71 lines
3.2 KiB
PHP
71 lines
3.2 KiB
PHP
<?php
|
|
const MESSAGE = 'Hallo %%NAME%%,<br/><br/>das Passwort für deinen 4Creative-Account wurde soeben über die Funktion "Passwort vergessen" geändert.<br/><br/>Solltest du diese Änderung nicht selbst durchgeführt haben, wende dich bitte umgehend per E-Mail (info@4creative.net) oder Discord (@ikeytan) an uns.';
|
|
|
|
function displayTokenError() {
|
|
$HTML = new HTML();
|
|
$HTML->importHTML("error.html");
|
|
$HTML->ReplaceLayoutInhalt('%%MESSAGE%%', 'Dieser Link zur Passwortzurücksetzung ist nicht gültig. Bitte klicke oder kopiere den Link aus der E-Mail, die du erhalten hast.');
|
|
$HTML->build();
|
|
exit();
|
|
}
|
|
|
|
function displayPage($err) {
|
|
$HTML = new HTML();
|
|
$HTML->setHTMLTitle("");
|
|
$HTML->importHTML("reset-password.html");
|
|
$HTML->ReplaceLayoutInhalt('%%MESSAGE%%', $err);
|
|
$HTML->build();
|
|
echo $HTML->ausgabe();
|
|
exit();
|
|
}
|
|
|
|
if($_SERVER['REQUEST_METHOD'] == 'POST') {
|
|
include_once 'app/FormValidator.php';
|
|
$validator = new FormValidator(array(
|
|
'password' => array('required' => true, 'regex' => '/^.{1,1000}$/'),
|
|
'passwordRepeat' => array('required' => true, 'regex' => '/^.{1,1000}$/'),
|
|
'resetToken' => array('required' => true, 'regex' => '/^[a-zA-Z0-9]{32}$/')
|
|
));
|
|
|
|
if($validator->isValid($_POST)) {
|
|
if($_POST['password'] !== $_POST['passwordRepeat']) {
|
|
displayPage('Du musst in beiden Feldern das gleiche Passwort eingeben');
|
|
}
|
|
|
|
if(strlen($_POST['password']) < $RUNTIME['PASSWORD_MIN_LENGTH']) {
|
|
displayPage('Dein Passwort muss mindestens '.$RUNTIME['PASSWORD_MIN_LENGTH'].' Zeichen lang sein.');
|
|
}
|
|
|
|
$getUuid = $RUNTIME['PDO']->prepare('SELECT PrincipalID,FirstName,LastName FROM PasswordResetTokens JOIN UserAccounts ON PasswordResetTokens.PrincipalID = PasswordResetTokens.PrincipalID WHERE Token = ?');
|
|
if($getUuid->rowCount() == 0) {
|
|
displayTokenError();
|
|
}
|
|
|
|
$res = $getUuid->fetch();
|
|
$uuid = $res['PrincipalID'];
|
|
$name = $res['FirstName'].' '.$res['LastName'];
|
|
$getToken = $RUNTIME['PDO']->prepare('DELETE FROM PasswordResetTokens WHERE Token = ?');
|
|
$getToken->execute([$_POST['resetToken']]);
|
|
|
|
$salt = bin2hex(random_bytes(16));
|
|
$hash = md5(md5(trim($_POST['password'])).':'.$salt);
|
|
$statement = $RUNTIME['PDO']->prepare('UPDATE auth SET passwordHash = :PasswordHash, passwordSalt = :PasswordSalt WHERE UUID = :PrincipalID');
|
|
$statement->execute(['PasswordHash' => $hash, 'PasswordSalt' => $salt, 'PrincipalID' => $uuid]);
|
|
|
|
session_unset();
|
|
$_SESSION['resetPassword'] = true;
|
|
|
|
require_once 'app/utils.php';
|
|
sendMail(str_replace('%%NAME%%', $name, MESSAGE), 'Passwort für '.$name.' zurückgesetzt', 'Passwort geändert', 'Das Passwort für deinen 4Creative-Account wurde soeben zurückgesetzt');
|
|
|
|
header('Location: index.php?page=login');
|
|
exit();
|
|
}
|
|
}
|
|
|
|
displayPage('');
|
|
|
|
if(!isset($_GET['token']) || !preg_match('/^[a-z0-9A-Z]{32}$/', $_GET['token'])) {
|
|
displayTokenError();
|
|
}
|
|
?>
|