]> git.wh0rd.org - tt-rss.git/blame - register.php
strip_harmful_tags: remove data- attributes
[tt-rss.git] / register.php
CommitLineData
4f7956b3 1<?php
a53f3dc4 2 // This file uses two additional include files:
4f7956b3 3 //
a53f3dc4
AD
4 // 1) templates/register_notice.txt - displayed above the registration form
5 // 2) register_expire_do.php - contains user expiration queries when necessary
4f7956b3 6
88e8fb3a
AD
7 set_include_path(dirname(__FILE__) ."/include" . PATH_SEPARATOR .
8 get_include_path());
107d0cf3 9
404e2e36 10 require_once "autoload.php";
fb074239 11 require_once "functions.php";
4f7956b3 12 require_once "sessions.php";
4f7956b3 13 require_once "sanity_check.php";
4f7956b3
AD
14 require_once "config.php";
15 require_once "db.php";
4f7956b3 16
67e0cf9a
AD
17 startup_gettext();
18
f9c0fc6e
AD
19 $action = $_REQUEST["action"];
20
6322ac79 21 if (!init_plugins()) return;
4f7956b3 22
870a70e1
AD
23 if ($_REQUEST["format"] == "feed") {
24 header("Content-Type: text/xml");
25
26 print '<?xml version="1.0" encoding="utf-8"?>';
27 print "<feed xmlns=\"http://www.w3.org/2005/Atom\">
28 <id>".htmlspecialchars(SELF_URL_PATH . "/register.php")."</id>
99534a3d 29 <title>Tiny Tiny RSS registration slots</title>
870a70e1
AD
30 <link rel=\"self\" href=\"".htmlspecialchars(SELF_URL_PATH . "/register.php?format=feed")."\"/>
31 <link rel=\"alternate\" href=\"".htmlspecialchars(SELF_URL_PATH)."\"/>";
32
33 if (ENABLE_REGISTRATION) {
6322ac79 34 $result = db_query( "SELECT COUNT(*) AS cu FROM ttrss_users");
870a70e1
AD
35 $num_users = db_fetch_result($result, 0, "cu");
36
410c0b3a 37 $num_users = REG_MAX_USERS - $num_users;
870a70e1
AD
38 if ($num_users < 0) $num_users = 0;
39 $reg_suffix = "enabled";
40 } else {
41 $num_users = 0;
42 $reg_suffix = "disabled";
43 }
44
45 print "<entry>
46 <id>".htmlspecialchars(SELF_URL_PATH)."/register.php?$num_users"."</id>
47 <link rel=\"alternate\" href=\"".htmlspecialchars(SELF_URL_PATH . "/register.php")."\"/>";
48
49 print "<title>$num_users slots are currently available, registration $reg_suffix</title>";
50 print "<summary>$num_users slots are currently available, registration $reg_suffix</summary>";
51
52 print "</entry>";
53
54 print "</feed>";
55
56 return;
57 }
58
4f7956b3
AD
59 /* Remove users which didn't login after receiving their registration information */
60
61 if (DB_TYPE == "pgsql") {
6322ac79 62 db_query( "DELETE FROM ttrss_users WHERE last_login IS NULL
4f7956b3
AD
63 AND created < NOW() - INTERVAL '1 day' AND access_level = 0");
64 } else {
6322ac79 65 db_query( "DELETE FROM ttrss_users WHERE last_login IS NULL
4f7956b3
AD
66 AND created < DATE_SUB(NOW(), INTERVAL 1 DAY) AND access_level = 0");
67 }
68
a53f3dc4
AD
69 if (file_exists("register_expire_do.php")) {
70 require_once "register_expire_do.php";
71 }
72
4f7956b3
AD
73 if ($action == "check") {
74 header("Content-Type: application/xml");
75
6322ac79 76 $login = trim(db_escape_string( $_REQUEST['login']));
4f7956b3 77
6322ac79 78 $result = db_query( "SELECT id FROM ttrss_users WHERE
4f7956b3 79 LOWER(login) = LOWER('$login')");
133ab8c7 80
4f7956b3
AD
81 $is_registered = db_num_rows($result) > 0;
82
83 print "<result>";
84
85 printf("%d", $is_registered);
86
87 print "</result>";
88
89 return;
90 }
91?>
92
93<html>
94<head>
95<title>Create new account</title>
96<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
9dd336a2 97<?php echo stylesheet_tag("css/default.css") ?>
5a801bd6
AD
98<?php echo javascript_tag("js/functions.js") ?>
99<?php echo javascript_tag("lib/prototype.js") ?>
100<?php echo javascript_tag("lib/scriptaculous/scriptaculous.js?load=effects,controls") ?>
4f7956b3
AD
101</head>
102
103<script type="text/javascript">
104
105 function checkUsername() {
106
107 try {
108 var f = document.forms['register_form'];
109 var login = f.login.value;
110
111 if (login == "") {
112 new Effect.Highlight(f.login);
113 f.sub_btn.disabled = true;
114 return false;
115 }
116
133ab8c7 117 var query = "register.php?action=check&login=" +
4f7956b3
AD
118 param_escape(login);
119
120 new Ajax.Request(query, {
133ab8c7 121 onComplete: function(transport) {
4f7956b3
AD
122
123 try {
124
125 var reply = transport.responseXML;
126
127 var result = reply.getElementsByTagName('result')[0];
128 var result_code = result.firstChild.nodeValue;
129
130 if (result_code == 0) {
131 new Effect.Highlight(f.login, {startcolor : '#00ff00'});
132 f.sub_btn.disabled = false;
133 } else {
134 new Effect.Highlight(f.login, {startcolor : '#ff0000'});
135 f.sub_btn.disabled = true;
133ab8c7 136 }
4f7956b3
AD
137 } catch (e) {
138 exception_error("checkUsername_callback", e);
139 }
140
141 } });
142
143 } catch (e) {
144 exception_error("checkUsername", e);
145 }
146
147 return false;
148
149 }
150
151 function validateRegForm() {
152 try {
153
154 var f = document.forms['register_form'];
155
156 if (f.login.value.length == 0) {
157 new Effect.Highlight(f.login);
158 return false;
159 }
160
161 if (f.email.value.length == 0) {
162 new Effect.Highlight(f.email);
163 return false;
164 }
165
166 if (f.turing_test.value.length == 0) {
167 new Effect.Highlight(f.turing_test);
168 return false;
169 }
170
171 return true;
172
173 } catch (e) {
174 exception_error("validateRegForm", e);
175 return false;
176 }
177 }
178
179</script>
180
09bc54c6 181<body class="claro ttrss_utility">
4f7956b3 182
884d1650 183<div class="floatingLogo"><img src="images/logo_small.png"></div>
4f7956b3
AD
184
185<h1><?php echo __("Create new account") ?></h1>
186
884d1650
AD
187<div class="content">
188
4f7956b3
AD
189<?php
190 if (!ENABLE_REGISTRATION) {
191 print_error(__("New user registrations are administratively disabled."));
192
2376ad49
AD
193 print "<p><form method=\"GET\" action=\"backend.php\">
194 <input type=\"hidden\" name=\"op\" value=\"logout\">
4f7956b3
AD
195 <input type=\"submit\" value=\"".__("Return to Tiny Tiny RSS")."\">
196 </form>";
197 return;
198 }
199?>
200
4f7956b3 201<?php if (REG_MAX_USERS > 0) {
6322ac79 202 $result = db_query( "SELECT COUNT(*) AS cu FROM ttrss_users");
4f7956b3
AD
203 $num_users = db_fetch_result($result, 0, "cu");
204} ?>
205
0844d6a9 206<?php if (!REG_MAX_USERS || $num_users < REG_MAX_USERS) { ?>
4f7956b3 207
4ca3d8c4
AD
208 <!-- If you have any rules or ToS you'd like to display, enter them here -->
209
210 <?php if (file_exists("templates/register_notice.txt")) {
211 require_once "templates/register_notice.txt";
212 } ?>
213
0844d6a9 214 <?php if (!$action) { ?>
133ab8c7
AD
215
216 <p><?php echo __('Your temporary password will be sent to the specified email. Accounts, which were not logged in once, are erased automatically 24 hours after temporary password is sent.') ?></p>
217
4f7956b3
AD
218 <form action="register.php" method="POST" name="register_form">
219 <input type="hidden" name="action" value="do_register">
220 <table>
221 <tr>
222 <td><?php echo __('Desired login:') ?></td><td>
5ce9d43e 223 <input name="login" required>
4f7956b3
AD
224 </td><td>
225 <input type="submit" value="<?php echo __('Check availability') ?>" onclick='return checkUsername()'>
226 </td></tr>
e331188f 227 <tr><td><?php echo __('Email:') ?></td><td>
5ce9d43e 228 <input name="email" type="email" required>
4f7956b3 229 </td></tr>
e331188f 230 <tr><td><?php echo __('How much is two plus two:') ?></td><td>
5ce9d43e 231 <input name="turing_test" required></td></tr>
4f7956b3 232 <tr><td colspan="2" align="right">
2a52d96f 233 <input type="submit" name="sub_btn" value="<?php echo __('Submit registration') ?>"
a2998811 234 disabled="disabled" onclick='return validateRegForm()'>
4f7956b3
AD
235 </td></tr>
236 </table>
237 </form>
1da195e2 238
107d0cf3 239 <?php print "<p><form method=\"GET\" action=\"index.php\">
1da195e2
AD
240 <input type=\"submit\" value=\"".__("Return to Tiny Tiny RSS")."\">
241 </form>"; ?>
242
0844d6a9 243 <?php } else if ($action == "do_register") { ?>
133ab8c7 244
0844d6a9 245 <?php
6322ac79
AD
246 $login = mb_strtolower(trim(db_escape_string( $_REQUEST["login"])));
247 $email = trim(db_escape_string( $_REQUEST["email"]));
248 $test = trim(db_escape_string( $_REQUEST["turing_test"]));
133ab8c7 249
4f7956b3 250 if (!$login || !$email || !$test) {
c46a4a05 251 print_error(__("Your registration information is incomplete."));
107d0cf3 252 print "<p><form method=\"GET\" action=\"index.php\">
c46a4a05
AD
253 <input type=\"submit\" value=\"".__("Return to Tiny Tiny RSS")."\">
254 </form>";
4f7956b3
AD
255 return;
256 }
133ab8c7 257
4f7956b3 258 if ($test == "four" || $test == "4") {
133ab8c7 259
6322ac79 260 $result = db_query( "SELECT id FROM ttrss_users WHERE
4f7956b3 261 login = '$login'");
133ab8c7 262
4f7956b3 263 $is_registered = db_num_rows($result) > 0;
133ab8c7 264
4f7956b3
AD
265 if ($is_registered) {
266 print_error(__('Sorry, this username is already taken.'));
107d0cf3 267 print "<p><form method=\"GET\" action=\"index.php\">
4f7956b3
AD
268 <input type=\"submit\" value=\"".__("Return to Tiny Tiny RSS")."\">
269 </form>";
270 } else {
133ab8c7 271
4f7956b3 272 $password = make_password();
133ab8c7 273
8db5d8ea 274 $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
098df83b 275 $pwd_hash = encrypt_password($password, $salt, true);
133ab8c7 276
6322ac79 277 db_query( "INSERT INTO ttrss_users
098df83b
AD
278 (login,pwd_hash,access_level,last_login, email, created, salt)
279 VALUES ('$login', '$pwd_hash', 0, null, '$email', NOW(), '$salt')");
133ab8c7 280
6322ac79 281 $result = db_query( "SELECT id FROM ttrss_users WHERE
4f7956b3 282 login = '$login' AND pwd_hash = '$pwd_hash'");
133ab8c7 283
4f7956b3
AD
284 if (db_num_rows($result) != 1) {
285 print_error(__('Registration failed.'));
107d0cf3 286 print "<p><form method=\"GET\" action=\"index.php\">
4f7956b3
AD
287 <input type=\"submit\" value=\"".__("Return to Tiny Tiny RSS")."\">
288 </form>";
289 } else {
133ab8c7 290
4f7956b3 291 $new_uid = db_fetch_result($result, 0, "id");
133ab8c7 292
6322ac79 293 initialize_user( $new_uid);
133ab8c7 294
4f7956b3
AD
295 $reg_text = "Hi!\n".
296 "\n".
297 "You are receiving this message, because you (or somebody else) have opened\n".
298 "an account at Tiny Tiny RSS.\n".
299 "\n".
300 "Your login information is as follows:\n".
301 "\n".
302 "Login: $login\n".
303 "Password: $password\n".
304 "\n".
305 "Don't forget to login at least once to your new account, otherwise\n".
306 "it will be deleted in 24 hours.\n".
307 "\n".
308 "If that wasn't you, just ignore this message. Thanks.";
133ab8c7 309
57932e18 310 $mailer = new Mailer();
55bf4bc1 311 $rc = $mailer->mail(["to_address" => $email,
57932e18
AD
312 "subject" => "Registration information for Tiny Tiny RSS",
313 "message" => $reg_text]);
133ab8c7 314
57932e18 315 if (!$rc) print_error($mailer->error());
884d1650 316
4f7956b3
AD
317 $reg_text = "Hi!\n".
318 "\n".
319 "New user had registered at your Tiny Tiny RSS installation.\n".
320 "\n".
321 "Login: $login\n".
322 "Email: $email\n";
884d1650 323
57932e18 324 $mailer = new Mailer();
55bf4bc1 325 $rc = $mailer->mail(["to_address" => REG_NOTIFY_ADDRESS,
57932e18
AD
326 "subject" => "Registration notice for Tiny Tiny RSS",
327 "message" => $reg_text]);
884d1650 328
57932e18 329 if (!$rc) print_error($mailer->error());
884d1650 330
4f7956b3 331 print_notice(__("Account created successfully."));
133ab8c7 332
107d0cf3 333 print "<p><form method=\"GET\" action=\"index.php\">
4f7956b3
AD
334 <input type=\"submit\" value=\"".__("Return to Tiny Tiny RSS")."\">
335 </form>";
133ab8c7 336
4f7956b3 337 }
133ab8c7 338
4f7956b3 339 }
133ab8c7 340
4f7956b3
AD
341 } else {
342 print_error('Plese check the form again, you have failed the robot test.');
107d0cf3 343 print "<p><form method=\"GET\" action=\"index.php\">
4f7956b3
AD
344 <input type=\"submit\" value=\"".__("Return to Tiny Tiny RSS")."\">
345 </form>";
133ab8c7 346
4f7956b3
AD
347 }
348 }
349 ?>
350
0844d6a9 351<?php } else { ?>
4f7956b3
AD
352
353 <?php print_notice(__('New user registrations are currently closed.')) ?>
354
107d0cf3 355 <?php print "<p><form method=\"GET\" action=\"index.php\">
4f7956b3
AD
356 <input type=\"submit\" value=\"".__("Return to Tiny Tiny RSS")."\">
357 </form>"; ?>
358
0844d6a9 359<?php } ?>
4f7956b3 360
884d1650
AD
361 </div>
362
4f7956b3
AD
363</body>
364</html>