jcs.org
CMS for the late garbage.fm
1<?php
2
3class AdminController extends ApplicationController {
4 static $session = "on";
5 static $before_filter = array(
6 "authenticate_user",
7 "require_logged_in_user" => array("except" => array("login", "auth",
8 "auth2")),
9 );
10
11 static $verify = array(
12 array("method" => "post",
13 "only" => array("auth", "logout", "update_notes",
14 "update_show_settings"),
15 "redirect_to" => ADMIN_ROOT_URL,
16 ),
17 );
18
19 static $filter_parameter_logging = array("password", "totp_secret",
20 "totp_code");
21
22 public function auth() {
23 if ($user = User::find_by_username($this->params["username"])) {
24 if ($user->hashed_password == "" ||
25 $user->password_matches($this->params["password"])) {
26 $_SESSION["auth_user_id"] = $user->id;
27 HalfMoon\Log::info("authenticated as " . $user->username);
28 return $this->render(array("action" => "auth2"),
29 array("auth_user" => $user));
30 }
31
32 HalfMoon\Log::error("logged failed for " . $user->username);
33 }
34
35 $this->add_flash_error("Invalid username and/or password.");
36 return $this->render(array("action" => "login"));
37 }
38
39 public function auth2() {
40 if (!$_SESSION["auth_user_id"])
41 return $this->redirect_to(ADMIN_ROOT_URL . "login");
42
43 $user = User::find($_SESSION["auth_user_id"]);
44 if (empty($user->totp_secret) ||
45 ($this->params["totp_code"] &&
46 $user->totp->verify($this->params["totp_code"]))) {
47 if (empty($user->totp_secret)) {
48 $user->totp_secret = $this->params["totp_secret"];
49 $user->save();
50 }
51
52 $_SESSION["user_id"] = $_SESSION["auth_user_id"];
53 unset($_SESSION["auth_user_id"]);
54 return $this->redirect_to(ADMIN_ROOT_URL);
55 }
56
57 $this->add_flash_error("Invalid TOTP code");
58 $this->render(array("action" => "auth2"), array("auth_user" => $user));
59 }
60
61 public function flushcache() {
62 $this->flush_cache();
63 return $this->redirect_to(ADMIN_ROOT_URL);
64 }
65
66 public function index() {
67 if ($this->user->hashed_password == "")
68 return $this->redirect_to(ADMIN_ROOT_URL . "profile");
69
70 $this->find_other_users();
71
72 $this->episodes = Episode::find("all",
73 array("order" => "episode DESC"));
74 }
75
76 public function login() {
77 $this->page_title = "Login";
78 }
79
80 public function logout() {
81 if ($this->user)
82 session_destroy();
83
84 $this->add_flash_notice("You have been logged out.");
85
86 return $this->redirect_to("/");
87 }
88
89 public function show_settings() {
90 }
91
92 public function twitter_auth() {
93 $rt = Twitter::new_request_token(ADMIN_ROOT_URL . "twitter_verify");
94
95 $_SESSION["twitter_token"] = $rt["oauth_token"];
96 $_SESSION["twitter_secret"] = $rt["oauth_token_secret"];
97
98 try {
99 return $this->redirect_to(Twitter::new_authorize_url(
100 $rt["oauth_token"]));
101 }
102 catch (Exception $e) {
103 \HalfMoon\Log::error("couldn't get url for twitter authorization: "
104 . $e->getMessage());
105 $this->add_flash_error("Could not add Twitter account.");
106 return $this->redirect_to(ADMIN_ROOT_URL . "show_settings");
107 }
108 }
109
110 /* we'll get back to here from a twitter.com redirect */
111 public function twitter_verify() {
112 $tt = @$_SESSION["twitter_token"];
113 $ts = @$_SESSION["twitter_secret"];
114
115 unset($_SESSION["twitter_token"]);
116 unset($_SESSION["twitter_secret"]);
117
118 if (!empty($this->params["denied"])) {
119 /* user clicked cancel */
120 $this->add_flash_notice("Twitter authentication canceled.");
121 return $this->redirect_to(ADMIN_ROOT_URL . "show_settings");
122 }
123
124 try {
125 if (empty($tt) || $this->params["oauth_token"] !== $tt)
126 throw new Exception("invalid oauth token received back");
127
128 if (Twitter::verify_oauth_credentials($tt, $ts,
129 $this->params["oauth_verifier"])) {
130 $this->add_flash_success("Twitter account has been "
131 . "authenticated.");
132 return $this->redirect_to(ADMIN_ROOT_URL . "show_settings");
133 }
134 else
135 throw new Exception("verification failed");
136 }
137 catch (Exception $e) {
138 $this->add_flash_error("Could not authenticate Twitter account.");
139 return $this->redirect_to(ADMIN_ROOT_URL . "show_settings");
140 }
141 }
142
143 public function update_notes() {
144 $this->user->upcoming_notes = $this->params["upcoming_notes"];
145 $this->user->private_notes = $this->params["private_notes"];
146 $this->user->save();
147
148 $this->add_flash_success("Your upcoming show notes have been saved.");
149 return $this->redirect_to(ADMIN_ROOT_URL);
150 }
151
152 public function other_notes() {
153 $this->find_other_users();
154
155 return $this->render(array("partial" => "notes", "layout" => false));
156 }
157
158 public function update_show_settings() {
159 $this->settings = $this->settings();
160 if ($this->settings->update_attributes($this->params["settings"])) {
161 $this->add_flash_success("Show settings have been updated.");
162 return $this->redirect_to(ADMIN_ROOT_URL);
163 }
164 else
165 $this->render(array("action" => "show_settings"));
166 }
167
168 protected function find_other_users() {
169 $this->other_users = User::find("all",
170 array("conditions" => array("id <> ?", $this->user->id)));
171 }
172}
173
174?>