1<?php 2 3/** 4 * webtrees: online genealogy 5 * Copyright (C) 2022 webtrees development team 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation, either version 3 of the License, or 9 * (at your option) any later version. 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * You should have received a copy of the GNU General Public License 15 * along with this program. If not, see <https://www.gnu.org/licenses/>. 16 */ 17 18declare(strict_types=1); 19 20namespace Fisharebest\Webtrees\Http\RequestHandlers; 21 22use Exception; 23use Fisharebest\Webtrees\Contracts\UserInterface; 24use Fisharebest\Webtrees\FlashMessages; 25use Fisharebest\Webtrees\Http\Exceptions\HttpNotFoundException; 26use Fisharebest\Webtrees\Http\ViewResponseTrait; 27use Fisharebest\Webtrees\I18N; 28use Fisharebest\Webtrees\Log; 29use Fisharebest\Webtrees\NoReplyUser; 30use Fisharebest\Webtrees\Services\CaptchaService; 31use Fisharebest\Webtrees\Services\EmailService; 32use Fisharebest\Webtrees\Services\MessageService; 33use Fisharebest\Webtrees\Services\RateLimitService; 34use Fisharebest\Webtrees\Services\UserService; 35use Fisharebest\Webtrees\Session; 36use Fisharebest\Webtrees\Site; 37use Fisharebest\Webtrees\SiteUser; 38use Fisharebest\Webtrees\Tree; 39use Fisharebest\Webtrees\TreeUser; 40use Fisharebest\Webtrees\Validator; 41use Illuminate\Database\Capsule\Manager as DB; 42use Illuminate\Support\Str; 43use Psr\Http\Message\ResponseInterface; 44use Psr\Http\Message\ServerRequestInterface; 45use Psr\Http\Server\RequestHandlerInterface; 46 47use function view; 48 49/** 50 * Process a user registration. 51 */ 52class RegisterAction implements RequestHandlerInterface 53{ 54 use ViewResponseTrait; 55 56 private CaptchaService $captcha_service; 57 58 private EmailService $email_service; 59 60 private RateLimitService $rate_limit_service; 61 62 private UserService $user_service; 63 64 /** 65 * RegisterController constructor. 66 * 67 * @param CaptchaService $captcha_service 68 * @param EmailService $email_service 69 * @param RateLimitService $rate_limit_service 70 * @param UserService $user_service 71 */ 72 public function __construct( 73 CaptchaService $captcha_service, 74 EmailService $email_service, 75 RateLimitService $rate_limit_service, 76 UserService $user_service 77 ) { 78 $this->captcha_service = $captcha_service; 79 $this->email_service = $email_service; 80 $this->rate_limit_service = $rate_limit_service; 81 $this->user_service = $user_service; 82 } 83 84 /** 85 * Perform a registration. 86 * 87 * @param ServerRequestInterface $request 88 * 89 * @return ResponseInterface 90 */ 91 public function handle(ServerRequestInterface $request): ResponseInterface 92 { 93 $tree = Validator::attributes($request)->treeOptional(); 94 95 $this->checkRegistrationAllowed(); 96 97 $params = (array) $request->getParsedBody(); 98 99 $comments = $params['comments'] ?? ''; 100 $email = $params['email'] ?? ''; 101 $password = $params['password'] ?? ''; 102 $realname = $params['realname'] ?? ''; 103 $username = $params['username'] ?? ''; 104 105 try { 106 if ($this->captcha_service->isRobot($request)) { 107 throw new Exception(I18N::translate('Please try again.')); 108 } 109 110 $this->doValidateRegistration($request, $username, $email, $realname, $comments, $password); 111 112 Session::forget('register_comments'); 113 Session::forget('register_email'); 114 Session::forget('register_realname'); 115 Session::forget('register_username'); 116 } catch (Exception $ex) { 117 FlashMessages::addMessage($ex->getMessage(), 'danger'); 118 119 Session::put('register_comments', $comments); 120 Session::put('register_email', $email); 121 Session::put('register_realname', $realname); 122 Session::put('register_username', $username); 123 124 return redirect(route(RegisterPage::class)); 125 } 126 127 $this->rate_limit_service->limitRateForSite(5, 300, 'rate-limit-registration'); 128 129 Log::addAuthenticationLog('User registration requested for: ' . $username); 130 131 $user = $this->user_service->create($username, $realname, $email, $password); 132 $token = Str::random(32); 133 134 $user->setPreference(UserInterface::PREF_LANGUAGE, I18N::languageTag()); 135 $user->setPreference(UserInterface::PREF_TIME_ZONE, Site::getPreference('TIMEZONE')); 136 $user->setPreference(UserInterface::PREF_IS_EMAIL_VERIFIED, ''); 137 $user->setPreference(UserInterface::PREF_IS_ACCOUNT_APPROVED, ''); 138 $user->setPreference(UserInterface::PREF_TIMESTAMP_REGISTERED, date('U')); 139 $user->setPreference(UserInterface::PREF_VERIFICATION_TOKEN, $token); 140 $user->setPreference(UserInterface::PREF_CONTACT_METHOD, MessageService::CONTACT_METHOD_INTERNAL_AND_EMAIL); 141 $user->setPreference(UserInterface::PREF_NEW_ACCOUNT_COMMENT, $comments); 142 $user->setPreference(UserInterface::PREF_IS_VISIBLE_ONLINE, '1'); 143 $user->setPreference(UserInterface::PREF_AUTO_ACCEPT_EDITS, ''); 144 $user->setPreference(UserInterface::PREF_IS_ADMINISTRATOR, ''); 145 $user->setPreference(UserInterface::PREF_TIMESTAMP_ACTIVE, '0'); 146 147 $base_url = Validator::attributes($request)->string('base_url'); 148 $reply_to = $tree instanceof Tree ? new TreeUser($tree) : new SiteUser(); 149 150 $verify_url = route(VerifyEmail::class, [ 151 'username' => $user->userName(), 152 'token' => $token, 153 'tree' => $tree instanceof Tree ? $tree->name() : null, 154 ]); 155 156 // Send a verification message to the user. 157 /* I18N: %s is a server name/URL */ 158 $this->email_service->send( 159 new SiteUser(), 160 $user, 161 $reply_to, 162 I18N::translate('Your registration at %s', $base_url), 163 view('emails/register-user-text', ['user' => $user, 'base_url' => $base_url, 'verify_url' => $verify_url]), 164 view('emails/register-user-html', ['user' => $user, 'base_url' => $base_url, 'verify_url' => $verify_url]) 165 ); 166 167 // Tell the administrators about the registration. 168 foreach ($this->user_service->administrators() as $administrator) { 169 I18N::init($administrator->getPreference(UserInterface::PREF_LANGUAGE)); 170 171 /* I18N: %s is a server name/URL */ 172 $subject = I18N::translate('New registration at %s', $base_url); 173 174 $body_text = view('emails/register-notify-text', [ 175 'user' => $user, 176 'comments' => $comments, 177 'base_url' => $base_url, 178 'tree' => $tree, 179 ]); 180 181 $body_html = view('emails/register-notify-html', [ 182 'user' => $user, 183 'comments' => $comments, 184 'base_url' => $base_url, 185 'tree' => $tree, 186 ]); 187 188 189 /* I18N: %s is a server name/URL */ 190 $this->email_service->send( 191 new SiteUser(), 192 $administrator, 193 new NoReplyUser(), 194 $subject, 195 $body_text, 196 $body_html 197 ); 198 199 $mail1_method = $administrator->getPreference(UserInterface::PREF_CONTACT_METHOD); 200 if ( 201 $mail1_method !== MessageService::CONTACT_METHOD_EMAIL && 202 $mail1_method !== MessageService::CONTACT_METHOD_MAILTO && 203 $mail1_method !== MessageService::CONTACT_METHOD_NONE 204 ) { 205 DB::table('message')->insert([ 206 'sender' => $user->email(), 207 'ip_address' => $request->getAttribute('client-ip'), 208 'user_id' => $administrator->id(), 209 'subject' => $subject, 210 'body' => $body_text, 211 ]); 212 } 213 } 214 215 $title = I18N::translate('Request a new user account'); 216 217 return $this->viewResponse('register-success-page', [ 218 'title' => $title, 219 'tree' => $tree, 220 'user' => $user, 221 ]); 222 } 223 224 /** 225 * Check that visitors are allowed to register on this site. 226 * 227 * @return void 228 * @throws HttpNotFoundException 229 */ 230 private function checkRegistrationAllowed(): void 231 { 232 if (Site::getPreference('USE_REGISTRATION_MODULE') !== '1') { 233 throw new HttpNotFoundException(); 234 } 235 } 236 237 /** 238 * Check the registration details. 239 * 240 * @param ServerRequestInterface $request 241 * @param string $username 242 * @param string $email 243 * @param string $realname 244 * @param string $comments 245 * @param string $password 246 * 247 * @return void 248 * @throws Exception 249 */ 250 private function doValidateRegistration(ServerRequestInterface $request, string $username, string $email, string $realname, string $comments, string $password): void 251 { 252 // All fields are required 253 if ($username === '' || $email === '' || $realname === '' || $comments === '' || $password === '') { 254 throw new Exception(I18N::translate('All fields must be completed.')); 255 } 256 257 // Username already exists 258 if ($this->user_service->findByUserName($username) !== null) { 259 throw new Exception(I18N::translate('Duplicate username. A user with that username already exists. Please choose another username.')); 260 } 261 262 // Email already exists 263 if ($this->user_service->findByEmail($email) !== null) { 264 throw new Exception(I18N::translate('Duplicate email address. A user with that email already exists.')); 265 } 266 267 $base_url = Validator::attributes($request)->string('base_url'); 268 269 // No external links 270 if (preg_match('/(?!' . preg_quote($base_url, '/') . ')(((?:http|https):\/\/)[a-zA-Z0-9.-]+)/', $comments, $match)) { 271 throw new Exception(I18N::translate('You are not allowed to send messages that contain external links.') . ' ' . I18N::translate('You should delete the “%1$s” from “%2$s” and try again.', e($match[2]), e($match[1]))); 272 } 273 } 274} 275