diff --git a/README.md b/README.md new file mode 100644 index 0000000..15cf7bb --- /dev/null +++ b/README.md @@ -0,0 +1,12 @@ +## Konfigurasjon +Du må endre instillinger for database, migrering (key og server), payex betaling og snapporder-integrasjon. + cp inside/credentials-sample.php inside/credentials.php + cp inside/migration/config.example.php inside/migration/config.php + cp includes/payex2/payex_defines.example.php includes/payex2/payex_defines.php + cp snapporder/config-sample.php snapporder/config.php + +Du trenger kanskje å endre ting i includes/Ldap_defines.php også. + +## Installasjon +Legg inn Apache, MySQL og PHP. Du trenger også noen utvidelser til PHP. + sudo apt-get install php5-mysql php5-ldap diff --git a/README.txt b/README.txt deleted file mode 100644 index 50a55cb..0000000 --- a/README.txt +++ /dev/null @@ -1,12 +0,0 @@ -== Konfigurasjon == -Du må endre instillinger for database, migrering (key og server), payex betaling og snapporder-integrasjon. - $ cp inside/credentials-sample.php inside/credentials.php - $ cp inside/migration/config.example.php inside/migration/config.php - $ cp includes/payex2/payex_defines.example.php includes/payex2/payex_defines.php - $ cp snapporder/config-sample.php snapporder/config.php - -Du trenger kanskje å endre ting i includes/Ldap_defines.php også. - -== Installasjon == -Legg inn Apache, MySQL og PHP. Du trenger også noen utvidelser til PHP. - $ sudo apt-get install php5-mysql php5-ldap diff --git a/api/api_functions.php b/api/api_functions.php index de20385..dbbfd7f 100644 --- a/api/api_functions.php +++ b/api/api_functions.php @@ -1,15 +1,26 @@ "Missing param apikey.")); - die(); + return_json_response(array('error' => "Missing param apikey."), 400); } /* Valid API KEY (defined in credentials.php) ? */ if( $_GET['apikey'] !== USER_API_KEY && $_GET['apikey'] !== USER_API_KEY_KASSA ) { - set_response_code(400); - echo json_encode(array('error' => "Invalid apikey: '".$_GET['apikey']."'.")); - die(); + return_json_response(array('error' => "Invalid apikey: '".$_GET['apikey']."'."), 400); } +if($_SERVER['REQUEST_METHOD'] === 'POST') { + $body = file_get_contents('php://input'); + $data = json_decode($body, true); -/* Validate params */ -if(!isset($_GET['q'])) { - set_response_code(400); - echo json_encode(array('error' => "Missing param q")); - die(); + /* Validate params */ + if( !isset($data['card_number']) ) { + return_json_response(array('error' => "Missing param card_number"), 400); + } + $card_number = $data['card_number']; + + if( !is_numeric($card_number) ) { + return_json_response(array('error' => "Value card_number must be numeric: '".$card_number."'"), 400); + } + + /* Validate user_id */ + if( !isset($data['user_id']) ) { + return_json_response(array('error' => "Missing param user_id"), 400); + } + if( !is_numeric($data['user_id']) ) { + return_json_response(array('error' => "Value user_id must be numeric: '".$data['user_id']."'"), 400); + } + /* TODO: If user does not exist, bail */ + /* TODO: If user relationship to card exists, bail */ + /* TODO: Either Add card relationship OR remove old relationsip and add new */ + return_json_response(array('error' => 'TODO: Not implemented')); } +else { + /* Validate params */ + if( !isset($_GET['card_number']) && !isset($_POST['card_number']) ) { + return_json_response(array('error' => "Missing param card_number: ".var_export($_POST, true)), 400); + } + $card_number = $_GET['card_number']; -$card_number = $_GET['q']; + if( !is_numeric($card_number) ) { + return_json_response(array('error' => "Value card_number must be numeric: '".$card_number."'"), 400); + } -if( !is_numeric($card_number) ) { - set_response_code(400); - echo json_encode(array('error' => "Value q must be numeric: '".$card_number."'")); - die(); -} + // Search query + $card_number = $conn->quoteSmart($card_number); + $sql = "SELECT mc.userId FROM din_membercard AS mc + LEFT JOIN din_user AS u ON mc.userId=u.id + WHERE mc.id=$card_number"; -$card_number = $conn->quoteSmart($card_number); + $res = $conn->getAll($sql); -// Search query -$sql = " - SELECT mc.userId FROM din_membercard AS mc - LEFT JOIN din_user AS u ON mc.userId=u.id - WHERE mc.id=$card_number"; -error_reporting(0); + if( DB::isError($res) ) { + return_json_response(array('error' => $res->message), 500); + } + $card_number_exists = count($res) === 0; -$res = $conn->getAll($sql); + /* Invalid card number? */ + if($card_number_exists) { + return_json_response(array('user' => NULL, 'valid' => false)); + } -if( DB::isError($res) ) { - set_response_code(500); - echo json_encode(array('error' => $res->message)); - die(); -} + $user_id = $res[0][0]; + /* Free card_number? */ + if($user_id === "") { + return_json_response(array('user' => NULL, 'valid' => true)); + } -/* Invalid card number*/ -if(count($res) === 0) { - echo json_encode(array( - 'user' => NULL, - 'valid' => false - )); - die(); -} + /* Existing user with card_number. */ + try{ + $user_data = get_user_data($user_id, $conn); + } catch(Exception $e) { + return_json_response(array('error' => $e->getMessage()), 500); + return; // Note: Help IntelliJ code inspection. + } -$user_id = $res[0][0]; -/* Free card_number? */ -if($user_id === "") { - echo json_encode(array( - 'user' => NULL, - 'valid' => true - )); - die(); -} - -/* Existing user with card_number. */ -try{ - $user_data = get_user_data($user_id, $conn); -} catch(Exception $e) { - set_response_code(500); - echo json_encode(array('error' => $e->getMessage())); - die(); -} -echo json_encode(array( - 'user' => $user_data, - 'valid' => $res !== NULL -)); - -?> \ No newline at end of file + return_json_response(array('user' => $user_data, 'valid' => $res !== NULL)); +} \ No newline at end of file diff --git a/api/register.php b/api/register.php new file mode 100644 index 0000000..620e31a --- /dev/null +++ b/api/register.php @@ -0,0 +1,184 @@ + 'Invalid request'), 400); +} + +/* Decode body */ +$data = json_decode($body, true); +if($data === NULL) { + return_json_response(array('error' => 'Can\'t decode body'), 400); +} +/* Check type of registration and set valid fields */ +$reg_type = "new"; +if( isset($data['type']) && $data['type'] === "renewal" ) { + /* Renewal */ + $reg_type = $data['type']; +} + +$required_keys = array('apikey', 'phone'); +$valid_keys = $required_keys; +$valid_keys = array_merge($valid_keys, array('purchased', 'source', 'type', 'membership_trial', 'cardno')); + +$valid_sources = array('physical', 'web', 'manual'); + +/* Validate supplied data */ +foreach($required_keys as $key) { + if(!array_key_exists($key, $data)) { + return_json_response(array('error' => 'missing required field \''.$key.'\''), 400); + } +} +foreach($data as $key => $value) { + if(!in_array($key, $valid_keys)) { + return_json_response(array('error' => 'unknown field \''.$key.'\''), 400); + } +} + +/* Valid API KEY (defined in credentials.php) ? */ +if( $data['apikey'] !== USER_API_KEY_KASSA ) { + return_json_response(array('error' => "Invalid apikey: '".$data['apikey']."'."), 400); +} + +$data['phone'] = clean_phonenumber($data['phone']); +if( !valid_phonenumber($data['phone']) ) { + return_json_response(array('error' => "Not a phone number: '".$data['phone']."'"), 400); +} + +$conn = get_db_connection(DB_FETCHMODE_ASSOC); + +/* Existing user? */ +$user_id = getUseridFromPhone($data['phone']); +if( $reg_type === "new" && $user_id !== false ) { + return_json_response(array('error' => 'Existing user with phone: '.$data['phone']), 409); +} +/* Renewal of membership? */ +if( $reg_type === "renewal" && $user_id === false ) { + return_json_response(array('error' => 'Could not find user with phone: '.$data['phone']), 409); +} + +$data['user_id'] = $user_id; +if( $reg_type === "renewal") { + $user = get_user($user_id); + /* Don't allow renewal of an existing valid membership. */ + if( $user['membership_status'] !== 0 ) { + if($user['expires'] === '') { + // Life long + return_json_response(array('error' => 'Cannot renew, user with phone '.$data['phone'].' has a life long membership.'), 409); + } + return_json_response(array('error' => 'Cannot renew, user with phone '.$data['phone'].' has a valid membership until: '.$user['expires']), 409); + } +} + +/* Validate optional purchase_date */ +if( isset($data['purchased']) ) { + $purchased = clean_date($data['purchased']) ; + if($purchased === false) { + return_json_response(array('error' => 'Could not parse date from field purchased: '.$data['purchased']), 400); + } + $data['purchased'] = $purchased; +} + +/* Validate optional source */ +if( isset($data['source']) && !in_array($data['source'], $valid_sources) ) { + return_json_response(array('error' => 'Invalid value in field source: '.$data['source']), 400); +} + +/* Validate optional membership_trial */ +if( isset($data['membership_trial']) && $data['membership_trial'] !== "buddy") { + return_json_response(array('error' => 'Invalid value in field membership_trial: '.$data['membership_trial']), 400); +} + +/* Create user */ +try { + if( $reg_type === "new" ) { + $user_id = add_user($data, $data['source']); + } else { + renew_user($data); + } +} catch(InsideDatabaseException $e) { + error_log($e->getMessage()); + return_json_response(array('error' => 'db_error', 'error_message' => $e->getMessage()), 500); +} + +/* Get and format user */ +$user = NULL; +try { + $user = get_user($user_id); +} catch(InsideDatabaseException $e) { + error_log($e->getMessage()); + return_json_response(array('error' => 'db_error', 'error_message' => $e->getMessage()), 500); +} + +/* Add register url */ +if($user['registration_status'] === "partial") { + $user['registration_url'] = generate_registration_url($user, SECRET_KEY); +} + +/* Add back phone number from query */ +$user['phone'] = $data['phone']; + +if( isset($data['membership_trial']) ) { + /* Add back membership_trial from query */ + $user['membership_trial'] = $data['membership_trial']; +} + +/* Send welcome email */ +if($reg_type === "new") { + send_activation_email($data, $user); + // TODO: send_activation_sms($data, $user); +} + +/* Return encrypted user object */ +return_json_response($user); diff --git a/inside/functions.php b/inside/functions.php index 3df5100..b5a179b 100644 --- a/inside/functions.php +++ b/inside/functions.php @@ -1710,6 +1710,11 @@ function clean_phonenumber($pn) { if( strlen($pn) === 8 && ($pn[0] === "4" || $pn[0] === "9") ) { $pn = "+47".$pn; } + // ...without + + if( strlen($pn) === 10 && $pn[0] === "4" && $pn[1] === "7" && ($pn[2] === "4" || $pn[2] === "9") ) { + $pn = "+".$pn; + } + return $pn; } // ISO-8601 Y-m-d @@ -1788,5 +1793,3 @@ function hash_ldap_password($raw_password) { return '{SSHA}' . base64_encode(sha1( $raw_password.$salt, TRUE ). $salt); } - -?> diff --git a/sms/register.php b/sms/register.php index 4d10582..5a503c2 100644 --- a/sms/register.php +++ b/sms/register.php @@ -81,10 +81,10 @@ if( isset($_POST['submit']) ) {
-

Registrering av medlemskap kjøpt på SMS

+

Registrering av medlemskap kjøpt på SMS eller på Chateau Neuf

på Det Norske Studentersamfund
-

Hei, for at medlemskapet du har kjøpt på SMS skal være gyldig, så må du registerere deg.

+

Hei, for at medlemskapet du har kjøpt på SMS eller på Chateau Neuf skal være gyldig, så må du registerere deg.

Gå videre med registreringen ved å angi telefonnummer, aktiveringskode, fornavn og epost.

diff --git a/snapporder/api/query.php b/snapporder/api/query.php index 90cf55b..75a57ed 100644 --- a/snapporder/api/query.php +++ b/snapporder/api/query.php @@ -87,6 +87,4 @@ if($user['registration_status'] === "partial") { /* Return encrypted user object */ echo $crypt->json_encode_and_encrypt($user); -//echo json_encode($user); - -?> +//echo json_encode($user); \ No newline at end of file diff --git a/snapporder/api/register.php b/snapporder/api/register.php index 86e74ac..54f0c55 100644 --- a/snapporder/api/register.php +++ b/snapporder/api/register.php @@ -236,5 +236,3 @@ if($reg_type === "new") { /* Return encrypted user object */ echo $crypt->json_encode_and_encrypt($user); - -?> diff --git a/snapporder/lib/functions.php b/snapporder/lib/functions.php index a751a06..4dd71ad 100644 --- a/snapporder/lib/functions.php +++ b/snapporder/lib/functions.php @@ -67,8 +67,9 @@ function add_user($data, $source) { $user_id = get_user_id_by_username($data['username']); /* Phonenumber table */ + $phone_number_validated = $source === 'snapporder' ? 1 : 0; $cols = array('user_id', 'number', 'validated'); - $values = array($user_id, $phone, 1); + $values = array($user_id, $phone, $phone_number_validated); $sth = $conn->autoPrepare("din_userphonenumber", $cols, DB_AUTOQUERY_INSERT); $res = $conn->execute($sth, $values); @@ -195,11 +196,12 @@ function renew_user($data) { /* Phonenumber table, set validated */ $fields_values = array('validated' => 1); + if($source === "snapporder") { + $res = $conn->autoExecute("din_userphonenumber", $fields_values, DB_AUTOQUERY_UPDATE, "user_id=$user_id AND number='$phone'"); - $res = $conn->autoExecute("din_userphonenumber", $fields_values, DB_AUTOQUERY_UPDATE, "user_id=$user_id AND number='$phone'"); - - if( DB::isError($res) ) { - throw new InsideDatabaseException($res->getMessage().". DEBUG: ".$res->getDebugInfo()); + if( DB::isError($res) ) { + throw new InsideDatabaseException($res->getMessage().". DEBUG: ".$res->getDebugInfo()); + } } if( isset($data['membership_trial']) && $in_autumn) { @@ -688,6 +690,4 @@ function send_confirmation_email($data, $user) { $message .= ""; @mail($sendto, $subject, $message, $headers); -} -?> - +} \ No newline at end of file