No OneTemporary
Actions

Size

50 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/applications/auth/controller/PhabricatorAuthRegisterController.php b/src/applications/auth/controller/PhabricatorAuthRegisterController.php
	index 9fbf30d092..a71e576476 100644
	--- a/src/applications/auth/controller/PhabricatorAuthRegisterController.php
	+++ b/src/applications/auth/controller/PhabricatorAuthRegisterController.php
	@@ -1,758 +1,758 @@
	<?php

	final class PhabricatorAuthRegisterController
	extends PhabricatorAuthController {

	public function shouldRequireLogin() {
	return false;
	}

	public function handleRequest(AphrontRequest $request) {
	$viewer = $this->getViewer();
	$account_key = $request->getURIData('akey');

	if ($viewer->isLoggedIn()) {
	return id(new AphrontRedirectResponse())->setURI('/');
	}

	$invite = $this->loadInvite();

	$is_setup = false;
	- if (strlen($account_key)) {
	+ if (phutil_nonempty_string($account_key)) {
	$result = $this->loadAccountForRegistrationOrLinking($account_key);
	list($account, $provider, $response) = $result;
	$is_default = false;
	} else if ($this->isFirstTimeSetup()) {
	$account = null;
	$provider = null;
	$response = null;
	$is_default = true;
	$is_setup = true;
	} else {
	list($account, $provider, $response) = $this->loadDefaultAccount($invite);
	$is_default = true;
	}

	if ($response) {
	return $response;
	}

	if (!$is_setup) {
	if (!$provider->shouldAllowRegistration()) {
	if ($invite) {
	// If the user has an invite, we allow them to register with any
	// provider, even a login-only provider.
	} else {
	// TODO: This is a routine error if you click "Login" on an external
	// auth source which doesn't allow registration. The error should be
	// more tailored.

	return $this->renderError(
	pht(
	'The account you are attempting to register with uses an '.
	'authentication provider ("%s") which does not allow '.
	'registration. An administrator may have recently disabled '.
	'registration with this provider.',
	$provider->getProviderName()));
	}
	}
	}

	$errors = array();

	$user = new PhabricatorUser();

	if ($is_setup) {
	$default_username = null;
	$default_realname = null;
	$default_email = null;
	} else {
	$default_username = $account->getUsername();
	$default_realname = $account->getRealName();
	$default_email = $account->getEmail();
	}

	$account_type = PhabricatorAuthPassword::PASSWORD_TYPE_ACCOUNT;
	$content_source = PhabricatorContentSource::newFromRequest($request);

	if ($invite) {
	$default_email = $invite->getEmailAddress();
	}

	if ($default_email !== null) {
	if (!PhabricatorUserEmail::isValidAddress($default_email)) {
	$errors[] = pht(
	'The email address associated with this external account ("%s") is '.
	'not a valid email address and can not be used to register an '.
	'account. Choose a different, valid address.',
	phutil_tag('strong', array(), $default_email));
	$default_email = null;
	}
	}

	if ($default_email !== null) {
	// We should bypass policy here because e.g. limiting an application use
	// to a subset of users should not allow the others to overwrite
	// configured application emails.
	$application_email = id(new PhabricatorMetaMTAApplicationEmailQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withAddresses(array($default_email))
	->executeOne();
	if ($application_email) {
	$errors[] = pht(
	'The email address associated with this account ("%s") is '.
	'already in use by an application and can not be used to '.
	'register a new account. Choose a different, valid address.',
	phutil_tag('strong', array(), $default_email));
	$default_email = null;
	}
	}

	$show_existing = null;
	if ($default_email !== null) {
	// If the account source provided an email, but it's not allowed by
	// the configuration, roadblock the user. Previously, we let the user
	// pick a valid email address instead, but this does not align well with
	// user expectation and it's not clear the cases it enables are valuable.
	// See discussion in T3472.
	if (!PhabricatorUserEmail::isAllowedAddress($default_email)) {
	$debug_email = new PHUIInvisibleCharacterView($default_email);
	return $this->renderError(
	array(
	pht(
	'The account you are attempting to register with has an invalid '.
	'email address (%s). This server only allows registration with '.
	'specific email addresses:',
	$debug_email),
	phutil_tag('br'),
	phutil_tag('br'),
	PhabricatorUserEmail::describeAllowedAddresses(),
	));
	}

	// If the account source provided an email, but another account already
	// has that email, just pretend we didn't get an email.
	if ($default_email !== null) {
	$same_email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$default_email);
	if ($same_email) {
	if ($invite) {
	// We're allowing this to continue. The fact that we loaded the
	// invite means that the address is nonprimary and unverified and
	// we're OK to steal it.
	} else {
	$show_existing = $default_email;
	$default_email = null;
	}
	}
	}
	}

	if ($show_existing !== null) {
	if (!$request->getInt('phase')) {
	return $this->newDialog()
	->setTitle(pht('Email Address Already in Use'))
	->addHiddenInput('phase', 1)
	->appendParagraph(
	pht(
	'You are creating a new account linked to an existing '.
	'external account.'))
	->appendParagraph(
	pht(
	'The email address ("%s") associated with the external account '.
	'is already in use by an existing %s account. Multiple '.
	'%s accounts may not have the same email address, so '.
	'you can not use this email address to register a new account.',
	phutil_tag('strong', array(), $show_existing),
	PlatformSymbols::getPlatformServerName(),
	PlatformSymbols::getPlatformServerName()))
	->appendParagraph(
	pht(
	'If you want to register a new account, continue with this '.
	'registration workflow and choose a new, unique email address '.
	'for the new account.'))
	->appendParagraph(
	pht(
	'If you want to link an existing %s account to this '.
	'external account, do not continue. Instead: log in to your '.
	'existing account, then go to "Settings" and link the account '.
	'in the "External Accounts" panel.',
	PlatformSymbols::getPlatformServerName()))
	->appendParagraph(
	pht(
	'If you continue, you will create a new account. You will not '.
	'be able to link this external account to an existing account.'))
	->addCancelButton('/auth/login/', pht('Cancel'))
	->addSubmitButton(pht('Create New Account'));
	} else {
	$errors[] = pht(
	'The external account you are registering with has an email address '.
	'that is already in use ("%s") by an existing %s account. '.
	'Choose a new, valid email address to register a new account.',
	phutil_tag('strong', array(), $show_existing),
	PlatformSymbols::getPlatformServerName());
	}
	}

	$profile = id(new PhabricatorRegistrationProfile())
	->setDefaultUsername($default_username)
	->setDefaultEmail($default_email)
	->setDefaultRealName($default_realname)
	->setCanEditUsername(true)
	->setCanEditEmail(($default_email === null))
	->setCanEditRealName(true)
	->setShouldVerifyEmail(false);

	$event_type = PhabricatorEventType::TYPE_AUTH_WILLREGISTERUSER;
	$event_data = array(
	'account' => $account,
	'profile' => $profile,
	);

	$event = id(new PhabricatorEvent($event_type, $event_data))
	->setUser($user);
	PhutilEventEngine::dispatchEvent($event);

	$default_username = $profile->getDefaultUsername();
	$default_email = $profile->getDefaultEmail();
	$default_realname = $profile->getDefaultRealName();

	$can_edit_username = $profile->getCanEditUsername();
	$can_edit_email = $profile->getCanEditEmail();
	$can_edit_realname = $profile->getCanEditRealName();

	if ($is_setup) {
	$must_set_password = false;
	} else {
	$must_set_password = $provider->shouldRequireRegistrationPassword();
	}

	$can_edit_anything = $profile->getCanEditAnything() \|\| $must_set_password;
	$force_verify = $profile->getShouldVerifyEmail();

	// Automatically verify the administrator's email address during first-time
	// setup.
	if ($is_setup) {
	$force_verify = true;
	}

	$value_username = $default_username;
	$value_realname = $default_realname;
	$value_email = $default_email;
	$value_password = null;

	$require_real_name = PhabricatorEnv::getEnvConfig('user.require-real-name');

	- $e_username = strlen($value_username) ? null : true;
	+ $e_username = phutil_nonempty_string($value_username) ? null : true;
	$e_realname = $require_real_name ? true : null;
	- $e_email = strlen($value_email) ? null : true;
	+ $e_email = phutil_nonempty_string($value_email) ? null : true;
	$e_password = true;
	$e_captcha = true;

	$skip_captcha = false;
	if ($invite) {
	// If the user is accepting an invite, assume they're trustworthy enough
	// that we don't need to CAPTCHA them.
	$skip_captcha = true;
	}

	$min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
	$min_len = (int)$min_len;

	$from_invite = $request->getStr('invite');
	if ($from_invite && $can_edit_username) {
	$value_username = $request->getStr('username');
	$e_username = null;
	}

	$try_register =
	($request->isFormPost() \|\| !$can_edit_anything) &&
	!$from_invite &&
	($request->getInt('phase') != 1);

	if ($try_register) {
	$errors = array();

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();

	if ($must_set_password && !$skip_captcha) {
	$e_captcha = pht('Again');

	$captcha_ok = AphrontFormRecaptchaControl::processCaptcha($request);
	if (!$captcha_ok) {
	$errors[] = pht('Captcha response is incorrect, try again.');
	$e_captcha = pht('Invalid');
	}
	}

	if ($can_edit_username) {
	$value_username = $request->getStr('username');
	if (!strlen($value_username)) {
	$e_username = pht('Required');
	$errors[] = pht('Username is required.');
	} else if (!PhabricatorUser::validateUsername($value_username)) {
	$e_username = pht('Invalid');
	$errors[] = PhabricatorUser::describeValidUsername();
	} else {
	$e_username = null;
	}
	}

	if ($must_set_password) {
	$value_password = $request->getStr('password');
	$value_confirm = $request->getStr('confirm');

	$password_envelope = new PhutilOpaqueEnvelope($value_password);
	$confirm_envelope = new PhutilOpaqueEnvelope($value_confirm);

	$engine = id(new PhabricatorAuthPasswordEngine())
	->setViewer($user)
	->setContentSource($content_source)
	->setPasswordType($account_type)
	->setObject($user);

	try {
	$engine->checkNewPassword($password_envelope, $confirm_envelope);
	$e_password = null;
	} catch (PhabricatorAuthPasswordException $ex) {
	$errors[] = $ex->getMessage();
	$e_password = $ex->getPasswordError();
	}
	}

	if ($can_edit_email) {
	$value_email = $request->getStr('email');
	if (!strlen($value_email)) {
	$e_email = pht('Required');
	$errors[] = pht('Email is required.');
	} else if (!PhabricatorUserEmail::isValidAddress($value_email)) {
	$e_email = pht('Invalid');
	$errors[] = PhabricatorUserEmail::describeValidAddresses();
	} else if (!PhabricatorUserEmail::isAllowedAddress($value_email)) {
	$e_email = pht('Disallowed');
	$errors[] = PhabricatorUserEmail::describeAllowedAddresses();
	} else {
	$e_email = null;
	}
	}

	if ($can_edit_realname) {
	$value_realname = $request->getStr('realName');
	if (!strlen($value_realname) && $require_real_name) {
	$e_realname = pht('Required');
	$errors[] = pht('Real name is required.');
	} else {
	$e_realname = null;
	}
	}

	if (!$errors) {
	if (!$is_setup) {
	$image = $this->loadProfilePicture($account);
	if ($image) {
	$user->setProfileImagePHID($image->getPHID());
	}
	}

	try {
	$verify_email = false;

	if ($force_verify) {
	$verify_email = true;
	}

	if (!$is_setup) {
	if ($value_email === $default_email) {
	if ($account->getEmailVerified()) {
	$verify_email = true;
	}

	if ($provider->shouldTrustEmails()) {
	$verify_email = true;
	}

	if ($invite) {
	$verify_email = true;
	}
	}
	}

	$email_obj = null;
	if ($invite) {
	// If we have a valid invite, this email may exist but be
	// nonprimary and unverified, so we'll reassign it.
	$email_obj = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$value_email);
	}
	if (!$email_obj) {
	$email_obj = id(new PhabricatorUserEmail())
	->setAddress($value_email);
	}

	$email_obj->setIsVerified((int)$verify_email);

	$user->setUsername($value_username);
	$user->setRealname($value_realname);

	if ($is_setup) {
	$must_approve = false;
	} else if ($invite) {
	$must_approve = false;
	} else {
	$must_approve = PhabricatorEnv::getEnvConfig(
	'auth.require-approval');
	}

	if ($must_approve) {
	$user->setIsApproved(0);
	} else {
	$user->setIsApproved(1);
	}

	if ($invite) {
	$allow_reassign_email = true;
	} else {
	$allow_reassign_email = false;
	}

	$user->openTransaction();

	$editor = id(new PhabricatorUserEditor())
	->setActor($user);

	$editor->createNewUser($user, $email_obj, $allow_reassign_email);
	if ($must_set_password) {
	$password_object = PhabricatorAuthPassword::initializeNewPassword(
	$user,
	$account_type);

	$password_object
	->setPassword($password_envelope, $user)
	->save();
	}

	if ($is_setup) {
	$xactions = array();
	$xactions[] = id(new PhabricatorUserTransaction())
	->setTransactionType(
	PhabricatorUserEmpowerTransaction::TRANSACTIONTYPE)
	->setNewValue(true);

	$actor = PhabricatorUser::getOmnipotentUser();
	$content_source = PhabricatorContentSource::newFromRequest(
	$request);

	$people_application_phid = id(new PhabricatorPeopleApplication())
	->getPHID();

	$transaction_editor = id(new PhabricatorUserTransactionEditor())
	->setActor($actor)
	->setActingAsPHID($people_application_phid)
	->setContentSource($content_source)
	->setContinueOnMissingFields(true);

	$transaction_editor->applyTransactions($user, $xactions);
	}

	if (!$is_setup) {
	$account->setUserPHID($user->getPHID());
	$account->save();
	}

	$user->saveTransaction();

	if (!$email_obj->getIsVerified()) {
	$email_obj->sendVerificationEmail($user);
	}

	if ($must_approve) {
	$this->sendWaitingForApprovalEmail($user);
	}

	if ($invite) {
	$invite->setAcceptedByPHID($user->getPHID())->save();
	}

	return $this->loginUser($user);
	} catch (AphrontDuplicateKeyQueryException $exception) {
	$same_username = id(new PhabricatorUser())->loadOneWhere(
	'userName = %s',
	$user->getUserName());

	$same_email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$value_email);

	if ($same_username) {
	$e_username = pht('Duplicate');
	$errors[] = pht('Another user already has that username.');
	}

	if ($same_email) {
	// TODO: See T3340.
	$e_email = pht('Duplicate');
	$errors[] = pht('Another user already has that email.');
	}

	if (!$same_username && !$same_email) {
	throw $exception;
	}
	}
	}

	unset($unguarded);
	}

	$form = id(new AphrontFormView())
	->setUser($request->getUser())
	->addHiddenInput('phase', 2);

	if (!$is_default) {
	$form->appendChild(
	id(new AphrontFormMarkupControl())
	->setLabel(pht('External Account'))
	->setValue(
	id(new PhabricatorAuthAccountView())
	->setUser($request->getUser())
	->setExternalAccount($account)
	->setAuthProvider($provider)));
	}

	if ($can_edit_username) {
	$form->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Username'))
	->setName('username')
	->setValue($value_username)
	->setError($e_username));
	} else {
	$form->appendChild(
	id(new AphrontFormMarkupControl())
	->setLabel(pht('Username'))
	->setValue($value_username)
	->setError($e_username));
	}

	if ($can_edit_realname) {
	$form->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Real Name'))
	->setName('realName')
	->setValue($value_realname)
	->setError($e_realname));
	}

	if ($must_set_password) {
	$form->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel(pht('Password'))
	->setName('password')
	->setError($e_password));
	$form->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel(pht('Confirm Password'))
	->setName('confirm')
	->setError($e_password)
	->setCaption(
	$min_len
	? pht('Minimum length of %d characters.', $min_len)
	: null));
	}

	if ($can_edit_email) {
	$form->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Email'))
	->setName('email')
	->setValue($value_email)
	->setCaption(PhabricatorUserEmail::describeAllowedAddresses())
	->setError($e_email));
	}

	if ($must_set_password && !$skip_captcha) {
	$form->appendChild(
	id(new AphrontFormRecaptchaControl())
	->setLabel(pht('Captcha'))
	->setError($e_captcha));
	}

	$submit = id(new AphrontFormSubmitControl());

	if ($is_setup) {
	$submit
	->setValue(pht('Create Admin Account'));
	} else {
	$submit
	->addCancelButton($this->getApplicationURI('start/'))
	->setValue(pht('Register Account'));
	}


	$form->appendChild($submit);

	$crumbs = $this->buildApplicationCrumbs();

	if ($is_setup) {
	$crumbs->addTextCrumb(pht('Setup Admin Account'));
	$title = pht(
	'Welcome to %s',
	PlatformSymbols::getPlatformServerName());
	} else {
	$crumbs->addTextCrumb(pht('Register'));
	$crumbs->addTextCrumb($provider->getProviderName());
	$title = pht('Create a New Account');
	}
	$crumbs->setBorder(true);

	$welcome_view = null;
	if ($is_setup) {
	$welcome_view = id(new PHUIInfoView())
	->setSeverity(PHUIInfoView::SEVERITY_NOTICE)
	->setTitle(
	pht(
	'Welcome to %s',
	PlatformSymbols::getPlatformServerName()))
	->appendChild(
	pht(
	'Installation is complete. Register your administrator account '.
	'below to log in. You will be able to configure options and add '.
	'authentication mechanisms later on.'));
	}

	$object_box = id(new PHUIObjectBoxView())
	->setForm($form)
	->setFormErrors($errors);

	$invite_header = null;
	if ($invite) {
	$invite_header = $this->renderInviteHeader($invite);
	}

	$header = id(new PHUIHeaderView())
	->setHeader($title);

	$view = id(new PHUITwoColumnView())
	->setHeader($header)
	->setFooter(
	array(
	$welcome_view,
	$invite_header,
	$object_box,
	));

	return $this->newPage()
	->setTitle($title)
	->setCrumbs($crumbs)
	->appendChild($view);
	}

	private function loadDefaultAccount($invite) {
	$providers = PhabricatorAuthProvider::getAllEnabledProviders();
	$account = null;
	$provider = null;
	$response = null;

	foreach ($providers as $key => $candidate_provider) {
	if (!$invite) {
	if (!$candidate_provider->shouldAllowRegistration()) {
	unset($providers[$key]);
	continue;
	}
	}

	if (!$candidate_provider->isDefaultRegistrationProvider()) {
	unset($providers[$key]);
	}
	}

	if (!$providers) {
	$response = $this->renderError(
	pht(
	'There are no configured default registration providers.'));
	return array($account, $provider, $response);
	} else if (count($providers) > 1) {
	$response = $this->renderError(
	pht('There are too many configured default registration providers.'));
	return array($account, $provider, $response);
	}

	$provider = head($providers);
	$account = $provider->newDefaultExternalAccount();

	return array($account, $provider, $response);
	}

	private function loadProfilePicture(PhabricatorExternalAccount $account) {
	$phid = $account->getProfileImagePHID();
	if (!$phid) {
	return null;
	}

	// NOTE: Use of omnipotent user is okay here because the registering user
	// can not control the field value, and we can't use their user object to
	// do meaningful policy checks anyway since they have not registered yet.
	// Reaching this means the user holds the account secret key and the
	// registration secret key, and thus has permission to view the image.

	$file = id(new PhabricatorFileQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withPHIDs(array($phid))
	->executeOne();
	if (!$file) {
	return null;
	}

	$xform = PhabricatorFileTransform::getTransformByKey(
	PhabricatorFileThumbnailTransform::TRANSFORM_PROFILE);
	return $xform->executeTransform($file);
	}

	protected function renderError($message) {
	return $this->renderErrorPage(
	pht('Registration Failed'),
	array($message));
	}

	private function sendWaitingForApprovalEmail(PhabricatorUser $user) {
	$title = pht(
	'[%s] New User "%s" Awaiting Approval',
	PlatformSymbols::getPlatformServerName(),
	$user->getUsername());

	$body = new PhabricatorMetaMTAMailBody();

	$body->addRawSection(
	pht(
	'Newly registered user "%s" is awaiting account approval by an '.
	'administrator.',
	$user->getUsername()));

	$body->addLinkSection(
	pht('APPROVAL QUEUE'),
	PhabricatorEnv::getProductionURI(
	'/people/query/approval/'));

	$body->addLinkSection(
	pht('DISABLE APPROVAL QUEUE'),
	PhabricatorEnv::getProductionURI(
	'/config/edit/auth.require-approval/'));

	$admins = id(new PhabricatorPeopleQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withIsAdmin(true)
	->execute();

	if (!$admins) {
	return;
	}

	$mail = id(new PhabricatorMetaMTAMail())
	->addTos(mpull($admins, 'getPHID'))
	->setSubject($title)
	->setBody($body->render())
	->saveAndSend();
	}

	}
	diff --git a/src/applications/base/controller/PhabricatorController.php b/src/applications/base/controller/PhabricatorController.php
	index db9d456094..d1b1fcfc8e 100644
	--- a/src/applications/base/controller/PhabricatorController.php
	+++ b/src/applications/base/controller/PhabricatorController.php
	@@ -1,651 +1,651 @@
	<?php

	abstract class PhabricatorController extends AphrontController {

	private $handles;

	public function shouldRequireLogin() {
	return true;
	}

	public function shouldRequireAdmin() {
	return false;
	}

	public function shouldRequireEnabledUser() {
	return true;
	}

	public function shouldAllowPublic() {
	return false;
	}

	public function shouldAllowPartialSessions() {
	return false;
	}

	public function shouldRequireEmailVerification() {
	return PhabricatorUserEmail::isEmailVerificationRequired();
	}

	public function shouldAllowRestrictedParameter($parameter_name) {
	return false;
	}

	public function shouldRequireMultiFactorEnrollment() {
	if (!$this->shouldRequireLogin()) {
	return false;
	}

	if (!$this->shouldRequireEnabledUser()) {
	return false;
	}

	if ($this->shouldAllowPartialSessions()) {
	return false;
	}

	$user = $this->getRequest()->getUser();
	if (!$user->getIsStandardUser()) {
	return false;
	}

	return PhabricatorEnv::getEnvConfig('security.require-multi-factor-auth');
	}

	public function shouldAllowLegallyNonCompliantUsers() {
	return false;
	}

	public function isGlobalDragAndDropUploadEnabled() {
	return false;
	}

	public function willBeginExecution() {
	$request = $this->getRequest();

	if ($request->getUser()) {
	// NOTE: Unit tests can set a user explicitly. Normal requests are not
	// permitted to do this.
	PhabricatorTestCase::assertExecutingUnitTests();
	$user = $request->getUser();
	} else {
	$user = new PhabricatorUser();
	$session_engine = new PhabricatorAuthSessionEngine();

	$phsid = $request->getCookie(PhabricatorCookies::COOKIE_SESSION);
	- if (strlen($phsid)) {
	+ if (phutil_nonempty_string($phsid)) {
	$session_user = $session_engine->loadUserForSession(
	PhabricatorAuthSession::TYPE_WEB,
	$phsid);
	if ($session_user) {
	$user = $session_user;
	}
	} else {
	// If the client doesn't have a session token, generate an anonymous
	// session. This is used to provide CSRF protection to logged-out users.
	$phsid = $session_engine->establishSession(
	PhabricatorAuthSession::TYPE_WEB,
	null,
	$partial = false);

	// This may be a resource request, in which case we just don't set
	// the cookie.
	if ($request->canSetCookies()) {
	$request->setCookie(PhabricatorCookies::COOKIE_SESSION, $phsid);
	}
	}


	if (!$user->isLoggedIn()) {
	$csrf = PhabricatorHash::digestWithNamedKey($phsid, 'csrf.alternate');
	$user->attachAlternateCSRFString($csrf);
	}

	$request->setUser($user);
	}

	id(new PhabricatorAuthSessionEngine())
	->willServeRequestForUser($user);

	if (PhabricatorEnv::getEnvConfig('darkconsole.enabled')) {
	$dark_console = PhabricatorDarkConsoleSetting::SETTINGKEY;
	if ($user->getUserSetting($dark_console) \|\|
	PhabricatorEnv::getEnvConfig('darkconsole.always-on')) {
	$console = new DarkConsoleCore();
	$request->getApplicationConfiguration()->setConsole($console);
	}
	}

	// NOTE: We want to set up the user first so we can render a real page
	// here, but fire this before any real logic.
	$restricted = array(
	'code',
	);
	foreach ($restricted as $parameter) {
	if ($request->getExists($parameter)) {
	if (!$this->shouldAllowRestrictedParameter($parameter)) {
	throw new Exception(
	pht(
	'Request includes restricted parameter "%s", but this '.
	'controller ("%s") does not whitelist it. Refusing to '.
	'serve this request because it might be part of a redirection '.
	'attack.',
	$parameter,
	get_class($this)));
	}
	}
	}

	if ($this->shouldRequireEnabledUser()) {
	if ($user->getIsDisabled()) {
	$controller = new PhabricatorDisabledUserController();
	return $this->delegateToController($controller);
	}
	}

	$auth_class = 'PhabricatorAuthApplication';
	$auth_application = PhabricatorApplication::getByClass($auth_class);

	// Require partial sessions to finish login before doing anything.
	if (!$this->shouldAllowPartialSessions()) {
	if ($user->hasSession() &&
	$user->getSession()->getIsPartial()) {
	$login_controller = new PhabricatorAuthFinishController();
	$this->setCurrentApplication($auth_application);
	return $this->delegateToController($login_controller);
	}
	}

	// Require users sign Legalpad documents before we check if they have
	// MFA. If we don't do this, they can get stuck in a state where they
	// can't add MFA until they sign, and can't sign until they add MFA.
	// See T13024 and PHI223.
	$result = $this->requireLegalpadSignatures();
	if ($result !== null) {
	return $result;
	}

	// Check if the user needs to configure MFA.
	$need_mfa = $this->shouldRequireMultiFactorEnrollment();
	$have_mfa = $user->getIsEnrolledInMultiFactor();
	if ($need_mfa && !$have_mfa) {
	// Check if the cache is just out of date. Otherwise, roadblock the user
	// and require MFA enrollment.
	$user->updateMultiFactorEnrollment();
	if (!$user->getIsEnrolledInMultiFactor()) {
	$mfa_controller = new PhabricatorAuthNeedsMultiFactorController();
	$this->setCurrentApplication($auth_application);
	return $this->delegateToController($mfa_controller);
	}
	}

	if ($this->shouldRequireLogin()) {
	// This actually means we need either:
	// - a valid user, or a public controller; and
	// - permission to see the application; and
	// - permission to see at least one Space if spaces are configured.

	$allow_public = $this->shouldAllowPublic() &&
	PhabricatorEnv::getEnvConfig('policy.allow-public');

	// If this controller isn't public, and the user isn't logged in, require
	// login.
	if (!$allow_public && !$user->isLoggedIn()) {
	$login_controller = new PhabricatorAuthStartController();
	$this->setCurrentApplication($auth_application);
	return $this->delegateToController($login_controller);
	}

	if ($user->isLoggedIn()) {
	if ($this->shouldRequireEmailVerification()) {
	if (!$user->getIsEmailVerified()) {
	$controller = new PhabricatorMustVerifyEmailController();
	$this->setCurrentApplication($auth_application);
	return $this->delegateToController($controller);
	}
	}
	}

	// If Spaces are configured, require that the user have access to at
	// least one. If we don't do this, they'll get confusing error messages
	// later on.
	$spaces = PhabricatorSpacesNamespaceQuery::getSpacesExist();
	if ($spaces) {
	$viewer_spaces = PhabricatorSpacesNamespaceQuery::getViewerSpaces(
	$user);
	if (!$viewer_spaces) {
	$controller = new PhabricatorSpacesNoAccessController();
	return $this->delegateToController($controller);
	}
	}

	// If the user doesn't have access to the application, don't let them use
	// any of its controllers. We query the application in order to generate
	// a policy exception if the viewer doesn't have permission.
	$application = $this->getCurrentApplication();
	if ($application) {
	id(new PhabricatorApplicationQuery())
	->setViewer($user)
	->withPHIDs(array($application->getPHID()))
	->executeOne();
	}

	// If users need approval, require they wait here. We do this near the
	// end so they can take other actions (like verifying email, signing
	// documents, and enrolling in MFA) while waiting for an admin to take a
	// look at things. See T13024 for more discussion.
	if ($this->shouldRequireEnabledUser()) {
	if ($user->isLoggedIn() && !$user->getIsApproved()) {
	$controller = new PhabricatorAuthNeedsApprovalController();
	return $this->delegateToController($controller);
	}
	}
	}

	// NOTE: We do this last so that users get a login page instead of a 403
	// if they need to login.
	if ($this->shouldRequireAdmin() && !$user->getIsAdmin()) {
	return new Aphront403Response();
	}
	}

	public function getApplicationURI($path = '') {
	if (!$this->getCurrentApplication()) {
	throw new Exception(pht('No application!'));
	}
	return $this->getCurrentApplication()->getApplicationURI($path);
	}

	public function willSendResponse(AphrontResponse $response) {
	$request = $this->getRequest();

	if ($response instanceof AphrontDialogResponse) {
	if (!$request->isAjax() && !$request->isQuicksand()) {
	$dialog = $response->getDialog();

	$title = $dialog->getTitle();
	$short = $dialog->getShortTitle();

	$crumbs = $this->buildApplicationCrumbs();
	$crumbs->addTextCrumb(coalesce($short, $title));

	$page_content = array(
	$crumbs,
	$response->buildResponseString(),
	);

	$view = id(new PhabricatorStandardPageView())
	->setRequest($request)
	->setController($this)
	->setDeviceReady(true)
	->setTitle($title)
	->appendChild($page_content);

	$response = id(new AphrontWebpageResponse())
	->setContent($view->render())
	->setHTTPResponseCode($response->getHTTPResponseCode());
	} else {
	$response->getDialog()->setIsStandalone(true);

	return id(new AphrontAjaxResponse())
	->setContent(array(
	'dialog' => $response->buildResponseString(),
	));
	}
	} else if ($response instanceof AphrontRedirectResponse) {
	if ($request->isAjax() \|\| $request->isQuicksand()) {
	return id(new AphrontAjaxResponse())
	->setContent(
	array(
	'redirect' => $response->getURI(),
	'close' => $response->getCloseDialogBeforeRedirect(),
	));
	}
	}

	return $response;
	}

	/**
	* WARNING: Do not call this in new code.
	*
	* @deprecated See "Handles Technical Documentation".
	*/
	protected function loadViewerHandles(array $phids) {
	return id(new PhabricatorHandleQuery())
	->setViewer($this->getRequest()->getUser())
	->withPHIDs($phids)
	->execute();
	}

	public function buildApplicationMenu() {
	return null;
	}

	protected function buildApplicationCrumbs() {
	$crumbs = array();

	$application = $this->getCurrentApplication();
	if ($application) {
	$icon = $application->getIcon();
	if (!$icon) {
	$icon = 'fa-puzzle';
	}

	$crumbs[] = id(new PHUICrumbView())
	->setHref($this->getApplicationURI())
	->setName($application->getName())
	->setIcon($icon);
	}

	$view = new PHUICrumbsView();
	foreach ($crumbs as $crumb) {
	$view->addCrumb($crumb);
	}

	return $view;
	}

	protected function hasApplicationCapability($capability) {
	return PhabricatorPolicyFilter::hasCapability(
	$this->getRequest()->getUser(),
	$this->getCurrentApplication(),
	$capability);
	}

	protected function requireApplicationCapability($capability) {
	PhabricatorPolicyFilter::requireCapability(
	$this->getRequest()->getUser(),
	$this->getCurrentApplication(),
	$capability);
	}

	protected function explainApplicationCapability(
	$capability,
	$positive_message,
	$negative_message) {

	$can_act = $this->hasApplicationCapability($capability);
	if ($can_act) {
	$message = $positive_message;
	$icon_name = 'fa-play-circle-o lightgreytext';
	} else {
	$message = $negative_message;
	$icon_name = 'fa-lock';
	}

	$icon = id(new PHUIIconView())
	->setIcon($icon_name);

	require_celerity_resource('policy-css');

	$phid = $this->getCurrentApplication()->getPHID();
	$explain_uri = "/policy/explain/{$phid}/{$capability}/";

	$message = phutil_tag(
	'div',
	array(
	'class' => 'policy-capability-explanation',
	),
	array(
	$icon,
	javelin_tag(
	'a',
	array(
	'href' => $explain_uri,
	'sigil' => 'workflow',
	),
	$message),
	));

	return array($can_act, $message);
	}

	public function getDefaultResourceSource() {
	return 'phabricator';
	}

	/**
	* Create a new @{class:AphrontDialogView} with defaults filled in.
	*
	* @return AphrontDialogView New dialog.
	*/
	public function newDialog() {
	$submit_uri = new PhutilURI($this->getRequest()->getRequestURI());
	$submit_uri = $submit_uri->getPath();

	return id(new AphrontDialogView())
	->setUser($this->getRequest()->getUser())
	->setSubmitURI($submit_uri);
	}

	public function newRedirect() {
	return id(new AphrontRedirectResponse());
	}

	public function newPage() {
	$page = id(new PhabricatorStandardPageView())
	->setRequest($this->getRequest())
	->setController($this)
	->setDeviceReady(true);

	$application = $this->getCurrentApplication();
	if ($application) {
	$page->setApplicationName($application->getName());
	if ($application->getTitleGlyph()) {
	$page->setGlyph($application->getTitleGlyph());
	}
	}

	$viewer = $this->getRequest()->getUser();
	if ($viewer) {
	$page->setUser($viewer);
	}

	return $page;
	}

	public function newApplicationMenu() {
	return id(new PHUIApplicationMenuView())
	->setViewer($this->getViewer());
	}

	public function newCurtainView($object = null) {
	$viewer = $this->getViewer();

	$action_id = celerity_generate_unique_node_id();

	$action_list = id(new PhabricatorActionListView())
	->setViewer($viewer)
	->setID($action_id);

	// NOTE: Applications (objects of class PhabricatorApplication) can't
	// currently be set here, although they don't need any of the extensions
	// anyway. This should probably work differently than it does, though.
	if ($object) {
	if ($object instanceof PhabricatorLiskDAO) {
	$action_list->setObject($object);
	}
	}

	$curtain = id(new PHUICurtainView())
	->setViewer($viewer)
	->setActionList($action_list);

	if ($object) {
	$panels = PHUICurtainExtension::buildExtensionPanels($viewer, $object);
	foreach ($panels as $panel) {
	$curtain->addPanel($panel);
	}
	}

	return $curtain;
	}

	protected function buildTransactionTimeline(
	PhabricatorApplicationTransactionInterface $object,
	PhabricatorApplicationTransactionQuery $query = null,
	PhabricatorMarkupEngine $engine = null,
	$view_data = array()) {

	$request = $this->getRequest();
	$viewer = $this->getViewer();
	$xaction = $object->getApplicationTransactionTemplate();

	if (!$query) {
	$query = PhabricatorApplicationTransactionQuery::newQueryForObject(
	$object);
	if (!$query) {
	throw new Exception(
	pht(
	'Unable to find transaction query for object of class "%s".',
	get_class($object)));
	}
	}

	$pager = id(new AphrontCursorPagerView())
	->readFromRequest($request)
	->setURI(new PhutilURI(
	'/transactions/showolder/'.$object->getPHID().'/'));

	$xactions = $query
	->setViewer($viewer)
	->withObjectPHIDs(array($object->getPHID()))
	->needComments(true)
	->executeWithCursorPager($pager);
	$xactions = array_reverse($xactions);

	$timeline_engine = PhabricatorTimelineEngine::newForObject($object)
	->setViewer($viewer)
	->setTransactions($xactions)
	->setViewData($view_data);

	$view = $timeline_engine->buildTimelineView();

	if ($engine) {
	foreach ($xactions as $xaction) {
	if ($xaction->getComment()) {
	$engine->addObject(
	$xaction->getComment(),
	PhabricatorApplicationTransactionComment::MARKUP_FIELD_COMMENT);
	}
	}
	$engine->process();
	$view->setMarkupEngine($engine);
	}

	$timeline = $view
	->setPager($pager)
	->setQuoteTargetID($this->getRequest()->getStr('quoteTargetID'))
	->setQuoteRef($this->getRequest()->getStr('quoteRef'));

	return $timeline;
	}


	public function buildApplicationCrumbsForEditEngine() {
	// TODO: This is kind of gross, I'm basically just making this public so
	// I can use it in EditEngine. We could do this without making it public
	// by using controller delegation, or make it properly public.
	return $this->buildApplicationCrumbs();
	}

	private function requireLegalpadSignatures() {
	if (!$this->shouldRequireLogin()) {
	return null;
	}

	if ($this->shouldAllowLegallyNonCompliantUsers()) {
	return null;
	}

	$viewer = $this->getViewer();

	if (!$viewer->hasSession()) {
	return null;
	}

	$session = $viewer->getSession();
	if ($session->getIsPartial()) {
	// If the user hasn't made it through MFA yet, require they survive
	// MFA first.
	return null;
	}

	if ($session->getSignedLegalpadDocuments()) {
	return null;
	}

	if (!$viewer->isLoggedIn()) {
	return null;
	}

	$must_sign_docs = array();
	$sign_docs = array();

	$legalpad_class = 'PhabricatorLegalpadApplication';
	$legalpad_installed = PhabricatorApplication::isClassInstalledForViewer(
	$legalpad_class,
	$viewer);
	if ($legalpad_installed) {
	$sign_docs = id(new LegalpadDocumentQuery())
	->setViewer($viewer)
	->withSignatureRequired(1)
	->needViewerSignatures(true)
	->setOrder('oldest')
	->execute();

	foreach ($sign_docs as $sign_doc) {
	if (!$sign_doc->getUserSignature($viewer->getPHID())) {
	$must_sign_docs[] = $sign_doc;
	}
	}
	}

	if (!$must_sign_docs) {
	// If nothing needs to be signed (either because there are no documents
	// which require a signature, or because the user has already signed
	// all of them) mark the session as good and continue.
	$engine = id(new PhabricatorAuthSessionEngine())
	->signLegalpadDocuments($viewer, $sign_docs);

	return null;
	}

	$request = $this->getRequest();
	$request->setURIMap(
	array(
	'id' => head($must_sign_docs)->getID(),
	));

	$application = PhabricatorApplication::getByClass($legalpad_class);
	$this->setCurrentApplication($application);

	$controller = new LegalpadDocumentSignController();
	$controller->setIsSessionGate(true);
	return $this->delegateToController($controller);
	}


	/* -( Deprecated )--------------------------------------------------------- */


	/**
	* DEPRECATED. Use @{method:newPage}.
	*/
	public function buildStandardPageView() {
	return $this->newPage();
	}


	/**
	* DEPRECATED. Use @{method:newPage}.
	*/
	public function buildStandardPageResponse($view, array $data) {
	$page = $this->buildStandardPageView();
	$page->appendChild($view);
	return $page->produceAphrontResponse();
	}

	}
	diff --git a/src/view/form/control/AphrontFormControl.php b/src/view/form/control/AphrontFormControl.php
	index 0125fa87b3..d891636230 100644
	--- a/src/view/form/control/AphrontFormControl.php
	+++ b/src/view/form/control/AphrontFormControl.php
	@@ -1,244 +1,244 @@
	<?php

	abstract class AphrontFormControl extends AphrontView {

	private $label;
	private $caption;
	private $error;
	private $name;
	private $value;
	private $disabled;
	private $id;
	private $controlID;
	private $controlStyle;
	private $required;
	private $hidden;
	private $classes;

	public function setHidden($hidden) {
	$this->hidden = $hidden;
	return $this;
	}

	public function setID($id) {
	$this->id = $id;
	return $this;
	}

	public function getID() {
	return $this->id;
	}

	public function setControlID($control_id) {
	$this->controlID = $control_id;
	return $this;
	}

	public function getControlID() {
	return $this->controlID;
	}

	public function setControlStyle($control_style) {
	$this->controlStyle = $control_style;
	return $this;
	}

	public function getControlStyle() {
	return $this->controlStyle;
	}

	public function setLabel($label) {
	$this->label = $label;
	return $this;
	}

	public function getLabel() {
	return $this->label;
	}

	public function setCaption($caption) {
	$this->caption = $caption;
	return $this;
	}

	public function getCaption() {
	return $this->caption;
	}

	public function setError($error) {
	$this->error = $error;
	return $this;
	}

	public function getError() {
	return $this->error;
	}

	public function setName($name) {
	$this->name = $name;
	return $this;
	}

	public function getName() {
	return $this->name;
	}

	public function setValue($value) {
	$this->value = $value;
	return $this;
	}

	public function getValue() {
	return $this->value;
	}

	public function isValid() {
	if ($this->error && $this->error !== true) {
	return false;
	}

	if ($this->isRequired() && $this->isEmpty()) {
	return false;
	}

	return true;
	}

	public function isRequired() {
	return $this->required;
	}

	public function isEmpty() {
	return !strlen($this->getValue());
	}

	public function getSerializedValue() {
	return $this->getValue();
	}

	public function readSerializedValue($value) {
	$this->setValue($value);
	return $this;
	}

	public function readValueFromRequest(AphrontRequest $request) {
	$this->setValue($request->getStr($this->getName()));
	return $this;
	}

	public function readValueFromDictionary(array $dictionary) {
	$this->setValue(idx($dictionary, $this->getName()));
	return $this;
	}

	public function setDisabled($disabled) {
	$this->disabled = $disabled;
	return $this;
	}

	public function getDisabled() {
	return $this->disabled;
	}

	abstract protected function renderInput();
	abstract protected function getCustomControlClass();

	protected function shouldRender() {
	return true;
	}

	public function addClass($class) {
	$this->classes[] = $class;
	return $this;
	}

	final public function render() {
	if (!$this->shouldRender()) {
	return null;
	}

	$custom_class = $this->getCustomControlClass();

	// If we don't have an ID yet, assign an automatic one so we can associate
	// the label with the control. This allows assistive technologies to read
	// form labels.
	if (!$this->getID()) {
	$this->setID(celerity_generate_unique_node_id());
	}

	$input = phutil_tag(
	'div',
	array('class' => 'aphront-form-input'),
	$this->renderInput());

	$error = null;
	- if (strlen($this->getError())) {
	+ if ($this->getError()) {
	$error = $this->getError();
	if ($error === true) {
	$error = phutil_tag(
	'span',
	array('class' => 'aphront-form-error aphront-form-required'),
	pht('Required'));
	} else {
	$error = phutil_tag(
	'span',
	array('class' => 'aphront-form-error'),
	$error);
	}
	}

	- if (strlen($this->getLabel())) {
	+ if (phutil_nonempty_string($this->getLabel())) {
	$label = phutil_tag(
	'label',
	array(
	'class' => 'aphront-form-label',
	'for' => $this->getID(),
	),
	array(
	$this->getLabel(),
	$error,
	));
	} else {
	$label = null;
	$custom_class .= ' aphront-form-control-nolabel';
	}

	- if (strlen($this->getCaption())) {
	+ if (phutil_nonempty_string($this->getCaption())) {
	$caption = phutil_tag(
	'div',
	array('class' => 'aphront-form-caption'),
	$this->getCaption());
	} else {
	$caption = null;
	}

	$classes = array();
	$classes[] = 'aphront-form-control';
	$classes[] = 'grouped';
	$classes[] = $custom_class;
	if ($this->classes) {
	foreach ($this->classes as $class) {
	$classes[] = $class;
	}
	}

	$style = $this->controlStyle;
	if ($this->hidden) {
	$style = 'display: none; '.$style;
	}

	return phutil_tag(
	'div',
	array(
	'class' => implode(' ', $classes),
	'id' => $this->controlID,
	'style' => $style,
	),
	array(
	$label,
	$error,
	$input,
	$caption,
	));
	}
	}

File Metadata

Mime Type: text/x-diff
Expires: Sun, Sep 7, 9:33 AM (1 d, 19 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 220700
Default Alt Text: (50 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions