diff --git a/inside/User.php b/inside/User.php
index ef82243..9fe4eaf 100644
--- a/inside/User.php
+++ b/inside/User.php
@@ -57,68 +57,67 @@ class User {
error("User: No data supplied.");
$this->id = -1;
return false;
+ }
+
+ /* Validate user supplied data. */
+ if( !validate_username_length($data['username']) ) {
+ notify("Brukernavnet mć være mellom 3 og 12 tegn.");
+ $this->id = -1;
+ return false;
+ }
+ if( !validate_username_chars($data['username']) ) {
+ notify("Brukernavnet kan kun inneholde smć bokstaver.");
+ $this->id = -1;
+ return false;
+ }
+ $this->username = strtolower(stripcslashes($data['username']));
+ if( !validate_password_length($data['password']) ) {
+ notify("Passordet mć være minst 8 tegn.");
+ $this->id = -1;
+ return false;
+ }
+ if( !validate_password_chars($data['password']) ) {
+ notify("Passordet kan ikke inneholde enkel- eller dobbelfnutt eller bakslask.");
+ $this->id = -1;
+ return false;
+ }
+ if ($data['password1'] != $data['password2']) {
+ notify("Passordene var ikke like.");
+ $this->id = -1;
+ return false;
+ }
+ $this->password = $data['password1'];
+
+ $this->addresstype = isset ($data['addresstype']) ? "int" : "no";
+
+ if (isDate($data['birthdate'])) {
+ $this->birthdate = $data['birthdate'];
} else {
- /* Validate user supplied data. */
- if (strlen(stripcslashes($data['username'])) < 3 || strlen(stripcslashes($data['username'])) > 12 ) {
- notify("Brukernavnet mć være mellom 3 og 12 tegn.");
- $this->id = -1;
- return false;
- }
- if(! preg_match('/^[a-z]*$/', strtolower(stripcslashes($data['username'])))) {
- notify("Brukernavnet kan kun inneholde smć bokstaver.");
- $this->id = -1;
- return false;
- }
- $this->username = strtolower(stripcslashes($data['username']));
- if (strlen($data['password1']) < 8) {
- notify("Passordet mć være minst 8 tegn.");
- $this->id = -1;
- return false;
- }
- /* No double nor single quotes */
- if(preg_match('/[\\\"\']+/', $data['password1'])) {
- notify("Passordet kan ikke inneholde enkel- eller dobbelfnutt eller bakslask.");
- $this->id = -1;
- return false;
- }
- if ($data['password1'] != $data['password2']) {
- notify("Passordene var ikke like.");
- $this->id = -1;
- return false;
- }
- $this->password = $data['password1'];
+ notify("Ugyldig fűdselsdato: " . $data['birthdate']);
+ $this->id = -1;
+ return false;
+ }
- $this->addresstype = isset ($data['addresstype']) ? "int" : "no";
+ if( $data['phonenumber'] ) {
+ $data['phonenumber'] = clean_phonenumber($data['phonenumber']);
+ }
- if (isDate($data['birthdate'])) {
- $this->birthdate = $data['birthdate'];
- } else {
- notify("Ugyldig fűdselsdato: " . $data['birthdate']);
- $this->id = -1;
- return false;
- }
+ /* No duplicate phone numbers */
+ if( getUseridFromPhone($data['phonenumber']) !== false ) {
+ notify("Telefonnummeret er allerede registrert pć en bruker.");
+ $this->id = -1;
+ return false;
+ }
- /* TODO replace +47 and 0047 with blank */
- //if( $data['phonenumber'] ) {
- //}
-
- /* No duplicate phone numbers */
- if( getUseridFromPhone($data['phonenumber']) !== false ) {
- notify("Telefonnummeret er allerede registrert pć en bruker.");
- $this->id = -1;
- return false;
- }
-
- if (isset ($data['active'])) {
- $this->division_id_request = $data['division'];
- } else {
- $this->division_id_request = NULL;
- }
- if (isset ($data['group'])) {
- $this->group_id = $data['group_id'];
- } else {
- $this->group_id = NULL;
- }
+ if (isset ($data['active'])) {
+ $this->division_id_request = $data['division'];
+ } else {
+ $this->division_id_request = NULL;
+ }
+ if (isset ($data['group'])) {
+ $this->group_id = $data['group_id'];
+ } else {
+ $this->group_id = NULL;
}
} else { //ID set, existing user
if ($data != NULL) {
diff --git a/inside/functions.php b/inside/functions.php
index 39fc4a8..41757db 100644
--- a/inside/functions.php
+++ b/inside/functions.php
@@ -1690,5 +1690,80 @@ function get_gravatar( $email, $s = 80, $d = 'mm', $r = 'g', $img = false, $atts
}
return $url;
}
+function validate_username_length($username) {
+ return strlen(stripcslashes($username)) >= 3 && strlen(stripcslashes($username)) <= 12;
+}
+function validate_username_chars($username) {
+ return preg_match('/^[a-z]+[a-z0-9]*$/', strtolower(stripcslashes($username)));
+}
+function validate_password_length($password) {
+ return strlen($password) >= 8;
+}
+function validate_password_chars($password) {
+ /* No double nor single quotes */
+ if( preg_match('/[\\\"\']+/', $password) ) {
+ return false;
+ }
+ return true;
+}
+function clean_phonenumber($pn) {
+ $pn = preg_replace('/[^0-9\+]/', '', $pn); // remove everything except valid chars
+ $pn = preg_replace('/^00/','+', $pn); // replace starting 00 with +
+ // norwegian phone numbers
+ if( strlen($pn) === 8 && ($pn[0] === "4" || $pn[0] === "9") ) {
+ $pn = "+47".$pn;
+ }
+ return $pn;
+}
+// ISO-8601 Y-m-d
+function clean_date($date) {
+ // returns a DateTime object
+ return date_create_from_format('Y-m-d', $date);
+}
+// E.164
+function valid_phonenumber($phone) {
+ return preg_match('/^\+?\d{8,15}$/i', $phone);
+}
+function valida_email($email) {
+ return filter_var($email, FILTER_VALIDATE_EMAIL);
+}
+
+/* Set HTTP response code */
+function set_response_code($code) {
+ if(!is_int($code)) {
+ return false;
+ }
+ header('X-Ignore-This: something', true, $code);
+}
+/* Redirect to path on same domain */
+function redirect($path) {
+ $scheme ="http".((empty($_SERVER['HTTPS']) or $_SERVER['HTTPS'] == 'off')?'':'s');
+ $host = $_SERVER['HTTP_HOST'];
+ $location = "$scheme://$host$path";
+ header("Location: $location");
+}
+
+function log_userupdate($updated, $comment, $updated_by=NULL) {
+ global $conn;
+
+ if( $updated_by == NULL) {
+ $updated_by = $updated;
+ }
+
+ $now = date_format(date_create(), "Y-m-d H:i:s");
+ $data = array(
+ 'date' => $now,
+ 'user_id_updated' => $updated,
+ 'comment' => $comment,
+ 'user_id_updated_by' => $updated_by
+ );
+ $res = $conn->autoExecute("din_userphonenumber", $data, DB_AUTOQUERY_INSERT);
+
+ if (DB::isError($res)) {
+
+ return false;
+ }
+ return true;
+}
?>
diff --git a/snapporder/activate.php b/snapporder/activate.php
index dd28590..dff0210 100644
--- a/snapporder/activate.php
+++ b/snapporder/activate.php
@@ -2,10 +2,7 @@
/* User activation form (step 2).
* SnappOrder first saves initial data in our temp user db
*
- * TODO:
- * - validate user data
- * - load inside user object and populate it
- * - persist to db
+ * TODO possible to activate expired memberships?
*/
set_include_path("../includes/");
@@ -17,7 +14,7 @@ require_once("lib/functions.php");
require_once("config.php");
if( !isset($_GET['userid']) || !isset($_GET['token']) ) {
- echo "Ugyldig aktiveringslenke. Ta kontakt med medlemskap@studentersamfundet.no hvis du har spÞrsmÄl.";
+ echo "Ugyldig eller utgÄtt aktiveringslenke. Ta kontakt med medlemskap@studentersamfundet.no hvis du har spÞrsmÄl.";
set_response_code(400);
die();
}
@@ -32,22 +29,44 @@ if(DB :: isError($conn)) {
die();
}
$conn->setFetchMode(DB_FETCHMODE_ASSOC);
+
/* Fetch user and check for valid token */
$user = get_user($_GET['userid']);
if(!$user) {
- echo "Ugyldig aktiveringslenke. Ta kontakt med medlemskap@studentersamfundet.no hvis du har spÞrsmÄl.";
+ echo "Ugyldig eller utgÄtt aktiveringslenke. Ta kontakt med medlemskap@studentersamfundet.no hvis du har spÞrsmÄl.";
set_response_code(400);
die();
}
if( !check_token($user, $_GET['token'], SECRET_KEY)) {
- echo "Ugyldig aktiveringslenke. Ta kontakt med medlemskap@studentersamfundet.no hvis du har spÞrsmÄl.";
+ echo "Ugyldig eller utgÄtt aktiveringslenke. Ta kontakt med medlemskap@studentersamfundet.no hvis du har spÞrsmÄl.";
set_response_code(400);
die();
}
+// empty default form values
+$validation_errors = "";
+$username = "";
+$password = "";
+$newsletter_checked = " checked";
+
if( isset($_POST['submit']) ) {
- // TODO validate and persist
- var_dump($_POST);
+ try {
+ $data = validate_activation_form($_POST); // can throw
+
+ // persist
+ save_activation_form($data);
+ // redirect to confirmation page
+ redirect("/snapporder/activate_confirmed.php");
+ die();
+
+ } catch(ValidationException $e) {
+ $validation_errors = $e->getMessage();
+
+ /* Refill form values*/
+ $username = $_POST['username'];
+ $password = $_POST['password'];
+ $newsletter_checked = isset($_POST['newsletter']) ? " checked" : "";
+ }
}
?>
@@ -76,34 +95,41 @@ if( isset($_POST['submit']) ) {
Hei , du er veldig nĂŠre Ă„ kunne:
+ - FĂ„ tilgang til din medlemskonto
- Bruke trÄdlÞsnett pÄ Chateau Neuf
- Bli aktiv pÄ Studentersamfundet
+ FullfĂžr profilen din ved Ă„ angi brukernavn og passord.
Din profil
- $val) {
- if( in_array($key, $visible_vars) ) {
- echo "- ".ucfirst($key).": $val
\n";
- }
- }
- ?>
+
+ - Navn:
+ - E-post:
+ - Medlemsnummer:
- Kontodetaljer
+ 0 ) {
+ echo "$validation_errors";
+ } ?>
diff --git a/snapporder/activate_confirmed.php b/snapporder/activate_confirmed.php
new file mode 100644
index 0000000..88006c9
--- /dev/null
+++ b/snapporder/activate_confirmed.php
@@ -0,0 +1,33 @@
+
+
+
+