- mails added by (sub)admins are automatically verified - provisioning_api controller as verification endpoint - IAccountProperty gets a locallyVerified property - IPropertyCollection gets a method to fetch an IAccountProperty by value - an remove equivalent was already present - AccountManager always initiates mail verification on update if necessary - add core success template for arbitrary title and message Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>pull/28422/head
Arthur Schiwon
3 years ago
parent
19cc757531
commit
aacaad2a3f
@ -0,0 +1,121 @@ |
||||
<?php |
||||
|
||||
declare(strict_types=1); |
||||
|
||||
/** |
||||
* @copyright Copyright (c) 2021 Arthur Schiwon <blizzz@arthur-schiwon.de> |
||||
* |
||||
* @author Arthur Schiwon <blizzz@arthur-schiwon.de> |
||||
* |
||||
* @license GNU AGPL version 3 or any later version |
||||
* |
||||
* This program is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License as |
||||
* published by the Free Software Foundation, either version 3 of the |
||||
* License, or (at your option) any later version. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License |
||||
* along with this program. If not, see <https://www.gnu.org/licenses/>. |
||||
* |
||||
*/ |
||||
|
||||
namespace OCA\Provisioning_API\Controller; |
||||
|
||||
use InvalidArgumentException; |
||||
use OC\Security\Crypto; |
||||
use OCP\Accounts\IAccountManager; |
||||
use OCP\AppFramework\Controller; |
||||
use OCP\AppFramework\Http\TemplateResponse; |
||||
use OCP\IL10N; |
||||
use OCP\IRequest; |
||||
use OCP\IUserManager; |
||||
use OCP\IUserSession; |
||||
use OCP\Security\VerificationToken\InvalidTokenException; |
||||
use OCP\Security\VerificationToken\IVerificationToken; |
||||
|
||||
class VerificationController extends Controller { |
||||
|
||||
/** @var IVerificationToken */ |
||||
private $verificationToken; |
||||
/** @var IUserManager */ |
||||
private $userManager; |
||||
/** @var IL10N */ |
||||
private $l10n; |
||||
/** @var IUserSession */ |
||||
private $userSession; |
||||
/** @var IAccountManager */ |
||||
private $accountManager; |
||||
/** @var Crypto */ |
||||
private $crypto; |
||||
|
||||
public function __construct( |
||||
string $appName, |
||||
IRequest $request, |
||||
IVerificationToken $verificationToken, |
||||
IUserManager $userManager, |
||||
IL10N $l10n, |
||||
IUserSession $userSession, |
||||
IAccountManager $accountManager, |
||||
Crypto $crypto |
||||
) { |
||||
parent::__construct($appName, $request); |
||||
$this->verificationToken = $verificationToken; |
||||
$this->userManager = $userManager; |
||||
$this->l10n = $l10n; |
||||
$this->userSession = $userSession; |
||||
$this->accountManager = $accountManager; |
||||
$this->crypto = $crypto; |
||||
} |
||||
|
||||
/** |
||||
* @NoCSRFRequired |
||||
*/ |
||||
public function verifyMail(string $token, string $userId, string $key) { |
||||
try { |
||||
if ($this->userSession->getUser()->getUID() !== $userId) { |
||||
throw new InvalidArgumentException('Logged in user is not mail address owner'); |
||||
} |
||||
$email = $this->crypto->decrypt($key); |
||||
$ref = \substr(hash('sha256', $email), 0, 8); |
||||
|
||||
$user = $this->userManager->get($userId); |
||||
$this->verificationToken->check($token, $user, 'verifyMail' . $ref, $email); |
||||
|
||||
$userAccount = $this->accountManager->getAccount($user); |
||||
$emailProperty = $userAccount->getPropertyCollection(IAccountManager::COLLECTION_EMAIL) |
||||
->getPropertyByValue($email); |
||||
|
||||
if ($emailProperty === null) { |
||||
throw new InvalidArgumentException($this->l10n->t('Email was already removed from account and cannot be confirmed anymore.')); |
||||
} |
||||
$emailProperty->setLocallyVerified(IAccountManager::VERIFIED); |
||||
$this->accountManager->updateAccount($userAccount); |
||||
} catch (InvalidTokenException $e) { |
||||
$error = $e->getCode() === InvalidTokenException::TOKEN_EXPIRED |
||||
? $this->l10n->t('Could not verify mail because the token is expired.') |
||||
: $this->l10n->t('Could not verify mail because the token is invalid.'); |
||||
} catch (InvalidArgumentException $e) { |
||||
$error = $e->getMessage(); |
||||
} catch (\Exception $e) { |
||||
$error = $this->l10n->t('An unexpected error occurred. Please consult your sysadmin.'); |
||||
} |
||||
|
||||
if (isset($error)) { |
||||
return new TemplateResponse( |
||||
'core', 'error', [ |
||||
'errors' => [['error' => $error]] |
||||
], 'guest'); |
||||
} |
||||
|
||||
return new TemplateResponse( |
||||
'core', 'success', [ |
||||
'title' => $this->l10n->t('Email confirmation successful'), |
||||
'message' => $this->l10n->t('Email confirmation successful'), |
||||
], 'guest'); |
||||
} |
||||
} |
||||
@ -0,0 +1,13 @@ |
||||
<?php |
||||
/** @var array $_ */ |
||||
/** @var \OCP\IL10N $l */ |
||||
/** @var \OCP\Defaults $theme */ |
||||
?> |
||||
|
||||
<div class="update"> |
||||
<h2><?php p($_['title']) ?></h2>
|
||||
<p><?php p($_['message']) ?></p>
|
||||
<p><a class="button primary" href="<?php p(\OC::$server->get(\OCP\IURLGenerator::class)->linkTo('', 'index.php')) ?>">
|
||||
<?php p($l->t('Go to %s', [$theme->getName()])); ?> |
||||
</a></p> |
||||
</div> |
||||
Loading…
Reference in new issue