Commit Graph

97 Commits

Author SHA1 Message Date
Sebastian Grewe
67a6d9aff4 [UPDATE] Coding style 2014-01-02 11:05:07 +01:00
Sebastian Grewe
4c3421cc8a Merge pull request #1165 from Neozonz/issue-1164
Initial commit for pin reset functionality
2014-01-02 02:02:37 -08:00
Sebastian Grewe
ee02445b7d Merge branch 'issue-965' into next
Conflicts:
	public/templates/mpos/master.tpl
2013-12-31 16:27:16 +01:00
Neozonz
5e401bd6dd fixed indent 2013-12-30 09:17:22 -08:00
Neozonz
e3db7e0a02 Initial commit for pin reset functionality 2013-12-30 03:29:20 -05:00
poolpm
c9215475b0 [FIX] Wrong behavior on Edit Account with no addy
When an account is edited and no payment address has been set, the following non-sense message appears:
Unable to connect to RPC server for coin address validation

This patch fixes the issue and allows profile to be edited with no payment address
2013-12-27 16:21:25 +01:00
Sebastian Grewe
b16d9afcad [SECURITY] Fixed exploit in token types
Fixes an exploit due to missing check of token type used.

Fixes #1118 once merged.
2013-12-27 00:21:22 +01:00
Sebastian Grewe
f465bda350 [ADDED] Accept TaC during registration 2013-12-12 10:11:44 +01:00
Sebastian Grewe
6315d8fe03 [FIX] Validate coin_address on account updates
Fixes #945 once merged.
2013-12-10 16:53:56 +01:00
Sebastian Grewe
256b5f59c6 [IMPROVED] Lockout user on invalid pin/password
This will lock a user account if a password or PIN has been entered
wrong for multiple times in a row. When unlocking the account via admin
panel, both counters are reset so the user can log in again.

This should fix issues with brute force attacks to access user accounts.

Please see configuration dist file for new config options.
Please import SQL upgrade 007 to add new column to user accounts table.

Addresses #670 and should be merged once tested.
2013-12-07 22:14:14 +01:00
Sebastian Grewe
ae89c7f198 [FIX] Backport from #855 2013-11-21 09:36:44 +01:00
Sebastian Grewe
f67e63b6fc [REFACTOR] Refactored classes for error handling
* [ADDED] More error codes
* [MODIFIED] Class updates to use Base Class all the time
* [MODIFIED] Cronjobs have been slightly adjusted
* [ADDED] More base class features
2013-11-05 14:34:31 +01:00
Sebastian Grewe
c0e7385332 [ADDED] Re-added custom HTTP port support 2013-11-04 15:25:38 +01:00
Sebastian Grewe
5eefb730ae [FIX] Re-location via HTTPS on login 2013-11-04 14:26:21 +01:00
Sebastian Grewe
f713edf234 Revert "[FIX] Honor custom HTTP ports"
This reverts commit fc4b718067.
2013-11-04 14:16:54 +01:00
Sebastian Grewe
fc4b718067 [FIX] Honor custom HTTP ports
Fixes #803
2013-10-31 07:55:12 +01:00
Sebastian Grewe
8786a99382 [FIX] Fix sending mails even though diabled
Fixes #732
2013-10-18 07:21:51 +02:00
Sebastian Grewe
50fb5218b1 [FIX] Use existing getDonatePercent 2013-10-16 11:54:59 +02:00
Sebastian Grewe
aedb37aa3d [IMPROVED] Added getUserEstimates method 2013-10-16 11:34:59 +02:00
Sebastian Grewe
a06d64e1fb [IMPROVED] Added case-insensitive login
* [IMPROVED] Added Username/Email password reset

Fixes #709
2013-10-10 17:06:01 +02:00
Sebastian Grewe
1d4f60b4d9 [FIX] Logout on HTTPS 2013-09-30 13:25:27 +02:00
Sebastian Grewe
5e64d43732 [IMPROVEMENT] Allow user login via E-Mail 2013-09-18 07:33:57 +02:00
Sebastian Grewe
fbf2a86162 [FIX] Properly redirect after login 2013-09-18 07:24:34 +02:00
Sebastian Grewe
faadf7cbaf [FEATURE] Proper login/logout/auth redirects
* Allow to redirect to referrer page when access is denied
* Logout user and point towards login, add redirect
* Logout user as usual but added save redirects
* Adjusted templates and page codes
2013-09-14 21:20:12 +02:00
Sebastian Grewe
5c11c74974 allow simple authentication checks wihtout logout 2013-09-09 07:45:55 +02:00
Sebastian Grewe
bc7e511177 removing debug echos 2013-09-06 15:00:47 +02:00
Sebastian Grewe
7ec8fa9b95 Moving a lot of settings from config to adminpanel
* Migrated configuration options to admin panel
* Removed configuration options from config file
* Added help text for each configuration option into panel

Addresses #622 and needs extensive testing by pools. A lot has changed
so pool owners might have to adjust their own templates to match this
new system.
2013-08-20 12:02:47 +02:00
Sebastian Grewe
95825224a1 Adding archiving flag for transactions
* Added new column to transactions table (`007_transactions.sql`)
* Added setArchived method to mark old transactions as archived
* Honor archived flag in getBalance and getLockedBalance

This will further address and fix #536 once merged.
2013-08-01 12:16:59 +02:00
Sebastian Grewe
c6a4df2975 Check coin address when updating account
This will fix #506 and ensures valid addresses are added when updating
the account.
2013-07-23 14:37:58 +02:00
Sebastian Grewe
9899507839 Fix some reported issues in #260 2013-07-23 11:05:45 +02:00
Sebastian Grewe
63b942a7e1 Adding No Fee option to admin panel
Admins can disable a users fee via admin panel now.

Fixes #260
2013-07-23 10:56:45 +02:00
Sebastian Grewe
b7ffbd0bfd fixing issue for first created admin user 2013-07-16 16:02:52 +02:00
Sebastian Grewe
501f369b4e Further fixes to PHP warnings
Addresses #330 and further cleans up the PHP log.
2013-07-15 15:31:18 +02:00
Sebastian Grewe
525c0ab009 Fixing PHP Warning on unsert token on register
Addresses #330 and cleans up PHP Log
2013-07-15 14:28:54 +02:00
Sebastian Grewe
bf3cd25326 removing unused token methods 2013-07-15 12:52:55 +02:00
Sebastian Grewe
bd32dfa9f8 Adding invitation system to mmcfe-ng core
This will allow users to send invitations to other people via email.
Each account will still need to confirm the email address if the option
is enabled.

Addresses #330, will need to allow pool operators to enable this feature
even with registrations turned off.
2013-07-15 12:26:31 +02:00
Sebastian Grewe
7cc1e2543c fixing syntax error 2013-07-15 12:26:31 +02:00
Sebastian Grewe
be9a8d3fda Go through activiation even for admin accounts
Fixes an issue with accounts being locked after trying to activate it.

Addresses #330
2013-07-15 12:26:31 +02:00
Sebastian Grewe
0ede05a6fd Adding email verification
* Adding mail verification during account registration
* Added new dist file option for mail verification
* Added account confirmation page using tokens
* Added mail class into user class for password resets
* Moved password reset template
* Adjusted account registration page
* Adjusted user class for email confirmation

Also fixed a bug with smarty_cache_key not being used properly if smarty
is disabled. Key still needs to be available even if caching is disabled

Addresses #330 and prepare the ticket for invitation only system.
2013-07-15 12:26:31 +02:00
Sebastian Grewe
29d5d36a7e WiP for one time tokens
* Added token type class
* Storing Token Type as ID not varchar
* Added new system to user class and fixed issues with it
* Started on mail verification process in user class
* Updated autoloader
* Updated change password template

Addresses #330
2013-07-15 12:26:31 +02:00
Sebastian Grewe
253d6e8a47 Fixing username regexp during registration
Fixes wrong regext of #453
2013-07-14 21:08:03 +02:00
Sebastian Grewe
15753f5eca Merge pull request #455 from typal/issue-452
fucked up...
2013-07-14 01:15:21 -07:00
typ
ed5e320ff6 fucked up... 2013-07-14 02:43:44 +02:00
Sebastian Grewe
d190866315 Merge pull request #454 from TheSerapher/issue-419
Adding anonymous account support
2013-07-13 10:43:21 -07:00
typ
0775eaf8c1 add check for non alpa/-/_ chars 2013-07-13 16:41:51 +02:00
Sebastian Grewe
8ec1d2cab3 Adding anonymous account support
* Added anonymous flag to accounts table
* Added checkbox for anonymous flag in edit account page
* Updated user class to support new flag
* Updated statistics class to support anonymous and donations
* Updated all templates showing usernames to show anonymous instead
* Added new SQL `ALTER TABLE` file for upgrading the table

Fixes #419 once merged.
2013-07-12 10:33:42 +02:00
Sebastian Grewe
a9ae72cd50 Merge pull request #445 from IainKay/issue-434
Issue 434
2013-07-11 13:06:41 -07:00
Iain Kay
dfbaf621de When destroying a users session on the server we now also remove all session data immediately, rather than relying on garbage collection, and we destroy the cookie on the users browser. 2013-07-11 19:41:50 +00:00
Sebastian Grewe
5b50422675 Fixing XSS for user registration 2013-07-11 15:49:08 +02:00
Sebastian Grewe
307c7ee23f Enforce unique account emails
* display an error if user tries to re-use an email address
* moved SQL files to indicate the order of SQL import
* added unique email index SQL file

This will address #389, still needs email validation.
2013-07-06 17:47:50 +02:00