X-Git-Url: https://ruin.nu/git/?a=blobdiff_plain;f=lib%2FNDWeb%2FController%2FSettings.pm;h=f95a97922373f9853649ad4f3091fb1b117f97d4;hb=c7e26c754fc09d8837b5801bce4046c2493cf8a9;hp=4a60ebebf53354378a35390568121cc6cafcbb45;hpb=7782222a680e2752239bd7f9a853630412d47c74;p=ndwebbie.git

diff --git a/lib/NDWeb/Controller/Settings.pm b/lib/NDWeb/Controller/Settings.pm
index 4a60ebe..f95a979 100644
--- a/lib/NDWeb/Controller/Settings.pm
+++ b/lib/NDWeb/Controller/Settings.pm
@@ -2,11 +2,14 @@ package NDWeb::Controller::Settings;
 
 use strict;
 use warnings;
+use feature ":5.10";
 use parent 'Catalyst::Controller';
 
 use NDWeb::Include;
 
 use DateTime::TimeZone;
+use Mail::Sendmail;
+use Email::Valid;
 
 =head1 NAME
 
@@ -40,10 +43,11 @@ sub index :Path :Args(0) {
 	}
 	$c->stash(stylesheets => \@stylesheets);
 
-	my ($birthday,$timezone) = $dbh->selectrow_array(q{
-SELECT birthday,timezone FROM users WHERE uid = $1
+	my ($birthday,$timezone,$email) = $dbh->selectrow_array(q{
+SELECT birthday,timezone,email FROM users WHERE uid = $1
 		},undef,$c->user->id);
 	$c->stash(birthday => $birthday);
+	$c->stash(email =>  $c->flash->{email} // $email);
 
 	my @timezone = split m{/},$timezone,2;
 	$c->stash(timezone => \@timezone);
@@ -108,11 +112,103 @@ sub changePassword : Local {
 	my ( $self, $c ) = @_;
 	my $dbh = $c->model;
 
-	my $query = $dbh->prepare(q{UPDATE users SET password = MD5($1)
-		WHERE password = MD5($2) AND uid = $3
+	if (length $c->req->param('pass') < 4) {
+		$c->flash(error => "Your password need to be at least 4 characters");
+	} else {
+		my $query = $dbh->prepare(q{UPDATE users SET password = $1
+			WHERE password = crypt($2,password) AND uid = $3
 		});
-	$query->execute($c->req->param('pass'),$c->req->param('oldpass'),$c->user->id);
+		$query->execute($c->req->param('pass'),$c->req->param('oldpass'),$c->user->id);
 
+		$c->flash(error => "Old password was invalid") unless $query->rows;
+	}
+
+	$c->res->redirect($c->uri_for(''));
+}
+
+sub changeEmail : Local {
+	my ( $self, $c ) = @_;
+	my $dbh = $c->model;
+
+	my $email = $c->req->param('email');
+
+	if ($email =~ /^s?$/) {
+		my $update = $dbh->prepare(q{
+UPDATE users SET email = NULL WHERE uid = $1;
+			});
+		$update->execute($c->user->id);
+		$c->flash(error => 'email cleared');
+		$c->res->redirect($c->uri_for(''));
+		return,
+	}
+
+	unless (Email::Valid->address($email)){
+		$c->flash(email => $email);
+		$c->flash(error => 'Invalid email address');
+		$c->res->redirect($c->uri_for(''));
+		return,
+	}
+
+	eval{
+		my $insert = $dbh->prepare(q{
+INSERT INTO email_change (uid,email) VALUES ($1,$2) RETURNING id;
+			});
+		$insert->execute($c->user->id,$email);
+
+		my ($id) = $insert->fetchrow_array;
+
+		my %mail = (
+			smtp => 'localhost',
+			To      => $email,
+			From    => 'NewDawn Command <nd@ruin.nu>',
+			'Content-type' => 'text/plain; charset="UTF-8"',
+			Subject => 'Change email address',
+			Message => qq{
+You have requested to change email address on the NewDawn website.
+If that is not the case, then feel free to ignore this email. Otherwise
+use the following url to confirm the change:
+
+}.$c->uri_for('confirmEmail',$id)."\n",
+		);
+
+		if (sendmail %mail) {
+			$c->flash(error => 'Sent mail for confirmation.');
+		}else {
+			$c->flash(error => $Mail::Sendmail::error);
+		}
+	};
+	if($@){
+		if($@ =~ /duplicate key value violates unique constraint/){
+			$c->flash(email => $email);
+			$c->flash(error => 'Something went wrong, try to set the email again');
+		}else{
+			die $@;
+		}
+	}
+	$c->res->redirect($c->uri_for(''));
+}
+
+sub confirmEmail : Local {
+	my ( $self, $c, $id ) = @_;
+	my $dbh = $c->model;
+
+	$dbh->begin_work;
+	my $query = $dbh->prepare(q{
+UPDATE email_change SET confirmed = TRUE
+WHERE uid = $1 AND id = $2 AND NOT confirmed
+RETURNING email
+		});
+	$query->execute($c->user->id,$id);
+	my ($email) = $query->fetchrow_array;
+
+	if ($email){
+		$dbh->do(q{UPDATE users SET email = $2 WHERE uid = $1}
+			,undef,$c->user->id,$email);
+		$c->flash(error => "Email updated.");
+	}else{
+		$c->flash(error => "$id is not a valid change id for your account, or already confirmed");
+	}
+	$dbh->commit;
 	$c->res->redirect($c->uri_for(''));
 }