|
1342
|
1 local dm_load = require "util.datamanager".load; |
|
|
2 local st = require "util.stanza"; |
|
|
3 local nodeprep = require "util.encodings".stringprep.nodeprep; |
|
|
4 local usermanager = require "core.usermanager"; |
|
|
5 local http = require "net.http"; |
|
|
6 local vcard = module:require "vcard"; |
|
|
7 local datetime = require "util.datetime"; |
|
|
8 local timer = require "util.timer"; |
|
|
9 local jidutil = require "util.jid"; |
|
|
10 |
|
|
11 -- SMTP related params. Readed from config |
|
|
12 local os_time = os.time; |
|
|
13 local smtp = require "socket.smtp"; |
|
|
14 local smtp_server = module:get_option_string("smtp_server", "localhost"); |
|
|
15 local smtp_port = module:get_option_string("smtp_port", "25"); |
|
|
16 local smtp_ssl = module:get_option_boolean("smtp_ssl", false); |
|
|
17 local smtp_user = module:get_option_string("smtp_username"); |
|
|
18 local smtp_pass = module:get_option_string("smtp_password"); |
|
|
19 local smtp_address = module:get_option("smtp_from") or ((smtp_user or "no-responder").."@"..(smtp_server or module.host)); |
|
|
20 local mail_subject = module:get_option_string("msg_subject") |
|
|
21 local mail_body = module:get_option_string("msg_body"); |
|
|
22 local url_path = module:get_option_string("url_path", "/resetpass"); |
|
|
23 |
|
|
24 |
|
|
25 -- This table has the tokens submited by the server |
|
|
26 tokens_mails = {}; |
|
|
27 tokens_expiration = {}; |
|
|
28 |
|
|
29 -- URL |
|
|
30 local https_host = module:get_option_string("https_host"); |
|
|
31 local http_host = module:get_option_string("http_host"); |
|
|
32 local https_port = module:get_option("https_ports", { 443 }); |
|
|
33 local http_port = module:get_option("http_ports", { 80 }); |
|
|
34 |
|
|
35 local timer_repeat = 120; -- repeat after 120 secs |
|
|
36 |
|
|
37 function enablessl() |
|
|
38 local sock = socket.tcp() |
|
|
39 return setmetatable({ |
|
|
40 connect = function(_, host, port) |
|
|
41 local r, e = sock:connect(host, port) |
|
|
42 if not r then return r, e end |
|
|
43 sock = ssl.wrap(sock, {mode='client', protocol='tlsv1'}) |
|
|
44 return sock:dohandshake() |
|
|
45 end |
|
|
46 }, { |
|
|
47 __index = function(t,n) |
|
|
48 return function(_, ...) |
|
|
49 return sock[n](sock, ...) |
|
|
50 end |
|
|
51 end |
|
|
52 }) |
|
|
53 end |
|
|
54 |
|
|
55 function template(data) |
|
|
56 -- Like util.template, but deals with plain text |
|
|
57 return { apply = function(values) return (data:gsub("{([^}]+)}", values)); end } |
|
|
58 end |
|
|
59 |
|
|
60 local function get_template(name, extension) |
|
|
61 local fh = assert(module:load_resource("templates/"..name..extension)); |
|
|
62 local data = assert(fh:read("*a")); |
|
|
63 fh:close(); |
|
|
64 return template(data); |
|
|
65 end |
|
|
66 |
|
|
67 local function render(template, data) |
|
|
68 return tostring(template.apply(data)); |
|
|
69 end |
|
|
70 |
|
|
71 function send_email(address, smtp_address, message_text, subject) |
|
|
72 local rcpt = "<"..address..">"; |
|
|
73 |
|
|
74 local mesgt = { |
|
|
75 headers = { |
|
|
76 to = address; |
|
|
77 subject = subject or ("Jabber password reset "..jid_bare(from_address)); |
|
|
78 }; |
|
|
79 body = message_text; |
|
|
80 }; |
|
|
81 local ok, err = nil; |
|
|
82 |
|
|
83 if not smtp_ssl then |
|
|
84 ok, err = smtp.send{ from = smtp_address, rcpt = rcpt, source = smtp.message(mesgt), |
|
|
85 server = smtp_server, user = smtp_user, password = smtp_pass, port = 25 }; |
|
|
86 else |
|
|
87 ok, err = smtp.send{ from = smtp_address, rcpt = rcpt, source = smtp.message(mesgt), |
|
|
88 server = smtp_server, user = smtp_user, password = smtp_pass, port = smtp_port, create = enablessl }; |
|
|
89 end |
|
|
90 |
|
|
91 if not ok then |
|
|
92 module:log("error", "Failed to deliver to %s: %s", tostring(address), tostring(err)); |
|
|
93 return; |
|
|
94 end |
|
|
95 return true; |
|
|
96 end |
|
|
97 |
|
|
98 local vCard_mt = { |
|
|
99 __index = function(t, k) |
|
|
100 if type(k) ~= "string" then return nil end |
|
|
101 for i=1,#t do |
|
|
102 local t_i = rawget(t, i); |
|
|
103 if t_i and t_i.name == k then |
|
|
104 rawset(t, k, t_i); |
|
|
105 return t_i; |
|
|
106 end |
|
|
107 end |
|
|
108 end |
|
|
109 }; |
|
|
110 |
|
|
111 local function get_user_vcard(user, host) |
|
|
112 local vCard = dm_load(user, host or base_host, "vcard"); |
|
|
113 if vCard then |
|
|
114 vCard = st.deserialize(vCard); |
|
|
115 vCard = vcard.from_xep54(vCard); |
|
|
116 return setmetatable(vCard, vCard_mt); |
|
|
117 end |
|
|
118 end |
|
|
119 |
|
|
120 local changepass_tpl = get_template("changepass",".html"); |
|
|
121 local sendmail_success_tpl = get_template("sendmailok",".html"); |
|
|
122 local reset_success_tpl = get_template("resetok",".html"); |
|
|
123 local token_tpl = get_template("token",".html"); |
|
|
124 |
|
|
125 function generate_page(event, display_options) |
|
|
126 local request = event.request; |
|
|
127 |
|
|
128 return render(changepass_tpl, { |
|
|
129 path = request.path; hostname = module.host; |
|
|
130 notice = display_options and display_options.register_error or ""; |
|
|
131 }) |
|
|
132 end |
|
|
133 |
|
|
134 function generate_token_page(event, display_options) |
|
|
135 local request = event.request; |
|
|
136 |
|
|
137 return render(token_tpl, { |
|
|
138 path = request.path; hostname = module.host; |
|
|
139 token = request.url.query; |
|
|
140 notice = display_options and display_options.register_error or ""; |
|
|
141 }) |
|
|
142 end |
|
|
143 |
|
|
144 function generateToken(address) |
|
|
145 math.randomseed(os.time()) |
|
|
146 length = 16 |
|
|
147 if length < 1 then return nil end |
|
|
148 local array = {} |
|
|
149 for i = 1, length, 2 do |
|
|
150 array[i] = string.char(math.random(48,57)) |
|
|
151 array[i+1] = string.char(math.random(97,122)) |
|
|
152 end |
|
|
153 local token = table.concat(array); |
|
|
154 if not tokens_mails[token] then |
|
|
155 |
|
|
156 tokens_mails[token] = address; |
|
|
157 tokens_expiration[token] = os.time(); |
|
|
158 return token |
|
|
159 else |
|
|
160 module:log("error", "Reset password token collision: '%s'", token); |
|
|
161 return generateToken(address) |
|
|
162 end |
|
|
163 end |
|
|
164 |
|
|
165 function isExpired(token) |
|
|
166 if not tokens_expiration[token] then |
|
|
167 return nil; |
|
|
168 end |
|
|
169 if os.difftime(os.time(), tokens_expiration[token]) < 86400 then -- 86400 secs == 24h |
|
|
170 -- token is valid yet |
|
|
171 return nil; |
|
|
172 else |
|
|
173 -- token invalid, we can create a fresh one. |
|
|
174 return true; |
|
|
175 end |
|
|
176 end |
|
|
177 |
|
|
178 -- Expire tokens |
|
|
179 expireTokens = function() |
|
|
180 for token,value in pairs(tokens_mails) do |
|
|
181 if isExpired(token) then |
|
|
182 module:log("info","Expiring password reset request from user '%s', not used.", tokens_mails[token]); |
|
|
183 tokens_mails[token] = nil; |
|
|
184 tokens_expiration[token] = nil; |
|
|
185 end |
|
|
186 end |
|
|
187 return timer_repeat; |
|
|
188 end |
|
|
189 |
|
|
190 -- Check if a user has a active token not used yet. |
|
|
191 function hasTokenActive(address) |
|
|
192 for token,value in pairs(tokens_mails) do |
|
|
193 if address == value and not isExpired(token) then |
|
|
194 return token; |
|
|
195 end |
|
|
196 end |
|
|
197 return nil; |
|
|
198 end |
|
|
199 |
|
|
200 function generateUrl(token) |
|
|
201 local url; |
|
|
202 |
|
|
203 if https_host then |
|
|
204 url = "https://" .. https_host; |
|
|
205 else |
|
|
206 url = "http://" .. http_host; |
|
|
207 end |
|
|
208 |
|
|
209 if https_port then |
|
|
210 url = url .. ":" .. https_port[1]; |
|
|
211 else |
|
|
212 url = url .. ":" .. http_port[1]; |
|
|
213 end |
|
|
214 |
|
|
215 url = url .. url_path .. "token.html?" .. token; |
|
|
216 |
|
|
217 return url; |
|
|
218 end |
|
|
219 |
|
|
220 function sendMessage(jid, subject, message) |
|
|
221 local msg = st.message({ from = module.host; to = jid; }): |
|
|
222 tag("subject"):text(subject):up(): |
|
|
223 tag("body"):text(message); |
|
|
224 module:send(msg); |
|
|
225 end |
|
|
226 |
|
|
227 function send_token_mail(form, origin) |
|
|
228 local user, host, resource = jidutil.split(form.username); |
|
|
229 local prepped_username = nodeprep(user); |
|
|
230 local prepped_mail = form.email; |
|
|
231 local jid = prepped_username .. "@" .. host; |
|
|
232 |
|
|
233 if not prepped_username then |
|
|
234 return nil, "El usuario contiene caracteres incorrectos"; |
|
|
235 end |
|
|
236 if #prepped_username == 0 then |
|
|
237 return nil, "El campo usuario está vacio"; |
|
|
238 end |
|
|
239 if not usermanager.user_exists(prepped_username, module.host) then |
|
|
240 return nil, "El usuario NO existe"; |
|
|
241 end |
|
|
242 |
|
|
243 if #prepped_mail == 0 then |
|
|
244 return nil, "El campo email está vacio"; |
|
|
245 end |
|
|
246 |
|
|
247 local vcarduser = get_user_vcard(prepped_username, module.host); |
|
|
248 |
|
|
249 if not vcarduser then |
|
|
250 return nil, "User has not vCard"; |
|
|
251 else |
|
|
252 if not vcarduser.EMAIL then |
|
|
253 return nil, "Esa cuente no tiene ningún email configurado en su vCard"; |
|
|
254 end |
|
|
255 |
|
|
256 email = string.lower(vcarduser.EMAIL[1]); |
|
|
257 |
|
|
258 if email ~= string.lower(prepped_mail) then |
|
|
259 return nil, "Dirección eMail incorrecta"; |
|
|
260 end |
|
|
261 |
|
|
262 -- Check if has already a valid token, not used yet. |
|
|
263 if hasTokenActive(jid) then |
|
|
264 local valid_until = tokens_expiration[hasTokenActive(jid)] + 86400; |
|
|
265 return nil, "Ya tienes una petición de restablecimiento de clave válida hasta: " .. datetime.date(valid_until) .. " " .. datetime.time(valid_until); |
|
|
266 end |
|
|
267 |
|
|
268 local url_token = generateToken(jid); |
|
|
269 local url = generateUrl(url_token); |
|
|
270 local email_body = render(get_template("sendtoken",".mail"), {jid = jid, url = url} ); |
|
|
271 |
|
|
272 module:log("info", "Sending password reset mail to user %s", jid); |
|
|
273 send_email(email, smtp_address, email_body, mail_subject); |
|
|
274 return "ok"; |
|
|
275 end |
|
|
276 |
|
|
277 end |
|
|
278 |
|
|
279 function reset_password_with_token(form, origin) |
|
|
280 local token = form.token; |
|
|
281 local password = form.newpassword; |
|
|
282 |
|
|
283 if not token then |
|
|
284 return nil, "El Token es inválido"; |
|
|
285 end |
|
|
286 if not tokens_mails[token] then |
|
|
287 return nil, "El Token no existe o ya fué usado"; |
|
|
288 end |
|
|
289 if not password then |
|
|
290 return nil, "La campo clave no puede estar vacio"; |
|
|
291 end |
|
|
292 if #password < 5 then |
|
|
293 return nil, "La clave debe tener una longitud de al menos 5 caracteres"; |
|
|
294 end |
|
|
295 local jid = tokens_mails[token]; |
|
|
296 local user, host, resource = jidutil.split(jid); |
|
|
297 |
|
|
298 usermanager.set_password(user, password, host); |
|
|
299 module:log("info", "Password changed with token for user %s", jid); |
|
|
300 tokens_mails[token] = nil; |
|
|
301 tokens_expiration[token] = nil; |
|
|
302 sendMessage(jid, mail_subject, mail_body); |
|
|
303 return "ok"; |
|
|
304 end |
|
|
305 |
|
|
306 function generate_success(event, form) |
|
|
307 return render(sendmail_success_tpl, { jid = nodeprep(form.username).."@"..module.host }); |
|
|
308 end |
|
|
309 |
|
|
310 function generate_register_response(event, form, ok, err) |
|
|
311 local message; |
|
|
312 if ok then |
|
|
313 return generate_success(event, form); |
|
|
314 else |
|
|
315 return generate_page(event, { register_error = err }); |
|
|
316 end |
|
|
317 end |
|
|
318 |
|
|
319 function handle_form_token(event) |
|
|
320 local request, response = event.request, event.response; |
|
|
321 local form = http.formdecode(request.body); |
|
|
322 |
|
|
323 local token_ok, token_err = send_token_mail(form, request); |
|
|
324 response:send(generate_register_response(event, form, token_ok, token_err)); |
|
|
325 |
|
|
326 return true; -- Leave connection open until we respond above |
|
|
327 end |
|
|
328 |
|
|
329 function generate_reset_success(event, form) |
|
|
330 return render(reset_success_tpl, { }); |
|
|
331 end |
|
|
332 |
|
|
333 function generate_reset_response(event, form, ok, err) |
|
|
334 local message; |
|
|
335 if ok then |
|
|
336 return generate_reset_success(event, form); |
|
|
337 else |
|
|
338 return generate_token_page(event, { register_error = err }); |
|
|
339 end |
|
|
340 end |
|
|
341 |
|
|
342 function handle_form_reset(event) |
|
|
343 local request, response = event.request, event.response; |
|
|
344 local form = http.formdecode(request.body); |
|
|
345 |
|
|
346 local reset_ok, reset_err = reset_password_with_token(form, request); |
|
|
347 response:send(generate_reset_response(event, form, reset_ok, reset_err)); |
|
|
348 |
|
|
349 return true; -- Leave connection open until we respond above |
|
|
350 |
|
|
351 end |
|
|
352 |
|
|
353 timer.add_task(timer_repeat, expireTokens); |
|
|
354 |
|
|
355 module:provides("http", { |
|
|
356 default_path = url_path; |
|
|
357 route = { |
|
|
358 ["GET /style.css"] = render(get_template("style",".css"), {}); |
|
|
359 ["GET /token.html"] = generate_token_page; |
|
|
360 ["GET /"] = generate_page; |
|
|
361 ["POST /token.html"] = handle_form_reset; |
|
|
362 ["POST /"] = handle_form_token; |
|
|
363 }; |
|
|
364 }); |
|
|
365 |
|
|
366 |
