Browse Source
Allows a user or admin to reset his/her forgotten password with a code sent by email/SMS #18
pull/18/head
Allows a user or admin to reset his/her forgotten password with a code sent by email/SMS #18
pull/18/head
Sylvain Tissot
9 years ago
17 changed files with 376 additions and 2 deletions
-
20config.inc.php
-
17functions.inc.php
-
15languages/en.lang
-
16languages/fr.lang
-
1login.php
-
4model/AdminHandler.php
-
2model/MailboxHandler.php
-
1password-change.php
-
1password-recover.php
-
2templates/index.tpl
-
3templates/login.tpl
-
28templates/password-change.tpl
-
26templates/password-recover.tpl
-
13upgrade.php
-
1users/login.php
-
104users/password-change.php
-
124users/password-recover.php
@ -0,0 +1 @@ |
|||
users/password-change.php |
|||
@ -0,0 +1 @@ |
|||
users/password-recover.php |
|||
@ -0,0 +1,28 @@ |
|||
<div id="edit_form"> |
|||
<form name="mailbox" method="post"> |
|||
<table> |
|||
<tr> |
|||
<td colspan="3"><h3>{$PALANG.pPassword_welcome}</h3></td> |
|||
</tr> |
|||
<tr> |
|||
<td>{$PALANG.pLogin_username} :</td> |
|||
<td><input class="flat" type="text" name="fUsername" value="{$tUsername}" /></td> |
|||
</tr> |
|||
<tr> |
|||
<td>{$PALANG.pPassword_password_code} :</td> |
|||
<td><input class="flat" type="text" name="fCode" value="{$tCode}" /></td> |
|||
</tr> |
|||
<tr> |
|||
<td>{$PALANG.pPassword_password} :</td> |
|||
<td><input class="flat" type="password" name="fPassword" /></td> |
|||
</tr> |
|||
<tr> |
|||
<td>{$PALANG.pPassword_password2} :</td> |
|||
<td><input class="flat" type="password" name="fPassword2" /></td> |
|||
</tr> |
|||
<tr> |
|||
<td colspan="2" class="hlp_center"><input class="button" type="submit" name="submit" value="{$PALANG.change_password}" /></td> |
|||
</tr> |
|||
</table> |
|||
</form> |
|||
</div> |
|||
@ -0,0 +1,26 @@ |
|||
<div id="edit_form"> |
|||
<form name="frmPassword" method="post" action=""> |
|||
<table> |
|||
<tr> |
|||
<th colspan="3">{$PALANG.pPassword_recovery_title}</th> |
|||
</tr> |
|||
<tr> |
|||
<td class="label"><label>{$PALANG.pLogin_username}:</label></td> |
|||
<td><input class="flat" type="text" name="fUsername" /></td> |
|||
</tr> |
|||
<tr> |
|||
<td class="label"> </td> |
|||
<td colspan="2"> |
|||
<input class="button" type="submit" name="submit" value="{$PALANG.pPassword_recovery_button}" /> |
|||
</td> |
|||
</tr> |
|||
</table> |
|||
</form> |
|||
{literal} |
|||
<script type="text/javascript"> |
|||
<!-- |
|||
document.frmPassword.fUsername.focus(); |
|||
// --> |
|||
</script> |
|||
{/literal} |
|||
</div> |
|||
@ -0,0 +1,104 @@ |
|||
<?php |
|||
/** |
|||
* Postfix Admin |
|||
* |
|||
* LICENSE |
|||
* This source file is subject to the GPL license that is bundled with |
|||
* this package in the file LICENSE.TXT. |
|||
* |
|||
* Further details on the project are available at http://postfixadmin.sf.net |
|||
* |
|||
* @version $Id$ |
|||
* @license GNU GPL v2 or later. |
|||
* |
|||
* File: password-change.php |
|||
* Used by users and admins to change their forgotten login password. |
|||
* Template File: password-change.tpl |
|||
* |
|||
* Template Variables: |
|||
* |
|||
* tUsername |
|||
* tCode |
|||
* |
|||
* Form POST \ GET Variables: |
|||
* |
|||
* fUsername |
|||
*/ |
|||
|
|||
if (preg_match('/\/users\//', $_SERVER['REQUEST_URI'])) { |
|||
$rel_path = '../'; |
|||
$context = 'users'; |
|||
} else { |
|||
$rel_path = './'; |
|||
$context = 'admin'; |
|||
} |
|||
require_once($rel_path . 'common.php'); |
|||
|
|||
if ($context == 'admin' && !Config::read('forgotten_admin_password_reset') || $context == 'users' && !Config::read('forgotten_user_password_reset')) |
|||
{ |
|||
header('HTTP/1.0 403 Forbidden'); |
|||
exit(0); |
|||
} |
|||
|
|||
if ($_SERVER['REQUEST_METHOD'] == 'GET') |
|||
{ |
|||
$tUsername = safeget('username'); |
|||
$tCode = safeget('code'); |
|||
} |
|||
|
|||
if ($_SERVER['REQUEST_METHOD'] == 'POST') |
|||
{ |
|||
if(safepost('fCancel')) { |
|||
header('Location: main.php'); |
|||
exit(0); |
|||
} |
|||
|
|||
$fPassword = safepost('fPassword'); |
|||
$fPassword2 = safepost('fPassword2'); |
|||
|
|||
$tUsername = safepost('fUsername'); |
|||
$tCode = trim(strtoupper(safepost('fCode'))); |
|||
|
|||
if (empty($fPassword) or ($fPassword != $fPassword2)) { |
|||
$error = true; |
|||
flash_error(Config::lang('pPassword_password_text_error')); |
|||
} elseif (trim(strtoupper($tCode) != getPasswordRecoveryCode($tUsername))) { |
|||
flash_error(Config::lang('pPassword_code_text_error')); |
|||
} else { |
|||
session_regenerate_id(); |
|||
$_SESSION['sessid']['username'] = $tUsername; |
|||
if ($context == 'users') { |
|||
$_SESSION['sessid']['roles'][] = 'user'; |
|||
$handler = new MailboxHandler; |
|||
} else { |
|||
$_SESSION['sessid']['roles'][] = 'admin'; |
|||
$handler = new AdminHandler; |
|||
} |
|||
if (!$handler->init($tUsername)) { |
|||
flash_error($handler->errormsg); |
|||
} else { |
|||
$values = $handler->result; |
|||
$values[$handler->getId_field()] = $tUsername; |
|||
$values['password'] = $fPassword; |
|||
$values['password2'] = $fPassword2; |
|||
if ($handler->set($values) && $handler->store()) { |
|||
flash_info(Config::lang_f('pPassword_result_success', $tUsername)); |
|||
header('Location: ' . dirname($_SERVER['REQUEST_URI']) . '/main.php'); |
|||
exit(0); |
|||
} else { |
|||
foreach($handler->errormsg as $msg) { |
|||
flash_error($msg); |
|||
} |
|||
} |
|||
} |
|||
} |
|||
} |
|||
|
|||
$smarty->assign ('language_selector', language_selector(), false); |
|||
$smarty->assign('tUsername', @$tUsername); |
|||
$smarty->assign('tCode', @$tCode); |
|||
$smarty->assign ('smarty_template', 'password-change'); |
|||
$smarty->display ('index.tpl'); |
|||
|
|||
/* vim: set expandtab softtabstop=4 tabstop=4 shiftwidth=4: */ |
|||
?>
|
|||
@ -0,0 +1,124 @@ |
|||
<?php |
|||
/** |
|||
* Postfix Admin |
|||
* |
|||
* LICENSE |
|||
* This source file is subject to the GPL license that is bundled with |
|||
* this package in the file LICENSE.TXT. |
|||
* |
|||
* Further details on the project are available at http://postfixadmin.sf.net |
|||
* |
|||
* @version $Id$ |
|||
* @license GNU GPL v2 or later. |
|||
* |
|||
* File: password-recover.php |
|||
* Used by users and admins to recover their forgotten login password. |
|||
* Template File: password-recover.tpl |
|||
* |
|||
* Template Variables: |
|||
* |
|||
* none |
|||
* |
|||
* Form POST \ GET Variables: |
|||
* |
|||
* fUsername |
|||
*/ |
|||
|
|||
|
|||
if (preg_match('/\/users\//', $_SERVER['REQUEST_URI'])) { |
|||
$rel_path = '../'; |
|||
$context = 'users'; |
|||
} else { |
|||
$rel_path = './'; |
|||
$context = 'admin'; |
|||
} |
|||
require_once($rel_path . 'common.php'); |
|||
|
|||
if ($context == 'admin' && !Config::read('forgotten_admin_password_reset') || $context == 'users' && !Config::read('forgotten_user_password_reset')) |
|||
{ |
|||
header('HTTP/1.0 403 Forbidden'); |
|||
exit(0); |
|||
} |
|||
|
|||
function sendCodebyEmail($to, $username, $code) |
|||
{ |
|||
$fHeaders = "To: " . $to . PHP_EOL; |
|||
$fHeaders .= "From: " . Config::read('admin_email') . PHP_EOL; |
|||
$fHeaders .= "Subject: " . encode_header(Config::Lang('pPassword_welcome')) . PHP_EOL; |
|||
$fHeaders .= "MIME-Version: 1.0" . PHP_EOL; |
|||
$fHeaders .= "Content-Type: text/plain; charset=utf-8" . PHP_EOL; |
|||
$fHeaders .= "Content-Transfer-Encoding: 8bit" . PHP_EOL . PHP_EOL; |
|||
|
|||
$url = $_SERVER['REQUEST_SCHEME'] . '://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['REQUEST_URI']) . '/password-change.php?username=' . urlencode($username) . '&code=' . $code; |
|||
$fHeaders .= Config::lang_f('pPassword_recovery_email_body', $url); |
|||
|
|||
return smtp_mail($to, Config::read('admin_email') , $fHeaders); |
|||
} |
|||
|
|||
function sendCodebySMS($to, $username, $code) |
|||
{ |
|||
$text = Config::lang_f('pPassword_recovery_sms_body', $code); |
|||
|
|||
$url = 'https://api.clickatell.com/http/sendmsg?api_id=' . Config::read('clickatell_api_id') . '&user=' . Config::read('clickatell_user') . '&password=' . Config::read('clickatell_password') . "&to=$to" . '&from=' . Config::read('clickatell_sender') . '&text=' . urlencode($text); |
|||
|
|||
$result = file_get_contents($url); |
|||
|
|||
return $result !== false; |
|||
} |
|||
|
|||
if ($_SERVER['REQUEST_METHOD'] == "POST") |
|||
{ |
|||
$tUsername = escape_string (safepost('fUsername')); |
|||
$table = table_by_key($context == 'users' ? 'mailbox' : 'admin'); |
|||
$result = db_query("SELECT * FROM `$table` WHERE username='$tUsername'"); |
|||
$eMessage = ''; |
|||
if ($result['rows'] == 1) |
|||
{ |
|||
$row = db_array($result['result']); |
|||
$code = getPasswordRecoveryCode($tUsername); |
|||
|
|||
$email_other = trim($row['email_other']); |
|||
$phone = trim($row['phone']); |
|||
|
|||
// An active session is required to propagate flash messages to redirected page
|
|||
if ($email_other) |
|||
{ |
|||
// send email
|
|||
if (sendCodeByEmail($email_other, $tUsername, $code)) |
|||
{ |
|||
flash_info(Config::Lang('pPassword_recovery_email_sent') . ' ' . $email_other); |
|||
} |
|||
} |
|||
|
|||
if ($phone) |
|||
{ |
|||
// send phone
|
|||
if (sendCodeBySMS($phone, $tUsername, $code)) |
|||
{ |
|||
flash_info(Config::Lang('pPassword_recovery_sms_sent') . ' ' . $phone); |
|||
} |
|||
} |
|||
|
|||
if ($email_other || $phone) |
|||
{ |
|||
// session_regenerate_id();
|
|||
header("Location: password-change.php?username=" . $tUsername); |
|||
exit(0); |
|||
} |
|||
else |
|||
{ |
|||
flash_error(Config::Lang('pPassword_recovery_no_alternative')); |
|||
} |
|||
} |
|||
else |
|||
{ |
|||
flash_error(Config::Lang('pCreate_mailbox_username_text_error1')); |
|||
} |
|||
} |
|||
|
|||
$smarty->assign ('language_selector', language_selector(), false); |
|||
$smarty->assign ('smarty_template', 'password-recover'); |
|||
$smarty->display ('index.tpl'); |
|||
|
|||
/* vim: set expandtab softtabstop=4 tabstop=4 shiftwidth=4: */ |
|||
?>
|
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue