attempt'])
AND in_array($this->getData(['blacklist',$userId,'ip']),$ipBlackList) ) {
if (
$this->getData(['blacklist', $userId, 'connectFail']) >= $this->getData(['config', 'connect', 'attempt'])
and in_array($this->getData(['blacklist', $userId, 'ip']), $ipBlackList)
) {
$logStatus = 'Compte inconnu verrouillé';
// Valeurs en sortie
$this->addOutput([
@ -418,8 +424,10 @@ class user extends common {
*/
} else {
// Cas 4 : le délai de blocage est dépassé et le compte est au max - Réinitialiser
if ($this->getData(['user',$userId,'connectTimeout']) + $this->getData(['config', 'connect', 'timeout']) < time()
AND $this->getData(['user',$userId,'connectFail']) === $this->getData(['config', 'connect', 'attempt']) ) {
if (
$this->getData(['user', $userId, 'connectTimeout']) + $this->getData(['config', 'connect', 'timeout']) < time()
and $this->getData(['user', $userId, 'connectFail']) === $this->getData(['config', 'connect', 'attempt'])
) {
$this->setData(['user', $userId, 'connectFail', 0]);
$this->setData(['user', $userId, 'connectTimeout', 0]);
}
@ -427,10 +435,10 @@ class user extends common {
// Vérification du mot de passe et du groupe
if (
($this->getData(['user', $userId, 'connectTimeout']) + $this->getData(['config', 'connect', 'timeout'])) < time()
AND $this->getData(['user',$userId,'connectFail']) < $this->getData(['config', 'connect', 'attempt'])
AND password_verify($this->getInput('userLoginPassword', helper::FILTER_STRING_SHORT, true), $this->getData(['user', $userId, 'password']))
AND $this->getData(['user', $userId, 'group']) >= self::GROUP_MEMBER
AND $captcha === true
and $this->getData(['user', $userId, 'connectFail']) < $this->getData(['config', 'connect', 'attempt'])
and password_verify($this->getInput('userLoginPassword', helper::FILTER_STRING_SHORT, true), $this->getData(['user', $userId, 'password']))
and $this->getData(['user', $userId, 'group']) >= self::GROUP_MEMBER
and $captcha === true
) {
// RAZ
$this->setData(['user', $userId, 'connectFail', 0]);
@ -446,7 +454,7 @@ class user extends common {
// Valeurs en sortie lorsque le site est en maintenance et que l'utilisateur n'est pas administrateur
if (
$this->getData(['config', 'maintenance'])
AND $this->getData(['user', $userId, 'group']) < self::GROUP_ADMIN
and $this->getData(['user', $userId, 'group']) < self::GROUP_ADMIN
) {
$this->addOutput([
'notification' => 'Seul un administrateur peut se connecter lors d\'une maintenance',
@ -486,18 +494,20 @@ class user extends common {
}
}
}
// Journalisation
$dataLog = mb_detect_encoding(\PHP81_BC\strftime('%d/%m/%y', time()), 'UTF-8', true)
? \PHP81_BC\strftime('%d/%m/%y', time()) . ';' . \PHP81_BC\strftime('%R', time()) . ';'
: utf8_encode(\PHP81_BC\strftime('%d/%m/%y', time())) . ';' . utf8_encode(\PHP81_BC\strftime('%R', time())) . ';';
$dataLog .= helper::getIp($this->getData(['config', 'connect', 'anonymousIp'])) . ';';
$dataLog .= is_null($this->getInput('userLoginId')) ? ';' : $this->getInput('userLoginId', helper::FILTER_ID) . ';' ;
$dataLog .= empty($this->getInput('userLoginId')) ? ';' : $this->getInput('userLoginId', helper::FILTER_ID) . ';';
$dataLog .= $this->getUrl() . ';';
$dataLog .= $logStatus;
$dataLog .= PHP_EOL;
if ($this->getData(['config', 'connect', 'log'])) {
file_put_contents(self::DATA_DIR . 'journal.log', $dataLog, FILE_APPEND);
}
// Stockage des cookies
if (!empty($_COOKIE['ZWII_USER_ID'])) {
self::$userId = $_COOKIE['ZWII_USER_ID'];
@ -516,10 +526,13 @@ class user extends common {
/**
* Déconnexion
*/
public function logout() {
public function logout()
{
// Ne pas effacer l'identifiant mais seulement le mot de passe
if (array_key_exists('ZWII_USER_LONGTIME',$_COOKIE)
AND $_COOKIE['ZWII_USER_LONGTIME'] !== 'true' ) {
if (
array_key_exists('ZWII_USER_LONGTIME', $_COOKIE)
and $_COOKIE['ZWII_USER_LONGTIME'] !== 'true'
) {
helper::deleteCookie('ZWII_USER_ID');
helper::deleteCookie('ZWII_USER_LONGTIME');
}
@ -536,15 +549,16 @@ class user extends common {
/**
* Réinitialisation du mot de passe
*/
public function reset() {
public function reset()
{
// Accès refusé
if (
// L'utilisateur n'existe pas
$this->getData(['user', $this->getUrl(2)]) === null
// Lien de réinitialisation trop vieux
OR $this->getData(['user', $this->getUrl(2), 'forgot']) + 86400 < time()
or $this->getData(['user', $this->getUrl(2), 'forgot']) + 86400 < time()
// Id unique incorrecte
OR $this->getUrl(3) !== md5(json_encode($this->getData(['user', $this->getUrl(2)])))
or $this->getUrl(3) !== md5(json_encode($this->getData(['user', $this->getUrl(2)])))
) {
// Valeurs en sortie
$this->addOutput([
@ -561,8 +575,7 @@ class user extends common {
if ($this->getInput('userResetNewPassword', helper::FILTER_STRING_SHORT, true) !== $this->getInput('userResetConfirmPassword', helper::FILTER_STRING_SHORT, true)) {
$newPassword = $this->getData(['user', $this->getUrl(2), 'password']);
self::$inputNotices['userResetConfirmPassword'] = 'Incorrect';
}
else {
} else {
$newPassword = $this->getInput('userResetNewPassword', helper::FILTER_PASSWORD, true);
}
// Modifie le mot de passe
@ -593,7 +606,8 @@ class user extends common {
/**
* Importation CSV d'utilisateurs
*/
public function import() {
public function import()
{
// Soumission du formulaire
$notification = '';
$success = true;
@ -601,9 +615,11 @@ class user extends common {
// Lecture du CSV et construction du tableau
$file = $this->getInput('userImportCSVFile', helper::FILTER_STRING_SHORT, true);
$filePath = self::FILE_DIR . 'source/' . $file;
if ($file AND file_exists($filePath)) {
if ($file and file_exists($filePath)) {
// Analyse et extraction du CSV
$rows = array_map(function($row) { return str_getcsv($row, $this->getInput('userImportSeparator') ); }, file($filePath));
$rows = array_map(function ($row) {
return str_getcsv($row, $this->getInput('userImportSeparator'));
}, file($filePath));
$header = array_shift($rows);
$csv = array();
foreach ($rows as $row) {
@ -612,24 +628,24 @@ class user extends common {
// Traitement des données
foreach ($csv as $item) {
// Données valides
if( array_key_exists('id', $item)
AND array_key_exists('prenom',$item)
AND array_key_exists('nom',$item)
AND array_key_exists('groupe',$item)
AND array_key_exists('email',$item)
AND $item['nom']
AND $item['prenom']
AND $item['id']
AND $item['email']
AND $item['groupe']
if (
array_key_exists('id', $item)
and array_key_exists('prenom', $item)
and array_key_exists('nom', $item)
and array_key_exists('groupe', $item)
and array_key_exists('email', $item)
and $item['nom']
and $item['prenom']
and $item['id']
and $item['email']
and $item['groupe']
) {
// Validation du groupe
$item['groupe'] = (int) $item['groupe'];
$item['groupe'] = ( $item['groupe'] >= self::GROUP_BANNED AND $item['groupe'] <= self::GROUP_ADMIN )
$item['groupe'] = ($item['groupe'] >= self::GROUP_BANNED and $item['groupe'] <= self::GROUP_ADMIN)
? $item['groupe'] : 1;
// L'utilisateur existe
if ( $this->getData(['user',helper::filter($item['id'] , helper::FILTER_ID)]))
{
if ($this->getData(['user', helper::filter($item['id'], helper::FILTER_ID)])) {
// Notification du doublon
$item['notification'] = template::ico('cancel');
// Création du tableau de confirmation
@ -663,12 +679,15 @@ class user extends common {
"accessUrl" => null,
"accessTimer" => null,
"accessCsrf" => null
]]);
]
]);
// Icône de notification
$item['notification'] = $create ? template::ico('check') : template::ico('cancel');
// Envoi du mail
if ($create
AND $this->getInput('userImportNotification',helper::FILTER_BOOLEAN) === true) {
if (
$create
and $this->getInput('userImportNotification', helper::FILTER_BOOLEAN) === true
) {
$sent = $this->sendMail(
$item['email'],
'Compte créé sur ' . $this->getData(['locale', 'title']),
@ -715,5 +734,4 @@ class user extends common {
'state' => $success
]);
}
}