108 lines
4.1 KiB
PHP
108 lines
4.1 KiB
PHP
<?php
|
|
|
|
class UserPasswordResetController extends mfBaseController
|
|
{
|
|
protected function indexAction()
|
|
{
|
|
self::redirect("UserPasswordReset", "forgotPassword");
|
|
}
|
|
|
|
protected function forgotPasswordAction()
|
|
{
|
|
$this->layout()->setTemplate("UserPasswordReset/forgot-password");
|
|
}
|
|
|
|
protected function sendResetLinkAction($request)
|
|
{
|
|
$username = $this->db()->escape($request['Username']);
|
|
$res = $this->db()->select(MFUSERTABLE, "*", "username='$username' OR email='$username'");
|
|
|
|
if ($this->db()->num_rows($res)) {
|
|
$user = $this->db()->fetch_object($res);
|
|
$token = bin2hex(random_bytes(32));
|
|
$expires = time() + 3600;
|
|
|
|
$this->db()->update(MFUSERTABLE, array(
|
|
'password_reset_token' => $token,
|
|
'password_reset_expires' => $expires
|
|
), "id=" . (int)$user->id);
|
|
|
|
$resetLink = "https://".MFAPPNAME.".xinon.at/UserPasswordReset/resetPassword?token=" . $token;
|
|
|
|
$email = new Emailnotification();
|
|
$email->setTo($user->email);
|
|
$email->setFrom('noreply@xinon.at','XINON No-Reply');
|
|
$email->setSubject("Passwort zurücksetzen für " . MFAPPNAME_FULL);
|
|
|
|
$textBody = "Hallo " . $user->username . ",\n\n" .
|
|
"Klicke auf den folgenden Link, um dein Passwort zurückzusetzen. Der Link ist eine Stunde gültig.\n\n" .
|
|
$resetLink . "\n\n" .
|
|
"Wenn du diese Anfrage nicht gestellt hast, ignoriere diese E-Mail.\n";
|
|
|
|
$htmlBody = "<h2>Passwort zurücksetzen</h2>" .
|
|
"<p>Hallo " . $user->username . ",</p>" .
|
|
"<p>Klicke auf den folgenden Link, um dein Passwort zurückzusetzen. Der Link ist eine Stunde gültig.</p>" .
|
|
'<p><a href="' . $resetLink . '">Passwort jetzt zurücksetzen</a></p>' .
|
|
"<p>Wenn du diese Anfrage nicht gestellt hast, ignoriere diese E-Mail bitte.</p>";
|
|
|
|
$email->setBody($textBody);
|
|
$email->setHtmlBody($htmlBody);
|
|
$email->send();
|
|
}
|
|
$this->layout()->setTemplate("UserPasswordReset/forgot-password-sent");
|
|
}
|
|
|
|
protected function resetPasswordAction($request)
|
|
{
|
|
if (empty($request['token'])) {
|
|
self::redirect("mfLogin", "index");
|
|
return;
|
|
}
|
|
|
|
$token = $this->db()->escape($request['token']);
|
|
$res = $this->db()->select(MFUSERTABLE, "*", "password_reset_token='$token' AND password_reset_expires > " . time());
|
|
|
|
if (!$this->db()->num_rows($res)) {
|
|
$this->layout()->setTemplate("mfLogin/Index");
|
|
return;
|
|
}
|
|
|
|
$this->layout()->set("token", $token);
|
|
$this->layout()->setTemplate("UserPasswordReset/reset-password");
|
|
}
|
|
|
|
protected function updatePasswordAction($request)
|
|
{
|
|
$token = $this->db()->escape($request['token']);
|
|
$password = $request['Password'];
|
|
$password_confirm = $request['Password_confirm'];
|
|
|
|
if (empty($token) || empty($password) || $password !== $password_confirm) {
|
|
$error="Passwörter stimmen nicht überein oder die Anfrage ist ungültig.";
|
|
$this->layout()->set("error",$error,);
|
|
|
|
$this->layout()->set("token", $token);
|
|
$this->layout()->setTemplate("UserPasswordReset/reset-password");
|
|
return;
|
|
}
|
|
|
|
$res = $this->db()->select(MFUSERTABLE, "*", "password_reset_token='$token' AND password_reset_expires > " . time());
|
|
|
|
if (!$this->db()->num_rows($res)) {
|
|
$this->layout()->setTemplate("mfLogin/Index");
|
|
return;
|
|
}
|
|
|
|
$user = $this->db()->fetch_object($res);
|
|
$new_hash = mfLoginController::generatePasswordHash($password);
|
|
|
|
$this->db()->update(MFUSERTABLE, array(
|
|
'password' => $new_hash,
|
|
'password_reset_token' => NULL,
|
|
'password_reset_expires' => NULL
|
|
), "id=" . (int)$user->id);
|
|
|
|
$this->layout()->setFlash("Dein Passwort wurde erfolgreich geändert. Du kannst dich jetzt einloggen.", "success");
|
|
self::redirect("mfLogin", "index");
|
|
}
|
|
} |