site/join/signup-handler.php
Anton McClure e761216d08
signup fix
2020-07-01 19:48:42 -04:00

150 lines
3.9 KiB
PHP

<?php
require_once "../email/smtp.php";
function forbidden_name($name) {
return in_array($name, [
'0x0',
'abuse',
'admin',
'anton',
'amcclure',
'zenith',
'summit',
'administrator',
'auth',
'autoconfig',
'bbj',
'broadcasthost',
'cloud',
'forum',
'ftp',
'git',
'gopher',
'hostmaster',
'imap',
'info',
'irc',
'is',
'isatap',
'it',
'localdomain',
'localhost',
'lounge',
'mail',
'mailer-daemon',
'marketing',
'marketting',
'mis',
'news',
'nobody',
'noc',
'noreply',
'oracle',
'pop',
'pop3',
'postmaster',
'register',
'retro',
'root',
'sales',
'security',
'signup',
'smtp',
'ssladmin',
'ssladministrator',
'sslwebmaster',
'summit',
'support',
'sysadmin',
'team',
'thunix',
'usenet',
'uucp',
'webmaster',
'wpad',
'www',
'znc',
]);
}
$message = "";
if (isset($_REQUEST["username"]) && isset($_REQUEST["email"]) && isset($_REQUEST["fullname"])) {
// Check the name.
$fullname = trim($_REQUEST["fullname"]);
if ($fullname == "")
$message .= "<li>Enter your full name</li>";
// Check the name.
$name = trim($_REQUEST["username"]);
if ($name == "")
$message .= "<li>Enter a username</li>";
if (strlen($name) > 32)
$message .= "<li>username too long (32 character max)</li>";
if (!preg_match('/^[a-z][a-z0-9]{2,31}$/', $name))
$message .= "<li>Username contains invalid characters (lowercase only, must start with a letter)</li>";
if ($_REQUEST["sshkey"] == "" || mb_substr($_REQUEST["sshkey"], 0, 4) !== "ssh-")
$message .= '<li>SSH key required: please create one and submit the public key.</li>';
if ($_REQUEST["interest"] == "")
$message .= "<li>Please explain why you're interested so we can make sure you're a real human being</li>";
if (posix_getpwnam($name) || forbidden_name($name))
$message .= "<li>Sorry, the username $name is unavailable</li>";
// Check the e-mail address.
$email = trim($_REQUEST["email"]);
if ($email == "")
$message .= "<li>Please fill in your email address</li>";
else {
$result = SMTP::MakeValidEmailAddress($_REQUEST["email"]);
if (!$result["success"])
$message .= "<li>invalid email address: " . htmlspecialchars($result["error"]) . "</li>";
elseif ($result["email"] != $email)
$message .= "<li>invalid email address. did you mean: " . htmlspecialchars($result["email"]) . "</li>";
}
// no validation errors
if ($message == "") {
$sshkey = trim($_REQUEST["sshkey"]);
$makeuser = "./makeuser {$_REQUEST["username"]} \"{$fullname}\" {$_REQUEST["email"]} \"{$sshkey}\"";
$msgbody = "
Full name: {$_REQUEST["fullname"]}
Username: {$_REQUEST["username"]}
Email address: {$_REQUEST["email"]}
Reason:
{$_REQUEST["interest"]}
SSH Key:
{$_REQUEST["sshkey"]}
$makeuser
";
if (mail('root', 'New registration request', $msgbody)) {
header("Location: /join/success");
file_put_contents("/var/signups", $makeuser.PHP_EOL, FILE_APPEND);
// validation errors
} else {
echo '<div class="alert alert-danger" role="alert">
Something went wrong... Please send an email to <a href="mailto:admin@summit.tildex.com">admin@summit.tildex.com</a> with details of what happened
</div>';
}
} else {
?>
<div class="message" role="alert">
<strong>Please correct the following errors before continuing: </strong>
<?=$message?>
</div>
<?php
}
}
?>