// create or edit account
public User createOrEditAccount(User inUser, String password, String captchaText) throws SimpleMessageException {
Transaction tx = session.get().beginTransaction();
try {
User possibleAuthUser = getAuthenticatedUser(session.get());
User authUser = null;
if (possibleAuthUser instanceof User) {
authUser = (User) possibleAuthUser;
}
User dbUser = null;
try {
dbUser = (User) session.get().load(User.class, inUser.getId());
} catch (Exception e) {
}
if (dbUser == null) {
// new account, it did NOT exist
// validate captcha first
if (StringUtils.isEmpty(captchaText)) {
captchaText = "INVALID!";
}
Captcha captcha = (Captcha) getThreadLocalRequest().getSession().getAttribute("captcha");
if (captcha != null && !captcha.isValid(captchaText)) {
throw new SimpleMessageException("CAPTCHA validation failed");
}
User newUser = new User();
newUser.setUsername(inUser.getUsername().toLowerCase());
if (password != null && !"".equals(password)) {
MD5 md5 = new MD5();
md5.Update(password);
newUser.setPasswordHash(md5.asHex());
}
if (authUser != null && authUser.isAdministrator()) {
newUser.setAdministrator(inUser.isAdministrator());
}
newUser.setFirstname(inUser.getFirstname());
newUser.setLastname(inUser.getLastname());
newUser.setEmail(inUser.getEmail());
newUser.setBirthday(inUser.getBirthday());
newUser.setPasswordHint(inUser.getPasswordHint());
newUser.setValidated(!BaseSystem.requireAccountValidation());
if (authUser != null && authUser.isAdministrator()) {
// admin can automatically create/validate accounts
newUser.setValidated(true);
}
session.get().save(newUser);
UserGroup userGroup = new UserGroup();
userGroup.setName(newUser.getUsername());
userGroup.setVisible(true);
userGroup.setAutoJoin(false);
userGroup.setLocked(false);
userGroup.setOwner(newUser);
session.get().save(userGroup);
GroupMembership groupMembership = new GroupMembership();
groupMembership.setUser(newUser);
groupMembership.setUserGroup(userGroup);
session.get().save(groupMembership);
tx.commit();
// if a new user is creating a new account, login if new user account is validated
if (authUser == null && isAccountValidated(newUser)) {
destroyAuthCookies(getThreadLocalRequest(), getThreadLocalResponse());
if (login(session.get(), getThreadLocalRequest(), getThreadLocalResponse(), newUser.getUsername(), newUser.getPasswordHash(), true) != null) {
return newUser;
}
} else if (authUser == null && !isAccountValidated(newUser)) {
// send user a validation email, where, upon clicking the link, their account will be validated
// the validation code in the URL will simply be a hash of their email address
MD5 md5 = new MD5();
md5.Update(newUser.getEmail());
md5.Update(newUser.getPasswordHash());
String portStr = "";
if (getThreadLocalRequest().getLocalPort() != 80) {
portStr = ":" + getThreadLocalRequest().getLocalPort();
}
String url = getThreadLocalRequest().getScheme() + "://" + getThreadLocalRequest().getServerName() + portStr + "/?u=" + newUser.getUsername() + "&v="
+ md5.asHex();
String text = "Thank you for signing up with " + BaseSystem.getDomainName()
+ ".<BR><BR>Please confirm your account by clicking the following link:<BR><BR>";
text += "<A HREF=\"";
text += url;
text += "\">" + url + "</A>";
BaseSystem.getEmailService().sendMessage(BaseSystem.getSmtpHost(), BaseSystem.getAdminEmailAddress(), BaseSystem.getDomainName() + " validator",
newUser.getEmail(), BaseSystem.getDomainName() + " account validation", text);
}
return newUser;
} else if (authUser != null && (authUser.isAdministrator() || authUser.getId().equals(dbUser.getId()))) {
// edit an existing account
// the following conditions must be met to be here: