1<?php 2 3/** 4 * webtrees: online genealogy 5 * Copyright (C) 2021 webtrees development team 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation, either version 3 of the License, or 9 * (at your option) any later version. 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * You should have received a copy of the GNU General Public License 15 * along with this program. If not, see <https://www.gnu.org/licenses/>. 16 */ 17 18declare(strict_types=1); 19 20namespace Fisharebest\Webtrees\Http\RequestHandlers; 21 22use Exception; 23use Fisharebest\Webtrees\Contracts\UserInterface; 24use Fisharebest\Webtrees\Exceptions\HttpNotFoundException; 25use Fisharebest\Webtrees\FlashMessages; 26use Fisharebest\Webtrees\Http\ViewResponseTrait; 27use Fisharebest\Webtrees\I18N; 28use Fisharebest\Webtrees\Log; 29use Fisharebest\Webtrees\NoReplyUser; 30use Fisharebest\Webtrees\Services\CaptchaService; 31use Fisharebest\Webtrees\Services\EmailService; 32use Fisharebest\Webtrees\Services\UserService; 33use Fisharebest\Webtrees\Site; 34use Fisharebest\Webtrees\SiteUser; 35use Fisharebest\Webtrees\Tree; 36use Fisharebest\Webtrees\TreeUser; 37use Illuminate\Database\Capsule\Manager as DB; 38use Illuminate\Support\Str; 39use Psr\Http\Message\ResponseInterface; 40use Psr\Http\Message\ServerRequestInterface; 41use Psr\Http\Server\RequestHandlerInterface; 42 43use function view; 44 45/** 46 * Process a user registration. 47 */ 48class RegisterAction implements RequestHandlerInterface 49{ 50 use ViewResponseTrait; 51 52 private CaptchaService $captcha_service; 53 54 private EmailService $email_service; 55 56 private UserService $user_service; 57 58 /** 59 * RegisterController constructor. 60 * 61 * @param CaptchaService $captcha_service 62 * @param EmailService $email_service 63 * @param UserService $user_service 64 */ 65 public function __construct( 66 CaptchaService $captcha_service, 67 EmailService $email_service, 68 UserService $user_service 69 ) { 70 $this->captcha_service = $captcha_service; 71 $this->email_service = $email_service; 72 $this->user_service = $user_service; 73 } 74 75 /** 76 * Perform a registration. 77 * 78 * @param ServerRequestInterface $request 79 * 80 * @return ResponseInterface 81 */ 82 public function handle(ServerRequestInterface $request): ResponseInterface 83 { 84 $tree = $request->getAttribute('tree'); 85 86 $this->checkRegistrationAllowed(); 87 88 $params = (array) $request->getParsedBody(); 89 90 $comment = $params['comment'] ?? ''; 91 $email = $params['email'] ?? ''; 92 $password = $params['password'] ?? ''; 93 $realname = $params['realname'] ?? ''; 94 $username = $params['username'] ?? ''; 95 96 try { 97 if ($this->captcha_service->isRobot($request)) { 98 throw new Exception(I18N::translate('Please try again.')); 99 } 100 101 $this->doValidateRegistration($request, $username, $email, $realname, $comment, $password); 102 } catch (Exception $ex) { 103 FlashMessages::addMessage($ex->getMessage(), 'danger'); 104 105 return redirect(route(RegisterPage::class, [ 106 'comment' => $comment, 107 'email' => $email, 108 'realname' => $realname, 109 'username' => $username, 110 ])); 111 } 112 113 Log::addAuthenticationLog('User registration requested for: ' . $username); 114 115 $user = $this->user_service->create($username, $realname, $email, $password); 116 $token = Str::random(32); 117 118 $user->setPreference(UserInterface::PREF_LANGUAGE, I18N::languageTag()); 119 $user->setPreference(UserInterface::PREF_TIME_ZONE, Site::getPreference('TIMEZONE')); 120 $user->setPreference(UserInterface::PREF_IS_EMAIL_VERIFIED, ''); 121 $user->setPreference(UserInterface::PREF_IS_ACCOUNT_APPROVED, ''); 122 $user->setPreference(UserInterface::PREF_TIMESTAMP_REGISTERED, date('U')); 123 $user->setPreference(UserInterface::PREF_VERIFICATION_TOKEN, $token); 124 $user->setPreference(UserInterface::PREF_CONTACT_METHOD, 'messaging2'); 125 $user->setPreference(UserInterface::PREF_NEW_ACCOUNT_COMMENT, $comment); 126 $user->setPreference(UserInterface::PREF_IS_VISIBLE_ONLINE, '1'); 127 $user->setPreference(UserInterface::PREF_AUTO_ACCEPT_EDITS, ''); 128 $user->setPreference(UserInterface::PREF_IS_ADMINISTRATOR, ''); 129 $user->setPreference(UserInterface::PREF_TIMESTAMP_ACTIVE, '0'); 130 131 $base_url = $request->getAttribute('base_url'); 132 $reply_to = $tree instanceof Tree ? new TreeUser($tree) : new SiteUser(); 133 134 $verify_url = route(VerifyEmail::class, [ 135 'username' => $user->userName(), 136 'token' => $token, 137 'tree' => $tree instanceof Tree ? $tree->name() : null, 138 ]); 139 140 // Send a verification message to the user. 141 /* I18N: %s is a server name/URL */ 142 $this->email_service->send( 143 new Siteuser(), 144 $user, 145 $reply_to, 146 I18N::translate('Your registration at %s', $base_url), 147 view('emails/register-user-text', ['user' => $user, 'base_url' => $base_url, 'verify_url' => $verify_url]), 148 view('emails/register-user-html', ['user' => $user, 'base_url' => $base_url, 'verify_url' => $verify_url]) 149 ); 150 151 // Tell the administrators about the registration. 152 foreach ($this->user_service->administrators() as $administrator) { 153 I18N::init($administrator->getPreference(UserInterface::PREF_LANGUAGE)); 154 155 /* I18N: %s is a server name/URL */ 156 $subject = I18N::translate('New registration at %s', $base_url); 157 158 $body_text = view('emails/register-notify-text', [ 159 'user' => $user, 160 'comments' => $comment, 161 'base_url' => $base_url, 162 'tree' => $tree, 163 ]); 164 165 $body_html = view('emails/register-notify-html', [ 166 'user' => $user, 167 'comments' => $comment, 168 'base_url' => $base_url, 169 'tree' => $tree, 170 ]); 171 172 173 /* I18N: %s is a server name/URL */ 174 $this->email_service->send( 175 new SiteUser(), 176 $administrator, 177 new NoReplyUser(), 178 $subject, 179 $body_text, 180 $body_html 181 ); 182 183 $mail1_method = $administrator->getPreference(UserInterface::PREF_CONTACT_METHOD); 184 if ($mail1_method !== 'messaging3' && $mail1_method !== 'mailto' && $mail1_method !== 'none') { 185 DB::table('message')->insert([ 186 'sender' => $user->email(), 187 'ip_address' => $request->getAttribute('client-ip'), 188 'user_id' => $administrator->id(), 189 'subject' => $subject, 190 'body' => $body_text, 191 ]); 192 } 193 } 194 195 $title = I18N::translate('Request a new user account'); 196 197 return $this->viewResponse('register-success-page', [ 198 'title' => $title, 199 'tree' => $tree, 200 'user' => $user, 201 ]); 202 } 203 204 /** 205 * Check that visitors are allowed to register on this site. 206 * 207 * @return void 208 * @throws HttpNotFoundException 209 */ 210 private function checkRegistrationAllowed(): void 211 { 212 if (Site::getPreference('USE_REGISTRATION_MODULE') !== '1') { 213 throw new HttpNotFoundException(); 214 } 215 } 216 217 /** 218 * Check the registration details. 219 * 220 * @param ServerRequestInterface $request 221 * @param string $username 222 * @param string $email 223 * @param string $realname 224 * @param string $comments 225 * @param string $password 226 * 227 * @return void 228 * @throws Exception 229 */ 230 private function doValidateRegistration(ServerRequestInterface $request, string $username, string $email, string $realname, string $comments, string $password): void 231 { 232 // All fields are required 233 if ($username === '' || $email === '' || $realname === '' || $comments === '' || $password === '') { 234 throw new Exception(I18N::translate('All fields must be completed.')); 235 } 236 237 // Username already exists 238 if ($this->user_service->findByUserName($username) !== null) { 239 throw new Exception(I18N::translate('Duplicate username. A user with that username already exists. Please choose another username.')); 240 } 241 242 // Email already exists 243 if ($this->user_service->findByEmail($email) !== null) { 244 throw new Exception(I18N::translate('Duplicate email address. A user with that email already exists.')); 245 } 246 247 $base_url = $request->getAttribute('base_url'); 248 249 // No external links 250 if (preg_match('/(?!' . preg_quote($base_url, '/') . ')(((?:http|https):\/\/)[a-zA-Z0-9.-]+)/', $comments, $match)) { 251 throw new Exception(I18N::translate('You are not allowed to send messages that contain external links.') . ' ' . I18N::translate('You should delete the “%1$s” from “%2$s” and try again.', e($match[2]), e($match[1]))); 252 } 253 } 254} 255