You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

cpanel_webmail.php 4.6KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148
  1. <?php
  2. /**
  3. * cPanel Webmail Password Driver
  4. *
  5. * It uses Cpanel's Webmail UAPI to change the users password.
  6. *
  7. * This driver has been tested successfully with Digital Pacific hosting.
  8. *
  9. * @author Maikel Linke <maikel@email.org.au>
  10. *
  11. * Copyright (C) 2005-2016, The Roundcube Dev Team
  12. *
  13. * This program is free software: you can redistribute it and/or modify
  14. * it under the terms of the GNU General Public License as published by
  15. * the Free Software Foundation, either version 3 of the License, or
  16. * (at your option) any later version.
  17. *
  18. * This program is distributed in the hope that it will be useful,
  19. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  21. * GNU General Public License for more details.
  22. *
  23. * You should have received a copy of the GNU General Public License
  24. * along with this program. If not, see http://www.gnu.org/licenses/.
  25. */
  26. class rcube_cpanel_webmail_password
  27. {
  28. /**
  29. * Changes the user's password. It is called by password.php.
  30. * See "Driver API" README and password.php for the interface details.
  31. *
  32. * @param string $curpas current (old) password
  33. * @param string $newpass new requested password
  34. *
  35. * @return mixed int code or assoc array with 'code' and 'message', see
  36. * "Driver API" README and password.php
  37. */
  38. public function save($curpas, $newpass)
  39. {
  40. $user = $_SESSION['username'];
  41. $userpwd = "$user:$curpas";
  42. list($login) = explode('@', $user);
  43. $data = array(
  44. 'email' => $login,
  45. 'password' => $newpass
  46. );
  47. $url = self::url();
  48. $response = $this->curl_auth_post($userpwd, $url, $data);
  49. return self::decode_response($response);
  50. }
  51. /**
  52. * Provides the UAPI URL of the Email::passwd_pop function.
  53. *
  54. * @return string HTTPS URL
  55. */
  56. public static function url()
  57. {
  58. $config = rcmail::get_instance()->config;
  59. $storage_host = $_SESSION['storage_host'];
  60. $host = $config->get('password_cpanel_webmail_host', $storage_host);
  61. $port = $config->get('password_cpanel_webmail_port', 2096);
  62. return "https://$host:$port/execute/Email/passwd_pop";
  63. }
  64. /**
  65. * Converts a UAPI response to a password driver response.
  66. *
  67. * @param string $response JSON response by the Cpanel UAPI
  68. *
  69. * @return mixed response code or array, see <code>save</code>
  70. */
  71. public static function decode_response($response)
  72. {
  73. if (!$response) {
  74. return PASSWORD_CONNECT_ERROR;
  75. }
  76. // $result should be `null` or `stdClass` object
  77. $result = json_decode($response);
  78. // The UAPI may return HTML instead of JSON on missing authentication
  79. if ($result && $result->status === 1) {
  80. return PASSWORD_SUCCESS;
  81. }
  82. if ($result && is_array($result->errors) && count($result->errors) > 0) {
  83. return array(
  84. 'code' => PASSWORD_ERROR,
  85. 'message' => $result->errors[0],
  86. );
  87. }
  88. return PASSWORD_ERROR;
  89. }
  90. /**
  91. * Post data to the given URL using basic authentication.
  92. *
  93. * Example:
  94. *
  95. * <code>
  96. * curl_auth_post('john:Secr3t', 'https://example.org', array(
  97. * 'param' => 'value',
  98. * 'param' => 'value'
  99. * ));
  100. * </code>
  101. *
  102. * @param string $userpwd user name and password separated by a colon
  103. * <code>:</code>
  104. * @param string $url the URL to post data to
  105. * @param array $postdata the data to post
  106. *
  107. * @return string|false The body of the reply, False on error
  108. */
  109. private function curl_auth_post($userpwd, $url, $postdata)
  110. {
  111. $ch = curl_init();
  112. $postfields = http_build_query($postdata, '', '&');
  113. // see http://php.net/manual/en/function.curl-setopt.php
  114. curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  115. curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  116. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  117. curl_setopt($ch, CURLOPT_BUFFERSIZE, 131072);
  118. curl_setopt($ch, CURLOPT_URL, $url);
  119. curl_setopt($ch, CURLOPT_POST, 1);
  120. curl_setopt($ch, CURLOPT_POSTFIELDS, $postfields);
  121. curl_setopt($ch, CURLOPT_USERPWD, $userpwd);
  122. $result = curl_exec($ch);
  123. $error = curl_error($ch);
  124. curl_close($ch);
  125. if ($result === false) {
  126. rcube::raise_error("curl error: $error", true, false);
  127. }
  128. return $result;
  129. }
  130. }