<?xml version="1.0" encoding="UTF-8"?>
<!--
 -
 -  $Id$
 -
 -  This file is part of the OpenLink Software Virtuoso Open-Source (VOS)
 -  project.
 -
 -  Copyright (C) 1998-2018 OpenLink Software
 -
 -  This project is free software; you can redistribute it and/or modify it
 -  under the terms of the GNU General Public License as published by the
 -  Free Software Foundation; only version 2 of the License, dated June 1991.
 -
 -  This program is distributed in the hope that it will be useful, but
 -  WITHOUT ANY WARRANTY; without even the implied warranty of
 -  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 -  General Public License for more details.
 -
 -  You should have received a copy of the GNU General Public License along
 -  with this program; if not, write to the Free Software Foundation, Inc.,
 -  51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
 -
-->
<v:page name="blog-home-page"
        xmlns:vm="http://www.openlinksw.com/vspx/ods/"
        xmlns:v="http://www.openlinksw.com/vspx/"
        style="index.xsl"
        doctype="-//W3C//DTD XHTML 1.0 Transitional//EN"
        doctype-system="http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  <vm:page>
    <vm:header>
      <vm:title>Password Recovery</vm:title>
    </vm:header>
    <vm:pagewrapper>
      <v:variable name="recovery_step" type="int" default="0" persist="0"/>
      <v:variable name="question1" type="varchar" default="null" persist="0"/>
      <v:variable name="answer1" type="varchar" default="null" persist="0"/>
      <v:variable name="login_name" type="varchar" default="null" persist="0"/>
      <v:variable name="recovery_attempts" type="int" default="1" persist="0"/>
      <vm:rawheader caption="Password Recovery"/>
      <vm:body>
        <div id="container">
          <div id="main">
            <div class="box">
              <v:template name="tem1" type="simple" condition="self.recovery_step=0">
                <v:form type="simple" name="pass_check_form1" method="POST">
                <input type="hidden" name="ret" value="<?=get_keyword_ucase ('ret', self.vc_page.vc_event.ve_params, '')?>" />
                  <table>
                    <tr>
                      <th>Enter your login</th>
                      <td>
                        <v:text name="login_name1" xhtml_size="30" error-glyph="*" value="--get_keyword('usr', self.vc_event.ve_params)"/>
                      </td>
                    </tr>
                    <tr>
                      <td class="ctrl" colspan="2">
                        <v:button name="continue1" action="simple" value="Continue">
                          <v:on-post>
                            <v:script>
                              <![CDATA[
                                if (exists(select 1 from db.dba.sys_users where u_name = self.login_name1.ufl_value))
                                {
                                  declare sec_quest integer;
                                  sec_quest := USER_GET_OPTION(self.login_name1.ufl_value, 'SEC_QUESTION');
                                  self.answer1 := USER_GET_OPTION(self.login_name1.ufl_value, 'SEC_ANSWER');
                                  self.login_name := self.login_name1.ufl_value;
                                  if (sec_quest is null or self.answer1 is null)
                                  {
				  self.vc_error_message := 'The user  has no password recovery information. The system can send no information.';
                                    self.vc_is_valid := 0;
                                    return;
                                  }
                                  self.recovery_step := 1;
                                  self.question1 := sec_quest;
                                }
                                else
                                {
                                  self.vc_error_message := 'User does not exist';
                                  self.vc_is_valid := 0;
                                  return;
                                }
                              ]]>
                            </v:script>
                          </v:on-post>
                        </v:button>
                      </td>
                    </tr>
                  </table>
                </v:form>
              </v:template>
              <v:template name="tem2" type="simple" condition="self.recovery_step=1">
                <v:form type="simple" name="pass_check_form2" method="POST">
                  <table>
                    <tr>
                      <th colspan="2">
                        <?vsp http(sprintf('Your secret question is: <b>%s</b>', self.question1)); ?>
                      </th>
                    </tr>
                    <tr>
                      <th>Enter your secret answer</th>
                      <td>
                        <v:text name="login_name2" xhtml_size="30" error-glyph="*" value=""/>
                      </td>
                    </tr>
                    <tr>
                      <td class="ctrl" colspan="2">
                        <v:button name="continue2" action="simple" value="Continue">
                          <v:on-post>
                            <v:script>
                              <![CDATA[
                                  -- check if attempts was blocked
                                  declare _blocked_until any;
                                  _blocked_until := (select WAU_PWD_RECOVER_DISABLE_UNTIL from WA_USERS where
                                    WAU_U_ID = (select U_ID from SYS_USERS where U_NAME = self.login_name));
                                  if (_blocked_until is not null and _blocked_until > now())
                                  {
                                    self.vc_error_message := 'Your recovery password attempts are blocked.';
                                    self.vc_is_valid := 0;
                                    return;
                                  }
                                  -- block future attempts
                                  if (self.recovery_attempts > 3)
                                  {
                                    self.vc_error_message := 'Recovery password process was failed 3 times. Future attempts will be blocked for 1 hour.';
                                    update
                                      WA_USERS
                                    set
                                      WAU_PWD_RECOVER_DISABLE_UNTIL = dateadd('hour', 1, now())
                                    where
                                      WAU_U_ID = (select U_ID from SYS_USERS where U_NAME = self.login_name);
                                    self.vc_is_valid := 0;
                                    return;
                                  }
                                  if (self.login_name2.ufl_value = self.answer1)
                                  {
                                    declare exit handler for sqlstate '*'
                                    {
                                      self.vc_error_message := concat (__SQL_STATE,' ',__SQL_MESSAGE);
                                      self.vc_is_valid := 0;
                                      return;
                                    };
                                    declare _smtp_server, full_name, _user_e_mail, password1, _site_admin_e_mail, msg varchar;
                                    if ((select max(WS_USE_DEFAULT_SMTP) from WA_SETTINGS) = 1)
                                      _smtp_server := cfg_item_value(virtuoso_ini_path(), 'HTTPServer', 'DefaultMailServer');
                                    else
                                      _smtp_server := (select max(WS_SMTP) from WA_SETTINGS);
                                    if (not _smtp_server or length(_smtp_server) = 0)
                                    {
                                      self.vc_error_message := 'SMTP server is not defined. Mail sending is impossible.';
                                      self.vc_is_valid := 0;
                                      return;
                                    }
                                    _site_admin_e_mail := (select
                                                             U_E_MAIL
                                                           from
                                                             SYS_USERS
                                                           where
                                                             U_ID = http_dav_uid()
                                                           );
                                    if (_site_admin_e_mail is null or _site_admin_e_mail = '')
                                      _site_admin_e_mail := 'admin@domain.com';
                                    select
                                      U_FULL_NAME,
                                      U_E_MAIL,
                                      pwd_magic_calc(U_NAME, U_PASSWORD, 1)
                                    into
                                      full_name,
                                      _user_e_mail,
                                      password1
                                    from
                                      SYS_USERS
                                    where
                                      u_name = self.login_name;
                                    msg := 'Subject: Virtuoso Web Applications Account information\r\nContent-Type: text/plain\r\n';
                                    msg := msg || '\r\nSomebody asked your login information.\r\n';
                                    msg := msg || '\r\nYour login is:' || self.login_name;
                                    msg := msg || '\r\nYour password is:' || password1;
                                    {
                                       declare exit handler for sqlstate '*' {
                                         self.vc_is_valid := 0;
                                         declare _use_sys_errors, _sys_error, _error any;
                                         _sys_error := concat (__SQL_STATE,' ',__SQL_MESSAGE);
                                         _error := 'Due to a transient problem in the system, your password recovery could not be
                                           processed at the moment. The system administrators have been notified. Please
                                           try again later';
                                         _use_sys_errors := (select top 1 WS_SHOW_SYSTEM_ERRORS from WA_SETTINGS);
                                         if(_use_sys_errors)
                                         {
                                           self.vc_error_message := _error || ' ' || _sys_error;
                                           self.vc_is_valid := 0;
                                           return;
                                         }
                                         else
                                         {
                                           self.vc_error_message := _error;
                                           self.vc_is_valid := 0;
                                           return;
                                         }
                                         rollback work;
                                         return;
                                       };
                                       smtp_send(_smtp_server, _site_admin_e_mail, _user_e_mail, msg);
                                    }
                                    self.recovery_step := 2;
                                  }
                                  else
                                  {
                                    self.vc_error_message := 'Incorrect answer';
                                    self.vc_is_valid := 0;
                                    return;
                                  }
                                  self.recovery_attempts := self.recovery_attempts + 1;
                              ]]>
                            </v:script>
                          </v:on-post>
                        </v:button>
                      </td>
                    </tr>
                  </table>
                </v:form>
              </v:template>
              <v:template name="tem3" type="simple" condition="self.recovery_step=2">
                <h3>Your login information was sent to your e-mail.</h3>
              </v:template>
            </div>
          </div>
        </div>
      </vm:body>
    </vm:pagewrapper>
  </vm:page>
</v:page>


