Commit Graph

112 Commits

Author SHA1 Message Date
xisi
e7725399c2 change function name for sending 2f emails 2014-01-16 05:55:57 -05:00
xisi
8736123df2 improved bad csrf token error message
cleaned up wording of config
improved leadtime defaults in getCSRFToken
2014-01-16 05:55:57 -05:00
xisi
2d0938b35b [ADDED] Simple CSRF protection tokens
* Adds config options for disabling, timeout lead time, and forms
 * Adds another salt in config that's used in the token
 * Adds protection for login form by default
2014-01-16 05:55:57 -05:00
xisi
8ed8338b3e fixed my incorrect use of notif settings array 2014-01-16 05:53:36 -05:00
xisi
f3a6d65eab send notifications on successful login when active 2014-01-16 05:53:36 -05:00
xisi
96b734edaa fix how late we delete tokens for 2fa 2014-01-16 05:53:36 -05:00
xisi
d9d678be61 retooled most of the email confirmation setup 2014-01-16 05:53:36 -05:00
xisi
bfd803ec28 Incremented version, moved config options, return vals fixed in 2f checks 2014-01-16 05:42:43 -05:00
xisi
ef904858ae [Addition] E-mail confirmations for user actions
* If enabled, sends e-mail to confirm user withdraws, edits and pw changes
 * Adds 4 config options, enabled + individual settings
 * Adds 3 new token_types
2014-01-16 05:42:43 -05:00
Sebastian Grewe
4fe46cbd2a [ADDED] last_login timestamp
* [RENAMED] sessionTimeoutStamp to last_login
* [UPDATE] user class to store login time after successful login
* [ADDED] SQL Upgrade file for new column
* [UPDATE] Updated base SQL file

Fixes #1162 once merged.
2014-01-11 20:32:45 +01:00
Sebastian Grewe
2417ee7c4f [FIX] Log SQL errors on invalid checkUserPassword
Fixes #1366 once merged.
2014-01-11 19:28:37 +01:00
Sebastian Grewe
f98d08df83 [SECURITY] Fixing XSS in PHP_SELF
Fixes #1364 once merged.
2014-01-11 19:01:14 +01:00
Sebastian Grewe
627b7a17ff [FIX] Catch jsonRPC exceptions
Fixes #1339 once merged.
2014-01-10 16:20:24 +01:00
Sebastian Grewe
8fcd59eeea [ADDED] Account unlock mail on failed PIN 2014-01-02 13:28:33 +01:00
Sebastian Grewe
878fa1c1c8 [IMPROVED] Unlock notification mails on auto-locks
* Added new token type: account_unlock
* Added update SQL File
* Updated base structure with new token type
* Added empty template
* Updated user class to send mail on failed passwords
* Added unlock account page to use tokens

Addresses #670
2014-01-02 11:51:22 +01:00
Sebastian Grewe
67a6d9aff4 [UPDATE] Coding style 2014-01-02 11:05:07 +01:00
Sebastian Grewe
4c3421cc8a Merge pull request #1165 from Neozonz/issue-1164
Initial commit for pin reset functionality
2014-01-02 02:02:37 -08:00
Sebastian Grewe
ee02445b7d Merge branch 'issue-965' into next
Conflicts:
	public/templates/mpos/master.tpl
2013-12-31 16:27:16 +01:00
Neozonz
5e401bd6dd fixed indent 2013-12-30 09:17:22 -08:00
Neozonz
e3db7e0a02 Initial commit for pin reset functionality 2013-12-30 03:29:20 -05:00
poolpm
c9215475b0 [FIX] Wrong behavior on Edit Account with no addy
When an account is edited and no payment address has been set, the following non-sense message appears:
Unable to connect to RPC server for coin address validation

This patch fixes the issue and allows profile to be edited with no payment address
2013-12-27 16:21:25 +01:00
Sebastian Grewe
b16d9afcad [SECURITY] Fixed exploit in token types
Fixes an exploit due to missing check of token type used.

Fixes #1118 once merged.
2013-12-27 00:21:22 +01:00
Sebastian Grewe
f465bda350 [ADDED] Accept TaC during registration 2013-12-12 10:11:44 +01:00
Sebastian Grewe
6315d8fe03 [FIX] Validate coin_address on account updates
Fixes #945 once merged.
2013-12-10 16:53:56 +01:00
Sebastian Grewe
256b5f59c6 [IMPROVED] Lockout user on invalid pin/password
This will lock a user account if a password or PIN has been entered
wrong for multiple times in a row. When unlocking the account via admin
panel, both counters are reset so the user can log in again.

This should fix issues with brute force attacks to access user accounts.

Please see configuration dist file for new config options.
Please import SQL upgrade 007 to add new column to user accounts table.

Addresses #670 and should be merged once tested.
2013-12-07 22:14:14 +01:00
Sebastian Grewe
ae89c7f198 [FIX] Backport from #855 2013-11-21 09:36:44 +01:00
Sebastian Grewe
f67e63b6fc [REFACTOR] Refactored classes for error handling
* [ADDED] More error codes
* [MODIFIED] Class updates to use Base Class all the time
* [MODIFIED] Cronjobs have been slightly adjusted
* [ADDED] More base class features
2013-11-05 14:34:31 +01:00
Sebastian Grewe
c0e7385332 [ADDED] Re-added custom HTTP port support 2013-11-04 15:25:38 +01:00
Sebastian Grewe
5eefb730ae [FIX] Re-location via HTTPS on login 2013-11-04 14:26:21 +01:00
Sebastian Grewe
f713edf234 Revert "[FIX] Honor custom HTTP ports"
This reverts commit fc4b718067.
2013-11-04 14:16:54 +01:00
Sebastian Grewe
fc4b718067 [FIX] Honor custom HTTP ports
Fixes #803
2013-10-31 07:55:12 +01:00
Sebastian Grewe
8786a99382 [FIX] Fix sending mails even though diabled
Fixes #732
2013-10-18 07:21:51 +02:00
Sebastian Grewe
50fb5218b1 [FIX] Use existing getDonatePercent 2013-10-16 11:54:59 +02:00
Sebastian Grewe
aedb37aa3d [IMPROVED] Added getUserEstimates method 2013-10-16 11:34:59 +02:00
Sebastian Grewe
a06d64e1fb [IMPROVED] Added case-insensitive login
* [IMPROVED] Added Username/Email password reset

Fixes #709
2013-10-10 17:06:01 +02:00
Sebastian Grewe
1d4f60b4d9 [FIX] Logout on HTTPS 2013-09-30 13:25:27 +02:00
Sebastian Grewe
5e64d43732 [IMPROVEMENT] Allow user login via E-Mail 2013-09-18 07:33:57 +02:00
Sebastian Grewe
fbf2a86162 [FIX] Properly redirect after login 2013-09-18 07:24:34 +02:00
Sebastian Grewe
faadf7cbaf [FEATURE] Proper login/logout/auth redirects
* Allow to redirect to referrer page when access is denied
* Logout user and point towards login, add redirect
* Logout user as usual but added save redirects
* Adjusted templates and page codes
2013-09-14 21:20:12 +02:00
Sebastian Grewe
5c11c74974 allow simple authentication checks wihtout logout 2013-09-09 07:45:55 +02:00
Sebastian Grewe
bc7e511177 removing debug echos 2013-09-06 15:00:47 +02:00
Sebastian Grewe
7ec8fa9b95 Moving a lot of settings from config to adminpanel
* Migrated configuration options to admin panel
* Removed configuration options from config file
* Added help text for each configuration option into panel

Addresses #622 and needs extensive testing by pools. A lot has changed
so pool owners might have to adjust their own templates to match this
new system.
2013-08-20 12:02:47 +02:00
Sebastian Grewe
95825224a1 Adding archiving flag for transactions
* Added new column to transactions table (`007_transactions.sql`)
* Added setArchived method to mark old transactions as archived
* Honor archived flag in getBalance and getLockedBalance

This will further address and fix #536 once merged.
2013-08-01 12:16:59 +02:00
Sebastian Grewe
c6a4df2975 Check coin address when updating account
This will fix #506 and ensures valid addresses are added when updating
the account.
2013-07-23 14:37:58 +02:00
Sebastian Grewe
9899507839 Fix some reported issues in #260 2013-07-23 11:05:45 +02:00
Sebastian Grewe
63b942a7e1 Adding No Fee option to admin panel
Admins can disable a users fee via admin panel now.

Fixes #260
2013-07-23 10:56:45 +02:00
Sebastian Grewe
b7ffbd0bfd fixing issue for first created admin user 2013-07-16 16:02:52 +02:00
Sebastian Grewe
501f369b4e Further fixes to PHP warnings
Addresses #330 and further cleans up the PHP log.
2013-07-15 15:31:18 +02:00
Sebastian Grewe
525c0ab009 Fixing PHP Warning on unsert token on register
Addresses #330 and cleans up PHP Log
2013-07-15 14:28:54 +02:00
Sebastian Grewe
bf3cd25326 removing unused token methods 2013-07-15 12:52:55 +02:00