Skip to content

Commit f681222

Browse files
tbrehmtbrehm
committed
Changed default encryption method for ispconfig controlpanel users from md5 to crypt-md5.
1 parent 7b56208 commit f681222

File tree

11 files changed

+342
-298
lines changed

11 files changed

+342
-298
lines changed

‎interface/web/admin/form/users.tform.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,7 @@
158158
'passwort' => array (
159159
'datatype' => 'VARCHAR',
160160
'formtype' => 'PASSWORD',
161+
'encryption'=> 'CRYPT',
161162
'regex' => '',
162163
'errmsg' => '',
163164
'default' => '',

‎interface/web/client/form/client.tform.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@
119119
'password' => array (
120120
'datatype' => 'VARCHAR',
121121
'formtype' => 'PASSWORD',
122-
'encryption'=> 'MD5',
122+
'encryption'=> 'CRYPT',
123123
'default' => '',
124124
'value' => '',
125125
'separator' => '',

‎interface/web/login/index.php‎

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,8 @@ public function render() {
5858
if(count($_POST) > 0) {
5959

6060
//** Check variables
61-
if(!preg_match("/^[\w\.\-\_]{1,64}$/", $_POST['username'])) $error = 'Username contains unallowed characters or is longer then 64 characters.';
62-
if(!preg_match("/^.{1,64}$/i", $_POST['passwort'])) $error = 'The password length is > 64 characters.';
61+
if(!preg_match("/^[\w\.\-\_]{1,64}$/", $_POST['username'])) $error = $app->lng('user_regex_error');
62+
if(!preg_match("/^.{1,64}$/i", $_POST['passwort'])) $error = $app->lng('pw_error_length');
6363

6464
//** iporting variables
6565
$ip = $app->db->quote(ip2long($_SERVER['REMOTE_ADDR']));
@@ -105,10 +105,29 @@ public function render() {
105105
} else {
106106
if ($loginAs){
107107
$sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and PASSWORT = '". $passwort. "'";
108+
$user = $app->db->queryOneRecord($sql);
108109
} else {
109-
$sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and ( PASSWORT = '".md5($passwort)."' or PASSWORT = password('$passwort') )";
110+
$sql = "SELECT * FROM sys_user WHERE USERNAME = '$username'";
111+
$user = $app->db->queryOneRecord($sql);
112+
if($user && $user['active'] == 1) {
113+
$saved_password = stripslashes($user['passwort']);
114+
if(substr($saved_password,0,3) == '$1$') {
115+
//* The password is crypt-md5 encrypted
116+
$salt = '$1$'.substr($saved_password,3,8).'$';
117+
if(crypt($passwort,$salt) != $saved_password) {
118+
$user = false;
119+
}
120+
} else {
121+
//* The password is md5 encrypted
122+
if(md5($passwort) != $saved_password) {
123+
$user = false;
124+
}
125+
}
126+
} else {
127+
$user = false;
128+
}
110129
}
111-
$user = $app->db->queryOneRecord($sql);
130+
112131
if($user) {
113132
if($user['active'] == 1) {
114133
// User login right, so attempts can be deleted

‎interface/web/login/lib/lang/en.lng‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,18 @@
1-
<?php
2-
3-
$wb[1001] = "Username or Password empty.";
4-
$wb[1002] = "Username or Password wrong.";
5-
$wb[1003] = "User is blocked.";
6-
$wb[1004] = "To many wrong login's, Please retry it after 15 minutes";
7-
$wb['pass_reset_txt'] = 'A new password will be generated and send to your email address if the email address entered below matches the email address in your client settings.';
8-
$wb['pw_reset'] = 'The password has been reset and send to your email address.';
9-
$wb['pw_error'] = 'Username or email address does not match.';
10-
$wb['pw_error_noinput'] = 'Please enter email address and username.';
11-
12-
$wb['pw_reset_mail_msg'] = 'The password to your ISPConfig 3 control panel account has been reset. The new password is: ';
13-
$wb['pw_reset_mail_title'] = 'ISPConfig 3 Control panel password has been reset.';
14-
1+
<?php
2+
3+
$wb[1001] = "Username or Password empty.";
4+
$wb[1002] = "Username or Password wrong.";
5+
$wb[1003] = "User is blocked.";
6+
$wb[1004] = "To many wrong login's, Please retry it after 15 minutes";
7+
$wb['pass_reset_txt'] = 'A new password will be generated and send to your email address if the email address entered below matches the email address in your client settings.';
8+
$wb['pw_reset'] = 'The password has been reset and send to your email address.';
9+
$wb['pw_error'] = 'Username or email address does not match.';
10+
$wb['pw_error_noinput'] = 'Please enter email address and username.';
11+
12+
$wb['pw_reset_mail_msg'] = 'The password to your ISPConfig 3 control panel account has been reset. The new password is: ';
13+
$wb['pw_reset_mail_title'] = 'ISPConfig 3 Control panel password has been reset.';
14+
15+
$wb['user_regex_error'] = 'Username contains unallowed characters or is longer then 64 characters.';
16+
$wb['pw_error_length'] = 'The password length is > 64 characters.';
17+
1518
?>

‎interface/web/login/lib/lang/es.lng‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
1-
<?php
2-
$wb['1001'] = 'Usuario o contraseña vacíos.';
3-
$wb['1002'] = 'Usuario o contraseña incorrectos.';
4-
$wb['1003'] = 'El usuario está bloqueado';
5-
$wb['1004'] = 'Demasiados intentos erroneos, por favor, inténtelo dentro de 15 minutos.';
6-
$wb['pass_reset_txt'] = 'Se generará una nueva contraseña que se le enviará a la cuenta de correo que tiene configurada.';
7-
$wb['pw_reset'] = 'La contraseña ha sido reseteada y enviada a su cuenta de correo.';
8-
$wb['pw_error'] = 'El usuario o la cuenta de correo no coinciden.';
9-
$wb['pw_error_noinput'] = 'Por favor, introduzca la dirección de correo y el nombre de usuario.';
10-
$wb['pw_reset_mail_msg'] = 'La contraseña de su cuenta de panel de control ISPConfig 3 ha sido reseteada. La nueva contraseña es: ';
11-
$wb['pw_reset_mail_title'] = 'La contraseña del panel de control ISPConfig 3 ha sido reseteada.';
12-
?>
1+
<?php
2+
$wb['1001'] = 'Usuario o contraseña vacíos.';
3+
$wb['1002'] = 'Usuario o contraseña incorrectos.';
4+
$wb['1003'] = 'El usuario está bloqueado';
5+
$wb['1004'] = 'Demasiados intentos erroneos, por favor, inténtelo dentro de 15 minutos.';
6+
$wb['pass_reset_txt'] = 'Se generará una nueva contraseña que se le enviará a la cuenta de correo que tiene configurada.';
7+
$wb['pw_reset'] = 'La contraseña ha sido reseteada y enviada a su cuenta de correo.';
8+
$wb['pw_error'] = 'El usuario o la cuenta de correo no coinciden.';
9+
$wb['pw_error_noinput'] = 'Por favor, introduzca la dirección de correo y el nombre de usuario.';
10+
$wb['pw_reset_mail_msg'] = 'La contraseña de su cuenta de panel de control ISPConfig 3 ha sido reseteada. La nueva contraseña es: ';
11+
$wb['pw_reset_mail_title'] = 'La contraseña del panel de control ISPConfig 3 ha sido reseteada.';
12+
$wb['user_regex_error'] = 'Username contains unallowed characters or is longer then 64 characters.';
13+
$wb['pw_error_length'] = 'The password length is > 64 characters.';
14+
?>

‎interface/web/login/lib/lang/fr.lng‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
1-
<?php
2-
$wb['1001'] = 'Nom dutilisateur ou mot de passe vide.';
3-
$wb['1002'] = 'Nom dutilisateur ou mot de passe faux.';
4-
$wb['1003'] = 'Utilisateur bloqu�.';
5-
$wb['1004'] = 'To many wrong logins, Please retry it after 15 minutes';
6-
$wb['pass_reset_txt'] = 'A new password will be generated and send to your email address if the email address entered below matches the email address in your client settings.';
7-
$wb['pw_reset'] = 'The password has been reset and send to your email address.';
8-
$wb['pw_error'] = 'Username or email address does not match.';
9-
$wb['pw_error_noinput'] = 'Please enter email address and username.';
10-
$wb['pw_reset_mail_msg'] = 'The password to your ISPConfig 3 control panel account has been reset. The new password is: ';
11-
$wb['pw_reset_mail_title'] = 'ISPConfig 3 Control panel password has been reset.';
12-
?>
1+
<?php
2+
$wb['1001'] = 'Nom dutilisateur ou mot de passe vide.';
3+
$wb['1002'] = 'Nom dutilisateur ou mot de passe faux.';
4+
$wb['1003'] = 'Utilisateur bloqu�.';
5+
$wb['1004'] = 'To many wrong logins, Please retry it after 15 minutes';
6+
$wb['pass_reset_txt'] = 'A new password will be generated and send to your email address if the email address entered below matches the email address in your client settings.';
7+
$wb['pw_reset'] = 'The password has been reset and send to your email address.';
8+
$wb['pw_error'] = 'Username or email address does not match.';
9+
$wb['pw_error_noinput'] = 'Please enter email address and username.';
10+
$wb['pw_reset_mail_msg'] = 'The password to your ISPConfig 3 control panel account has been reset. The new password is: ';
11+
$wb['pw_reset_mail_title'] = 'ISPConfig 3 Control panel password has been reset.';
12+
$wb['user_regex_error'] = 'Username contains unallowed characters or is longer then 64 characters.';
13+
$wb['pw_error_length'] = 'The password length is > 64 characters.';
14+
?>

‎interface/web/login/lib/lang/it.lng‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
1-
<?php
2-
$wb['1001'] = 'Nome utente o Password vuoti.';
3-
$wb['1002'] = 'Nome utente o Password errati.';
4-
$wb['1003'] = 'Utente bloccato.';
5-
$wb['1004'] = 'Troppi tentativi di login errati, Riprova tra 15 minuti';
6-
$wb['pass_reset_txt'] = 'Una nuova password sarà generata e spedita alla tua email se l`email inserita corrisponde a quella delle impostazioni dell`utente.';
7-
$wb['pw_reset'] = 'La password è stata reimpostata e spedita al tuo indirizzo mail.';
8-
$wb['pw_error'] = 'Nome utente o email non corrispondenti.';
9-
$wb['pw_error_noinput'] = 'Inserisci nome utente e indirizzo email.';
10-
$wb['pw_reset_mail_msg'] = 'La password nel tuo pannello di controllo ISPConfig 3 è stata reimpostata. La nuova password è: ';
11-
$wb['pw_reset_mail_title'] = 'Password del pannello di controllo ISPConfig 3 reimpostata.';
12-
?>
1+
<?php
2+
$wb['1001'] = 'Nome utente o Password vuoti.';
3+
$wb['1002'] = 'Nome utente o Password errati.';
4+
$wb['1003'] = 'Utente bloccato.';
5+
$wb['1004'] = 'Troppi tentativi di login errati, Riprova tra 15 minuti';
6+
$wb['pass_reset_txt'] = 'Una nuova password sarà generata e spedita alla tua email se l`email inserita corrisponde a quella delle impostazioni dell`utente.';
7+
$wb['pw_reset'] = 'La password è stata reimpostata e spedita al tuo indirizzo mail.';
8+
$wb['pw_error'] = 'Nome utente o email non corrispondenti.';
9+
$wb['pw_error_noinput'] = 'Inserisci nome utente e indirizzo email.';
10+
$wb['pw_reset_mail_msg'] = 'La password nel tuo pannello di controllo ISPConfig 3 è stata reimpostata. La nuova password è: ';
11+
$wb['pw_reset_mail_title'] = 'Password del pannello di controllo ISPConfig 3 reimpostata.';
12+
$wb['user_regex_error'] = 'Username contains unallowed characters or is longer then 64 characters.';
13+
$wb['pw_error_length'] = 'The password length is > 64 characters.';
14+
?>

‎interface/web/login/lib/lang/nl.lng‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
1-
<?php
2-
$wb['1001'] = 'Gebruikersnaam of wachtwoord is leeg.';
3-
$wb['1002'] = 'Gebruikersnaam of wachtwoord ongeldig.';
4-
$wb['1003'] = 'Gebruiker is geblokkeerd.';
5-
$wb['1004'] = 'Teveel ongeldige login pogingen, Probeer het na 15 minuten opnieuw.';
6-
$wb['pass_reset_txt'] = 'Een nieuw wachtwoord zal worden gegenereerd en na het hierboven ingevulde Emailadres worden gestuurd, op voorwaarde dat het Emailadres overeenkomt met het Emailadres in uw klanten-settings';
7-
$wb['pw_reset'] = 'Het wachtwoord is gereset en is verzonden aan uw Emailadres.';
8-
$wb['pw_error'] = 'Gebruikersnaam of Emailadres komen niet overeen.';
9-
$wb['pw_error_noinput'] = 'Voer a.u.b. uw Emailadres en gebruikersnaam in.';
10-
$wb['pw_reset_mail_msg'] = 'Het wachtwoord dat toegang biedt tot ISPConfig 3 is gereset. Het nieuwe wachtwoord is: ';
11-
$wb['pw_reset_mail_title'] = 'Het wachtwoord dat toegang biedt tot ISPConfig 3 is gereset.';
12-
?>
1+
<?php
2+
$wb['1001'] = 'Gebruikersnaam of wachtwoord is leeg.';
3+
$wb['1002'] = 'Gebruikersnaam of wachtwoord ongeldig.';
4+
$wb['1003'] = 'Gebruiker is geblokkeerd.';
5+
$wb['1004'] = 'Teveel ongeldige login pogingen, Probeer het na 15 minuten opnieuw.';
6+
$wb['pass_reset_txt'] = 'Een nieuw wachtwoord zal worden gegenereerd en na het hierboven ingevulde Emailadres worden gestuurd, op voorwaarde dat het Emailadres overeenkomt met het Emailadres in uw klanten-settings';
7+
$wb['pw_reset'] = 'Het wachtwoord is gereset en is verzonden aan uw Emailadres.';
8+
$wb['pw_error'] = 'Gebruikersnaam of Emailadres komen niet overeen.';
9+
$wb['pw_error_noinput'] = 'Voer a.u.b. uw Emailadres en gebruikersnaam in.';
10+
$wb['pw_reset_mail_msg'] = 'Het wachtwoord dat toegang biedt tot ISPConfig 3 is gereset. Het nieuwe wachtwoord is: ';
11+
$wb['pw_reset_mail_title'] = 'Het wachtwoord dat toegang biedt tot ISPConfig 3 is gereset.';
12+
$wb['user_regex_error'] = 'Username contains unallowed characters or is longer then 64 characters.';
13+
$wb['pw_error_length'] = 'The password length is > 64 characters.';
14+
?>

‎interface/web/login/lib/lang/se.lng‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
1-
<?php
2-
$wb['1001'] = 'Anv�ndarnamn eller L�senord �r tomt.';
3-
$wb['1002'] = 'Felaktigt Anv�ndarnamn eller L�senord.';
4-
$wb['1003'] = 'Anv�ndaren �r sp�rrad.';
5-
$wb['1004'] = 'To many wrong logins, Please retry it after 15 minutes';
6-
$wb['pass_reset_txt'] = 'A new password will be generated and send to your email address if the email address entered below matches the email address in your client settings.';
7-
$wb['pw_reset'] = 'The password has been reset and send to your email address.';
8-
$wb['pw_error'] = 'Username or email address does not match.';
9-
$wb['pw_error_noinput'] = 'Please enter email address and username.';
10-
$wb['pw_reset_mail_msg'] = 'The password to your ISPConfig 3 control panel account has been reset. The new password is: ';
11-
$wb['pw_reset_mail_title'] = 'ISPConfig 3 Control panel password has been reset.';
12-
?>
1+
<?php
2+
$wb['1001'] = 'Anv�ndarnamn eller L�senord �r tomt.';
3+
$wb['1002'] = 'Felaktigt Anv�ndarnamn eller L�senord.';
4+
$wb['1003'] = 'Anv�ndaren �r sp�rrad.';
5+
$wb['1004'] = 'To many wrong logins, Please retry it after 15 minutes';
6+
$wb['pass_reset_txt'] = 'A new password will be generated and send to your email address if the email address entered below matches the email address in your client settings.';
7+
$wb['pw_reset'] = 'The password has been reset and send to your email address.';
8+
$wb['pw_error'] = 'Username or email address does not match.';
9+
$wb['pw_error_noinput'] = 'Please enter email address and username.';
10+
$wb['pw_reset_mail_msg'] = 'The password to your ISPConfig 3 control panel account has been reset. The new password is: ';
11+
$wb['pw_reset_mail_title'] = 'ISPConfig 3 Control panel password has been reset.';
12+
$wb['user_regex_error'] = 'Username contains unallowed characters or is longer then 64 characters.';
13+
$wb['pw_error_length'] = 'The password length is > 64 characters.';
14+
?>

‎interface/web/login/password_reset.php‎

Lines changed: 87 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -1,78 +1,88 @@
1-
<?php
2-
3-
/*
4-
Copyright (c) 2008, Till Brehm, projektfarm Gmbh
5-
All rights reserved.
6-
7-
Redistribution and use in source and binary forms, with or without modification,
8-
are permitted provided that the following conditions are met:
9-
10-
* Redistributions of source code must retain the above copyright notice,
11-
this list of conditions and the following disclaimer.
12-
* Redistributions in binary form must reproduce the above copyright notice,
13-
this list of conditions and the following disclaimer in the documentation
14-
and/or other materials provided with the distribution.
15-
* Neither the name of ISPConfig nor the names of its contributors
16-
may be used to endorse or promote products derived from this software without
17-
specific prior written permission.
18-
19-
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
20-
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
21-
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22-
IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
23-
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24-
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25-
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
26-
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
27-
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
28-
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29-
*/
30-
31-
require_once('../../lib/config.inc.php');
32-
require_once('../../lib/app.inc.php');
33-
34-
// Loading the template
35-
$app->uses('tpl');
36-
$app->tpl->newTemplate("form.tpl.htm");
37-
$app->tpl->setInclude('content_tpl','templates/password_reset.htm');
38-
39-
$app->tpl_defaults();
40-
41-
include(ISPC_ROOT_PATH.'/web/login/lib/lang/'.$_SESSION['s']['language'].'.lng');
42-
$app->tpl->setVar($wb);
43-
44-
if(isset($_POST['username']) && $_POST['username'] != '' && $_POST['email'] != '' && $_POST['username'] != 'admin') {
45-
46-
$username = $app->db->quote($_POST['username']);
47-
$email = $app->db->quote($_POST['email']);
48-
49-
$client = $app->db->queryOneRecord("SELECT * FROM client WHERE username = '$username' && email = '$email'");
50-
51-
if($client['client_id'] > 0) {
52-
$new_password = md5 (uniqid (rand()));
53-
$new_password = $app->db->quote($new_password);
54-
$username = $app->db->quote($client['username']);
55-
$app->db->query("UPDATE sys_user SET passwort = md5('$new_password') WHERE username = '$username'");
56-
$app->db->query("UPDATE client SET ´password´ = md5('$new_password') WHERE username = '$username'");
57-
$app->tpl->setVar("message",$wb['pw_reset']);
58-
59-
mail($client['email'],$wb['pw_reset_mail_title'],$wb['pw_reset_mail_msg'].$new_password);
60-
61-
} else {
62-
$app->tpl->setVar("message",$wb['pw_error']);
63-
}
64-
65-
} else {
66-
$app->tpl->setVar("message",$wb['pw_error_noinput']);
67-
}
68-
69-
70-
71-
$app->tpl_defaults();
72-
$app->tpl->pparse();
73-
74-
75-
76-
77-
1+
<?php
2+
3+
/*
4+
Copyright (c) 2008, Till Brehm, projektfarm Gmbh
5+
All rights reserved.
6+
7+
Redistribution and use in source and binary forms, with or without modification,
8+
are permitted provided that the following conditions are met:
9+
10+
* Redistributions of source code must retain the above copyright notice,
11+
this list of conditions and the following disclaimer.
12+
* Redistributions in binary form must reproduce the above copyright notice,
13+
this list of conditions and the following disclaimer in the documentation
14+
and/or other materials provided with the distribution.
15+
* Neither the name of ISPConfig nor the names of its contributors
16+
may be used to endorse or promote products derived from this software without
17+
specific prior written permission.
18+
19+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
20+
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
21+
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22+
IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
23+
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24+
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
26+
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
27+
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
28+
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29+
*/
30+
31+
require_once('../../lib/config.inc.php');
32+
require_once('../../lib/app.inc.php');
33+
34+
// Loading the template
35+
$app->uses('tpl');
36+
$app->tpl->newTemplate("form.tpl.htm");
37+
$app->tpl->setInclude('content_tpl','templates/password_reset.htm');
38+
39+
$app->tpl_defaults();
40+
41+
include(ISPC_ROOT_PATH.'/web/login/lib/lang/'.$_SESSION['s']['language'].'.lng');
42+
$app->tpl->setVar($wb);
43+
44+
if(isset($_POST['username']) && $_POST['username'] != '' && $_POST['email'] != '' && $_POST['username'] != 'admin') {
45+
46+
if(!preg_match("/^[\w\.\-\_]{1,64}$/", $_POST['username'])) die($app->lng('user_regex_error'));
47+
if(!preg_match("/^\w+[\w.-]*\w+@\w+[\w.-]*\w+\.[a-z]{2,10}$/i", $_POST['email'])) die($app->lng('email_error'));
48+
49+
$username = $app->db->quote($_POST['username']);
50+
$email = $app->db->quote($_POST['email']);
51+
52+
$client = $app->db->queryOneRecord("SELECT * FROM client WHERE username = '$username' AND email = '$email'");
53+
54+
if($client['client_id'] > 0) {
55+
$new_password = md5 (uniqid (rand()));
56+
$salt="$1$";
57+
for ($n=0;$n<11;$n++) {
58+
$salt.=chr(mt_rand(64,126));
59+
}
60+
$salt.="$";
61+
$new_password_encrypted = crypt($new_password,$salt);
62+
$new_password_encrypted = $app->db->quote($new_password_encrypted);
63+
64+
$username = $app->db->quote($client['username']);
65+
$app->db->query("UPDATE sys_user SET passwort = '$new_password_encrypted' WHERE username = '$username'");
66+
$app->db->query("UPDATE client SET ´password´ = '$new_password_encrypted' WHERE username = '$username'");
67+
$app->tpl->setVar("message",$wb['pw_reset']);
68+
69+
mail($client['email'],$wb['pw_reset_mail_title'],$wb['pw_reset_mail_msg'].$new_password);
70+
71+
} else {
72+
$app->tpl->setVar("message",$wb['pw_error']);
73+
}
74+
75+
} else {
76+
$app->tpl->setVar("message",$wb['pw_error_noinput']);
77+
}
78+
79+
80+
81+
$app->tpl_defaults();
82+
$app->tpl->pparse();
83+
84+
85+
86+
87+
7888
?>

0 commit comments

Comments
 (0)