edb/inside
Archived
9
0 Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

Turns on encryption, refactors some error handling

Browse Source
This commit is contained in:
nikolark committed 2014-07-08 17:13:56 +02:00
1 parent a19c433c4c
commit c05e5cdd8b
5 files changed
+78 -62
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

snapporder/activate.php
+19 -13
View File
@@ -51,21 +51,9 @@ $password = "";
$newsletter_checked = " checked";
if( isset($_POST['submit']) ) {
$data = NULL;
try {
$data = validate_activation_form($_POST); // can throw
// persist
save_activation_form($data);
// Push the user to LDAP
$migrated = ldap_add_user($user['username'], $data['firstname'], $data['lastname'], $data['email'], $data['password'], array('dns-alle'));
_log($migrated);
set_migrated($data['userid']);
// redirect to confirmation page
redirect("/snapporder/activate_confirmed.php");
die();
} catch(ValidationException $e) {
$validation_errors = $e->getMessage();
@@ -74,6 +62,24 @@ if( isset($_POST['submit']) ) {
$password = $_POST['password'];
$newsletter_checked = isset($_POST['newsletter']) ? " checked" : "";
}
if($data !== NULL) {
// persist
try {
save_activation_form($data);
// Push the user to LDAP
$migrated = ldap_add_user($user['username'], $data['firstname'], $data['lastname'], $data['email'], $data['password'], array('dns-alle'));
_log($migrated);
// FIXME assumes this works every time
set_migrated($data['userid']);
// redirect to confirmation page
redirect("/snapporder/activate_confirmed.php");
die();
} catch(InsideDatabaseException $e) {
echo $e->getMessage();
die();
}
}
}
?>
snapporder/api/query.php
+14 -7
View File
@@ -38,14 +38,14 @@ $crypt = new CryptoHelper(SNAP_IV, SNAP_KEY);
/* Checks */
if(!isset($_GET['phone'])) {
set_response_code(400);
echo json_encode(array('error' => 'Missing param phone'));
echo $crypt->json_encode_and_encrypt(array('error' => 'Missing param phone'));
die();
}
$phone = $_GET['phone'];
$phone = clean_phonenumber($phone);
if( !valid_phonenumber($phone) ) {
set_response_code(400);
echo json_encode(array('error' => 'Not a phone number', 'query' => $_GET));
echo $crypt->json_encode_and_encrypt(array('error' => 'Not a phone number', 'query' => $_GET));
die();
}
@@ -55,7 +55,7 @@ $conn = DB::connect(getDSN(), $options);
if(DB :: isError($conn)) {
echo $conn->toString();
set_response_code(500);
echo json_encode(array('error' => 'Could not connect to DB'));
echo $crypt->json_encode_and_encrypt(array('error' => 'Could not connect to DB'));
die();
}
$conn->setFetchMode(DB_FETCHMODE_ASSOC);
@@ -63,12 +63,19 @@ $conn->setFetchMode(DB_FETCHMODE_ASSOC);
/* Search in phone number table for phone number */
$user_id = getUseridFromPhone($phone);
if( $user_id === false ) {
echo json_encode( array('result' => 'No matching users'));
echo $crypt->json_encode_and_encrypt( array('result' => 'No matching users'));
die();
}
/* Get and format user */
$user = get_user($user_id);
$user = NULL;
try {
$user = get_user($user_id);
} catch(InsideDatabaseException $e) {
set_response_code(500);
echo $crypt->json_encode_and_encrypt(array('error' => 'db_error', 'error_message' => $e->getMessage()));
die();
}
/* Add back phone number from query */
$user['phone'] = $phone;
@@ -79,7 +86,7 @@ if($user['registration_status'] === "partial") {
}
/* Return encrypted user object */
echo json_encode($user);
//echo $crypt->encrypt(json_encode($user));
echo $crypt->json_encode_and_encrypt($user);
//echo json_encode($user);
?>
snapporder/api/register.php
+31 -18
View File
@@ -52,13 +52,12 @@ if(strlen($body) === 0) {
}
/* Decrypt body */
// TODO enable
//$crypt = new CryptoHelper(SNAP_IV, SNAP_KEY);
//$body = $crypt->decrypt($body);
$crypt = new CryptoHelper(SNAP_IV, SNAP_KEY);
$body = $crypt->decrypt($body);
$data = (array) json_decode($body);
if($data === NULL) {
set_response_code(400);
echo json_encode(array('error' => 'Can\'t decode body'));
echo $crypt->json_encode_and_encrypt(array('error' => 'Can\'t decode body'));
die();
}
@@ -70,14 +69,14 @@ $valid_keys[] = + 'purchased';
foreach($required_keys as $key) {
if(!array_key_exists($key, $data)) {
set_response_code(400);
echo json_encode(array('error' => 'missing required field \''.$key.'\''));
echo $crypt->json_encode_and_encrypt(array('error' => 'missing required field \''.$key.'\''));
die();
}
}
foreach($data as $key => $value) {
if(!in_array($key, $valid_keys)) {
set_response_code(400);
echo json_encode(array('error' => 'unknown field \''.$key.'\''));
echo $crypt->json_encode_and_encrypt(array('error' => 'unknown field \''.$key.'\''));
die();
}
}
@@ -85,12 +84,12 @@ foreach($data as $key => $value) {
$data['phone'] = clean_phonenumber($data['phone']);
if( !valid_phonenumber($data['phone']) ) {
set_response_code(400);
echo json_encode(array('error' => 'Not a phone number:'.$data['phone']));
echo $crypt->json_encode_and_encrypt(array('error' => 'Not a phone number:'.$data['phone']));
die();
}
if( !valid_email($data['email']) ) {
set_response_code(400);
echo json_encode(array('error' => 'Not an email: '.$data['email']));
echo $crypt->json_encode_and_encrypt(array('error' => 'Not an email: '.$data['email']));
die();
}
@@ -100,7 +99,7 @@ $conn = DB::connect(getDSN(), $options);
if(DB :: isError($conn)) {
echo $conn->toString();
set_response_code(500);
echo json_encode(array('error' => 'Could not connect to DB'));
echo $crypt->json_encode_and_encrypt(array('error' => 'Could not connect to DB'));
die();
}
$conn->setFetchMode(DB_FETCHMODE_ASSOC);
@@ -108,24 +107,24 @@ $conn->setFetchMode(DB_FETCHMODE_ASSOC);
/* Existing user? */
if( getUseridFromEmail($data['email']) !== false) {
set_response_code(409);
echo json_encode(array('error' => 'Existing user with email: '.$data['email']));
echo $crypt->json_encode_and_encrypt(array('error' => 'Existing user with email: '.$data['email']));
die();
}
if( getUseridFromPhone($data['phone']) !== false ) {
set_response_code(409);
echo json_encode(array('error' => 'Existing user with phone: '.$data['phone']));
echo $crypt->json_encode_and_encrypt(array('error' => 'Existing user with phone: '.$data['phone']));
die();
}
/* validate firstname and lastname */
if( strlen($data['firstname']) < 2) {
set_response_code(400);
echo json_encode(array('error' => 'Too short firstname: '.$data['firstname']));
echo $crypt->json_encode_and_encrypt(array('error' => 'Too short firstname: '.$data['firstname']));
die();
}
if( strlen($data['lastname']) < 2) {
set_response_code(400);
echo json_encode(array('error' => 'Too short lastname: '.$data['lastname']));
echo $crypt->json_encode_and_encrypt(array('error' => 'Too short lastname: '.$data['lastname']));
die();
}
@@ -134,7 +133,7 @@ if( isset($data['purchased']) ) {
$purchased = clean_date($data['purchased']) ;
if($purchased === false) {
set_response_code(400);
echo json_encode(array('error' => 'Could not parse date from field purchased: '.$data['purchased']));
echo $crypt->json_encode_and_encrypt(array('error' => 'Could not parse date from field purchased: '.$data['purchased']));
die();
}
$data['purchased'] = $purchased;
@@ -142,10 +141,24 @@ if( isset($data['purchased']) ) {
/* Create user */
$user_id = add_user($data);
$user_id = NULL;
try {
$user_id = add_user($user_id);
} catch(InsideDatabaseException $e) {
set_response_code(500);
echo $crypt->json_encode_and_encrypt(array('error' => 'db_error', 'error_message' => $e->getMessage()));
die();
}
/* Get and format user */
$user = get_user($user_id);
$user = NULL;
try {
$user = add_user($user_id);
} catch(InsideDatabaseException $e) {
set_response_code(500);
echo $crypt->json_encode_and_encrypt(array('error' => 'db_error', 'error_message' => $e->getMessage()));
die();
}
/* Add register url */
$user['registration_url'] = generate_registration_url($user, SECRET_KEY);
@@ -154,7 +167,7 @@ $user['registration_url'] = generate_registration_url($user, SECRET_KEY);
$user['phone'] = $data['phone'];
/* Return encrypted user object */
echo json_encode($user);
//echo $crypt->encrypt(json_encode($user));
echo $crypt->json_encode_and_encrypt($user);
//echo json_encode($user);
?>
snapporder/lib/CryptoHelper.php
+4
View File
@@ -57,5 +57,9 @@ class CryptoHelper
return $bindata;
}
public function json_encode_and_encrypt($data) {
return $this->encode(json_encode($data));
}
}
snapporder/lib/functions.php
+10 -24
View File
@@ -2,6 +2,8 @@
class ValidationException extends Exception {}
class InsideDatabaseException extends Exception {}
/* Username based on firstname and lastname, max 12 chars */
function generate_username($data) {
$firstname = preg_replace('/[^\w]/', '', $data['firstname']);
@@ -42,9 +44,7 @@ function add_user($data) {
$res = $conn->execute($sth, $values);
if( DB::isError($res) ) {
set_response_code(500);
echo json_encode( array('error' => 'db_error', 'error_message' => $res->toString() ) );
die();
throw new InsideDatabaseException($res->toString);
}
$user_id = get_user_id_by_username($data['username']);
@@ -57,9 +57,7 @@ function add_user($data) {
$res = $conn->execute($sth, $values);
if( DB::isError($res) ) {
set_response_code(500);
echo json_encode( array('error' => 'db_error', 'error_message' => $res->toString() ) );
die();
throw new InsideDatabaseException($res->toString);
}
log_userupdate($user_id, "User registered."); // for legacy
@@ -84,9 +82,7 @@ function get_user($user_id) {
$sql = "SELECT ".implode($cols, ",").",$sql_group_ids,$sql_is_member FROM din_user AS users LEFT JOIN din_usergrouprelationship AS ug ON users.id=ug.user_id WHERE users.id=$user_id GROUP BY users.id";
$res = $conn->query($sql);
if( DB::isError($res) ) {
set_response_code(500);
echo json_encode( array('error' => 'db_error', 'error_message' => $res->toString() ) );
die();
throw new InsideDatabaseException($res->toString);
}
if($res->numRows() === 0) {
return false;
@@ -121,19 +117,13 @@ function get_user($user_id) {
return $user;
}
function get_user_id_by_username($username, $json=true) {
function get_user_id_by_username($username) {
global $conn;
$sql = "SELECT id FROM din_user WHERE username='$username'";
$res = $conn->query($sql);
if( DB::isError($res) ) {
set_response_code(500);
if($json) {
echo json_encode( array('error' => 'db_error', 'error_message' => $res->toString()) );
} else {
echo "Oops, databasefeil: ".$res->toString();
}
die();
throw new InsideDatabaseException($res->toString);
}
if( $res->numRows() === 0 ) {
return false;
@@ -240,9 +230,7 @@ function institutions($output=true) {
$sql = "SELECT * FROM studiesteder";
$res = $conn->getAll($sql);
if( DB::isError($res) ) {
set_response_code(500);
echo json_encode( array('error' => 'db_error', 'error_message' => $res->toString() ) );
die();
throw new InsideDatabaseException($res->toString);
}
$institutions = $res;
@@ -329,9 +317,7 @@ function update_user($data) {
$res = $conn->query($sql);
if (DB::isError($res)) {
set_response_code(500);
echo "Oops, databasefeil: ".$res->toString();
die();
throw new InsideDatabaseException($res->toString);
}
return true;
}
@@ -429,7 +415,7 @@ function save_activation_form($data) {
// weekly newsletter (mailchimp)
if(isset($data['newsletter']) && $data['newsletter'] === "1" && MAILCHIMP_API_KEY !== "") {
if( mailchimp_subscribe($data, MAILCHIMP_LIST_ID, MAILCHIMP_API_KEY) ) {
log_userupdate($data['userid'], "Added to newsletter.");
log_userupdate($data['userid'], "Lagt til nyhetsbrevet.");
}
}