Amélioration du code de la page de connexion

dispatcher.php

@@ -29,6 +29,9 @@ $ROUTES["^ajouter_equipe$"] = ["server_files/controllers/ajouter_equipe.php"];
 $ROUTES["^ajouter_organisateur$"] = ["server_files/controllers/ajouter_organisateur.php"];
 $ROUTES["^ajouter_tournoi$"] = ["server_files/controllers/ajouter_tournoi.php"];
 $ROUTES["^confirmer_mail/([a-z0-9]*)/?$"] = ["server_files/controllers/confirmer_mail.php", "token"];
+$ROUTES["^connexion/(confirmation-mail)/?$"] = ["server_files/controllers/connexion.php", "confirmation-mail"];
+$ROUTES["^connexion/(mdp_oublie)/?$"] = ["server_files/controllers/connexion.php", "mdp_oublie"];
+$ROUTES["^connexion/(reinitialiser_mdp)/(.*)/?$"] = ["server_files/controllers/connexion.php", "reset_password", "token"];
 $ROUTES["^connexion/?$"] = ["server_files/controllers/connexion.php"];
 $ROUTES["^deconnexion/?$"] = ["server_files/controllers/deconnexion.php"];
 $ROUTES["^equipe/([A-Z]{3})/?$"] = ["server_files/controllers/equipe.php", "trigram"];

docker-compose.yml

@@ -1,32 +0,0 @@
-version: '3'
-services:
-  db:
-    image: mysql:5
-    command: --default-authentication-plugin=mysql_native_password
-    restart: always
-    environment:
-      MYSQL_ROOT_PASSWORD: mysql_root_password
-      MYSQL_DATABASE: plateforme
-      MYSQL_USER: plateforme
-      MYSQL_PASSWORD: plateforme
-
-  adminer:
-    image: adminer
-    restart: always
-    ports:
-      - 8888:8080
-    depends_on:
-      - db
-
-  plateforme:
-    build:
-      context: .
-    ports:
-      - 80:80
-    depends_on:
-      - db
-    environment:
-      TFJM_DB_HOST: db
-      TFJM_DB_USER: plateforme
-      TFJM_DB_NAME: plateforme
-      TFJM_DB_PASSWORD: plateforme

server_files/controllers/ajouter_equipe.php

@@ -46,10 +46,7 @@ class NewTeam {
 	public function register() {
 		global $DB, $YEAR;
 
-		$alphabet = "0123456789abcdefghijkmnopqrstuvwxyz0123456789";
+		$this->access_code = genRandomPhrase(6);
-		$this->access_code = "";
-		for ($i = 0; $i < 6; ++$i)
-			$this->access_code .= $alphabet[rand(0, strlen($alphabet) - 1)];
 
 		$req = $DB->prepare("INSERT INTO `teams` (`name`, `trigram`, `tournament`, `encadrant_1`, `participant_1`, `validation_status`, `access_code`, `year`)
                            VALUES (?, ?, ?, ?, ?, ?, ?, ?);");

server_files/controllers/ajouter_organisateur.php

@@ -44,10 +44,7 @@ class NewOrganizer {
 	public function register() {
 		global $DB, $YEAR;
 
-		$alphabet = "0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+		$this->password = genRandomPhrase(16, true);
-		$this->password = "";
-		for ($i = 0; $i < 16; ++$i)
-			$this->password .= $alphabet[rand(0, strlen($alphabet) - 1)];
 
 		$req = $DB->prepare("INSERT INTO `users`(`email`, `pwd_hash`, `surname`, `first_name`, `role`, `year`)
                 VALUES (?, ?, ?, ?, ?, ?);");

server_files/controllers/connexion.php

@@ -1,100 +1,150 @@
 <?php
 
-// TODO Arranger tout ça
+$has_error = false;
+$error_message = null;
 
 if (isset($_POST["submitted"]) && !isset($_SESSION["user_id"])) {
-    $error_message = login();
+	$logging_in_user = new LoggingInUser($_POST);
+	try {
+		$logging_in_user->makeVerifications();
+		$logging_in_user->login();
+	} catch (AssertionError $e) {
+		$has_error = true;
+		$error_message = $e->getMessage();
+	}
 }
 
 if (isset($_POST["forgotten_password"]) && !isset($_SESSION["user_id"])) {
-    $error_message = recuperateAccount();
+	$recuperate_account = new RecuperateAccount($_POST);
+	try {
+		$recuperate_account->makeVerifications();
+		$recuperate_account->recuperateAccount();
+	} catch (AssertionError $e) {
+		$has_error = true;
+		$error_message = $e->getMessage();
+	}
 }
 
 if (isset($_GET["reset_password"]) && isset($_GET["token"]) && !isset($_SESSION["user_id"])) {
-	$reset_data = $DB->query("SELECT `id` FROM `users` WHERE `forgotten_password` = '" . htmlspecialchars($_GET["token"]) . "';")->fetch();
+	$reset_password = new ResetPassword($_GET, $_POST);
-    if ($reset_data === FALSE) {
+	try {
-        header("Location: $URL_BASE/connexion");
+		$reset_password->makeVerifications();
-        exit();
+		if (isset($_POST["password"]))
+			$reset_password->resetPassword();
+	} catch (AssertionError $e) {
+		$has_error = true;
+		$error_message = $e->getMessage();
+	}
+}
+
+if (isset($_GET["confirmation-mail"]) && !isset($_SESSION["user_id"]))
+	sendConfirmEmail();
+
+class LoggingInUser
+{
+	public $email;
+	/** @var User $user */
+	public $user;
+	private $password;
+
+	public function __construct($data)
+	{
+		foreach ($data as $key => $value)
+			$this->$key = htmlspecialchars($value);
 	}
 
-    if (isset($_POST["reset_password"]))
+	public function makeVerifications()
-        $error_message = resetPassword();
+	{
-}
-
-if (isset($_GET["confirmation-mail"]) && !isset($_SESSION["user_id"])) {
-    $error_message = sendConfirmEmail();
-}
-
-function login() {
 		global $URL_BASE;
 
-    $email = htmlspecialchars($_POST["email"]);
+		ensure(filter_var($this->email, FILTER_VALIDATE_EMAIL), "L'adresse email est invalide.");
-
+		$this->user = User::fromEmail($this->email);
-    if (!filter_var($email, FILTER_VALIDATE_EMAIL))
+		ensure($this->user != null, "Le compte n'existe pas.");
-        return "L'email entrée est invalide.";
+		ensure($this->user->checkPassword($this->password), "Le mot de passe est incorrect.");
-
+		if ($this->user->getConfirmEmailToken() != null) {
-    $password = htmlspecialchars($_POST["password"]);
+			$_SESSION["confirm_email"] = $this->email;
-
+			throw new AssertionError("L'adresse mail n'a pas été validée. Veuillez vérifier votre boîte mail (surtout vos spams). "
-    $user = User::fromEmail($email);
+				. "<a href=\"$URL_BASE/connexion/confirmation-mail\">Cliquez ici pour renvoyer le mail de confirmation</a>.");
-	if ($user === null)
+		}
-        return "Le compte n'existe pas.";
-    
-    if ($user->getConfirmEmailToken() !== NULL) {
-		$_SESSION["confirm_email"] = $email;
-		return "L'adresse mail n'a pas été validée. Veuillez vérifier votre boîte mail (surtout vos spams). <a href=\"$URL_BASE/connexion/confirmation-mail\">Cliquez ici pour renvoyer le mail de confirmation</a>.";
 	}
 
-    if (!$user->checkPassword($password))
+	public function login()
-        return "Le mot de passe est incorrect.";
+	{
-
+		$_SESSION["user_id"] = $this->user->getId();
-    $_SESSION["user_id"] = $user->getId();
 		loadUserValues();
-
+	}
-    return false;
 }
 
-function recuperateAccount() {
+class RecuperateAccount
-	$email = htmlspecialchars($_POST["email"]);
+{
+	public $email;
+	/** @var User $user */
+	public $user;
 
-	if (!filter_var($email, FILTER_VALIDATE_EMAIL))
+	public function __construct($data)
-		return "L'email entrée est invalide.";
+	{
+		foreach ($data as $key => $value)
+			$this->$key = htmlspecialchars($value);
+	}
 
-	$user = User::fromEmail($email);
+	public function makeVerifications()
-	if ($user == null)
+	{
-	    return "Le compte n'existe pas.";
+		ensure(filter_var($this->email, FILTER_VALIDATE_EMAIL), "L'adresse email est invalide.");
+		$this->user = User::fromEmail($this->email);
+		ensure($this->user != null, "Le compte n'existe pas.");
+	}
 
-	$token = uniqid();
+	public function recuperateAccount()
-
+	{
-	$user->setForgottenPasswordToken($token);
+		$token = genRandomPhrase(64);
-
+		$this->user->setForgottenPasswordToken($token);
-	Mailer::sendForgottenPasswordProcedureMail($user);
+		Mailer::sendForgottenPasswordProcedureMail($this->user);
-	
+	}
-	return false;
 }
 
-function resetPassword() {
+class ResetPassword
-	global $reset_data;
+{
+	public $token;
+	/** @var User $user */
+	public $user;
+	private $password;
+	private $confirm_password;
 
-    $id = $reset_data["id"];
+	public function __construct($data, $data2)
-    $password = htmlspecialchars($_POST["password"]);
+	{
-    $confirm = htmlspecialchars($_POST["confirm_password"]);
+		foreach ($data as $key => $value)
+			$this->$key = htmlspecialchars($value);
+		foreach ($data2 as $key => $value)
+			$this->$key = htmlspecialchars($value);
+	}
 
-	if (strlen($password) < 8)
+	public function makeVerifications()
-		return "Le mot de passe doit comporter au moins 8 caractères.";
+	{
+		global $DB;
+		$data = $DB->query("SELECT `id` FROM `users` WHERE `forgotten_password` = '" . $this->token . "';")->fetch();
+		ensure($data !== false, "Il n'y a pas de compte à récupérer avec ce jeton.");
+		$this->user = User::fromId($data["id"]);
 
-	if ($password != $confirm)
+		if ($this->password == null)
-		return "Les deux mots de passe sont différents.";
+			return;
 
-	$user = User::fromId($id);
+		ensure($this->password == $this->confirm_password, "Les deux mots de passe sont différents.");
-	$user->setForgottenPasswordToken(null);
+		ensure(strlen($this->password) >= 8, "Le mot de passe doit comporter au moins 8 caractères.");
-	$user->setPassword($password);
+	}
 
-	Mailer::sendChangePasswordMail($user);
+	public function resetPassword()
+	{
+		$this->user->setForgottenPasswordToken(null);
+		$this->user->setPassword($this->password);
+
+		Mailer::sendChangePasswordMail($this->user);
 
 		return false;
+	}
 }
 
-function sendConfirmEmail() {
+function sendConfirmEmail()
+{
 	global $URL_BASE;
 
 	$email = htmlspecialchars($_SESSION["confirm_email"]);

server_files/controllers/equipe.php

@@ -24,14 +24,8 @@ if (isset($_POST["select"])) {
 	$sols_req->execute([$team->getId(), $team->getTournamentId()]);
 	while (($sol_data = $sols_req->fetch()) !== false) {
 		$old_id = $sol_data["file_id"];
-		$alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+		do
-		
+			$id = genRandomPhrase(64);
-		do {
-			$id = "";
-			for ($i = 0; $i < 64; ++$i) {
-				$id .= $alphabet[rand(0, strlen($alphabet) - 1)];
-			}
-		}
 		while (file_exists("$LOCAL_PATH/files/$id"));
 		
 		copy("$LOCAL_PATH/files/$old_id", "$LOCAL_PATH/files/$id");

server_files/controllers/inscription.php

@@ -73,7 +73,7 @@ class NewUser
 			}
 		}
 
-		$this->confirm_email_token = uniqid();
+		$this->confirm_email_token = genRandomPhrase(64);
 	}
 
 	public function register()

server_files/controllers/mon_compte.php

@@ -92,7 +92,7 @@ function updateAccount()
 
     $email = htmlspecialchars($_POST["email"]);
     if (isset($email) && $email != "" && filter_var($email, FILTER_VALIDATE_EMAIL)) {
-        $confirm_email_token = uniqid();
+		$confirm_email_token = genRandomPhrase(64);
 		$user->setEmail($email);
         $user->setConfirmEmailToken($confirm_email_token);
 

server_files/controllers/mon_equipe.php

@@ -57,14 +57,9 @@ function sendDocument()
 	if (!is_dir("$LOCAL_PATH/files") && !mkdir("$LOCAL_PATH/files"))
 		return "Les droits sont insuffisants. Veuillez contacter l'administrateur du serveur.";
 
-	$alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	do
-	
+		$id = genRandomPhrase(64);
-	do {
+	while (file_exists("$LOCAL_PATH/files/$id"));
-		$id = "";
-		for ($i = 0; $i < 64; ++$i) {
-			$id .= $alphabet[rand(0, strlen($alphabet) - 1)];
-		}
-	} while (file_exists("$LOCAL_PATH/files/$id"));
 	
 	if (!rename($file["tmp_name"], "$LOCAL_PATH/files/$id"))
 		return "Une erreur est survenue lors de l'envoi du fichier.";

server_files/controllers/solutions.php

@@ -42,14 +42,8 @@ function saveSolution() {
     if (!is_dir("$LOCAL_PATH/files") && !mkdir("$LOCAL_PATH/files"))
         return "Les droits sont insuffisants. Veuillez contacter l'administrateur du serveur.";
 
-    $alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	do
-
+		$id = genRandomPhrase(64);
-    do {
-        $id = "";
-        for ($i = 0; $i < 64; ++$i) {
-            $id .= $alphabet[rand(0, strlen($alphabet) - 1)];
-        }
-    }
     while (file_exists("$LOCAL_PATH/files/$id"));
 
     if (!rename($file["tmp_name"], "$LOCAL_PATH/files/$id"))

server_files/controllers/syntheses.php

@@ -38,14 +38,8 @@ function saveSynthesis() {
     if (!is_dir("$LOCAL_PATH/files") && !mkdir("$LOCAL_PATH/files"))
         return "Les droits sont insuffisants. Veuillez contacter l'administrateur du serveur.";
 
-    $alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	do
-
+		$id = genRandomPhrase(64);
-    do {
-        $id = "";
-        for ($i = 0; $i < 64; ++$i) {
-            $id .= $alphabet[rand(0, strlen($alphabet) - 1)];
-        }
-    }
     while (file_exists("$LOCAL_PATH/files/$id"));
 
     if (!rename($file["tmp_name"], "$LOCAL_PATH/files/$id"))

server_files/services/mail.php

@@ -38,7 +38,7 @@ class Mailer
 	{
 		global $YEAR;
 
-		$content = self::getTemplate("register");
+		$content = self::getTemplate("confirm_email");
 		$content = preg_replace("#{FIRST_NAME}#", $user->getFirstName(), $content);
 		$content = preg_replace("#{SURNAME}#", $user->getSurname(), $content);
 		$content = preg_replace("#{TOKEN}#", $user->getConfirmEmailToken(), $content);

server_files/services/mail_templates/forgotten_password.html

@@ -1,4 +1,5 @@
 <!DOCTYPE html>
+<!--suppress HtmlUnknownTarget -->
 <html lang="fr">
 <head>
     <meta charset="UTF-8">
@@ -7,8 +8,8 @@
 <body>
 Bonjour,<br/>
 <br/>
-Vous avez indiqué avoir oublié votre mot de passe. Veuillez cliquer ici pour le réinitialiser :
+Vous avez indiqué avoir oublié votre mot de passe. Veuillez cliquer ici pour le réinitialiser : <a
-$URL_BASE/connexion/reinitialiser_mdp/{TOKEN}<br/>
+        href="{URL_BASE}/connexion/reinitialiser_mdp/{TOKEN}">{URL_BASE}/connexion/reinitialiser_mdp/{TOKEN}</a><br/>
 <br/>
 Si vous n'êtes pas à l'origine de cette manipulation, vous pouvez ignorer ce message.<br/>
 <br/>

server_files/utils.php

@@ -1,17 +1,32 @@
 <?php
 
-function ensure($bool, $error_msg = "") {
+function ensure($bool, $error_msg = "")
+{
 	if (!$bool)
 		throw new AssertionError($error_msg);
 }
 
-function formatDate($date = NULL, $with_time = false) {
+function formatDate($date = NULL, $with_time = false)
+{
 	if ($date == NULL)
 		$date = date("yyyy-mm-dd");
 
 	return strftime("%d %B %G" . ($with_time ? " %H:%M" : ""), strtotime($date));
 }
 
-function dateWellFormed($date, $with_time = false) {
+function dateWellFormed($date, $with_time = false)
+{
 	return date_parse_from_format($with_time ? "yyyy-mm-dd HH-MM:ss" : "yy-mm-dd", $date) !== false;
 }
+
+function genRandomPhrase($size, $uppercase = false)
+{
+	$alphabet = $uppercase ? "0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" : "0123456789abcdefghijklmnopqrstuvwxyz0123456789";
+
+	$phrase = "";
+	for ($i = 0; $i < $size; ++$i) {
+		$phrase .= $alphabet[rand(0, strlen($alphabet) - 1)];
+	}
+
+	return $phrase;
+}

server_files/views/connexion.php

@@ -1,24 +1,24 @@
 <?php
 require_once "header.php";
 
-if (isset($error_message) && $error_message)
+if ($has_error)
 	echo "<h2>Erreur : " . $error_message . "</h2>";
-
+else {
-if (isset($error_message) && $error_message === FALSE) {
+	if (isset($recuperate_account))
-	if (isset($_GET["mdp_oublie"]))
+		echo "<h2>Le mail de récupération de mot de passe a bien été envoyé.</h2>";
-		echo "Le mail de récupération de mot de passe a bien été envoyé.";
+    elseif (isset($reset_password))
-	else if (isset($_POST["reset_password"]))
+		echo "<h2>Le mot de passe a bien été changé. Vous pouvez désormais vous connecter.</h2>";
-		echo "Le mot de passe a bien été changé. Vous pouvez désormais vous connecter.";
+    elseif (isset($_GET["confirmation-mail"]))
-	else if (isset($_GET["confirmation-mail"]))
+		echo "<h2>Le mail a bien été renvoyé.</h2>";
-		echo "Le mail a bien été renvoyé.";
+	else if (isset($logging_in_user)) {
-	else
+		echo "<h2>Connexion réussie !</h2>";
-		echo "Connexion réussie !";
+		require_once "footer.php";
+	} else if (isset($_SESSION["user_id"])) {
+		echo "<h2>Vous êtes déjà connecté.</h2>";
+		require_once "footer.php";
+	}
 }
-else if (isset($_SESSION["user_id"])) { ?>
+if (isset($_GET["mdp_oublie"])) { ?>
-	<h2>Vous êtes déjà connecté !</h2>
-<?php } else { ?>
-
-	<?php if (isset($_GET["mdp_oublie"])) { ?>
     <form method="POST">
         <table style="width: 100%;">
             <tbody>
@@ -27,20 +27,21 @@ else if (isset($_SESSION["user_id"])) { ?>
                     <label for="email">E-mail associée au compte :</label>
                 </td>
                 <td style="width: 70%;">
-						<input style="width: 100%;" type="email" id="email" name="email" />
+                    <input style="width: 100%;" type="email" id="email" name="email"/>
                 </td>
             </tr>
             <tr>
                 <td colspan="2">
-						<input style="width: 100%;" type="submit" name="forgotten_password" value="Envoyer l'e-mail de récupération" />
+                    <input style="width: 100%;" type="submit" name="forgotten_password"
+                           value="Envoyer l'e-mail de récupération"/>
                 </td>
             </tr>
             </tbody>
         </table>
     </form>
-	<?php } elseif (isset($_GET["reset_password"])) { ?>
+<?php } elseif (isset($_GET["reset_password"])) {
+	if ($reset_password->user != null) { ?>
         <form method="POST">
-			<input type="hidden" name="token" value="<?= $_GET["token"] ?>" />
             <table style="width: 100%;">
                 <tbody>
                 <tr>
@@ -48,7 +49,7 @@ else if (isset($_SESSION["user_id"])) { ?>
                         <label for="password">Nouveau mot de passe :</label>
                     </td>
                     <td style="width: 70%;">
-						<input style="width: 100%;" type="password" id="password" name="password" />
+                        <input style="width: 100%;" type="password" id="password" name="password"/>
                     </td>
                 </tr>
                 <tr>
@@ -56,29 +57,32 @@ else if (isset($_SESSION["user_id"])) { ?>
                         <label for="confirm_password">Confirmer le mot de passe :</label>
                     </td>
                     <td style="width: 70%;">
-						<input style="width: 100%;" type="password" id="confirm_password" name="confirm_password" />
+                        <input style="width: 100%;" type="password" id="confirm_password" name="confirm_password"/>
                     </td>
                 </tr>
                 <tr>
                     <td colspan="2">
-						<input style="width: 100%;" type="submit" name="reset_password" value="Changer le mot de passe" />
+                        <input style="width: 100%;" type="submit" name="reset_password"
+                               value="Changer le mot de passe"/>
                     </td>
                 </tr>
                 </tbody>
             </table>
         </form>
-	<?php } elseif (isset($_GET["confirmation-mail"])) { ?>
+	<?php }
-	<?php } else { ?>
+} elseif (isset($_GET["confirmation-mail"])) { ?>
+<?php } else { ?>
     <form method="POST">
-			<input type="hidden" name="submitted" value="true" />
+        <input type="hidden" name="submitted" value="true"/>
         <table style="width: 100%;">
             <tr>
                 <td style="width: 30%;"><label for="email">E-mail :</label></td>
-					<td style="width: 70%;"><input  style="width: 100%;" type="email" id="email" name="email" value="<?php if (isset($email)) echo $email ?>" /></td>
+                <td style="width: 70%;"><input style="width: 100%;" type="email" id="email" name="email"
+                                               value="<?php if (isset($email)) echo $email ?>"/></td>
             </tr>
             <tr>
                 <td><label for="password">Mot de passe :</label></td>
-					<td><input style="width: 100%;" type="password" id="password" name="password" /></td>
+                <td><input style="width: 100%;" type="password" id="password" name="password"/></td>
             </tr>
             <tr>
                 <td colspan="2">
@@ -87,11 +91,10 @@ else if (isset($_SESSION["user_id"])) { ?>
                 </td>
             </tr>
             <tr>
-					<td colspan="2"><input style="width: 100%;" type="submit" value="Se connecter" /></td>
+                <td colspan="2"><input style="width: 100%;" type="submit" value="Se connecter"/></td>
             </tr>
         </table>
     </form>
-	<?php } ?>
 <?php } ?>
 
 <?php require_once "footer.php" ?>