dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Login (Default): Password Reset functionality (requires PHP mcrypt library, Enhanced & Minimized themes only, enable in Default Settings).

Browse Source
This commit is contained in:
Nate Jones
2014-12-06 17:53:29 +00:00
parent 241542bd9d
commit 0147c9bf2f
6 changed files with 457 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resources/login.php
+170 -18
View File
@@ -30,6 +30,113 @@
$text[$key] = $value[$_SESSION['domain']['language']['code']];
}
//get action, if any
if (isset($_REQUEST['action'])) {
$action = check_str($_REQUEST['action']);
}
//retrieve parse reset key
if ($action == 'define') {
$key = $_GET['key'];
$key_part = explode('|', decrypt($_SESSION['login']['password_reset_key']['text'], $key));
$username = $key_part[0];
$domain_uuid = $key_part[1];
$password_submitted = $key_part[2];
//get current salt, see if same as submitted salt
$sql = "select password from v_users where domain_uuid = '".$domain_uuid."' and username = '".$username."'";
$prep_statement = $db->prepare(check_sql($sql));
$prep_statement->execute();
$result = $prep_statement->fetch(PDO::FETCH_NAMED);
$password_current = $result['password'];
unset($prep_statement, $result);
//set flag
$password_reset = ($username != '' && $domain_uuid == $_SESSION['domain_uuid'] && $password_submitted == $password_current) ? true : false;
}
//send password reset link
if ($action == 'request') {
if (valid_email($_REQUEST['email'])) {
$_SESSION["message_delay"] = 2500;
$email = check_str($_REQUEST['email']);
//see if email exists
$sql = "select ";
$sql .= "u.username, ";
$sql .= "u.password ";
$sql .= "from ";
$sql .= "v_users as u, ";
$sql .= "v_contact_emails e ";
$sql .= "where ";
$sql .= "e.domain_uuid = u.domain_uuid ";
$sql .= "and e.contact_uuid = u.contact_uuid ";
$sql .= "and e.email_address = '".$email."' ";
$sql .= "and e.domain_uuid = '".$_SESSION['domain_uuid']."' ";
$prep_statement = $db->prepare(check_sql($sql));
$prep_statement->execute();
$result = $prep_statement->fetch(PDO::FETCH_NAMED);
unset($prep_statement);
if ($result['username'] != '') {
//generate reset link
$key = encrypt($_SESSION['login']['password_reset_key']['text'], $result['username'].'|'.$_SESSION['domain_uuid'].'|'.$result['password']);
$reset_link = "https://".$_SESSION['domain_name'].PROJECT_PATH."/login.php?action=define&key=".urlencode($key);
$eml_body = "<a href='".$reset_link."'>".$reset_link."</a>";
//send reset link
if (!send_email($email, $text['label-reset_link'], $eml_body)) {
$_SESSION["message_mood"] = 'negative';
$_SESSION["message"] = $eml_error;
}
else {
$_SESSION["message"] = $text['message-reset_link_sent'];
}
}
else {
//not found
$_SESSION["message_mood"] = 'negative';
$_SESSION["message"] = $text['message-invalid_email'];
}
}
else {
//not found
$_SESSION["message_mood"] = 'negative';
$_SESSION["message"] = $text['message-invalid_email'];
}
}
//reset password
if ($action == 'reset') {
$authorized_username = check_str($_REQUEST['au']);
$username = check_str($_REQUEST['username']);
$password_new = check_str($_REQUEST['password_new']);
$password_repeat = check_str($_REQUEST['password_repeat']);
if ($username != '' &&
$authorized_username == md5($_SESSION['login']['password_reset_key']['text'].$username) &&
$password_new != '' &&
$password_repeat != '' &&
$password_new == $password_repeat
) {
$salt = generate_password('20', '4');
$sql = "update v_users set ";
$sql .= "password = '".md5($salt.$password_new)."', ";
$sql .= "salt = '".$salt."' ";
$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
$sql .= "and username = '".$username."' ";
$db->exec(check_sql($sql));
$_SESSION["message"] = $text['message-password_reset'];
$password_reset = false;
}
else {
//not found
$_SESSION["message_mood"] = 'negative';
$_SESSION["message"] = $text['message-invalid_username_mismatch_passwords'];
$password_reset = true;
}
}
//get the http values and set as variables
$path = check_str($_GET["path"]);
$msg = check_str($_GET["msg"]);
@@ -85,29 +192,74 @@
}
//show the content
echo "<script>";
echo " var speed = 350;";
echo " function toggle_password_reset(hide_id, show_id, focus_id) {";
echo " $('#'+hide_id).slideToggle(speed, function() {;";
echo " $('#'+show_id).slideToggle(speed, function() {;";
echo " $('#'+focus_id).focus();";
echo " });";
echo " });";
echo " }";
echo "</script>";
echo "<br />\n";
echo "<form name='login' method='post' action='".$_SESSION['login']['destination']['url']."'>\n";
echo "<input type='hidden' name='path' value='".$path."'>\n";
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='username' id='username' placeholder=\"".$text['label-username']."\"><br />\n";
echo "<input type='password' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='password' placeholder=\"".$text['label-password']."\"><br />\n";
if ($_SESSION['login']['domain_name.visible']['boolean'] == "true") {
if (count($_SESSION['login']['domain_name']) > 0) {
echo "<select style='width: 200px; margin-bottom: 8px;' class='formfld' name='domain_name'>\n";
echo " <option value=''></option>\n";
foreach ($_SESSION['login']['domain_name'] as &$row) {
echo " <option value='$row'>$row</option>\n";
if (!$password_reset) {
echo "<span id='login_form'>\n";
echo "<form name='login' method='post' action='".$_SESSION['login']['destination']['url']."'>\n";
echo "<input type='hidden' name='path' value='".$path."'>\n";
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='username' id='username' placeholder=\"".$text['label-username']."\"><br />\n";
echo "<input type='password' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='password' placeholder=\"".$text['label-password']."\"><br />\n";
if ($_SESSION['login']['domain_name.visible']['boolean'] == "true") {
if (count($_SESSION['login']['domain_name']) > 0) {
echo "<select style='width: 200px; margin-bottom: 8px;' class='formfld' name='domain_name'>\n";
echo " <option value=''></option>\n";
foreach ($_SESSION['login']['domain_name'] as &$row) {
echo " <option value='$row'>$row</option>\n";
}
echo "</select>\n";
echo "<br />";
}
else {
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='domain_name' placeholder=\"".$text['label-domain']."\"><br />\n";
}
echo "</select>\n";
echo "<br />";
}
else {
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='domain_name' placeholder=\"".$text['label-domain']."\"><br />\n";
echo "<input type='submit' class='btn' style='width: 100px; margin-top: 15px;' value='".$text['button-login']."'>\n";
if ($_SESSION['login']['password_reset_key']['text'] != '' && function_exists('mcrypt_encrypt')) {
echo "<br><br><a class='login_box_link' onclick=\"toggle_password_reset('login_form','request_form','email');\">".$text['label-reset_password']."</a>";
}
echo "</form>";
echo "<script>document.getElementById('username').focus();</script>";
echo "</span>";
echo "<span id='request_form' style='display: none;'>\n";
echo "<form name='request' method='post' action=''>\n";
echo "<input type='hidden' name='action' value='request'>\n";
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='email' id='email' placeholder=\"".$text['label-email_address']."\"><br />\n";
echo "<input type='submit' class='btn' style='width: 100px; margin-top: 15px;' value='".$text['button-reset']."'>\n";
echo "<br><br><a class='login_box_link' onclick=\"toggle_password_reset('request_form','login_form','username');\">".$text['label-cancel']."</a>";
echo "</form>";
echo "</span>";
}
else {
echo "<span id='reset_form'>\n";
echo "<form name='reset' method='post' action=''>\n";
echo "<input type='hidden' name='action' value='reset'>\n";
echo "<input type='hidden' name='au' value='".md5($_SESSION['login']['password_reset_key']['text'].$username)."'>\n";
echo "<input type='text' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='username' id='username' placeholder=\"".$text['label-username']."\"><br />\n";
echo "<input type='password' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='password_new' autocomplete='off' placeholder=\"".$text['label-new_password']."\"><br />\n";
echo "<input type='password' class='formfld' style='text-align: center; min-width: 200px; width: 200px; margin-bottom: 8px;' name='password_repeat' autocomplete='off' placeholder=\"".$text['label-repeat_password']."\"><br />\n";
echo "<input type='submit' class='btn' style='width: 100px; margin-top: 15px;' value='".$text['button-save']."'>\n";
echo "<br><br><a class='login_box_link' onclick=\"document.location.href='login.php';\">".$text['label-cancel']."</a>";
echo "</form>";
echo "<script>document.getElementById('username').focus();</script>";
echo "</span>";
}
echo "<br />";
echo "<input type='submit' class='btn' style='width: 100px; margin-top: 15px;' value='".$text['button-login']."'>\n";
echo "</form>";
echo "<script>document.getElementById('username').focus();</script>";
//add the footer
$default_login = true;