diff --git a/mozilla/webtools/addons/public/htdocs/addcomment.php b/mozilla/webtools/addons/public/htdocs/addcomment.php index 991703ec7d1..6f2a7228f4b 100644 --- a/mozilla/webtools/addons/public/htdocs/addcomment.php +++ b/mozilla/webtools/addons/public/htdocs/addcomment.php @@ -2,6 +2,91 @@ /** * Add a comment to any Addon. * - * @todo require session authentication. + * @package amo + * @subpackage docs + * + * Variables: + * $_GET['id'] = Addon ID (integer) */ + +startProcessing('addcomment.tpl', null, null, 'nonav'); +require_once 'includes.php'; + +session_start(); + +if ((!array_key_exists('id', $_GET)) || !is_numeric($_GET['id'])) { + triggerError('There was an error processing your request.'); +} + +//This is a secure page, so we'll check the session +if (!$_auth->validSession()) { + //id is already verified to be numeric from above + header('Location: '.WEB_PATH."/login.php?dest=comment&id={$_GET['id']}"); + exit; +} + +// If there are errors, this will be populated +$_errors = array(); + +// They're posting a comment +if (isset($_POST['c_submit'])) { + + if (! (array_key_exists('c_rating', $_POST) + && array_key_exists('c_title', $_POST) + && array_key_exists('c_comments', $_POST))) { + //This should never happen, but hey... + triggerError('There was an error processing your request.'); + } + + + $_c_rating = mysql_real_escape_string($_POST['c_rating']); + $_c_title = mysql_real_escape_string($_POST['c_title']); + $_c_comments = mysql_real_escape_string($_POST['c_comments']); + + // This is used in the template. If 'true' is returned, an error will be + // printed in the template (using booleans instead of strings here keeps the + // error messages in the template). + $_errors['c_rating'] = !is_numeric($_c_rating); + $_errors['c_title'] = empty($_c_title); + $_errors['c_comments'] = empty($_c_comments); + + foreach ($_errors as $error) { + if ($error !== false) { + $_bad_input = true; + } else { + $_bad_input = false; + } + } + + // If bad_input is true, we'll skip the rest of the processing and dump them + // back out to the from with an error. + if ($_bad_input === false) { + + // @todo this + // Put it in the database + // Drop significant stuff in the session + // header() them to somewhere else + } +} + +$addon = new AddOn($_GET['id']); + +// Put values back into the form - something went wrong (or they haven't hit 'submit' yet). +$c_rating_value = array_key_exists('c_rating', $_POST) ? $_POST['c_rating'] : ''; +$c_title_value = array_key_exists('c_title', $_POST) ? $_POST['c_title'] : ''; +$c_comments_value = array_key_exists('c_comments', $_POST) ? $_POST['c_comments'] : ''; + +// Assign template variables. +$tpl->assign( + array( 'title' => 'Add Comment', + 'currentTab' => null, + 'rate_select_value' => array('','5','4','3','2','1','0'), + 'rate_select_name' => array('Rating:','5 stars', '4 stars', '3 stars', '2 stars', '1 star', '0 stars'), + 'addon' => $addon, + 'c_errors' => $_errors, + 'c_rating_value' => $c_rating_value, + 'c_title_value' => $c_title_value, + 'c_comments_value' => $c_comments_value + ) +); ?> diff --git a/mozilla/webtools/addons/public/htdocs/login.php b/mozilla/webtools/addons/public/htdocs/login.php new file mode 100644 index 00000000000..9e98d7851ea --- /dev/null +++ b/mozilla/webtools/addons/public/htdocs/login.php @@ -0,0 +1,54 @@ + WEB_PATH.'/addcomment.php'); + +if (!empty($_POST['username']) && !empty($_POST['password'])) { + if ($_auth->authenticate($_POST['username'], $_POST['password'])) { + session_start(); + $_auth->createSession(); + + if (array_key_exists('dest', $_GET) && array_key_exists($_GET['dest'], $valid_destinations)) { + $_next_page = $valid_destinations[$_GET['dest']]; + } else { + triggerError('There was an error processing your request.'); + } + + /* Right now $_GET['id'] is needed for all pages, but potentially you could + * login and not need it, so this should handle all cases. */ + if (array_key_exists('id', $_GET) && is_numeric($_GET['id'])) { + $_addon = "?id={$_GET['id']}"; + } else { + $_addon = ''; + } + + header("Location: {$_next_page}{$_addon}"); + exit; + + } else { + $login_error = true; + } +} + +// Assign template variables. +$tpl->assign( + array( 'title' => 'Firefox Add-ons Login', + 'currentTab' => null, + 'login_error' => $login_error + ) +); +?> diff --git a/mozilla/webtools/addons/public/htdocs/logout.php b/mozilla/webtools/addons/public/htdocs/logout.php new file mode 100644 index 00000000000..ebf2636c290 --- /dev/null +++ b/mozilla/webtools/addons/public/htdocs/logout.php @@ -0,0 +1,23 @@ +assign( + array( 'title' => 'Firefox Add-ons', + 'currentTab' => null + ) +); +?> diff --git a/mozilla/webtools/addons/public/inc/includes.php b/mozilla/webtools/addons/public/inc/includes.php index ef237172b7e..6a67db9f124 100644 --- a/mozilla/webtools/addons/public/inc/includes.php +++ b/mozilla/webtools/addons/public/inc/includes.php @@ -4,6 +4,7 @@ require_once('DB.php'); // PEAR::DB require_once('Auth.php'); // PEAR::Auth require_once(LIB.'/amo.class.php'); require_once(LIB.'/addon.class.php'); +require_once(LIB.'/auth.class.php'); require_once(LIB.'/error.php'); require_once(LIB.'/rdf.class.php'); require_once(LIB.'/rss.class.php'); @@ -38,14 +39,15 @@ class AMO_SQL extends SQL $db = new AMO_SQL(); -if (USE_DB_SESSIONS) -{ - $amo_session_handler = new AMO_Session($db); - session_set_save_handler(array(&$amo_session_handler, '_open'), - array(&$amo_session_handler, '_close'), - array(&$amo_session_handler, '_read'), - array(&$amo_session_handler, '_write'), - array(&$amo_session_handler, '_destroy'), - array(&$amo_session_handler, '_gc')); -} +// Setup the session for the secure pages +$_auth = new AMO_Auth(); +session_set_save_handler( + array(&$_auth, "_openSession"), + array(&$_auth, "_closeSession"), + array(&$_auth, "_readSession"), + array(&$_auth, "_writeSession"), + array(&$_auth, "_destroySession"), + array(&$_auth, "_gcSession") + ); + ?> diff --git a/mozilla/webtools/addons/public/tpl/addcomment.tpl b/mozilla/webtools/addons/public/tpl/addcomment.tpl new file mode 100644 index 00000000000..9f1ba262a69 --- /dev/null +++ b/mozilla/webtools/addons/public/tpl/addcomment.tpl @@ -0,0 +1,35 @@ + +

{$addon->Name|escape} - Firefox Extension

+

{$addon->Name|escape} {$addon->Version|escape}, by {$addon->UserName|escape} released on {$addon->DateUpdated|date_format:"%B %d, %Y"}

+

Your comments about {$addon->Name|escape}

+
+
+ + + {if $c_errors.c_rating} +
+

Please choose a rating.

+
+ {/if} + + + {if $c_errors.c_title} +
+

Please provide a title with your comments.

+
+ {/if} + + + {if $c_errors.c_comments} +
+

Please include some valid comments.

+
+ {/if} + +

All fields are required.

+
+
+ + diff --git a/mozilla/webtools/addons/public/tpl/login.tpl b/mozilla/webtools/addons/public/tpl/login.tpl new file mode 100644 index 00000000000..e9627e14cde --- /dev/null +++ b/mozilla/webtools/addons/public/tpl/login.tpl @@ -0,0 +1,20 @@ + +

Login

+
+ {if $login_error} +
+

You were not successfully logged in. Check your e-mail address and + password and try again.

+
+ {/if} +
+
+ + + + + +
+
+
+ diff --git a/mozilla/webtools/addons/public/tpl/logout.tpl b/mozilla/webtools/addons/public/tpl/logout.tpl new file mode 100644 index 00000000000..102dae53321 --- /dev/null +++ b/mozilla/webtools/addons/public/tpl/logout.tpl @@ -0,0 +1,6 @@ + +

Logout

+
+ Your login information has been forgotten. +
+ diff --git a/mozilla/webtools/addons/shared/lib/auth.class.php b/mozilla/webtools/addons/shared/lib/auth.class.php new file mode 100644 index 00000000000..41cf10e549e --- /dev/null +++ b/mozilla/webtools/addons/shared/lib/auth.class.php @@ -0,0 +1,291 @@ +_expires = get_cfg_var('session.gc_maxlifetime'); + } + + /** + * Dummy function, we don't need it but session_set_save_handler() requires it + * @access private + * @param string path to save files (NOT USED) + * @param string name of file (NOT USED) + * @return bool true + */ + function _openSession($path, $name) + { + return true; + } + + /** + * This function will actually create the row in the database for the function. + * session_start() needs to be called before this function. + * @access private + * @return bool true + */ + function createSession() + { + if (is_null($this->_user_id)) { + // We're storing the userid in this object (it get's put in there when + // the person authenticates. If the field is empty, there isn't really + // any point to starting a session, so we just return. + return false; + } + + // technically, none of these should need escaping, but hey... + $_id = mysql_real_escape_string(session_id()); + $_user_id = mysql_real_escape_string($this->_user_id); + $_expires = mysql_real_escape_string(time() + $this->_expires); + + $_sql = "INSERT INTO `{$this->_session_table}` + ( `sess_id`, + `sess_user_id`, + `sess_expires`, + `sess_data` + ) VALUES ( + '{$_id}', + '{$_user_id}', + '{$_expires}', + '' + )"; + + $this->db->query($_sql); + return true; + } + + /** + * Dummy function, we don't need it but session_set_save_handler() requires it + * @access private + * @return bool true + */ + function _closeSession() + { + return true; + } + + /** + * Pulls data from the session (database in our case) + * @access private + * @param string session id + * @return string with data from session, or empty on empty session or failure + */ + function _readSession($id) + { + $_id = mysql_real_escape_string($id); + + $_sql = "SELECT + `sess_data` + FROM + `{$this->_session_table}` + WHERE + `sess_id`={$_id} + AND + `sess_expires` > CURRENT_TIMESTAMP()"; + + $this->db->query($_sql, SQL_INIT, SQL_ASSOC); + + if (!empty($this->db->record)){ + return $this->db->record; + } else { + return ''; + } + } + + /** + * Push data into the session (into the database) + * @access private + * @param string session id + * @param string data to store + * @return bool true on success, false on failure + */ + function _writeSession($id, $data) + { + if (is_null($this->_user_id)) { + // We're storing the userid in this object (it get's put in there when + // the person authenticates. If the field is empty, there isn't really + // any point to starting a session, so we just return. + return false; + } + // An extra check, otherwise session_start() would start valid sessions + if ($this->validSession()){ + $_id = mysql_real_escape_string($id); + $_user_id = mysql_real_escape_string($this->_user_id); + $_data = mysql_real_escape_string($data); + $_expires = mysql_real_escape_string(time() + $this->_expires); + + $_sql = "REPLACE INTO + `{$this->_session_table}` + ( `sess_id`, + `sess_user_id`, + `sess_expires`, + `sess_data` + ) VALUES ( + '{$_id}', + '{$_user_id}, + '{$_expires}', + '{$_data}' + )"; + + $this->db->query($_sql, SQL_INIT, SQL_ASSOC); + return true; + } + return false; + } + + /** + * Checks if the current session is valid or not. session_start() needs to be + * called before this. + * @access public + * @return bool true if valid, false if not + */ + function validSession() + { + $_session_id = mysql_real_escape_string(session_id()); + + $_sql = "SELECT + `sess_id` + FROM + `{$this->_session_table}` + WHERE + `sess_id` = '{$_session_id}' + LIMIT 1"; + + $this->db->query($_sql, SQL_INIT, SQL_ASSOC); + + if (!empty($this->db->record)){ + return true; + } else { + return false; + } + } + + /** + * Checks if the user should be able to start a session with us (looks them up + * in the user table) + * @access public + * @param string $username + * @param string $password + * @return bool true on success, false on failure + */ + function authenticate($username,$password) + { + if (empty($username)||empty($password)) { + return false; + } + $_username = trim(mysql_real_escape_string($username)); + $_password = trim(mysql_real_escape_string($password)); + $_sql = "SELECT + `UserID` + FROM + `{$this->_user_table}` + WHERE + `UserEmail`='{$_username}' + AND + `UserPass`=MD5('{$_password}') + AND + `UserMode` != 'D' + LIMIT 1"; + + $this->db->query($_sql, SQL_INIT, SQL_ASSOC); + + if (!empty($this->db->record)) { + $_record = $this->db->record; + $this->_user_id = $_record['UserID']; + return true; + } else { + return false; + } + } + + /** + * Destroys the current session + * @access private + * @param string session id + * @return bool true + */ + function _destroySession($id) + { + $_id = mysql_real_escape_string($id); + + $_sql = "DELETE FROM + `{$this->_session_table}` + WHERE + `sess_id` ='{$_id}'"; + + $this->db->query($_sql); + + $this->_user_id = null; + $_COOKIE = array(); + $_SESSION = array(); + + setcookie(session_name(), '', time()-42000, '/'); + + return true; + } + + /** + * Clean out stale sessions + * @access private + * @return bool true + */ + function _gcSession() + { + $_sql = "DELETE FROM + `{$this->_session_table}` + WHERE + `sess_expires` < CURRENT_TIMESTAMP()"; + + $this->db->query($_sql); + return true; + } +} +?>