Commit Graph

74 Commits

Author SHA1 Message Date
Sebastian Grewe
faadf7cbaf [FEATURE] Proper login/logout/auth redirects
* Allow to redirect to referrer page when access is denied
* Logout user and point towards login, add redirect
* Logout user as usual but added save redirects
* Adjusted templates and page codes
2013-09-14 21:20:12 +02:00
Sebastian Grewe
5c11c74974 allow simple authentication checks wihtout logout 2013-09-09 07:45:55 +02:00
Sebastian Grewe
bc7e511177 removing debug echos 2013-09-06 15:00:47 +02:00
Sebastian Grewe
7ec8fa9b95 Moving a lot of settings from config to adminpanel
* Migrated configuration options to admin panel
* Removed configuration options from config file
* Added help text for each configuration option into panel

Addresses #622 and needs extensive testing by pools. A lot has changed
so pool owners might have to adjust their own templates to match this
new system.
2013-08-20 12:02:47 +02:00
Sebastian Grewe
95825224a1 Adding archiving flag for transactions
* Added new column to transactions table (`007_transactions.sql`)
* Added setArchived method to mark old transactions as archived
* Honor archived flag in getBalance and getLockedBalance

This will further address and fix #536 once merged.
2013-08-01 12:16:59 +02:00
Sebastian Grewe
c6a4df2975 Check coin address when updating account
This will fix #506 and ensures valid addresses are added when updating
the account.
2013-07-23 14:37:58 +02:00
Sebastian Grewe
9899507839 Fix some reported issues in #260 2013-07-23 11:05:45 +02:00
Sebastian Grewe
63b942a7e1 Adding No Fee option to admin panel
Admins can disable a users fee via admin panel now.

Fixes #260
2013-07-23 10:56:45 +02:00
Sebastian Grewe
b7ffbd0bfd fixing issue for first created admin user 2013-07-16 16:02:52 +02:00
Sebastian Grewe
501f369b4e Further fixes to PHP warnings
Addresses #330 and further cleans up the PHP log.
2013-07-15 15:31:18 +02:00
Sebastian Grewe
525c0ab009 Fixing PHP Warning on unsert token on register
Addresses #330 and cleans up PHP Log
2013-07-15 14:28:54 +02:00
Sebastian Grewe
bf3cd25326 removing unused token methods 2013-07-15 12:52:55 +02:00
Sebastian Grewe
bd32dfa9f8 Adding invitation system to mmcfe-ng core
This will allow users to send invitations to other people via email.
Each account will still need to confirm the email address if the option
is enabled.

Addresses #330, will need to allow pool operators to enable this feature
even with registrations turned off.
2013-07-15 12:26:31 +02:00
Sebastian Grewe
7cc1e2543c fixing syntax error 2013-07-15 12:26:31 +02:00
Sebastian Grewe
be9a8d3fda Go through activiation even for admin accounts
Fixes an issue with accounts being locked after trying to activate it.

Addresses #330
2013-07-15 12:26:31 +02:00
Sebastian Grewe
0ede05a6fd Adding email verification
* Adding mail verification during account registration
* Added new dist file option for mail verification
* Added account confirmation page using tokens
* Added mail class into user class for password resets
* Moved password reset template
* Adjusted account registration page
* Adjusted user class for email confirmation

Also fixed a bug with smarty_cache_key not being used properly if smarty
is disabled. Key still needs to be available even if caching is disabled

Addresses #330 and prepare the ticket for invitation only system.
2013-07-15 12:26:31 +02:00
Sebastian Grewe
29d5d36a7e WiP for one time tokens
* Added token type class
* Storing Token Type as ID not varchar
* Added new system to user class and fixed issues with it
* Started on mail verification process in user class
* Updated autoloader
* Updated change password template

Addresses #330
2013-07-15 12:26:31 +02:00
Sebastian Grewe
253d6e8a47 Fixing username regexp during registration
Fixes wrong regext of #453
2013-07-14 21:08:03 +02:00
Sebastian Grewe
15753f5eca Merge pull request #455 from typal/issue-452
fucked up...
2013-07-14 01:15:21 -07:00
typ
ed5e320ff6 fucked up... 2013-07-14 02:43:44 +02:00
Sebastian Grewe
d190866315 Merge pull request #454 from TheSerapher/issue-419
Adding anonymous account support
2013-07-13 10:43:21 -07:00
typ
0775eaf8c1 add check for non alpa/-/_ chars 2013-07-13 16:41:51 +02:00
Sebastian Grewe
8ec1d2cab3 Adding anonymous account support
* Added anonymous flag to accounts table
* Added checkbox for anonymous flag in edit account page
* Updated user class to support new flag
* Updated statistics class to support anonymous and donations
* Updated all templates showing usernames to show anonymous instead
* Added new SQL `ALTER TABLE` file for upgrading the table

Fixes #419 once merged.
2013-07-12 10:33:42 +02:00
Sebastian Grewe
a9ae72cd50 Merge pull request #445 from IainKay/issue-434
Issue 434
2013-07-11 13:06:41 -07:00
Iain Kay
dfbaf621de When destroying a users session on the server we now also remove all session data immediately, rather than relying on garbage collection, and we destroy the cookie on the users browser. 2013-07-11 19:41:50 +00:00
Sebastian Grewe
5b50422675 Fixing XSS for user registration 2013-07-11 15:49:08 +02:00
Sebastian Grewe
307c7ee23f Enforce unique account emails
* display an error if user tries to re-use an email address
* moved SQL files to indicate the order of SQL import
* added unique email index SQL file

This will address #389, still needs email validation.
2013-07-06 17:47:50 +02:00
Sebastian Grewe
9b81d48e72 Fix PHP Warning on user login
While at it, I also extracted the hash function into it's own getHash
method. This will allow easy changes to hashing for string in the
future.

Fixes #382
2013-07-05 22:56:22 +02:00
Sebastian Grewe
8056ce9f87 Adding input check for AP and Donation
Fixes #354
2013-07-04 12:42:03 +02:00
Sebastian Grewe
ce5a8f7240 Fix PHP Warnings on Password Reset page
* Added HTML5 required to username field
* Added empty string check to resetPassword method

Fixes #348
2013-07-03 14:25:14 +02:00
Sebastian Grewe
e1c5761cf4 Fixing strict PHP warnings when registering a user
Fixes #329
2013-07-02 20:59:03 +02:00
Sebastian Grewe
535f13c184 Fixing PHP Warnings in Registration page
* Fix API Key generation not using SALT when creating hash
 * This should not affect existing API keys since hashes are compared
* Fix PHP Warning for RECAPTCHA if disabled

Fixes #328
2013-07-02 10:38:23 +02:00
Sebastian Grewe
7390ca38e5 Enable or Disable maintenance and registrations
This will allow any admin to enable or disable a pool maintenance mode.
Regular users that are still logged in will not be kicked out (yet). New
users that are trying to login and are not admins will be denied access.

Also added registration option to Admin Settings via WebUI. You can now
disable new accounts via web option or configuration setting.

Fixes #259 but also adds an additional feature.
2013-06-30 12:03:46 +02:00
Sebastian Grewe
d4f4b9073f Working jQuery Mobile frontend for mobile devices
* Added mobile device detection PHP library
* Call PHP library to decide which theme to use
* Added theme as a configuration option into global config
 * Selectable Desktop theme (default: mmcFE)
 * Selectable Mobile theme (default: mobile)
 * Disable mobile theme support entirely

**NOTE**: This requires updates to the `global.inc.php` so please check
the dist file and update your config before filing a new issue!

Addresses #25
2013-06-28 13:45:14 +02:00
Sebastian Grewe
d630329055 Display error message to user on failed logins
Warn a user with an error that there have been failed login attempts
for their account. Login errors can be cleared by clicking on the URL in
the message itself.

Fixes #240
2013-06-23 20:58:42 +02:00
Sebastian Grewe
0817befaaa Further cleanup to reduce PHP notice warnings 2013-06-14 13:51:06 +02:00
Sebastian Grewe
5d356b5c4f Adding counter for failed login attempts
* Track failed login attempts of a user
* Reset failed attempts as soon as the login succeeded

Fixes #182
2013-06-13 15:26:23 +02:00
Sebastian Grewe
bfaa0a67ef Enforce session logout if IP address changed
Fixes #179
2013-06-13 13:59:45 +02:00
Sebastian Grewe
6a5f938895 Store Users IP address in accounts after login
Fixes #177
2013-06-13 13:46:32 +02:00
Sebastian Grewe
44851e35df Add admin/lock changes to admin panel
* Add clickable boxes for Admin and Locked status for all users
* Change status via Ajax call, script embedded to the admin page

Fixes #147
2013-06-13 11:36:28 +02:00
Sebastian Grewe
42b6d4b3b2 Adding support for user locking
* Currently no GUI, use DB access to change the row entry
* Upgraded Database table `accounts` with upgrade SQL
* Updated `admin` field to `is_admin` as boolean
* Modified pages, classes, templates to support is_admin and is_locked

Addresses #147
2013-06-13 11:36:28 +02:00
Sebastian Grewe
b1d698e686 Allow users to change their email address
* Added email to account page
* No confirmation required as of yet

Fixes #142
2013-06-10 10:54:57 +02:00
Sebastian Grewe
9e74175ca3 Make email mandatory during registration
Partially addresses #142
2013-06-10 10:45:46 +02:00
Sebastian Grewe
4da9fd2369 Working notification system
* Added things to mail templates
* Modified user password reset call for new mail template
* Added BASEPATH to smarty code to ensure templates are compiled in the
  proper directory
* Updated mail and notification class
* Updated notification cron
* Added notification cron to run-cron list
2013-06-07 15:36:35 +02:00
Sebastian Grewe
6c4fb84ee9 Adding min/max threshold configuration
* Check for min/max values set for auto payouts
* Display error messages to the user
* Sanitize values just in case we fall through the validation
* Updated template and class
* New configuration option added! Update your local configs!

Fixes #108
2013-06-05 09:11:25 +02:00
Sebastian Grewe
065f5e6d16 Adding working user admin panel to query user DB
* Users are all fetched from the DB
* Each user is assigned special stats
 * Hashrate
 * Shares
 * Balance
 * Est. Payout
 * Est. Donation
* Display in sortable and paginated table

This is not well optimized. Each user stats are grabbed individually
via the stats and transaction classes. It would probably make sense to
expand the statistics class to list a full user list with all statistics
available instead to cover this in a single SQL query.
2013-06-04 11:34:22 +02:00
Sebastian Grewe
ed0853202b Initial file import for admin panel
* Added isAdmin to user class
 * Run isAdmin on EACH page to ensure admin status hasn't changed
* Added main page with no content
* Added user query page with basic form, no content
2013-06-04 09:15:55 +02:00
Sebastian Grewe
b5ab1a02fb Adding more in-line documentation and some cleanup 2013-05-30 09:55:21 +02:00
Sebastian Grewe
69b2c2f517 Properly abort API calls if api_key is invalid
* Fixes an issue where any api_key would be validated
* Now returns user ID upon success, aborts script processing with error
  on fail
2013-05-29 12:41:53 +02:00
Sebastian Grewe
2548d4b03d add API key back to account details
Fixes #73.
2013-05-28 15:35:28 +02:00