I've gotten a lot of feedback about my tracking system already. So now I'm changing gears and looking at my email generation system. I have a class called Email which manages the sending of emails, validation of user email addresses, and validation of whether the user is a permissible "victim". To do this, I created a custom iterator to iterate over a PDO result set of users, called PDOIterator. The resulting Email class function gets called in PhishingController, where the data is assembled then passed to be sent.
As this is a complete rewrite of what I originally had, I have no specific direction that I'm asking for. So whatever you have works!
/**
* executeEmail
* Public-facing method to send an email to a database of users if they are a valid recipient.
*
* @param array $emailSettings Host, port, username, and password variables for the mail server
* @param string $emailTemplate Path to the blade.php template file from the views directory
* @param string $templateType Specifies whether the email is an Advanced (adv) or Basic (bsc) scam
* @param string $templateTarget Specifies whether the email is a Targeted (T) or Generic (G) scam
* @param int $period Number of weeks to check back for recipient validation
* @param string $projectName Name of this project
* @param int $projectId ID of this project
* @param string $fromEmail Email to be sent from
* @param string $companyName Name of company sponsoring this awareness test
* @param string $subject Subject of email
* @throws OutOfBoundsException
* @throws FatalErrorException
* @throws \PDOException Thrown from DBManager->query()
* @throws QueryException Thrown from DBManager->query()
*/
public static function executeEmail($emailSettings, $emailTemplate, $templateType, $templateTarget, $period,
$projectName, $projectId, $companyName = 'your organization',
$subject = 'Corporate Communication') {
self::setEmailEnvironmentSettings($emailSettings);
$db = new DBManager();
$sql = "SELECT * FROM gaig_users.users;";
$bindings = array();
$users = $db->query($sql,$bindings,array('\PDO::ATTR_CURSOR'),array('\PDO::CURSOR_SCROLL'));
self::sendEmail(array($templateType,$templateTarget,$users,$period,$emailTemplate,$companyName,
$projectName,$projectId),$emailSettings[2],$subject);
}
/**
* setEmailEnvironmentSettings
* Checks if the settings are valid settings, then sets or returns an exception.
*
* @param array $emailSettings Host, port, username, and password variables for the mail server
* @throws OutOfBoundsException
*/
private function setEmailEnvironmentSettings($emailSettings) {
$pattern = ';(?:https?://)?(?:[a-zA-Z0-9.-]+?\.(?:com|net|org|gov|edu|mil)|\d+\.\d+\.\d+\.\d+);';
if(!preg_match($pattern,$emailSettings[0]) || !filter_var($emailSettings[1],FILTER_VALIDATE_INT) ||
!filter_var($emailSettings[2],FILTER_VALIDATE_EMAIL)) {
$message = '';
if(!preg_match($pattern,$emailSettings[0])) {
$message .= 'Host is not a valid host name or IP address. host=' . $emailSettings[0] . '\n';
}
if(!filter_var($emailSettings[1],FILTER_VALIDATE_INT)) {
$message .= 'Port is not a valid integer. port=' . $emailSettings[1] . '\n';
}
if(!filter_var($emailSettings[2],FILTER_VALIDATE_EMAIL)) {
$message .= 'Username is not a valid email address. username=' . $emailSettings[2] . '\n';
}
throw new OutOfBoundsException($message);
}
putenv("MAIL_HOST=$emailSettings[0]");
putenv("MAIL_PORT=$emailSettings[1]");
putenv("MAIL_USERNAME=$emailSettings[2]");
putenv("MAIL_PASSWORD=$emailSettings[3]");
}
/**
* validRecipientAlgo
* Function checks if the specified user has not received a test within the specified duration,
* if the template type is the same for the last two project participants, if the template target
* is the same for last three project participants, or if the last project is identical to the new project.
*
* @param string $templateType Specifies whether the email is an Advanced (adv) or Basic (bsc) scam
* @param string $templateTarget Specifies whether the email is a Targeted (T) or Generic (G) scam
* @param array $user Associative Array containing the fields associated to the user
* @param int $period Number of weeks to check back for recipient validation
* @return bool
*/
private function validRecipientAlgo($templateType,$templateTarget,$user,$period) {
$db = new DBManager();
$date = date('Y-m-d',strtotime('-' . $period . 'weeks')) . '00:00:00';
$sql = "SELECT max(SML_AccessTimestamp) as 'timestamp_check' from gaig_users.sent_email where SML_UserId = ? and SML_ProjectName = ?;";
$bindings = array($user['USR_UserId'],$user['USR_ProjectMostRecent']);
$timestampData = $db->query($sql,$bindings);
$result = $timestampData->fetch(\PDO::FETCH_ASSOC);
if($result['timestamp_check'] <= $date) {
return true;
} else if($templateType == substr($user['USR_ProjectMostRecent'],-5,3) &&
$templateType == substr($user['USR_ProjectPrevious'],-5,3)) {
return false;
} else if($templateTarget == substr($user['USR_ProjectMostRecent'],-2,1) &&
$templateTarget == substr($user['USR_ProjectPrevious'],-2,1) &&
$templateTarget == substr($user['USR_ProjectLast'],-2,1)) {
return false;
} else if($templateType.$templateTarget ==
substr($user['USR_ProjectMostRecent'],strpos($user['USR_ProjectMostRecent'],'-')+1,4)) {
return false;
}
return true;
}
/**
* sendEmail
* Iterates through the PDO Result Set of users. Calls validRecipientAlgo to validate user. Sends email if
* valid and updates user if valid.
* @param array $params Required parameters to pass to the email template
* @param string $from Email to be sent from
* @param string $subject Subject of email
* @throws FatalErrorException
*/
private function sendEmail($params, $from, $subject) {
$userIterator = new PDOIterator($params[2]);
foreach($userIterator as $user) {
if($this->validRecipientAlgo($params[0],$params[1],$user,$params[3])) {
$to = $user['USR_Email'];
if(!filter_var($to,FILTER_VALIDATE_EMAIL)) {
ErrorLogging::badEmailAddress(['USR_Username'] . ' has a bad email address. email=' . $user['USR_Email']);
} else {
$db = new DBManager();
$urlId = null;
if(!is_null($user['USR_UniqueURLId'])) {
$urlId = $user['USR_UniqueURLId'];
}
$urlId = $this->random_str(15);
$sql = "UPDATE gaig_users.users SET USR_UniqueURLId=?;";
$bindings = array($urlId);
if($updateUniqueURLId = $db->query($sql,$bindings)) {
$headers = array('companyName'=>$params[5],'projectName'=>$params[6],'projectId'=>$params[7],
'lastName'=>$user['USR_LastName'],'username'=>$user['USR_Username'],'urlId'=>$urlId);
if(!Mail::send(['html' => $params[4]],$headers, function($m) use ($from, $to, $subject) {
$m->from($from);
$m->to($to)->subject($subject);
})) {
throw new FatalErrorException('Email failed to send to ' . $to . ' from ' . $from);
}
$project_new = $params[6] . '-' . $params[4];
$project_mostRecent = $user['USR_ProjectMostRecent'];
$project_previous = $user['USR_ProjectPrevious'];
$sql = "UPDATE gaig_users.users SET USR_ProjectMostRecent=?, USR_ProjectPrevious=?,
USR_ProjectLast=? WHERE USR_Username=?;";
$bindings = array($project_new,$project_mostRecent,$project_previous,$user['USR_Username']);
$updateProjects = $db->query($sql,$bindings);
}
}
}
}
}
private function random_str($length, $keyspace = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ')
{
$str = '';
$max = mb_strlen($keyspace, '8bit') - 1;
for ($i = 0; $i < $length; ++$i) {
$str .= $keyspace[random_int(0, $max)];
}
return $str;
}
PDOIterator - No PHPDoc Yet
private $pdoStatement;
private $key;
private $result;
private $valid;
public function __construct(\PDOStatement $pdoStatement) {
$this->pdoStatement = $pdoStatement;
}
public function next() {
$this->key++;
$this->result = $this->pdoStatement->fetch(
\PDO::FETCH_OBJ,
\PDO::FETCH_ORI_ABS,
$this->key
);
if ($this->result === false) {
$this->valid = false;
return null;
}
}
public function valid() {
return $this->valid;
}
public function current() {
return $this->result;
}
public function rewind() {
$this->key = 0;
}
public function key() {
return $this->key;
}
PhishingController - No PHPDoc Yet
public function sendEmail(Request $request) {
$fromEmail = $request['fromEmail'];
$fromPass = $request['fromPass'];
$host = $request['hostName'];
$port = $request['port'];
$emailSettings = array($host,$port,$fromEmail,$fromPass);
$emailTemplate = 'emails.' . $request['emailTemplate'];
$emailTemplateType = substr($request['emailTemplate'],0,3);
$emailTemplateTarget = substr($request['emailTemplate'],3,1);
$period = 4;
$subject = $request['subject'];
$projectName = $request['projectName'];
$projectId = intval($projectName,strpos($projectName,'_'));
$projectName = substr($projectName,0,strpos($projectName,'_')-1);
$companyName = $request['companyName'];
try {
Email::executeEmail($emailSettings,$emailTemplate,$emailTemplateType,$emailTemplateTarget,
$period,$projectName,$projectId,$companyName,$subject);
} catch(OutOfBoundsException $oobe) {
} catch(FatalErrorException $fee) {
} catch(\PDOException $pdoe) {
ErrorLogging::logConnectError(__CLASS__,__FUNCTION__,$pdoe->getMessage(),$pdoe->getTrace());
} catch(QueryException $qe) {
ErrorLogging::logQueryError(__CLASS__,__FUNCTION__,$qe);
}
}
As always, thanks for the review!
