ShaYmez/FreeSTAR-Status-Engine
1
0
Fork 0
mirror of https://github.com/ShaYmez/FreeSTAR-Status-Engine.git synced 2025-11-03 20:20:20 -05:00
Code Issues Projects Releases Wiki Activity

Fix lost password change

Browse Source
This commit is contained in:
Vojtěch Sajdl 2017-11-29 15:32:40 +01:00
parent 392d1f4019
commit 13b1f00590
No known key found for this signature in database
GPG Key ID: 082BC82518E5F32E
2 changed files with 5 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
classes/token.php
View File

@ -16,15 +16,14 @@ class Token
return $token; return $token;
} }
public static function validate_token($token, $user, $data) public static function validate_token($token, $id, $data)
{ {
global $mysqli; global $mysqli;
$time = time(); $time = time();
$stmt = $mysqli->prepare("SELECT count(*) as count, data FROM tokens WHERE token = ? AND user = ? AND expire>=? AND data LIKE ?"); $stmt = $mysqli->prepare("SELECT count(*) as count FROM tokens WHERE token = ? AND user = ? AND expire>=? AND data LIKE ?");
$stmt->bind_param("siis", $token, $id, $time, $data); $stmt->bind_param("siis", $token, $id, $time, $data);
$stmt->execute(); $stmt->execute();
$query = $stmt->get_result(); $query = $stmt->get_result();
return $query->fetch_assoc()['count']; return $query->fetch_assoc()['count'];
} }

25
classes/user.php
View File

@ -356,7 +356,6 @@ class User
$stmt->bind_param("i", $id); $stmt->bind_param("i", $id);
$stmt->execute(); $stmt->execute();
$query = $stmt->get_result(); $query = $stmt->get_result();
$result = $query->fetch_assoc(); $result = $query->fetch_assoc();
$salt = $result['salt']; $salt = $result['salt'];
$pass = $_POST['password']; $pass = $_POST['password'];
@ -389,10 +388,8 @@ class User
$id = $query->fetch_assoc()['id']; $id = $query->fetch_assoc()['id'];
$time = strtotime('+1 day', time()); $time = strtotime('+1 day', time());
$salt = uniqid(mt_rand(), true);
$token = hash('sha256', $id.$salt);
Token::new($id, 'passwd', $time); $token = Token::new($id, 'passwd', $time);
$link = WEB_URL."/admin/?do=lost-password&id=$id&token=$token"; $link = WEB_URL."/admin/?do=lost-password&id=$id&token=$token";
$to = $email; $to = $email;
@ -409,27 +406,11 @@ class User
public function email_link(){ public function email_link(){
global $mysqli; global $mysqli;
$email = trim($_POST['email']); $email = $_POST['email'];
$time = strtotime('+1 day', time()); $time = strtotime('+1 day', time());
$salt = uniqid(mt_rand(), true);
$id = $this->id; $id = $this->id;
$token = hash('sha256', $id.$salt);
$stmt = $mysqli->prepare("SELECT count(*) as count FROM users WHERE email=?"); $token = Token::new($id, 'email;$email', $time);
$stmt->bind_param("s", $email);
$stmt->execute();
$query = $stmt->get_result();
$count = $query->fetch_assoc()['count'];
if ($count)
{
$message = "This email is already used.";
return;
}
Token::new($id, 'email;$email', $time);
$link = WEB_URL."/admin/?do=change-email&id=$id&token=$token"; $link = WEB_URL."/admin/?do=change-email&id=$id&token=$token";