From 53182c49224227d0e23a0213432bdce6b236101b Mon Sep 17 00:00:00 2001
From: David Goodwin <david@palepurple.co.uk>
Date: Fri, 13 Mar 2009 20:48:24 +0000
Subject: [PATCH] refactoring of users (most app logic is now in /model)

git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@575 a1433add-5e2c-0410-b055-b7f2511e0802
---
 model/AliasHandler.php    | 185 ++++++++++++++++++++++++++++++++++++++
 model/UserHandler.php     |  65 ++++++++++++++
 model/VacationHandler.php | 126 ++++++++++++++++++++++++++
 users/edit-alias.php      |  79 ++++++----------
 users/login.php           |  37 ++------
 users/main.php            |  26 ++----
 users/password.php        |  31 ++-----
 users/vacation.php        | 121 ++++---------------------
 8 files changed, 441 insertions(+), 229 deletions(-)
 create mode 100644 model/AliasHandler.php
 create mode 100644 model/UserHandler.php
 create mode 100644 model/VacationHandler.php

diff --git a/model/AliasHandler.php b/model/AliasHandler.php
new file mode 100644
index 00000000..280dedf3
--- /dev/null
+++ b/model/AliasHandler.php
@@ -0,0 +1,185 @@
+<?php
+
+/** 
+ * Handlers User level alias actions - e.g. add alias, get aliases, update etc.
+ */
+class AliasHandler {
+
+    private $username = null;
+
+    public function __construct($username) {
+        $this->username = $username;
+
+    }
+    /**
+     * @return list of email addresses the user's mail is forwarded to.
+     * (may be an empty list, especially if $CONF['alias_control'] is turned off...
+     * @param boolean - by default we don't return special addresses (e.g. vacation and mailbox alias); pass in true here if you wish to.
+     */
+    public function get($all=false) {
+        $username = escape_string($this->username);
+        $table_alias = table_by_key('alias');
+
+        $sql = "SELECT * FROM $table_alias WHERE address='$username'";
+        $result = db_query($sql);
+        if ($result['rows'] == 1)
+        {
+            $row = db_array ($result['result']);
+            // At the moment Postfixadmin stores aliases in it's database in a comma seperated list; this may change one day.
+            $list = explode(',', $row['goto']);
+            if($all) {
+                return $list;
+            }
+
+            $new_list = array();
+            /* if !$all, remove vacation & mailbox aliases */
+            foreach($list as $address) {
+                if($address != '' ) {
+                    if($this->is_vacation_address($address) || $this->is_mailbox_alias($address)) {
+                    }
+                    else {
+                        $new_list[] = $address;
+                    }
+                }
+            }
+            $list = $new_list;
+            return $list;
+        }
+        return array();
+    }
+
+   /** 
+    * @param string $address
+    * @param string $username
+    * @return boolean true if the username is an alias for the mailbox AND we have alias_control turned off.
+    */
+    public function is_mailbox_alias($address) {
+        global $CONF;
+        $username = $this->username;
+        if($address == $username) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @param string $address
+     * @return boolean true if the address contains the vacation domain
+     */
+    public function is_vacation_address($address) {
+        global $CONF;
+        if($CONF['vacation'] == 'YES') {
+            if(stripos($address, '@' . $CONF['vacation_domain'])) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * @return boolean true on success
+     * @param string $username
+     * @param array $addresses - list of aliases to set for the user.
+     * @param string flags - forward_and_store or remote_only or ''
+     * @param boolean $vacation_persist - set to false to stop the vacation address persisting across updates
+     * Set the user's aliases to those provided. If $addresses ends up being empty the alias record is removed.
+     */
+    public function update($addresses, $flags = '', $vacation_persist=true) {
+        // find out if the user is on vacation or not; if they are, 
+        // then the vacation alias needs adding to the db (as we strip it out in the get method) 
+        // likewise with the alias_control address.
+
+        $valid_flags = array('', 'forward_and_store', 'remote_only');
+        if(!in_array($flags, $valid_flags)) {
+            die("Invalid flag passed into update()... : $flag - valid options are :" . implode(',', $valid_flags));
+        } 
+        $addresses = array_unique($addresses);
+
+        $original = $this->get(true);
+
+        foreach($original as $address) {
+            if($vacation_persist) {
+                if($this->is_vacation_address($address)) {
+                    $addresses[] = $address;
+                }
+            }
+            if($flags != 'remote_only') {
+                if($this->is_mailbox_alias($address)) {
+                    $addresses[] = $address;
+                }
+            }
+        }
+        $addresses = array_unique($addresses);
+
+        $new_list = array();
+        if($flags == 'remote_only') {
+            foreach($addresses as $address) {
+                // strip out our username... if it's in the list given.
+                if($address != $this->username) {
+                    $new_list[] = $address;            
+                }
+            }
+            $addresses = $new_list;
+        }
+        
+        if($flags == 'forward_and_store') {
+            if(!in_array($this->username, $addresses)) {
+                $addresses[] = $this->username;
+            }
+        }
+        $new_list = array();
+        foreach($addresses as $address) {
+            if($address != '') {
+                $new_list[] = $address;
+            }
+        } 
+        $addresses = array_unique($new_list);
+        $username = escape_string($this->username);
+        $goto = escape_string(implode(',', $addresses));
+        $table_alias = table_by_key('alias');
+        if(sizeof($addresses) == 0) {
+            $sql = "DELETE FROM $table_alias WHERE address = '$username'";
+        }
+        if($this->hasAliasRecord() == false) {
+            $true = db_get_boolean(True);
+            $tmp = preg_split('/@/', $username);
+            $domain = $tmp[1];
+            $sql = "INSERT INTO $table_alias (address, goto, domain, created, modified, active) VALUES ('$username', '$goto', '$domain', NOW(), NOW(), $true)";
+        }
+        else {
+            $sql = "UPDATE $table_alias SET goto = '$goto', modified = NOW() WHERE address = '$username'";
+        }
+        $result = db_query($sql);
+        if($result['rows'] != 1) {
+            return false;
+        }
+        db_log($username, $domain, 'edit_alias', "$username -> $goto");
+        return true;
+    }
+
+    /** 
+     * Determine whether a local delivery address is present. This is 
+     * stores as an alias with the same name as the mailbox name (username)
+     * @return boolean true if local delivery is enabled
+     */
+    public function hasStoreAndForward() {
+        $aliases = $this->get(true);
+        if(in_array($this->username, $aliases)) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * @return boolean true if the user has an alias record (i.e row in alias table); else false.
+     */
+    public function hasAliasRecord() {
+        $username = escape_string($this->username);
+        $table_alias = table_by_key('alias');
+        $sql = "SELECT * FROM $table_alias WHERE address = '$username'";
+        $result = db_query($sql);
+        if($result['rows'] == 1) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/model/UserHandler.php b/model/UserHandler.php
new file mode 100644
index 00000000..b0c461dd
--- /dev/null
+++ b/model/UserHandler.php
@@ -0,0 +1,65 @@
+<?php
+
+/**
+ * Simple class to represent a user.
+ */
+class UserHandler {
+    
+    /**
+     * @return boolean true on success; false on failure 
+     * @param string $username
+     * @param string $old_password
+     * @param string $new_passwords
+     *
+     * All passwords need to be plain text; they'll be hashed appropriately
+     * as per the configuration in config.inc.php
+     */
+    public function change_pass($username, $old_password, $new_password) {
+        global $config;
+        if(!UserHandler::login($username, $old_password)) {
+            return false;
+        }
+
+        $tmp = preg_split ('/@/', $username);
+        $USERID_DOMAIN = $tmp[1];
+
+        $username = escape_string($username);
+        $table_mailbox = table_by_key('mailbox');
+
+        $active = db_get_boolean(True);
+        $result = db_query("SELECT * FROM $table_mailbox WHERE username='$username' AND active=$active");
+        $new_db_password = escape_string(pacrypt($new_password));
+
+        $result = db_query ("UPDATE $table_mailbox SET password='$new_db_password',modified=NOW() WHERE username='$username'");
+
+        db_log ($username, $USERID_DOMAIN, 'edit_password', "$USERID_USERNAME");
+        return true;
+    }
+
+    /**
+     * Attempt to log a user in.
+     * @param string $username
+     * @param string $password
+     * @return boolean true on successful login (i.e. password matches etc)
+     */
+    public static function login($username, $password) {
+        global $config;
+        $username = escape_string($username);
+
+        $table_mailbox = table_by_key('mailbox');
+        $active = db_get_boolean(True);
+        $query = "SELECT password FROM $table_mailbox WHERE username='$username' AND active=$active";
+
+        $result = db_query ($query);
+        if ($result['rows'] == 1)
+        {
+            $row = db_array ($result['result']);
+            $password = pacrypt ($password, $row['password']);
+
+            if($row['password'] == $password) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
diff --git a/model/VacationHandler.php b/model/VacationHandler.php
new file mode 100644
index 00000000..678a80dd
--- /dev/null
+++ b/model/VacationHandler.php
@@ -0,0 +1,126 @@
+<?php
+
+class VacationHandler {
+    protected $username = null;
+    function __construct($username) {
+        $this->username = $username;
+    }
+
+    /**
+     * Removes the autoreply alias etc for this user; namely, if they're away we remove their vacation alias and 
+     * set the vacation table record to false.
+     * @return boolean true on success.
+     */
+    function remove() {
+        $ah = new AliasHandler($this->username);
+        $aliases = $ah->get(true); // fetch all.
+        $new_aliases = array();
+        $table_vacation = table_by_key('vacation');
+        $table_vacation_notification = table_by_key('vacation_notification');
+
+        /* go through the user's aliases and remove any that look like a vacation address */
+        foreach($aliases as $alias) {
+            if(!$ah->is_vacation_address($alias)) {
+                $new_aliases[] = $alias;
+            }
+        }
+        $ah->update($new_aliases, '', false);
+
+        // tidy up vacation table.
+        $active = db_get_boolean(False);
+        $username = escape_string($this->username);
+        $result = db_query("UPDATE $table_vacation SET active = $active WHERE email='$username'");
+        $result = db_query("DELETE FROM $table_vacation_notification WHERE on_vacation='$username'");
+        /* crap error handling; oh for exceptions... */
+        return true;
+    }
+
+    /**
+     * @return boolean true indicates this server supports vacation messages, and users are able to change their own.
+     * @global array $CONF
+     */
+    function vacation_supported() {
+        global $CONF;
+        return $CONF['vacation'] == 'YES' && $CONF['vacation_control'] == 'YES';
+    }
+
+    /**
+     * @return boolean true if on vacation, otherwise false
+     * Why do we bother storing true/false in the vacation table if the alias dictates it anyway?
+     */
+    function check_vacation() {
+        $ah = new AliasHandler($this->username);
+        $aliases = $ah->get(true); // fetch all.
+        foreach($aliases as $alias) {
+            if($ah->is_vacation_address($alias)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Retrieve information on someone who is on vacation
+     * @return mixed stored information on vacation - array(subject - string, message - string, active - boolean) or false if they've never been on vacation.
+     */
+    function get_details() {
+        $table_vacation = table_by_key('vacation');
+        $username = escape_string($this->username);
+
+        $sql = "SELECT * FROM $table_vacation WHERE email = '$username'";
+        $result = db_query($sql);
+        if($result['rows'] == 1) {
+            $row = db_array($result['result']);
+            $boolean = ($row['active'] == db_get_boolean(true));
+            return array( 'subject' => $row['subject'],
+                          'body' => $row['body'],
+                          'active'  => $boolean );
+        }
+        return false;
+    }
+    /**
+     * @param string $username
+     * @param string $subject
+     * @param string $body
+     */
+    function set_away($subject, $body) {
+        $this->remove(); // clean out any notifications that might already have been sent.
+        // is there an entry in the vacaton table for the user, or do we need to insert?
+        $table_vacation = table_by_key('vacation');
+        $username = escape_string($this->username);
+        $body = escape_string($body);
+        $subject = escape_string($subject);
+
+        $result = db_query("SELECT * FROM $table_vacation WHERE email = '$username'");
+        // check if the user has a vacation entry already, if so just update it
+        if($result['rows'] == 1) {
+            $active = db_get_boolean(True);
+            $result = db_query("UPDATE $table_vacation SET active = $active, body = '$body', subject = '$subject', created = NOW() WHERE email = '$username'");
+        }
+        else {
+            $tmp = preg_split ('/@/', $username);
+            $domain = escape_string($tmp[1]);
+            $result = db_query ("INSERT INTO $table_vacation (email,subject,body,domain,created,active) VALUES ('$username','$subject','$body','$domain',NOW(),$Active)");
+        }
+
+        $ah = new AliasHandler($this->username); 
+        $aliases = $ah->get(true);
+        $vacation_address = $this->getVacationAlias();
+        $aliases[] = $vacation_address;
+        return $ah->update($aliases, '', false);
+    }
+
+    /**
+     * Returns the vacation alias for this user. 
+     * i.e. if this user's username was roger@example.com, and the autoreply domain was set to
+     * autoreply.fish.net in config.inc.php we'd return roger#example.com@autoreply.fish.net
+     * @return string an email alias.
+     */
+    public function getVacationAlias() {
+        global $CONF;
+        $vacation_domain = $CONF['vacation_domain']; 
+        $vacation_goto = preg_replace('/@/', '#', $this->username); 
+        $vacation_goto = "{$vacation_goto}@{$vacation_domain}"; 
+        return $vacation_goto;
+    }
+}
diff --git a/users/edit-alias.php b/users/edit-alias.php
index 34305cb8..50a971b1 100644
--- a/users/edit-alias.php
+++ b/users/edit-alias.php
@@ -20,12 +20,12 @@
  * Template Variables:
  *
  * tMessage
- * tGoto
+ * tGotoArray
+ * tStoreAndForward
  *
  * Form POST \ GET Variables:
  *
  * fAddress
- * fDomain
  * fGoto
  */
 
@@ -40,20 +40,14 @@ $USERID_DOMAIN = $tmp[1];
 $vacation_domain = $CONF['vacation_domain'];
 $vacation_goto = preg_replace('/@/', '#', $USERID_USERNAME) . '@' . $vacation_domain;
 
+$ah = new AliasHandler($USERID_USERNAME);
+
 if ($_SERVER['REQUEST_METHOD'] == "GET")
 {
     $vacation_domain = $CONF['vacation_domain'];
 
-    $result = db_query ("SELECT * FROM $table_alias WHERE address='$USERID_USERNAME'");
-    if ($result['rows'] == 1)
-    {
-        $row = db_array ($result['result']);
-        $tGoto = $row['goto'];
-    }
-    else
-    {
-        $tMessage = $PALANG['pEdit_alias_address_error'];
-    }
+    $tGotoArray = $ah->get();
+    $tStoreAndForward = $ah->hasStoreAndForward();
 
     include ("../templates/header.php");
     include ("../templates/users_menu.php");
@@ -71,63 +65,42 @@ if ($_SERVER['REQUEST_METHOD'] == "POST")
 
     $pEdit_alias_goto = $PALANG['pEdit_alias_goto'];
 
-    if (isset ($_POST['fVacation'])) $fVacation = $_POST['fVacation'];   
-    if (isset ($_POST['fGoto'])) $fGoto = escape_string (trim($_POST['fGoto']));
-    if (isset ($_POST['fForward_and_store'])) $fForward_and_store = escape_string ($_POST['fForward_and_store']);
-
+    if (isset($_POST['fVacation'])) $fVacation = $_POST['fVacation'];   
+    if (isset($_POST['fGoto'])) $fGoto = escape_string (trim($_POST['fGoto']));
+    if (isset($_POST['fForward_and_store'])) $fForward_and_store = escape_string ($_POST['fForward_and_store']);
     $goto = strtolower ($fGoto);
     $goto = preg_replace ('/\\\r\\\n/', ',', $goto);
     $goto = preg_replace ('/\r\n/', ',', $goto);
     $goto = preg_replace ('/[\s]+/i', '', $goto);
     $goto = preg_replace ('/\,*$/', '', $goto);
-    ( $fForward_and_store == "YES" ) ? $goto = $USERID_USERNAME . "," . $goto : '';
+
     $goto = explode(",",$goto);
-    $goto = array_merge(array_unique($goto));
-    $goto = implode(",",$goto);
 
-    $array = preg_split ('/,/', $goto);
+    $goto = array_merge(array_unique($goto));
 
-    for ($i = 0; $i < sizeof ($array); $i++) {
-        if (in_array ("$array[$i]", $CONF['default_aliases'])) continue;
-        if (empty ($array[$i]) && $fForward_and_store == "NO")
-        {
-            $error = 1;
-            $tGoto = $goto;
-            $tMessage = $PALANG['pEdit_alias_goto_text_error1'];
+    $good_goto = array();
+    foreach($goto as $address) {
+        if(!check_email($address)) {
+            $error += 1;
+            $tMessage = $PALANG['pEdit_alias_goto_text_error1'] . "$address</font>";
         }
-        if (empty ($array[$i])) continue;
-        if (!check_email ($array[$i]))
-        {
-            $error = 1;
-            $tGoto = $goto;
-            $tMessage = $PALANG['pEdit_alias_goto_text_error2'] . "$array[$i]</font>";
+        else {
+            $good_goto[] = $address;
         }
     }
+    $goto = $good_goto;
 
-    if ($error != 1)
-    {
-        if (empty ($goto))
-        {
-            $goto = $USERID_USERNAME;
-        }
-
-        if ($fVacation == "YES")
-        {
-            $goto .= "," . $vacation_goto;
+    if ($error == 0) {
+        $flags = 'remote_only';
+        if($fForward_and_store == "YES" ) {
+            $flags = 'forward_and_store';
         }
-
-        $result = db_query ("UPDATE $table_alias SET goto='$goto',modified=NOW() WHERE address='$USERID_USERNAME'");
-        if ($result['rows'] != 1)
-        {
-            $tMessage = $PALANG['pEdit_alias_result_error'];
-        }
-        else
-        {
-            db_log ($USERID_USERNAME, $USERID_DOMAIN, 'edit_alias', "$USERID_USERNAME -> $goto");
-
+        $updated = $ah->update($goto, $flags);
+        if($updated) {
             header ("Location: main.php");
             exit;
         }
+        $tMessage = $PALANG['pEdit_alias_result_error'];
     }
 
     include ("../templates/header.php");
diff --git a/users/login.php b/users/login.php
index 7325540e..cfa63d4f 100644
--- a/users/login.php
+++ b/users/login.php
@@ -40,8 +40,7 @@ if ($_SERVER['REQUEST_METHOD'] == "GET")
 
 if ($_SERVER['REQUEST_METHOD'] == "POST")
 {
-   $fUsername = escape_string ($_POST['fUsername']);
-   $fPassword = escape_string ($_POST['fPassword']);
+
    $lang = safepost('lang');
 
    if ( $lang != check_language(0) ) { # only set cookie if language selection was changed
@@ -49,33 +48,10 @@ if ($_SERVER['REQUEST_METHOD'] == "POST")
       # (language preference cookie is processed even if username and/or password are invalid)
    }
 
-   $active = db_get_boolean(True);
-   $query = "SELECT password FROM $table_mailbox WHERE username='$fUsername' AND active=$active";
-
-   $result = db_query ($query);
-   if ($result['rows'] == 1)
-   {
-      $row = db_array ($result['result']);
-      $password = pacrypt ($fPassword, $row['password']);
-
-      $query = "SELECT * FROM $table_mailbox WHERE username='$fUsername' AND password='$password' AND active=$active";
-
-      $result = db_query ($query);
-      if ($result['rows'] != 1)
-      {
-         $error = 1;
-         $tMessage = '<span class="error_msg">' . $PALANG['pLogin_failed'] . '</span>';
-         $tUsername = $fUsername;
-      }
-   }
-   else
-   {
-      $error = 1;
-      $tMessage = '<span class="error_msg">' . $PALANG['pLogin_failed'] . '</span>';
-   }
+   $fUsername = escape_string ($_POST['fUsername']);
+   $fPassword = escape_string ($_POST['fPassword']);
 
-   if ($error != 1)
-   {
+   if(UserHandler::login($_POST['fUsername'], $_POST['fPassword'])) {
       session_regenerate_id();
       $_SESSION['sessid'] = array();
       $_SESSION['sessid']['roles'] = array();
@@ -84,6 +60,11 @@ if ($_SERVER['REQUEST_METHOD'] == "POST")
       header("Location: main.php");
       exit;
    }
+   else {   
+         $error = 1;
+         $tMessage = '<span class="error_msg">' . $PALANG['pLogin_failed'] . '</span>';
+         $tUsername = $fUsername;
+   }
 
    include ("../templates/header.php");
    include ("../templates/users_login.php");
diff --git a/users/main.php b/users/main.php
index 01b99e9a..561a8e6c 100644
--- a/users/main.php
+++ b/users/main.php
@@ -27,11 +27,8 @@ require_once('../common.php');
 authentication_require_role('user');
 $USERID_USERNAME = authentication_get_username();
 
-$db_active = db_get_boolean(True);
-$result = db_query("SELECT * FROM $table_vacation WHERE email='$USERID_USERNAME' AND active='$db_active'");
-if ($result['rows'] == 1)
-{
-   $row = db_array($result['result']);
+$vh = new VacationHandler($USERID_USERNAME);
+if($vh->check_vacation()) {
    $tummVacationtext = $PALANG['pUsersMain_vacationSet'];
 }
 else
@@ -39,21 +36,10 @@ else
    $tummVacationtext = $PALANG['pUsersMain_vacation'];
 }
 
-if ($_SERVER["REQUEST_METHOD"] == "GET")
-{
-   include ("../templates/header.php");
-   include ("../templates/users_menu.php");
-   include ("../templates/users_main.php");
-   include ("../templates/footer.php");
-}
-
-if ($_SERVER["REQUEST_METHOD"] == "POST")
-{
-   include ("../templates/header.php");
-   include ("../templates/users_menu.php");
-   include ("../templates/users_main.php");
-   include ("../templates/footer.php");
-}
+include ("../templates/header.php");
+include ("../templates/users_menu.php");
+include ("../templates/users_main.php");
+include ("../templates/footer.php");
 
 /* vim: set expandtab softtabstop=3 tabstop=3 shiftwidth=3: */
 ?>
diff --git a/users/password.php b/users/password.php
index febef327..5f908645 100644
--- a/users/password.php
+++ b/users/password.php
@@ -32,9 +32,6 @@ require_once('../common.php');
 authentication_require_role('user');
 $USERID_USERNAME = authentication_get_username();
 
-$tmp = preg_split ('/@/', $USERID_USERNAME);
-$USERID_DOMAIN = $tmp[1];
-
 if ($_SERVER['REQUEST_METHOD'] == "POST")
 {
     if(isset($_POST['fCancel'])) {
@@ -52,25 +49,11 @@ if ($_SERVER['REQUEST_METHOD'] == "POST")
     }
     $username = $USERID_USERNAME;
 
-    $result = db_query ("SELECT * FROM $table_mailbox WHERE username='$username'");
-    if ($result['rows'] == 1)
-    {
-        $row = db_array ($result['result']);
-        $checked_password = pacrypt($fPassword_current, $row['password']);
-
-        $result = db_query ("SELECT * FROM $table_mailbox WHERE username='$username' AND password='$checked_password'");
-        if ($result['rows'] != 1)
-        {
-            $error = 1;
-            $pPassword_password_current_text = $PALANG['pPassword_password_current_text_error'];
-        }
+    $uh = new UserHandler();
+    if(!$uh->login($username, $fPassword_current)) {
+        $error += 1;
+        $pPassword_password_current_text = $PALANG['pPassword_password_current_text_error'];
     }
-    else
-    {
-        $error = 1;
-        $pPassword_email_text = $PALANG['pPassword_email_text_error']; 
-    }
-
     if (empty ($fPassword) or ($fPassword != $fPassword2))
     {
         $error = 1;
@@ -79,12 +62,8 @@ if ($_SERVER['REQUEST_METHOD'] == "POST")
 
     if ($error != 1)
     {
-        $password = pacrypt ($fPassword);
-        $result = db_query ("UPDATE $table_mailbox SET password='$password',modified=NOW() WHERE username='$username'");
-        if ($result['rows'] == 1)
-        {
+        if($uh->change_pass($username, $fPassword_current, $fPassword)) {
             flash_info($PALANG['pPassword_result_success']);
-            db_log ($USERID_USERNAME, $USERID_DOMAIN, 'edit_password', "$USERID_USERNAME");
             header("Location: main.php");
             exit(0);
         }
diff --git a/users/vacation.php b/users/vacation.php
index 478d384d..3dbf3789 100644
--- a/users/vacation.php
+++ b/users/vacation.php
@@ -42,18 +42,19 @@ if($CONF['vacation'] == 'NO') {
     exit(0);
 }
 
-$tmp = preg_split ('/@/', $USERID_USERNAME);
-$USERID_DOMAIN = $tmp[1];
+$vh = new VacationHandler(authentication_get_username());
 
 if ($_SERVER['REQUEST_METHOD'] == "GET")
 {
-    $result = db_query("SELECT * FROM $table_vacation WHERE email='$USERID_USERNAME'");
-    if ($result['rows'] == 1)
-    {
-        $row = db_array($result['result']);
-        if ($row['active'] == db_get_boolean(True)) $tMessage = $PALANG['pUsersVacation_welcome_text'];
-        $tSubject = $row['subject'];
-        $tBody = $row['body'];
+    $tSubject = '';
+    $tBody = '';
+
+    if($vh->get_details()) {
+        $tSubject = $details['subject'];
+        $tBody = $details['body'];
+    }
+    if($vh->check_vacation()) {
+        $tMessage = $PALANG['pUsersVacation_welcome_text'];
     }
 
     if ($tSubject == '') { $tSubject = html_entity_decode($PALANG['pUsersVacation_subject_text'], ENT_QUOTES, 'UTF-8'); }
@@ -67,11 +68,6 @@ if ($_SERVER['REQUEST_METHOD'] == "POST")
         exit(0);
     }
 
-    // We store goto addresses in the form of roger#example.com@autoreply.example.com
-    $vacation_domain = $CONF['vacation_domain'];
-    $vacation_goto = preg_replace('/@/', '#', $USERID_USERNAME);
-    $vacation_goto = "{$vacation_goto}@{$vacation_domain}";
-
     if (isset ($_POST['fSubject'])) $fSubject = escape_string ($_POST['fSubject']);
     if (isset ($_POST['fBody'])) $fBody = escape_string ($_POST['fBody']);
     if (isset ($_POST['fAway'])) $fAway = escape_string ($_POST['fAway']);
@@ -82,104 +78,25 @@ if ($_SERVER['REQUEST_METHOD'] == "POST")
     if ($tBody == '') { $tBody = html_entity_decode($PALANG['pUsersVacation_body_text'], ENT_QUOTES, 'UTF-8'); }
 
     // if they've set themselves away OR back, delete any record of vacation emails.
-    if (!empty ($fBack) || !empty ($fAway))
-    {
-        $notActive = db_get_boolean(False);
-        // this isn't very good, as $result['rows'] would be 0 if the user had not used vacation stuff before.
-        $result = db_query("UPDATE $table_vacation SET active = $notActive WHERE email='$USERID_USERNAME'");
-        $result = db_query("DELETE FROM $table_vacation_notification WHERE on_vacation='$USERID_USERNAME'");
-        $tMessage = $PALANG['pUsersVacation_result_error'];
-
-        // We need to see whether there is already an alias record for the user, or not. 
-        // If not, we create one, else update the existing one.
-        $result = db_query ("SELECT * FROM $table_alias WHERE address='$USERID_USERNAME'");
-        if ($result['rows'] == 1)
-        {
-            $row = db_array ($result['result']);
-            $tGoto = $row['goto'];
-
-            //only one of these will do something, first handles address at beginning and middle, second at end, third if it's the only alias record.
-            $goto= preg_replace ( "/$vacation_goto,/", '', $tGoto);
-            $goto= preg_replace ( "/,$vacation_goto/", '', $goto);
-            $goto= preg_replace ( "/$vacation_goto/", '', $goto);
-            $query = "UPDATE $table_alias SET goto='$goto',modified=NOW() WHERE address='$USERID_USERNAME'";
-
-            if($goto == '') {
-                // if there are no other goto records left, remove the alias record for this user.
-                $query = "DELETE FROM $table_alias WHERE address = '$USERID_USERNAME'";
-            }
-            $result = db_query($query);
-        }
-        else {
-            $goto = $vacation_goto;
-            $boolean = db_get_boolean(True);
-
-            $result = db_query("INSERT into $table_alias (address, goto, domain, created, active) 
-                                VALUES ('$USERID_USERNAME', '', '$USERID_DOMAIN', NOW(), $boolean)");
-        }
-        if ($result['rows'] != 1)
-        {
-            $error = 1;
-            $tMessage = $PALANG['pUsersVacation_result_error'];
-        }
-        else
-        {
-            $tMessage = $PALANG['pUsersVacation_result_success'];
-        }
-
-    }
 
     // the user is going away - set the goto alias and vacation table as necessary.
     if (!empty ($fAway))
     {
-        // Can we ever have no alias records for a user?
-        $result = db_query ("SELECT * FROM $table_alias WHERE address='$USERID_USERNAME'");
-        if ($result['rows'] == 1)
-        {
-            $row = db_array ($result['result']);
-            $tGoto = $row['goto'];
-        }
-        $Active = db_get_boolean(True);
-        $result = db_query("SELECT * FROM $table_vacation WHERE email = '$USERID_USERNAME'");
-        if($result['rows'] == 1) {
-            $result = db_query("UPDATE $table_vacation SET active = $Active, body = '$fBody', subject = '$fSubject', created = NOW() WHERE email = '$USERID_USERNAME'");
-        }
-        else {
-            $result = db_query ("INSERT INTO $table_vacation (email,subject,body,domain,created,active) VALUES ('$USERID_USERNAME','$fSubject','$fBody','$USERID_DOMAIN',NOW(),$Active)");
-        }
-
-        if ($result['rows'] != 1)
-        {
+        if(!$vh->set_away($fSubject, $fBody)) {
             $error = 1;
             $tMessage = $PALANG['pUsersVacation_result_error'];
         }
-        // add the goto record back in...
-        $comma = '';
-        if(strlen($tGoto) > 1) {
-            $comma = ',';
-        }
-        $goto = $tGoto . $comma . $vacation_goto;
-
-        $result = db_query ("UPDATE $table_alias SET goto='$goto',modified=NOW() WHERE address='$USERID_USERNAME'");
-        if ($result['rows'] != 1)
-        {
-            $error = 1;
-            $tMessage = $PALANG['pUsersVacation_result_error'];
-        }
-        else
-        {
-            flash_info($PALANG['pVacation_result_added']);
-            header ("Location: main.php");
-            exit;
-        }
+        flash_info($PALANG['pVacation_result_added']);
+        header ("Location: main.php");
+        exit;
     }
 
     if (!empty ($fBack)) {
-        if ($tMessage == '' || $tMessage = $PALANG['pUsersVacation_result_success']) {
-            flash_info($PALANG['pVacation_result_removed']);
-            header ("Location: main.php");
-            exit;
-        }
+        $vh->remove();
+        $tMessage = $PALANG['pUsersVacation_result_success'];
+        flash_info($tMessage);
+        header ("Location: main.php");
+        exit;
     }
 }