From c05e5cdd8b093a7d22f4753ed1760d6d9075caa6 Mon Sep 17 00:00:00 2001 From: Nikolai Kristiansen Date: Tue, 8 Jul 2014 17:13:56 +0200 Subject: [PATCH] Turns on encryption, refactors some error handling --- snapporder/activate.php | 32 ++++++++++++--------- snapporder/api/query.php | 21 +++++++++----- snapporder/api/register.php | 49 +++++++++++++++++++++------------ snapporder/lib/CryptoHelper.php | 4 +++ snapporder/lib/functions.php | 34 +++++++---------------- 5 files changed, 78 insertions(+), 62 deletions(-) diff --git a/snapporder/activate.php b/snapporder/activate.php index 90208eb..54823e5 100644 --- a/snapporder/activate.php +++ b/snapporder/activate.php @@ -51,21 +51,9 @@ $password = ""; $newsletter_checked = " checked"; if( isset($_POST['submit']) ) { + $data = NULL; try { $data = validate_activation_form($_POST); // can throw - - // persist - save_activation_form($data); - - // Push the user to LDAP - $migrated = ldap_add_user($user['username'], $data['firstname'], $data['lastname'], $data['email'], $data['password'], array('dns-alle')); - _log($migrated); - set_migrated($data['userid']); - - // redirect to confirmation page - redirect("/snapporder/activate_confirmed.php"); - die(); - } catch(ValidationException $e) { $validation_errors = $e->getMessage(); @@ -74,6 +62,24 @@ if( isset($_POST['submit']) ) { $password = $_POST['password']; $newsletter_checked = isset($_POST['newsletter']) ? " checked" : ""; } + if($data !== NULL) { + // persist + try { + save_activation_form($data); + + // Push the user to LDAP + $migrated = ldap_add_user($user['username'], $data['firstname'], $data['lastname'], $data['email'], $data['password'], array('dns-alle')); + _log($migrated); + // FIXME assumes this works every time + set_migrated($data['userid']); + // redirect to confirmation page + redirect("/snapporder/activate_confirmed.php"); + die(); + } catch(InsideDatabaseException $e) { + echo $e->getMessage(); + die(); + } + } } ?> diff --git a/snapporder/api/query.php b/snapporder/api/query.php index b10ce0b..90cf55b 100644 --- a/snapporder/api/query.php +++ b/snapporder/api/query.php @@ -38,14 +38,14 @@ $crypt = new CryptoHelper(SNAP_IV, SNAP_KEY); /* Checks */ if(!isset($_GET['phone'])) { set_response_code(400); - echo json_encode(array('error' => 'Missing param phone')); + echo $crypt->json_encode_and_encrypt(array('error' => 'Missing param phone')); die(); } $phone = $_GET['phone']; $phone = clean_phonenumber($phone); if( !valid_phonenumber($phone) ) { set_response_code(400); - echo json_encode(array('error' => 'Not a phone number', 'query' => $_GET)); + echo $crypt->json_encode_and_encrypt(array('error' => 'Not a phone number', 'query' => $_GET)); die(); } @@ -55,7 +55,7 @@ $conn = DB::connect(getDSN(), $options); if(DB :: isError($conn)) { echo $conn->toString(); set_response_code(500); - echo json_encode(array('error' => 'Could not connect to DB')); + echo $crypt->json_encode_and_encrypt(array('error' => 'Could not connect to DB')); die(); } $conn->setFetchMode(DB_FETCHMODE_ASSOC); @@ -63,12 +63,19 @@ $conn->setFetchMode(DB_FETCHMODE_ASSOC); /* Search in phone number table for phone number */ $user_id = getUseridFromPhone($phone); if( $user_id === false ) { - echo json_encode( array('result' => 'No matching users')); + echo $crypt->json_encode_and_encrypt( array('result' => 'No matching users')); die(); } /* Get and format user */ -$user = get_user($user_id); +$user = NULL; +try { + $user = get_user($user_id); +} catch(InsideDatabaseException $e) { + set_response_code(500); + echo $crypt->json_encode_and_encrypt(array('error' => 'db_error', 'error_message' => $e->getMessage())); + die(); +} /* Add back phone number from query */ $user['phone'] = $phone; @@ -79,7 +86,7 @@ if($user['registration_status'] === "partial") { } /* Return encrypted user object */ -echo json_encode($user); -//echo $crypt->encrypt(json_encode($user)); +echo $crypt->json_encode_and_encrypt($user); +//echo json_encode($user); ?> diff --git a/snapporder/api/register.php b/snapporder/api/register.php index 5707785..a7fc2b8 100644 --- a/snapporder/api/register.php +++ b/snapporder/api/register.php @@ -52,13 +52,12 @@ if(strlen($body) === 0) { } /* Decrypt body */ -// TODO enable -//$crypt = new CryptoHelper(SNAP_IV, SNAP_KEY); -//$body = $crypt->decrypt($body); +$crypt = new CryptoHelper(SNAP_IV, SNAP_KEY); +$body = $crypt->decrypt($body); $data = (array) json_decode($body); if($data === NULL) { set_response_code(400); - echo json_encode(array('error' => 'Can\'t decode body')); + echo $crypt->json_encode_and_encrypt(array('error' => 'Can\'t decode body')); die(); } @@ -70,14 +69,14 @@ $valid_keys[] = + 'purchased'; foreach($required_keys as $key) { if(!array_key_exists($key, $data)) { set_response_code(400); - echo json_encode(array('error' => 'missing required field \''.$key.'\'')); + echo $crypt->json_encode_and_encrypt(array('error' => 'missing required field \''.$key.'\'')); die(); } } foreach($data as $key => $value) { if(!in_array($key, $valid_keys)) { set_response_code(400); - echo json_encode(array('error' => 'unknown field \''.$key.'\'')); + echo $crypt->json_encode_and_encrypt(array('error' => 'unknown field \''.$key.'\'')); die(); } } @@ -85,12 +84,12 @@ foreach($data as $key => $value) { $data['phone'] = clean_phonenumber($data['phone']); if( !valid_phonenumber($data['phone']) ) { set_response_code(400); - echo json_encode(array('error' => 'Not a phone number:'.$data['phone'])); + echo $crypt->json_encode_and_encrypt(array('error' => 'Not a phone number:'.$data['phone'])); die(); } if( !valid_email($data['email']) ) { set_response_code(400); - echo json_encode(array('error' => 'Not an email: '.$data['email'])); + echo $crypt->json_encode_and_encrypt(array('error' => 'Not an email: '.$data['email'])); die(); } @@ -100,7 +99,7 @@ $conn = DB::connect(getDSN(), $options); if(DB :: isError($conn)) { echo $conn->toString(); set_response_code(500); - echo json_encode(array('error' => 'Could not connect to DB')); + echo $crypt->json_encode_and_encrypt(array('error' => 'Could not connect to DB')); die(); } $conn->setFetchMode(DB_FETCHMODE_ASSOC); @@ -108,24 +107,24 @@ $conn->setFetchMode(DB_FETCHMODE_ASSOC); /* Existing user? */ if( getUseridFromEmail($data['email']) !== false) { set_response_code(409); - echo json_encode(array('error' => 'Existing user with email: '.$data['email'])); + echo $crypt->json_encode_and_encrypt(array('error' => 'Existing user with email: '.$data['email'])); die(); } if( getUseridFromPhone($data['phone']) !== false ) { set_response_code(409); - echo json_encode(array('error' => 'Existing user with phone: '.$data['phone'])); + echo $crypt->json_encode_and_encrypt(array('error' => 'Existing user with phone: '.$data['phone'])); die(); } /* validate firstname and lastname */ if( strlen($data['firstname']) < 2) { set_response_code(400); - echo json_encode(array('error' => 'Too short firstname: '.$data['firstname'])); + echo $crypt->json_encode_and_encrypt(array('error' => 'Too short firstname: '.$data['firstname'])); die(); } if( strlen($data['lastname']) < 2) { set_response_code(400); - echo json_encode(array('error' => 'Too short lastname: '.$data['lastname'])); + echo $crypt->json_encode_and_encrypt(array('error' => 'Too short lastname: '.$data['lastname'])); die(); } @@ -134,7 +133,7 @@ if( isset($data['purchased']) ) { $purchased = clean_date($data['purchased']) ; if($purchased === false) { set_response_code(400); - echo json_encode(array('error' => 'Could not parse date from field purchased: '.$data['purchased'])); + echo $crypt->json_encode_and_encrypt(array('error' => 'Could not parse date from field purchased: '.$data['purchased'])); die(); } $data['purchased'] = $purchased; @@ -142,10 +141,24 @@ if( isset($data['purchased']) ) { /* Create user */ -$user_id = add_user($data); +$user_id = NULL; +try { + $user_id = add_user($user_id); +} catch(InsideDatabaseException $e) { + set_response_code(500); + echo $crypt->json_encode_and_encrypt(array('error' => 'db_error', 'error_message' => $e->getMessage())); + die(); +} /* Get and format user */ -$user = get_user($user_id); +$user = NULL; +try { + $user = add_user($user_id); +} catch(InsideDatabaseException $e) { + set_response_code(500); + echo $crypt->json_encode_and_encrypt(array('error' => 'db_error', 'error_message' => $e->getMessage())); + die(); +} /* Add register url */ $user['registration_url'] = generate_registration_url($user, SECRET_KEY); @@ -154,7 +167,7 @@ $user['registration_url'] = generate_registration_url($user, SECRET_KEY); $user['phone'] = $data['phone']; /* Return encrypted user object */ -echo json_encode($user); -//echo $crypt->encrypt(json_encode($user)); +echo $crypt->json_encode_and_encrypt($user); +//echo json_encode($user); ?> diff --git a/snapporder/lib/CryptoHelper.php b/snapporder/lib/CryptoHelper.php index 8fd2a8e..fb7e0bf 100644 --- a/snapporder/lib/CryptoHelper.php +++ b/snapporder/lib/CryptoHelper.php @@ -57,5 +57,9 @@ class CryptoHelper return $bindata; } + public function json_encode_and_encrypt($data) { + return $this->encode(json_encode($data)); + } + } diff --git a/snapporder/lib/functions.php b/snapporder/lib/functions.php index 1e4a50b..86871ba 100644 --- a/snapporder/lib/functions.php +++ b/snapporder/lib/functions.php @@ -2,6 +2,8 @@ class ValidationException extends Exception {} +class InsideDatabaseException extends Exception {} + /* Username based on firstname and lastname, max 12 chars */ function generate_username($data) { $firstname = preg_replace('/[^\w]/', '', $data['firstname']); @@ -42,9 +44,7 @@ function add_user($data) { $res = $conn->execute($sth, $values); if( DB::isError($res) ) { - set_response_code(500); - echo json_encode( array('error' => 'db_error', 'error_message' => $res->toString() ) ); - die(); + throw new InsideDatabaseException($res->toString); } $user_id = get_user_id_by_username($data['username']); @@ -57,9 +57,7 @@ function add_user($data) { $res = $conn->execute($sth, $values); if( DB::isError($res) ) { - set_response_code(500); - echo json_encode( array('error' => 'db_error', 'error_message' => $res->toString() ) ); - die(); + throw new InsideDatabaseException($res->toString); } log_userupdate($user_id, "User registered."); // for legacy @@ -84,9 +82,7 @@ function get_user($user_id) { $sql = "SELECT ".implode($cols, ",").",$sql_group_ids,$sql_is_member FROM din_user AS users LEFT JOIN din_usergrouprelationship AS ug ON users.id=ug.user_id WHERE users.id=$user_id GROUP BY users.id"; $res = $conn->query($sql); if( DB::isError($res) ) { - set_response_code(500); - echo json_encode( array('error' => 'db_error', 'error_message' => $res->toString() ) ); - die(); + throw new InsideDatabaseException($res->toString); } if($res->numRows() === 0) { return false; @@ -121,19 +117,13 @@ function get_user($user_id) { return $user; } -function get_user_id_by_username($username, $json=true) { +function get_user_id_by_username($username) { global $conn; $sql = "SELECT id FROM din_user WHERE username='$username'"; $res = $conn->query($sql); if( DB::isError($res) ) { - set_response_code(500); - if($json) { - echo json_encode( array('error' => 'db_error', 'error_message' => $res->toString()) ); - } else { - echo "Oops, databasefeil: ".$res->toString(); - } - die(); + throw new InsideDatabaseException($res->toString); } if( $res->numRows() === 0 ) { return false; @@ -240,9 +230,7 @@ function institutions($output=true) { $sql = "SELECT * FROM studiesteder"; $res = $conn->getAll($sql); if( DB::isError($res) ) { - set_response_code(500); - echo json_encode( array('error' => 'db_error', 'error_message' => $res->toString() ) ); - die(); + throw new InsideDatabaseException($res->toString); } $institutions = $res; @@ -329,9 +317,7 @@ function update_user($data) { $res = $conn->query($sql); if (DB::isError($res)) { - set_response_code(500); - echo "Oops, databasefeil: ".$res->toString(); - die(); + throw new InsideDatabaseException($res->toString); } return true; } @@ -429,7 +415,7 @@ function save_activation_form($data) { // weekly newsletter (mailchimp) if(isset($data['newsletter']) && $data['newsletter'] === "1" && MAILCHIMP_API_KEY !== "") { if( mailchimp_subscribe($data, MAILCHIMP_LIST_ID, MAILCHIMP_API_KEY) ) { - log_userupdate($data['userid'], "Added to newsletter."); + log_userupdate($data['userid'], "Lagt til nyhetsbrevet."); } }