LoginController.php (11761B)
1 <?php 2 3 /** 4 * LoginController 5 * Controls everything that is authentication-related 6 */ 7 class LoginController extends Controller 8 { 9 /** 10 * Construct this object by extending the basic Controller class. The parent::__construct thing is necessary to 11 * put checkAuthentication in here to make an entire controller only usable for logged-in users (for sure not 12 * needed in the LoginController). 13 */ 14 public function __construct() 15 { 16 parent::__construct(); 17 } 18 19 /** 20 * Index, default action (shows the login form), when you do login/index 21 */ 22 public function index() 23 { 24 // if user is logged in redirect to main-page, if not show the view 25 if (LoginModel::isUserLoggedIn()) { 26 Redirect::home(); 27 } else { 28 $data = array('redirect' => Request::get('redirect') ? Request::get('redirect') : NULL); 29 $this->View->render('login/index', $data); 30 } 31 } 32 33 /** 34 * The login action, when you do login/login 35 */ 36 public function login() 37 { 38 39 // check if csrf token is valid 40 if (!Csrf::isTokenValid()) { 41 self::logout(); 42 } 43 44 // perform the login method, put result (true or false) into $login_successful 45 $login_successful = LoginModel::login( 46 Request::post('user_name'), Request::post('user_password'), Request::post('set_remember_me_cookie') 47 ); 48 49 // check login status: if true, then redirect user login/showProfile, if false, then to login form again 50 if ($login_successful) { 51 if (Request::post('redirect')) { 52 Redirect::to(ltrim(urldecode(Request::post('redirect')), '/')); 53 } else { 54 Redirect::to('login/showProfile'); 55 } 56 } else { 57 Redirect::to('login/index'); 58 } 59 } 60 61 /** 62 * The logout action 63 * Perform logout, redirect user to main-page 64 */ 65 public function logout() 66 { 67 LoginModel::logout(); 68 Redirect::home(); 69 exit(); 70 } 71 72 /** 73 * Login with cookie 74 */ 75 public function loginWithCookie() 76 { 77 // run the loginWithCookie() method in the login-model, put the result in $login_successful (true or false) 78 $login_successful = LoginModel::loginWithCookie(Request::cookie('remember_me')); 79 80 // if login successful, redirect to dashboard/index ... 81 if ($login_successful) { 82 Redirect::to('dashboard/index'); 83 } else { 84 // if not, delete cookie (outdated? attack?) and route user to login form to prevent infinite login loops 85 LoginModel::deleteCookie(); 86 Redirect::to('login/index'); 87 } 88 } 89 90 /** 91 * Show user's PRIVATE profile 92 * Auth::checkAuthentication() makes sure that only logged in users can use this action and see this page 93 */ 94 public function showProfile() 95 { 96 Auth::checkAuthentication(); 97 $this->View->render('login/showProfile', array( 98 'user_name' => Session::get('user_name'), 99 'user_email' => Session::get('user_email'), 100 'user_gravatar_image_url' => Session::get('user_gravatar_image_url'), 101 'user_avatar_file' => Session::get('user_avatar_file'), 102 'user_account_type' => Session::get('user_account_type') 103 )); 104 } 105 106 /** 107 * Show edit-my-username page 108 * Auth::checkAuthentication() makes sure that only logged in users can use this action and see this page 109 */ 110 public function editUsername() 111 { 112 Auth::checkAuthentication(); 113 $this->View->render('login/editUsername'); 114 } 115 116 /** 117 * Edit user name (perform the real action after form has been submitted) 118 * Auth::checkAuthentication() makes sure that only logged in users can use this action 119 */ 120 public function editUsername_action() 121 { 122 Auth::checkAuthentication(); 123 124 // check if csrf token is valid 125 if (!Csrf::isTokenValid()) { 126 self::logout(); 127 } 128 129 UserModel::editUserName(Request::post('user_name')); 130 Redirect::to('login/index'); 131 } 132 133 /** 134 * Show edit-my-user-email page 135 * Auth::checkAuthentication() makes sure that only logged in users can use this action and see this page 136 */ 137 public function editUserEmail() 138 { 139 Auth::checkAuthentication(); 140 $this->View->render('login/editUserEmail'); 141 } 142 143 /** 144 * Edit user email (perform the real action after form has been submitted) 145 * Auth::checkAuthentication() makes sure that only logged in users can use this action and see this page 146 */ 147 // make this POST 148 public function editUserEmail_action() 149 { 150 Auth::checkAuthentication(); 151 UserModel::editUserEmail(Request::post('user_email')); 152 Redirect::to('login/editUserEmail'); 153 } 154 155 /** 156 * Edit avatar 157 * Auth::checkAuthentication() makes sure that only logged in users can use this action and see this page 158 */ 159 public function editAvatar() 160 { 161 Auth::checkAuthentication(); 162 $this->View->render('login/editAvatar', array( 163 'avatar_file_path' => AvatarModel::getPublicUserAvatarFilePathByUserId(Session::get('user_id')) 164 )); 165 } 166 167 /** 168 * Perform the upload of the avatar 169 * Auth::checkAuthentication() makes sure that only logged in users can use this action and see this page 170 * POST-request 171 */ 172 public function uploadAvatar_action() 173 { 174 Auth::checkAuthentication(); 175 AvatarModel::createAvatar(); 176 Redirect::to('login/editAvatar'); 177 } 178 179 /** 180 * Delete the current user's avatar 181 * Auth::checkAuthentication() makes sure that only logged in users can use this action and see this page 182 */ 183 public function deleteAvatar_action() 184 { 185 Auth::checkAuthentication(); 186 AvatarModel::deleteAvatar(Session::get("user_id")); 187 Redirect::to('login/editAvatar'); 188 } 189 190 /** 191 * Show the change-account-type page 192 * Auth::checkAuthentication() makes sure that only logged in users can use this action and see this page 193 */ 194 public function changeUserRole() 195 { 196 Auth::checkAuthentication(); 197 $this->View->render('login/changeUserRole'); 198 } 199 200 /** 201 * Perform the account-type changing 202 * Auth::checkAuthentication() makes sure that only logged in users can use this action 203 * POST-request 204 */ 205 public function changeUserRole_action() 206 { 207 Auth::checkAuthentication(); 208 209 if (Request::post('user_account_upgrade')) { 210 // "2" is quick & dirty account type 2, something like "premium user" maybe. you got the idea :) 211 UserRoleModel::changeUserRole(2); 212 } 213 214 if (Request::post('user_account_downgrade')) { 215 // "1" is quick & dirty account type 1, something like "basic user" maybe. 216 UserRoleModel::changeUserRole(1); 217 } 218 219 Redirect::to('login/changeUserRole'); 220 } 221 222 /** 223 * Register page 224 * Show the register form, but redirect to main-page if user is already logged-in 225 */ 226 public function register() 227 { 228 if (LoginModel::isUserLoggedIn()) { 229 Redirect::home(); 230 } else { 231 $this->View->render('login/register'); 232 } 233 } 234 235 /** 236 * Register page action 237 * POST-request after form submit 238 */ 239 public function register_action() 240 { 241 $registration_successful = RegistrationModel::registerNewUser(); 242 243 if ($registration_successful) { 244 Redirect::to('login/index'); 245 } else { 246 Redirect::to('login/register'); 247 } 248 } 249 250 /** 251 * Verify user after activation mail link opened 252 * @param int $user_id user's id 253 * @param string $user_activation_verification_code user's verification token 254 */ 255 public function verify($user_id, $user_activation_verification_code) 256 { 257 if (isset($user_id) && isset($user_activation_verification_code)) { 258 RegistrationModel::verifyNewUser($user_id, $user_activation_verification_code); 259 $this->View->render('login/verify'); 260 } else { 261 Redirect::to('login/index'); 262 } 263 } 264 265 /** 266 * Show the request-password-reset page 267 */ 268 public function requestPasswordReset() 269 { 270 $this->View->render('login/requestPasswordReset'); 271 } 272 273 /** 274 * The request-password-reset action 275 * POST-request after form submit 276 */ 277 public function requestPasswordReset_action() 278 { 279 PasswordResetModel::requestPasswordReset(Request::post('user_name_or_email')); 280 Redirect::to('login/index'); 281 } 282 283 /** 284 * Verify the verification token of that user (to show the user the password editing view or not) 285 * @param string $user_name username 286 * @param string $verification_code password reset verification token 287 */ 288 public function verifyPasswordReset($user_name, $verification_code) 289 { 290 // check if this the provided verification code fits the user's verification code 291 if (PasswordResetModel::verifyPasswordReset($user_name, $verification_code)) { 292 // pass URL-provided variable to view to display them 293 $this->View->render('login/resetPassword', array( 294 'user_name' => $user_name, 295 'user_password_reset_hash' => $verification_code 296 )); 297 } else { 298 Redirect::to('login/index'); 299 } 300 } 301 302 /** 303 * Set the new password 304 * Please note that this happens while the user is not logged in. The user identifies via the data provided by the 305 * password reset link from the email, automatically filled into the <form> fields. See verifyPasswordReset() 306 * for more. Then (regardless of result) route user to index page (user will get success/error via feedback message) 307 * POST request ! 308 * TODO this is an _action 309 */ 310 public function setNewPassword() 311 { 312 PasswordResetModel::setNewPassword( 313 Request::post('user_name'), Request::post('user_password_reset_hash'), 314 Request::post('user_password_new'), Request::post('user_password_repeat') 315 ); 316 Redirect::to('login/index'); 317 } 318 319 /** 320 * Password Change Page 321 * Show the password form if user is logged in, otherwise redirect to login page 322 */ 323 public function changePassword() 324 { 325 Auth::checkAuthentication(); 326 $this->View->render('login/changePassword'); 327 } 328 329 /** 330 * Password Change Action 331 * Submit form, if retured positive redirect to index, otherwise show the changePassword page again 332 */ 333 public function changePassword_action() 334 { 335 $result = PasswordResetModel::changePassword( 336 Session::get('user_name'), Request::post('user_password_current'), 337 Request::post('user_password_new'), Request::post('user_password_repeat') 338 ); 339 340 if($result) 341 Redirect::to('login/index'); 342 else 343 Redirect::to('login/changePassword'); 344 } 345 346 /** 347 * Generate a captcha, write the characters into $_SESSION['captcha'] and returns a real image which will be used 348 * like this: <img src="......./login/showCaptcha" /> 349 * IMPORTANT: As this action is called via <img ...> AFTER the real application has finished executing (!), the 350 * SESSION["captcha"] has no content when the application is loaded. The SESSION["captcha"] gets filled at the 351 * moment the end-user requests the <img .. > 352 * Maybe refactor this sometime. 353 */ 354 public function showCaptcha() 355 { 356 CaptchaModel::generateAndShowCaptcha(); 357 } 358 }