Login (Default): Password Reset functionality (requires PHP mcrypt library, Enhanced & Minimized themes only, enable in Default Settings).
This commit is contained in:
Nate Jones
@@ -1080,4 +1080,158 @@ function number_pad($number,$n) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//function to send email
|
||||
if (!function_exists('send_email')) {
|
||||
function send_email($eml_recipients, $eml_subject, $eml_body, &$eml_error = '', $eml_from_address = '', $eml_from_name = '', $eml_priority = 3) {
|
||||
/*
|
||||
RECIPIENTS NOTE:
|
||||
|
||||
Pass in a single email address...
|
||||
|
||||
user@domain.com
|
||||
|
||||
Pass in a comma or semi-colon delimited string of e-mail addresses...
|
||||
|
||||
user@domain.com,user2@domain2.com,user3@domain3.com
|
||||
user@domain.com;user2@domain2.com;user3@domain3.com
|
||||
|
||||
Pass in a simple array of email addresses...
|
||||
|
||||
Array (
|
||||
[0] => user@domain.com
|
||||
[1] => user2@domain2.com
|
||||
[2] => user3@domain3.com
|
||||
)
|
||||
|
||||
Pass in a multi-dimentional array of addresses (delivery, address, name)...
|
||||
|
||||
Array (
|
||||
[0] => Array (
|
||||
[delivery] => to
|
||||
[address] => user@domain.com
|
||||
[name] => user 1
|
||||
)
|
||||
[1] => Array (
|
||||
[delivery] => cc
|
||||
[address] => user2@domain2.com
|
||||
[name] => user 2
|
||||
)
|
||||
[2] => Array (
|
||||
[delivery] => bcc
|
||||
[address] => user3@domain3.com
|
||||
[name] => user 3
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
ERROR RESPONSE:
|
||||
|
||||
Error messages are stored in the variable passed into $eml_error BY REFERENCE
|
||||
|
||||
*/
|
||||
|
||||
include_once("resources/phpmailer/class.phpmailer.php");
|
||||
include_once("resources/phpmailer/class.smtp.php");
|
||||
|
||||
$regexp = '/^[A-z0-9][\w.-]*@[A-z0-9][\w\-\.]+\.[A-z0-9]{2,6}$/';
|
||||
|
||||
$mail = new PHPMailer();
|
||||
$mail -> IsSMTP();
|
||||
$mail -> Host = $_SESSION['email']['smtp_host']['var'];
|
||||
if ($_SESSION['email']['smtp_port']['var'] != '') {
|
||||
$mail -> Port = $_SESSION['email']['smtp_port']['var'];
|
||||
}
|
||||
if ($_SESSION['email']['smtp_auth']['var'] == "true") {
|
||||
$mail -> SMTPAuth = $_SESSION['email']['smtp_auth']['var'];
|
||||
}
|
||||
if ($_SESSION['email']['smtp_username']['var']) {
|
||||
$mail -> Username = $_SESSION['email']['smtp_username']['var'];
|
||||
$mail -> Password = $_SESSION['email']['smtp_password']['var'];
|
||||
}
|
||||
if ($_SESSION['email']['smtp_secure']['var'] == "none") {
|
||||
$_SESSION['email']['smtp_secure']['var'] = '';
|
||||
}
|
||||
if ($_SESSION['email']['smtp_secure']['var'] != '') {
|
||||
$mail -> SMTPSecure = $_SESSION['email']['smtp_secure']['var'];
|
||||
}
|
||||
$eml_from_address = ($eml_from_address != '') ? $eml_from_address : $_SESSION['email']['smtp_from']['var'];
|
||||
$eml_from_name = ($eml_from_name != '') ? $eml_from_name : $_SESSION['email']['smtp_from_name']['var'];
|
||||
$mail -> SetFrom($eml_from_address, $eml_from_name);
|
||||
$mail -> AddReplyTo($eml_from_address, $eml_from_name);
|
||||
$mail -> Subject = $eml_subject;
|
||||
$mail -> MsgHTML($eml_body);
|
||||
$mail -> Priority = $eml_priority;
|
||||
|
||||
$address_found = false;
|
||||
|
||||
if (!is_array($eml_recipients)) { // must be a single or delimited recipient address(s)
|
||||
$eml_recipients = str_replace(' ', '', $eml_recipients);
|
||||
if (substr_count(',', $eml_recipients)) { $delim = ','; }
|
||||
if (substr_count(';', $eml_recipients)) { $delim = ';'; }
|
||||
if ($delim) { $eml_recipients = explode($delim, $eml_recipients); } // delimiter found, convert to array of addresses
|
||||
}
|
||||
|
||||
if (is_array($eml_recipients)) { // check if multiple recipients
|
||||
foreach ($eml_recipients as $eml_recipient) {
|
||||
if (is_array($eml_recipient)) { // check if each recipient has multiple fields
|
||||
if ($eml_recipient["address"] != '' && preg_match($regexp, $eml_recipient["address"]) == 1) { // check if valid address
|
||||
switch ($eml_recipient["delivery"]) {
|
||||
case "cc" : $mail -> AddCC($eml_recipient["address"], ($eml_recipient["name"]) ? $eml_recipient["name"] : $eml_recipient["address"]); break;
|
||||
case "bcc" : $mail -> AddBCC($eml_recipient["address"], ($eml_recipient["name"]) ? $eml_recipient["name"] : $eml_recipient["address"]); break;
|
||||
default : $mail -> AddAddress($eml_recipient["address"], ($eml_recipient["name"]) ? $eml_recipient["name"] : $eml_recipient["address"]);
|
||||
}
|
||||
$address_found = true;
|
||||
}
|
||||
}
|
||||
else if ($eml_recipient != '' && preg_match($regexp, $eml_recipient) == 1) { // check if recipient value is simply (only) an address
|
||||
$mail -> AddAddress($eml_recipient);
|
||||
$address_found = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (!$address_found) {
|
||||
$eml_error = "No valid e-mail address provided.";
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
else { // just a single e-mail address found, not an array of addresses
|
||||
if ($eml_recipients != '' && preg_match($regexp, $eml_recipients) == 1) { // check if email syntax is valid
|
||||
$mail -> AddAddress($eml_recipients);
|
||||
}
|
||||
else {
|
||||
$eml_error = "No valid e-mail address provided.";
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
if (!$mail -> Send()) {
|
||||
$eml_error = $mail -> ErrorInfo;
|
||||
return false;
|
||||
}
|
||||
else {
|
||||
return true;
|
||||
}
|
||||
|
||||
$mail -> ClearAddresses();
|
||||
$mail -> SmtpClose();
|
||||
|
||||
unset($mail);
|
||||
}
|
||||
}
|
||||
|
||||
//encrypt a string
|
||||
if (!function_exists('encrypt')) {
|
||||
function encrypt($key, $str_to_enc) {
|
||||
return base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($key), $str_to_enc, MCRYPT_MODE_CBC, md5(md5($key))));
|
||||
}
|
||||
}
|
||||
|
||||
//decrypt a string
|
||||
if (!function_exists('decrypt')) {
|
||||
function decrypt($key, $str_to_dec) {
|
||||
return rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($key), base64_decode($str_to_dec), MCRYPT_MODE_CBC, md5(md5($key))), "\0");
|
||||
}
|
||||
}
|
||||
?>
|
||||
|
||||
+170
-18
@@ -30,6 +30,113 @@
|
||||
$text[$key] = $value[$_SESSION['domain']['language']['code']];
|
||||
}
|
||||
|
||||
//get action, if any
|
||||
if (isset($_REQUEST['action'])) {
|
||||
$action = check_str($_REQUEST['action']);
|
||||
}
|
||||
|
||||
//retrieve parse reset key
|
||||
if ($action == 'define') {
|
||||
$key = $_GET['key'];
|
||||
$key_part = explode('|', decrypt($_SESSION['login']['password_reset_key']['text'], $key));
|
||||
$username = $key_part[0];
|
||||
$domain_uuid = $key_part[1];
|
||||
$password_submitted = $key_part[2];
|
||||
//get current salt, see if same as submitted salt
|
||||
$sql = "select password from v_users where domain_uuid = '".$domain_uuid."' and username = '".$username."'";
|
||||
$prep_statement = $db->prepare(check_sql($sql));
|
||||
$prep_statement->execute();
|
||||
$result = $prep_statement->fetch(PDO::FETCH_NAMED);
|
||||
$password_current = $result['password'];
|
||||
unset($prep_statement, $result);
|
||||
|
||||
//set flag
|
||||
$password_reset = ($username != '' && $domain_uuid == $_SESSION['domain_uuid'] && $password_submitted == $password_current) ? true : false;
|
||||
}
|
||||
|
||||
//send password reset link
|
||||
if ($action == 'request') {
|
||||
if (valid_email($_REQUEST['email'])) {
|
||||
$_SESSION["message_delay"] = 2500;
|
||||
|
||||
$email = check_str($_REQUEST['email']);
|
||||
//see if email exists
|
||||
$sql = "select ";
|
||||
$sql .= "u.username, ";
|
||||
$sql .= "u.password ";
|
||||
$sql .= "from ";
|
||||
$sql .= "v_users as u, ";
|
||||
$sql .= "v_contact_emails e ";
|
||||
$sql .= "where ";
|
||||
$sql .= "e.domain_uuid = u.domain_uuid ";
|
||||
$sql .= "and e.contact_uuid = u.contact_uuid ";
|
||||
$sql .= "and e.email_address = '".$email."' ";
|
||||
$sql .= "and e.domain_uuid = '".$_SESSION['domain_uuid']."' ";
|
||||
$prep_statement = $db->prepare(check_sql($sql));
|
||||
$prep_statement->execute();
|
||||
$result = $prep_statement->fetch(PDO::FETCH_NAMED);
|
||||
unset($prep_statement);
|
||||
|
||||
if ($result['username'] != '') {
|
||||
//generate reset link
|
||||
$key = encrypt($_SESSION['login']['password_reset_key']['text'], $result['username'].'|'.$_SESSION['domain_uuid'].'|'.$result['password']);
|
||||
$reset_link = "https://".$_SESSION['domain_name'].PROJECT_PATH."/login.php?action=define&key=".urlencode($key);
|
||||
$eml_body = "<a href='".$reset_link."'>".$reset_link."</a>";
|
||||
//send reset link
|
||||
if (!send_email($email, $text['label-reset_link'], $eml_body)) {
|
||||
$_SESSION["message_mood"] = 'negative';
|
||||
$_SESSION["message"] = $eml_error;
|
||||
}
|
||||
else {
|
||||
$_SESSION["message"] = $text['message-reset_link_sent'];
|
||||
}
|
||||
}
|
||||
else {
|
||||
//not found
|
||||
$_SESSION["message_mood"] = 'negative';
|
||||
$_SESSION["message"] = $text['message-invalid_email'];
|
||||
}
|
||||
|
||||
}
|
||||
else {
|
||||
//not found
|
||||
$_SESSION["message_mood"] = 'negative';
|
||||
$_SESSION["message"] = $text['message-invalid_email'];
|
||||
}
|
||||
}
|
||||
|
||||
//reset password
|
||||
if ($action == 'reset') {
|
||||
$authorized_username = check_str($_REQUEST['au']);
|
||||
$username = check_str($_REQUEST['username']);
|
||||
$password_new = check_str($_REQUEST['password_new']);
|
||||
$password_repeat = check_str($_REQUEST['password_repeat']);
|
||||
|
||||
if ($username != '' &&
|
||||
$authorized_username == md5($_SESSION['login']['password_reset_key']['text'].$username) &&
|
||||
$password_new != '' &&
|
||||
$password_repeat != '' &&
|
||||
$password_new == $password_repeat
|
||||
) {
|
||||
$salt = generate_password('20', '4');
|
||||
$sql = "update v_users set ";
|
||||
$sql .= "password = '".md5($salt.$password_new)."', ";
|
||||
$sql .= "salt = '".$salt."' ";
|
||||
$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
|
||||
$sql .= "and username = '".$username."' ";
|
||||
$db->exec(check_sql($sql));
|
||||
|
||||
$_SESSION["message"] = $text['message-password_reset'];
|
||||
$password_reset = false;
|
||||
}
|
||||
else {
|
||||
//not found
|
||||
$_SESSION["message_mood"] = 'negative';
|
||||
$_SESSION["message"] = $text['message-invalid_username_mismatch_passwords'];
|
||||
$password_reset = true;
|
||||
}
|
||||
}
|
||||
|
||||
//get the http values and set as variables
|
||||
$path = check_str($_GET["path"]);
|
||||
$msg = check_str($_GET["msg"]);
|
||||
@@ -85,29 +192,74 @@
|
||||
}
|
||||
|
||||
//show the content
|
||||
echo "<script>";
|
||||
echo " var speed = 350;";
|
||||
echo " function toggle_password_reset(hide_id, show_id, focus_id) {";
|
||||
echo " $('#'+hide_id).slideToggle(speed, function() {;";
|
||||
echo " $('#'+show_id).slideToggle(speed, function() {;";
|
||||
echo " $('#'+focus_id).focus();";
|
||||
echo " });";
|
||||
echo " });";
|
||||
echo " }";
|
||||
echo "</script>";
|
||||
|
||||
echo "<br />\n";
|
||||
echo "<form name='login' method='post' action='".$_SESSION['login']['destination']['url']."'>\n";
|
||||
echo "<input type='hidden' name='path' value='".$path."'>\n";
|
||||
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='username' id='username' placeholder=\"".$text['label-username']."\"><br />\n";
|
||||
echo "<input type='password' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='password' placeholder=\"".$text['label-password']."\"><br />\n";
|
||||
if ($_SESSION['login']['domain_name.visible']['boolean'] == "true") {
|
||||
if (count($_SESSION['login']['domain_name']) > 0) {
|
||||
echo "<select style='width: 200px; margin-bottom: 8px;' class='formfld' name='domain_name'>\n";
|
||||
echo " <option value=''></option>\n";
|
||||
foreach ($_SESSION['login']['domain_name'] as &$row) {
|
||||
echo " <option value='$row'>$row</option>\n";
|
||||
|
||||
if (!$password_reset) {
|
||||
|
||||
echo "<span id='login_form'>\n";
|
||||
echo "<form name='login' method='post' action='".$_SESSION['login']['destination']['url']."'>\n";
|
||||
echo "<input type='hidden' name='path' value='".$path."'>\n";
|
||||
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='username' id='username' placeholder=\"".$text['label-username']."\"><br />\n";
|
||||
echo "<input type='password' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='password' placeholder=\"".$text['label-password']."\"><br />\n";
|
||||
if ($_SESSION['login']['domain_name.visible']['boolean'] == "true") {
|
||||
if (count($_SESSION['login']['domain_name']) > 0) {
|
||||
echo "<select style='width: 200px; margin-bottom: 8px;' class='formfld' name='domain_name'>\n";
|
||||
echo " <option value=''></option>\n";
|
||||
foreach ($_SESSION['login']['domain_name'] as &$row) {
|
||||
echo " <option value='$row'>$row</option>\n";
|
||||
}
|
||||
echo "</select>\n";
|
||||
echo "<br />";
|
||||
}
|
||||
else {
|
||||
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='domain_name' placeholder=\"".$text['label-domain']."\"><br />\n";
|
||||
}
|
||||
echo "</select>\n";
|
||||
echo "<br />";
|
||||
}
|
||||
else {
|
||||
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='domain_name' placeholder=\"".$text['label-domain']."\"><br />\n";
|
||||
echo "<input type='submit' class='btn' style='width: 100px; margin-top: 15px;' value='".$text['button-login']."'>\n";
|
||||
if ($_SESSION['login']['password_reset_key']['text'] != '' && function_exists('mcrypt_encrypt')) {
|
||||
echo "<br><br><a class='login_box_link' onclick=\"toggle_password_reset('login_form','request_form','email');\">".$text['label-reset_password']."</a>";
|
||||
}
|
||||
echo "</form>";
|
||||
echo "<script>document.getElementById('username').focus();</script>";
|
||||
echo "</span>";
|
||||
|
||||
echo "<span id='request_form' style='display: none;'>\n";
|
||||
echo "<form name='request' method='post' action=''>\n";
|
||||
echo "<input type='hidden' name='action' value='request'>\n";
|
||||
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='email' id='email' placeholder=\"".$text['label-email_address']."\"><br />\n";
|
||||
echo "<input type='submit' class='btn' style='width: 100px; margin-top: 15px;' value='".$text['button-reset']."'>\n";
|
||||
echo "<br><br><a class='login_box_link' onclick=\"toggle_password_reset('request_form','login_form','username');\">".$text['label-cancel']."</a>";
|
||||
echo "</form>";
|
||||
echo "</span>";
|
||||
|
||||
}
|
||||
else {
|
||||
|
||||
echo "<span id='reset_form'>\n";
|
||||
echo "<form name='reset' method='post' action=''>\n";
|
||||
echo "<input type='hidden' name='action' value='reset'>\n";
|
||||
echo "<input type='hidden' name='au' value='".md5($_SESSION['login']['password_reset_key']['text'].$username)."'>\n";
|
||||
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='username' id='username' placeholder=\"".$text['label-username']."\"><br />\n";
|
||||
echo "<input type='password' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='password_new' autocomplete='off' placeholder=\"".$text['label-new_password']."\"><br />\n";
|
||||
echo "<input type='password' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='password_repeat' autocomplete='off' placeholder=\"".$text['label-repeat_password']."\"><br />\n";
|
||||
echo "<input type='submit' class='btn' style='width: 100px; margin-top: 15px;' value='".$text['button-save']."'>\n";
|
||||
echo "<br><br><a class='login_box_link' onclick=\"document.location.href='login.php';\">".$text['label-cancel']."</a>";
|
||||
echo "</form>";
|
||||
echo "<script>document.getElementById('username').focus();</script>";
|
||||
echo "</span>";
|
||||
|
||||
}
|
||||
echo "<br />";
|
||||
echo "<input type='submit' class='btn' style='width: 100px; margin-top: 15px;' value='".$text['button-login']."'>\n";
|
||||
echo "</form>";
|
||||
echo "<script>document.getElementById('username').focus();</script>";
|
||||
|
||||
//add the footer
|
||||
$default_login = true;
|
||||
|
||||
Reference in New Issue
Block a user