diff --git a/public/include/classes/user.class.php b/public/include/classes/user.class.php index 3ec72546..3e373ab7 100644 --- a/public/include/classes/user.class.php +++ b/public/include/classes/user.class.php @@ -43,6 +43,10 @@ class User { return $this->getSingle($id, 'token', 'id'); } + public function getIdFromToken($token) { + return $this->getSingle($token, 'id', 'token', 's'); + } + public function setUserToken($id) { $field = array( 'name' => 'token', @@ -322,7 +326,30 @@ class User { return false; } - public function resetPassword($username) { + public function useToken($token, $new1, $new2) { + $this->debug->append("STA " . __METHOD__, 4); + if ($id = $this->getIdFromToken($token)) { + if ($new1 !== $new2) { + $this->setErrorMessage( 'New passwords do not match' ); + return false; + } + if ( strlen($new1) < 8 ) { + $this->setErrorMessage( 'New password is too short, please use more than 8 chars' ); + return false; + } + $new = hash('sha256', $new1.$this->salt); + $stmt = $this->mysqli->prepare("UPDATE $this->table SET pass = ?, token = NULL WHERE id = ? AND token = ?"); + if ($this->checkStmt($stmt) && $stmt->bind_param('sis', $new, $id, $token) && $stmt->execute() && $stmt->affected_rows === 1) { + return true; + } + } else { + $this->setErrorMessage("Unable find user for your token"); + return false; + } + return false; + } + + public function resetPassword($username, $smarty) { $this->debug->append("STA " . __METHOD__, 4); // Fetch the users mail address if (!$email = $this->getUserEmail($username)) { @@ -338,10 +365,10 @@ class User { $this->setErrorMessage("Unable fetch token for password reset"); return false; } - $subject = "[" . $this->config['website']['name'] . "] Password Reset Request"; - $header = "From: " . $this->config['website']['email']; - $message = "Please follow the link to reset your password\n\n" . $this->config['website']['url']['password_reset'] . "/index.php?page=password&action=change&token=$token"; - if (mail($email, 'Password Reset Request', $message)) { + $smarty->assign('TOKEN', $token); + $smarty->assign('USERNAME', $username); + $smarty->assign('WEBSITENAME', $this->config['website']['name']); + if (mail($email, $smarty->fetch('templates/mail/subject.tpl'), $smarty->fetch('templates/mail/body.tpl'))) { return true; } else { $this->setErrorMessage("Unable to send mail to your address"); diff --git a/public/include/config/global.inc.dist.php b/public/include/config/global.inc.dist.php index 37d39c3f..f684c2bb 100644 --- a/public/include/config/global.inc.dist.php +++ b/public/include/config/global.inc.dist.php @@ -24,6 +24,7 @@ $config = array( 'website' => array( 'name' => 'The Pool', 'slogan' => 'Resistance is futile', + 'email' => 'test@example.com', // Mail address used for notifications ), 'fees' => 0, 'difficulty' => '31', // Target difficulty for this pool as set in pushpoold json diff --git a/public/include/pages/password/change.inc.php b/public/include/pages/password/change.inc.php new file mode 100644 index 00000000..8b5f4064 --- /dev/null +++ b/public/include/pages/password/change.inc.php @@ -0,0 +1,17 @@ +useToken($_POST['token'], $_POST['newPassword'], $_POST['newPassword2'])) { + $_SESSION['POPUP'][] = array('CONTENT' => 'Password reset complete! Please login.'); + } else { + $_SESSION['POPUP'][] = array('CONTENT' => $user->getError(), 'TYPE' => 'errormsg'); + } +} + +// Tempalte specifics +$smarty->assign("CONTENT", "default.tpl"); +?> diff --git a/public/include/pages/password/reset.inc.php b/public/include/pages/password/reset.inc.php index 532eb67c..796f5811 100644 --- a/public/include/pages/password/reset.inc.php +++ b/public/include/pages/password/reset.inc.php @@ -4,7 +4,8 @@ if (!defined('SECURITY')) die('Hacking attempt'); -if ($user->resetPassword($_POST['username'])) { +// Process password reset request +if ($user->resetPassword($_POST['username'], $smarty)) { $_SESSION['POPUP'][] = array('CONTENT' => 'Please check your mail account to finish your password reset'); } else { $_SESSION['POPUP'][] = array('CONTENT' => $user->getError(), 'TYPE' => 'errormsg'); diff --git a/public/templates/mail/body.tpl b/public/templates/mail/body.tpl new file mode 100644 index 00000000..ad36501d --- /dev/null +++ b/public/templates/mail/body.tpl @@ -0,0 +1,13 @@ +Hello {$USERNAME}, + +You have requested a password reset through our online form. +In order to complete the request please follow this link + +http://{$smarty.server.SERVER_NAME}{$smarty.server.PHP_SELF}?page=password&action=change&token={$TOKEN} + +You will be asked to change your password. You can then use this new +password to login to your account. + + +Cheers, +Website Administration diff --git a/public/templates/mail/subject.tpl b/public/templates/mail/subject.tpl new file mode 100644 index 00000000..665e26f5 --- /dev/null +++ b/public/templates/mail/subject.tpl @@ -0,0 +1 @@ +[ {$WEBSITENAME} ] Password Reset Request diff --git a/public/templates/mmcFE/password/change/default.tpl b/public/templates/mmcFE/password/change/default.tpl new file mode 100644 index 00000000..0d254677 --- /dev/null +++ b/public/templates/mmcFE/password/change/default.tpl @@ -0,0 +1,12 @@ +{include file="global/block_header.tpl" BLOCK_HEADER="Change Password"} +
+{include file="global/block_footer.tpl"}