- if (is_null($session)) {
- // Create new session and set cookie.
- $sesskey = bin2hex(openssl_random_pseudo_bytes(512/8)); // Get 512 bits of randomness (128 byte hex string).
- setcookie('sessionkey', $sesskey, 0, "", "", !$running_on_localhost, true); // Last two params are secure and httponly, secure is not set on localhost.
- $result = $db->prepare('INSERT INTO `auth_sessions` (`sesskey`, `time_expire`) VALUES (:sesskey, :expire);');
- $result->execute(array(':sesskey' => $sesskey, ':expire' => gmdate('Y-m-d H:i:s', strtotime('+5 minutes'))));
- // After insert, actually fetch the session row from the DB so we have all values.
- $result = $db->prepare('SELECT * FROM auth_sessions WHERE `sesskey` = :sesskey AND `time_expire` > :expire;');
- $result->execute(array(':sesskey' => $sesskey, ':expire' => gmdate('Y-m-d H:i:s')));
- $row = $result->fetch(PDO::FETCH_ASSOC);
- if ($row) {
- $session = $row;
+ elseif (array_key_exists('reset', $_GET)) {
+ if ($session['logged_in']) {
+ $result = $db->prepare('SELECT `id`,`email` FROM `auth_users` WHERE `id` = :userid;');
+ $result->execute(array(':userid' => $session['user']));
+ $user = $result->fetch(PDO::FETCH_ASSOC);
+ if (!$user['id']) {
+ $utils->log('reset_user_read_failure', 'user: '.$session['user']);
+ }
+ $pagetype = 'resetpwd';
+ }
+ else {
+ // Display form for entering email.
+ $pagetype = 'resetstart';
+ }
+ }
+ elseif (array_key_exists('verification_code', $_GET)) {
+ $result = $db->prepare('SELECT `id`,`email` FROM `auth_users` WHERE `email` = :email AND `status` = \'unverified\' AND `verify_hash` = :vcode;');
+ $result->execute(array(':email' => @$_GET['email'], ':vcode' => $_GET['verification_code']));
+ $user = $result->fetch(PDO::FETCH_ASSOC);
+ if ($user['id']) {
+ $result = $db->prepare('UPDATE `auth_users` SET `verify_hash` = \'\', `status` = \'ok\' WHERE `id` = :userid;');
+ if (!$result->execute(array(':userid' => $user['id']))) {
+ $utils->log('verification_save_failure', 'user: '.$user['id']);
+ $errors[] = _('Could not save confirmation. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
+ }
+ $pagetype = 'verification_done';
+ }
+ else {
+ $errors[] = _('The confirmation link you called is not valid. Possibly it has expired and you need to try registering again.');
+ }
+ }
+ elseif (array_key_exists('reset_code', $_GET)) {
+ $reset_fail = true;
+ $result = $db->prepare('SELECT `id`,`email`,`verify_hash` FROM `auth_users` WHERE `email` = :email');
+ $result->execute(array(':email' => @$_GET['email']));
+ $user = $result->fetch(PDO::FETCH_ASSOC);
+ if ($user['id']) {
+ // Deconstruct reset code and verify it.
+ if (preg_match('/^([0-9a-f]{'.strlen($user['verify_hash']).'})([0-9a-f]+)_(\d+\.\d+)$/', $_GET['reset_code'], $regs)) {
+ $tcode_sessid = hexdec($regs[2]) - $user['id'];
+ $result = $db->prepare('SELECT `id`,`sesskey` FROM `auth_sessions` WHERE `id` = :sessid;');
+ $result->execute(array(':sessid' => $tcode_sessid));
+ $row = $result->fetch(PDO::FETCH_ASSOC);
+ if ($row) {
+ $tcode_session = $row;
+ if (($regs[1] == $user['verify_hash']) &&
+ $utils->verifyTimeCode($regs[3], $session, 60)) {
+ // Set a new verify_hash for the actual password reset.
+ $user['verify_hash'] = $utils->createVerificationCode();
+ $result = $db->prepare('UPDATE `auth_users` SET `verify_hash` = :vcode WHERE `id` = :userid;');
+ if (!$result->execute(array(':vcode' => $user['verify_hash'], ':userid' => $user['id']))) {
+ $utils->log('vhash_reset_failure', 'user: '.$user['id']);
+ }
+ $result = $db->prepare('UPDATE `auth_sessions` SET `user` = :userid WHERE `id` = :sessid;');
+ if (!$result->execute(array(':userid' => $user['id'], ':sessid' => $session['id']))) {
+ $utils->log('reset_session_set_user_failure', 'session: '.$session['id']);
+ }
+ $pagetype = 'resetpwd';
+ $reset_fail = false;
+ }
+ }
+ }
+ }
+ if ($reset_fail) {
+ $errors[] = _('The password reset link you called is not valid. Possibly it has expired and you need to call the "Password forgotten?" function again.');
+ }
+ }
+ elseif (intval($session['user'])) {
+ $result = $db->prepare('SELECT `id`,`email`,`verify_hash` FROM `auth_users` WHERE `id` = :userid;');
+ $result->execute(array(':userid' => $session['user']));
+ $user = $result->fetch(PDO::FETCH_ASSOC);
+ if (!$user['id']) {
+ $utils->log('user_read_failure', 'user: '.$session['user']);
+ }
+ // Password reset requested.
+ if (array_key_exists('pwd', $_POST) && array_key_exists('reset', $_POST) && array_key_exists('tcode', $_POST)) {
+ // If not logged in, a password reset needs to have the proper vcode set.
+ if (!$session['logged_in'] && (!strlen(@$_POST['vcode']) || ($_POST['vcode'] != $user['verify_hash']))) {
+ $errors[] = _('Password reset failed. The reset form you used was not valid. Possibly it has expired and you need to initiate the password reset again.');
+ }
+ // If not logged in, a password reset also needs to have the proper email set.
+ if (!$session['logged_in'] && !count($errors) && (@$_POST['email_hidden'] != $user['email'])) {
+ $errors[] = _('Password reset failed. The reset form you used was not valid. Possibly it has expired and you need to initiate the password reset again.');
+ }
+ // Check validity of time code.
+ if (!count($errors) && !$utils->verifyTimeCode($_POST['tcode'], $session)) {
+ $errors[] = _('Password reset failed. The reset form you used was not valid. Possibly it has expired and you need to initiate the password reset again.');
+ }
+ $errors += $utils->checkPasswordConstraints(strval($_POST['pwd']), $user['email']);
+ if (!count($errors)) {
+ $newHash = $utils->pwdHash($_POST['pwd']);
+ $result = $db->prepare('UPDATE `auth_users` SET `pwdhash` = :pwdhash, `verify_hash` = \'\' WHERE `id` = :userid;');
+ if (!$result->execute(array(':pwdhash' => $newHash, ':userid' => $session['user']))) {
+ $utils->log('pwd_reset_failure', 'user: '.$session['user']);
+ $errors[] = _('Password reset failed. Please <a href="https://www.kairo.at/contact">contact KaiRo.at</a> and tell the team about this.');
+ }
+ else {
+ $pagetype = 'reset_done';
+ }
+ }