Newer
Older
<?php
/*********************************************************************
User access link recovery
TODO: This is a temp. fix to allow for collaboration in lieu of real
username and password coming in 1.8.2
Peter Rotich <peter@osticket.com>
http://www.osticket.com
Released under the GNU General Public License WITHOUT ANY WARRANTY.
See LICENSE.TXT for details.
vim: expandtab sw=4 ts=4 sts=4:
**********************************************************************/
require_once('client.inc.php');
if(!defined('INCLUDE_DIR')) die('Fatal Error');
define('CLIENTINC_DIR',INCLUDE_DIR.'client/');
define('OSTCLIENTINC',TRUE); //make includes happy
require_once(INCLUDE_DIR.'class.client.php');
require_once(INCLUDE_DIR.'class.ticket.php');
if ($cfg->getClientRegistrationMode() == 'disabled'
|| isset($_POST['lticket']))
$inc = 'accesslink.inc.php';
else
$inc = 'login.inc.php';
$suggest_pwreset = false;
if (!$_POST['luser'])
$errors['err'] = 'Valid username or email address is required';
elseif (($user = UserAuthenticationBackend::process($_POST['luser'],
$_POST['lpasswd'], $errors))) {
if ($user instanceof ClientCreateRequest) {
if ($cfg && $cfg->isClientRegistrationEnabled()) {
$inc = 'register.inc.php';
$user_form = UserForm::getUserForm()->getForm($user->getInfo());
}
else {
$errors['err'] = 'Access Denied. Contact your help desk
administrator to have an account registered for you';
// fall through to show login page again
}
}
else {
Http::redirect($_SESSION['_client']['auth']['dest']
?: 'tickets.php');
}
$errors['err'] = 'Invalid username or password - try again!';
$suggest_pwreset = true;
elseif ($_POST && isset($_POST['lticket'])) {
if (!Validator::is_email($_POST['lemail']))
$errors['err'] = 'Valid email address and ticket number required';
elseif (($user = UserAuthenticationBackend::process($_POST['lemail'],
$_POST['lticket'], $errors))) {
// We're using authentication backend so we can guard aganist brute
// force attempts (which doesn't buy much since the link is emailed)
$user->sendAccessLink();
$msg = sprintf("%s - access link sent to your email!",
$user->getName()->getFirst());
$_POST = null;
} elseif(!$errors['err']) {
$errors['err'] = 'Invalid email or ticket number - try again!';
}
}
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
elseif (isset($_GET['do'])) {
switch($_GET['do']) {
case 'ext':
// Lookup external backend
if ($bk = UserAuthenticationBackend::getBackend($_GET['bk']))
$bk->triggerAuth();
}
}
elseif ($user = UserAuthenticationBackend::processSignOn($errors, false)) {
// Users from the ticket access link
if ($user && $user instanceof TicketUser && $user->getTicketId())
Http::redirect('tickets.php?id='.$user->getTicketId());
// Users imported from an external auth backend
elseif ($user instanceof ClientCreateRequest) {
if ($cfg && $cfg->isClientRegistrationEnabled()) {
// Attempt to automatically register
$user_form = UserForm::getUserForm()->getForm($user->getInfo());
$bk = $user->getBackend();
$defaults = array(
'timezone_id' => $cfg->getDefaultTimezoneId(),
'dst' => $cfg->observeDaylightSaving(),
'username' => $user->getUsername(),
);
if ($bk->supportsInteractiveAuthentication())
$defaults['backend'] = $bk::$id;
if ($user_form->isValid(function($f) { return !$f->get('private'); })
&& ($U = User::fromVars($user_form->getClean()))
&& ($acct = ClientAccount::createForUser($U, $defaults))
// Confirm and save the account
&& $acct->confirm()
// Login, since `tickets.php` will not attempt SSO
&& ($cl = new ClientSession(new EndUser($U)))
&& ($bk->login($cl, $bk)))
Http::redirect('tickets.php');
// Unable to auto-register. Fill in what we have and let the
// user complete the info
$inc = 'register.inc.php';
}
else {
$errors['err'] = 'Access Denied. Contact your help desk
administrator to have an account registered for you';
// fall through to show login page again
}
}
elseif ($user instanceof AuthenticatedUser) {
Http::redirect('tickets.php');
}
}
if (!$nav) {
$nav = new UserNav();
$nav->setActiveNav('status');
}
require CLIENTINC_DIR.'header.inc.php';
require CLIENTINC_DIR.$inc;
require CLIENTINC_DIR.'footer.inc.php';