Store in GIT
This commit is contained in:
@@ -0,0 +1,49 @@
|
||||
<?php
|
||||
//Load required scripts
|
||||
require('../../../inc/connect.php');
|
||||
require('../../../inc/session.php');
|
||||
require('../../../inc/crypt.php');
|
||||
|
||||
//Get username and password
|
||||
$password_current = $_POST['password_current'];
|
||||
$password1 = $_POST['password1'];
|
||||
$password2 = $_POST['password2'];
|
||||
|
||||
$sql = "SELECT `password` FROM `user` WHERE `id`=$userid";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
if($query->num_rows < 1)
|
||||
{
|
||||
error("account", "An error occured");
|
||||
}
|
||||
|
||||
$result = $query->fetch_assoc();
|
||||
$password_hash = $result['password'];
|
||||
|
||||
if(!password_verify($password_current, $password_hash))
|
||||
{
|
||||
error("account", "Your current password is incorrect");
|
||||
}
|
||||
|
||||
if($password_current == $password1)
|
||||
{
|
||||
error("account", "Your current password does not differ from the new password");
|
||||
}
|
||||
|
||||
if($password1 != $password2)
|
||||
{
|
||||
error("account", "Your new passwords do not match");
|
||||
}
|
||||
|
||||
//Logout everywhere else
|
||||
$sql = "DELETE FROM `session` WHERE `user`=$userid AND `id`<>$sessionid";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
//Change password
|
||||
$password_hash = password_hash($password1, PASSWORD_BCRYPT);
|
||||
|
||||
$sql = "UPDATE `user` SET `password`='$password_hash' WHERE `id`=$userid";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
success("account", "Your password has been changed");
|
||||
?>
|
||||
@@ -0,0 +1,38 @@
|
||||
<?php
|
||||
//Load required scripts
|
||||
require('../../../inc/connect.php');
|
||||
require('../../../inc/crypt.php');
|
||||
|
||||
//Get username and password
|
||||
$email = $_POST['email'];
|
||||
|
||||
$sql = "SELECT `id`, `username` FROM `user` WHERE `email`='$email'";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
if($query->num_rows < 1)
|
||||
{
|
||||
error("login", "No account found with that email address");
|
||||
}
|
||||
|
||||
$result = $query->fetch_assoc();
|
||||
$username = $result['username'];
|
||||
$id = $result['id'];
|
||||
|
||||
$password = RandomString(8);
|
||||
$password_hash = password_hash($password, PASSWORD_BCRYPT);
|
||||
|
||||
$sql = "UPDATE `user` SET `password`='$password_hash' WHERE `id`=$id";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
//Logout everywhere else
|
||||
$sql = "DELETE FROM `session` WHERE `user`=$id";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
$msg = "Dear $username,\n\n";
|
||||
$msg .= "Your password has been reset.\nEvery active session has been logged out.\n";
|
||||
$msg .= "New password: <b>" . $password . "</b>";
|
||||
|
||||
sendMail($email, "Password reset", $msg);
|
||||
|
||||
success("login", "Your password has been reset, an email has been sent to " . $email);
|
||||
?>
|
||||
@@ -0,0 +1,67 @@
|
||||
<?php
|
||||
//Load required scripts
|
||||
require('../../../inc/connect.php');
|
||||
require('../../../inc/crypt.php');
|
||||
|
||||
//Get username and password
|
||||
$username = $_POST['username'];
|
||||
$password = $_POST['password'];
|
||||
$remember = isset($_POST['remember']) ? $_POST['remember'] : 0;
|
||||
|
||||
//Check if user exists
|
||||
$sql = "SELECT `id`, `password`, `verified` FROM `user` WHERE `username`='" . $username . "'";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
if($query->num_rows < 1){
|
||||
logout("Username or password incorrect");
|
||||
}
|
||||
else
|
||||
{
|
||||
//Check if password is correct
|
||||
$result = $query->fetch_assoc();
|
||||
$verified = $result['verified'];
|
||||
$password_hash = $result['password'];
|
||||
|
||||
if(!password_verify($password, $password_hash)){
|
||||
logout("Username or password incorrect");
|
||||
}
|
||||
else if($verified == 0)
|
||||
{
|
||||
logout('Your email has not yet been verified');
|
||||
}
|
||||
else
|
||||
{
|
||||
//Get user ID, IP
|
||||
$id = $result['id'];
|
||||
$ip = $_SERVER['REMOTE_ADDR'];
|
||||
|
||||
//Set default device
|
||||
$sql = "SELECT `id` FROM `device` WHERE `user`=$id LIMIT 0,1";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
if($query->num_rows < 1)
|
||||
{
|
||||
$deviceid = 0;
|
||||
}
|
||||
else
|
||||
{
|
||||
$result = $query->fetch_assoc();
|
||||
$deviceid = $result['id'];
|
||||
}
|
||||
|
||||
$sessionid = RandomString(60);
|
||||
|
||||
//Update Session ID, Last Login, IP in database
|
||||
$sql = "INSERT INTO session (`user`, `session`, `time`, `remember`, `ip`, `dev_id`, `dev_type`) VALUES ($id, '$sessionid', NOW(), $remember, '$ip', $deviceid, 'Browser')";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
//Set Session ID
|
||||
setSession($sessionid);
|
||||
|
||||
//Reroute user to dashboard
|
||||
success("devices", "You have succesfully logged in.");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
?>
|
||||
@@ -0,0 +1,18 @@
|
||||
<?php
|
||||
require('../../../inc/connect.php');
|
||||
|
||||
$error = isset($_GET['error']) ? $_GET['error'] : 'You have succesfully logged out';
|
||||
|
||||
if(isSession())
|
||||
{
|
||||
$sessionid = getSession();
|
||||
|
||||
$sql = "DELETE FROM session WHERE `session`='" . $sessionid . "'";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
destroySession();
|
||||
}
|
||||
|
||||
$link = ROOT . "login?error=" . $error;
|
||||
header("Location: $link");
|
||||
?>
|
||||
@@ -0,0 +1,27 @@
|
||||
<?php
|
||||
require('../../../inc/connect.php');
|
||||
require('../../../inc/session.php');
|
||||
|
||||
$id = $_POST['id'];
|
||||
|
||||
//Check if user owns session
|
||||
$sql = "SELECT `id` FROM `session` WHERE `user`=$userid AND `id`=$id";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
if($query->num_rows < 1)
|
||||
{
|
||||
error("account", "You cannot manage that session");
|
||||
}
|
||||
|
||||
//Check if it is not a remembered session
|
||||
if($remember == 1)
|
||||
{
|
||||
error("account", "You cannot manage your sessions from a remembered login");
|
||||
}
|
||||
|
||||
//Delete session
|
||||
$sql = "DELETE FROM `session` WHERE `id`=$id";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
success("account", "The session has been logged out");
|
||||
?>
|
||||
@@ -0,0 +1,69 @@
|
||||
<?php
|
||||
require('../../../inc/connect.php');
|
||||
require('../../../inc/crypt.php');
|
||||
|
||||
$username = $_POST['username'];
|
||||
$email = $_POST['email'];
|
||||
$password1 = $_POST['password1'];
|
||||
$password2 = $_POST['password2'];
|
||||
$device = $_POST['device'];
|
||||
|
||||
//Validate Device ID
|
||||
if(strlen($device) != 6)
|
||||
{
|
||||
error("login", "Device ID invalid");
|
||||
}
|
||||
|
||||
$sql = "SELECT `id` FROM `device` WHERE `dev_id`='" . $device . "' AND `user`=0";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
if($query->num_rows < 1)
|
||||
{
|
||||
error("login", "Device ID invalid");
|
||||
}
|
||||
|
||||
//Validate email
|
||||
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
||||
error("login", "Invalid email address");
|
||||
}
|
||||
|
||||
$sql = "SELECT `id` FROM `user` WHERE `email`='" . $email . "' AND verified=1";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
if($query->num_rows >= 1)
|
||||
{
|
||||
error("login", "Email address is already in use.");
|
||||
}
|
||||
|
||||
//Validate username
|
||||
$sql = "SELECT `id` FROM `user` WHERE `username`='" . $username . "'";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
if($query->num_rows >= 1)
|
||||
{
|
||||
error("login", "Username is already in use.");
|
||||
}
|
||||
|
||||
//Validate password
|
||||
if($password1 != $password2)
|
||||
{
|
||||
error("login", "Passwords do not match");
|
||||
}
|
||||
|
||||
$password_hash = password_hash($password1, PASSWORD_BCRYPT);
|
||||
|
||||
$code = $email . "~" . $device . "~";
|
||||
$code .= RandomString(96 - strlen($code));
|
||||
$code = str_rot13($code);
|
||||
|
||||
$sql = "INSERT INTO user (`username`, `password`, `email`, `code`) VALUES ('$username', '$password_hash', '$email', '$code')";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
$msg = "Hello " . $username . ",\n\n";
|
||||
$msg .= "Please verify your LiPaccount by clicking the link below.\n";
|
||||
$msg .= "<a href='http://lipa.kvewijk.nl/manage/php/session/verify.php?code=" . urlencode($code) . "'>Verify</a>";
|
||||
|
||||
sendMail($email, "Verify LiPaccount", $msg);
|
||||
|
||||
success("login", "An email has been sent to " . $email . " for verification");
|
||||
?>
|
||||
@@ -0,0 +1,63 @@
|
||||
<?php
|
||||
require('../../../inc/connect.php');
|
||||
|
||||
//Decode code
|
||||
$code = urldecode($_GET['code']);
|
||||
$temp = str_rot13($code) or die(error("login", "An error occured"));
|
||||
$spl = explode("~", $temp);
|
||||
|
||||
$email = $spl[0];
|
||||
$device = $spl[1];
|
||||
|
||||
//Validate
|
||||
if(strlen($device) != 6 || !filter_var($email, FILTER_VALIDATE_EMAIL))
|
||||
{
|
||||
error("login", "An error occured");
|
||||
}
|
||||
|
||||
|
||||
//Check if device id already bound -> delete account
|
||||
$sql = "SELECT `id` FROM device WHERE `dev_id`='$device' AND `user`=0";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
if($query->num_rows < 1)
|
||||
{
|
||||
|
||||
//Check if email already verified
|
||||
$sql = "SELECT `id` FROM user WHERE `email`='$email' AND `verified`=1";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
$str = "";
|
||||
|
||||
if($query->num_rows < 1)
|
||||
{
|
||||
$sql = "DELETE FROM user WHERE `email`='$email' AND `code`='$code'";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
$str = ", account registration has been cancelled";
|
||||
}
|
||||
|
||||
error("login", "This device has already been bound to an account" . $str);
|
||||
}
|
||||
|
||||
|
||||
//Check if email matches code to verify integrity
|
||||
$sql = "SELECT `id` FROM user WHERE `email`='$email' AND `code`='$code'";
|
||||
$query = ExecQuery($mysqli, $sql);
|
||||
|
||||
if($query->num_rows < 1)
|
||||
{
|
||||
error("login", "Verification failed");
|
||||
}
|
||||
|
||||
$uid = $query->fetch_assoc()['id'];
|
||||
|
||||
//Account has passed all the checks, verify
|
||||
$sql = "UPDATE user SET `verified`=1, `code`='' WHERE `id`=$uid";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
$sql = "UPDATE device SET `user`=$uid WHERE `dev_id`='$device'";
|
||||
ExecQuery($mysqli, $sql);
|
||||
|
||||
success("login", "The verification has succeeded");
|
||||
?>
|
||||
Reference in New Issue
Block a user