--- loncom/interface/lonpreferences.pm 2006/06/26 18:56:50 1.93 +++ loncom/interface/lonpreferences.pm 2006/12/06 22:22:37 1.95 @@ -1,7 +1,7 @@ # The LearningOnline Network # Preferences # -# $Id: lonpreferences.pm,v 1.93 2006/06/26 18:56:50 albertel Exp $ +# $Id: lonpreferences.pm,v 1.95 2006/12/06 22:22:37 albertel Exp $ # # Copyright Michigan State University Board of Trustees # @@ -42,6 +42,7 @@ use Apache::loncommon(); use Apache::lonhtmlcommon(); use Apache::lonlocal; use Apache::lonnet; +use LONCAPA(); # # Write lonnet::passwd to do the call below. @@ -553,8 +554,8 @@ sub verify_and_change_msgforward { my $message=''; foreach (split(/\,/,$env{'form.msgforward'})) { my ($msuser,$msdomain)=split(/[\@\:]/,$_); - $msuser=~s/\W//g; - $msdomain=~s/\W//g; + $msuser = &LONCAPA::clean_username($msuser); + $msdomain = &LONCAPA::clean_domain($msdomain); if (($msuser) && ($msdomain)) { if (&Apache::lonnet::homeserver($msuser,$msdomain) ne 'no_host') { $newscreen.=$msuser.':'.$msdomain.','; @@ -718,14 +719,41 @@ ENDVCCOL # password handler subroutines # ###################################################### sub passwordchanger { + my ($r,$errormessage,$caller,$mailtoken) = @_; # This function is a bit of a mess.... # Passwords are encrypted using londes.js (DES encryption) - my $r = shift; - my $errormessage = shift; $errormessage = ($errormessage || ''); - my $user = $env{'user.name'}; - my $domain = $env{'user.domain'}; - my $homeserver = $env{'user.home'}; + my ($user,$domain,$currentpass,$defdom); + if ((!defined($caller)) || ($caller eq 'preferences')) { + $user = $env{'user.name'}; + $domain = $env{'user.domain'}; + if (!defined($caller)) { + $caller = 'preferences'; + } + } elsif ($caller eq 'reset_by_email') { + $defdom = $r->dir_config('lonDefDomain'); + my %data = &Apache::lonnet::tmpget($mailtoken); + if (keys(%data) == 0) { + $r->print(&mt('Sorry, the URL you provided to complete the reset of your password was invalid. Either the token included in the URL has been deleted or the URL you provided was invalid. Please submit a new request for a password reset, and follow the link to the new URL included in the e-mail that will be sent to you, to allow you to enter a new password.')); + return; + } + if (defined($data{time})) { + if (time - $data{'time'} < 7200) { + $user = $data{'username'}; + $domain = $data{'domain'}; + $currentpass = $data{'temppasswd'}; + } else { + $r->print(&mt('Sorry, the token generated when you requested a password reset has expired.').'
'); + return; + } + } else { + $r->print(&mt('Sorry, the URL generated when you requested reset of your password contained incomplete information.').'
'); + return; + } + } else { + $r->print(&mt('Page requested in unexpected context').'
'); + return; + } my $currentauth=&Apache::lonnet::queryauthenticate($user,$domain); # Check for authentication types that allow changing of the password. return if ($currentauth !~ /^(unix|internal):/); @@ -742,12 +770,13 @@ sub passwordchanger { .$ukey_npass2 . $lkey_npass2, $lonhost); # Hexify the keys for output as javascript variables - $ukey_cpass = hex($ukey_cpass); - $lkey_cpass = hex($lkey_cpass); - $ukey_npass1= hex($ukey_npass1); - $lkey_npass1= hex($lkey_npass1); - $ukey_npass2= hex($ukey_npass2); - $lkey_npass2= hex($lkey_npass2); + my %hexkey; + $hexkey{'ukey_cpass'} = hex($ukey_cpass); + $hexkey{'lkey_cpass'} = hex($lkey_cpass); + $hexkey{'ukey_npass1'} = hex($ukey_npass1); + $hexkey{'lkey_npass1'} = hex($lkey_npass1); + $hexkey{'ukey_npass2'} = hex($ukey_npass2); + $hexkey{'lkey_npass2'} = hex($lkey_npass2); # Output javascript to deal with passwords # Output DES javascript { @@ -755,7 +784,25 @@ sub passwordchanger { my $jsh=Apache::File->new($include."/londes.js"); $r->print(<$jsh>); } + $r->print(&jscript_send($caller)); $r->print(< + +ENDFORM + $r->print(&server_form($logtoken,$caller,$mailtoken)); + $r->print(&client_form($caller,\%hexkey,$currentpass,$defdom)); + + # + return; +} + +sub jscript_send { + my ($caller) = @_; + my $output = qq| -$errormessage - -

- - -

- - - - - -
+|; +} +sub client_form { + my ($caller,$hexkey,$currentpass,$defdom) = @_; + my $output = qq|
+|; + if ($caller eq 'reset_by_email') { + $output .= qq| + + + + + + + +'; + } else { + $output .= qq| +|; + } + $output .= <<"ENDFORM"; @@ -808,27 +876,83 @@ $errormessage
E-mail address:
Username: + + +
Domain: +|; + $output .= &Apache::loncommon::select_dom_form($defdom,'udom').' +
Current password:
New password:
Confirm password:
- - - - - - + + + + + +

ENDFORM - # - return; + return $output; +} + +sub server_form { + my ($logtoken,$caller,$mailtoken) = @_; + my $action = '/adm/preferences'; + if ($caller eq 'reset_by_email') { + $action = '/adm/resetpw'; + } + my $output = qq| +
+ + + + + |; + if ($caller eq 'reset_by_email') { + $output .= qq| + + + + +|; + } + $output .= qq| + +
+|; + return $output; } sub verify_and_change_password { - my $r = shift; - my $user = $env{'user.name'}; - my $domain = $env{'user.domain'}; - my $homeserver = $env{'user.home'}; + my ($r,$caller,$mailtoken) = @_; + my ($user,$domain,$homeserver); + if ($caller eq 'reset_by_email') { + $user = $env{'form.uname'}; + $domain = $env{'form.udom'}; + if ($user ne '' && $domain ne '') { + $homeserver = &Apache::lonnet::homeserver($user,$domain); + if ($homeserver eq 'no_host') { + &passwordchanger($r,"

\nERROR". + "Invalid username and/or domain .\n

", + $caller,$mailtoken); + return 1; + } + } else { + &passwordchanger($r,"

\nERROR". + "Username and Domain were blank.\n

", + $caller,$mailtoken); + return 1; + } + } else { + $user = $env{'user.name'}; + $domain = $env{'user.domain'}; + $homeserver = $env{'user.home'}; + } my $currentauth=&Apache::lonnet::queryauthenticate($user,$domain); # Check for authentication types that allow changing of the password. - return if ($currentauth !~ /^(unix|internal):/); + if ($currentauth !~ /^(unix|internal):/) { + if ($caller eq 'reset_by_email') { + &passwordchanger($r,"

\nERROR". + "Authentication type for this user can not be changed by this mechanism..\n

", + $caller,$mailtoken); + return 1; + } else { + return; + } + } # my $currentpass = $env{'form.currentpass'}; my $newpass1 = $env{'form.newpass_1'}; @@ -839,7 +963,7 @@ sub verify_and_change_password { defined($newpass1) && defined($newpass2) ){ &passwordchanger($r,"

\nERROR". - "Password data was blank.\n

"); + "One or more password fields were blank.\n

",$caller,$mailtoken); return; } # Get the keys @@ -847,10 +971,14 @@ sub verify_and_change_password { my $tmpinfo = Apache::lonnet::reply('tmpget:'.$logtoken,$lonhost); if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) { # I do not a have a better idea about how to handle this + my $tryagain_text = &mt('Please log out and try again.'); + if ($caller eq 'reset_by_email') { + $tryagain_text = &mt('Please try again later.'); + } $r->print(< ERROR: Unable to retrieve stored token for -password decryption. Please log out and try again. +password decryption. $tryagain_text

ENDERROR # Probably should log an error here @@ -861,19 +989,29 @@ ENDERROR $currentpass = &des_decrypt($ckey ,$currentpass); $newpass1 = &des_decrypt($n1key,$newpass1); $newpass2 = &des_decrypt($n2key,$newpass2); - # + # + if ($caller eq 'reset_by_email') { + my %data = &Apache::lonnet::tmpget($mailtoken); + if ($currentpass ne $data{'temppasswd'}) { + &passwordchanger($r, + 'ERROR:'. + 'Could not verify current authentication. '. + 'Please try again.',$caller,$mailtoken); + return 1; + } + } if ($newpass1 ne $newpass2) { &passwordchanger($r, 'ERROR:'. 'The new passwords you entered do not match. '. - 'Please try again.'); + 'Please try again.',$caller,$mailtoken); return 1; } if (length($newpass1) < 7) { &passwordchanger($r, 'ERROR:'. 'Passwords must be a minimum of 7 characters long. '. - 'Please try again.'); + 'Please try again.',$caller,$mailtoken); return 1; } # @@ -884,7 +1022,7 @@ ENDERROR } if ($badpassword) { # I can't figure out how to enter bad characters on my browser. - &passwordchanger($r,<ERROR: The password you entered contained illegal characters.
Valid characters are: space and
@@ -893,20 +1031,22 @@ Valid characters are: space and
ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_\`abcdefghijklmnopqrstuvwxyz{|}~ ENDERROR + &passwordchanger($r,$errormessage,$caller,$mailtoken); + return 1; } # # Change the password (finally) my $result = &Apache::lonnet::changepass - ($user,$domain,$currentpass,$newpass1,$homeserver); + ($user,$domain,$currentpass,$newpass1,$homeserver,$caller); # Inform the user the password has (not?) been changed if ($result =~ /^ok$/) { $r->print(<<"ENDTEXT"); -

The password for $user was successfully changed

+

The password for $user was successfully changed

ENDTEXT } else { # error error: run in circles, scream and shout $r->print(<The password for $user was not changed +

The password for $user was not changed

Please make sure your old password was entered correctly. ENDERROR return 1;