diff --git a/public/include/classes/user.class.php b/public/include/classes/user.class.php
index 27459ef4..af42eabd 100644
--- a/public/include/classes/user.class.php
+++ b/public/include/classes/user.class.php
@@ -124,7 +124,7 @@ class User extends Base {
}
}
if ($this->isLocked($this->getUserId($username))) {
- $this->setErrorMessage("Account is locked. Please contact site support.");
+ $this->setErrorMessage('Account locked.');
return false;
}
if ($this->checkUserPassword($username, $password)) {
@@ -136,8 +136,16 @@ class User extends Base {
if ($id = $this->getUserId($username)) {
$this->incUserFailed($id);
// Check if this account should be locked
- if (isset($this->config['maxfailed']['login']) && $this->getUserFailed($id) >= $this->config['maxfailed']['login'])
+ if (isset($this->config['maxfailed']['login']) && $this->getUserFailed($id) >= $this->config['maxfailed']['login']) {
$this->changeLocked($id);
+ if ($token = $this->token->createToken('account_unlock', $id)) {
+ $aData['token'] = $token;
+ $aData['username'] = $username;
+ $aData['email'] = $this->getUserEmail($username);;
+ $aData['subject'] = 'Account auto-locked';
+ $this->mail->sendMail('notifications/locked', $aData);
+ }
+ }
}
return false;
@@ -162,12 +170,20 @@ class User extends Base {
// Check if this account should be locked
if (isset($this->config['maxfailed']['pin']) && $this->getUserPinFailed($userId) >= $this->config['maxfailed']['pin']) {
$this->changeLocked($userId);
+ if ($token = $this->token->createToken('account_unlock', $userId)) {
+ $username = $this->getUserName($userId);
+ $aData['token'] = $token;
+ $aData['username'] = $username;
+ $aData['email'] = $this->getUserEmail($username);;
+ $aData['subject'] = 'Account auto-locked';
+ $this->mail->sendMail('notifications/locked', $aData);
+ }
$this->logoutUser();
}
return false;
}
-public function generatePin($userID, $current) {
+ public function generatePin($userID, $current) {
$this->debug->append("STA " . __METHOD__, 4);
$username = $this->getUserName($userID);
$email = $this->getUserEmail($username);
diff --git a/public/include/pages/account/unlock.inc.php b/public/include/pages/account/unlock.inc.php
new file mode 100644
index 00000000..fef18761
--- /dev/null
+++ b/public/include/pages/account/unlock.inc.php
@@ -0,0 +1,20 @@
+ 'Missing token', 'TYPE' => 'errormsg');
+} else if (!$aToken = $oToken->getToken($_GET['token'], 'account_unlock')) {
+ $_SESSION['POPUP'][] = array('CONTENT' => 'Unable to re-activate your account. Invalid token.', 'TYPE' => 'errormsg');
+} else {
+ if ($user->setUserFailed($aToken['account_id'], 0) && $user->setUserPinFailed($aToken['account_id'], 0) && $user->changeLocked($aToken['account_id'])) {
+ $oToken->deleteToken($aToken['token']);
+ $_SESSION['POPUP'][] = array('CONTENT' => 'Account re-activated. Please login.');
+ } else {
+ $_SESSION['POPUP'][] = array('CONTENT' => 'Failed to re-activate account. Contact site support.', 'TYPE' => 'errormsg');
+ }
+}
+$smarty->assign('CONTENT', 'default.tpl');
+?>
diff --git a/public/templates/mail/notifications/locked.tpl b/public/templates/mail/notifications/locked.tpl
new file mode 100644
index 00000000..fcf1ccfa
--- /dev/null
+++ b/public/templates/mail/notifications/locked.tpl
@@ -0,0 +1,8 @@
+
+
+You account has been locked due to too many failed password or PIN attempts. Please follow the URL below to unlock your account.
+http://{$smarty.server.SERVER_NAME}{$smarty.server.PHP_SELF}?page=account&action=unlock&token={nocache}{$DATA.token}{/nocache}
+
+
+
+
diff --git a/public/templates/mpos/account/unlock/default.tpl b/public/templates/mpos/account/unlock/default.tpl
new file mode 100644
index 00000000..8b137891
--- /dev/null
+++ b/public/templates/mpos/account/unlock/default.tpl
@@ -0,0 +1 @@
+
diff --git a/sql/000_base_structure.sql b/sql/000_base_structure.sql
index 502d22b2..f3314392 100644
--- a/sql/000_base_structure.sql
+++ b/sql/000_base_structure.sql
@@ -197,7 +197,8 @@ CREATE TABLE IF NOT EXISTS `token_types` (
INSERT INTO `token_types` (`id`, `name`, `expiration`) VALUES
(1, 'password_reset', 3600),
(2, 'confirm_email', 0),
-(3, 'invitation', 0);
+(3, 'invitation', 0),
+(4, 'account_unlock', 0);
CREATE TABLE IF NOT EXISTS `transactions` (
`id` int(255) NOT NULL AUTO_INCREMENT,
diff --git a/sql/010_tokentype_update.sql b/sql/010_tokentype_update.sql
new file mode 100644
index 00000000..2dc0c8f1
--- /dev/null
+++ b/sql/010_tokentype_update.sql
@@ -0,0 +1 @@
+INSERT INTO `token_types` (`name`, `expiration`) VALUES ('account_unlock', 0);