index.cgi
changeset 17 bf0ff90e2cf5
parent 15 164da420a326
child 18 c250bcee5857
equal deleted inserted replaced
15:164da420a326 17:bf0ff90e2cf5
    18 
    18 
    19 sub insert(\%);
    19 sub insert(\%);
    20 sub confirm($$);
    20 sub confirm($$);
    21 sub read_conf($);
    21 sub read_conf($);
    22 
    22 
    23 sub do_invite($);
    23 sub do_invite();
    24 sub do_show($$);
    24 sub page;
       
    25 sub mail;
    25 
    26 
    26 
    27 
    27 delete @ENV{grep /PATH$/ => keys %ENV};
    28 delete @ENV{grep /PATH$/ => keys %ENV};
    28 $ENV{PATH} = "/usr/bin:/usr/sbin:/bin:/sbin";
    29 $ENV{PATH} = "/usr/bin:/usr/sbin:/bin:/sbin";
    29 
    30 
    55     # other problems later
    56     # other problems later
    56     if (basename($ENV{SCRIPT_NAME}) ne basename(url(-path_info => 0, -relative => 1))) {
    57     if (basename($ENV{SCRIPT_NAME}) ne basename(url(-path_info => 0, -relative => 1))) {
    57 	print redirect(basename($ENV{SCRIPT_NAME}));
    58 	print redirect(basename($ENV{SCRIPT_NAME}));
    58     }
    59     }
    59 
    60 
    60     # OK, let's start
       
    61     print header(-charset => "UTF-8");
       
    62     my $tt = Template->new(\%ttconfig);
       
    63 
    61 
    64     # ACCESS
    62     # ACCESS
    65     # Here we generate a link URL (sent via Mail) containing the
    63     # Here we generate a link URL (sent via Mail) containing the
    66     # encrypted current timestamp. Accessing the form is only possible
    64     # encrypted current timestamp. Accessing the form is only possible
    67     # using this link. Note: These links may not be unique!
    65     # using this link. Note: These links may not be unique!
    68     if (!path_info()) {
    66     if (!path_info()) {
    69 	do_invite($tt);
    67 	do_invite();
    70 	exit 0;
    68 	exit 0;
    71     }
    69     }
    72 
    70 
    73     # /show/(…)
    71     # /show/(…)
    74     if (path_info() =~ /^\/?show\/(.*)$/) {
    72     if (path_info() =~ /^\/?show\/(.*)$/) {
    75 	if ($1 ~~ [qw(info)]) {
    73 	if ($1 ~~ [qw(info)]) {
    76 	    do_show($tt, $1);
    74 	    page("$1.tpl");
    77 	    exit 0;
    75 	    exit 0;
    78 	}
    76 	}
    79 	$tt->process("html.denied.tpl");
    77 	page("html.denied.tpl");
    80 	exit 0;
    78 	exit 0;
    81     }
    79     }
    82 
    80 
    83     # /user.<uuid>
    81     # /user.<uuid>
    84     if (path_info() =~ /^\/?user\.(.*)$/) {
    82     if (path_info() =~ /^\/?user\.(.*)$/) {
    85 	my $uuid = $1;
    83 	my $uuid = $1;
    86 	my $confirmed = param("confirm") eq "yes";
    84 
       
    85 	my $confirmed = param("confirm") eq "yes";   
    87 	my %data = confirm($uuid => $confirmed);
    86 	my %data = confirm($uuid => $confirmed);
    88 
    87 
    89 	if ($data{error}) {
    88 	if ($data{error}) {
    90 	    $tt->process("html.denied.tpl");
    89 	    page("html.denied.tpl");
    91 	    exit 0;
    90 	    exit 0;
    92 	}
    91 	}
    93 
    92 
    94 	open(my $sendmail, "|$SENDMAIL") or die "Can't open $SENDMAIL: $!\n";
    93 	mail("mail.confirmed.tpl", {
    95 	$tt->process("mail.confirmed.tpl", {
       
    96 	    to => $data{email},
    94 	    to => $data{email},
    97 	    confirmed => $confirmed,
    95 	    confirmed => $confirmed,
    98 	}, $sendmail)
    96 	});
    99 	or die $tt->error();
    97 
   100 	close($sendmail) or die "sendmail: $!\n";
    98 	page("html.confirmed.tpl", {
   101 
       
   102 
       
   103 	$tt->process("html.confirmed.tpl", {
       
   104 	    confirmed => $confirmed,
    99 	    confirmed => $confirmed,
   105 	    error => delete $data{error},
   100 	    error => delete $data{error},
   106 	    value => \%data}) or die $tt->error();
   101 	    value => \%data});
   107 	exit 0;
   102 	exit 0;
   108     }
   103     }
   109 
   104 
   110     # /tmp.<uuid>
   105     # /tmp.<uuid>
   111     if (path_info() =~ /^\/?tmp\.(.*)$/) {
   106     if (path_info() =~ /^\/?tmp\.(.*)$/) {
   116 	eval {
   111 	eval {
   117 	    my $time = decrypt($_) or die "DECRYPTION ERROR";
   112 	    my $time = decrypt($_) or die "DECRYPTION ERROR";
   118 	    $time =~ /^\d+$/ or die "FORMAT ERROR";
   113 	    $time =~ /^\d+$/ or die "FORMAT ERROR";
   119 	    time() - $time < (60 * $EXPIRATION) or die "EXPIRED";
   114 	    time() - $time < (60 * $EXPIRATION) or die "EXPIRED";
   120 	}; if ($@) {
   115 	}; if ($@) {
   121 	    $tt->process("html.denied.tpl");
   116 	    page("html.denied.tpl");
   122 	    exit 0;
   117 	    exit 0;
   123 	}
   118 	}
   124 
   119 
   125 	my %warn;
   120 	my %warn;
   126 	my %value;
   121 	my %value;
   160 	    }
   155 	    }
   161 
   156 
   162 	    if (!%warn) {
   157 	    if (!%warn) {
   163 		my %r = insert(%value);
   158 		my %r = insert(%value);
   164 
   159 
   165 		open(my $sendmail => "|$SENDMAIL")
   160 		mail("mail.form-ack.tpl", {
   166 		    or die "Can't open $SENDMAIL: $!\n";
       
   167 
       
   168 		$tt->process("mail.form-ack.tpl", {
       
   169 		    to => $value{email},
   161 		    to => $value{email},
   170 		    url => {
   162 		    url => {
   171 			yes => "$SELF/user.$r{uuid}?confirm=yes",
   163 			yes => "$SELF/user.$r{uuid}?confirm=yes",
   172 			no  => "$SELF/user.$r{uuid}?confirm=no",
   164 			no  => "$SELF/user.$r{uuid}?confirm=no",
   173 		    }
   165 		    }
   174 		}, $sendmail)
   166 		});
   175 		or die $tt->error();
   167 
   176 
   168 		page("html.form-ack.tpl", {
   177 		close($sendmail);
       
   178 
       
   179 		$tt->process("html.form-ack.tpl", {
       
   180 		    value => \%value,
   169 		    value => \%value,
   181 		    created => $r{created},
   170 		    created => $r{created},
   182 		    uuid => $r{uuid},
   171 		    uuid => $r{uuid},
   183 		}) or die $tt->error();
   172 		});
   184 		exit 0;
   173 		exit 0;
   185 	    }
   174 	    }
   186 	}
   175 	}
   187 
   176 
   188 	$tt->process("html.form.tpl", {
   177 	page("html.form.tpl", {
   189 	    warn => %warn ? \%warn : undef,
   178 	    warn => %warn ? \%warn : undef,
   190 	    value => {
   179 	    value => {
   191 		givenname => scalar param("givenname"),
   180 		givenname => scalar param("givenname"),
   192 		surname => scalar param("surname"),
   181 		surname => scalar param("surname"),
   193 		email => scalar param("email"),
   182 		email => scalar param("email"),
   194 	    },
   183 	    },
   195 	} ) or die $tt->error();
   184 	} );
   196 	exit 0;
   185 	exit 0;
   197     }
   186     }
   198 
   187 
   199     $tt->process("html.denied.tpl", {
   188     page("html.denied.tpl", {
   200 	    url => $SELF,
   189 	    url => $SELF,
   201     }) or die $tt->error();
   190     });
   202     exit 0;
   191     exit 0;
   203 }
   192 }
   204 
   193 
   205 sub insert(\%) {
   194 sub insert(\%) {
   206     my %value = %{$_[0]};
   195     my %value = %{$_[0]};
   229 }
   218 }
   230 
   219 
   231 sub confirm($$) {
   220 sub confirm($$) {
   232     my ($uuid, $confirmed) = @_;
   221     my ($uuid, $confirmed) = @_;
   233     my %data;
   222     my %data;
       
   223 
   234     $DBH->begin_work;
   224     $DBH->begin_work;
   235 	
   225 	
   236 	local $" = ", ";
   226 	local $" = ", ";
   237 	my $sth = $DBH->prepare("SELECT @{$FIELDS{MAN}}, @{$FIELDS{OPT}}, confirmed FROM db WHERE uuid = ?");
   227 	my $sth = $DBH->prepare("SELECT @{$FIELDS{MAN}}, @{$FIELDS{OPT}}, confirmed FROM db WHERE uuid = ?");
   238 	$sth->execute($uuid);
   228 	$sth->execute($uuid);
   266     /^\s*(.*?)\s*$/s;
   256     /^\s*(.*?)\s*$/s;
   267     return $1;
   257     return $1;
   268 }
   258 }
   269 
   259 
   270 sub do_invite() {
   260 sub do_invite() {
   271 	my ($tt) = @_;
       
   272 	my %warn;
   261 	my %warn;
   273 	my $sent;
   262 	my $sent;
   274 
   263 
   275 	if (param("email")) {
   264 	if (param("email")) {
   276 	    if (not valid param("email")) {
   265 	    if (not valid param("email")) {
   279 	    else {
   268 	    else {
   280 		my $xxx = encrypt(time);
   269 		my $xxx = encrypt(time);
   281 		$xxx =~ s/\+/-/g;
   270 		$xxx =~ s/\+/-/g;
   282 		$xxx =~ s/\//_/g;
   271 		$xxx =~ s/\//_/g;
   283 
   272 
   284 		# send mail
   273 		mail("mail.invitation.tpl", {
   285 		open(my $sendmail => "|$SENDMAIL")
       
   286 		    or die "Can't open sendmail: $!\n";
       
   287 
       
   288 		$tt->process("mail.invitation.tpl", {
       
   289 		    to   => scalar(param("email")),
   274 		    to   => scalar(param("email")),
   290 		    url  => "$SELF/tmp.$xxx"}, $sendmail)
   275 		    url  => "$SELF/tmp.$xxx"});
   291 		or die $tt->error();
       
   292 		close($sendmail)
       
   293 			or die "problem sending mail to "
       
   294 				. param("email");
       
   295 
   276 
   296 		$sent = param("email");
   277 		$sent = param("email");
   297 	    }
   278 	    }
   298 	}
   279 	}
   299 	$tt->process("html.invitation.tpl", {
   280 	page("html.invitation.tpl", {
   300 	    sent => $sent,
   281 	    sent => $sent,
   301 	    warn => %warn ? \%warn : undef,
   282 	    warn => %warn ? \%warn : undef,
   302 	    expires => $EXPIRATION,
   283 	    expires => $EXPIRATION,
   303 	    value => { email => scalar param("email") },
   284 	    value => { email => scalar param("email") },
   304 	});
   285 	});
   305 }
   286 }
   306 
   287 
   307 sub do_show($$) {
   288 
   308     my ($tt, $object) = @_;
   289 sub page {
   309     $tt->process("$object.tpl");
   290     state $tt = Template->new(\%ttconfig);
   310 }
   291     print header(-charset => "UTF-8");
       
   292     $tt->process(@_);
       
   293 }
       
   294 
       
   295 sub mail {
       
   296     state $tt = Template->new(\%ttconfig);
       
   297     open(my $sendmail, "|$SENDMAIL") 
       
   298 	or die "Can't open $SENDMAIL: $!\n";
       
   299     $tt->process(@_, $sendmail)
       
   300     or die $tt->error();
       
   301     close($sendmail) 
       
   302 	or die "SENDMAIL: $!\n";
       
   303 }
       
   304