The Joomla! Forum ™



Forum rules


Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.



Post new topic Reply to topic  [ 11 posts ] 
Author Message
PostPosted: Tue Feb 15, 2011 11:42 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Tue Feb 15, 2011 11:18 am
Posts: 6
Hello Joomla Forum,

I've been trying for hours to make what I thought would be a simple modification to User Layout From. option=com_user&view=user&layout=form

I want to allow users to only change passwords. I would like the Username and E-Mail displayed, but not allow users to modify.

I have tried several methods, including edits to the following files:

/com_user/views/user/tmpl/default.php
/com_user/views/user/tmpl/form.php
/com_user/views/register/tmpl/default.php

I have been trying to edit the following code and make it readonly:

Code:
<input type="text" name="name" id="name" size="40" value="<?php echo $this->escape($this->user->get( 'name' ));?>" class="inputbox required" maxlength="50" />


Can someone please help me with the file that needs modifying and the syntax required to make the fields read only.

I understand that this will be a core hack, however I would just like to test results and then I will create a template over ride.

Also - I do not allow front-end user registrations - so a mod of the registration form is OK.

Thanks!
Albert


Top
 Profile  
 
PostPosted: Tue Feb 15, 2011 12:10 pm 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Fri Sep 22, 2006 6:22 pm
Posts: 1823
Location: UK
Albert, as you point out, the best method for this would be a template override.
Also, it is quite a simple change, although Im not sure if you are trying to affect the email or name field (your code snippet is of the name field)
Anyway, the principles are the same:
1) copy /components/com_user/views/user/tmpl/form.php to /templates/<your template>/html/com_user/user
2) Find the field you want to change. If you want the value to show, but not be editable, then just change the code from
Code:
<input type="text" name="name" id="name" size="40" value="<?php echo $this->escape($this->user->get( 'name' ));?>" class="inputbox required" maxlength="50" />

to
Code:
<?php echo $this->escape($this->user->get( 'name' ));?>


So that will still show the username to the user, but of course, not in a field (hence read only)

Keep in mind that you will then have to add (ideally, somewhere near the closing </form> tag) the username in a hidden field
Code:
<input type="hidden" name="name" value="<?php echo $this->escape($this->user->get( 'name' ));?>">


Then when the user presses submit, joomla will think the name has been entered, but of course it wont have been edited!

Good luck!

_________________
EmailAsUsername - Remove Usernames Joomla! Virtuemart And JomSocial registration http://www.lunarhotel.co.uk Many other extensions supported.
RsJoomla! RsForms RsMembership http://www.lunarhotel.co.uk/rsjoomla.php


Top
 Profile  
 
PostPosted: Tue Feb 15, 2011 5:15 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Tue Feb 15, 2011 11:18 am
Posts: 6
Awesome - Thanks Dylan,

Coincidentally, I purchased your EmailAsUsername extension and this is the primary reason I trying to accomplish this.

The code snippet I posted was misleading - however you fully understood. So, I followed your directions, and had a good result. The changes I made now serve a form that allows the User to only change the password while the UN and Name are displayed.

This will work - however, to make it perfect I'd like to have the user have to validate their current password.

Modifications made to
Code:
<?php // no direct access
defined('_JEXEC') or die('Restricted access'); ?>

<script type="text/javascript">
<!--
   Window.onDomReady(function(){
      document.formvalidator.setHandler('passverify', function (value) { return ($('password').value == value); }   );
   });
// -->
</script>

<form action="<?php echo JRoute::_( 'index.php' ); ?>" method="post" name="userform" autocomplete="off" class="form-validate">
<?php if ( $this->params->def( 'show_page_title', 1 ) ) : ?>
   <div class="componentheading<?php echo $this->escape($this->params->get('pageclass_sfx')); ?>">
      <?php echo $this->escape($this->params->get('page_title')); ?>
   </div>
<?php endif; ?>
<table cellpadding="5" cellspacing="0" border="0" width="100%">
<tr>
   <td>
      <label for="username">
         <?php echo JText::_( 'User Name' ); ?>:
      </label>
   </td>
   <td>
      <span><?php echo $this->user->get('username');?></span>
   </td>
</tr>
<tr>
   <td width="120">
      <label for="name">
         <?php echo JText::_( 'Your Name' ); ?>:
      </label>
   </td>
   <td>
      
<?php echo $this->escape($this->user->get( 'name' ));?>
   </td>
</tr>
<tr>
   <td>
      <label for="email">
         <?php echo JText::_( 'email' ); ?>:
      </label>
   </td>
   <td>
   <?php echo $this->escape($this->user->get( 'email' ));?>
   </td>
</tr>
<?php if($this->user->get('password')) : ?>
<tr>
   <td>
      <label for="password">
         <?php echo JText::_( 'Password' ); ?>:
      </label>
   </td>
   <td>
      <input class="inputbox validate-password" type="password" id="password" name="password" value="" size="40" />
   </td>
</tr>
<tr>
   <td>
      <label for="password2">
         <?php echo JText::_( 'Verify Password' ); ?>:
      </label>
   </td>
   <td>
      <input class="inputbox validate-passverify" type="password" id="password2" name="password2" size="40" />
   </td>
</tr>
<?php endif; ?>
</table>
<?php if(isset($this->params)) :  echo $this->params->render( 'params' ); endif; ?>
   <button class="button validate" type="submit" onclick="submitbutton( this.form );return false;"><?php echo JText::_('Save'); ?></button>

   <input type="hidden" name="username" value="<?php echo $this->user->get('username');?>" />
   <input type="hidden" name="email" value="<?php echo $this->user->get('email');?>" />   
   <input type="hidden" name="name" value="<?php echo $this->user->get('name');?>" />      
   <input type="hidden" name="id" value="<?php echo $this->user->get('id');?>" />
   <input type="hidden" name="gid" value="<?php echo $this->user->get('gid');?>" />
   <input type="hidden" name="option" value="com_user" />
   <input type="hidden" name="task" value="save" />
   <?php echo JHTML::_( 'form.token' ); ?>
</form>


Any idea what I can add to to force the user to enter their current password?

Thank you so much for your help. And BTW your Email as Username Extension works like a charm! I will be sure to rate it on JED.

Albert


Top
 Profile  
 
PostPosted: Tue Feb 15, 2011 9:45 pm 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Fri Sep 22, 2006 6:22 pm
Posts: 1823
Location: UK
Ah! Excellent. Im glad you like it Albert. Yes, A JED review would be very much appreciated. Now then, getting the user to enter thier current password is a bit more involved.
You see for starters, Joomla! doesnt store users passwords either in clear text, or in an excryption that can be reversed (md5) as such, you would need to encrypt the users input, and make sure that they matched, returning an error message if not.
Now this is beyond what should normally be put in the template file (which is what we are editing here) and So, would have to go into the controller.php of com_user.

Looking at the code, it appears that function save is called when the form is submitted. So thats where we'd need to add the code to check, and of course, the code to check the password is correct should be found in the Joomla authentication plugin:

Code:
      // Joomla does not like blank passwords
      if (empty($credentials['password']))
      {
         $response->status = JAUTHENTICATE_STATUS_FAILURE;
         $response->error_message = 'Empty password not allowed';
         return false;
      }

      // Initialize variables
      $conditions = '';

      // Get a database object
      $db =& JFactory::getDBO();

      $query = 'SELECT `id`, `password`, `gid`'
         . ' FROM `#__users`'
         . ' WHERE username=' . $db->Quote( $credentials['username'] )
         ;
      $db->setQuery( $query );
      $result = $db->loadObject();


      if($result)
      {
         $parts   = explode( ':', $result->password );
         $crypt   = $parts[0];
         $salt   = @$parts[1];
         $testcrypt = JUserHelper::getCryptedPassword($credentials['password'], $salt);

         if ($crypt == $testcrypt) {
            $user = JUser::getInstance($result->id); // Bring this in line with the rest of the system
            $response->email = $user->email;
            $response->fullname = $user->name;
            $response->status = JAUTHENTICATE_STATUS_SUCCESS;
            $response->error_message = '';
         } else {
            $response->status = JAUTHENTICATE_STATUS_FAILURE;
            $response->error_message = 'Invalid password';
         }
      }
      else
      {


So we can see near the top, we're checking that the user has entered a password.
Where it says "$db->Quote( $credentials['username'] )" you'll want to replace this with the current logged in user's username
Code:
$user = JFactory::getUser();
$username = $user->username;


have a look at this for what more info you can get from the user object (sadly, password isnt one of them!!)
http://docs.joomla.org/JFactory/getUser

Further down where the line starts "$testcrypt = JUserHelper... " you'll want to replace $credentials['password'] with the value the user entered in the form... retrievable with JRequest::get("password","POST") or something like

Then at the if ($crypt == $testcrypt) { comparrison, you'd probably only want to tell your user about it if it was wrong (of course:
Code:
if ($crypt != $testcrypt) {
)

You can do this by enquing a message:

Code:
$app =& JFactory::getApplication();
$app->enqueueMessage( "You entered the wrong password" );

then a mainframe redirect to the original page.

Phew! :pop

_________________
EmailAsUsername - Remove Usernames Joomla! Virtuemart And JomSocial registration http://www.lunarhotel.co.uk Many other extensions supported.
RsJoomla! RsForms RsMembership http://www.lunarhotel.co.uk/rsjoomla.php


Top
 Profile  
 
PostPosted: Tue Feb 15, 2011 9:56 pm 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Fri Sep 22, 2006 6:22 pm
Posts: 1823
Location: UK
Just remembered, you may also need to include the user helper, if its not already

Code:
jimport('joomla.user.helper');

_________________
EmailAsUsername - Remove Usernames Joomla! Virtuemart And JomSocial registration http://www.lunarhotel.co.uk Many other extensions supported.
RsJoomla! RsForms RsMembership http://www.lunarhotel.co.uk/rsjoomla.php


Top
 Profile  
 
PostPosted: Wed Feb 16, 2011 1:18 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Tue Feb 15, 2011 11:18 am
Posts: 6
Hi Dylan,

Thank you so much for the detailed instructions - I know how time consuming and boring it is. Although I learn more about PHP everyday - I'm pretty much at the cut and paste level.

I followed your instructions as best I could - but apparently not as well as I should have. So now essentially the form.php is the same as before - however with exposed php code.

You can check it out at: http://nectarcorp.com/albert_sandbox/ - you can login as: Albert/1234

when you navigate to "User Form Layout" you will see the out I am referring to.
Code:
<?php // no direct access
defined('_JEXEC') or die('Restricted access'); ?>

<script type="text/javascript">
<!--
   Window.onDomReady(function(){
      document.formvalidator.setHandler('passverify', function (value) { return ($('password').value == value); }   );
   });
// -->
</script>

<form action="<?php echo JRoute::_( 'index.php' ); ?>" method="post" name="userform" autocomplete="off" class="form-validate">
<?php if ( $this->params->def( 'show_page_title', 1 ) ) : ?>
   <div class="componentheading<?php echo $this->escape($this->params->get('pageclass_sfx')); ?>">
      <?php echo $this->escape($this->params->get('page_title')); ?>
   </div>
<?php endif; ?>
<table cellpadding="5" cellspacing="0" border="0" width="100%">
<tr>
   <td>
      <label for="username">
         <?php echo JText::_( 'User Name' ); ?>:
      </label>
   </td>
   <td>
      <span><?php echo $this->user->get('username');?></span>
   </td>
</tr>
<tr>
   <td width="120">
      <label for="name">
         <?php echo JText::_( 'Your Name' ); ?>:
      </label>
   </td>
   <td>
     
<?php echo $this->escape($this->user->get( 'name' ));?>
   </td>
</tr>
<tr>
   <td>
      <label for="email">
         <?php echo JText::_( 'email' ); ?>:
      </label>
   </td>
   <td>
   <?php echo $this->escape($this->user->get( 'email' ));?>
   </td>
</tr>
<?php if($this->user->get('password')) : ?>
<tr>
   <td>
      <label for="password">
         <?php echo JText::_( 'Password' ); ?>:
      </label>
   </td>
   <td>
      <input class="inputbox validate-password" type="password" id="password" name="password" value="" size="40" />
   </td>
</tr>
<tr>
   <td>
      <label for="password2">
         <?php echo JText::_( 'Verify Password' ); ?>:
      </label>
   </td>
   <td>
      <input class="inputbox validate-passverify" type="password" id="password2" name="password2" size="40" />
   </td>
</tr>
<?php endif; ?>
</table>
<?php if(isset($this->params)) :  echo $this->params->render( 'params' ); endif; ?>
   <button class="button validate" type="submit" onclick="submitbutton( this.form );return false;"><?php echo JText::_('Save'); ?></button>
// Joomla does not like blank passwords
      if (empty($credentials['password']))
      {
         $response->status = JAUTHENTICATE_STATUS_FAILURE;
         $response->error_message = 'Empty password not allowed';
         return false;
      }

      // Initialize variables
      $conditions = '';

      // Get a database object
      $db =& JFactory::getDBO();

      $query = 'SELECT `id`, `password`, `gid`'
         . ' FROM `#__users`'
         . ' WHERE username=' . $user = JFactory::getUser();
$username = $user->username;
      $db->setQuery( $query );
      $result = $db->loadObject();


      if($result)
      {
         $parts   = explode( ':', $result->password );
         $crypt   = $parts[0];
         $salt   = @$parts[1];
         $testcrypt = JUserHelper::getCryptedPassword(JRequest::get("password","POST")

        if ($crypt != $testcrypt) {
            $user = JUser::getInstance($result->id); // Bring this in line with the rest of the system
            $response->email = $user->email;
            $response->fullname = $user->name;
            $response->status = JAUTHENTICATE_STATUS_SUCCESS;
            $response->error_message = '';
         } else {
            $response->status = JAUTHENTICATE_STATUS_FAILURE;
            $response->error_message = 'Invalid password';
         }
      }
      else
      {
   <input type="hidden" name="username" value="<?php echo $this->user->get('username');?>" />
   <input type="hidden" name="email" value="<?php echo $this->user->get('email');?>" />   
   <input type="hidden" name="name" value="<?php echo $this->user->get('name');?>" />     
   <input type="hidden" name="id" value="<?php echo $this->user->get('id');?>" />
   <input type="hidden" name="gid" value="<?php echo $this->user->get('gid');?>" />
   <input type="hidden" name="option" value="com_user" />
   <input type="hidden" name="task" value="save" />
$app =& JFactory::getApplication();
$app->enqueueMessage( "You entered the wrong password" );<?php echo JHTML::_( 'form.token' ); ?>

</form>


I hadn't thought to test the original modifications I made - but you were 100% correct. The form successfully submitted with blank passwords.

At this point - I do not care if the user does not have to enter their current pasword. The site will not contain any content that need to be so secure - and its a fair assumption that if someone is logged in, they have successfully entered a correct password.

So the only thing I need to correct is the blank pasword issue.

What do you say - can you help me out one more time? :-[


Top
 Profile  
 
PostPosted: Wed Feb 16, 2011 9:12 am 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Fri Sep 22, 2006 6:22 pm
Posts: 1823
Location: UK
At the moment,
Im getting this:
Code:
Fatal error: Can't use function return value in write context in /home/content/23/5831523/html/albert_sandbox/components/com_user/views/user/tmpl/form.php on line 74

_________________
EmailAsUsername - Remove Usernames Joomla! Virtuemart And JomSocial registration http://www.lunarhotel.co.uk Many other extensions supported.
RsJoomla! RsForms RsMembership http://www.lunarhotel.co.uk/rsjoomla.php


Top
 Profile  
 
PostPosted: Wed Feb 16, 2011 10:14 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Tue Feb 15, 2011 11:18 am
Posts: 6
Sorry Dylan,

A friend of mine is working on it. I was just getting ready to post about it but did not get a chance to. The change he made to the form.php that is returning the fatal error si as follows:
Code:
<?php // no direct access
defined('_JEXEC') or die('Restricted access'); ?>

<script type="text/javascript">
<!--
   Window.onDomReady(function(){
      document.formvalidator.setHandler('passverify', function (value) { return ($('password').value == value); }   );
   });
// -->
</script>

<form action="<?php echo JRoute::_( 'index.php' ); ?>" method="post" name="userform" autocomplete="off" class="form-validate">
<?php if ( $this->params->def( 'show_page_title', 1 ) ) : ?>
   <div class="componentheading<?php echo $this->escape($this->params->get('pageclass_sfx')); ?>">
      <?php echo $this->escape($this->params->get('page_title')); ?>
   </div>
<?php endif; ?>
<table cellpadding="5" cellspacing="0" border="0" width="100%">
<tr>
   <td>
      <label for="username">
         <?php echo JText::_( 'User Name' ); ?>:
      </label>
   </td>
   <td>
      <span><?php echo $this->user->get('username');?></span>
   </td>
</tr>
<tr>
   <td width="120">
      <label for="name">
         <?php echo JText::_( 'Your Name' ); ?>:
      </label>
   </td>
   <td>
      <?php echo $this->escape($this->user->get( 'name' ));?>
   </td>
</tr>
<tr>
   <td>
      <label for="email">
         <?php echo JText::_( 'email' ); ?>:
      </label>
   </td>
   <td>
      <?php echo $this->escape($this->user->get( 'email' ));?>
   </td>
</tr>
<?php if($this->user->get('password')) { ?>
<tr>
   <td>
      <label for="password">
         <?php echo JText::_( 'Password' ); ?>:
      </label>
   </td>
   <td>
      <input class="inputbox validate-password" type="password" id="password" name="password" value="" size="40" />
   </td>
</tr>
<tr>
   <td>
      <label for="password2">
         <?php echo JText::_( 'Verify Password' ); ?>:
      </label>
   </td>
   <td>
      <input class="inputbox validate-passverify" type="password" id="password2" name="password2" size="40" />
   </td>
</tr>
<?php } ?>
</table>
<?php if(isset($this->params)) { echo $this->params->render( 'params' ); } ?>
   <button class="button validate" type="submit" onclick="submitbutton( this.form );return false;"><?php echo JText::_('Save'); ?></button>
   <?php if(empty($credentials['password'])) {
         $response->status = JAUTHENTICATE_STATUS_FAILURE;
         $response->error_message = 'Empty password not allowed';
         return false;
      } ?>

   <input type="hidden" name="username" value="<?php echo $this->user->get('username');?>" />
   <input type="hidden" name="id" value="<?php echo $this->user->get('id');?>" />
   <input type="hidden" name="gid" value="<?php echo $this->user->get('gid');?>" />
   <input type="hidden" name="option" value="com_user" />
   <input type="hidden" name="task" value="save" />
   <?php echo JHTML::_( 'form.token' ); ?>
</form>


Top
 Profile  
 
PostPosted: Wed Feb 16, 2011 10:16 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Tue Feb 15, 2011 11:18 am
Posts: 6
Another note - he told me the following:

The problem with the form is going to be in the controller file <Joomla root>/components/com_user/controller.php

He's working on it now.


Top
 Profile  
 
PostPosted: Wed Feb 16, 2011 10:51 am 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Fri Sep 22, 2006 6:22 pm
Posts: 1823
Location: UK
Ok, Well the user layout looks good so far. You have both password fields back.

_________________
EmailAsUsername - Remove Usernames Joomla! Virtuemart And JomSocial registration http://www.lunarhotel.co.uk Many other extensions supported.
RsJoomla! RsForms RsMembership http://www.lunarhotel.co.uk/rsjoomla.php


Top
 Profile  
 
 Post subject: Joomls FIles we hacked
PostPosted: Wed Feb 16, 2011 7:45 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Tue Feb 15, 2011 11:18 am
Posts: 6
Modification to: <Joomla root>/components/com_user/views/user/tmpl/form.php


Code:
<?php // no direct access
defined('_JEXEC') or die('Restricted access'); ?>

<script type="text/javascript">
<!--
   Window.onDomReady(function(){
      document.formvalidator.setHandler('passverify', function (value) { return ($('password').value == value); }   );
   });
// -->
</script>

<form action="<?php echo JRoute::_( 'index.php' ); ?>" method="post" name="userform" autocomplete="off" class="form-validate">
<?php if ( $this->params->def( 'show_page_title', 1 ) ) : ?>
   <div class="componentheading<?php echo $this->escape($this->params->get('pageclass_sfx')); ?>">
      <?php echo $this->escape($this->params->get('page_title')); ?>
   </div>
<?php endif; ?>
<table cellpadding="5" cellspacing="0" border="0" width="100%">
<tr>
   <td>
      <label for="username">
         <?php echo JText::_( 'User Name' ); ?>:
      </label>
   </td>
   <td>
      <span><?php echo $this->user->get('username');?></span>
   </td>
</tr>
<tr>
   <td width="120">
      <label for="name">
         <?php echo JText::_( 'Your Name' ); ?>:
      </label>
   </td>
   <td>
      <?php echo $this->escape($this->user->get( 'name' ));?>
   </td>
</tr>
<tr>
   <td>
      <label for="email">
         <?php echo JText::_( 'email' ); ?>:
      </label>
   </td>
   <td>
      <?php echo $this->escape($this->user->get( 'email' ));?>
   </td>
</tr>
<?php if($this->user->get('password')) { ?>
<tr>
   <td>
      <label for="password">
         <?php echo JText::_( 'Password' ); ?>:
      </label>
   </td>
   <td>
      <input class="inputbox validate-password" type="password" id="password" name="password" value="" size="40" />
   </td>
</tr>
<tr>
   <td>
      <label for="password2">
         <?php echo JText::_( 'Verify Password' ); ?>:
      </label>
   </td>
   <td>
      <input class="inputbox validate-passverify" type="password" id="password2" name="password2" size="40" />
   </td>
</tr>
<?php } ?>
</table>
<?php if(isset($this->params)) { echo $this->params->render( 'params' ); } ?>
   <button class="button validate" type="submit" onclick="submitbutton( this.form );return false;"><?php echo JText::_('Save'); ?></button>

   <input type="hidden" name="username" value="<?php echo $this->user->get('username');?>" />
   <input type="hidden" name="id" value="<?php echo $this->user->get('id');?>" />
   <input type="hidden" name="gid" value="<?php echo $this->user->get('gid');?>" />
   <input type="hidden" name="option" value="com_user" />
   <input type="hidden" name="task" value="save" />
   <?php echo JHTML::_( 'form.token' ); ?>
</form>



Modification to <Joomla root>/components/com_user/controller.php


Code:
<?php
/**
 * @version      $Id: controller.php 16385 2010-04-23 10:44:15Z ian $
 * @package      Joomla
 * @subpackage   Content
 * @copyright   Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved.
 * @license      GNU/GPL, see LICENSE.php
 * Joomla! is free software. This version may have been modified pursuant to the
 * GNU General Public License, and as distributed it includes or is derivative
 * of works licensed under the GNU General Public License or other free or open
 * source software licenses. See COPYRIGHT.php for copyright notices and
 * details.
 */

// Check to ensure this file is included in Joomla!
defined('_JEXEC') or die( 'Restricted access' );

jimport('joomla.application.component.controller');

/**
 * User Component Controller
 *
 * @package      Joomla
 * @subpackage   Weblinks
 * @since 1.5
 */
class UserController extends JController
{
   /**
    * Method to display a view
    *
    * @access   public
    * @since   1.5
    */
   function display()
   {
      parent::display();
   }

   function edit()
   {
      global $mainframe, $option;

      $db      =& JFactory::getDBO();
      $user   =& JFactory::getUser();

      if ( $user->get('guest')) {
         JError::raiseError( 403, JText::_('Access Forbidden') );
         return;
      }

      JRequest::setVar('layout', 'form');

      parent::display();
   }

   function save()
   {
      // Check for request forgeries
      JRequest::checkToken() or jexit( 'Invalid Token' );

      $user    =& JFactory::getUser();
      $userid = JRequest::getVar( 'id', 0, 'post', 'int' );

      // preform security checks
      if ($user->get('id') == 0 || $userid == 0 || $userid <> $user->get('id')) {
         JError::raiseError( 403, JText::_('Access Forbidden') );
         return;
      }

      //clean request
      $post = JRequest::get( 'post' );
      $post['username']   = JRequest::getVar('username', '', 'post', 'username');
      $post['password']   = JRequest::getVar('password', '', 'post', 'string', JREQUEST_ALLOWRAW);
      $post['password2']   = JRequest::getVar('password2', '', 'post', 'string', JREQUEST_ALLOWRAW);
   
      // get the redirect
      $return = JURI::base();
      
      // do a password safety check
      if(strlen($post['password']) || strlen($post['password2'])) { // so that "0" can be used as password e.g.
         if($post['password'] != $post['password2']) {
            $msg   = JText::_('PASSWORDS_DO_NOT_MATCH');
            // something is wrong. we are redirecting back to edit form.
            // TODO: HTTP_REFERER should be replaced with a base64 encoded form field in a later release
            $return = str_replace(array('"', '<', '>', "'"), '', @$_SERVER['HTTP_REFERER']);
            if (empty($return) || !JURI::isInternal($return)) {
               $return = JURI::base();
            }
            $this->setRedirect($return, $msg, 'error');
            return false;
         }
      }

      if (empty($post['password']) || empty($post['password2'])) {
         $msg = JText::_('Empty password not allowed');
         $return = str_replace(array('"', '<', '>', "'"), '', @$_SERVER['HTTP_REFERER']);
         if (empty($return) || !JURI::isInternal($return)) {
            $return = JURI::base();
         }
         $this->setRedirect($return, $msg, 'error');
         return false;
      }

      // we don't want users to edit certain fields so we will unset them
      unset($post['gid']);
      unset($post['block']);
      unset($post['usertype']);
      unset($post['registerDate']);
      unset($post['activation']);

      // store data
      $model = $this->getModel('user');

      if ($model->store($post)) {
         $msg   = JText::_( 'Your settings have been saved.' );
      } else {
         //$msg   = JText::_( 'Error saving your settings.' );
         $msg   = $model->getError();
      }

      
      $this->setRedirect( $return, $msg );
   }

   function cancel()
   {
      $this->setRedirect( 'index.php' );
   }

   function login()
   {
      // Check for request forgeries
      JRequest::checkToken('request') or jexit( 'Invalid Token' );

      global $mainframe;

      if ($return = JRequest::getVar('return', '', 'method', 'base64')) {
         $return = base64_decode($return);
         if (!JURI::isInternal($return)) {
            $return = '';
         }
      }

      $options = array();
      $options['remember'] = JRequest::getBool('remember', false);
      $options['return'] = $return;

      $credentials = array();
      $credentials['username'] = JRequest::getVar('username', '', 'method', 'username');
      $credentials['password'] = JRequest::getString('passwd', '', 'post', JREQUEST_ALLOWRAW);

      //preform the login action
      $error = $mainframe->login($credentials, $options);

      if(!JError::isError($error))
      {
         // Redirect if the return url is not registration or login
         if ( ! $return ) {
            $return   = 'index.php?option=com_user';
         }

         $mainframe->redirect( $return );
      }
      else
      {
         // Facilitate third party login forms
         if ( ! $return ) {
            $return   = 'index.php?option=com_user&view=login';
         }

         // Redirect to a login form
         $mainframe->redirect( $return );
      }
   }

   function logout()
   {
      global $mainframe;

      //preform the logout action
      $error = $mainframe->logout();

      if(!JError::isError($error))
      {
         if ($return = JRequest::getVar('return', '', 'method', 'base64')) {
            $return = base64_decode($return);
            if (!JURI::isInternal($return)) {
               $return = '';
            }
         }

         // Redirect if the return url is not registration or login
         if ( $return && !( strpos( $return, 'com_user' )) ) {
            $mainframe->redirect( $return );
         }
      } else {
         parent::display();
      }
   }

   /**
    * Prepares the registration form
    * @return void
    */
   function register()
   {
      $usersConfig = &JComponentHelper::getParams( 'com_users' );
      if (!$usersConfig->get( 'allowUserRegistration' )) {
         JError::raiseError( 403, JText::_( 'Access Forbidden' ));
         return;
      }

      $user    =& JFactory::getUser();

      if ( $user->get('guest')) {
         JRequest::setVar('view', 'register');
      } else {
         $this->setredirect('index.php?option=com_user&task=edit',JText::_('You are already registered.'));
      }

      parent::display();
   }

   /**
    * Save user registration and notify users and admins if required
    * @return void
    */
   function register_save()
   {
      global $mainframe;

      // Check for request forgeries
      JRequest::checkToken() or jexit( 'Invalid Token' );

      // Get required system objects
      $user       = clone(JFactory::getUser());
      $pathway    =& $mainframe->getPathway();
      $config      =& JFactory::getConfig();
      $authorize   =& JFactory::getACL();
      $document   =& JFactory::getDocument();

      // If user registration is not allowed, show 403 not authorized.
      $usersConfig = &JComponentHelper::getParams( 'com_users' );
      if ($usersConfig->get('allowUserRegistration') == '0') {
         JError::raiseError( 403, JText::_( 'Access Forbidden' ));
         return;
      }

      // Initialize new usertype setting
      $newUsertype = $usersConfig->get( 'new_usertype' );
      if (!$newUsertype) {
         $newUsertype = 'Registered';
      }

      // Bind the post array to the user object
      if (!$user->bind( JRequest::get('post'), 'usertype' )) {
         JError::raiseError( 500, $user->getError());
      }

      // Set some initial user values
      $user->set('id', 0);
      $user->set('usertype', $newUsertype);
      $user->set('gid', $authorize->get_group_id( '', $newUsertype, 'ARO' ));

      $date =& JFactory::getDate();
      $user->set('registerDate', $date->toMySQL());

      // If user activation is turned on, we need to set the activation information
      $useractivation = $usersConfig->get( 'useractivation' );
      if ($useractivation == '1')
      {
         jimport('joomla.user.helper');
         $user->set('activation', JUtility::getHash( JUserHelper::genRandomPassword()) );
         $user->set('block', '1');
      }

      // If there was an error with registration, set the message and display form
      if ( !$user->save() )
      {
         JError::raiseWarning('', JText::_( $user->getError()));
         $this->register();
         return false;
      }

      // Send registration confirmation mail
      $password = JRequest::getString('password', '', 'post', JREQUEST_ALLOWRAW);
      $password = preg_replace('/[\x00-\x1F\x7F]/', '', $password); //Disallow control chars in the email
      UserController::_sendMail($user, $password);

      // Everything went fine, set relevant message depending upon user activation state and display message
      if ( $useractivation == 1 ) {
         $message  = JText::_( 'REG_COMPLETE_ACTIVATE' );
      } else {
         $message = JText::_( 'REG_COMPLETE' );
      }

      $this->setRedirect('index.php', $message);
   }

   function activate()
   {
      global $mainframe;

      // Initialize some variables
      $db         =& JFactory::getDBO();
      $user       =& JFactory::getUser();
      $document   =& JFactory::getDocument();
      $pathway    =& $mainframe->getPathWay();

      $usersConfig = &JComponentHelper::getParams( 'com_users' );
      $userActivation         = $usersConfig->get('useractivation');
      $allowUserRegistration   = $usersConfig->get('allowUserRegistration');

      // Check to see if they're logged in, because they don't need activating!
      if ($user->get('id')) {
         // They're already logged in, so redirect them to the home page
         $mainframe->redirect( 'index.php' );
      }

      if ($allowUserRegistration == '0' || $userActivation == '0') {
         JError::raiseError( 403, JText::_( 'Access Forbidden' ));
         return;
      }

      // create the view
      require_once (JPATH_COMPONENT.DS.'views'.DS.'register'.DS.'view.html.php');
      $view = new UserViewRegister();

      $message = new stdClass();

      // Do we even have an activation string?
      $activation = JRequest::getVar('activation', '', '', 'alnum' );
      $activation = $db->getEscaped( $activation );

      if (empty( $activation ))
      {
         // Page Title
         $document->setTitle( JText::_( 'REG_ACTIVATE_NOT_FOUND_TITLE' ) );
         // Breadcrumb
         $pathway->addItem( JText::_( 'REG_ACTIVATE_NOT_FOUND_TITLE' ));

         $message->title = JText::_( 'REG_ACTIVATE_NOT_FOUND_TITLE' );
         $message->text = JText::_( 'REG_ACTIVATE_NOT_FOUND' );
         $view->assign('message', $message);
         $view->display('message');
         return;
      }

      // Lets activate this user
      jimport('joomla.user.helper');
      if (JUserHelper::activateUser($activation))
      {
         // Page Title
         $document->setTitle( JText::_( 'REG_ACTIVATE_COMPLETE_TITLE' ) );
         // Breadcrumb
         $pathway->addItem( JText::_( 'REG_ACTIVATE_COMPLETE_TITLE' ));

         $message->title = JText::_( 'REG_ACTIVATE_COMPLETE_TITLE' );
         $message->text = JText::_( 'REG_ACTIVATE_COMPLETE' );
      }
      else
      {
         // Page Title
         $document->setTitle( JText::_( 'REG_ACTIVATE_NOT_FOUND_TITLE' ) );
         // Breadcrumb
         $pathway->addItem( JText::_( 'REG_ACTIVATE_NOT_FOUND_TITLE' ));

         $message->title = JText::_( 'REG_ACTIVATE_NOT_FOUND_TITLE' );
         $message->text = JText::_( 'REG_ACTIVATE_NOT_FOUND' );
      }

      $view->assign('message', $message);
      $view->display('message');
   }

   /**
    * Password Reset Request Method
    *
    * @access   public
    */
   function requestreset()
   {
      // Check for request forgeries
      JRequest::checkToken() or jexit( 'Invalid Token' );

      // Get the input
      $email      = JRequest::getVar('email', null, 'post', 'string');

      // Get the model
      $model = &$this->getModel('Reset');

      // Request a reset
      if ($model->requestReset($email) === false)
      {
         $message = JText::sprintf('PASSWORD_RESET_REQUEST_FAILED', $model->getError());
         $this->setRedirect('index.php?option=com_user&view=reset', $message);
         return false;
      }

      $this->setRedirect('index.php?option=com_user&view=reset&layout=confirm');
   }

   /**
    * Password Reset Confirmation Method
    *
    * @access   public
    */
   function confirmreset()
   {
      // Check for request forgeries
      JRequest::checkToken() or jexit( 'Invalid Token' );

      // Get the input
      $token = JRequest::getVar('token', null, 'post', 'alnum');
      $username = JRequest::getVar('username', null, 'post');

      // Get the model
      $model = &$this->getModel('Reset');

      // Verify the token
      if ($model->confirmReset($token, $username) !== true)
      {
         $message = JText::sprintf('PASSWORD_RESET_CONFIRMATION_FAILED', $model->getError());
         $this->setRedirect('index.php?option=com_user&view=reset&layout=confirm', $message);
         return false;
      }
      $this->setRedirect('index.php?option=com_user&view=reset&layout=complete');
   }

   /**
    * Password Reset Completion Method
    *
    * @access   public
    */
   function completereset()
   {
      // Check for request forgeries
      JRequest::checkToken() or jexit( 'Invalid Token' );

      // Get the input
      $password1 = JRequest::getVar('password1', null, 'post', 'string', JREQUEST_ALLOWRAW);
      $password2 = JRequest::getVar('password2', null, 'post', 'string', JREQUEST_ALLOWRAW);

      // Get the model
      $model = &$this->getModel('Reset');

      // Reset the password
      if ($model->completeReset($password1, $password2) === false)
      {
         $message = JText::sprintf('PASSWORD_RESET_FAILED', $model->getError());
         $this->setRedirect('index.php?option=com_user&view=reset&layout=complete', $message);
         return false;
      }

      $message = JText::_('PASSWORD_RESET_SUCCESS');
      $this->setRedirect('index.php?option=com_user&view=login', $message);
   }

   /**
    * Username Reminder Method
    *
    * @access   public
    */
   function remindusername()
   {
      // Check for request forgeries
      JRequest::checkToken() or jexit( 'Invalid Token' );

      // Get the input
      $email = JRequest::getVar('email', null, 'post', 'string');

      // Get the model
      $model = &$this->getModel('Remind');

      // Send the reminder
      if ($model->remindUsername($email) === false)
      {
         $message = JText::sprintf('USERNAME_REMINDER_FAILED', $model->getError());
         $this->setRedirect('index.php?option=com_user&view=remind', $message);
         return false;
      }

      $message = JText::sprintf('USERNAME_REMINDER_SUCCESS', $email);
      $this->setRedirect('index.php?option=com_user&view=login', $message);
   }

   function _sendMail(&$user, $password)
   {
      global $mainframe;

      $db      =& JFactory::getDBO();

      $name       = $user->get('name');
      $email       = $user->get('email');
      $username    = $user->get('username');

      $usersConfig    = &JComponentHelper::getParams( 'com_users' );
      $sitename       = $mainframe->getCfg( 'sitename' );
      $useractivation = $usersConfig->get( 'useractivation' );
      $mailfrom       = $mainframe->getCfg( 'mailfrom' );
      $fromname       = $mainframe->getCfg( 'fromname' );
      $siteURL      = JURI::base();

      $subject    = sprintf ( JText::_( 'Account details for' ), $name, $sitename);
      $subject    = html_entity_decode($subject, ENT_QUOTES);

      if ( $useractivation == 1 ){
         $message = sprintf ( JText::_( 'SEND_MSG_ACTIVATE' ), $name, $sitename, $siteURL."index.php?option=com_user&task=activate&activation=".$user->get('activation'), $siteURL, $username, $password);
      } else {
         $message = sprintf ( JText::_( 'SEND_MSG' ), $name, $sitename, $siteURL);
      }

      $message = html_entity_decode($message, ENT_QUOTES);

      //get all super administrator
      $query = 'SELECT name, email, sendEmail' .
            ' FROM #__users' .
            ' WHERE LOWER( usertype ) = "super administrator"';
      $db->setQuery( $query );
      $rows = $db->loadObjectList();

      // Send email to user
      if ( ! $mailfrom  || ! $fromname ) {
         $fromname = $rows[0]->name;
         $mailfrom = $rows[0]->email;
      }

      JUtility::sendMail($mailfrom, $fromname, $email, $subject, $message);

      // Send notification to all administrators
      $subject2 = sprintf ( JText::_( 'Account details for' ), $name, $sitename);
      $subject2 = html_entity_decode($subject2, ENT_QUOTES);

      // get superadministrators id
      foreach ( $rows as $row )
      {
         if ($row->sendEmail)
         {
            $message2 = sprintf ( JText::_( 'SEND_MSG_ADMIN' ), $row->name, $sitename, $name, $email, $username);
            $message2 = html_entity_decode($message2, ENT_QUOTES);
            JUtility::sendMail($mailfrom, $fromname, $row->email, $subject2, $message2);
         }
      }
   }
}
?>


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 11 posts ] 



Who is online

Users browsing this forum: No registered users and 25 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group