Address changes.
This commit is contained in:
parent
a5949e0401
commit
635b3ddcbc
59 changed files with 7249 additions and 2745 deletions
|
|
@ -7,81 +7,217 @@ use DJMixHosting\Database;
|
|||
use Aws\Ses\SesClient;
|
||||
use Aws\Exception\AwsException;
|
||||
|
||||
if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['email'])) {
|
||||
$email = trim($_POST['email']);
|
||||
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
||||
$_SESSION['error'] = "Invalid email format.";
|
||||
$db = new Database($config);
|
||||
|
||||
// Ensure a CSRF token exists.
|
||||
if (empty($_SESSION['csrf_token'])) {
|
||||
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
||||
}
|
||||
|
||||
// Determine if we are in reset stage based on GET parameter.
|
||||
$isResetStage = false;
|
||||
$verification_code = "";
|
||||
if ($_SERVER['REQUEST_METHOD'] === 'GET' && isset($_GET['code'])) {
|
||||
$verification_code = trim($_GET['code']);
|
||||
$isResetStage = true;
|
||||
}
|
||||
|
||||
// Process POST submissions.
|
||||
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
||||
|
||||
// Validate the CSRF token.
|
||||
if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'] ?? '')) {
|
||||
$_SESSION['error'] = "Invalid CSRF token.";
|
||||
header("Location: forgot-password.php");
|
||||
exit;
|
||||
}
|
||||
|
||||
$db = new Database($config);
|
||||
// Check if email exists in the system
|
||||
$stmt = $db->prepare("SELECT id, username FROM users WHERE email = ?");
|
||||
$stmt->bind_param("s", $email);
|
||||
$stmt->execute();
|
||||
$result = $stmt->get_result();
|
||||
$userData = $result->fetch_assoc();
|
||||
$stmt->close();
|
||||
// If a verification code is provided, we are in reset mode.
|
||||
if (isset($_POST['verification_code']) && !empty($_POST['verification_code'])) {
|
||||
|
||||
// Always show a success message (to avoid disclosing which emails are registered)
|
||||
$_SESSION['success'] = "If the email exists in our system, a password reset link has been sent.";
|
||||
// Rate limiting for reset attempts.
|
||||
if (!isset($_SESSION['attempts'])) {
|
||||
$_SESSION['attempts'] = 0;
|
||||
$_SESSION['first_attempt_time'] = time();
|
||||
}
|
||||
$_SESSION['attempts']++;
|
||||
if ($_SESSION['attempts'] > 5 && (time() - $_SESSION['first_attempt_time']) < 900) { // 15 minutes
|
||||
$_SESSION['error'] = "Too many attempts. Please try again later.";
|
||||
header("Location: forgot-password.php?code=" . urlencode($_POST['verification_code']));
|
||||
exit;
|
||||
}
|
||||
if (time() - $_SESSION['first_attempt_time'] >= 900) {
|
||||
$_SESSION['attempts'] = 1;
|
||||
$_SESSION['first_attempt_time'] = time();
|
||||
}
|
||||
|
||||
if ($userData) {
|
||||
$user_id = $userData['id'];
|
||||
// Generate a password reset verification code valid for 15 minutes
|
||||
$verification_code = bin2hex(random_bytes(16));
|
||||
$expires_at = date("Y-m-d H:i:s", strtotime("+15 minutes"));
|
||||
// Process the reset.
|
||||
$verification_code = trim($_POST['verification_code']);
|
||||
$username = trim($_POST['username'] ?? '');
|
||||
$new_password = $_POST['new_password'] ?? '';
|
||||
$confirm_password = $_POST['confirm_password'] ?? '';
|
||||
|
||||
// Insert a record with purpose 'password_reset'
|
||||
$stmt = $db->prepare("REPLACE INTO email_verifications (user_id, email, verification_code, expires_at, purpose) VALUES (?, ?, ?, ?, 'password_reset')");
|
||||
$stmt->bind_param("isss", $user_id, $email, $verification_code, $expires_at);
|
||||
if (empty($verification_code) || empty($username) || empty($new_password) || empty($confirm_password)) {
|
||||
$_SESSION['error'] = $locale['allFieldsRequired'];
|
||||
header("Location: forgot-password.php?code=" . urlencode($verification_code));
|
||||
exit;
|
||||
}
|
||||
if ($new_password !== $confirm_password) {
|
||||
$_SESSION['error'] = $locale['passwordMismatch'];
|
||||
header("Location: forgot-password.php?code=" . urlencode($verification_code));
|
||||
exit;
|
||||
}
|
||||
if (!validate_password($new_password)) {
|
||||
$_SESSION['error'] = $locale['passwordRequirements'];
|
||||
header("Location: forgot-password.php?code=" . urlencode($verification_code));
|
||||
exit;
|
||||
}
|
||||
|
||||
// Look up the password reset record.
|
||||
$stmt = $db->prepare("SELECT * FROM email_verifications WHERE verification_code = ? AND purpose = 'password_reset'");
|
||||
$stmt->bind_param("s", $verification_code);
|
||||
$stmt->execute();
|
||||
$result = $stmt->get_result();
|
||||
$record = $result->fetch_assoc();
|
||||
$stmt->close();
|
||||
|
||||
if (!$record) {
|
||||
$_SESSION['error'] = $locale['resetExpiredInvalid'];
|
||||
header("Location: forgot-password.php?code=" . urlencode($verification_code));
|
||||
exit;
|
||||
}
|
||||
|
||||
// Check expiration.
|
||||
$current_time = new DateTime();
|
||||
$expires_at = new DateTime($record['expires_at']);
|
||||
if ($current_time > $expires_at) {
|
||||
$_SESSION['error'] = $locale['resetExpired'];
|
||||
header("Location: forgot-password.php?code=" . urlencode($verification_code));
|
||||
exit;
|
||||
}
|
||||
|
||||
// Verify the username matches the record.
|
||||
$stmt = $db->prepare("SELECT id, username FROM users WHERE id = ? AND username = ?");
|
||||
$stmt->bind_param("is", $record['user_id'], $username);
|
||||
$stmt->execute();
|
||||
$userData = $stmt->get_result()->fetch_assoc();
|
||||
$stmt->close();
|
||||
|
||||
if (!$userData) {
|
||||
$_SESSION['error'] = $locale['codeCredsInvalid'];
|
||||
header("Location: forgot-password.php?code=" . urlencode($verification_code));
|
||||
exit;
|
||||
}
|
||||
|
||||
// Update the user's password.
|
||||
$hashed_password = password_hash($new_password, PASSWORD_DEFAULT);
|
||||
$stmt = $db->prepare("UPDATE users SET password = ? WHERE id = ?");
|
||||
$stmt->bind_param("si", $hashed_password, $userData['id']);
|
||||
$stmt->execute();
|
||||
$stmt->close();
|
||||
|
||||
// Send password reset email via AWS SES
|
||||
$sesClient = new SesClient([
|
||||
'version' => 'latest',
|
||||
'region' => $config['aws']['ses']['region'],
|
||||
'credentials' => [
|
||||
'key' => $config['aws']['ses']['access_key'],
|
||||
'secret' => $config['aws']['ses']['secret_key'],
|
||||
]
|
||||
]);
|
||||
// Remove the password reset record.
|
||||
$stmt = $db->prepare("DELETE FROM email_verifications WHERE verification_code = ? AND purpose = 'password_reset'");
|
||||
$stmt->bind_param("s", $verification_code);
|
||||
$stmt->execute();
|
||||
$stmt->close();
|
||||
|
||||
$sender_email = $config['aws']['ses']['sender_email'];
|
||||
$recipient_email = $email;
|
||||
$subject = "Password Reset Request";
|
||||
$reset_link = $config['app']['url'] . "/password-reset.php?code={$verification_code}";
|
||||
$body_text = "You have requested to reset your password. Please click the link below to reset your password:\n\n";
|
||||
$body_text .= "{$reset_link}\n\nIf you did not request this, please ignore this email. This link will expire in 15 minutes.";
|
||||
session_regenerate_id(true);
|
||||
$_SESSION['success'] = $locale['passwordResetSuccess'];
|
||||
header("Location: /login");
|
||||
exit;
|
||||
|
||||
try {
|
||||
$result = $sesClient->sendEmail([
|
||||
'Destination' => [
|
||||
'ToAddresses' => [$recipient_email],
|
||||
],
|
||||
'ReplyToAddresses' => [$sender_email],
|
||||
'Source' => $sender_email,
|
||||
'Message' => [
|
||||
'Body' => [
|
||||
'Text' => [
|
||||
} else {
|
||||
// Otherwise, we are processing a forgot password request.
|
||||
$email = trim($_POST['email'] ?? '');
|
||||
if (empty($email)) {
|
||||
$_SESSION['error'] = $locale['enterEmailAddressPlease'];
|
||||
header("Location: /forgot-password");
|
||||
exit;
|
||||
}
|
||||
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
||||
$_SESSION['error'] = $locale['emailInvalid'];
|
||||
header("Location: /forgot-password");
|
||||
exit;
|
||||
}
|
||||
|
||||
// Check if email exists in the system.
|
||||
$stmt = $db->prepare("SELECT id, username FROM users WHERE email = ?");
|
||||
$stmt->bind_param("s", $email);
|
||||
$stmt->execute();
|
||||
$result = $stmt->get_result();
|
||||
$userData = $result->fetch_assoc();
|
||||
$stmt->close();
|
||||
|
||||
// Always display a success message (even if the email isn’t registered) to avoid disclosing registered emails.
|
||||
$_SESSION['success'] = $locale['passwordResetSent'];
|
||||
|
||||
if ($userData) {
|
||||
$user_id = $userData['id'];
|
||||
// Generate a password reset verification code valid for 15 minutes.
|
||||
$verification_code = bin2hex(random_bytes(16));
|
||||
$expires_at = date("Y-m-d H:i:s", strtotime("+15 minutes"));
|
||||
|
||||
// Insert a record for the password reset.
|
||||
$stmt = $db->prepare("REPLACE INTO email_verifications (user_id, email, verification_code, expires_at, purpose) VALUES (?, ?, ?, ?, 'password_reset')");
|
||||
$stmt->bind_param("isss", $user_id, $email, $verification_code, $expires_at);
|
||||
$stmt->execute();
|
||||
$stmt->close();
|
||||
|
||||
// Send the password reset email via AWS SES.
|
||||
$sesClient = new SesClient([
|
||||
'version' => 'latest',
|
||||
'region' => $config['aws']['ses']['region'],
|
||||
'credentials' => [
|
||||
'key' => $config['aws']['ses']['access_key'],
|
||||
'secret' => $config['aws']['ses']['secret_key'],
|
||||
]
|
||||
]);
|
||||
|
||||
$sender_email = $config['aws']['ses']['sender_email'];
|
||||
$recipient_email = $email;
|
||||
$subject = "Password Reset Request";
|
||||
$reset_link = $config['app']['url'] . "/forgot-password.php?code={$verification_code}";
|
||||
$body_text = $locale['passwordResetRequested'] . "\n\n";
|
||||
$body_text .= "{$reset_link}\n\n";
|
||||
$body_text .= $locale['passwordResetUnrequested'];
|
||||
|
||||
try {
|
||||
$sesClient->sendEmail([
|
||||
'Destination' => [
|
||||
'ToAddresses' => [$recipient_email],
|
||||
],
|
||||
'ReplyToAddresses' => [$sender_email],
|
||||
'Source' => $sender_email,
|
||||
'Message' => [
|
||||
'Body' => [
|
||||
'Text' => [
|
||||
'Charset' => 'UTF-8',
|
||||
'Data' => $body_text,
|
||||
],
|
||||
],
|
||||
'Subject' => [
|
||||
'Charset' => 'UTF-8',
|
||||
'Data' => $body_text,
|
||||
'Data' => $subject,
|
||||
],
|
||||
],
|
||||
'Subject' => [
|
||||
'Charset' => 'UTF-8',
|
||||
'Data' => $subject,
|
||||
],
|
||||
],
|
||||
]);
|
||||
} catch (AwsException $e) {
|
||||
// Optionally log the error without disclosing details to the user.
|
||||
]);
|
||||
} catch (AwsException $e) {
|
||||
// Log the error as needed.
|
||||
}
|
||||
}
|
||||
header("Location: /forgot-password");
|
||||
exit;
|
||||
}
|
||||
header("Location: forgot-password.php");
|
||||
exit;
|
||||
}
|
||||
|
||||
// Helper function to validate password strength.
|
||||
function validate_password($password) {
|
||||
if (strlen($password) < 8) return false;
|
||||
if (!preg_match('/[A-Z]/', $password)) return false;
|
||||
if (!preg_match('/[a-z]/', $password)) return false;
|
||||
if (!preg_match('/[0-9]/', $password)) return false;
|
||||
return true;
|
||||
}
|
||||
|
||||
require_once 'includes/header.php';
|
||||
|
|
@ -92,27 +228,59 @@ require_once 'includes/header.php';
|
|||
<div class="row justify-content-center">
|
||||
<div class="col-lg-5">
|
||||
<?php
|
||||
if(isset($_SESSION['error'])) {
|
||||
echo '<div class="alert alert-danger alert-dismissible fade show mb-4" role="alert">' . htmlspecialchars($_SESSION['error']) . '<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button></div>';
|
||||
if (isset($_SESSION['error'])) {
|
||||
echo '<div class="alert alert-danger alert-dismissible fade show mb-4" role="alert">'
|
||||
. htmlspecialchars($_SESSION['error']) .
|
||||
'<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button></div>';
|
||||
unset($_SESSION['error']);
|
||||
}
|
||||
if(isset($_SESSION['success'])) {
|
||||
echo '<div class="alert alert-success alert-dismissible fade show mb-4" role="alert">' . htmlspecialchars($_SESSION['success']) . '<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button></div>';
|
||||
if (isset($_SESSION['success'])) {
|
||||
echo '<div class="alert alert-success alert-dismissible fade show mb-4" role="alert">'
|
||||
. htmlspecialchars($_SESSION['success']) .
|
||||
'<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button></div>';
|
||||
unset($_SESSION['success']);
|
||||
}
|
||||
?>
|
||||
<div class="card shadow-sm border-0">
|
||||
<div class="card-body p-4">
|
||||
<h3 class="text-center mb-4">Forgot Password</h3>
|
||||
<form action="forgot-password.php" method="post" class="needs-validation" novalidate>
|
||||
<div class="mb-3">
|
||||
<label for="email" class="form-label">Enter your email address</label>
|
||||
<input type="email" class="form-control" id="email" name="email" required>
|
||||
</div>
|
||||
<button type="submit" class="btn btn-primary w-100">Submit</button>
|
||||
</form>
|
||||
<?php if ($isResetStage): ?>
|
||||
<!-- Reset Password Form -->
|
||||
<div class="card shadow-sm border-0">
|
||||
<div class="card-body p-4">
|
||||
<h3 class="text-center mb-4"><?php echo $locale['passwordReset']; ?></h3>
|
||||
<form action="/forgot-password.php" method="post" class="needs-validation" novalidate>
|
||||
<input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($_SESSION['csrf_token']); ?>">
|
||||
<input type="hidden" name="verification_code" value="<?php echo htmlspecialchars($verification_code); ?>">
|
||||
<div class="mb-3">
|
||||
<label for="username" class="form-label"><?php echo $locale['enterYourUsername']; ?></label>
|
||||
<input type="text" class="form-control" id="username" name="username" required>
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<label for="new_password" class="form-label"><?php echo $locale['newPassword']; ?></label>
|
||||
<input type="password" class="form-control" id="new_password" name="new_password" required>
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<label for="confirm_password" class="form-label"><?php echo $locale['confirmPassword']; ?></label>
|
||||
<input type="password" class="form-control" id="confirm_password" name="confirm_password" required>
|
||||
</div>
|
||||
<button type="submit" class="btn btn-primary w-100"><?php echo $locale['passwordReset']; ?></button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<?php else: ?>
|
||||
<!-- Forgot Password Request Form -->
|
||||
<div class="card shadow-sm border-0">
|
||||
<div class="card-body p-4">
|
||||
<h3 class="text-center mb-4"><?php echo $locale['forgotPassword']; ?></h3>
|
||||
<form action="/forgot-password.php" method="post" class="needs-validation" novalidate>
|
||||
<input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($_SESSION['csrf_token']); ?>">
|
||||
<div class="mb-3">
|
||||
<label for="email" class="form-label"><?php echo $locale['emailaddressEnter']; ?></label>
|
||||
<input type="email" class="form-control" id="email" name="email" required>
|
||||
</div>
|
||||
<button type="submit" class="btn btn-primary w-100"><?php echo $locale['submit']; ?></button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
<?php endif; ?>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue