hackademic/controller/class.ForgotPasswordController.php at next-dev · Hackademic/hackademic · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
<?php
/**
 * Hackademic-CMS/controller/class.ForgotPasswordController.php
 *
 * Hackademic Forgot Password Controller
 * Class for generating the home page of the website
 *
 * Copyright (c) 2012 OWASP
 *
 * LICENSE:
 *
 * This file is part of Hackademic CMS
 * (https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project).
 *
 * Hackademic CMS is free software: you can redistribute it and/or modify it under
 * the terms of the GNU General Public License as published by the Free Software
 * Foundation, either version 2 of the License, or (at your option) any later
 * version.
 *
 * Hackademic CMS is distributed in the hope that it will be useful, but WITHOUT ANY
 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 * PARTICULAR PURPOSE.  See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along with
 * Hackademic CMS.  If not, see <http://www.gnu.org/licenses/>.
 *
 * PHP Version 5.
 *
 * @author    Pragya Gupta <pragya18nsit@gmail.com>
 * @author    Konstantinos Papapanagiotou <conpap@gmail.com>
 * @copyright 2012 OWASP
 * @license   GNU General Public License http://www.gnu.org/licenses/gpl.html
 */
require_once HACKADEMIC_PATH."controller/class.HackademicController.php";
require_once HACKADEMIC_PATH."model/common/class.User.php";
require_once HACKADEMIC_PATH."model/common/class.Mailer.php";
require_once HACKADEMIC_PATH."model/common/class.Utils.php";


class ForgotPasswordController extends HackademicController
{

    private static $_action_type = 'forgot_password';

    public function go()
    {
        $this->setViewTemplate('forgotpw.tpl');
        if (isset($_POST['submit'])) {
            if ($_POST['username']=='') {
                $this->addErrorMessage("Username should not be empty");
            } else {
                $username = $_POST['username'];
                //$is_activated = $_POST['is_activated'];
                if (!(User::doesUserExist($username)) || !User::isUserActivated($username)) {
                    $this->addErrorMessage("Username does not exist");
                } else {
                    global $ESAPI_utils;
                    $token=$ESAPI_utils->getHttpUtilities()->getCSRFToken();
                    $subject="Hackademic new password link activation";
                    $message="Please click on the following link below to reset your password";
                    $message = SOURCE_ROOT_PATH."?url=resetpassword&username=$username&token=$token";
                    error_log($message);
                    //Mailer::mail($email,$subject,$message);
                    $result = User::addToken($username, $token);
                    $this->addSuccessMessage("A mail has been send to your email  click on the link in the email to reset the password to your account");
                    //header("Location: resetpassword.php?username=$username&token=$token");
                }
            }
        }
        return $this->generateView(self::$_action_type);
    }
}