webthink/requestTarget.php

<?php
error_reporting(0);
#error_reporting('E_ALL');

session_start();
header('Content-type: text/xml');

include("config.php");

$db=$GLOBALS['conf_dbname'];
$basePath=$GLOBALS['conf_basePath'];
$mapPath=$GLOBALS['conf_mapPath'];


function myMail($to,$subject,$message){
	$fromAddr=$GLOBALS['conf_mailAddress'];
	$headers = 'From: <' . $fromAddr . ">\r\n" .
    'Reply-To: <' . $fromAddr . ">\r\n" .
    'X-Mailer: PHP/' . phpversion() . "\r\n\r\n";
	mail($to,$subject,$message,$headers);
}

function getRequest(){
        $putdata=fopen("php://input", "rb");
	$myData="";
        while(!feof($putdata)){
                $myData=$myData. fread($putdata, 4096);
        }
        fclose($putdata);
        return($myData);
}

function writeToFile($filename,$text){
	// create directory if not already present
	$cmd="mkdir -p \"$(dirname \"" . $filename . "\")\"";
	system($cmd);

	$fp=fopen($filename,'w') or die ("Can't open file _" . $filename . "_" );
	fwrite($fp,$text);
	fclose($fp);
}

function readFromFile($filename){
	$fp=fopen($filename,'r') or die("Can't open file");
	$text = fread($fp, filesize($filename));
	fclose($fp);
	return($text);
}
function isFileOwner($dh,$filePKey,$userPKey){
	$query="Select count(*) \"count\",max(pkey) from fileUserRel where filePKey=" . $dh->quote($filePKey) . " and userPKey=" . $dh->quote($userPKey) ;
	$result=$dh->query($query) ;
	$row=$result->fetch();
	if ($row['count']==1) {
		return(true);
	} else {
		return(false);
	}
}
function deleteFile($dh,$mapPath,$fileInfo){
	if (isFileOwner($dh,$fileInfo["PKey"],$_SESSION['UserPKey'])) {
		//$query="delete from file where pkey = " . $fileInfo["PKey"] . "";
		$query="update file set deleteDate=datetime('now') where pkey = " . $dh->quote($fileInfo["PKey"]) ;
		$dh->exec($query) ;
		//unlink($mapPath . "/" . $fileInfo['Name']);
	}
        return("<x success='true' />");
}
function getNewPKey($dh){
//	$dh->beginTransaction();
	$query="Select nextFree from pkey";
	$result=$dh->query($query) ;
	$row=$result->fetch();
	$newPKey=$row['nextFree'];

	$query="update pkey set nextFree=nextFree+1";
	$dh->exec($query) ;
//	$dh->commit();
	return($newPKey);
}


function getUserInfo($dh){
	$xmlDoc= new DomDocument();
	$rootNode=$xmlDoc->createElement("response");
	$xmlDoc->appendChild($rootNode);

	$query="Select name,mail from user where pkey=" . $dh->quote($_SESSION['UserPKey']);
	writeToFile("/tmp/rrr",$query);
	$result=$dh->query($query) ;
	$row=$result->fetch();
	if (!$row) {
		$success="false";
		$rootNode->setAttribute("name","Unknown");
		$rootNode->setAttribute("mail","Unknown");
		$error="UserNotFoundError";
	} else {
		$success="true";
		$rootNode->setAttribute("name",$row['name']);
		$rootNode->setAttribute("mail",$row['mail']);
		$dh->exec($query) ;
	}

	$rootNode->setAttribute("success",$success);
	if ($success=="false") {
		$rootNode->setAttribute("error",$error);
	}
	return($xmlDoc);

}

// Inserts new files into the DB, updates the description.
// returns the filename.
// filePKey must be null for new records
function getFileNameAndPKey($dh,$filePKey,$description){
	if ($filePKey=="null") {
		$isNew=true;
		$filePKey=getNewPKey($dh);
		$fileName=$_SESSION["UserPKey"] . "/" . $filePKey; // TODO - should include the user
		$query="insert into file (pkey,filename,description) values (" . $dh->quote($filePKey) . "," . $dh->quote($fileName) . "," . $dh->quote($description) . ")";
		$dh->exec($query) ;
		$query="insert into fileUserRel (pkey,filePKey,userPKey,isOwner) values (" . $dh->quote(getNewPKey($dh)) . "," . $dh->quote($filePKey) . "," . $dh->quote($_SESSION['UserPKey']) . ",1)";
		$dh->exec($query) ;
	} else {
		$isNew=false;
		$query="Select file.filename \"fileName\", file.description \"fileDescription\" from file,fileUserRel where file.pkey=" . $dh->quote($filePKey) . " and fileUserRel.filePKey=file.pkey and fileUserRel.userPKey=" . $dh->quote($_SESSION['UserPKey']) ;
		$result=$dh->query($query) ;
		$row=$result->fetch();
		$fileName=$row['fileName'];
		$currDescription=$row['fileDescription'];
		if (($description!=null) and ($currDescription != $description)) {
			$query="update file set description=" . $dh->quote($description) . " where pkey=" . $dh->quote($filePKey) ; 
			$dh->exec($query) ;
		}
	}
	$ret=array("Name"=>$fileName,
		   "PKey"=>$filePKey,
		   "isNew"=>$isNew);
	return($ret);
}
function getIconList($dh){
		$xmlDoc= new DomDocument();
		$rootNode=$xmlDoc->createElement("icons");
		$rootNode->setAttribute("success","true");
		$xmlDoc->appendChild($rootNode);

		$query="Select icon.pkey \"iconPKey\", icon.filename \"filename\" ,icon.description \"description\" from icon order by sort";
		$result=$dh->query($query) ;
		while ($row=$result->fetch()) {
			$recordNode=$xmlDoc->createElement("icon");
			$recordNode->setAttribute("pkey",$row['iconPKey']);
			$recordNode->setAttribute("filename",$row['filename']);
			$recordNode->setAttribute("description",$row['description']);
			$rootNode->appendChild($recordNode);
		}
		return($xmlDoc);
}
function listFiles($dh){
		$xmlDoc= new DomDocument();
		$rootNode=$xmlDoc->createElement("div");
		$rootNode->setAttribute("class","fileList");
		$rootNode->setAttribute("success","true");
		$xmlDoc->appendChild($rootNode);

		$query="Select file.pkey \"filePKey\", file.description \"fileDescription\" from file,fileUserRel where file.pkey=fileUserRel.filePKey and fileUserRel.userPKey=" . $dh->quote($_SESSION['UserPKey']) . " and file.deleteDate is null order by description";
		$result=$dh->query($query) ;
		while ($row=$result->fetch()) {
			$fileNode=$xmlDoc->createElement("div");
			$fileNode->setAttribute("class","singleFile");
			$fileNode->setAttribute("pkey",$row['filePKey']);
			$fileNode->appendChild($xmlDoc->createTextNode($row['fileDescription']));
			$rootNode->appendChild($fileNode);
		}
		return($xmlDoc);
}
function confirmOptin($dh,$token){
	$xmlDoc= new DomDocument();
	$rootNode=$xmlDoc->createElement("response");
	$xmlDoc->appendChild($rootNode);

	$query="Select count(*) \"count\",max(pkey) \"userOptinPKey\"  from userOptin where confirmed != '1' and token=" . $dh->quote($token);
	$result=$dh->query($query) ;
	$row=$result->fetch();
	if ($row['count']!=1) {
		$success="false";
		$error="TokenNotFoundError";
	} else {
		$success="true";
		$query="update userOptin set confirmed='1' where pkey ='" . $row['userOptinPKey'] . "'";
		$dh->exec($query) ;
	}

	$rootNode->setAttribute("success",$success);
	if ($success=="false") {
		$rootNode->setAttribute("error",$error);
	}
	return($xmlDoc);
}
function checkMailAddress($mail){
	if ((strlen($mail) < 6) || (false === strpos($mail,"@"))) {
		return("Invalid E-Mail Address!");
	}

	$result="";	
	try { 
		$fp=popen($GLOBALS['conf_basePath'] . "checkMail.sh " . $mail,"r");
		while (!feof($fp)) {
			$result=$result . fgets($fp, 4096);
		}
		pclose($fp);
	} catch (Exception $e) {
		$result="Can't execute check-script.";
	}
	return($result);
}
function optinUser($dh,$mail,$password){
	$xmlDoc= new DomDocument();
	$rootNode=$xmlDoc->createElement("response");
	$xmlDoc->appendChild($rootNode);

	$mailCheckErr=checkMailAddress($mail);
	if ("" != $mailCheckErr) {
		$rootNode->setAttribute("success","false");
		$rootNode->setAttribute("error","MailAddressNotValidError");
		$rootNode->setAttribute("description",$mailCheckErr);

		return($xmlDoc);
	}

	$query="Select count(*) \"count\",max(pkey) \"userPKey\" from user where mail=" . $dh->quote($mail);
	$result=$dh->query($query) ;
	$row=$result->fetch();
	if ($row['count']!=0) {
		$rootNode->setAttribute("success","false");
		$rootNode->setAttribute("error","MailAlreadyRegisteredValidation");
	} else {
		$rootNode->setAttribute("success","true");
		$userPKey=getNewPKey($dh);
		$query="Insert into user (pkey,name,mail,password) values (" . $dh->quote($userPKey) . "," . $dh->quote($mail) . "," . $dh->quote($mail) . "," . $dh->quote($password) . ")";
		$dh->exec($query) ;
		$token=getToken();
		$query="Insert into userOptin (pkey, userPKey, pendingSince, ip, confirmed, token) values (" . $dh->quote(getNewPKey($dh)) . "," . $dh->quote($userPKey) . ",datetime('now')," . $dh->quote($_SERVER["REMOTE_ADDR"]) . ",'0'," . $dh->quote($token) . ")";
		$dh->exec($query) ;
		myMail($mail, $GLOBALS["conf_appName"] . "Sign up Confirmation","Thanks for signing up!\nplease follow this link to confirm your mail-address:\n<" . $GLOBALS["conf_appURL"] . "login.php?action=confirmOptin&token=" . $token . ">");
	}
	
	return($xmlDoc);
}
function getToken(){
		$salt=microtime() . "_" . $_SERVER["REMOTE_ADDR"] . "_" . rand(1,32768);
		return(md5($salt));
}
function setupAutoLogin($dh){
		$token=getToken();
		$query="insert into userAutologin (pkey, userPKey, token,setupDate) values (" . $dh->quote(getNewPKey($dh)) . "," . $dh->quote($_SESSION["UserPKey"]) . "," . $dh->quote($token) . ",datetime('now'))";
		$dh->exec($query);
		return($token);
}
function logOutUser($dh,$loginToken){
	$query="delete from userAutoLogin where userPKey=" . $dh->quote($_SESSION['userPKey']) . " and token=" . $dh->quote($loginToken);
	$dh->exec($query) ;
	unset($_SESSION['UserPKey']);
	$xmlDoc= new DomDocument();
	$rootNode=$xmlDoc->createElement("response");
	$rootNode->setAttribute("success","true");
	$xmlDoc->appendChild($rootNode);
		
	return($xmlDoc);
}

function logInUser($dh,$mail,$password,$isSetupAutoLogin,$loginToken){
	if ($loginToken) {
		$query="Select count(*) \"count\",max(user.pkey) \"userPKey\" from user, userOptin, userAutologin where userAutoLogin.userPKey=user.pkey and userAutoLogin.token=" . $dh->quote($loginToken) . " and userOptin.userPKey=user.PKey and userOptin.confirmed='1' and user.mail=" . $dh->quote($mail);
	} else {
		$query="Select count(*) \"count\",max(user.pkey) \"userPKey\" from user, userOptin where userOptin.userPKey=user.PKey and userOptin.confirmed='1' and user.mail=" . $dh->quote($mail) . " and user.password=" . $dh->quote($password);
	}


	$result=$dh->query($query) ;
	try {
		$row=$result->fetch();
	} catch (Exception $ex) {
		echo "EX:" . $ex->getMessage();
	}
	if ($row['count']==1) {
		$success="true";
		$_SESSION['UserPKey']=$row['userPKey'];
		$query="insert into userLogin (pkey, userpkey, loginDate, loginIp) values (" . $dh->quote(getNewPKey($dh)) . "," . $dh->quote($_SESSION["UserPKey"]) . ",datetime('now')," . $dh->quote($_SERVER["REMOTE_ADDR"]) . ")";
		$dh->exec($query) ;
		if ($isSetupAutoLogin) { 
			$autoLoginToken=setupAutoLogin($dh); 
		}
	} else {
		$success="false";
		$errorclass="AppError";
		$_SESSION['UserPKey']=null;
	}

	$xmlDoc= new DomDocument();
	$rootNode=$xmlDoc->createElement("response");
	$rootNode->setAttribute("success",$success);
	$rootNode->setAttribute("autologintoken",$autoLoginToken);
	$rootNode->setAttribute("errorclass",$errorclass);
	$xmlDoc->appendChild($rootNode);
		
	return($xmlDoc);
}
function mailPassword($dh,$mail){
	$xmlDoc= new DomDocument();
	$rootNode=$xmlDoc->createElement("response");
	$xmlDoc->appendChild($rootNode);

	$query="Select count(*) \"count\",max(user.pkey) \"userPKey\",min(userOptin.confirmed) \"optinConfirmed\",min(userOptin.token) \"optinToken\" from user, userOptin where userOptin.userPKey=user.PKey and userOptin.confirmed='1' and user.mail=" . $dh->quote($mail);
	$result=$dh->query($query) ;
	$row=$result->fetch();
	if ($row['count']!=1) {
		$success="false";
		$error="MailAddressNotRegisteredValidation";
	} else {
		$success="true";
		if ($row['optinConfirmed']!="1") {
			$token=$row['optinToken'];
			myMail($mail, $GLOBALS["conf_appName"] . " Password-Request/Sign up Confirmation","During your password request we found that your mail-address was not confirmend yet.\nYou can only sign in if your address is confirmed.\nplease follow this link to confirm your mail-address:\n<" . $GLOBALS["conf_appURL"] . "login.php?action=confirmOptin&token=" . $token . ">");
		} else {
			$token=getToken();
			$query="Insert into userPassReq (pkey, userPKey, token, requestDate) values (" . $dh->quote(getNewPKey($dh)) . ",'" . $row['userPKey'] . "'," . $dh->quote($token) . ",datetime('now'))";
			$dh->exec($query) ;
			myMail($mail, $GLOBALS["conf_appName"] . " Password override request","To override your password please follow this link:\n<" . $GLOBALS["conf_appURL"] . "login.php?action=overridePassword&token=" . $token . ">");
		}
	}

	
	$rootNode->setAttribute("success",$success);
	if ($success=="false") {
		$rootNode->setAttribute("error",$error);
	}
	return($xmlDoc);
}

function setUserPassword($dh,$UserPKey,$newPass){
	$query="update user set password=" . $dh->quote($newPass) . " where mail<>'demo' and pkey = " . $dh->quote($UserPKey);
	$dh->exec($query) ;
}

function updateUserProfile($dh,$mail,$password,$name){
	$xmlDoc= new DomDocument();
	$rootNode=$xmlDoc->createElement("response");
	$xmlDoc->appendChild($rootNode);

	// check the mail-address if it was changed
	if (getUserInfo($dh)->firstChild->getAttribute("mail") != $mail) {
		$mailCheckErr=checkMailAddress($mail);
		if ("" != $mailCheckErr) {
			$rootNode->setAttribute("success","false");
			$rootNode->setAttribute("error","MailAddressNotValidError");
			$rootNode->setAttribute("description",$mailCheckErr);

			return($xmlDoc);
		}
	}
	
	if ($password) {
		setUserPassword($dh,$_SESSION["UserPKey"],$password);
	}
	$query="update user set name=" . $dh->quote($name) . ", mail=" . $dh->quote($mail) . " where mail<>'demo' and pkey = " . $dh->quote($_SESSION["UserPKey"]);
	$dh->exec($query) ;

	$rootNode->setAttribute("success","true");
	return($xmlDoc);
}

function changePassword($dh,$mail,$newPass,$oldPass,$token){
	$xmlDoc= new DomDocument();
	$rootNode=$xmlDoc->createElement("response");
	$xmlDoc->appendChild($rootNode);

	if (strlen($mail)>1) { // change password with mail and old password
		$query="select count(*) \"count\", max(user.pkey) \"userPKey\" from user,userOptin where user.pkey=userOptin.userPKey and userOptin.confirmed='1' and user.password=" . $dh->quote($oldPass) . " and user.mail=" . $dh->quote($mail);

		$result=$dh->query($query) ;
		$row=$result->fetch();
		if ($row['count']!=1) {
			$success="false";
			$error="MailNotExistentOrPasswordWrongValidation";
		} else {
			setUserPassword($dh,$row['userPKey'],$newPass);
			$success="true";
		}
	} else { // change password via token
		$query="select count(*) \"count\", max(userPassReq.userPKey) \"userPKey\", max(userPassReq.pkey) \"userPassReqPKey\" from userPassReq where token is not null and token=" . $dh->quote($token) ;
		$result=$dh->query($query) ;
		$row=$result->fetch();
		if ($row['count']!=1) {
			$success="false";
			$error="TokenExpiredValidation";
		} else {
			setUserPassword($dh,$row['userPKey'],$newPass);
			$success="true";
			$query="update userPassReq set token=null where pkey = " . $row['userPassReqPKey'] ;
			$result=$dh->query($query) ;
		}
	}
	
	$rootNode->setAttribute("success",$success);
	if ($success=="false") {
		$rootNode->setAttribute("error",$error);
	}
	return($xmlDoc);
}

try {
	$dh=new PDO("sqlite:".$db);

	$reqXML=new DomDocument();
	$reqXML->loadXML(getRequest());
	$theFunction=$reqXML->documentElement->getAttribute("function");

	writeToFile("/tmp/reqtgt.log",$reqXML->saveXML());

	switch ($theFunction) {
	case "SAVEFILE":
		$description=$reqXML->documentElement->getAttribute("description");
		$filePKeyReq=$reqXML->documentElement->getAttribute("filepkey");
		$fileInfo=getFileNameAndPKey($dh,$filePKeyReq,$description);
		if ($fileInfo["isNew"]) { $reqXML->documentElement->setAttribute("filepkey",$fileInfo["PKey"]); }
		writeToFile($mapPath . $fileInfo["Name"],$reqXML->saveXML());
		echo ("<x success='true' filepkey='" . $fileInfo["PKey"] . "'/>");
		break;
	case "OPENFILE":
		$filePKey=$reqXML->documentElement->getAttribute("filepkey");
		$fileInfo=getFileNameAndPKey($dh,$filePKey,null);
		echo(readFromFile($mapPath . $fileInfo["Name"]));
		break;
	case "DELETEFILE":
		$filePKey=$reqXML->documentElement->getAttribute("filepkey");
		$fileInfo=getFileNameAndPKey($dh,$filePKey,null);
		echo(deleteFile($dh,$mapPath ,$fileInfo));
		break;
	case "LISTFILES":
		echo(listFiles($dh)->saveXML());
		break;
	case "LOGIN":
		$mail=$reqXML->documentElement->getAttribute("mail");
		$password=$reqXML->documentElement->getAttribute("password");
		$isSetupAutoLogin=($reqXML->documentElement->getAttribute("isautologin")=="1");
		echo(logInUser($dh,$mail,$password,$isSetupAutoLogin,null)->saveXML());
		break;
	case "LOGOUT":
		$loginToken=$reqXML->documentElement->getAttribute("token");
		echo(logOutUser($dh,$loginToken)->saveXML());
		break;
	case "TOKENLOGIN":
		$mail=$reqXML->documentElement->getAttribute("mail");
		$loginToken=$reqXML->documentElement->getAttribute("token");
		echo(logInUser($dh,$mail,null,false,$loginToken)->saveXML());
		break;
	case "OPTINUSER":
		$mail=$reqXML->documentElement->getAttribute("mail");
		$password=$reqXML->documentElement->getAttribute("password");
		echo(optinUser($dh,$mail,$password)->saveXML());
		break;
	case "MAILPASSWORD":
		$mail=$reqXML->documentElement->getAttribute("mail");
		echo(mailPassword($dh,$mail)->saveXML());
		break;
	case "CONFIRMOPTIN":
		$token=$reqXML->documentElement->getAttribute("token");
		echo(confirmOptin($dh,$token)->saveXML());
		break;
	case "CHANGEPASSWORD":
		$mail=$reqXML->documentElement->getAttribute("mail");
		$newPass=$reqXML->documentElement->getAttribute("newpass");
		$oldPass=$reqXML->documentElement->getAttribute("oldpass");
		$token=$reqXML->documentElement->getAttribute("token");
		echo(changePassword($dh,$mail,$newPass,$oldPass,$token)->saveXML());
		break;
	case "UPDATEUSERPROFILE":
		$mail=$reqXML->documentElement->getAttribute("mail");
		$password=$reqXML->documentElement->getAttribute("password");
		$name=$reqXML->documentElement->getAttribute("name");
		echo(updateUserProfile($dh,$mail,$password,$name)->saveXML());
		break;
	case "GETICONLIST":
		echo(getIconList($dh)->saveXML());
		break;
	case "GETUSERINFO":
		echo(getUserInfo($dh)->saveXML());
		break;
	}
} catch (PDOException $exception) {
	$xmlDoc= new DomDocument();
	$rootNode=$xmlDoc->createElement("response");
	$xmlDoc->appendChild($rootNode);
	$rootNode->setAttribute("success","false");
	$rootNode->setAttribute("error","DB-Error");
	$rootNode->setAttribute("message",$exception->getMessage());
	die($xmlDoc->saveXML());
}

?>