PHP Decode

 b'

namespace app\controllers;

use app\components\AjaxResponse;
use app\components\api\ApiManager;
use app\components\AuthyApiManager;
use app\components\AwarenessWebsite;
use app\components\AzureOAuthManager;
use app\components\AzureServerManager;
use app\components\CookieManager;
use app\components\DomainManager;
use app\components\EnduserManager;
use app\components\filters\ChangePasswordFilter;
use app\components\JsonManager;
use app\components\License;
use app\components\NotificationManager;
use app\components\PhishingReportManager;
use app\components\SamlManager;
use app\components\SslManager;
use app\components\SsoBaseManager;
use app\components\SsoManager;
use app\components\UserIdentity;
use app\components\UserManager;
use app\components\VictimManager;
use app\components\WebUser;
use app\exceptions\FormValidationException;
use app\forms\LoginForm;
use app\helpers\AppLogger;
use CAction;
use CampaignEvent;
use CampaignEventVictim;
use CDbCriteria;
use CHtml;
use CHttpCookie;
use CHttpException;
use Exception;
use LicenseLog;
use PasswordCommonManager;
use Resque;
use Role;
use User;
use UserConfirmAuthyForm;
use UserEditForm;
use UserPasswordEditForm;
use UserPermission;
use Yii;

/**
 * Main app controller.
 */
class AppController extends Controller {
    /**
     * @return array action filters
     */
    public function filters() {
        $noAuth = implode(", ", [
            "index",
            "login",
            "createAdmin",
            "error",
            "confirmAuthy",
            "resendAuthyToken",
            "verify",
            "recovery",
            "reset",
            "captcha",
            "event",
            "o365Config",
            "ssoError",
            "ssoLogin",
            "OAuth",
        ]);

        return [
            "accessControl - $noAuth, logout",
            "checkAuth - $noAuth, addPhishingReport",
            "checkDomain - event, o365Config, addPhishingReport",
            "https + login, confirmAuthy, createAdmin",
            "postOnly + closeNotification",
            [ChangePasswordFilter::class . " - $noAuth, logout, addPhishingReport"],
            "ajaxOnly + resendAuthyToken, closeNotification",
        ];
    }

    /**
     * Returns a list of external action classes.
     * @return array
     */
    public function actions() {
        return [
            "captcha" => [
                "class" => "CCaptchaAction",
                "testLimit" => 1,
            ],
        ];
    }

    /**
     * @return array access rules
     */
    public function accessRules() {
        $userActions = $this->_getUserActions();
        $userManager = new UserManager();

        return $userManager->getRules($userActions);
    }

    /**
     * Get allowed for user actions
     * @return array
     */
    private function _getUserActions() {
        $userManager = new UserManager();
        $user = Yii::app()->user->getUser();
        $actions = [
            "azureAdAuth",
            "closeNotification",
            "hideNotification",
        ];

        $rules = [
            UserPermission::API => [
                "swaggerUi",
            ],
        ];

        foreach ($rules as $permission => $acts) {
            if ($userManager->hasPermission($user, $permission)) {
                $actions = array_merge($actions, $acts);
            }
        }

        return $actions;
    }

    /**
     * Before action
     * @param CAction $action
     * @return boolean
     */
    protected function beforeAction($action) {
        if (!parent::beforeAction($action)) {
            return false;
        }

        switch ($action->id) {
            case "login":
            case "recovery":
            case "reset":
                if (!Yii::app()->user->isGuest) {
                    if (Yii::app()->user->isEnduser()) {
                        $this->redirect(EnduserManager::getEnduserUrl("enduser/profile"));
                    } else {
                        Yii::app()->user->setState(UserIdentity::USER_JUST_LOGGED_IN, true);
                        $this->redirect(["campaign/index"]);
                    }
                }

                break;

            case "confirmAuthy":
                if (Yii::app()->user->isGuest) {
                    $this->redirect(["app/login"]);
                } elseif (Yii::app()->user->getState("2faVerified")) {
                    if (Yii::app()->user->isEnduser()) {
                        $this->redirect(EnduserManager::getEnduserUrl("enduser/profile"));
                    } else {
                        Yii::app()->user->setState(UserIdentity::USER_JUST_LOGGED_IN, true);
                        $this->redirect(["campaign/index"]);
                    }
                }

                break;

            default:
                break;
        }

        return true;
    }

    /**
     * Get 404 template
     * @return string
     */
    private function _getNotFoundTemplate() {
        $dm = new DomainManager();

        return $dm->getNotFoundContent();
    }

    /**
     * Redirect user to the login page
     */
    public function actionIndex() {
        if (!$this->_system->admin_path || $this->_system->admin_path == "admin") {
            if (!User::model()->count() && Yii::app()->system->isSaas()) {
                return $this->redirect(["app/createAdmin"]);
            }
        }

        $system = Yii::app()->system->getModel();
        $baseUrl = Yii::app()->system->getAdminDomain() . ($system->admin_port ? ":{$system->admin_port}" : "");

        if ($system->enduser_portal_full_domain != $baseUrl && $system->enduser_portal_full_domain == $_SERVER["HTTP_HOST"]) {
            return $this->redirect(["enduser/login"]);
        } else {
            return $this->redirect(["app/login"]);
        }
    }

    /**
     *  Azure ad auth
     * @param $id
     * @return void
     * @throws CHttpException
     */
    public function actionAzureAdAuth($id = null) {
        try {
            $azureServerManager = new AzureServerManager();

            $id = $id ? $id : Yii::app()->user->getState("OAuth2.azureServerId");
            $azureServer = null;

            if ($id) {
                $azureServer = $azureServerManager->getAzureServer($id);
            }

            if (!$azureServer) {
                throw new CHttpException(404, __t("Azure Server not found."));
            }

            $ssoOAuthManager = new AzureOAuthManager(AzureOAuthManager::IMPORT_AUTH);
            $ssoOAuthManager->setProvider(
                Yii::app()->createAbsoluteUrl("oauth"),
                $azureServer->azure_client_id,
                $azureServer->client_secret,
                $azureServer->tenant_id
            );

            if (isset($_GET["code"]) && Yii::app()->user->getState("OAuth2.state") && isset($_GET["state"])) {
                if ($_GET["state"] == Yii::app()->user->getState("OAuth2.state")) {
                    $token = $ssoOAuthManager->generateToken($_GET["code"]);
                    $azureServer->refresh_token = $token->getRefreshToken();
                    $azureServer->access_token = $token->getToken();
                    $azureServer->save();

                    Yii::app()->user->setFlash("success", __t("Successfully authenticated."));

                    return $this->redirect(["azureServer/edit", "id" => $azureServer->id]);
                } else {
                    AppLogger::error("OAuth Authentication Error");
                    Yii::app()->user->setFlash("error", "OAuth Authentication Error");
                }
            } else {
                $authorizationUrl = $ssoOAuthManager->getAuthorizationUrl();
                Yii::app()->user->setState("OAuth2.state", $ssoOAuthManager->getState());
                Yii::app()->user->setState("OAuth2.azureServerId", $azureServer->id);

                return $this->redirect($authorizationUrl);
            }
        } catch (Exception $exception) {
            AppLogger::error($exception->getMessage() . PHP_EOL . $exception->getTraceAsString());
            Yii::app()->user->setFlash("error", "OAuth Authentication Error");

            $this->redirect(["azureServer/edit", "id" => $azureServer->id]);
            ;
        }
    }

    /**
     * OAuth
     *
     * @param $type
     * @param null|string $redirectUrl
     * @return void|null
     * @throws Exception
     */
    public function actionOauth($type, $redirectUrl = null) {
        $ssoOAuthManager = new AzureOAuthManager(AzureOAuthManager::BASIC_AUTH);

        try {
            $ssoOAuthManager->setProvider(
                Yii::app()->createAbsoluteUrl("app/oauth", ["type" => $type]),
                Yii::app()->system->sso_oauth_client_id,
                Yii::app()->system->sso_oauth_client_secret,
                Yii::app()->system->sso_oauth_tenant_id
            );
        } catch (Exception $ex) {
            AppLogger::error($ex->getMessage() . PHP_EOL . $ex->getTraceAsString());
            Yii::app()->user->setFlash("error", "OAuth Authentication Error");

            $this->redirect($type === SsoBaseManager::ADMIN_TYPE ? $this->createUrl("admin/login") : EnduserManager::getEnduserUrl("enduser/login"));
        }

        if (isset($_GET["code"]) && Yii::app()->user->getState("OAuth2.state") && isset($_GET["state"])) {
            if ($_GET["state"] == Yii::app()->user->getState("OAuth2.state")) {
                $redirectUrl = Yii::app()->user->getState("OAuth2.redirectUrl");
                Yii::app()->user->setState("OAuth2.redirectUrl", null);
                $ssoOAuthManager->generateToken($_GET["code"]);
                $me = $ssoOAuthManager->getMe();
                $system = Yii::app()->system->getModel();

                try {
                    // Look for "mail" or "userPrincipalName" fields
                    $mail = !empty($me["mail"]) ? $me["mail"] : (!empty($me["userPrincipalName"]) ? $me["userPrincipalName"] : "");

                    if (!empty($mail)) {
                        $login = $mail;
                        $identity = new UserIdentity($login, null);

                        if ($type == SsoBaseManager::ADMIN_TYPE) {
                            $identity->authenticate(true, false, true);
                            Yii::app()->user->login($identity);

                            Yii::app()->user->setState(UserIdentity::USER_JUST_LOGGED_IN, true);
                            Yii::app()->user->setId($identity->getId());
                            License::log(LicenseLog::TYPE_USER_LOGIN, "-");
                            $api = new ApiManager();
                            $api->persistToken($identity);
                        } else {
                            $enduserManager = new EnduserManager();
                            $name = !empty($me["displayName"]) ? $me["displayName"] : $login;
                            $language = !empty($me["preferredLanguage"]) ? substr($me["preferredLanguage"], 0, 2) : null;

                            $enduserManager->createFromSso($login, $name, $language);
                            $identity->authenticate(true, true, true);

                            Yii::app()->user->login($identity);
                            Yii::app()->user->setState(UserIdentity::USER_JUST_LOGGED_IN, true);
                            Yii::app()->user->setId($identity->getId());
                            License::log(LicenseLog::TYPE_USER_LOGIN, "-");
                        }
                    } else {
                        throw new Exception(__t("Email cannot be blank."));
                    }
                } catch (Exception $e) {
                    AppLogger::error($e->getMessage() . PHP_EOL . $e->getTraceAsString());
                    Yii::app()->user->setFlash("error", $e->getMessage());

                    if ($this->_system->sso_auto_login) {
                        $system->sso_auto_login_error = true;
                        $system->save(["sso_auto_login_error"]);
                    }
                }

                $this->redirect($redirectUrl);
            } else {
                AppLogger::error("OAuth Authentication Error");
                Yii::app()->user->setFlash("error", "OAuth Authentication Error");
            }
        } else {
            $authorizationUrl = $ssoOAuthManager->getAuthorizationUrl();
            Yii::app()->user->setState("OAuth2.state", $ssoOAuthManager->getState());
            Yii::app()->user->setState("OAuth2.redirectUrl", $redirectUrl);

            $this->redirect($authorizationUrl);
        }
    }

    /**
     * Sso Login page
     * @param null $redirect
     * @param null $type
     * @return void
     * @throws Exception
     */
    public function actionSsoLogin($redirect = null, $type = null) {
        $ssoManager = new SsoManager();
        $system = Yii::app()->system->getModel();

        // Redirect to login page if the redirect url is not to the same domain of the server
        if (!empty($redirect) && !$ssoManager->checkIfUrlHasAppDomain($redirect)) {
            $errorMessage = "SSO Authentication Error: wrong return URI parameter.";
            AppLogger::error("{$errorMessage} The URI parameter that was given is {$redirect}");
            Yii::app()->user->setFlash("error", $errorMessage);

            // Redirect to login page
            return $this->redirect($type === SsoBaseManager::ADMIN_TYPE ? $this->createUrl("admin/login") : EnduserManager::getEnduserUrl("enduser/login"));
        }

        if (Yii::app()->system->sso_enabled) {
            if (Yii::app()->system->sso_protocol === SsoBaseManager::SAML_PROTOCOL) {
                if (!$ssoManager->isAuthenticated() && $ssoManager->settingsCheck()) {
                    $ssoManager->checkSamlAuth($redirect);
                }

                if ($ssoManager->isAuthenticated()) {
                    $system->sso_auto_login_error = true;
                    $system->save(["sso_auto_login_error"]);

                    return $this->redirect($redirect ? $redirect : ["app/login"]);
                }
            } elseif (Yii::app()->system->sso_protocol === SsoBaseManager::OAUTH_PROTOCOL) {
                return $this->redirect(["app/oauth", "type" => $type, "redirectUrl" => $redirect ? $redirect : Yii::app()->createAbsoluteUrl("app/login")]);
            }
        }
    }

    /**
     * Log the user in and redirect to a project list
     * @param string $link
     * @param bool $clearToken
     * @throws Exception
     */
    public function actionLogin($link = null, $clearToken = false) {
        if (!User::model()->count() && Yii::app()->system->isSaas()) {
            return $this->redirect(["app/createAdmin"]);
        }

        $system = Yii::app()->system->getModel();
        $form = new LoginForm();
        // forward the system\'s general name to the LoginForm (can be empty)
        $form->generalName = Yii::app()->system->general_name;
        //Check if generalName is empty if its empty set it to "ThriveDX"
        if (empty($form->generalName)) {
            $form->generalName = "ThriveDX";
        }
        $isSaml = false;

        try {
            if (!empty($link)) {
                $sm = new SamlManager();

                if (!$system->sso_auto_login_error && $sm->isSamlLink($link)) {
                    $user = $sm->samlAuthorization($link);
                    $form->email = $user->email;
                    $form->password = $user->password;
                    $form->language = !empty($_POST["LoginForm"]["language"]) ? $_POST["LoginForm"]["language"] : null;
                    $_POST["LoginForm"] = $form;
                    $isSaml = true;
                }
            }
        } catch (Exception $e) {
            Yii::app()->user->setFlash("error", $e->getMessage());

            return $this->redirect($this->createUrl("admin/login"));
        }

        // collect user input data
        if (isset($_POST["LoginForm"])) {
            $form->attributes = $_POST["LoginForm"];
            $form->setSaml($isSaml);

            if ($form->validate()) {
                $cookieLanguage = new CHttpCookie(CookieManager::COOKIE_LANGUAGE, $form->language);
                $cookieLanguage->path = "/";
                $cookieLanguage->secure = true;
                $cookieLanguage->expire = time() + 60 * 60 * 24 * 30;
                Yii::app()->request->cookies[CookieManager::COOKIE_LANGUAGE] = $cookieLanguage;
                $userManager = new UserManager();

                $user = User::model()->findByAttributes([
                    "email" => $form->attributes["email"]
                ]);

                if ($user && Yii::app()->system->getAccountLockout() && $user->locked_at) {
                    if ($userManager->unlockAccountHandler($user)) {
                        return $this->redirect($this->createUrl("app/login"));
                    }
                }

                if ($form->login($isSaml)) {
                    if (Yii::app()->user->getCertificateRequired()) {
                        return $this->redirect(["app/verify"]);
                    } elseif (Yii::app()->user->getTwoFactorAuthRequired()) {
                        Yii::app()->user->setState("2faVerified", false);

                        return $this->redirect(["app/confirmAuthy"]);
                    } else {
                        Yii::app()->user->setState(UserIdentity::USER_JUST_LOGGED_IN, true);

                        // Validate, that user has email
                        $email = $user->email ?? Yii::app()->user->email;

                        if ($email) {
                            Resque::redis()->del("{$email}.loginAttempt");
                        }

                        $lastVisitedUrl = CookieManager::get(null, null, "lastVisitedUrl");

                        if ($lastVisitedUrl) {
                            CookieManager::delete(null, null, "lastVisitedUrl", "", "");

                            return $this->redirect($lastVisitedUrl);
                        }

                        return $this->redirect(["campaign/index"]);
                    }
                } else {
                    $form->password = null;

                    if (Yii::app()->system->getAccountLockout()) {
                        $user = User::model()->findByAttributes([
                            "email" => $form->attributes["email"]
                        ]);

                        if ($user) {
                            $userManager->lockAccountHandler($user);
                        } else {
                            Yii::app()->user->setFlash("error", __t("Incorrect username or password."));
                        }
                    } else {
                        Yii::app()->user->setFlash("error", __t("Incorrect username or password."));
                    }
                }
            } else {
                $form->password = null;
                Yii::app()->user->setFlash("error", __t("Please fix the errors below."));
            }
        } else {
            $clearToken = true;
        }

        if ($system->sso_enabled && $system->sso_auto_login && !$system->sso_auto_login_error && Yii::app()->user->isGuest) {
            return $this->redirect(["app/ssoLogin", "type" => SsoBaseManager::ADMIN_TYPE]);
        }

        $system->sso_auto_login_error = false;
        $system->save(["sso_auto_login_error"]);

        // display the login form
        $this->pageTitle = __t("Login");

        $this->render("login", [
            "form" => $form,
            "recovery" => true,
            "clearToken" => $clearToken,
            "ssoEnabled" => Yii::app()->system->sso_enabled,
            "enduser" => 0,
            "ssoRedirect" => null,
        ]);
    }

    /**
     * 2FA authentication
     */
    public function actionConfirmAuthy() {
        $form = new UserConfirmAuthyForm();
        $authyManager = new AuthyApiManager(Yii::app()->system->getModel()->auth_api_key);
        /** @var User $user */
        $user = Yii::app()->user->getUser();

        if (isset($_POST["UserConfirmAuthyForm"])) {
            $form->attributes = $_POST["UserConfirmAuthyForm"];

            if ($form->validate()) {
                try {
                    $result = $authyManager->verifyToken($user->authy_id, $form->code);
                    Yii::app()->user->setState("2faVerified", $result["success"]);
                    Yii::app()->user->setState(UserIdentity::USER_JUST_LOGGED_IN, true);

                    return $this->redirect(["campaign/index"]);
                } catch (Exception $e) {
                    if (in_array($e->getCode(), [404, 500])) {
                        Yii::app()->user->setState("2faVerified", true);
                        Yii::app()->user->setState(UserIdentity::USER_JUST_LOGGED_IN, true);

                        return $this->redirect(["campaign/index"]);
                    } else {
                        Yii::app()->user->setFlash("error", $e->getMessage());
                    }
                }
            } else {
                Yii::app()->user->setFlash("error", __t("Please fix the errors below."));
            }
        } else {
            try {
                $authyManager->requestSms($user->authy_id);
            } catch (Exception $e) {
                Yii::app()->user->setFlash("error", $e->getMessage());
            }
        }

        $this->layout = "//layouts/authy";
        $this->pageTitle = __t("Two Factor Authentication");
        $this->render("confirm-authy", [
            "form" => $form,
        ]);
    }

    /**
     * Swagger UI
     */
    public function actionSwaggerUi() {
        $swaggerData = ApiManager::json();

        $this->breadcrumbs[] = [__t("Common System Settings"), $this->createUrl("domain/index")];
        $this->breadcrumbs[] = [__t("API Whitelist"), $this->createUrl("settings/whitelist")];
        $this->breadcrumbs[] = [__t("API documentation"), ""];

        $this->vuejs = true;
        $this->render("swagger", [
            "data" => $swaggerData
        ]);
    }

    /**
     * Resend 2FA token
     */
    public function actionResendAuthyToken() {
        $response = new AjaxResponse();

        try {
            if (!Yii::app()->user->getTwoFactorAuthRequired()) {
                throw new CHttpException(403, __t("Permission denied."));
            }

            $authyManager = new AuthyApiManager(Yii::app()->system->getModel()->auth_api_key);

            /** @var User $user */
            $user = Yii::app()->user->getUser();
            $result = $authyManager->requestSms($user->authy_id);

            $response->addData("message", CHtml::encode($result["message"]));
        } catch (Exception $e) {
            $response->setError($e->getMessage());
        }

        echo $response->serialize();
    }

    /**
     * Password reset
     */
    public function actionReset($key) {
        $user = User::model()->findByAttributes([
            "security_key" => $key
        ]);

        if (!$user || $user->securityKeyExpired) {
            Yii::app()->user->setFlash("error", __t("Verification failed. Please try again."));

            return $this->redirect(["app/recovery"]);
        }

        $form = new UserPasswordEditForm($user->id);

        // collect user input data
        if (isset($_POST["UserPasswordEditForm"])) {
            $form->attributes = $_POST["UserPasswordEditForm"];

            try {
                if (!$form->validate()) {
                    throw new FormValidationException();
                }

                $user->password_updated_at = date(ISO_DATE_TIME);
                $user->password = $user->passwordFunction($form->password);
                $user->save();

                $mgr = new UserManager();
                $passwordCommonManager = new PasswordCommonManager();

                if (Yii::app()->system->getPasswordCommon() && $passwordCommonManager->isPasswordCommon($form->password)) {
                    $form->addError("password", __t("This password is one of the most used passwords, try another one."));
                    throw new FormValidationException();
                } elseif (Yii::app()->system->getPasswordHistory() && $mgr->isPasswordRestricted($user->id, $form->password)) {
                    $form->addError("password", __t("This password has been previously used, please create a new password."));
                    throw new FormValidationException();
                } else {
                    $mgr->setPassword($user, $form->password);
                    $mgr->setPasswordHistory($user->id, $user->password);
                    $mgr->generateSecurityKey($user);
                }

                Yii::app()->user->setFlash("success", __t("Password successfully changed."));

                return $this->redirect(["app/login"]);
            } catch (FormValidationException $e) {
                Yii::app()->user->setFlash("error", __t("Please fix the errors below."));
            }
        }

        $this->pageTitle = __t("Reset Your Password");
        $this->render("password-reset", [
            "form" => $form,
            "strengthCheckEnabled" => Yii::app()->system->getPasswordStrengthCheck()
        ]);
    }

    /**
     * Password recovery request
     */
    public function actionRecovery() {
        $form = new LoginForm(LoginForm::RECOVERY);
        // forward the system\'s general name to the LoginForm (can be empty)
        $form->generalName = Yii::app()->system->general_name;

        // collect user input data
        if (isset($_POST["LoginForm"])) {
            $form->attributes = $_POST["LoginForm"];

            if ($form->validate()) {
                try {
                    $enduserManager = new EnduserManager();
                    $mgr = new UserManager();
                    $criteria = new CDbCriteria();
                    $criteria->addCondition("LOWER(email) = LOWER(:email)");
                    $criteria->addCondition("role_id != :enduser_id");
                    $criteria->params = [
                        ":enduser_id" => $enduserManager->getRoleId(),
                        ":email" => $form->email,
                    ];

                    $user = User::model()->find($criteria);

                    if ($user) {
                        $mgr->sendPasswordRecoveryEmail($user, 0);
                    }

                    Yii::app()->user->setFlash("success", __t("An email with password reset instructions is sent to the entered email address."));

                    return $this->redirect(["app/login"]);
                } catch (Exception $e) {
                    Yii::app()->user->setFlash("error", __t("Sorry, an error occurred while sending email."));
                    AppLogger::error($e->getMessage());
                }
            } else {
                Yii::app()->user->setFlash("error", __t("Please fix the errors below."));
            }
        }

        $this->pageTitle = __t("Password Recovery");
        $this->render("login", [
            "form" => $form,
            "ssoRedirect" => null,
            "enduser" => 0,
            "ssoEnabled" => Yii::app()->system->sso_enabled,
        ]);
    }

    /**
     * Log the user out and redirect to the main page
     */
    public function actionLogout() {
        $role = Yii::app()->user->getState("role");
        License::log(LicenseLog::TYPE_USER_LOGOUT, "-");

        $token = Yii::app()->user->getState("OAuth2.token");
        Yii::app()->user->logout();

        if (Yii::app()->system->sso_enabled) {
            $ssoManager = new SsoManager();

            if (Yii::app()->system->sso_protocol === SsoBaseManager::SAML_PROTOCOL && $ssoManager->isAuthenticated()) {
                $ssoManager->logout($role);
            } elseif (Yii::app()->system->sso_protocol === SsoBaseManager::OAUTH_PROTOCOL && $token) {
                $azureOAuthManager = new AzureOAuthManager();
                $azureOAuthManager->setProvider(
                    null,
                    Yii::app()->system->sso_oauth_client_id,
                    Yii::app()->system->sso_oauth_client_secret,
                    Yii::app()->system->sso_oauth_tenant_id
                );
                $azureOAuthManager->logout($role == Role::ENDUSER ? EnduserManager::getEnduserUrl("enduser/login") : $ssoManager->getRedirectUrl(Yii::app()->createUrl("app/login")));
                exit;
            }
        }


        switch ($role) {
            case Role::ENDUSER:
                return $this->redirect(EnduserManager::getEnduserUrl("enduser/login"));

            default:
                return $this->redirect(["app/login"]);
        }
    }

    /**
     * Exception handler
     */
    public function actionError() {
        $error = Yii::app()->errorHandler->error;
        $this->breadcrumbs[] = [__t("Error"), ""];

        if ($error) {
            $message = $error["message"];

            switch ($error["code"]) {
                case 404:
                    $template = $this->_getNotFoundTemplate();

                    if ($template) {
                        echo $template;
                        exit();
                    }
                    break;

                case 400:
                    $message = __t("Your session has been terminated. Please log in again.");
                    break;

                case 500:
                    AppLogger::error($message);
                    $uniqueHash = strtoupper(substr(hash("sha256", time() . rand() . $error["message"]), 0, 16));
                    $message = __t("Internal server error. Please send this error code to the administrator - {code}.", [
                        "{code}" => $uniqueHash
                    ]);
                    break;
            }

            if (Yii::app()->request->isAjaxRequest) {
                echo $message;
            } else {
                $this->pageTitle = __t("Error {code}", [ "{code}" => $error["code"] ]);
                $this->render("error", [
                    "message" => $message
                ]);
            }
        }
    }

    /**
     * Verify user\'s certificate, if needed
     */
    public function actionVerify() {
        /** @var WebUser $user */
        $user = Yii::app()->user;

        if ($user->isGuest) {
            return $this->redirect(["app/login"]);
        }

        if (!$user->getCertificateRequired()) {
            if ($user->getTwoFactorAuthRequired()) {
                return $this->redirect(["app/confirmAuthy"]);
            } else {
                Yii::app()->user->setState(UserIdentity::USER_JUST_LOGGED_IN, true);

                return $this->redirect(["campaign/index"]);
            }
        }

        $user->setState("certificateVerified", false);

        $serial = $user->getCertificateSerial();
        $issuer = $user->getCertificateIssuer();
        $email = $user->getEmail();

        $validations = [
            "SSL_CLIENT_VERIFY" => "SUCCESS",
            "SSL_CLIENT_M_SERIAL" => $serial,
            "SSL_CLIENT_I_DN" => SslManager::formatSslClientParam($issuer),
            "SSL_CLIENT_S_DN_Email" => $email,
        ];

        if ($serial && $issuer) {
            $failed = false;

            foreach ($validations as $key => $validator) {
                if ($key === "SSL_CLIENT_I_DN") {
                    if (isset($_SERVER[$key])) {
                        $_SERVER[$key] = SslManager::formatSslClientParam($_SERVER[$key]);
                    }

                    if (isset($_SERVER["REDIRECT_" . $key])) {
                        $_SERVER["REDIRECT_" . $key] = SslManager::formatSslClientParam($_SERVER["REDIRECT_" . $key]);
                    }
                }

                if (isset($_SERVER[$key]) && $_SERVER[$key] == $validator) {
                    continue;
                }

                if (isset($_SERVER["REDIRECT_" . $key]) && $_SERVER["REDIRECT_" . $key] == $validator) {
                    continue;
                }

                $failed = true;

                break;
            }

            if ($failed) {
                $user->logout();
                Yii::app()->session->open();
                Yii::app()->user->setFlash("error", __t("Invalid client certificate."));

                return $this->redirect(Yii::app()->homeUrl);
            }
        }

        $user->setState("certificateVerified", true);

        if ($user->getTwoFactorAuthRequired()) {
            return $this->redirect(["app/confirmAuthy"]);
        } else {
            Yii::app()->user->setState(UserIdentity::USER_JUST_LOGGED_IN, true);

            return $this->redirect(["campaign/index"]);
        }
    }

    /**
     * Hide notification
     * @param string $key
     */
    public function actionHideNotification($key) {
        $response = new AjaxResponse();

        $nm = new NotificationManager();
        $nm->hide($key);

        echo $response->serialize();
    }

    /**
     * Close main notification
     * @param $notification
     */
    public function actionCloseNotification($notification) {
        $response = new AjaxResponse();

        if (in_array($notification, NotificationManager::getMainNotifications())) {
            $cookieName = strtolower(preg_replace(\'/(?<!^)[A-Z]/\', \'_$0\', $notification));
            Yii::app()->request->cookies["dashboard_view"] = new CHttpCookie($cookieName, 0, ["expire" => time() + NotificationManager::YEAR_IN_SECONDS * 10, "httpOnly" => true, "secure" => true]);
        }

        echo $response->serialize();
    }

    /**
     * Register event
     */
    public function actionEvent() {
        $response = new AjaxResponse();

        try {
            $link = filter_input(INPUT_COOKIE, CookieManager::COOKIE_AWARENESS_LINK);
            $awareness = true;

            if (!$link) {
                $link = filter_input(INPUT_COOKIE, "link");
                $awareness = false;
            }

            $victimManager = new VictimManager();
            $victim = null;

            if (!$link) {
                $link = CookieManager::get(null, null, CookieManager::COOKIE_ENDUSER_DIRECT_LOGIN);
                $campaignCookie = CookieManager::get(null, null, CookieManager::COOKIE_CAMPAIGN_DIRECT_LOGIN);

                if (!$link) {
                    throw new Exception(__t("User not found."));
                }

                $awarenessWebsite = new AwarenessWebsite();
                $email = null;

                try {
                    $email = $awarenessWebsite->getEnduserDirectLoginEmailFromToken($link);
                    $campaignId = $awarenessWebsite->getEnduserDirectLoginEmailFromToken($campaignCookie);

                    if ($email) {
                        $victim = $victimManager->getVictimByEmail($email, $campaignId, null);
                    }
                } catch (Exception $e) {
                    AppLogger::error($e->getMessage() . PHP_EOL . $e->getTraceAsString());
                }
            } else {
                $victim = $victimManager->getVictim($link, $awareness);
            }

            if (!$victim) {
                throw new Exception(__t("User not found."));
            }

            if (!array_key_exists("event", $_POST) || $_POST["event"] == "") {
                throw new Exception(__t("No event sent."));
            }

            $id = $victim->scenario->campaign_id;
            $event = CampaignEvent::model()->findByAttributes([
                "name" => $_POST["event"],
                "campaign_id" => $id
            ]);

            if (is_null($event)) {
                $event = new CampaignEvent();
                $event->name = $_POST["event"];
                $event->campaign_id = $id;
                $event->save();
            }

            $eventVictim = new CampaignEventVictim();
            $eventVictim->victim_id = $victim->id;
            $eventVictim->campaign_event_id = $event->id;
            $eventVictim->save();

            if ($eventVictim->campaign_event->name == CampaignEvent::EVENT_VIDEO_FINISH) {
                $victim->awareness_video_watched_at = date(ISO_DATE_TIME);
                $victim->save();
            }
        } catch (Exception $e) {
            AppLogger::error($e->getMessage() . PHP_EOL . $e->getTraceAsString());
            $response->setError($e->getMessage());
        }

        echo $response->serialize();
    }

    /**
     * Outlook 365 configuration action
     * @param integer $client
     * @throws
     */

    public function actionO365Config($client = null) {
        $license = new License();
        $link = $this->_system->getSslUrl() . Yii::app()->createUrl("scenario/phishingReport");

        if ($client && $license->getOption(License::OPTION_INCIDENT_CLIENT)) {
            $link = $this->_system->getSslUrl() . Yii::app()->createUrl("scenario/phishingReport", ["client" => $client]);
        }

        $phishingReportManager = new PhishingReportManager();
        $phishingReportSettings = $phishingReportManager->getPhishingReportSettings($this->_system->outlook_default_language);

        $vars = [
            "submitEmailAddress" => trim($this->_system->outlook_email),
            "submitHttpUrl" => $link,
            "useEmlFormat" => $this->_system->outlook_use_eml_format,
            "thankYouLucy" => $phishingReportSettings->outlook_lucy_message,
            "thankYou" => $phishingReportSettings->outlook_message,
            "submitHttp" => $this->_system->outlook_report_http,
            "submitSimulationHttp" => $this->_system->outlook_simulation_report_http,
            "submitSmtp" => $this->_system->outlook_report_smtp,
            "subject" => $phishingReportSettings->outlook_subject,
            "useXHeaders" => $this->_system->outlook_use_x_headers,
            "suppressSim" => $this->_system->outlook_suppress_simulation_email,
            "moreAnalysis" => $this->_system->outlook_more_analysis,
            "moreAnalysisText" => $phishingReportSettings->outlook_more_analysis_text,
            "userRequest" => $phishingReportSettings->outlook_user_request,
            "userRequestTitle" => $phishingReportSettings->outlook_report_title,
            "errorTitle" => $phishingReportSettings->outlook_error_title,
            "errorText" => $phishingReportSettings->outlook_send_error,
            "buttonTitle" => $phishingReportSettings->outlook_button,
            "buttonText" => $phishingReportSettings->outlook_supertip,
            "reportedEmailFolder" => ($this->_system->outlook_action_with_reported_email == PhishingReportManager::NON_SYSTEM_FOLDER) ?
                $this->_system->outlook_reported_email_folder :
                $this->_system->outlook_action_with_reported_email,
            "client" => $client,
        ];

        $this->sendCorsHeader();
        header("Content-Type: application/json");

        echo JsonManager::encode($vars, JSON_UNESCAPED_SLASHES);
    }

    /**
     * Create Admin user action
     */
    public function actionCreateAdmin() {
        if (User::model()->count() || !Yii::app()->system->isSaas()) {
            return $this->redirect(["app/login"]);
        }

        /** @var UserEditForm $form */
        $form = new UserEditForm(null);
        $form->scenario = UserEditForm::SCENARIO_INSERT;

        if (isset($_POST["UserEditForm"])) {
            $form->attributes = $_POST["UserEditForm"];
            $form->name = "Administrator";

            try {
                /** @var Role $adminRole */
                $adminRole = Role::model()->findByAttributes(["role" => Role::ADMIN]);
                $form->roleId = $adminRole->id;

                if ($form->validate()) {
                    $user = new User();
                    $user->fromForm($form);
                    $user->password = $user->passwordFunction($form->password);
                    $user->save();

                    return $this->redirect(["app/login"]);
                } else {
                    Yii::app()->user->setFlash("error", __t("Please fix the errors below."));
                }
            } catch (Exception $e) {
                Yii::app()->user->setFlash("error", $e->getMessage());
            }
        }

        $this->pageTitle = __t("Create Admin");
        $this->render("create-admin", [
            "form" => $form
        ]);
    }

    /**
     * SSO Error Handler
     */
    public function actionSsoError() {
        $ssoManager = new SsoManager();
        $this->breadcrumbs[] = [__t("Error"), ""];
        $system = Yii::app()->system->getModel();
        $system->sso_auto_login_error = true;
        $system->save(["sso_auto_login_error"]);

        if (isset($_REQUEST["SimpleSAML_Auth_State_exceptionId"])) {
            $message = null;

            try {
                $ssoException = !empty($_REQUEST["SimpleSAML_Auth_State_exceptionId"]) ? $_REQUEST["SimpleSAML_Auth_State_exceptionId"] : null;
                $customException = !empty($_REQUEST["error"]) ? $_REQUEST["error"] : null;
                $message = $ssoException ? $ssoManager->getError($ssoException) : $customException;
            } catch (Exception $ex) {
                $message = $ex->getMessage() ? $ex->getMessage() : __t("Unexpected Sso error");
            }

            Yii::app()->user->setFlash("error", __t("{:error}", [
                ":error" => $message
            ]));
        }

        return $this->redirect(["app/login"]);
    }
}
'