-
Notifications
You must be signed in to change notification settings - Fork 4
/
_changePassword.php
106 lines (82 loc) · 3.4 KB
/
_changePassword.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
<?php
/*
Copyright 2020 FWBer.com
This file is part of FWBer.
FWBer is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
FWBer is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero Public License for more details.
You should have received a copy of the GNU Affero Public License
along with FWBer. If not, see <https://www.gnu.org/licenses/>.
*/
session_start();
include("_init.php");
include("_debug.php");
include("_names.php");
if($_SERVER["REQUEST_METHOD"] != "POST"){header('Location: '.getSiteURL());exit();}
include("_profileVars.php");
include("_secrets.php");
include("_globals.php");
include("_emailFunctions.php");
if(validateSessionOrCookiesReturnLoggedIn()==false){header('Location: '.getSiteURL());return;}//full auth for actions
goHomeIfCookieNotSet();
$db = mysqli_connect($dburl,$dbuser,$dbpass);
if(!$db)exit(mysqli_connect_error());
if(!isset($_POST['oldPass'])||empty($_POST['oldPass']))exit('oldPass'); else $oldPass= mysqli_escape_string($db,$_POST['oldPass']);
if(!isset($_POST['newPass'])||empty($_POST['newPass']))exit('newPass'); else $newPass= mysqli_escape_string($db,$_POST['newPass']);
if(!isset($_POST['verifyPass'])||empty($_POST['verifyPass']))exit('verifyPass'); else $verifyPass= mysqli_escape_string($db,$_POST['verifyPass']);
if($newPass!=$verifyPass)exit("Passwords don't match");
//authenticate old pass
$email = mysqli_escape_string($db,$_SESSION["email"]);
$dbquerystring = sprintf("SELECT passwordHash, dateJoined, dateLastSignedIn FROM ".$dbname.".users WHERE email='%s'",$email);
$dbquery = mysqli_query($db,$dbquerystring);
$dbresults = mysqli_fetch_array($dbquery);
mysqli_free_result($dbquery);
$message = "";
if(
$dbresults==null
||$dbresults['passwordHash']==null
||getSaltedPassword($oldPass,$dbresults['dateJoined'])!=$dbresults['passwordHash']
)
{
$message = "Old password was wrong.";
}
if($message=="")
{
$dateJoined = $dbresults['dateJoined'];
//set new pass hash in database
$dbquerystring =
sprintf("UPDATE ".$dbname.".users SET passwordHash = '%s' WHERE email='%s'",
getSaltedPassword($newPass,$dateJoined),
$email
);
if(!mysqli_query($db,$dbquerystring))exit("didn't work");
//delete cookies
setcookie("email","",time()-1000,'/',".".getSiteDomain());
setcookie("token","",time()-1000,'/',".".getSiteDomain());
session_destroy();
mysqli_close($db);
$message = "Password changed. Please sign in using your new password.";
}
?>
<!doctype html>
<html lang="en">
<head>
<title><?php require_once("_names.php"); echo getSiteName(); ?> - Change Password<?php require_once("_names.php"); echo getTitleTagline(); ?></title>
<?php include("head.php");?>
</head>
<body class="d-flex flex-column h-100">
<?php include("h.php");?>
<div id="mainbody" align="center">
<br><br><br>
<div style="font-size:14px;">
<?php echo $message; ?>
</div>
</div>
<?php include("f.php");?>
</body>
</html>