-
Notifications
You must be signed in to change notification settings - Fork 6
Expand file tree
/
Copy pathChangePassword.php
More file actions
116 lines (98 loc) · 3.61 KB
/
Copy pathChangePassword.php
File metadata and controls
116 lines (98 loc) · 3.61 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
<?php
namespace BNETDocs\Controllers\User;
use \BNETDocs\Libraries\Core\Config;
use \BNETDocs\Libraries\Core\Router;
use \BNETDocs\Libraries\EventLog\Logger;
use \BNETDocs\Libraries\User\User;
use \BNETDocs\Models\User\ChangePassword as ChangePasswordModel;
class ChangePassword extends \BNETDocs\Controllers\Base
{
public function __construct()
{
$this->model = new ChangePasswordModel();
}
public function invoke(?array $args): bool
{
if (!$this->model->active_user)
$this->model->error = 'NOT_LOGGED_IN';
else if (Router::requestMethod() == Router::METHOD_POST)
$this->tryChangePassword();
$this->model->_responseCode = \BNETDocs\Libraries\Core\HttpCode::HTTP_OK;
return true;
}
protected function tryChangePassword(): void
{
$q = Router::query();
$pw1 = isset($q['pw1']) ? $q['pw1'] : null;
$pw2 = isset($q['pw2']) ? $q['pw2'] : null;
$pw3 = isset($q['pw3']) ? $q['pw3'] : null;
if ($pw2 !== $pw3)
{
$this->model->error = ChangePasswordModel::ERROR_NONMATCHING_PASSWORD;
return;
}
if (!$this->model->active_user->checkPassword($pw1))
{
$this->model->error = ChangePasswordModel::ERROR_PASSWORD_INCORRECT;
return;
}
$pwlen = strlen($pw2);
$req = Config::get('bnetdocs.user_register_requirements') ?? [];
$email = $this->model->active_user->getEmail();
$username = $this->model->active_user->getUsername();
if (!($req['password_allow_email'] ?? false) && stripos($pw2, $email))
{
$this->model->error = ChangePasswordModel::ERROR_PASSWORD_CONTAINS_EMAIL;
return;
}
if (!($req['password_allow_username'] ?? false) && stripos($pw2, $username))
{
$this->model->error = ChangePasswordModel::ERROR_PASSWORD_CONTAINS_USERNAME;
return;
}
if (is_numeric($req['password_length_max'] ?? User::MAX_PASSWORD_HASH)
&& $pwlen > ($req['password_length_max'] ?? User::MAX_PASSWORD_HASH))
{
$this->model->error = ChangePasswordModel::ERROR_PASSWORD_TOO_LONG;
return;
}
if (is_numeric($req['password_length_min'] ?? 4)
&& $pwlen < ($req['password_length_min'] ?? 4))
{
$this->model->error = ChangePasswordModel::ERROR_PASSWORD_TOO_SHORT;
return;
}
$denylist = Config::get('bnetdocs.user_password_denylist_map') ?? '../etc/password_denylist.json';
$denylist = json_decode(file_get_contents('./' . $denylist));
foreach ($denylist as $denylist_pw)
{
if (strtolower($denylist_pw->password) == strtolower($pw2))
{
$this->model->error = ChangePasswordModel::ERROR_PASSWORD_DENYLIST;
$this->model->denylist_reason = $denylist_pw->reason;
return;
}
}
$old_password_hash = $this->model->active_user->getPasswordHash();
$old_password_salt = $this->model->active_user->getPasswordSalt();
$this->model->active_user->setPassword($pw2);
$this->model->error = $this->model->active_user->commit() ? false : ChangePasswordModel::ERROR_INTERNAL;
$event = Logger::initEvent(
\BNETDocs\Libraries\EventLog\EventTypes::USER_PASSWORD_CHANGE,
$this->model->active_user,
getenv('REMOTE_ADDR'),
[
'error' => $this->model->error,
'old_password_hash' => $old_password_hash,
'old_password_salt' => $old_password_salt,
'new_password_hash' => $this->model->active_user->getPasswordHash(),
'new_password_salt' => $this->model->active_user->getPasswordSalt()
]
);
if ($event->commit())
{
$embed = Logger::initDiscordEmbed($event, $this->model->active_user->getURI());
Logger::logToDiscord($event, $embed);
}
}
}