summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--web/html/passreset.php25
-rw-r--r--web/lib/acctfuncs.inc.php34
2 files changed, 37 insertions, 22 deletions
diff --git a/web/html/passreset.php b/web/html/passreset.php
index 69324d1f..cb88e5ab 100644
--- a/web/html/passreset.php
+++ b/web/html/passreset.php
@@ -30,25 +30,10 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir
}
if (empty($error)) {
- $dbh = db_connect();
$salt = generate_salt();
$hash = salted_hash($password, $salt);
- # The query below won't affect any records unless the ResetKey
- # and Email combination is correct and ResetKey is nonempty
- $q = "UPDATE Users
- SET Passwd = '$hash',
- Salt = '$salt',
- ResetKey = ''
- WHERE ResetKey != ''
- AND ResetKey = '".db_escape_string($resetkey)."'
- AND Email = '".db_escape_string($email)."'";
- $result = db_query($q, $dbh);
- if (!mysql_affected_rows($dbh)) {
- $error = __('Invalid e-mail and reset key combination.');
- } else {
- header('Location: passreset.php?step=complete');
- exit();
- }
+
+ $error = password_reset($hash, $salt, $resetkey, $email);
}
} elseif (isset($_POST['email'])) {
$email = $_POST['email'];
@@ -56,11 +41,7 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir
if ($uid != NULL && $uid != 'None') {
# We (ab)use new_sid() to get a random 32 characters long string
$resetkey = new_sid();
- $dbh = db_connect();
- $q = "UPDATE Users
- SET ResetKey = '" . $resetkey . "'
- WHERE ID = " . $uid;
- db_query($q, $dbh);
+ create_resetkey($resetkey, $uid);
# Send email with confirmation link
$body = __('A password reset request was submitted for the account '.
'associated with your e-mail address. If you wish to reset '.
diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php
index ecb9f99c..31c43dbf 100644
--- a/web/lib/acctfuncs.inc.php
+++ b/web/lib/acctfuncs.inc.php
@@ -580,6 +580,40 @@ function add_tu_proposal($agenda, $user, $votelength, $submitteruid, $dbh=NULL)
}
+# Add a reset key for a specific user
+function create_resetkey($resetkey, $uid, $dbh=NULL) {
+ if(!$dbh) {
+ $dbh = db_connect();
+ }
+ $q = "UPDATE Users ";
+ $q.= "SET ResetKey = '" . $resetkey . "' ";
+ $q.= "WHERE ID = " . $uid;
+ db_query($q, $dbh);
+}
+
+# Change a password and save the salt only if reset key and email are correct
+function password_reset($hash, $salt, $resetkey, $email, $dbh=NULL) {
+ if(!$dbh) {
+ $dbh = db_connect();
+ }
+ $q = "UPDATE Users ";
+ $q.= "SET Passwd = '$hash', ";
+ $q.= "Salt = '$salt', ";
+ $q.= "ResetKey = '' ";
+ $q.= "WHERE ResetKey != '' ";
+ $q.= "AND ResetKey = '".db_escape_string($resetkey)."' ";
+ $q.= "AND Email = '".db_escape_string($email)."'";
+ $result = db_query($q, $dbh);
+
+ if (!mysql_affected_rows($dbh)) {
+ $error = __('Invalid e-mail and reset key combination.');
+ return $error;
+ } else {
+ header('Location: passreset.php?step=complete');
+ exit();
+ }
+}
+
function good_passwd($passwd) {
if ( strlen($passwd) >= PASSWD_MIN_LEN ) {
return true;