servnest
/
servnest
1
1
Fork 0
Code Issues 4 Pull Requests Releases Wiki Activity

Close HTML using function, better error handling

This commit is contained in:
Miraty 2022-05-22 14:59:45 +02:00
parent 12534ee183
commit deb219d758
30 changed files with 118 additions and 119 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
common/bottom.php
View File

@ -1,13 +0,0 @@
</main>
<footer>
<small>
<?php if (isset($_SESSION['username'])) {
echo "Connecté·e en tant que " . $_SESSION['username'] . "<br><a class='authButton' href='" . CONF['common']['prefix'] . "/auth/logout'>Se déconnecter</a>";
} else { ?>
Vous n'êtes pas connecté·e à un compte Niver
<br><a class="authButton" href="<?= CONF['common']['prefix'] ?>/auth/login?redir=<?php if (SERVICE !== "") echo SERVICE . "/"; ?><?= PAGE ?>">Se connecter</a>
<?php } ?>
</small>
</footer>
</body>
</html>

22
common/top.php → common/html.php
View File

@ -9,14 +9,14 @@ function antiCSRF() {
// Session initialisation (with cookies) // Session initialisation (with cookies)
if ( if (
isset($_COOKIE['niver']) // Resume session isset($_COOKIE['niver-session-key']) // Resume session
OR OR
(SERVICE === "auth" // Create new session (SERVICE === "auth" // Create new session
AND (PAGE === "login" OR PAGE === "register") AND (PAGE === "login" OR PAGE === "register")
AND isset($_POST['username'])) AND isset($_POST['username']))
) { ) {
session_start([ session_start([
'name' => 'niver', 'name' => 'niver-session-key',
'sid_length' => 64, 'sid_length' => 64,
'sid_bits_per_character' => 6, 'sid_bits_per_character' => 6,
'cookie_secure' => true, 'cookie_secure' => true,
@ -104,3 +104,21 @@ $cssFileName = Less_Cache::Get($absoluteLessFiles, $options, THEME);
</header> </header>
<main> <main>
<?php
function closeHTML() {
?>
</main>
<footer>
<small>
<?php if (isset($_SESSION['username'])) {
echo "Connecté·e en tant que " . $_SESSION['username'] . "<br><a class='authButton' href='" . CONF['common']['prefix'] . "/auth/logout'>Se déconnecter</a>";
} else { ?>
Vous n'êtes pas connecté·e à un compte Niver
<br><a class="authButton" href="<?= CONF['common']['prefix'] ?>/auth/login?redir=<?php if (SERVICE !== "") echo SERVICE . "/"; ?><?= PAGE ?>">Se connecter</a>
<?php } ?>
</small>
</footer>
</body>
</html>
<?php } ?>

10
common/init.php
View File

@ -16,11 +16,15 @@ if (SERVICE !== "")
require "pages.php"; require "pages.php";
function userError($msg) { function userError($msg) {
http_response_code(422); http_response_code(403);
exit("<strong>User error</strong>: The server refused to process this request: <em>" . $msg . "</em>"); echo "<p><strong>Erreur utilisataire</strong> : <em>" . $msg . "</em></p>";
closeHTML();
exit();
} }
function serverError($msg) { function serverError($msg) {
http_response_code(500); http_response_code(500);
exit("<strong>Server error</strong>: The server encountered an error: <em>" . $msg . "</em>"); echo "<p><strong>Server error</strong>: The server encountered an error: <em>" . $msg . "</em></p>";
closeHTML();
exit();
} }

4
public/auth/index.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<?php if (isset($_SESSION['username'])) { ?> <?php if (isset($_SESSION['username'])) { ?>
@ -14,4 +14,4 @@
<a class="authButton" href="login">Se connecter</a> <a class="authButton" href="login">Se connecter</a>
<?php } ?> <?php } ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

31
public/auth/login.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
<label for="username">Identifiant</label><br> <label for="username">Identifiant</label><br>
@ -24,27 +24,26 @@ if (isset($_POST['username']) AND isset($_POST['password'])) {
checkUsernameFormat($_POST['username']); checkUsernameFormat($_POST['username']);
if (checkPassword($_POST['username'], $_POST['password'])) { if (userExist($_POST['username']) !== true)
userError("Connexion impossible : ce compte n'existe pas.");
$_SESSION['username'] = htmlspecialchars($_POST['username']); if (checkPassword($_POST['username'], $_POST['password']) !== true)
userError("Connexion impossible : clé de passe invalide.");
if (outdatedPasswordHash($_SESSION['username'])) $_SESSION['username'] = $_POST['username'];
changePassword($_SESSION['username'], $_POST['password']);
if (isset($_GET['redir'])) { if (outdatedPasswordHash($_SESSION['username']))
if (preg_match("/^[0-9a-z\/-]+$/", $_GET['redir'])) changePassword($_SESSION['username'], $_POST['password']);
header("Location: " . CONF['common']['prefix'] . "/" . $_GET['redir']);
else if (isset($_GET['redir'])) {
userError("Wrong character in <code>redir</code>."); if (preg_match("/^[0-9a-z\/-]+$/", $_GET['redir']) !== 1)
} else { userError("Wrong character in <code>redir</code>.");
header("Location: " . CONF['common']['prefix'] . "/"); header("Location: " . CONF['common']['prefix'] . "/" . $_GET['redir']);
}
} else { } else {
echo "<br>Connexion impossible : mot de passe invalide"; header("Location: " . CONF['common']['prefix'] . "/");
} }
} }
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/auth/logout.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<?php <?php
session_destroy(); session_destroy();
@ -7,4 +7,4 @@ header('Location: ' . CONF['common']['prefix'] . '/');
exit; exit;
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

25
public/auth/password.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<p> <p>
Vous pouvez ici changer le mot de passe permettant d'accéder à votre compte Niver. Vous pouvez ici changer le mot de passe permettant d'accéder à votre compte Niver.
@ -22,26 +22,21 @@ if (isset($_SESSION['username']) AND isset($_POST['newPassword']) AND isset($_PO
checkPasswordFormat($_POST['newPassword']); checkPasswordFormat($_POST['newPassword']);
if (checkPassword($_SESSION['username'], $_POST['currentPassword'])) { if (checkPassword($_SESSION['username'], $_POST['currentPassword']) !== true)
userError("Changement impossible : clé de passe invalide.");
$username = $_SESSION['username']; $newPassword = hashPassword($_POST['newPassword']);
$newPassword = password_hash($_POST['newPassword'], PASSWORD_DEFAULT);
$db = new PDO('sqlite:' . DB_PATH); $db = new PDO('sqlite:' . DB_PATH);
$stmt = $db->prepare("UPDATE users SET password = :password WHERE username = :username"); $stmt = $db->prepare("UPDATE users SET password = :password WHERE username = :username");
$stmt->bindParam(':username', $username); $stmt->bindParam(':username', $_SESSION['username']);
$stmt->bindParam(':password', $newPassword); $stmt->bindParam(':password', $newPassword);
$stmt->execute();
} else {
echo "<br>Le mot de passe actuel n'est pas bon !";
}
$stmt->execute();
} }
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

6
public/auth/register.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<?php <?php
@ -12,7 +12,7 @@ if (isset($_POST['username']) AND isset($_POST['password'])) {
$userExist = userExist($_POST['username']); $userExist = userExist($_POST['username']);
if (!$userExist) { if ($userExist === false) {
// Setup SFTP directory // Setup SFTP directory
umask(0002); umask(0002);
@ -76,4 +76,4 @@ if (isset($_POST['username']) AND isset($_POST['password'])) {
Déjà un compte ? <a class="authButton" href="login">Se connecter</a> Déjà un compte ? <a class="authButton" href="login">Se connecter</a>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ht/http-onion.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<p> <p>
Ajouter un accès en .onion sur un dossier Ajouter un accès en .onion sur un dossier
</p> </p>
@ -81,4 +81,4 @@ HiddenServicePort 80 [::1]:" . CONF['ht']['internal_onion_http_port'] . "
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ht/https-domain.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<p> <p>
Ajouter un domaine sur un dossier de site<br> Ajouter un domaine sur un dossier de site<br>
@ -67,4 +67,4 @@ if (isset($_POST['domain']) AND isset($_POST['dir']) AND isset($_SESSION['userna
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ht/index.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<p> <p>
Vous avez accès à un espace <abbr title="SSH File Transfert Protocol">SFTP</abbr>. Vous pouvez téléverser vos sites dans <code>/&lt;nom du site&gt;/*</code>. Indiquez les données ci-dessous à votre client <abbr title="SSH File Transfert Protocol">SFTP</abbr> pour y accéder. Vous avez accès à un espace <abbr title="SSH File Transfert Protocol">SFTP</abbr>. Vous pouvez téléverser vos sites dans <code>/&lt;nom du site&gt;/*</code>. Indiquez les données ci-dessous à votre client <abbr title="SSH File Transfert Protocol">SFTP</abbr> pour y accéder.
@ -67,4 +67,4 @@
</dd> </dd>
</dl> </dl>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ht/le.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<p> <p>
Installer un certificat Let's Encrypt Installer un certificat Let's Encrypt
</p> </p>
@ -51,4 +51,4 @@ if (isset($_POST['domain']) AND isset($_SESSION['username'])) {
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/index.php
View File

@ -1,4 +1,4 @@
<?php require "../common/top.php"; ?> <?php require "../common/html.php"; ?>
<dl> <dl>
<dt><a class="regButton" href="reg/">Registre</code></a></dt> <dt><a class="regButton" href="reg/">Registre</code></a></dt>
@ -19,4 +19,4 @@
</dd> </dd>
</dl> </dl>
<?php require "../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/caa.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
@ -49,4 +49,4 @@ if (nsCommonRequirements()
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/dnssec.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
Afin d'activer DNSSEC, vous devez indiquer un enregistrement DS à la zone parente. Afin d'activer DNSSEC, vous devez indiquer un enregistrement DS à la zone parente.
@ -75,4 +75,4 @@ if (isset($_POST['zone']) AND isset($_SESSION['username'])) {
<?php } ?> <?php } ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/index.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<dl> <dl>
<dt><a class="nsButton" href="zone">Gérer ses zones</a></dt> <dt><a class="nsButton" href="zone">Gérer ses zones</a></dt>
@ -58,4 +58,4 @@
</dd>--> </dd>-->
</dl> </dl>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/ip.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<p> <p>
Ici vous pouvez ajouter ou enlever des adresses IP dans une zone déjà enregistrée sur le serveur de noms de Niver Ici vous pouvez ajouter ou enlever des adresses IP dans une zone déjà enregistrée sur le serveur de noms de Niver
@ -30,4 +30,4 @@ if (nsCommonRequirements()
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/loc.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
@ -49,4 +49,4 @@ if (nsCommonRequirements()
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/mx.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
@ -42,4 +42,4 @@ if (nsCommonRequirements()
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/ns.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
<?php require "../../form.ns.php"; ?> <?php require "../../form.ns.php"; ?>
@ -27,4 +27,4 @@ if (nsCommonRequirements()
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/srv.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
@ -62,4 +62,4 @@ if (nsCommonRequirements()
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/sshfp.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
@ -59,4 +59,4 @@ if (nsCommonRequirements()
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/tlsa.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
@ -75,4 +75,4 @@ if (nsCommonRequirements()
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/txt.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
<?php require "../../form.ns.php"; ?> <?php require "../../form.ns.php"; ?>
@ -28,4 +28,4 @@ if (nsCommonRequirements()
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/ns/zone.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
<h2>Ajouter une zone</h2> <h2>Ajouter une zone</h2>
@ -91,4 +91,4 @@ if (isset($_POST['zone']) AND isset($_SESSION['username'])) {
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/reg/ds.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
<label for="action">Action</label> <label for="action">Action</label>
@ -104,4 +104,4 @@ if (isset($_POST['zone']) AND isset($_POST['keytag']) AND isset($_POST['algo'])
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/reg/glue.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
<label for="action">Action</label> <label for="action">Action</label>
@ -66,4 +66,4 @@ if (isset($_POST['action']) AND isset($_POST['subdomain']) AND isset($_POST['suf
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

4
public/reg/index.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<dl> <dl>
<dt><a class="regButton" href="register">Enregistrer un nouveau domaine</a></dt> <dt><a class="regButton" href="register">Enregistrer un nouveau domaine</a></dt>
@ -19,4 +19,4 @@
</dd> </dd>
</dl> </dl>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

5
public/reg/ns.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
<form method="post"> <form method="post">
<label for="action">Action</label> <label for="action">Action</label>
@ -49,6 +49,7 @@ if (isset($_POST['domain']) AND isset($_POST['action']) AND isset($_POST['ns'])
exec(CONF['reg']['knotc_path'] . " zone-" . $action . "set " . $suffix . " " . $_POST['domain'] . " 86400 IN NS " . $_POST['ns'], $output); exec(CONF['reg']['knotc_path'] . " zone-" . $action . "set " . $suffix . " " . $_POST['domain'] . " 86400 IN NS " . $_POST['ns'], $output);
exec(CONF['reg']['knotc_path'] . " zone-commit " . $suffix, $output); exec(CONF['reg']['knotc_path'] . " zone-commit " . $suffix, $output);
$error = false; $error = false;
var_dump($output);
foreach ($output as $line) { foreach ($output as $line) {
if ($line !== "OK") { if ($line !== "OK") {
$error = true; $error = true;
@ -63,4 +64,4 @@ if (isset($_POST['domain']) AND isset($_POST['action']) AND isset($_POST['ns'])
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>

37
public/reg/register.php
View File

@ -1,4 +1,4 @@
<?php require "../../common/top.php"; ?> <?php require "../../common/html.php"; ?>
Enregistrer la possession d'un domaine sur son compte.<br> Enregistrer la possession d'un domaine sur son compte.<br>
Ce domaine doit être composé uniquement d'au moins 4 lettres latines non accentuées. Ce domaine doit être composé uniquement d'au moins 4 lettres latines non accentuées.
@ -19,35 +19,30 @@ if (isset($_POST['subdomain']) AND isset($_SESSION['username'])) {
antiCSRF(); antiCSRF();
if (preg_match("/" . CONF['reg']['subdomain_regex'] . "/", $_POST['subdomain'])) { if (preg_match("/" . CONF['reg']['subdomain_regex'] . "/", $_POST['subdomain']) !== 1)
userError("Erreur : Le nom de domaine doit être composé uniquement d'entre 4 et 63 lettres minuscules (a-z)");
$domain = $_POST['subdomain'] . "." . CONF['reg']['registry']; $domain = $_POST['subdomain'] . "." . CONF['reg']['registry'];
checkAbsoluteDomainFormat($domain); checkAbsoluteDomainFormat($domain);
if (regIsFree($domain)) { if (regIsFree($domain) !== true)
$db = new PDO('sqlite:' . DB_PATH); userError("Ce domaine n'est pas disponible à l'enregistrement. Il est réservé ou déjà enregistré.");
$stmt = $db->prepare("INSERT INTO registry(domain, username, last_renewal) VALUES(:domain, :username, :last_renewal)");
$username = $_SESSION['username'];
$time = date("Y-m-d H:i:s"); $db = new PDO('sqlite:' . DB_PATH);
$stmt = $db->prepare("INSERT INTO registry(domain, username, last_renewal) VALUES(:domain, :username, :last_renewal)");
$stmt->bindParam(':domain', $domain); $time = date("Y-m-d H:i:s");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':last_renewal', $time);
$stmt->execute(); $stmt->bindParam(':domain', $domain);
$stmt->bindParam(':username', $_SESSION['username']);
$stmt->bindParam(':last_renewal', $time);
echo "Nouveau domaine enregistré"; $stmt->execute();
} else { echo "Nouveau domaine enregistré";
echo "Le domaine " . $domain . " n'est pas disponible à l'enregistrement. Il est réservé ou déjà enregistré.";
}
} else {
echo "Erreur : Le nom de domaine doit être composé uniquement d'entre 4 et 63 lettres minuscules (a-z)";
}
} }
?> ?>
<?php require "../../common/bottom.php"; ?> <?php closeHTML(); ?>