lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-18 18:44:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

users: prompt for old password to avoid account hijacking

Browse Source
This commit is contained in:
Franco Fichtner 2015-06-26 11:59:53 +02:00
parent 1c93f0586c
commit 64d6246a5a
1 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/www/system_usermanager_passwordmg.php
View File

@ -32,22 +32,24 @@ require_once("guiconfig.inc");
$pgtitle = array(gettext("System"),gettext("User Password"));
if (session_status() == PHP_SESSION_NONE) {
session_start();
}
if (isset($_POST['save'])) {
unset($input_errors);
/* input validation */
$reqdfields = explode(" ", "passwordfld1");
$reqdfields = explode(" ", "passwordfld0 passwordfld1 passwordfld2");
$reqdfieldsn = array(gettext("Password"));
do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors);
if ($_POST['passwordfld1'] != $_POST['passwordfld2']) {
if ($_POST['passwordfld1'] != $_POST['passwordfld2'] ||
$config['system']['user'][$userindex[$_SESSION['Username']]]['password'] != crypt($_POST['passwordfld0'], '$6$')) {
$input_errors[] = gettext("The passwords do not match.");
}
if (!$input_errors) {
if (session_status() == PHP_SESSION_NONE) {
session_start();
}
// all values are okay --> saving changes
$config['system']['user'][$userindex[$_SESSION['Username']]]['password'] = crypt($_POST['passwordfld1'], '$6$');
local_user_set($config['system']['user'][$userindex[$_SESSION['Username']]]);
@ -59,10 +61,6 @@ if (isset($_POST['save'])) {
}
}
if (session_status() == PHP_SESSION_NONE) {
session_start();
}
/* determine if user is not local to system */
$islocal = false;
foreach ($config['system']['user'] as $user) {
@ -118,7 +116,13 @@ include("head.inc");
<?php session_write_close(); ?>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Password"); ?></td>
<td width="22%" valign="top" class="vncell"><?=gettext("Old password"); ?></td>
<td width="78%" class="vtable">
<input name="passwordfld0" type="password" class="formfld pwd" id="passwordfld0" size="20" />
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("New password"); ?></td>
<td width="78%" class="vtable">
<input name="passwordfld1" type="password" class="formfld pwd" id="passwordfld1" size="20" />
</td>