Revision 1569
Added by darkviper almost 13 years ago
| password.php | ||
|---|---|---|
| 4 | 4 |
* @category frontend |
| 5 | 5 |
* @package account |
| 6 | 6 |
* @author WebsiteBaker Project |
| 7 |
* @copyright 2004-2009, Ryan Djurovich |
|
| 8 |
* @copyright 2009-2011, Website Baker Org. e.V. |
|
| 7 |
* @copyright 2009-2012, Website Baker Org. e.V. |
|
| 9 | 8 |
* @link http://www.websitebaker2.org/ |
| 10 | 9 |
* @license http://www.gnu.org/licenses/gpl.html |
| 11 | 10 |
* @platform WebsiteBaker 2.8.x |
| ... | ... | |
| 20 | 19 |
if(defined('WB_PATH') == false) { die("Cannot access this file directly"); }
|
| 21 | 20 |
|
| 22 | 21 |
// Get entered values |
| 23 |
$current_password = $wb->get_post('current_password');
|
|
| 24 |
$new_password = $wb->get_post('new_password');
|
|
| 25 |
$new_password2 = $wb->get_post('new_password2');
|
|
| 26 |
// Get existing password |
|
| 27 |
$sql = "SELECT `user_id` FROM `".TABLE_PREFIX."users` WHERE `user_id` = ".$wb->get_user_id()." AND `password` = '".md5($current_password)."'"; |
|
| 28 |
$rowset = $database->query($sql); |
|
| 22 |
$iMinPassLength = 6; |
|
| 23 |
$sCurrentPassword = $wb->get_post('current_password');
|
|
| 24 |
$sCurrentPassword = (is_null($sCurrentPassword) ? '' : $sCurrentPassword); |
|
| 25 |
$sNewPassword = $wb->get_post('new_password');
|
|
| 26 |
$sNewPassword = is_null($sNewPassword) ? '' : $sNewPassword; |
|
| 27 |
$sNewPasswordRetyped = $wb->get_post('new_password2');
|
|
| 28 |
$sNewPasswordRetyped= is_null($sNewPasswordRetyped) ? '' : $sNewPasswordRetyped; |
|
| 29 |
// Check existing password |
|
| 30 |
$sql = 'SELECT `password` '; |
|
| 31 |
$sql .= 'FROM `'.TABLE_PREFIX.'users` '; |
|
| 32 |
$sql .= 'WHERE `user_id` = '.$wb->get_user_id(); |
|
| 29 | 33 |
// Validate values |
| 30 |
if($rowset->numRows() == 0) {
|
|
| 31 |
$error[] = $MESSAGE['PREFERENCES']['CURRENT_PASSWORD_INCORRECT'];
|
|
| 34 |
if (md5($sCurrentPassword) != $database->get_one($sql)) {
|
|
| 35 |
$error[] = $MESSAGE['PREFERENCES_CURRENT_PASSWORD_INCORRECT'];
|
|
| 32 | 36 |
}else {
|
| 33 |
if(strlen($new_password) < 3) {
|
|
| 34 |
$error[] = $MESSAGE['USERS']['PASSWORD_TOO_SHORT'];
|
|
| 37 |
if(strlen($sNewPassword) < $iMinPassLength) {
|
|
| 38 |
$error[] = $MESSAGE['USERS_PASSWORD_TOO_SHORT'];
|
|
| 35 | 39 |
}else {
|
| 36 |
if($new_password != $new_password2) {
|
|
| 37 |
$error[] = $MESSAGE['USERS']['PASSWORD_MISMATCH'];
|
|
| 40 |
if($sNewPassword != $sNewPasswordRetyped) {
|
|
| 41 |
$error[] = $MESSAGE['USERS_PASSWORD_MISMATCH'];
|
|
| 38 | 42 |
}else {
|
| 39 |
// MD5 the password |
|
| 40 |
$md5_password = md5($new_password); |
|
| 43 |
$pattern = '/[^'.$wb->password_chars.']/'; |
|
| 44 |
if (preg_match($pattern, $sNewPassword)) {
|
|
| 45 |
$error[] = $MESSAGE['PREFERENCES_INVALID_CHARS']; |
|
| 46 |
}else {
|
|
| 47 |
// generate new password hash |
|
| 48 |
$sPwHashNew = md5($sNewPassword); |
|
| 41 | 49 |
// Update the database |
| 42 |
$sql = "UPDATE `".TABLE_PREFIX."users` SET `password` = '".$md5_password."' WHERE `user_id` = ".$wb->get_user_id(); |
|
| 43 |
$database->query($sql); |
|
| 44 |
if($database->is_error()) {
|
|
| 45 |
$error[] = $database->get_error(); |
|
| 46 |
} else {
|
|
| 47 |
$success[] = $MESSAGE['PREFERENCES']['PASSWORD_CHANGED']; |
|
| 50 |
$sql = 'UPDATE `'.TABLE_PREFIX.'users` '; |
|
| 51 |
$sql .= 'SET `password`=\''.$sPwHashNew.'\' '; |
|
| 52 |
$sql .= 'WHERE `user_id`='.$wb->get_user_id(); |
|
| 53 |
if ($database->query($sql)) {
|
|
| 54 |
$success[] = $MESSAGE['PREFERENCES_PASSWORD_CHANGED']; |
|
| 55 |
}else {
|
|
| 56 |
$error[] = $database->get_error(); |
|
| 57 |
} |
|
| 48 | 58 |
} |
| 49 | 59 |
} |
| 50 | 60 |
} |
Also available in: Unified diff
possible errors on 'save password' fixed. Minimum length of password set to 6 chars