source: trunk/password.php @ 18055

Last change on this file since 18055 was 17984, checked in by plg, 12 years ago

merge r17983 from branch 2.4 to trunk

bug 2750 fixed: HTML-sanitize $_POSTusername_or_email before display (both
username and email don't allow HTML tags...)

Original report by Stefan Schurtz via Secunia SVCRP

  • Property svn:eol-style set to LF
File size: 10.4 KB
Line 
1<?php
2// +-----------------------------------------------------------------------+
3// | Piwigo - a PHP based photo gallery                                    |
4// +-----------------------------------------------------------------------+
5// | Copyright(C) 2008-2012 Piwigo Team                  http://piwigo.org |
6// | Copyright(C) 2003-2008 PhpWebGallery Team    http://phpwebgallery.net |
7// | Copyright(C) 2002-2003 Pierrick LE GALL   http://le-gall.net/pierrick |
8// +-----------------------------------------------------------------------+
9// | This program is free software; you can redistribute it and/or modify  |
10// | it under the terms of the GNU General Public License as published by  |
11// | the Free Software Foundation                                          |
12// |                                                                       |
13// | This program is distributed in the hope that it will be useful, but   |
14// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
15// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
16// | General Public License for more details.                              |
17// |                                                                       |
18// | You should have received a copy of the GNU General Public License     |
19// | along with this program; if not, write to the Free Software           |
20// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
21// | USA.                                                                  |
22// +-----------------------------------------------------------------------+
23
24// +-----------------------------------------------------------------------+
25// |                           initialization                              |
26// +-----------------------------------------------------------------------+
27
28define('PHPWG_ROOT_PATH','./');
29include_once( PHPWG_ROOT_PATH.'include/common.inc.php' );
30include_once(PHPWG_ROOT_PATH.'include/functions_mail.inc.php');
31
32// +-----------------------------------------------------------------------+
33// | Check Access and exit when user status is not ok                      |
34// +-----------------------------------------------------------------------+
35
36check_status(ACCESS_FREE);
37
38// +-----------------------------------------------------------------------+
39// | Functions                                                             |
40// +-----------------------------------------------------------------------+
41
42/**
43 * checks the validity of input parameters, fills $page['errors'] and
44 * $page['infos'] and send an email with confirmation link
45 *
46 * @return bool (true if email was sent, false otherwise)
47 */
48function process_password_request()
49{
50  global $page, $conf;
51 
52  if (empty($_POST['username_or_email']))
53  {
54    array_push($page['errors'], l10n('Invalid username or email'));
55    return false;
56  }
57 
58  $user_id = get_userid_by_email($_POST['username_or_email']);
59   
60  if (!is_numeric($user_id))
61  {
62    $user_id = get_userid($_POST['username_or_email']);
63  }
64
65  if (!is_numeric($user_id))
66  {
67    array_push($page['errors'], l10n('Invalid username or email'));
68    return false;
69  }
70
71  $userdata = getuserdata($user_id, false);
72
73  // password request is not possible for guest/generic users
74  $status = $userdata['status'];
75  if (is_a_guest($status) or is_generic($status))
76  {
77    array_push($page['errors'], l10n('Password reset is not allowed for this user'));
78    return false;
79  }
80
81  if (empty($userdata['email']))
82  {
83    array_push(
84      $page['errors'],
85      sprintf(
86        l10n('User "%s" has no email address, password reset is not possible'),
87        $userdata['username']
88        )
89      );
90    return false;
91  }
92
93  if (empty($userdata['activation_key']))
94  {
95    $activation_key = get_user_activation_key();
96
97    single_update(
98      USER_INFOS_TABLE,
99      array('activation_key' => $activation_key),
100      array('user_id' => $user_id)
101      );
102
103    $userdata['activation_key'] = $activation_key;
104  }
105
106  set_make_full_url();
107 
108  $message = l10n('Someone requested that the password be reset for the following user account:') . "\r\n\r\n";
109  $message.= sprintf(
110    l10n('Username "%s" on gallery %s'),
111    $userdata['username'],
112    get_gallery_home_url()
113    );
114  $message.= "\r\n\r\n";
115  $message.= l10n('To reset your password, visit the following address:') . "\r\n";
116  $message.= get_gallery_home_url().'/password.php?key='.$userdata['activation_key']."\r\n\r\n";
117  $message.= l10n('If this was a mistake, just ignore this email and nothing will happen.')."\r\n";
118
119  unset_make_full_url();
120
121  $message = trigger_event('render_lost_password_mail_content', $message);
122
123  $email_params = array(
124    'subject' => '['.$conf['gallery_title'].'] '.l10n('Password Reset'),
125    'content' => $message,
126    'email_format' => 'text/plain',
127    );
128
129  if (pwg_mail($userdata['email'], $email_params))
130  {
131    array_push($page['infos'], l10n('Check your email for the confirmation link'));
132    return true;
133  }
134  else
135  {
136    array_push($page['errors'], l10n('Error sending email'));
137    return false;
138  }
139}
140
141/**
142 *  checks the activation key: does it match the expected pattern? is it
143 *  linked to a user? is this user allowed to reset his password?
144 *
145 * @return mixed (user_id if OK, false otherwise)
146 */
147function check_password_reset_key($key)
148{
149  global $page;
150 
151  if (!preg_match('/^[a-z0-9]{20}$/i', $key))
152  {
153    array_push($page['errors'], l10n('Invalid key'));
154    return false;
155  }
156
157  $query = '
158SELECT
159    user_id,
160    status
161  FROM '.USER_INFOS_TABLE.'
162  WHERE activation_key = \''.$key.'\'
163;';
164  $result = pwg_query($query);
165
166  if (pwg_db_num_rows($result) == 0)
167  {
168    array_push($page['errors'], l10n('Invalid key'));
169    return false;
170  }
171 
172  $userdata = pwg_db_fetch_assoc($result);
173
174  if (is_a_guest($userdata['status']) or is_generic($userdata['status']))
175  {
176    array_push($page['errors'], l10n('Password reset is not allowed for this user'));
177    return false;
178  }
179
180  return $userdata['user_id'];
181}
182
183/**
184 * checks the passwords, checks that user is allowed to reset his password,
185 * update password, fills $page['errors'] and $page['infos'].
186 *
187 * @return bool (true if password was reset, false otherwise)
188 */
189function reset_password()
190{
191  global $page, $user, $conf;
192
193  if ($_POST['use_new_pwd'] != $_POST['passwordConf'])
194  {
195    array_push($page['errors'], l10n('The passwords do not match'));
196    return false;
197  }
198
199  if (isset($_GET['key']))
200  {
201    $user_id = check_password_reset_key($_GET['key']);
202    if (!is_numeric($user_id))
203    {
204      array_push($page['errors'], l10n('Invalid key'));
205      return false;
206    }
207  }
208  else
209  {
210    // we check the currently logged in user
211    if (is_a_guest() or is_generic())
212    {
213      array_push($page['errors'], l10n('Password reset is not allowed for this user'));
214      return false;
215    }
216
217    $user_id = $user['id'];
218  }
219   
220  single_update(
221    USERS_TABLE,
222    array($conf['user_fields']['password'] => $conf['pass_convert']($_POST['use_new_pwd'])),
223    array($conf['user_fields']['id'] => $user_id)
224    );
225
226  array_push($page['infos'], l10n('Your password has been reset'));
227
228  if (isset($_GET['key']))
229  {
230    array_push($page['infos'], '<a href="'.get_root_url().'identification.php">'.l10n('Login').'</a>');
231  }
232  else
233  {
234    array_push($page['infos'], '<a href="'.get_gallery_home_url().'">'.l10n('Return to home page').'</a>');
235  }
236
237  return true;
238}
239
240// +-----------------------------------------------------------------------+
241// | Process form                                                          |
242// +-----------------------------------------------------------------------+
243if (isset($_POST['submit']))
244{
245  check_pwg_token();
246 
247  if ('lost' == $_GET['action'])
248  {
249    if (process_password_request())
250    {
251      $page['action'] = 'none';
252    }
253  }
254
255  if ('reset' == $_GET['action'])
256  {
257    if (reset_password())
258    {
259      $page['action'] = 'none';
260    }
261  }
262}
263
264// +-----------------------------------------------------------------------+
265// | key and action                                                        |
266// +-----------------------------------------------------------------------+
267
268// a connected user can't reset the password from a mail
269if (isset($_GET['key']) and !is_a_guest())
270{
271  unset($_GET['key']);
272}
273
274if (isset($_GET['key']))
275{
276  $user_id = check_password_reset_key($_GET['key']);
277  if (is_numeric($user_id))
278  {
279    $userdata = getuserdata($user_id, false);
280    $page['username'] = $userdata['username'];
281    $template->assign('key', $_GET['key']);
282
283    if (!isset($page['action']))
284    {
285      $page['action'] = 'reset';
286    }
287  }
288  else
289  {
290    $page['action'] = 'none';
291  }
292}
293
294if (!isset($page['action']))
295{
296  if (!isset($_GET['action']))
297  {
298    $page['action'] = 'lost';
299  }
300  elseif (in_array($_GET['action'], array('lost', 'reset', 'none')))
301  {
302    $page['action'] = $_GET['action'];
303  }
304}
305
306if ('reset' == $page['action'] and !isset($_GET['key']) and (is_a_guest() or is_generic()))
307{
308  redirect(get_gallery_home_url());
309}
310
311if ('lost' == $page['action'] and !is_a_guest())
312{
313  redirect(get_gallery_home_url());
314}
315
316// +-----------------------------------------------------------------------+
317// | template initialization                                               |
318// +-----------------------------------------------------------------------+
319
320$title = l10n('Password Reset');
321if ('lost' == $page['action'])
322{
323  $title = l10n('Forgot your password?');
324
325  if (isset($_POST['username_or_email']))
326  {
327    $template->assign('username_or_email', stripslashes(strip_tags($_POST['username_or_email'])));
328  }
329}
330
331$page['body_id'] = 'thePasswordPage';
332
333$template->set_filenames(array('password'=>'password.tpl'));
334$template->assign(
335  array(
336    'title' => $title,
337    'form_action'=> get_root_url().'password.php',
338    'action' => $page['action'],
339    'username' => isset($page['username']) ? $page['username'] : $user['username'],
340    'PWG_TOKEN' => get_pwg_token(),
341    )
342  );
343
344
345// include menubar
346$themeconf = $template->get_template_vars('themeconf');
347if (!isset($themeconf['hide_menu_on']) OR !in_array('thePasswordPage', $themeconf['hide_menu_on']))
348{
349  include( PHPWG_ROOT_PATH.'include/menubar.inc.php');
350}
351
352// +-----------------------------------------------------------------------+
353// |                           html code display                           |
354// +-----------------------------------------------------------------------+
355
356include(PHPWG_ROOT_PATH.'include/page_header.php');
357include(PHPWG_ROOT_PATH.'include/page_messages.php');
358$template->pparse('password');
359include(PHPWG_ROOT_PATH.'include/page_tail.php');
360
361?>
Note: See TracBrowser for help on using the repository browser.