No OneTemporary
Actions

Size

30 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/applications/auth/editor/PhabricatorAuthSSHKeyEditor.php b/src/applications/auth/editor/PhabricatorAuthSSHKeyEditor.php
	index 4d04707598..0962b7b56a 100644
	--- a/src/applications/auth/editor/PhabricatorAuthSSHKeyEditor.php
	+++ b/src/applications/auth/editor/PhabricatorAuthSSHKeyEditor.php
	@@ -1,258 +1,256 @@
	<?php

	final class PhabricatorAuthSSHKeyEditor
	extends PhabricatorApplicationTransactionEditor {

	public function getEditorApplicationClass() {
	return 'PhabricatorAuthApplication';
	}

	public function getEditorObjectsDescription() {
	return pht('SSH Keys');
	}

	public function getTransactionTypes() {
	$types = parent::getTransactionTypes();

	$types[] = PhabricatorAuthSSHKeyTransaction::TYPE_NAME;
	$types[] = PhabricatorAuthSSHKeyTransaction::TYPE_KEY;
	$types[] = PhabricatorAuthSSHKeyTransaction::TYPE_DEACTIVATE;

	return $types;
	}

	protected function getCustomTransactionOldValue(
	PhabricatorLiskDAO $object,
	PhabricatorApplicationTransaction $xaction) {

	switch ($xaction->getTransactionType()) {
	case PhabricatorAuthSSHKeyTransaction::TYPE_NAME:
	return $object->getName();
	case PhabricatorAuthSSHKeyTransaction::TYPE_KEY:
	return $object->getEntireKey();
	case PhabricatorAuthSSHKeyTransaction::TYPE_DEACTIVATE:
	return !$object->getIsActive();
	}

	}

	protected function getCustomTransactionNewValue(
	PhabricatorLiskDAO $object,
	PhabricatorApplicationTransaction $xaction) {

	switch ($xaction->getTransactionType()) {
	case PhabricatorAuthSSHKeyTransaction::TYPE_NAME:
	case PhabricatorAuthSSHKeyTransaction::TYPE_KEY:
	return $xaction->getNewValue();
	case PhabricatorAuthSSHKeyTransaction::TYPE_DEACTIVATE:
	return (bool)$xaction->getNewValue();
	}
	}

	protected function applyCustomInternalTransaction(
	PhabricatorLiskDAO $object,
	PhabricatorApplicationTransaction $xaction) {

	$value = $xaction->getNewValue();
	switch ($xaction->getTransactionType()) {
	case PhabricatorAuthSSHKeyTransaction::TYPE_NAME:
	$object->setName($value);
	return;
	case PhabricatorAuthSSHKeyTransaction::TYPE_KEY:
	$public_key = PhabricatorAuthSSHPublicKey::newFromRawKey($value);

	$type = $public_key->getType();
	$body = $public_key->getBody();
	$comment = $public_key->getComment();

	$object->setKeyType($type);
	$object->setKeyBody($body);
	$object->setKeyComment($comment);
	return;
	case PhabricatorAuthSSHKeyTransaction::TYPE_DEACTIVATE:
	if ($value) {
	$new = null;
	} else {
	$new = 1;
	}

	$object->setIsActive($new);
	return;
	}
	}

	protected function applyCustomExternalTransaction(
	PhabricatorLiskDAO $object,
	PhabricatorApplicationTransaction $xaction) {
	return;
	}

	protected function validateTransaction(
	PhabricatorLiskDAO $object,
	$type,
	array $xactions) {

	$errors = parent::validateTransaction($object, $type, $xactions);

	switch ($type) {
	case PhabricatorAuthSSHKeyTransaction::TYPE_NAME:
	$missing = $this->validateIsEmptyTextField(
	$object->getName(),
	$xactions);

	if ($missing) {
	$error = new PhabricatorApplicationTransactionValidationError(
	$type,
	pht('Required'),
	pht('SSH key name is required.'),
	nonempty(last($xactions), null));

	$error->setIsMissingFieldError(true);
	$errors[] = $error;
	}
	break;

	case PhabricatorAuthSSHKeyTransaction::TYPE_KEY;
	$missing = $this->validateIsEmptyTextField(
	$object->getName(),
	$xactions);

	if ($missing) {
	$error = new PhabricatorApplicationTransactionValidationError(
	$type,
	pht('Required'),
	pht('SSH key material is required.'),
	nonempty(last($xactions), null));

	$error->setIsMissingFieldError(true);
	$errors[] = $error;
	} else {
	foreach ($xactions as $xaction) {
	$new = $xaction->getNewValue();

	try {
	$public_key = PhabricatorAuthSSHPublicKey::newFromRawKey($new);
	} catch (Exception $ex) {
	$errors[] = new PhabricatorApplicationTransactionValidationError(
	$type,
	pht('Invalid'),
	$ex->getMessage(),
	$xaction);
	}
	}
	}
	break;

	case PhabricatorAuthSSHKeyTransaction::TYPE_DEACTIVATE:
	foreach ($xactions as $xaction) {
	if (!$xaction->getNewValue()) {
	$errors[] = new PhabricatorApplicationTransactionValidationError(
	$type,
	pht('Invalid'),
	pht('SSH keys can not be reactivated.'),
	$xaction);
	}
	}
	break;
	}

	return $errors;
	}

	protected function didCatchDuplicateKeyException(
	PhabricatorLiskDAO $object,
	array $xactions,
	Exception $ex) {

	$errors = array();
	$errors[] = new PhabricatorApplicationTransactionValidationError(
	PhabricatorAuthSSHKeyTransaction::TYPE_KEY,
	pht('Duplicate'),
	pht(
	'This public key is already associated with another user or device. '.
	'Each key must unambiguously identify a single unique owner.'),
	null);

	throw new PhabricatorApplicationTransactionValidationException($errors);
	}


	protected function shouldSendMail(
	PhabricatorLiskDAO $object,
	array $xactions) {
	return true;
	}

	protected function getMailSubjectPrefix() {
	return pht('[SSH Key]');
	}

	protected function getMailThreadID(PhabricatorLiskDAO $object) {
	return 'ssh-key-'.$object->getPHID();
	}

	protected function applyFinalEffects(
	PhabricatorLiskDAO $object,
	array $xactions) {

	// After making any change to an SSH key, drop the authfile cache so it
	// is regenerated the next time anyone authenticates.
	- $cache = PhabricatorCaches::getMutableCache();
	- $authfile_key = PhabricatorAuthSSHKeyQuery::AUTHFILE_CACHEKEY;
	- $cache->deleteKey($authfile_key);
	+ PhabricatorAuthSSHKeyQuery::deleteSSHKeyCache();

	return $xactions;
	}


	protected function getMailTo(PhabricatorLiskDAO $object) {
	return $object->getObject()->getSSHKeyNotifyPHIDs();
	}

	protected function getMailCC(PhabricatorLiskDAO $object) {
	return array();
	}

	protected function buildReplyHandler(PhabricatorLiskDAO $object) {
	return id(new PhabricatorAuthSSHKeyReplyHandler())
	->setMailReceiver($object);
	}

	protected function buildMailTemplate(PhabricatorLiskDAO $object) {
	$id = $object->getID();
	$name = $object->getName();
	$phid = $object->getPHID();

	$mail = id(new PhabricatorMetaMTAMail())
	->setSubject(pht('SSH Key %d: %s', $id, $name))
	->addHeader('Thread-Topic', $phid);

	// The primary value of this mail is alerting users to account compromises,
	// so force delivery. In particular, this mail should still be delievered
	// even if "self mail" is disabled.
	$mail->setForceDelivery(true);

	return $mail;
	}

	protected function buildMailBody(
	PhabricatorLiskDAO $object,
	array $xactions) {

	$body = parent::buildMailBody($object, $xactions);

	$body->addTextSection(
	pht('SECURITY WARNING'),
	pht(
	'If you do not recognize this change, it may indicate your account '.
	'has been compromised.'));

	$detail_uri = $object->getURI();
	$detail_uri = PhabricatorEnv::getProductionURI($detail_uri);

	$body->addLinkSection(pht('SSH KEY DETAIL'), $detail_uri);

	return $body;
	}

	}
	diff --git a/src/applications/auth/query/PhabricatorAuthSSHKeyQuery.php b/src/applications/auth/query/PhabricatorAuthSSHKeyQuery.php
	index 6ba047d100..77b666ea44 100644
	--- a/src/applications/auth/query/PhabricatorAuthSSHKeyQuery.php
	+++ b/src/applications/auth/query/PhabricatorAuthSSHKeyQuery.php
	@@ -1,132 +1,138 @@
	<?php

	final class PhabricatorAuthSSHKeyQuery
	extends PhabricatorCursorPagedPolicyAwareQuery {

	const AUTHFILE_CACHEKEY = 'ssh.authfile';

	private $ids;
	private $phids;
	private $objectPHIDs;
	private $keys;
	private $isActive;

	+ public static function deleteSSHKeyCache() {
	+ $cache = PhabricatorCaches::getMutableCache();
	+ $authfile_key = self::AUTHFILE_CACHEKEY;
	+ $cache->deleteKey($authfile_key);
	+ }
	+
	public function withIDs(array $ids) {
	$this->ids = $ids;
	return $this;
	}

	public function withPHIDs(array $phids) {
	$this->phids = $phids;
	return $this;
	}

	public function withObjectPHIDs(array $object_phids) {
	$this->objectPHIDs = $object_phids;
	return $this;
	}

	public function withKeys(array $keys) {
	assert_instances_of($keys, 'PhabricatorAuthSSHPublicKey');
	$this->keys = $keys;
	return $this;
	}

	public function withIsActive($active) {
	$this->isActive = $active;
	return $this;
	}

	public function newResultObject() {
	return new PhabricatorAuthSSHKey();
	}

	protected function loadPage() {
	return $this->loadStandardPage($this->newResultObject());
	}

	protected function willFilterPage(array $keys) {
	$object_phids = mpull($keys, 'getObjectPHID');

	$objects = id(new PhabricatorObjectQuery())
	->setViewer($this->getViewer())
	->setParentQuery($this)
	->withPHIDs($object_phids)
	->execute();
	$objects = mpull($objects, null, 'getPHID');

	foreach ($keys as $key => $ssh_key) {
	$object = idx($objects, $ssh_key->getObjectPHID());

	// We must have an object, and that object must be a valid object for
	// SSH keys.
	if (!$object \|\| !($object instanceof PhabricatorSSHPublicKeyInterface)) {
	$this->didRejectResult($ssh_key);
	unset($keys[$key]);
	continue;
	}

	$ssh_key->attachObject($object);
	}

	return $keys;
	}

	protected function buildWhereClauseParts(AphrontDatabaseConnection $conn) {
	$where = parent::buildWhereClauseParts($conn);

	if ($this->ids !== null) {
	$where[] = qsprintf(
	$conn,
	'id IN (%Ld)',
	$this->ids);
	}

	if ($this->phids !== null) {
	$where[] = qsprintf(
	$conn,
	'phid IN (%Ls)',
	$this->phids);
	}

	if ($this->objectPHIDs !== null) {
	$where[] = qsprintf(
	$conn,
	'objectPHID IN (%Ls)',
	$this->objectPHIDs);
	}

	if ($this->keys !== null) {
	$sql = array();
	foreach ($this->keys as $key) {
	$sql[] = qsprintf(
	$conn,
	'(keyType = %s AND keyIndex = %s)',
	$key->getType(),
	$key->getHash());
	}
	$where[] = implode(' OR ', $sql);
	}

	if ($this->isActive !== null) {
	if ($this->isActive) {
	$where[] = qsprintf(
	$conn,
	'isActive = %d',
	1);
	} else {
	$where[] = qsprintf(
	$conn,
	'isActive IS NULL');
	}
	}

	return $where;

	}

	public function getQueryApplicationClass() {
	return 'PhabricatorAuthApplication';
	}

	}
	diff --git a/src/applications/people/editor/PhabricatorUserEditor.php b/src/applications/people/editor/PhabricatorUserEditor.php
	index 3370fb428b..cb5ed65f8d 100644
	--- a/src/applications/people/editor/PhabricatorUserEditor.php
	+++ b/src/applications/people/editor/PhabricatorUserEditor.php
	@@ -1,734 +1,738 @@
	<?php

	/**
	* Editor class for creating and adjusting users. This class guarantees data
	* integrity and writes logs when user information changes.
	*
	* @task config Configuration
	* @task edit Creating and Editing Users
	* @task role Editing Roles
	* @task email Adding, Removing and Changing Email
	* @task internal Internals
	*/
	final class PhabricatorUserEditor extends PhabricatorEditor {

	private $logs = array();


	/* -( Creating and Editing Users )----------------------------------------- */


	/**
	* @task edit
	*/
	public function createNewUser(
	PhabricatorUser $user,
	PhabricatorUserEmail $email,
	$allow_reassign = false) {

	if ($user->getID()) {
	throw new Exception(pht('User has already been created!'));
	}

	$is_reassign = false;
	if ($email->getID()) {
	if ($allow_reassign) {
	if ($email->getIsPrimary()) {
	throw new Exception(
	pht('Primary email addresses can not be reassigned.'));
	}
	$is_reassign = true;
	} else {
	throw new Exception(pht('Email has already been created!'));
	}
	}

	if (!PhabricatorUser::validateUsername($user->getUsername())) {
	$valid = PhabricatorUser::describeValidUsername();
	throw new Exception(pht('Username is invalid! %s', $valid));
	}

	// Always set a new user's email address to primary.
	$email->setIsPrimary(1);

	// If the primary address is already verified, also set the verified flag
	// on the user themselves.
	if ($email->getIsVerified()) {
	$user->setIsEmailVerified(1);
	}

	$this->willAddEmail($email);

	$user->openTransaction();
	try {
	$user->save();
	$email->setUserPHID($user->getPHID());
	$email->save();
	} catch (AphrontDuplicateKeyQueryException $ex) {
	// We might have written the user but failed to write the email; if
	// so, erase the IDs we attached.
	$user->setID(null);
	$user->setPHID(null);

	$user->killTransaction();
	throw $ex;
	}

	$log = PhabricatorUserLog::initializeNewLog(
	$this->requireActor(),
	$user->getPHID(),
	PhabricatorUserLog::ACTION_CREATE);
	$log->setNewValue($email->getAddress());
	$log->save();

	if ($is_reassign) {
	$log = PhabricatorUserLog::initializeNewLog(
	$this->requireActor(),
	$user->getPHID(),
	PhabricatorUserLog::ACTION_EMAIL_REASSIGN);
	$log->setNewValue($email->getAddress());
	$log->save();
	}

	$user->saveTransaction();

	if ($email->getIsVerified()) {
	$this->didVerifyEmail($user, $email);
	}

	return $this;
	}


	/**
	* @task edit
	*/
	public function updateUser(
	PhabricatorUser $user,
	PhabricatorUserEmail $email = null) {

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}

	$user->openTransaction();
	$user->save();
	if ($email) {
	$email->save();
	}

	$log = PhabricatorUserLog::initializeNewLog(
	$this->requireActor(),
	$user->getPHID(),
	PhabricatorUserLog::ACTION_EDIT);
	$log->save();

	$user->saveTransaction();

	return $this;
	}


	/**
	* @task edit
	*/
	public function changePassword(
	PhabricatorUser $user,
	PhutilOpaqueEnvelope $envelope) {

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}

	$user->openTransaction();
	$user->reload();

	$user->setPassword($envelope);
	$user->save();

	$log = PhabricatorUserLog::initializeNewLog(
	$this->requireActor(),
	$user->getPHID(),
	PhabricatorUserLog::ACTION_CHANGE_PASSWORD);
	$log->save();

	$user->saveTransaction();
	}


	/**
	* @task edit
	*/
	public function changeUsername(PhabricatorUser $user, $username) {
	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}

	if (!PhabricatorUser::validateUsername($username)) {
	$valid = PhabricatorUser::describeValidUsername();
	throw new Exception(pht('Username is invalid! %s', $valid));
	}

	$old_username = $user->getUsername();

	$user->openTransaction();
	$user->reload();
	$user->setUsername($username);

	try {
	$user->save();
	} catch (AphrontDuplicateKeyQueryException $ex) {
	$user->setUsername($old_username);
	$user->killTransaction();
	throw $ex;
	}

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_CHANGE_USERNAME);
	$log->setOldValue($old_username);
	$log->setNewValue($username);
	$log->save();

	$user->saveTransaction();

	+ // The SSH key cache currently includes usernames, so dirty it. See T12554
	+ // for discussion.
	+ PhabricatorAuthSSHKeyQuery::deleteSSHKeyCache();
	+
	$user->sendUsernameChangeEmail($actor, $old_username);
	}


	/* -( Editing Roles )------------------------------------------------------ */


	/**
	* @task role
	*/
	public function makeAdminUser(PhabricatorUser $user, $admin) {
	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}

	$user->openTransaction();
	$user->beginWriteLocking();

	$user->reload();
	if ($user->getIsAdmin() == $admin) {
	$user->endWriteLocking();
	$user->killTransaction();
	return $this;
	}

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_ADMIN);
	$log->setOldValue($user->getIsAdmin());
	$log->setNewValue($admin);

	$user->setIsAdmin((int)$admin);
	$user->save();

	$log->save();

	$user->endWriteLocking();
	$user->saveTransaction();

	return $this;
	}

	/**
	* @task role
	*/
	public function makeSystemAgentUser(PhabricatorUser $user, $system_agent) {
	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}

	$user->openTransaction();
	$user->beginWriteLocking();

	$user->reload();
	if ($user->getIsSystemAgent() == $system_agent) {
	$user->endWriteLocking();
	$user->killTransaction();
	return $this;
	}

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_SYSTEM_AGENT);
	$log->setOldValue($user->getIsSystemAgent());
	$log->setNewValue($system_agent);

	$user->setIsSystemAgent((int)$system_agent);
	$user->save();

	$log->save();

	$user->endWriteLocking();
	$user->saveTransaction();

	return $this;
	}

	/**
	* @task role
	*/
	public function makeMailingListUser(PhabricatorUser $user, $mailing_list) {
	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}

	$user->openTransaction();
	$user->beginWriteLocking();

	$user->reload();
	if ($user->getIsMailingList() == $mailing_list) {
	$user->endWriteLocking();
	$user->killTransaction();
	return $this;
	}

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_MAILING_LIST);
	$log->setOldValue($user->getIsMailingList());
	$log->setNewValue($mailing_list);

	$user->setIsMailingList((int)$mailing_list);
	$user->save();

	$log->save();

	$user->endWriteLocking();
	$user->saveTransaction();

	return $this;
	}

	/**
	* @task role
	*/
	public function disableUser(PhabricatorUser $user, $disable) {
	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}

	$user->openTransaction();
	$user->beginWriteLocking();

	$user->reload();
	if ($user->getIsDisabled() == $disable) {
	$user->endWriteLocking();
	$user->killTransaction();
	return $this;
	}

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_DISABLE);
	$log->setOldValue($user->getIsDisabled());
	$log->setNewValue($disable);

	$user->setIsDisabled((int)$disable);
	$user->save();

	$log->save();

	$user->endWriteLocking();
	$user->saveTransaction();

	return $this;
	}


	/**
	* @task role
	*/
	public function approveUser(PhabricatorUser $user, $approve) {
	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}

	$user->openTransaction();
	$user->beginWriteLocking();

	$user->reload();
	if ($user->getIsApproved() == $approve) {
	$user->endWriteLocking();
	$user->killTransaction();
	return $this;
	}

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_APPROVE);
	$log->setOldValue($user->getIsApproved());
	$log->setNewValue($approve);

	$user->setIsApproved($approve);
	$user->save();

	$log->save();

	$user->endWriteLocking();
	$user->saveTransaction();

	return $this;
	}


	/* -( Adding, Removing and Changing Email )-------------------------------- */


	/**
	* @task email
	*/
	public function addEmail(
	PhabricatorUser $user,
	PhabricatorUserEmail $email) {

	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}
	if ($email->getID()) {
	throw new Exception(pht('Email has already been created!'));
	}

	// Use changePrimaryEmail() to change primary email.
	$email->setIsPrimary(0);
	$email->setUserPHID($user->getPHID());

	$this->willAddEmail($email);

	$user->openTransaction();
	$user->beginWriteLocking();

	$user->reload();

	try {
	$email->save();
	} catch (AphrontDuplicateKeyQueryException $ex) {
	$user->endWriteLocking();
	$user->killTransaction();

	throw $ex;
	}

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_EMAIL_ADD);
	$log->setNewValue($email->getAddress());
	$log->save();

	$user->endWriteLocking();
	$user->saveTransaction();

	return $this;
	}


	/**
	* @task email
	*/
	public function removeEmail(
	PhabricatorUser $user,
	PhabricatorUserEmail $email) {

	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}
	if (!$email->getID()) {
	throw new Exception(pht('Email has not been created yet!'));
	}

	$user->openTransaction();
	$user->beginWriteLocking();

	$user->reload();
	$email->reload();

	if ($email->getIsPrimary()) {
	throw new Exception(pht("Can't remove primary email!"));
	}
	if ($email->getUserPHID() != $user->getPHID()) {
	throw new Exception(pht('Email not owned by user!'));
	}

	$email->delete();

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_EMAIL_REMOVE);
	$log->setOldValue($email->getAddress());
	$log->save();

	$user->endWriteLocking();
	$user->saveTransaction();

	$this->revokePasswordResetLinks($user);

	return $this;
	}


	/**
	* @task email
	*/
	public function changePrimaryEmail(
	PhabricatorUser $user,
	PhabricatorUserEmail $email) {
	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}
	if (!$email->getID()) {
	throw new Exception(pht('Email has not been created yet!'));
	}

	$user->openTransaction();
	$user->beginWriteLocking();

	$user->reload();
	$email->reload();

	if ($email->getUserPHID() != $user->getPHID()) {
	throw new Exception(pht('User does not own email!'));
	}

	if ($email->getIsPrimary()) {
	throw new Exception(pht('Email is already primary!'));
	}

	if (!$email->getIsVerified()) {
	throw new Exception(pht('Email is not verified!'));
	}

	$old_primary = $user->loadPrimaryEmail();
	if ($old_primary) {
	$old_primary->setIsPrimary(0);
	$old_primary->save();
	}

	$email->setIsPrimary(1);
	$email->save();

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_EMAIL_PRIMARY);
	$log->setOldValue($old_primary ? $old_primary->getAddress() : null);
	$log->setNewValue($email->getAddress());

	$log->save();

	$user->endWriteLocking();
	$user->saveTransaction();

	if ($old_primary) {
	$old_primary->sendOldPrimaryEmail($user, $email);
	}
	$email->sendNewPrimaryEmail($user);


	$this->revokePasswordResetLinks($user);

	return $this;
	}


	/**
	* Verify a user's email address.
	*
	* This verifies an individual email address. If the address is the user's
	* primary address and their account was not previously verified, their
	* account is marked as email verified.
	*
	* @task email
	*/
	public function verifyEmail(
	PhabricatorUser $user,
	PhabricatorUserEmail $email) {
	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}
	if (!$email->getID()) {
	throw new Exception(pht('Email has not been created yet!'));
	}

	$user->openTransaction();
	$user->beginWriteLocking();

	$user->reload();
	$email->reload();

	if ($email->getUserPHID() != $user->getPHID()) {
	throw new Exception(pht('User does not own email!'));
	}

	if (!$email->getIsVerified()) {
	$email->setIsVerified(1);
	$email->save();

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_EMAIL_VERIFY);
	$log->setNewValue($email->getAddress());
	$log->save();
	}

	if (!$user->getIsEmailVerified()) {
	// If the user just verified their primary email address, mark their
	// account as email verified.
	$user_primary = $user->loadPrimaryEmail();
	if ($user_primary->getID() == $email->getID()) {
	$user->setIsEmailVerified(1);
	$user->save();
	}
	}

	$user->endWriteLocking();
	$user->saveTransaction();

	$this->didVerifyEmail($user, $email);
	}


	/**
	* Reassign an unverified email address.
	*/
	public function reassignEmail(
	PhabricatorUser $user,
	PhabricatorUserEmail $email) {
	$actor = $this->requireActor();

	if (!$user->getID()) {
	throw new Exception(pht('User has not been created yet!'));
	}

	if (!$email->getID()) {
	throw new Exception(pht('Email has not been created yet!'));
	}

	$user->openTransaction();
	$user->beginWriteLocking();

	$user->reload();
	$email->reload();

	$old_user = $email->getUserPHID();

	if ($old_user != $user->getPHID()) {
	if ($email->getIsVerified()) {
	throw new Exception(
	pht('Verified email addresses can not be reassigned.'));
	}
	if ($email->getIsPrimary()) {
	throw new Exception(
	pht('Primary email addresses can not be reassigned.'));
	}

	$email->setUserPHID($user->getPHID());
	$email->save();

	$log = PhabricatorUserLog::initializeNewLog(
	$actor,
	$user->getPHID(),
	PhabricatorUserLog::ACTION_EMAIL_REASSIGN);
	$log->setNewValue($email->getAddress());
	$log->save();
	}

	$user->endWriteLocking();
	$user->saveTransaction();
	}


	/* -( Internals )---------------------------------------------------------- */


	/**
	* @task internal
	*/
	private function willAddEmail(PhabricatorUserEmail $email) {

	// Hard check before write to prevent creation of disallowed email
	// addresses. Normally, the application does checks and raises more
	// user friendly errors for us, but we omit the courtesy checks on some
	// pathways like administrative scripts for simplicity.

	if (!PhabricatorUserEmail::isValidAddress($email->getAddress())) {
	throw new Exception(PhabricatorUserEmail::describeValidAddresses());
	}

	if (!PhabricatorUserEmail::isAllowedAddress($email->getAddress())) {
	throw new Exception(PhabricatorUserEmail::describeAllowedAddresses());
	}

	$application_email = id(new PhabricatorMetaMTAApplicationEmailQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withAddresses(array($email->getAddress()))
	->executeOne();
	if ($application_email) {
	throw new Exception($application_email->getInUseMessage());
	}
	}

	public function revokePasswordResetLinks(PhabricatorUser $user) {
	// Revoke any outstanding password reset links. If an attacker compromises
	// an account, changes the email address, and sends themselves a password
	// reset link, it could otherwise remain live for a short period of time
	// and allow them to compromise the account again later.

	PhabricatorAuthTemporaryToken::revokeTokens(
	$user,
	array($user->getPHID()),
	array(
	PhabricatorAuthOneTimeLoginTemporaryTokenType::TOKENTYPE,
	PhabricatorAuthPasswordResetTemporaryTokenType::TOKENTYPE,
	));
	}

	private function didVerifyEmail(
	PhabricatorUser $user,
	PhabricatorUserEmail $email) {

	$event_type = PhabricatorEventType::TYPE_AUTH_DIDVERIFYEMAIL;
	$event_data = array(
	'user' => $user,
	'email' => $email,
	);

	$event = id(new PhabricatorEvent($event_type, $event_data))
	->setUser($user);
	PhutilEventEngine::dispatchEvent($event);
	}


	}

File Metadata

Mime Type: text/x-diff
Expires: Jan 19 2025, 21:37 (6 w, 2 d ago)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1129028
Default Alt Text: (30 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions