root/veekun/trunk/lib/Vee/Controller/Users.pm

package Vee::Controller::Users;

use strict;
use warnings;
use base 'Catalyst::Controller';

use Vee::BBCode;
use Vee::Utils;
use Digest::SHA1 qw/sha1_hex/;
use Image::Size;
use Email::Valid;

our @ContactTypes = (
    { name => 'AIM', url => '', },
    { name => 'ICQ', url => '', },
    { name => 'MSN', url => '', },
    { name => 'YIM', url => '', },
    { name => 'LJ', url => 'http://%s.livejournal.com/', },
    { name => 'Homepage', url => '%s', },
    { name => 'email', url => 'mailto:%s', },
);

=head1 NAME

Vee::Controller::Users - Users Controller

=head1 SYNOPSIS

See L<Vee>

=head1 DESCRIPTION

Catalyst Controller for logging in/out, registration, and viewing user information.

=head1 METHODS

=cut

=head2 register

Creates a new account.

=cut

my $register_fields = {
    username => { type => 'text', size => 20, maxlength => 20 },
    password => { type => 'password', size => 20, maxlength => 20, count => 2 },
    remember => { type => 'checkbox', default => 1 },
};

sub register : Local {
    my ($self, $c) = @_;
    my $s = $c->stash;
    my $p = $c->req->params;
    
    $s->{page_title} = "Register";

    if ($c->user) {
        $c->vee_stop("You are already logged in as ", $c->user->name, ".");
    }
    
    my $form = Vee::Form->new(
        id => 'register',
        fields => $register_fields,
        params => $c->req->params,
    );

    $s->{form} = $form;
    $s->{template} = 'users/register.tt';

    if (!$form->submitted) {
        return;
    }

    # quietly make the username a little more HTML-friendly
    $p->{username} =~ s/^ +| +$//g;
    $p->{username} =~ s/ {2,}/ /g;

    # check for sensible username/password
    my @errors;
    if (!ref $p->{password} or $#{ $p->{password} } != 1 or $p->{password}[0] ne $p->{password}[1]) {
        push @errors, 'Your password must be typed exactly the same way twice.';
    } elsif ($p->{password}[0] eq '') {
        push @errors, 'Please enter a password.';
    } elsif (6 > length $p->{password}[0]) {
        push @errors, 'Your password must be at least six characters long.';
    }
    if ($p->{username} eq '') {
        push @errors, 'Please enter a username.';
    } elsif ($p->{username} !~ /^[-_ a-zA-Z0-9]{1,20}$/) {
        push @errors, 'Your username must be at least one character and no more than 20.  It can only contain letters, numbers, dashes, underscores, and spaces.';
    } elsif ($p->{username} !~ /\S/) {
        push @errors, 'No, you can\'t have just spaces for a username.';
    } elsif ( $c->model('DBIC::Users')->count({ name => $p->{username} }) ) {
        push @errors, 'The username you selected is already taken.';
    }
    if (@errors) {
        $s->{error_msg} = \@errors;
        return;
    }
    
    # create new user and log in
    $c->model('DBIC::Users')->create({
        name => $p->{username},
        password => sha1_hex( $p->{password}[0] ),
        time_joined => time,
        time_active => time,
        signature => '',
        thread_view_cutoff => time,
    });
    $c->login($p->{username}, $p->{password}[0]) or die "Can't log in new user $p->{username}.  Should not happen, ever, period.";

    $c->flash->{success_msg} = 'Your account has been created and you have been logged in, ' . $c->vee_cleanse($c->user->name) . '.';
    
    $c->session->{session_cookie} = !$p->{remember};
    
    # given that the referer is the registration form, the logical redirect is the new user's userinfo
    $c->res->redirect( $c->uri('Users', 'info', $c->user->obj->id) );
}

=head2 login

Logs a user in, or shows a login form if there is no POSTdata.

=cut

my $login_fields = {
    username => { type => 'text', size => 20, maxlength => 20 },
    password => { type => 'password', size => 20, maxlength => 20 },
    remember => { type => 'checkbox', default => 1 },
};

sub login : Local {
    my ($self, $c) = @_;
    my $s = $c->stash;
    
    $s->{page_title} = "Log In";

    if ($c->user) {
        $c->vee_stop("You are already logged in as ", $c->user->name, ".");
    }
    
    my $form = Vee::Form->new(
        id => 'biglogin',
        fields => $login_fields,
        params => $c->req->params,
    );
    $s->{form} = $form;
    $s->{template} = 'users/login.tt';

    my $username = $c->req->params->{username};
    my $password = $c->req->params->{password};
    
    # if parameters missing, just show login page
    if (!$form->submitted) {
        return;
    }
    
    # attempt to log in
    if ($c->login($username, $password)) {
        $c->flash->{success_msg} = 'You are now logged in.  Welcome back, ' . $c->vee_cleanse($c->user->name) . '!';
        
        $c->session->{session_cookie} = !$c->req->params->{remember};
        
        # if we don't know where the user came from or e came from the login
        #   form, send back to the main page; otherwise, send to referer
        $c->res->redirect(
            !$c->req->referer || $c->req->referer =~ m#/login/?$#
            ? $c->uri_for('/')
            : $c->req->referer
        );
    } else {
        $s->{error_msg} = "Bad username or password.";
    }
}

=head2 logout

Logs the user out.

=cut

sub logout : Local {
    my ($self, $c) = @_;

    $c->logout;
    $c->flash->{success_msg} = 'You have been logged out.  Bye  :(';
    
    $c->res->redirect( $c->req->referer or $c->uri_for('/') );
}

=head2 list

Userlist. Displays some basic info about a user in a list. User names link to /users/info/x.

=cut

sub list : Path : Args(0) {
    my ($self, $c) = @_;
    my $s = $c->stash;
    
    my $order  = $c->req->params->{order} || 'id';
    my $sort   = $c->req->params->{sort} || 'asc';
    my $filter = $c->req->params->{filter};
    my $skip   = $c->req->params->{skip} || 0;
        
    unless (Vee::Utils::in($order => qw/id name time_active time_joined post_count/)) { $order = 'id'; }
    unless (Vee::Utils::in($sort => qw/asc desc/)) { $sort = 'asc'; }
    
    my $users_rs = $c->model('DBIC::Users')->search(
            ( $filter ? ( 'me.name' => { like => '%' . $filter . '%' } ) : (undef) ),
            { order_by => 'me.' . $order . ' ' . $sort . '', offset => $skip, rows => $c->site_opts->{page_sizes}->{users} }
    );
    
    $s->{page_title}   = 'User List - Page ' . ($skip / 10 + 1) . '';
    $s->{extra_css}    = [qw/users forum/];
    $s->{breadcrumbs}  = ['Users'];

    $s->{users_rs}     = $users_rs;
    $s->{user_count}   = $c->model('DBIC::Users')->count( $filter ? { 'me.name' => { like => '%$filter%' } } : () );
    $s->{params}       = $c->req->params;
        $s->{ContactTypes} = \@ContactTypes;
    $s->{template}     = 'users/list.tt';
}

=head2 info

Displays the profile/userinfo/whatever for a user.

=cut

sub info : Path : Args(1) {
    my ($self, $c) = @_;
    my $s = $c->stash;

    my $user = $c->model('DBIC::Users')->search({ id => $c->req->args->[0] })->single
        or $c->vee_abort('There is currently no user with id ', $c->req->args->[0], '.');

    $s->{page_title}   = $user->name;
    $s->{link_name }   = 'user/info';
    $s->{extra_css }   = [qw/users forum/];
    $s->{crumbs    }   = [ '<a href="' . $c->uri('User') . '">Users</a>', $user->name ];
    $s->{ContactTypes} = \@ContactTypes;
    $s->{recent_post}  = $c->model('DBIC::Posts')->search({ -and => [ user_id => $c->req->args->[0], \'NOT FIND_IN_SET("deleted", me.flags)' ] }, {
        order_by => 'me.time DESC',
        rows => 1
    } )->single;

    $s->{user} = $user;
    $s->{template} = 'users/info.tt';
}

=head2 edit

User info editing, for changing AIM/MSN/avatar/sig/etc.

=cut

sub edit : Local : Args(0) {
    my ($self, $c) = @_;
    my $s = $c->stash;
    my %changes;
    my (@errors, @success);

    if (not $c->user) { $c->vee_abort('You must be logged in to edit user info.'); }   

    $s->{page_title} = 'Edit Options for ' . $c->user->name;
    $s->{link_name } = 'user/edit';
    $s->{crumbs    } = [ '<a href="' . $c->uri('User') . '">Users</a>', 'Edit ' . $c->user->name ];

    $s->{userinfo  } = $c->user->obj;
        $s->{extra_css } = [qw/users forum/];
    $s->{template} = 'users/edit.tt';

    return unless %{ $c->req->params };

    # Check to see what has been changed, and what hasn't (this block IGNORES avatars, it assumes it has been changed)
    for my $k (keys %{ $c->req->params }) {
        unless (Vee::Utils::in($k => qw/submit reset avatardel avatarurl avatarfile/)) {
            $changes{$k} = $c->req->params->{$k} unless $c->req->params->{$k} eq $c->user->obj->$k;
        }
        if ($k eq 'avatarfile' or $k eq 'avatarurl') { $changes{avatar} = $c->req->params->{$k}; }
    }
   
    # Setup various variables?
    my $query = $c->req->params;
    my $padid = Vee::Utils::pad($c->user->obj->id, 11);
    my $user_limits = $c->site_opts->{user_limits};
    my $avmaxbytes = $user_limits->{avatarbytes};
    my $avmaxpixels = $user_limits->{avatarpixels};
    my $contacts = $user_limits->{contacts};

    # Working with avatars; to me, this seems oddly.. disorganized and messy. If anyone wants to recode it, please, be my guest.
    if ($query->{avatardel}) {
        # Compared to the rest, this is simple; delete the avatar?
        unlink $c->path_to('root/images/avatars', $c->user->obj->avatar);
        $changes{avatar} = '';
        push @success, "Deleted your avatar.";

    } elsif (exists $query->{avatarfile} or $query->{avatarurl}) {
        my $av;

        # Check which method the user is trying to use for avatar: uploaded file, or URL?
        if (exists $query->{avatarfile}) {
            # This is for file (obviously); very straight forward, simply uploads the file.
            $av = $c->request->upload('avatarfile');

            # Gets the height/width/filetype of the file
            my ($width, $height, $type) = imgsize($av->tempname);
            if ($avmaxbytes * 1024 < $av->size) { push @errors, 'Filesize for avatar is bigger than maximum of ' . $avmaxbytes . ' kibibytes.'; delete $changes{avatar}; }
            if (not Vee::Utils::in(lc $type => qw/png gif jpg jpeg/)) { push @errors, 'Avatar is using an invalid filetype (' . lc $type . ').'; delete $changes{avatar}; }
            if ($width > $avmaxpixels or $height > $avmaxpixels) { push @errors, 'The height and/or width of your avatar is too large.'; delete $changes{avatar}; }

            my $target = $c->path_to('root/images/avatars', $padid);
            if ($changes{avatar}) {
                unless ($av->link_to($target) || $av->copy_to($target) ) { $c->vee_abort("Failed to copy '" . $padid . "' to '" . $target . "': " . $!); }
                push @success, "Updated your avatar from file $query->{avatarfile}";
                $changes{avatar} = $padid;
            }

        } elsif (exists $query->{avatarurl}) {
            # Check to see if the filesize of the remote avatar follows the restrictions of the max avatar size. I dunno how to explain it, really; I'm sure you who is reading this can understand?
            my $ua = new LWP::UserAgent;
            $ua->agent( $c->site_opts->{title} );
            $ua->env_proxy;
            $ua->protocols_allowed([ 'http', 'https' ]);
            $ua->timeout(10);  # this is pretty low, but we don't want to keep the user waiting for too long

            my $req = new HTTP::Request('HEAD' => $query->{avatarurl});
            $req->header('Accept' => 'text/html');

            my $response = $ua->request($req);
            unless ($response->is_success) { $c->vee_abort('Remote file not found; maybe the server is down or you mistyped the URL?') }
            my $header = $response->headers;
            $req = HTTP::Request->new(GET => $query->{avatarurl});
            $av = $ua->request($req)->content;

            # Do error checking
            my ($width, $height, $type) = imgsize(\$av);
            if ($width > $avmaxpixels or $height > $avmaxpixels) { push @errors, 'The height and/or width of your avatar is too large.'; delete $changes{avatar}; }
            if (not Vee::Utils::in(lc $type => qw/png gif jpg jpeg/)) { push @errors, 'Avatar is using an invalid filetype (.' . lc $type . ').'; delete $changes{avatar}; }
            if ($avmaxbytes * 1024 < $header->content_length) { push @errors, 'Filesize for avatar is bigger than ' . $avmaxbytes . ' kibibytes.'; delete $changes{avatar}; }

            # Okay, we're good; copy the file to $padid (which is the user's id)!                
            if ($changes{avatar}) { open AVATAR, '>' . $c->path_to('root/images/avatars', $padid); binmode AVATAR; print AVATAR $av; close AVATAR; $changes{avatar} = $padid; push @success, "Updated your avatar from $query->{avatarurl}"; }
        }
    }   

    # Working with text data (sigs, title, etc)
    # Title
    if ($changes{custom_title}) {
        # no fathomable reason this should ever be needed un-filtered, so just sanitize it now
        $changes{custom_title} =~ s:[\x0d\x0a]::g;
        $changes{custom_title} = Vee::Utils::cleanse( $changes{custom_title} );

        if (length $query->{custom_title} >= $user_limits->{custom_title}) {
            push @errors, 'Custom title is longer than the maximum of ' . $user_limits->{custom_title} . ' characters.';
            delete $changes{custom_title};
        } else {
            push @success, 'Updated your custom title to "' . $changes{custom_title} . '".';
        }
    } elsif (exists $changes{custom_title} and $c->user->custom_title) {
        push @success, 'Deleted your custom title.';
    }

    # Various contacts (AIM, MSN, ICQ, etc)
    for my $contact_row (@ContactTypes) {
        my $k = $contact_row->{name};
        my $join = "contact_" . lc $k;
        next unless exists $changes{$join};
        if (not $c->req->params->{$join} and $c->user->obj->$join) {
            push @success, 'Deleted your ' . $k . ' contact information.';
            $changes{$join} = '';
            next;
        }
        if ($changes{$join}) {
            # Validate email (and MSN!) to RFC822
            if ((lc $k eq 'email' or lc $k eq 'msn') and not Email::Valid->address($changes{$join})) {
                push @errors, 'The ' . $k . ' address ' . $changes{$join} . ' is invalid.';
                delete $changes{$join};
                next;
            }
            if ($k eq 'homepage') {
                push @success, 'Updated your homepage to: ' . $changes{contact_homepage};
            } else {
                push @success, 'Updated your ' . $k . ' contact information to ' . $changes{$join} . '.';
            }
        }
    }
    
    # Signature
    if ($changes{signature}) {
        ($changes{signature}, my @bbcode_errors) = Vee::BBCode::validate_bbcode( $changes{signature} );
        if (@bbcode_errors) {
            push @errors, 'Your signature contains invalid bbcode; please go back and fix it.';
            delete $changes{signature};
            next;
        }
        push @success, 'Updated your signature.';
    } elsif (exists $changes{signature} and $c->user->signature) {
        push @success, 'Deleted your signature.';
    }
    
    $s->{success_msg} = \@success if @success;
    $s->{error_msg} = \@errors if @errors;
    $c->user->obj->update(\%changes);
}
   
=head1 AUTHOR

Maintainer: Alex "Eevee" Munroe (C<veekun@veekun.com>)

See the included F<AUTHORS> file for a full list of contributers.

=head1 LICENSE

See the included F<LICENSE> file.

=cut

1;