From 1df2182bae2f27702f9e32756a21da207a9fe12d Mon Sep 17 00:00:00 2001
From: Anonymous Contributor <anonymous@invalid>
Date: Wed, 23 Aug 2023 18:16:35 +0200
Subject: [PATCH] Use POST for password changes, validate input

---
 pages/password.php | 100 +++++++++++++++++++--------------------------
 1 file changed, 42 insertions(+), 58 deletions(-)

diff --git a/pages/password.php b/pages/password.php
index b357ac7..d5bff06 100644
--- a/pages/password.php
+++ b/pages/password.php
@@ -1,61 +1,45 @@
 <?php
+    if($_SERVER['REQUEST_TYPE'] == 'POST') {
+        if(!isset($_SESSION['LOGIN']) || !isset($_SESSION['UUID'])) {
+            header('Location: index.php');
+            die();
+        }
+
+        include '../app/FormValidator.php';
+        $validator = new FormValidator(array(
+            'oldPassword' => array('required' => true, 'regex' => '.{1,1000}'),
+            'newPassword' => array('required' => true, 'regex' => '.{1,1000}'),
+            'newPasswordRepeat' => array('required' => true, 'regex' => '.{1,1000}')
+        ));
+
+        if($validator->isValid($_POST)) {
+            if($_POST['newPasswordRepeat'] == $_POST['newPassword']) {
+                if(password_verify($_POST['oldPassword'], $_SESSION['PASSWORD'])) {
+                    $hash = password_hash($NewPassword, PASSWORD_ARGON2ID);
+                    $statement = $RUNTIME['PDO']->prepare('UPDATE auth SET passwordHash = :PasswordHash WHERE UUID = :PrincipalID'); 
+                    $statement->execute(['PasswordHash' => $hash, 'PrincipalID' => $_SESSION['UUID']]);
+                    $_SESSION['PASSWORD'] = $hash;
+                    $_SESSION['pw_info'] = 'Neues Passwort gespeichert.';
+                }
+                else {
+                    $_SESION['pw_info'] = 'Das alte Passwort ist nicht richtig!';
+                }
+            }
+            else {
+                $_SESSION['pw_info'] = 'Die neuen Passwörter stimmen nicht überein!';
+            }
+        }
+        else {
+            $_SESSION['pw_info'] = 'Bitte fülle das Formular vollständig aus.';
+        }
+
+        header('Location: index.php?page=password');
+        die();
+    }
 
     $HTML->setHTMLTitle("Passwort ändern");
     $HTML->importSeitenInhalt("profile.html");
 
-    if(isset($_REQUEST['oldPassword']) || $_REQUEST['oldPassword'] != "")
-    {
-        $OLDPassword = trim($_REQUEST['oldPassword']);
-
-        if($OLDPassword != "")
-        {
-            if(password_verify($OLDPassword, $_SESSION['PASSWORD']))
-            {
-                if(isset($_REQUEST['newPassword']) && $_REQUEST['newPassword'] != "")
-                {
-                    $NewPassword = trim($_REQUEST['newPassword']);
-            
-                    if($NewPassword != "")
-                    {
-                        if(isset($_REQUEST['newPasswordRepeate']) || $_REQUEST['newPasswordRepeate'] != "")
-                        {
-                            $NewPasswordRepeate = trim($_REQUEST['newPasswordRepeate']);
-                    
-                            if($NewPasswordRepeate != "")
-                            {
-                                if($NewPasswordRepeate == $NewPassword)
-                                {
-                                    $hash = password_hash($NewPassword, PASSWORD_ARGON2ID);
-                                    $statement = $RUNTIME['PDO']->prepare('UPDATE auth SET passwordHash = :PasswordHash WHERE UUID = :PrincipalID'); 
-                                    $statement->execute(['PasswordHash' => $hash, 'PrincipalID' => $_SESSION['UUID']]);
-                                    $_SESSION['PASSWORD'] = $hash;
-                                    $_SESSION['pwChanged'] = true;
-
-                                    header('Location: index.php?page=password');
-                                    die();
-                                }else{
-                                    $HTML->ReplaceSeitenInhalt("%%INFOMESSAGE%%", 'Passwörter stimmen nicht überein!'); 
-                                }
-                            }else{
-                                $HTML->ReplaceSeitenInhalt("%%INFOMESSAGE%%", 'Bitte gib das Passwort zur bestätigung noch einmal ein!'); 
-                            }
-                        }else{
-                            $HTML->ReplaceSeitenInhalt("%%INFOMESSAGE%%", 'Bitte gib das Passwort zur bestätigung noch einmal ein!'); 
-                        }
-                    }else{
-                        $HTML->ReplaceSeitenInhalt("%%INFOMESSAGE%%", 'Bitte gebe ein neues Passwort ein!'); 
-                    }
-                }else{
-                    $HTML->ReplaceSeitenInhalt("%%INFOMESSAGE%%", 'Bitte gebe ein neues Passwort ein!'); 
-                }
-            }else{
-                $HTML->ReplaceSeitenInhalt("%%INFOMESSAGE%%", 'Das alte Passwort ist nicht richtig!'); 
-            }
-        }else{
-            $HTML->ReplaceSeitenInhalt("%%INFOMESSAGE%%", 'Gebe bitte dein Passwort ein.');
-        }
-    }
-
     include 'app/OpenSim.php';
     $opensim = new OpenSim();
 
@@ -70,12 +54,12 @@
     $HTML->ReplaceSeitenInhalt("%%email%%", htmlspecialchars($opensim->getUserMail($_SESSION['UUID']))); 
     $HTML->ReplaceSeitenInhalt("%%listAllResidentsAsJSArray%%", "");
 
-    $pwChanged = false;
-    if(isset($_SESSION['pwChanged'])) {
-        $pwChanged = true;
-        unset($_SESSION['pwChanged']);
+    $pwInfo = '';
+    if(isset($_SESSION['pw_info'])) {
+        $pwInfo = $_SESSION['pw_info'];
+        unset($_SESSION['pw_info']);
     }
-    $HTML->ReplaceSeitenInhalt("%%INFOMESSAGE%%", $pwChanged ? 'Neues Passwort gespeichert.' : ' ');
+    $HTML->ReplaceSeitenInhalt("%%INFOMESSAGE%%", $pwInfo);
     
     $HTML->build();
     echo $HTML->ausgabe();