class.ilPasswordAssistanceGUI.php

Go to the documentation of this file.

<?php

use ILIAS\Refinery\Factory as RefineryFactory;
use ILIAS\HTTP\Services as HTTPServices;

class ilPasswordAssistanceGUI implements ilCtrlSecurityInterface
{
    private const PERMANENT_LINK_TARGET_PW = 'pwassist';
    private const PERMANENT_LINK_TARGET_NAME = 'nameassist';

    protected ilCtrlInterface $ctrl;
    protected ilLanguage $lng;
    protected ilRbacReview $rbacreview;
    protected ilGlobalTemplateInterface $tpl;
    protected ilSetting $settings;
    protected ilErrorHandling $ilErr;
    protected RefineryFactory $refinery;
    protected HTTPServices $http;
    protected ilHelpGUI $help;
    protected ilObjUser $actor;
    private ILIAS\UI\Factory $ui_factory;
    private ILIAS\UI\Renderer $ui_renderer;

    public function __construct()
    {
        global $DIC;

        $this->ctrl = $DIC->ctrl();
        $this->lng = $DIC->language();
        $this->rbacreview = $DIC->rbac()->review();
        $this->tpl = $DIC->ui()->mainTemplate();
        $this->settings = $DIC->settings();
        $this->ilErr = $DIC['ilErr'];
        $this->help = $DIC->help();
        $this->http = $DIC->http();
        $this->actor = $DIC->user();
        $this->refinery = $DIC->refinery();
        $this->ui_factory = $DIC->ui()->factory();
        $this->ui_renderer = $DIC->ui()->renderer();

        $this->help->setScreenIdComponent('init');
    }

    private function retrieveRequestedKey(): string
    {
        $key = $this->http->wrapper()->query()->retrieve(
            'key',
            $this->refinery->byTrying([
                $this->refinery->kindlyTo()->string(),
                $this->refinery->always(
                    $this->http->wrapper()->post()->retrieve(
                        'key',
                        $this->refinery->byTrying([$this->refinery->kindlyTo()->string(), $this->refinery->always('')])
                    )
                )
            ])
        );

        return $key;
    }

    protected function getClientId(): string
    {
        return CLIENT_ID;
    }

    public function executeCommand()
    {
        if (!$this->settings->get('setup_ok')) {
            $this->ilErr->raiseError('Setup is not completed. Please run setup routine again.', $this->ilErr->FATAL);
        }

        if (!$this->settings->get('password_assistance')) {
            $this->ilErr->raiseError($this->lng->txt('permission_denied'), $this->ilErr->MESSAGE);
        }

        if ($this->actor->getId() > 0 && !$this->actor->isAnonymous()) {
            $this->ilErr->raiseError($this->lng->txt('permission_denied'), $this->ilErr->MESSAGE);
        }

        $this->lng->loadLanguageModule('pwassist');
        $cmd = $this->ctrl->getCmd() ?? '';
        $next_class = $this->ctrl->getNextClass($this);

        switch ($next_class) {
            default:
                if ($cmd !== '' && method_exists($this, $cmd)) {
                    $this->$cmd();
                    return;
                }

                if ($this->retrieveRequestedKey() !== '') {
                    $this->showAssignPasswordForm(null, $this->retrieveRequestedKey());
                } else {
                    $this->showAssistanceForm();
                }
                break;
        }
    }

    public function getUnsafeGetCommands(): array
    {
        return [];
    }

    public function getSafePostCommands(): array
    {
        return ['submitAssignPasswordForm'];
    }

    protected function getBaseUrl(): string
    {
        return rtrim(ILIAS_HTTP_PATH, '/');
    }

    protected function buildUrl(string $script, array $queryParameters): string
    {
        $url = implode('/', [
            $this->getBaseUrl(),
            ltrim($script, '/')
        ]);

        $url = \ilUtil::appendUrlParameterString(
            $url,
            http_build_query($queryParameters, null, '&')
        );

        return $url;
    }

    protected function getAssistanceForm(): ilPropertyFormGUI
    {
        $form = new ilPropertyFormGUI();

        $form->setFormAction($this->ctrl->getFormAction($this, 'submitAssistanceForm'));
        $form->setTarget('_parent');

        $username = new ilTextInputGUI($this->lng->txt('username'), 'username');
        $username->setRequired(true);
        $form->addItem($username);

        $email = new ilEMailInputGUI($this->lng->txt('email'), 'email');
        $email->setRequired(true);
        $form->addItem($email);

        $form->addCommandButton('submitAssistanceForm', $this->lng->txt('submit'));
        return $form;
    }

    public function showAssistanceForm(ilPropertyFormGUI $form = null): void
    {
        $this->help->setSubScreenId('password_assistance');

        $tpl = ilStartUpGUI::initStartUpTemplate('tpl.pwassist_assistance.html', true);
        $tpl->setVariable(
            'IMG_PAGEHEADLINE',
            $this->ui_renderer->render($this->ui_factory->symbol()->icon()->custom(
                ilUtil::getImagePath('icon_auth.svg'),
                $this->lng->txt('password_assistance')
            ))
        );
        $tpl->setVariable('TXT_PAGEHEADLINE', $this->lng->txt('password_assistance'));

        $tpl->setVariable(
            'TXT_ENTER_USERNAME_AND_EMAIL',
            str_replace(
                "\\n",
                '<br />',
                sprintf(
                    $this->lng->txt('pwassist_enter_username_and_email'),
                    '<a href="mailto:' . ilLegacyFormElementsUtil::prepareFormOutput(
                        $this->settings->get('admin_email')
                    ) . '">' . ilLegacyFormElementsUtil::prepareFormOutput($this->settings->get('admin_email')) . '</a>'
                )
            )
        );

        if (!$form) {
            $form = $this->getAssistanceForm();
        }
        $tpl->setVariable('FORM', $form->getHTML());
        $this->fillPermanentLink(self::PERMANENT_LINK_TARGET_PW);
        ilStartUpGUI::printToGlobalTemplate($tpl);
    }

    public function submitAssistanceForm(): void
    {
        $form = $this->getAssistanceForm();
        if (!$form->checkInput()) {
            $form->setValuesByPost();
            $this->showAssistanceForm($form);
            return;
        }

        $defaultAuth = ilAuthUtils::AUTH_LOCAL;
        if ($GLOBALS['DIC']['ilSetting']->get('auth_mode')) {
            $defaultAuth = $GLOBALS['DIC']['ilSetting']->get('auth_mode');
        }

        $assistance_callback = function () use ($form, $defaultAuth): void {
            $username = trim($form->getInput('username'));
            $email = trim($form->getInput('email'));

            $usrId = \ilObjUser::getUserIdByLogin($username);
            if (!is_numeric($usrId) || !($usrId > 0)) {
                \ilLoggerFactory::getLogger('usr')->info(
                    sprintf(
                        'Could not process password assistance form (reason: no user found) %s / %s',
                        $username,
                        $email
                    )
                );

                return;
            }

            $user = new \ilObjUser($usrId);
            $emailAddresses = array_map('strtolower', [$user->getEmail(), $user->getSecondEmail()]);

            if (!in_array(strtolower($email), $emailAddresses)) {
                if (0 === strlen(implode('', $emailAddresses))) {
                    \ilLoggerFactory::getLogger('usr')->info(sprintf(
                        'Could not process password assistance form (reason: account without email addresses): %s / %s',
                        $username,
                        $email
                    ));
                } else {
                    \ilLoggerFactory::getLogger('usr')->info(sprintf(
                        'Could not process password assistance form (reason: account email addresses differ from input): %s / %s',
                        $username,
                        $email
                    ));
                }
            } elseif (
                (
                    $user->getAuthMode(true) != ilAuthUtils::AUTH_LOCAL ||
                    ($user->getAuthMode(true) == $defaultAuth && $defaultAuth != ilAuthUtils::AUTH_LOCAL)
                ) && !(
                    (int) $user->getAuthMode(true) === ilAuthUtils::AUTH_SAML &&
                    \ilAuthUtils::isLocalPasswordEnabledForAuthMode($user->getAuthMode(true))
                )
            ) {
                \ilLoggerFactory::getLogger('usr')->info(sprintf(
                    'Could not process password assistance form (reason: not permitted for accounts using external authentication sources): %s / %s',
                    $username,
                    $email
                ));
            } elseif (
                $this->rbacreview->isAssigned($user->getId(), ANONYMOUS_ROLE_ID) ||
                $this->rbacreview->isAssigned($user->getId(), SYSTEM_ROLE_ID)
            ) {
                \ilLoggerFactory::getLogger('usr')->info(sprintf(
                    'Could not process password assistance form (reason: not permitted for system user or anonymous): %s / %s',
                    $username,
                    $email
                ));
            } else {
                $this->sendPasswordAssistanceMail($user);
            }
        };

        if (null !== ($assistance_duration = $this->settings->get("account_assistance_duration"))) {
            $duration = $this->http->durations()->callbackDuration((int) $assistance_duration);
            $status = $duration->stretch($assistance_callback);
        } else {
            $status = $assistance_callback();
        }

        $this->showMessageForm(
            sprintf($this->lng->txt('pwassist_mail_sent'), $form->getInput('email')),
            self::PERMANENT_LINK_TARGET_PW
        );
    }

    public function sendPasswordAssistanceMail(ilObjUser $userObj): void
    {
        global $DIC;

        require_once 'include/inc.pwassist_session_handler.php';

        // Create a new session id
        // #9700 - this didn't do anything before?!
        // db_set_save_handler();
        if (session_status() !== PHP_SESSION_ACTIVE) {
            session_start();
        }
        $pwassist_session['pwassist_id'] = db_pwassist_create_id();
        session_destroy();
        db_pwassist_session_write(
            $pwassist_session['pwassist_id'],
            3600,
            $userObj->getId()
        );

        $pwassist_url = $this->buildUrl(
            'pwassist.php',
            [
                'client_id' => $this->getClientId(),
                'lang' => $this->lng->getLangKey(),
                'key' => $pwassist_session['pwassist_id']
            ]
        );

        $alternative_pwassist_url = $this->buildUrl(
            'pwassist.php',
            [
                'client_id' => $this->getClientId(),
                'lang' => $this->lng->getLangKey(),
                'key' => $pwassist_session['pwassist_id']
            ]
        );

        $senderFactory = $DIC["mail.mime.sender.factory"];
        $sender = $senderFactory->system();

        $mm = new ilMimeMail();
        $mm->Subject($this->lng->txt('pwassist_mail_subject'), true);
        $mm->From($sender);
        $mm->To($userObj->getEmail());
        $mm->Body(
            str_replace(
                array("\\n", "\\t"),
                array("\n", "\t"),
                sprintf(
                    $this->lng->txt('pwassist_mail_body'),
                    $pwassist_url,
                    $this->getBaseUrl() . '/',
                    $_SERVER['REMOTE_ADDR'],
                    $userObj->getLogin(),
                    'mailto:' . $DIC->settings()->get("admin_email"),
                    $alternative_pwassist_url
                )
            )
        );
        $mm->Send();
    }

    protected function getAssignPasswordForm(string $pwassist_id): ilPropertyFormGUI
    {
        $form = new ilPropertyFormGUI();
        $form->setFormAction($this->ctrl->getFormAction($this, 'submitAssignPasswordForm'));
        $form->setTarget('_parent');

        $username = new ilTextInputGUI($this->lng->txt('username'), 'username');
        $username->setRequired(true);
        $form->addItem($username);

        $password = new ilPasswordInputGUI($this->lng->txt('password'), 'password');
        $password->setInfo(ilSecuritySettingsChecker::getPasswordRequirementsInfo());
        $password->setRequired(true);
        $password->setUseStripSlashes(false);
        $form->addItem($password);

        $key = new ilHiddenInputGUI('key');
        $key->setValue($pwassist_id);
        $form->addItem($key);
        $form->addCommandButton('submitAssignPasswordForm', $this->lng->txt('submit'));
        return $form;
    }

    public function showAssignPasswordForm(ilPropertyFormGUI $form = null, string $pwassist_id = ''): void
    {
        $this->help->setSubScreenId('password_input');

        // Retrieve form data
        if (!$pwassist_id) {
            if ($this->http->wrapper()->query()->has('key')) {
                $pwassist_id = $this->http->wrapper()->query()->retrieve(
                    'key',
                    $this->refinery->kindlyTo()->string()
                );
            }
        }

        // Retrieve the session, and check if it is valid
        require_once 'include/inc.pwassist_session_handler.php';
        $pwassist_session = db_pwassist_session_read($pwassist_id);
        if (
            !is_array($pwassist_session) ||
            count($pwassist_session) == 0 ||
            $pwassist_session['expires'] < time()
        ) {
            $this->tpl->setOnScreenMessage('failure', $this->lng->txt('pwassist_session_expired'));
            $this->showAssistanceForm(null);
        } else {
            $tpl = ilStartUpGUI::initStartUpTemplate('tpl.pwassist_assignpassword.html', true);
            $tpl->setVariable(
                'IMG_PAGEHEADLINE',
                $this->ui_renderer->render($this->ui_factory->symbol()->icon()->custom(
                    ilUtil::getImagePath('icon_auth.svg'),
                    $this->lng->txt('password_assistance')
                ))
            );
            $tpl->setVariable('TXT_PAGEHEADLINE', $this->lng->txt('password_assistance'));

            $tpl->setVariable(
                'TXT_ENTER_USERNAME_AND_NEW_PASSWORD',
                $this->lng->txt('pwassist_enter_username_and_new_password')
            );

            if (!$form) {
                $form = $this->getAssignPasswordForm($pwassist_id);
            }
            $tpl->setVariable('FORM', $form->getHTML());
            $this->fillPermanentLink(self::PERMANENT_LINK_TARGET_PW);
            ilStartUpGUI::printToGlobalTemplate($tpl);
        }
    }

    public function submitAssignPasswordForm(): void
    {
        require_once 'include/inc.pwassist_session_handler.php';

        // We need to fetch this before form instantiation
        $pwassist_id = ilUtil::stripSlashes($_POST['key']);

        $form = $this->getAssignPasswordForm($pwassist_id);
        if (!$form->checkInput()) {
            $form->setValuesByPost();
            $this->showAssignPasswordForm($form, $pwassist_id);
            return;
        }

        $username = trim($form->getInput('username'));
        $password = trim($form->getInput('password'));
        $pwassist_id = $form->getInput('key');

        // Retrieve the session
        $pwassist_session = db_pwassist_session_read($pwassist_id);

        if (
            !is_array($pwassist_session) ||
            count($pwassist_session) == 0 ||
            $pwassist_session['expires'] < time()
        ) {
            $this->tpl->setOnScreenMessage('failure', str_replace("\\n", '', $this->lng->txt('pwassist_session_expired')));
            $form->setValuesByPost();
            $this->showAssistanceForm($form);
            return;
        } else {
            $is_successful = true;
            $message = '';

            $userObj = \ilObjectFactory::getInstanceByObjId($pwassist_session['user_id'], false);
            if (!$userObj || !($userObj instanceof \ilObjUser)) {
                $message = $this->lng->txt('user_does_not_exist');
                $is_successful = false;
            }

            // check if the username entered by the user matches the
            // one of the user object.
            if ($is_successful && strcasecmp($userObj->getLogin(), $username) != 0) {
                $message = $this->lng->txt('pwassist_login_not_match');
                $is_successful = false;
            }

            $error_lng_var = '';
            if (!ilSecuritySettingsChecker::isPasswordValidForUserContext($password, $userObj, $error_lng_var)) {
                $message = $this->lng->txt($error_lng_var);
                $is_successful = false;
            }

            // End of validation
            // If the validation was successful, we change the password of the
            // user.
            // ------------------
            if ($is_successful) {
                $is_successful = $userObj->resetPassword($password, $password);
                if (!$is_successful) {
                    $message = $this->lng->txt('passwd_invalid');
                }
            }

            // If we are successful so far, we update the user object.
            // ------------------
            if ($is_successful) {
                $userObj->setLastPasswordChangeToNow();
                $userObj->update();
            }

            // If we are successful, we destroy the password assistance
            // session and redirect to the login page.
            // Else we display the form again along with an error message.
            // ------------------
            if ($is_successful) {
                db_pwassist_session_destroy($pwassist_id);
                $this->showMessageForm(
                    sprintf($this->lng->txt('pwassist_password_assigned'), $username),
                    self::PERMANENT_LINK_TARGET_PW
                );
            } else {
                $this->tpl->setOnScreenMessage('failure', str_replace("\\n", '', $message));
                $form->setValuesByPost();
                $this->showAssignPasswordForm($form, $pwassist_id);
            }
        }
    }

    protected function getUsernameAssistanceForm(): ilPropertyFormGUI
    {
        $form = new ilPropertyFormGUI();

        $form->setFormAction($this->ctrl->getFormAction($this, 'submitUsernameAssistanceForm'));
        $form->setTarget('_parent');

        $email = new ilTextInputGUI($this->lng->txt('email'), 'email');
        $email->setRequired(true);
        $form->addItem($email);

        $form->addCommandButton('submitUsernameAssistanceForm', $this->lng->txt('submit'));
        return $form;
    }

    public function showUsernameAssistanceForm(ilPropertyFormGUI $form = null): void
    {
        $this->help->setSubScreenId('username_assistance');

        $tpl = ilStartUpGUI::initStartUpTemplate('tpl.pwassist_username_assistance.html', true);
        $tpl->setVariable(
            'IMG_PAGEHEADLINE',
            $this->ui_renderer->render($this->ui_factory->symbol()->icon()->custom(
                ilUtil::getImagePath('icon_auth.svg'),
                $this->lng->txt('password_assistance')
            ))
        );
        $tpl->setVariable('TXT_PAGEHEADLINE', $this->lng->txt('password_assistance'));

        $tpl->setVariable(
            'TXT_ENTER_USERNAME_AND_EMAIL',
            str_replace(
                "\\n",
                '<br />',
                sprintf(
                    $this->lng->txt('pwassist_enter_email'),
                    '<a href="mailto:' . ilLegacyFormElementsUtil::prepareFormOutput(
                        $this->settings->get('admin_email')
                    ) . '">' . ilLegacyFormElementsUtil::prepareFormOutput($this->settings->get('admin_email')) . '</a>'
                )
            )
        );

        if (!$form) {
            $form = $this->getUsernameAssistanceForm();
        }
        $tpl->setVariable('FORM', $form->getHTML());
        $this->fillPermanentLink(self::PERMANENT_LINK_TARGET_NAME);
        ilStartUpGUI::printToGlobalTemplate($tpl);
    }

    public function submitUsernameAssistanceForm(): void
    {
        $form = $this->getUsernameAssistanceForm();
        if (!$form->checkInput()) {
            $form->setValuesByPost();
            $this->showUsernameAssistanceForm($form);

            return;
        }

        $assistance_callback = function () use ($form): void {
            $email = trim($form->getInput('email'));
            $logins = ilObjUser::getUserLoginsByEmail($email);

            if (is_array($logins) && count($logins) > 0) {
                $this->sendUsernameAssistanceMail($email, $logins);
            } else {
                \ilLoggerFactory::getLogger('usr')->info(sprintf(
                    'Could not sent username assistance emails to (reason: no user found): %s',
                    $email
                ));
            }
        };

        if (null !== ($assistance_duration = $this->settings->get("account_assistance_duration"))) {
            $duration = $this->http->durations()->callbackDuration((int) $assistance_duration);
            $status = $duration->stretch($assistance_callback);
        } else {
            $status = $assistance_callback();
        }

        $this->showMessageForm($this->lng->txt('pwassist_mail_sent_generic'), self::PERMANENT_LINK_TARGET_NAME);
    }

    public function sendUsernameAssistanceMail(string $email, array $logins): void
    {
        global $DIC;

        require_once 'include/inc.pwassist_session_handler.php';

        $login_url = $this->buildUrl(
            'pwassist.php',
            [
                'client_id' => $this->getClientId(),
                'lang' => $this->lng->getLangKey()
            ]
        );

        $senderFactory = $DIC["mail.mime.sender.factory"];
        $sender = $senderFactory->system();

        $mm = new ilMimeMail();
        $mm->Subject($this->lng->txt('pwassist_mail_subject'), true);
        $mm->From($sender);
        $mm->To($email);
        $mm->Body(
            str_replace(
                array("\\n", "\\t"),
                array("\n", "\t"),
                sprintf(
                    $this->lng->txt('pwassist_username_mail_body'),
                    join(",\n", $logins),
                    $this->getBaseUrl() . '/',
                    $_SERVER['REMOTE_ADDR'],
                    $email,
                    'mailto:' . $this->settings->get("admin_email"),
                    $login_url
                )
            )
        );
        $mm->Send();
    }

    public function showMessageForm(string $text, string $permanent_link_context): void
    {
        $tpl = ilStartUpGUI::initStartUpTemplate('tpl.pwassist_message.html', true);
        $tpl->setVariable('TXT_PAGEHEADLINE', $this->lng->txt('password_assistance'));
        $tpl->setVariable(
            'IMG_PAGEHEADLINE',
            $this->ui_renderer->render($this->ui_factory->symbol()->icon()->custom(
                ilUtil::getImagePath('icon_auth.svg'),
                $this->lng->txt('password_assistance')
            ))
        );

        $tpl->setVariable('TXT_TEXT', str_replace("\\n", '<br />', $text));
        $this->fillPermanentLink($permanent_link_context);
        ilStartUpGUI::printToGlobalTemplate($tpl);
    }

    protected function fillPermanentLink(string $context): void
    {
        $this->tpl->setPermanentLink('usr', null, $context);
    }
}