1<?php 2 3/** 4 * webtrees: online genealogy 5 * Copyright (C) 2019 webtrees development team 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation, either version 3 of the License, or 9 * (at your option) any later version. 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * You should have received a copy of the GNU General Public License 15 * along with this program. If not, see <http://www.gnu.org/licenses/>. 16 */ 17 18declare(strict_types=1); 19 20namespace Fisharebest\Webtrees\Http\RequestHandlers; 21 22use Exception; 23use Fisharebest\Webtrees\Exceptions\HttpNotFoundException; 24use Fisharebest\Webtrees\FlashMessages; 25use Fisharebest\Webtrees\Http\Controllers\AbstractBaseController; 26use Fisharebest\Webtrees\I18N; 27use Fisharebest\Webtrees\Log; 28use Fisharebest\Webtrees\NoReplyUser; 29use Fisharebest\Webtrees\Services\CaptchaService; 30use Fisharebest\Webtrees\Services\EmailService; 31use Fisharebest\Webtrees\Services\UserService; 32use Fisharebest\Webtrees\Site; 33use Fisharebest\Webtrees\SiteUser; 34use Fisharebest\Webtrees\Tree; 35use Fisharebest\Webtrees\TreeUser; 36use Fisharebest\Webtrees\User; 37use Illuminate\Database\Capsule\Manager as DB; 38use Illuminate\Support\Str; 39use Psr\Http\Message\ResponseInterface; 40use Psr\Http\Message\ServerRequestInterface; 41 42use function view; 43 44/** 45 * Process a user registration. 46 */ 47class RegisterAction extends AbstractBaseController 48{ 49 /** @var CaptchaService */ 50 private $captcha_service; 51 52 /** @var EmailService */ 53 private $email_service; 54 55 /** @var UserService */ 56 private $user_service; 57 58 /** 59 * RegisterController constructor. 60 * 61 * @param CaptchaService $captcha_service 62 * @param EmailService $email_service 63 * @param UserService $user_service 64 */ 65 public function __construct( 66 CaptchaService $captcha_service, 67 EmailService $email_service, 68 UserService $user_service 69 ) { 70 $this->captcha_service = $captcha_service; 71 $this->email_service = $email_service; 72 $this->user_service = $user_service; 73 } 74 75 /** 76 * Perform a registration. 77 * 78 * @param ServerRequestInterface $request 79 * 80 * @return ResponseInterface 81 */ 82 public function handle(ServerRequestInterface $request): ResponseInterface 83 { 84 $tree = $request->getAttribute('tree'); 85 86 $this->checkRegistrationAllowed(); 87 88 $params = (array) $request->getParsedBody(); 89 90 $comments = $params['comments'] ?? ''; 91 $email = $params['email'] ?? ''; 92 $password = $params['password'] ?? ''; 93 $realname = $params['realname'] ?? ''; 94 $username = $params['username'] ?? ''; 95 96 try { 97 if ($this->captcha_service->isRobot($request)) { 98 throw new Exception(I18N::translate('Please try again.')); 99 } 100 101 $this->doValidateRegistration($request, $username, $email, $realname, $comments, $password); 102 } catch (Exception $ex) { 103 FlashMessages::addMessage($ex->getMessage(), 'danger'); 104 105 return redirect(route(RegisterPage::class, [ 106 'comments' => $comments, 107 'email' => $email, 108 'realname' => $realname, 109 'username' => $username, 110 ])); 111 } 112 113 Log::addAuthenticationLog('User registration requested for: ' . $username); 114 115 $user = $this->user_service->create($username, $realname, $email, $password); 116 $token = Str::random(32); 117 118 $user->setPreference(User::PREF_LANGUAGE, I18N::languageTag()); 119 $user->setPreference(User::PREF_IS_EMAIL_VERIFIED, ''); 120 $user->setPreference(User::PREF_IS_ACCOUNT_APPROVED, ''); 121 $user->setPreference(User::PREF_TIMESTAMP_REGISTERED, date('U')); 122 $user->setPreference(User::PREF_VERIFICATION_TOKEN, $token); 123 $user->setPreference(User::PREF_CONTACT_METHOD, 'messaging2'); 124 $user->setPreference(User::PREF_NEW_ACCOUNT_COMMENT, $comments); 125 $user->setPreference(User::PREF_IS_VISIBLE_ONLINE, '1'); 126 $user->setPreference(User::PREF_AUTO_ACCEPT_EDITS, ''); 127 $user->setPreference(User::PREF_IS_ADMINISTRATOR, ''); 128 $user->setPreference(User::PREF_TIMESTAMP_ACTIVE, '0'); 129 130 $base_url = $request->getAttribute('base_url'); 131 $reply_to = $tree instanceof Tree ? new TreeUser($tree) : new SiteUser(); 132 133 $verify_url = route(VerifyEmail::class, [ 134 'username' => $user->userName(), 135 'token' => $token, 136 'tree' => $tree instanceof Tree ? $tree->name() : null, 137 ]); 138 139 // Send a verification message to the user. 140 /* I18N: %s is a server name/URL */ 141 $this->email_service->send( 142 new Siteuser(), 143 $user, 144 $reply_to, 145 I18N::translate('Your registration at %s', $base_url), 146 view('emails/register-user-text', ['user' => $user, 'base_url' => $base_url, 'verify_url' => $verify_url]), 147 view('emails/register-user-html', ['user' => $user, 'base_url' => $base_url, 'verify_url' => $verify_url]) 148 ); 149 150 // Tell the administrators about the registration. 151 foreach ($this->user_service->administrators() as $administrator) { 152 I18N::init($administrator->getPreference(User::PREF_LANGUAGE)); 153 154 /* I18N: %s is a server name/URL */ 155 $subject = I18N::translate('New registration at %s', $base_url); 156 157 $body_text = view('emails/register-notify-text', [ 158 'user' => $user, 159 'comments' => $comments, 160 'base_url' => $base_url, 161 'tree' => $tree, 162 ]); 163 164 $body_html = view('emails/register-notify-html', [ 165 'user' => $user, 166 'comments' => $comments, 167 'base_url' => $base_url, 168 'tree' => $tree, 169 ]); 170 171 172 /* I18N: %s is a server name/URL */ 173 $this->email_service->send( 174 new SiteUser(), 175 $administrator, 176 new NoReplyUser(), 177 $subject, 178 $body_text, 179 $body_html 180 ); 181 182 $mail1_method = $administrator->getPreference(User::PREF_CONTACT_METHOD); 183 if ($mail1_method !== 'messaging3' && $mail1_method !== 'mailto' && $mail1_method !== 'none') { 184 DB::table('message')->insert([ 185 'sender' => $user->email(), 186 'ip_address' => $request->getAttribute('client-ip'), 187 'user_id' => $administrator->id(), 188 'subject' => $subject, 189 'body' => $body_text, 190 ]); 191 } 192 } 193 194 $title = I18N::translate('Request a new user account'); 195 196 return $this->viewResponse('register-success-page', [ 197 'title' => $title, 198 'tree' => $tree, 199 'user' => $user, 200 ]); 201 } 202 203 /** 204 * Check that visitors are allowed to register on this site. 205 * 206 * @return void 207 * @throws HttpNotFoundException 208 */ 209 private function checkRegistrationAllowed(): void 210 { 211 if (Site::getPreference('USE_REGISTRATION_MODULE') !== '1') { 212 throw new HttpNotFoundException(); 213 } 214 } 215 216 /** 217 * Check the registration details. 218 * 219 * @param ServerRequestInterface $request 220 * @param string $username 221 * @param string $email 222 * @param string $realname 223 * @param string $comments 224 * @param string $password 225 * 226 * @return void 227 * @throws Exception 228 */ 229 private function doValidateRegistration(ServerRequestInterface $request, string $username, string $email, string $realname, string $comments, string $password): void 230 { 231 // All fields are required 232 if ($username === '' || $email === '' || $realname === '' || $comments === '' || $password === '') { 233 throw new Exception(I18N::translate('All fields must be completed.')); 234 } 235 236 // Username already exists 237 if ($this->user_service->findByUserName($username) !== null) { 238 throw new Exception(I18N::translate('Duplicate username. A user with that username already exists. Please choose another username.')); 239 } 240 241 // Email already exists 242 if ($this->user_service->findByEmail($email) !== null) { 243 throw new Exception(I18N::translate('Duplicate email address. A user with that email already exists.')); 244 } 245 246 $base_url = $request->getAttribute('base_url'); 247 248 // No external links 249 if (preg_match('/(?!' . preg_quote($base_url, '/') . ')(((?:http|https):\/\/)[a-zA-Z0-9.-]+)/', $comments, $match)) { 250 throw new Exception(I18N::translate('You are not allowed to send messages that contain external links.') . ' ' . I18N::translate('You should delete the “%1$s” from “%2$s” and try again.', e($match[2]), e($match[1]))); 251 } 252 } 253} 254