lost_password.lib.php 7.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211
  1. <?php
  2. /* For licensing terms, see /dokeos_license.txt */
  3. /**
  4. * Get email headers
  5. *
  6. * @return string
  7. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  8. */
  9. function get_email_headers()
  10. {
  11. global $charset;
  12. $emailHeaders = "From: \"".addslashes(api_get_setting('administratorSurname')." ".api_get_setting('administratorName'))."\" <".api_get_setting('emailAdministrator').">\n";
  13. $emailHeaders .= "Reply-To: ".api_get_setting('emailAdministrator')."\n";
  14. $emailHeaders .= "Return-Path: ".api_get_setting('emailAdministrator')."\n";
  15. $emailHeaders .= "X-Sender: ".api_get_setting('emailAdministrator')."\n";
  16. $emailHeaders .= "X-Mailer: PHP / ".phpversion()."\n";
  17. $emailHeaders .= "Content-Type: text/plain;\n\tcharset=\"".$charset."\"\n";
  18. $emailHeaders .= "Mime-Version: 1.0";
  19. return $emailHeaders;
  20. }
  21. /**
  22. * Enter description here...
  23. *
  24. * @param unknown_type $user
  25. * @param boolean $reset
  26. * @param boolean $by_username
  27. * @return unknown
  28. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  29. */
  30. function get_user_account_list($user, $reset = false, $by_username = false)
  31. {
  32. global $_configuration;
  33. $portal_url = $_configuration['root_web'];
  34. if ($_configuration['multiple_access_urls']==true) {
  35. $access_url_id = api_get_current_access_url_id();
  36. if ($access_url_id != -1 ){
  37. $url = api_get_access_url($access_url_id);
  38. $portal_url = $url['url'];
  39. }
  40. }
  41. if ($reset == true) {
  42. if ($by_username == true) {
  43. $secretword = get_secret_word($user["email"]);
  44. if ($reset) {
  45. $reset_link = $portal_url."main/auth/lostPassword.php?reset=".$secretword."&id=".$user['uid'];
  46. } else {
  47. $reset_link = get_lang('Pass')." : $user[password]";
  48. }
  49. $userAccountList = get_lang('YourRegistrationData')." : \n".get_lang('UserName').' : '.$user['loginName']."\n".get_lang('ResetLink').' : '.$reset_link.'';
  50. if ($userAccountList) {
  51. $userAccountList = "\n------------------------\n" . $userAccountList;
  52. }
  53. } else {
  54. foreach ($user as $thisUser) {
  55. $secretword = get_secret_word($thisUser["email"]);
  56. if ($reset) {
  57. $reset_link = $portal_url."main/auth/lostPassword.php?reset=".$secretword."&id=".$thisUser['uid'];
  58. } else {
  59. $reset_link = get_lang('Pass')." : $thisUser[password]";
  60. }
  61. $userAccountList[] = get_lang('YourRegistrationData')." : \n".get_lang('UserName').' : '.$thisUser['loginName']."\n".get_lang('ResetLink').' : '.$reset_link.'';
  62. }
  63. if ($userAccountList) {
  64. $userAccountList = implode("\n------------------------\n", $userAccountList);
  65. }
  66. }
  67. } else {
  68. if ($by_username == false) {
  69. $user = $user[0];
  70. }
  71. $reset_link = get_lang('Pass')." : $user[password]";
  72. $userAccountList = get_lang('YourRegistrationData')." : \n".get_lang('UserName').' : '.$user['loginName']."\n".$reset_link.'';
  73. }
  74. return $userAccountList;
  75. }
  76. /**
  77. * This function sends the actual password to the user
  78. *
  79. * @param unknown_type $user
  80. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  81. */
  82. function send_password_to_user($user, $by_username = false)
  83. {
  84. global $charset;
  85. global $_configuration;
  86. $emailHeaders = get_email_headers(); // Email Headers
  87. $emailSubject = "[".get_setting('siteName')."] ".get_lang('LoginRequest'); // SUBJECT
  88. if ($by_username == true) { // Show only for lost password
  89. $userAccountList = get_user_account_list($user, false, $by_username); // BODY
  90. $emailTo = $user["email"];
  91. } else {
  92. $userAccountList = get_user_account_list($user); // BODY
  93. $emailTo = $user[0]["email"];
  94. }
  95. $portal_url = $_configuration['root_web'];
  96. if ($_configuration['multiple_access_urls'] == true) {
  97. $access_url_id = api_get_current_access_url_id();
  98. if ($access_url_id != -1 ){
  99. $url = api_get_access_url($access_url_id);
  100. $portal_url = $url['url'];
  101. }
  102. }
  103. $emailBody = get_lang('YourAccountParam')." ".$portal_url."\n\n$userAccountList";
  104. // SEND MESSAGE
  105. $sender_name = get_setting('administratorName').' '.get_setting('administratorSurname');
  106. $email_admin = get_setting('emailAdministrator');
  107. if (@api_mail('', $emailTo, $emailSubject, $emailBody, $sender_name, $email_admin) == 1) {
  108. Display::display_confirmation_message(get_lang('YourPasswordHasBeenEmailed'));
  109. } else {
  110. $message = get_lang('SystemUnableToSendEmailContact') . ' ' . Display :: encrypted_mailto_link(get_setting('emailAdministrator'), get_lang('PlatformAdmin')).".</p>";
  111. }
  112. }
  113. /**
  114. * Enter description here...
  115. *
  116. * @param unknown_type $user
  117. * @param bool $by_username
  118. * @return unknown
  119. *
  120. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  121. */
  122. function handle_encrypted_password($user, $by_username = false)
  123. {
  124. global $charset;
  125. global $_configuration;
  126. $emailHeaders = get_email_headers(); // Email Headers
  127. $emailSubject = "[".get_setting('siteName')."] ".get_lang('LoginRequest'); // SUBJECT
  128. if ($by_username == true) { // Show only for lost password
  129. $userAccountList = get_user_account_list($user, true, $by_username); // BODY
  130. $emailTo = $user["email"];
  131. } else {
  132. $userAccountList = get_user_account_list($user, true); // BODY
  133. $emailTo = $user[0]["email"];
  134. }
  135. $secretword = get_secret_word($emailTo);
  136. $emailBody = get_lang('DearUser')." :\n".get_lang("password_request")."\n\n";
  137. $emailBody .= "-----------------------------------------------\n".$userAccountList."\n-----------------------------------------------\n\n";
  138. $emailBody .= get_lang('PasswordEncryptedForSecurity');
  139. $emailBody .= "\n\n".get_lang('Formula').",\n".get_lang('PlataformAdmin');
  140. $sender_name = get_setting('administratorName').' '.get_setting('administratorSurname');
  141. $email_admin = get_setting('emailAdministrator');
  142. if (@api_mail('', $emailTo, $emailSubject, $emailBody, $sender_name, $email_admin) == 1) {
  143. Display::display_confirmation_message(get_lang('YourPasswordHasBeenEmailed'));
  144. } else {
  145. $message = get_lang('SystemUnableToSendEmailContact') . ' ' . Display :: encrypted_mailto_link(get_setting('emailAdministrator'), get_lang('PlatformAdmin')).".</p>";
  146. Display::display_error_message($message, false);
  147. }
  148. }
  149. /**
  150. * Enter description here...
  151. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  152. */
  153. function get_secret_word($add)
  154. {
  155. global $_configuration;
  156. return $secretword = md5($_configuration['security_key'].$add);
  157. }
  158. /**
  159. * Enter description here...
  160. * @author Olivier Cauberghe <olivier.cauberghe@UGent.be>, Ghent University
  161. */
  162. function reset_password($secret, $id, $by_username = false)
  163. {
  164. $tbl_user = Database::get_main_table(TABLE_MAIN_USER);
  165. $id = intval($id);
  166. $sql = "SELECT user_id AS uid, lastname AS lastName, firstname AS firstName, username AS loginName, password, email FROM ".$tbl_user." WHERE user_id=$id";
  167. $result = Database::query($sql,__FILE__,__LINE__);
  168. $num_rows = Database::num_rows($result);
  169. if ($result && $num_rows > 0) {
  170. $user = Database::fetch_array($result);
  171. } else {
  172. return "Could not reset password.";
  173. }
  174. if (get_secret_word($user["email"]) == $secret) { // OK, secret word is good. Now change password and mail it.
  175. $user["password"] = api_generate_password();
  176. $crypted = $user["password"];
  177. $crypted = api_get_encrypted_password($crypted);
  178. $sql = "UPDATE ".$tbl_user." SET password='$crypted' WHERE user_id=$id";
  179. $result = Database::query($sql,__FILE__,__LINE__);
  180. return send_password_to_user($user, $by_username);
  181. } else {
  182. return "Not allowed.";
  183. }
  184. }
  185. ?>