]> git.mxchange.org Git - quix0rs-gnu-social.git/blob - actions/invite.php
CSRF protection for invites.php
[quix0rs-gnu-social.git] / actions / invite.php
1 <?php
2 /*
3  * Laconica - a distributed open-source microblogging tool
4  * Copyright (C) 2008, Controlez-Vous, Inc.
5  *
6  * This program is free software: you can redistribute it and/or modify
7  * it under the terms of the GNU Affero General Public License as published by
8  * the Free Software Foundation, either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU Affero General Public License for more details.
15  *
16  * You should have received a copy of the GNU Affero General Public License
17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19
20 if (!defined('LACONICA')) { exit(1); }
21
22 class InviteAction extends Action {
23
24         function is_readonly() {
25                 return false;
26         }
27
28     function handle($args) {
29         parent::handle($args);
30                 if (!common_logged_in()) {
31                         $this->client_error(sprintf(_('You must be logged in to invite other users to use %s'),
32                                                                                 common_config('site', 'name')));
33                         return;
34                 } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
35                         $this->send_invitations();
36                 } else {
37                         $this->show_form();
38                 }
39         }
40
41         function send_invitations() {
42
43                 # CSRF protection
44                 $token = $this->trimmed('token');
45                 if (!$token || $token != common_session_token()) {
46                         $this->show_form(_('There was a problem with your session token. Try again, please.'));
47                         return;
48                 }
49
50                 $user = common_current_user();
51                 $profile = $user->getProfile();
52
53                 $bestname = $profile->getBestName();
54                 $sitename = common_config('site', 'name');
55                 $personal = $this->trimmed('personal');
56
57                 $addresses = explode("\n", $this->trimmed('addresses'));
58
59                 foreach ($addresses as $email) {
60                         $email = trim($email);
61                         if (!Validate::email($email, true)) {
62                                 $this->show_form(sprintf(_('Invalid email address: %s'), $email));
63                                 return;
64                         }
65                 }
66
67                 $already = array();
68                 $subbed = array();
69
70                 foreach ($addresses as $email) {
71                         $email = common_canonical_email($email);
72                         $other = User::staticGet('email', $email);
73                         if ($other) {
74                                 if ($user->isSubscribed($other)) {
75                                         $already[] = $other;
76                                 } else {
77                                         subs_subscribe_to($user, $other);
78                                         $subbed[] = $other;
79                                 }
80                         } else {
81                                 $sent[] = $email;
82                                 $this->send_invitation($email, $user, $personal);
83                         }
84                 }
85
86                 common_show_header(_('Invitation(s) sent'));
87                 if ($already) {
88                         common_element('p', NULL, _('You are already subscribed to these users:'));
89                         common_element_start('ul');
90                         foreach ($already as $other) {
91                                 common_element('li', NULL, sprintf(_('%s (%s)'), $other->nickname, $other->email));
92                         }
93                         common_element_end('ul');
94                 }
95                 if ($subbed) {
96                         common_element('p', NULL, _('These people are already users and you were automatically subscribed to them:'));
97                         common_element_start('ul');
98                         foreach ($subbed as $other) {
99                                 common_element('li', NULL, sprintf(_('%s (%s)'), $other->nickname, $other->email));
100                         }
101                         common_element_end('ul');
102                 }
103                 if ($sent) {
104                         common_element('p', NULL, _('Invitation(s) sent to the following people:'));
105                         common_element_start('ul');
106                         foreach ($sent as $other) {
107                                 common_element('li', NULL, $other);
108                         }
109                         common_element_end('ul');
110                         common_element('p', NULL, _('You will be notified when your invitees accept the invitation and register on the site. Thanks for growing the community!'));
111                 }
112                 common_show_footer();
113         }
114
115         function show_top($error=NULL) {
116                 if ($error) {
117                         common_element('p', 'error', $error);
118                 } else {
119                         common_element_start('div', 'instructions');
120                         common_element('p', NULL,
121                                                    _('Use this form to invite your friends and colleagues to use this service.'));
122                         common_element_end('div');
123                 }
124         }
125
126         function show_form($error=NULL) {
127
128                 global $config;
129
130                 common_show_header(_('Invite new users'), NULL, $error, array($this, 'show_top'));
131
132                 common_element_start('form', array('method' => 'post',
133                                                                                    'id' => 'invite',
134                                                                                    'action' => common_local_url('invite')));
135                 common_hidden('token', common_session_token());
136
137                 common_textarea('addresses', _('Email addresses'),
138                                                 $this->trimmed('addresses'),
139                                                 _('Addresses of friends to invite (one per line)'));
140
141                 common_textarea('personal', _('Personal message'),
142                                                 $this->trimmed('personal'),
143                                                 _('Optionally add a personal message to the invitation.'));
144
145                 common_submit('send', _('Send'));
146
147                 common_element_end('form');
148
149                 common_show_footer();
150         }
151
152         function send_invitation($email, $user, $personal) {
153
154                 $profile = $user->getProfile();
155                 $bestname = $profile->getBestName();
156
157                 $sitename = common_config('site', 'name');
158
159                 $invite = new Invitation();
160
161                 $invite->address = $email;
162                 $invite->address_type = 'email';
163                 $invite->code = common_confirmation_code(128);
164                 $invite->user_id = $user->id;
165                 $invite->created = common_sql_now();
166
167                 if (!$invite->insert()) {
168                         common_log_db_error($invite, 'INSERT', __FILE__);
169                         return false;
170                 }
171
172                 $recipients = array($email);
173
174                 $headers['From'] = mail_notify_from();
175                 $headers['To'] = $email;
176                 $headers['Subject'] = sprintf(_('%1$s has invited you to join them on %2$s'), $bestname, $sitename);
177
178                 $body = sprintf(_("%1\$s has invited you to join them on %2\$s (%3\$s).\n\n".
179                                                   "%2\$s is a micro-blogging service that lets you keep up-to-date with people you know and people who interest you.\n\n".
180                                                   "You can also share news about yourself, your thoughts, or your life online with people who know about you. ".
181                                                   "It's also great for meeting new people who share your interests.\n\n".
182                                                   "%1\$s said:\n\n%4\$s\n\n".
183                                                   "You can see %1\$s's profile page on %2\$s here:\n\n".
184                                                   "%5\$s\n\n".
185                                                   "If you'd like to try the service, click on the link below to accept the invitation.\n\n".
186                                                   "%6\$s\n\n".
187                                                   "If not, you can ignore this message. Thanks for your patience and your time.\n\n".
188                                                   "Sincerely, %2\$s\n"),
189                                                 $bestname,
190                                                 $sitename,
191                                                 common_root_url(),
192                                                 $personal,
193                                                 common_local_url('showstream', array('nickname' => $user->nickname)),
194                                                 common_local_url('register', array('code' => $invite->code)));
195
196                 mail_send($recipients, $headers, $body);
197         }
198
199 }