Friendica Communications Platform (please note that this is a clone of the repository at github, issues are handled there) https://friendi.ca
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

168 lines
4.6 KiB

11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
11 years ago
10 years ago
10 years ago
11 years ago
  1. <?php
  2. require_once('include/email.php');
  3. require_once('include/enotify.php');
  4. require_once('include/text.php');
  5. function lostpass_post(App $a) {
  6. $loginame = notags(trim($_POST['login-name']));
  7. if(! $loginame)
  8. goaway(z_root());
  9. $r = q("SELECT * FROM `user` WHERE ( `email` = '%s' OR `nickname` = '%s' ) AND `verified` = 1 AND `blocked` = 0 LIMIT 1",
  10. dbesc($loginame),
  11. dbesc($loginame)
  12. );
  13. if (! dbm::is_result($r)) {
  14. notice( t('No valid account found.') . EOL);
  15. goaway(z_root());
  16. }
  17. $uid = $r[0]['uid'];
  18. $username = $r[0]['username'];
  19. $email = $r[0]['email'];
  20. $new_password = autoname(12) . mt_rand(100,9999);
  21. $new_password_encoded = hash('whirlpool',$new_password);
  22. $r = q("UPDATE `user` SET `pwdreset` = '%s' WHERE `uid` = %d",
  23. dbesc($new_password_encoded),
  24. intval($uid)
  25. );
  26. if($r)
  27. info( t('Password reset request issued. Check your email.') . EOL);
  28. $sitename = $a->config['sitename'];
  29. $resetlink = App::get_baseurl() . '/lostpass?verify=' . $new_password;
  30. $preamble = deindent(t('
  31. Dear %1$s,
  32. A request was recently received at "%2$s" to reset your account
  33. password. In order to confirm this request, please select the verification link
  34. below or paste it into your web browser address bar.
  35. If you did NOT request this change, please DO NOT follow the link
  36. provided and ignore and/or delete this email.
  37. Your password will not be changed unless we can verify that you
  38. issued this request.'));
  39. $body = deindent(t('
  40. Follow this link to verify your identity:
  41. %1$s
  42. You will then receive a follow-up message containing the new password.
  43. You may change that password from your account settings page after logging in.
  44. The login details are as follows:
  45. Site Location: %2$s
  46. Login Name: %3$s'));
  47. $preamble = sprintf($preamble, $username, $sitename);
  48. $body = sprintf($body, $resetlink, App::get_baseurl(), $email);
  49. notification(array(
  50. 'type' => "SYSTEM_EMAIL",
  51. 'to_email' => $email,
  52. 'subject'=> sprintf( t('Password reset requested at %s'),$sitename),
  53. 'preamble'=> $preamble,
  54. 'body' => $body));
  55. goaway(z_root());
  56. }
  57. function lostpass_content(App $a) {
  58. if(x($_GET,'verify')) {
  59. $verify = $_GET['verify'];
  60. $hash = hash('whirlpool', $verify);
  61. $r = q("SELECT * FROM `user` WHERE `pwdreset` = '%s' LIMIT 1",
  62. dbesc($hash)
  63. );
  64. if (! dbm::is_result($r)) {
  65. $o = t("Request could not be verified. \x28You may have previously submitted it.\x29 Password reset failed.");
  66. return $o;
  67. }
  68. $uid = $r[0]['uid'];
  69. $username = $r[0]['username'];
  70. $email = $r[0]['email'];
  71. $new_password = autoname(6) . mt_rand(100,9999);
  72. $new_password_encoded = hash('whirlpool',$new_password);
  73. $r = q("UPDATE `user` SET `password` = '%s', `pwdreset` = '' WHERE `uid` = %d",
  74. dbesc($new_password_encoded),
  75. intval($uid)
  76. );
  77. /// @TODO Is dbm::is_result() okay here?
  78. if ($r) {
  79. $tpl = get_markup_template('pwdreset.tpl');
  80. $o .= replace_macros($tpl,array(
  81. '$lbl1' => t('Password Reset'),
  82. '$lbl2' => t('Your password has been reset as requested.'),
  83. '$lbl3' => t('Your new password is'),
  84. '$lbl4' => t('Save or copy your new password - and then'),
  85. '$lbl5' => '<a href="' . App::get_baseurl() . '">' . t('click here to login') . '</a>.',
  86. '$lbl6' => t('Your password may be changed from the <em>Settings</em> page after successful login.'),
  87. '$newpass' => $new_password,
  88. '$baseurl' => App::get_baseurl()
  89. ));
  90. info("Your password has been reset." . EOL);
  91. $sitename = $a->config['sitename'];
  92. // $username, $email, $new_password
  93. $preamble = deindent(t('
  94. Dear %1$s,
  95. Your password has been changed as requested. Please retain this
  96. information for your records (or change your password immediately to
  97. something that you will remember).
  98. '));
  99. $body = deindent(t('
  100. Your login details are as follows:
  101. Site Location: %1$s
  102. Login Name: %2$s
  103. Password: %3$s
  104. You may change that password from your account settings page after logging in.
  105. '));
  106. $preamble = sprintf($preamble, $username);
  107. $body = sprintf($body, App::get_baseurl(), $email, $new_password);
  108. notification(array(
  109. 'type' => "SYSTEM_EMAIL",
  110. 'to_email' => $email,
  111. 'subject'=> sprintf( t('Your password has been changed at %s'),$sitename),
  112. 'preamble'=> $preamble,
  113. 'body' => $body));
  114. return $o;
  115. }
  116. }
  117. else {
  118. $tpl = get_markup_template('lostpass.tpl');
  119. $o .= replace_macros($tpl,array(
  120. '$title' => t('Forgot your Password?'),
  121. '$desc' => t('Enter your email address and submit to have your password reset. Then check your email for further instructions.'),
  122. '$name' => t('Nickname or Email: '),
  123. '$submit' => t('Reset')
  124. ));
  125. return $o;
  126. }
  127. }