Added an send invitations form to frontend and email notifications to backend

4 files changed, 47 insertions, 4 deletions

diff --git a/frontend/include/header.php b/frontend/include/header.php
index 0822f68..4a60969 100644
--- a/frontend/include/header.php
+++ b/frontend/include/header.php
@@ -32,6 +32,9 @@ if (isset($S['head'])) {
 echo '<li><a href="'.url().'">Home</a></li>';
 echo '<li><a href="'.url('create').'">Create an image</a></li>';
 echo '<li><a href="'.url('logs').'">Log viewer</a></li>';
+if (isset($S['user']) && $S['user']->hasflag('a')) {
+	echo '<li><a href="'.url('invite').'">Invite</a></li>';
+}
 ?>
 </ul>
 </div>
diff --git a/frontend/pages/invite.php b/frontend/pages/invite.php
new file mode 100644
index 0000000..a04a12d
--- /dev/null
+++ b/frontend/pages/invite.php
@@ -0,0 +1,39 @@
+<?php
+function init_invite() {
+	global $S;
+	if (!isset($S['user'])) {
+		return 'login';
+	}
+	if (!$S['user']->hasflag('a')) {
+		return 'denied';
+	}
+}
+function body_invite() {
+	global $S, $request, $conf;
+	if (isset($request['emails'])) {
+		echo '<h3>Inviting Users</h3>';
+		$emails=explode("\n", $request['emails']);
+		foreach ($emails as $email) {
+			// TODO proper checking that user and registrationtoken don't exist for this email to avoid errors
+			$email=trim($email);
+			if (strlen($email) == 0) {
+				continue;
+			}
+			if (!Validate::email($email)) {
+				echo 'Email address "'.htmlentities($email).'" invalid<br/>';
+				continue;
+			}
+			$token=sql_registrationtoken::create();
+			$token->email=$email;
+			$token->expire=time()+24*3600; // 24 hour shelf life (we're not checking currently)
+			$token->owner=$S['user']->id;
+			$token->write();
+			xhtmlemail($email, null, $conf['title'].' invitation', htmlentities($S['user']->name).' has invited you to create an account for '.$conf['title'].'.  To create an account, click this link: <a href="'.url('register/'.$token->id).'">'.url('register/'.$token->id).'</a>');
+			echo 'Invited '.htmlentities($email).'<br/>';
+		}
+		echo '<a href="'.url('invite').'">Send more invitations</a>';
+	} else {
+		echo '<h3>Invite Users</h3><form action="'.url('invite').'" method="post">Email addresses to send invitations to: (one per line)<br/><textarea name="emails"></textarea><br/><input type="submit" value="Send Invitations" /></form>';
+	}
+}
+?>
diff --git a/frontend/pages/register.php b/frontend/pages/register.php
index 344ee25..e624ac1 100644
--- a/frontend/pages/register.php
+++ b/frontend/pages/register.php
@@ -1,12 +1,12 @@
 <?php
 function init_register() {
-	global $S;
+	global $S, $request;
 	if (isset($S['user'])) {
 		header('Location: '.url());
 		return 'welcome';
 	}
 	if (isset($request['token']) && preg_match('/^[a-zA-Z0-9]{30}$/', $request['token'])) {
-		$r=$S['pdo']->query('SELECT * FROM `tokens` WHERE `id`=\''.$request['token'].'\'');
+		$r=$S['pdo']->query('SELECT * FROM `registrationtokens` WHERE `id`=\''.$request['token'].'\'');
 		if ($r->rowCount()) {
 			$S['register.token']=new sql_registrationtoken($r->fetch(PDO::FETCH_ASSOC));
 			if (isset($request['password'])) {
@@ -55,8 +55,7 @@ function body_register() {
 	} elseif (isset($S['register.token'])) {
 		if (isset($S['register.fail']))
 			echo $S['register.fail'];
-		else
-			echo '<h3>Register</h3><form action="'.url('register').'" method="post"><input type="hidden" name="token" value="'.$request['token'].'" />Display name: <input name="name" /><br/>Password: <input type="password" name="password" /><br/><input type="submit" value="Create Account" /></form>';
+		echo '<h3>Register</h3><form action="'.url('register').'" method="post"><input type="hidden" name="token" value="'.$request['token'].'" />Display name: <input name="name" /><br/>Password: <input type="password" name="password" /><br/><input type="submit" value="Create Account" /></form>';
 	} else
 		echo '<h3>Register</h3><form action="'.url('register').'" method="post">
 		E-mail: <input name="email" /><br/>
diff --git a/frontend/routing.csv b/frontend/routing.csv
index 74c9fee..bbec7d7 100644
--- a/frontend/routing.csv
+++ b/frontend/routing.csv
@@ -30,6 +30,8 @@
 ^logout/(.+)$	logout	go
 # Account stuff
 ^register$	register
+^register/([a-zA-Z0-9]{30})$	register	token
+^invite$	invite
 # Pass through
 ^(js)/([0-9a-zA-Z-_]+\.(js))$	passthrough	dir	file	ext
 ^(images)/([0-9a-zA-Z-_]+\.(gif|jpg|jpeg|ico))$	passthrough	dir	file	ext