diff --git a/Rocksolid_Light/common/changepw.php b/Rocksolid_Light/common/changepw.php deleted file mode 100644 index 6f056ba..0000000 --- a/Rocksolid_Light/common/changepw.php +++ /dev/null @@ -1,140 +0,0 @@ -'; - echo ''; - echo '
'; - echo ''; - echo 'Change Password '; - echo ''; - echo 'Username:'; - echo ''; - echo ''; - echo 'Current Password:'; - echo ''; - echo ''; - echo 'New Password:'; - echo ''; - echo ''; - echo 'Re-enter Password:'; - echo ''; - echo ''; - echo ''; - echo ''; - echo ''; - echo ' '; - echo ''; - echo '
'; - exit(0); -} - -# $hostname: '{POPaddress:port/pop3}INBOX' -$hostname = '{rocksolidbbs:110/pop3}INBOX'; -# $external: Using external POP auth? -$external = 0; -# $workpath: Where to cache users (must be writable by calling program) -$workpath = $config_dir."users/"; -$keypath = $config_dir."userconfig/"; - -$ok = FALSE; -$command = "Login"; - -$current = $_POST['current']; -$username = $_POST['username']; -$password = $_POST['password']; -$command = $_POST['command']; - -echo '
'; - -$thisusername = $username; -$username = strtolower($username); -$userFilename = $workpath.$username; -$keyFilename = $keypath.$username; - -# Check all input -if (empty($_POST['username'])) { - echo "Please enter a Username\r\n"; - echo '
Back'; - exit(2); -} - -if (!check_bbs_auth($username, $current)) { - echo "Failed to authenticate\r\n"; - echo '
Back'; - exit(2); -} - -if ($_POST['password'] !== $_POST['password2']) { - echo "Your passwords entered do not match\r\n"; - echo '
Back'; - exit(2); -} - -$ok=true; -# User is authenticated or to be created. Either way, create the file -if ($ok || ($command == "Change") ) -{ - if ($userFileHandle = @fopen($userFilename, 'w+')) - { - fwrite($userFileHandle, password_hash($password, PASSWORD_DEFAULT)); - fclose($userFileHandle); - chmod($userFilename, 0666); - } - - echo "User:".$thisusername." Password changed\r\n"; - echo '
Back'; - exit(0); -} else { - echo "Authentication Failed\r\n"; - exit(1); -} - -function make_key($username) { - $key = openssl_random_pseudo_bytes(44); - return base64_encode($key); -} - -function check_bbs_auth($username, $password) { - global $config_dir; - $workpath = $config_dir."users/"; - $username = strtolower($username); - $userFilename = $workpath.$username; - - if ($userFileHandle = @fopen($userFilename, 'r')) - { - $userFileInfo = fread($userFileHandle, filesize($userFilename)); - fclose($userFileHandle); - if (password_verify ( $password , $userFileInfo)) - { - touch($userFilename); - $ok = TRUE; - } else { - $ok = FALSE; - } - } else { - $ok = FALSE; - } - if ($ok) - { - return TRUE; - } else { - return FALSE; - } -} -?> - - diff --git a/Rocksolid_Light/common/register.php b/Rocksolid_Light/common/register.php index ea7ef22..1267bb2 100644 --- a/Rocksolid_Light/common/register.php +++ b/Rocksolid_Light/common/register.php @@ -49,16 +49,16 @@ if (! isset($_POST['command'])) { echo ''; echo 'Register Username '; echo ''; - echo 'Username:'; + echo 'Username: '; echo ''; echo ''; - echo 'Email:'; + echo 'Email: '; echo ''; echo ''; - echo 'Password:'; + echo 'Password: '; echo ''; echo ''; - echo 'Re-enter Password:'; + echo 'Re-enter Password: '; echo ''; echo ''; echo ''; @@ -72,7 +72,6 @@ if (! isset($_POST['command'])) { echo ' '; echo ''; echo ''; - echo 'Change current password'; echo ''; echo ''; echo ''; diff --git a/Rocksolid_Light/spoolnews/user.php b/Rocksolid_Light/spoolnews/user.php index 000de9b..3394731 100644 --- a/Rocksolid_Light/spoolnews/user.php +++ b/Rocksolid_Light/spoolnews/user.php @@ -12,7 +12,7 @@ if (isset($_POST['command']) && $_POST['command'] == 'Logout') { $_SESSION = array(); session_destroy(); unset($_COOKIE['mail_name']); - setcookie('mail_name', '', -1, '/'); + setcookie('mail_name', '', - 1, '/'); $logmeout = true; } else { $logmeout = false; @@ -204,8 +204,14 @@ if ($_POST['command'] != 'Configuration' && $_POST['command'] != 'SaveConfig') { echo "

" . $golink . "

"; echo '
'; } + // Apply Config if (isset($_POST['command']) && $_POST['command'] == 'SaveConfig') { + // Confirm password + if (! check_bbs_auth($user, $_POST['confirm_password'])) { + $message = 'Password Incorrect
Please try again'; + retry_configuration($message); + } if ($OVERRIDES['disable_change_name'] != true) { if (trim($_POST['display_name']) == '') { $_POST['display_name'] = $user; @@ -223,67 +229,59 @@ if (isset($_POST['command']) && $_POST['command'] == 'SaveConfig') { $value = false; } } - if(isset($OVERRIDES['reserved_names'])) { - $reserved_names = $OVERRIDES['reserved_names']; + if (isset($OVERRIDES['reserved_names'])) { + $reserved_names = $OVERRIDES['reserved_names']; } else { - $reserved_names = array("admin", "sysop"); + $reserved_names = array( + "admin", + "sysop" + ); } - if(isset($OVERRIDES['duplicate_aliases'])) { + if (isset($OVERRIDES['duplicate_aliases'])) { $dupe_ok = $OVERRIDES['duplicate_aliases']; } else { $dupe_ok = false; - } - foreach($reserved_names as $name) { - if(strtolower($_POST['display_name']) == strtolower($name)) { + } + foreach ($reserved_names as $name) { + if (strtolower($_POST['display_name']) == strtolower($name)) { // It's a reserved alias - echo '' . $_POST['display_name'] . " is unavailable.
Please try again"; - echo '
'; - echo ''; - echo ""; - echo ''; - exit(); + $message = '' . $_POST['display_name'] . " is unavailable.
Please try again"; + retry_configuration($message); } } if ($value && (strtolower($_POST['display_name']) != $user)) { // It's someone else's username or alias - echo '' . $_POST['display_name'] . " is unavailable.
Please try again"; - echo ''; - echo ''; - echo ""; - echo ''; - exit(); + $message = '' . $_POST['display_name'] . " is unavailable.
Please try again"; + retry_configuration($message); } // Validate email format if (filter_var($_POST['display_email'], FILTER_VALIDATE_EMAIL) == false) { // Email address format invalid. Format is important but does not need to be a real address - echo ' Display email format appears incorrect:
' . $_POST['display_email'] . '
Please try again'; - echo ''; - echo ''; - echo ""; - echo ''; - exit(); + $message = ' Display email format appears incorrect:
' . $_POST['display_email'] . '
Please try again'; + retry_configuration($message); } // Check if email already exists in user database if ($founduser = check_registered_email_addresses(trim($_POST['display_email']))) { // Email exists in database if (strtolower($user) != strtolower($founduser)) { // It's someone else's email - echo '' . $_POST['display_email'] . " is unavailable.
Please try again"; - echo ''; - echo ''; - echo ""; - echo ''; - exit(); + $message = '' . $_POST['display_email'] . " is unavailable.
Please try again"; + retry_configuration($message); } } + // New passwords do not match + if ($_POST['password'] !== $_POST['password2']) { + $message = ' New password entries do not match
Please try again'; + retry_configuration($message); + } $user_config['display_name'] = trim($_POST['display_name']); $user_config['display_email'] = trim($_POST['display_email']); // Apply alias into $config_dir/aliases_conf - if(strtolower($user_config['display_name'] != strtolower($_POST['username']))) { + if (strtolower($user_config['display_name'] != strtolower($_POST['username']))) { $value_unique = true; - if($dupe_ok) { - foreach($dupe_ok as $dupe) { - if($dupe == strtolower($_POST['username'])) { + if ($dupe_ok) { + foreach ($dupe_ok as $dupe) { + if ($dupe == strtolower($_POST['username'])) { $value_unique = false; break; } @@ -295,7 +293,7 @@ if (isset($_POST['command']) && $_POST['command'] == 'SaveConfig') { $user_config['signature'] = $_POST['signature']; $user_config['xface'] = $_POST['xface']; $user_config['timezone'] = $_POST['timezone']; - $user_config['theme'] = $_POST['listbox']; + $user_config['theme'] = $_POST['theme']; $user_config['hide_unsub'] = $_POST['hide_unsub']; file_put_contents($config_dir . '/userconfig/' . $user . '.config', serialize($user_config)); $_SESSION['theme'] = $user_config['theme']; @@ -315,7 +313,13 @@ if (isset($_POST['command']) && $_POST['command'] == 'SaveConfig') { if ($userdata) { ksort($userdata); } - echo 'Configuration Saved for ' . $_POST['username']; + // Save new password + if ((trim($_POST['password']) != '') && ($_POST['password'] == $_POST['password2'])) { + $userFilename = $config_dir . '/users/' . strtolower($user); + file_put_contents($userFilename, password_hash($_POST['password'], PASSWORD_DEFAULT)); + } + + echo '
Configuration Saved for ' . $_POST['username'] . '
'; } else { $user_config = unserialize(file_get_contents($config_dir . '/userconfig/' . $user . '.config')); } @@ -350,6 +354,16 @@ if ($OVERRIDES['disable_change_name'] != true) { } sort($themes); if (isset($_POST['command']) && $_POST['command'] == 'Configuration') { + // Use modifications from retry configuration + if ($_POST['retry'] == "retry") { + $display_name = $_POST['display_name']; + $display_email = $_POST['display_email']; + $user_config['signature'] = $_POST['signature']; + $user_config['xface'] = urldecode($_POST['xface']); + $user_config['hide_unsub'] = $_POST['hide_unsub']; + $user_config['subscribed'] = $_POST['subscribed']; + $user_config['theme'] = $_POST['theme']; + } // Show Config echo '

'; echo ''; @@ -377,13 +391,13 @@ if (isset($_POST['command']) && $_POST['command'] == 'Configuration') { echo ''; echo ''; // Theme - if (isset($user_config['theme'])) { + if (isset($user_config['theme']) && trim($user_config['theme']) != '') { echo ''; } else { echo ''; } echo ''; echo ''; // Subscriptions - if(!isset($user_config['hide_unsub'])) { + if (! isset($user_config['hide_unsub'])) { $user_config['hide_unsub'] = 'show'; } echo ''; echo ''; echo ''; echo ''; + + // User Display Name + echo ''; + echo ''; + echo ''; + // User Display Email + echo ''; + echo ''; + echo ''; + /* * // Timezone * echo ''; * echo ''; * echo ''; */ + // Password confirmation + echo ''; + echo ''; + echo ''; + echo '

Theme: (' . $user_config['theme'] . ')

Theme:

'; - echo ''; foreach ($themes as $theme) { if ($theme == $user_config['theme']) { echo ''; @@ -395,21 +409,21 @@ if (isset($_POST['command']) && $_POST['command'] == 'Configuration') { echo '

Subscriptions:

'; echo ' While viewing section pages:
'; - - if($user_config['hide_unsub'] == 'hide') { + + if ($user_config['hide_unsub'] == 'hide') { echo ''; } else { echo ''; } echo '
'; - - if($user_config['hide_unsub'] == 'show') { + + if ($user_config['hide_unsub'] == 'show') { echo ''; } else { echo ''; @@ -419,20 +433,45 @@ if (isset($_POST['command']) && $_POST['command'] == 'Configuration') { echo '

Subscribed groups:

New password:

'; + echo '

Re-enter new password:

'; + echo '
Timezone offset (+/- hours from UTC):

Current password:

(required)

'; + echo '
'; echo ''; echo 'Cancel'; @@ -444,4 +483,23 @@ if (isset($_POST['command']) && $_POST['command'] == 'Configuration') { echo '
'; } include "tail.inc"; -?> + +function retry_configuration($message) +{ + echo '
'; + echo $message; + echo ''; + echo ''; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ''; + echo '
'; + exit(); +}