Friendica/friendica
Friendica/friendica
1
0
Fork 1
mirror of https://git.friendi.ca/friendica/friendica.git synced 2025-06-17 03:25:15 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #3970 from MrPetovan/task/3942-add-user-authenticate

Browse source 
Migrate password hashing Part 1: Add User::authenticate
This commit is contained in:
Michael Vogel 2017-11-27 15:14:36 +01:00 • committed by GitHub
commit 3f448d9a42
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
13 changed files with 205 additions and 268 deletions
Download patch file Download diff file Expand all files Collapse all files

3
mod/openid.php
View file

@ -33,7 +33,8 @@ function openid_content(App $a) {
// mod/settings.php in 8367cad so it might have left mixed
// records in the user table
//
$r = q("SELECT *, `user`.`pubkey` as `upubkey`, `user`.`prvkey` as `uprvkey` FROM `user`
$r = q("SELECT *
FROM `user`
WHERE ( `openid` = '%s' OR `openid` = '%s' )
AND `blocked` = 0 AND `account_expired` = 0
AND `account_removed` = 0 AND `verified` = 1

24
mod/removeme.php
View file

@ -4,21 +4,21 @@ use Friendica\App;
use Friendica\Core\System;
use Friendica\Model\User;
function removeme_post(App $a) {
if (! local_user()) {
function removeme_post(App $a)
{
if (!local_user()) {
return;
}
if (x($_SESSION,'submanage') && intval($_SESSION['submanage'])) {
if (x($_SESSION, 'submanage') && intval($_SESSION['submanage'])) {
return;
}
if ((! x($_POST,'qxz_password')) || (! strlen(trim($_POST['qxz_password'])))) {
if ((!x($_POST, 'qxz_password')) || (!strlen(trim($_POST['qxz_password'])))) {
return;
}
if ((! x($_POST,'verify')) || (! strlen(trim($_POST['verify'])))) {
if ((!x($_POST, 'verify')) || (!strlen(trim($_POST['verify'])))) {
return;
}
@ -26,18 +26,15 @@ function removeme_post(App $a) {
return;
}
$encrypted = hash('whirlpool',trim($_POST['qxz_password']));
if ((strlen($a->user['password'])) && ($encrypted === $a->user['password'])) {
if (User::authenticate($a->user['uid'], trim($_POST['qxz_password']))) {
User::remove($a->user['uid']);
// NOTREACHED
}
}
function removeme_content(App $a) {
if (! local_user()) {
function removeme_content(App $a)
{
if (!local_user()) {
goaway(System::baseUrl());
}
@ -59,5 +56,4 @@ function removeme_content(App $a) {
));
return $o;
}

13
mod/settings.php
View file

@ -9,6 +9,7 @@ use Friendica\Core\Config;
use Friendica\Core\PConfig;
use Friendica\Database\DBM;
use Friendica\Model\GlobalContact;
use Friendica\Model\User;
require_once 'include/group.php';
@ -371,7 +372,6 @@ function settings_post(App $a) {
$newpass = $_POST['password'];
$confirm = $_POST['confirm'];
$oldpass = hash('whirlpool', $_POST['opassword']);
$err = false;
if ($newpass != $confirm) {
@ -386,8 +386,7 @@ function settings_post(App $a) {
// check if the old password was supplied correctly before
// changing it to the new value
$r = q("SELECT `password` FROM `user`WHERE `uid` = %d LIMIT 1", intval(local_user()));
if ($oldpass != $r[0]['password']) {
if (User::authenticate(intval(local_user()), $_POST['opassword'])) {
notice(t('Wrong password.') . EOL);
$err = true;
}
@ -501,22 +500,20 @@ function settings_post(App $a) {
if ($email != $a->user['email']) {
$email_changed = true;
// check for the correct password
$r = q("SELECT `password` FROM `user`WHERE `uid` = %d LIMIT 1", intval(local_user()));
$password = hash('whirlpool', $_POST['mpassword']);
if ($password != $r[0]['password']) {
if (!User::authenticate(intval(local_user()), $_POST['mpassword'])) {
$err .= t('Wrong Password') . EOL;
$email = $a->user['email'];
}
// check the email is valid
if (!valid_email($email)) {
$err .= t(' Not valid email.');
$err .= t('Invalid email.');
}
// ensure new email is not the admin mail
//if ((x($a->config, 'admin_email')) && (strcasecmp($email, $a->config['admin_email']) == 0)) {
if (x($a->config, 'admin_email')) {
$adminlist = explode(",", str_replace(" ", "", strtolower($a->config['admin_email'])));
if (in_array(strtolower($email), $adminlist)) {
$err .= t(' Cannot change to that email.');
$err .= t('Cannot change to that email.');
$email = $a->user['email'];
}
}