first commit

lib/pkp/pages/user/PKPUserHandler.php

@@ -0,0 +1,109 @@
+<?php
+
+/**
+ * @file pages/user/PKPUserHandler.php
+ *
+ * Copyright (c) 2014-2021 Simon Fraser University
+ * Copyright (c) 2000-2021 John Willinsky
+ * Distributed under the GNU GPL v3. For full terms see the file docs/COPYING.
+ *
+ * @class PKPUserHandler
+ *
+ * @ingroup pages_user
+ *
+ * @brief Handle requests for user functions.
+ */
+
+namespace PKP\pages\user;
+
+use APP\core\Request;
+use APP\handler\Handler;
+use APP\template\TemplateManager;
+use PKP\core\JSONMessage;
+use PKP\core\PKPRequest;
+use PKP\facades\Locale;
+use PKP\security\Validation;
+use PKP\user\InterestManager;
+
+class PKPUserHandler extends Handler
+{
+    /**
+     * Index page; redirect to profile
+     */
+    public function index($args, $request)
+    {
+        $request->redirect(null, null, 'profile');
+    }
+
+    /**
+     * Change the locale for the current user.
+     *
+     * @param array $args first parameter is the new locale
+     */
+    public function setLocale($args, $request)
+    {
+        $setLocale = array_shift($args);
+
+        $site = $request->getSite();
+        $context = $request->getContext();
+        if ($context != null) {
+            $contextSupportedLocales = (array) $context->getSupportedLocales();
+        }
+
+        if (Locale::isLocaleValid($setLocale) && (!isset($contextSupportedLocales) || in_array($setLocale, $contextSupportedLocales)) && in_array($setLocale, $site->getSupportedLocales())) {
+            $session = $request->getSession();
+            $session->setSessionVar('currentLocale', $setLocale);
+        }
+
+        $source = $request->getUserVar('source');
+        if (preg_match('#^/\w#', $source) === 1) {
+            $request->redirectUrl($source);
+        }
+
+        if (isset($_SERVER['HTTP_REFERER'])) {
+            $request->redirectUrl($_SERVER['HTTP_REFERER']);
+        }
+
+        $request->redirect(null, 'index');
+    }
+
+    /**
+     * Get interests for reviewer interests autocomplete.
+     *
+     * @param array $args
+     * @param PKPRequest $request
+     *
+     * @return JSONMessage JSON object
+     */
+    public function getInterests($args, $request)
+    {
+        return new JSONMessage(
+            true,
+            (new InterestManager())->getAllInterests($request->getUserVar('term'))
+        );
+    }
+
+    /**
+     * Display an authorization denied message.
+     *
+     * @param array $args
+     * @param Request $request
+     */
+    public function authorizationDenied($args, $request)
+    {
+        if (!Validation::isLoggedIn()) {
+            Validation::redirectLogin();
+        }
+
+        // Get message with sanity check (for XSS or phishing)
+        $authorizationMessage = $request->getUserVar('message');
+        if (!preg_match('/^[a-zA-Z0-9.]+$/', $authorizationMessage)) {
+            fatalError('Invalid locale key for auth message.');
+        }
+
+        $this->setupTemplate($request);
+        $templateMgr = TemplateManager::getManager($request);
+        $templateMgr->assign('message', $authorizationMessage);
+        return $templateMgr->display('frontend/pages/message.tpl');
+    }
+}

lib/pkp/pages/user/ProfileHandler.php

@@ -0,0 +1,85 @@
+<?php
+
+/**
+ * @file pages/user/ProfileHandler.php
+ *
+ * Copyright (c) 2014-2021 Simon Fraser University
+ * Copyright (c) 2003-2021 John Willinsky
+ * Distributed under the GNU GPL v3. For full terms see the file docs/COPYING.
+ *
+ * @class ProfileHandler
+ *
+ * @ingroup pages_user
+ *
+ * @brief Handle requests for modifying user profiles.
+ */
+
+namespace PKP\pages\user;
+
+use APP\core\Application;
+use APP\pages\user\UserHandler;
+use APP\template\TemplateManager;
+use PKP\core\PKPRequest;
+use PKP\security\authorization\PKPSiteAccessPolicy;
+use PKP\security\authorization\UserRequiredPolicy;
+
+class ProfileHandler extends UserHandler
+{
+    /** @copydoc PKPHandler::_isBackendPage */
+    public $_isBackendPage = true;
+
+    //
+    // Implement template methods from PKPHandler
+    //
+    /**
+     * @copydoc PKPHandler::authorize()
+     */
+    public function authorize($request, &$args, $roleAssignments)
+    {
+        $operations = [
+            'profile',
+        ];
+
+        // Site access policy
+        $this->addPolicy(new PKPSiteAccessPolicy($request, $operations, PKPSiteAccessPolicy::SITE_ACCESS_ALL_ROLES));
+
+        // User must be logged in
+        $this->addPolicy(new UserRequiredPolicy($request));
+
+        return parent::authorize($request, $args, $roleAssignments);
+    }
+
+    /**
+     * Display user profile tabset.
+     *
+     * @param array $args
+     * @param PKPRequest $request
+     */
+    public function profile($args, $request)
+    {
+        $context = $request->getContext();
+        if (!$context) {
+            $user = $request->getUser();
+            $contextDao = Application::getContextDAO();
+            $workingContexts = $contextDao->getAvailable($user ? $user->getId() : null);
+            [$firstContext, $secondContext] = [$workingContexts->next(), $workingContexts->next()];
+            if ($firstContext && !$secondContext) {
+                $request->redirect($firstContext->getPath(), 'user', 'profile', null, $args);
+            }
+        }
+
+        if ($anchor = array_shift($args)) {
+            // Some requests will try to specify a tab name in the args. Redirect
+            // to use this as an anchor name instead.
+            $request->redirect(null, null, null, null, null, $anchor);
+        }
+
+        $this->setupTemplate($request);
+
+        $templateMgr = TemplateManager::getManager($request);
+        $templateMgr->assign([
+            'pageTitle' => __('user.profile'),
+        ]);
+        $templateMgr->display('user/profile.tpl');
+    }
+}

lib/pkp/pages/user/RegistrationHandler.php

@@ -0,0 +1,224 @@
+<?php
+
+/**
+ * @file pages/user/RegistrationHandler.php
+ *
+ * Copyright (c) 2014-2021 Simon Fraser University
+ * Copyright (c) 2003-2021 John Willinsky
+ * Distributed under the GNU GPL v3. For full terms see the file docs/COPYING.
+ *
+ * @class RegistrationHandler
+ *
+ * @ingroup pages_user
+ *
+ * @brief Handle requests for user registration.
+ */
+
+namespace PKP\pages\user;
+
+use APP\core\Application;
+use APP\facades\Repo;
+use APP\pages\user\UserHandler;
+use APP\template\TemplateManager;
+use PKP\config\Config;
+use PKP\core\Core;
+use PKP\core\PKPRequest;
+use PKP\notification\PKPNotification;
+use PKP\notification\PKPNotificationManager;
+use PKP\observers\events\UserRegisteredContext;
+use PKP\observers\events\UserRegisteredSite;
+use PKP\security\AccessKeyManager;
+use PKP\security\Validation;
+use PKP\user\form\RegistrationForm;
+use Symfony\Component\Mailer\Exception\TransportException;
+
+class RegistrationHandler extends UserHandler
+{
+    /**
+     * Display registration form for new users, validate and execute that form,
+     * or display a registration success page if the user is logged in.
+     *
+     * @param array $args
+     * @param PKPRequest $request
+     */
+    public function register($args, $request)
+    {
+        if (Config::getVar('security', 'force_login_ssl') && $request->getProtocol() != 'https') {
+            // Force SSL connections for registration
+            $request->redirectSSL();
+        }
+
+        // If the user is logged in, show them the registration success page
+        if (Validation::isLoggedIn()) {
+            $this->setupTemplate($request);
+            $templateMgr = TemplateManager::getManager($request);
+            $templateMgr->assign('pageTitle', 'user.login.registrationComplete');
+            return $templateMgr->display('frontend/pages/userRegisterComplete.tpl');
+        }
+
+        $this->validate(null, $request);
+        $this->setupTemplate($request);
+
+        $regForm = new RegistrationForm($request->getSite());
+
+        // Initial GET request to register page
+        if (!$request->isPost()) {
+            $regForm->initData();
+            return $regForm->display($request);
+        }
+
+        // Form submitted
+        $regForm->readInputData();
+        if (!$regForm->validate()) {
+            return $regForm->display($request);
+        }
+
+        $userId = $regForm->execute();
+
+        $user = Repo::user()->get($userId, true);
+
+        try {
+            if ($context = $request->getContext()) {
+                event(new UserRegisteredContext($user, $context));
+            } else {
+                event(new UserRegisteredSite($user, $request->getSite()));
+            }
+        } catch (TransportException $e) {
+            $notificationMgr = new PKPNotificationManager();
+            $notificationMgr->createTrivialNotification(
+                $userId,
+                PKPNotification::NOTIFICATION_TYPE_ERROR,
+                ['contents' => __('email.compose.error')]
+            );
+            trigger_error($e->getMessage(), E_USER_WARNING);
+        }
+
+        // Inform the user of the email validation process. This must be run
+        // before the disabled account check to ensure new users don't see the
+        // disabled account message.
+        if (Config::getVar('email', 'require_validation')) {
+            $this->setupTemplate($request);
+            $templateMgr = TemplateManager::getManager($request);
+            $templateMgr->assign([
+                'requireValidation' => true,
+                'pageTitle' => 'user.login.registrationPendingValidation',
+                'messageTranslated' => __('user.login.accountNotValidated', ['email' => $regForm->getData('email')]),
+            ]);
+            return $templateMgr->display('frontend/pages/message.tpl');
+        }
+
+        $reason = null;
+        Validation::login($regForm->getData('username'), $regForm->getData('password'), $reason);
+
+        if ($reason !== null) {
+            $this->setupTemplate($request);
+            $templateMgr = TemplateManager::getManager($request);
+            $templateMgr->assign([
+                'pageTitle' => 'user.login',
+                'errorMsg' => $reason == '' ? 'user.login.accountDisabled' : 'user.login.accountDisabledWithReason',
+                'errorParams' => ['reason' => $reason],
+                'backLink' => $request->url(null, 'login'),
+                'backLinkLabel' => 'user.login',
+            ]);
+            return $templateMgr->display('frontend/pages/error.tpl');
+        }
+
+        $source = $request->getUserVar('source');
+        if (preg_match('#^/\w#', $source) === 1) {
+            return $request->redirectUrl($source);
+        } else {
+            // Make a new request to update cookie details after login
+            $request->redirect(null, 'user', 'register');
+        }
+    }
+
+    /**
+     * Re-route request to the register method.
+     * Backwards-compatible with third-party themes that submit the registration
+     * form to the registerUser method.
+     *
+     * @see RegistrationHandler::register
+     */
+    public function registerUser($args, $request)
+    {
+        $this->register($args, $request);
+    }
+
+    /**
+     * Check credentials and activate a new user
+     *
+     * @param array $args
+     * @param PKPRequest $request
+     */
+    public function activateUser($args, $request)
+    {
+        $username = array_shift($args);
+        $accessKeyCode = array_shift($args);
+        $user = Repo::user()->getByUsername($username, true);
+        if (!$user) {
+            $request->redirect(null, 'login');
+        }
+
+        // Checks user and token
+        $accessKeyManager = new AccessKeyManager();
+        $accessKeyHash = $accessKeyManager->generateKeyHash($accessKeyCode);
+        $accessKey = $accessKeyManager->validateKey(
+            'RegisterContext',
+            $user->getId(),
+            $accessKeyHash
+        );
+
+        if ($accessKey != null && $user->getDateValidated() === null) {
+            // Activate user
+            $user->setDisabled(false);
+            $user->setDisabledReason('');
+            $user->setDateValidated(Core::getCurrentDate());
+            Repo::user()->edit($user);
+
+            $templateMgr = TemplateManager::getManager($request);
+            $templateMgr->assign('message', 'user.login.activated');
+            return $templateMgr->display('frontend/pages/message.tpl');
+        }
+        $request->redirect(null, 'login');
+    }
+
+    /**
+     * @copydoc PKPHandler::validate
+     *
+     * @param null|mixed $requiredContexts
+     * @param null|mixed $request
+     */
+    public function validate($requiredContexts = null, $request = null)
+    {
+        $context = $request->getContext();
+        $disableUserReg = false;
+        if (!$context) {
+            $contextDao = Application::getContextDAO();
+            $contexts = $contextDao->getAll(true)->toArray();
+            $contextsForRegistration = [];
+            foreach ($contexts as $context) {
+                if (!$context->getData('disableUserReg')) {
+                    $contextsForRegistration[] = $context;
+                }
+            }
+            if (empty($contextsForRegistration)) {
+                $disableUserReg = true;
+            }
+        } elseif ($context->getData('disableUserReg')) {
+            $disableUserReg = true;
+        }
+
+        if ($disableUserReg) {
+            $this->setupTemplate($request);
+            $templateMgr = TemplateManager::getManager($request);
+            $templateMgr->assign([
+                'pageTitle' => 'user.register',
+                'errorMsg' => 'user.register.registrationDisabled',
+                'backLink' => $request->url(null, 'login'),
+                'backLinkLabel' => 'user.login',
+            ]);
+            $templateMgr->display('frontend/pages/error.tpl');
+            exit;
+        }
+    }
+}

lib/pkp/pages/user/index.php

@@ -0,0 +1,35 @@
+<?php
+
+/**
+ * @defgroup pages_user User Pages
+ */
+
+/**
+ * @file lib/pkp/pages/user/index.php
+ *
+ * Copyright (c) 2014-2021 Simon Fraser University
+ * Copyright (c) 2003-2021 John Willinsky
+ * Distributed under the GNU GPL v3. For full terms see the file docs/COPYING.
+ *
+ * @ingroup pages_user
+ *
+ * @brief Handle requests for user functions.
+ *
+ */
+
+switch ($op) {
+    //
+    // Profiles
+    //
+    case 'profile':
+        define('HANDLER_CLASS', 'PKP\pages\user\ProfileHandler');
+        break;
+    //
+        // Registration
+    //
+    case 'register':
+    case 'registerUser':
+    case 'activateUser':
+        define('HANDLER_CLASS', 'PKP\pages\user\RegistrationHandler');
+        break;
+}