From 8b1a2406e61952fb8c26c8430a13db1093188702 Mon Sep 17 00:00:00 2001 From: Andrew Dolgov Date: Mon, 1 Mar 2021 19:32:27 +0300 Subject: [PATCH] userhelper: use orm for a few more user-related things --- classes/auth/base.php | 13 +++++----- classes/feeds.php | 5 ++-- classes/pref/users.php | 19 +++++--------- classes/userhelper.php | 42 +++++++++++++----------------- include/sessions.php | 26 ++++++++----------- plugins/auth_internal/init.php | 47 +++++++++++++++------------------- 6 files changed, 65 insertions(+), 87 deletions(-) diff --git a/classes/auth/base.php b/classes/auth/base.php index 9b2f630c0..883c0df30 100644 --- a/classes/auth/base.php +++ b/classes/auth/base.php @@ -23,13 +23,14 @@ abstract class Auth_Base extends Plugin implements IAuthModule { if (!$password) $password = make_password(); - $salt = UserHelper::get_salt(); - $pwd_hash = UserHelper::hash_password($password, $salt, UserHelper::HASH_ALGOS[0]); + $user = ORM::for_table('ttrss_users')->create(); - $sth = $this->pdo->prepare("INSERT INTO ttrss_users - (login,access_level,last_login,created,pwd_hash,salt) - VALUES (LOWER(?), 0, null, NOW(), ?,?)"); - $sth->execute([$login, $pwd_hash, $salt]); + $user->salt = UserHelper::get_salt(); + $user->login = mb_strtolower($login); + $user->pwd_hash = UserHelper::hash_password($password, $user->salt); + $user->access_level = 0; + $user->created = 'NOW()'; + $user->save(); return UserHelper::find_user_by_login($login); diff --git a/classes/feeds.php b/classes/feeds.php index 55a71aebb..bf165f93a 100755 --- a/classes/feeds.php +++ b/classes/feeds.php @@ -474,8 +474,9 @@ class Feeds extends Handler_Protected { /* bump login timestamp if needed */ if (time() - $_SESSION["last_login_update"] > 3600) { - $sth = $this->pdo->prepare("UPDATE ttrss_users SET last_login = NOW() WHERE id = ?"); - $sth->execute([$_SESSION['uid']]); + $user = ORM::for_table('ttrss_users')->find_one($_SESSION["uid"]); + $user->last_login = 'NOW()'; + $user->save(); $_SESSION["last_login_update"] = time(); } diff --git a/classes/pref/users.php b/classes/pref/users.php index ff9bf1712..071f20a73 100644 --- a/classes/pref/users.php +++ b/classes/pref/users.php @@ -113,7 +113,7 @@ class Pref_Users extends Handler_Administrative { if ($id == 1) $login = "admin"; if (!$login) return; - $user->login = $login; + $user->login = mb_strtolower($login); $user->access_level = (int) clean($_REQUEST["access_level"]); $user->email = clean($_REQUEST["email"]); @@ -144,30 +144,25 @@ class Pref_Users extends Handler_Administrative { function add() { $login = clean($_REQUEST["login"]); - $tmp_user_pwd = make_password(); - $salt = UserHelper::get_salt(); if (!$login) return; // no blank usernames if (!UserHelper::find_user_by_login($login)) { + $new_password = make_password(); + $user = ORM::for_table('ttrss_users')->create(); - $tmp_user_pwd = make_password(); - $salt = UserHelper::get_salt(); - - $user->login = $login; - $user->pwd_hash = UserHelper::hash_password($tmp_user_pwd, $salt); + $user->salt = UserHelper::get_salt(); + $user->login = mb_strtolower($login); + $user->pwd_hash = UserHelper::hash_password($new_password, $user->salt); $user->access_level = 0; - $user->salt = $salt; $user->created = 'NOW()'; $user->save(); if ($new_uid = UserHelper::find_user_by_login($login)) { - print T_sprintf("Added user %s with password %s", - $login, $tmp_user_pwd); - + $login, $new_password); } else { print T_sprintf("Could not create user %s", $login); } diff --git a/classes/userhelper.php b/classes/userhelper.php index 84dc71383..1d14b51b0 100644 --- a/classes/userhelper.php +++ b/classes/userhelper.php @@ -131,8 +131,9 @@ class UserHelper { } else { /* bump login timestamp */ - $sth = $pdo->prepare("UPDATE ttrss_users SET last_login = NOW() WHERE id = ?"); - $sth->execute([$_SESSION['uid']]); + $user = ORM::for_table('ttrss_users')->find_one($_SESSION["uid"]); + $user->last_login = 'NOW()'; + $user->save(); $_SESSION["last_login_update"] = time(); } @@ -202,38 +203,31 @@ class UserHelper { static function reset_password($uid, $format_output = false, $new_password = "") { - $pdo = Db::pdo(); + $user = ORM::for_table('ttrss_users')->find_one($uid); + $message = ""; - $sth = $pdo->prepare("SELECT login FROM ttrss_users WHERE id = ?"); - $sth->execute([$uid]); + if ($user) { - if ($row = $sth->fetch()) { - - $login = $row["login"]; + $login = $user->login; $new_salt = self::get_salt(); $tmp_user_pwd = $new_password ? $new_password : make_password(); $pwd_hash = self::hash_password($tmp_user_pwd, $new_salt, self::HASH_ALGOS[0]); - $user = ORM::for_table('ttrss_users')->find_one($uid); - - if ($user) { - $user->pwd_hash = $pwd_hash; - $user->salt = $new_salt; - $user->save(); - - $message = T_sprintf("Changed password of user %s to %s", "$login", "$tmp_user_pwd"); - } else { - $message = T_sprintf("User not found: %s", $login); - } - - if ($format_output) - print_notice($message); - else - print $message; + $user->pwd_hash = $pwd_hash; + $user->salt = $new_salt; + $user->save(); + $message = T_sprintf("Changed password of user %s to %s", "$login", "$tmp_user_pwd"); + } else { + $message = __("User not found"); } + + if ($format_output) + print_notice($message); + else + print $message; } static function check_otp(int $owner_uid, int $otp_check) : bool { diff --git a/include/sessions.php b/include/sessions.php index 04c24cf72..0fa8428ad 100644 --- a/include/sessions.php +++ b/include/sessions.php @@ -36,27 +36,21 @@ return false; } - $sth = $pdo->prepare("SELECT pwd_hash FROM ttrss_users WHERE id = ?"); - $sth->execute([$_SESSION['uid']]); + $user = \ORM::for_table('ttrss_users')->find_one($_SESSION["uid"]); - // user not found - if ($row = $sth->fetch()) { - $pwd_hash = $row["pwd_hash"]; + if ($user) { + if ($user->pwd_hash != $_SESSION["pwd_hash"]) { - if ($pwd_hash != $_SESSION["pwd_hash"]) { + $_SESSION["login_error_msg"] = + __("Session failed to validate (password changed)"); - $_SESSION["login_error_msg"] = - __("Session failed to validate (password changed)"); - - return false; - } + return false; + } } else { + $_SESSION["login_error_msg"] = + __("Session failed to validate (user not found)"); - $_SESSION["login_error_msg"] = - __("Session failed to validate (user not found)"); - - return false; - + return false; } } diff --git a/plugins/auth_internal/init.php b/plugins/auth_internal/init.php index b0596eed6..70f071057 100644 --- a/plugins/auth_internal/init.php +++ b/plugins/auth_internal/init.php @@ -146,19 +146,13 @@ class Auth_Internal extends Auth_Base { function check_password(int $owner_uid, string $password, string $service = '') { - if (get_schema_version() > 87) { - $sth = $this->pdo->prepare("SELECT login,pwd_hash,salt FROM ttrss_users WHERE id = ?"); - } else { - $sth = $this->pdo->prepare("SELECT login,pwd_hash FROM ttrss_users WHERE id = ?"); - } + $user = ORM::for_table('ttrss_users')->find_one($owner_uid); - $sth->execute([$owner_uid]); + if ($user) { - if ($row = $sth->fetch()) { - - $salt = $row['salt'] ?? ""; - $login = $row['login']; - $pwd_hash = $row['pwd_hash']; + $salt = $user['salt'] ?? ""; + $login = $user['login']; + $pwd_hash = $user['pwd_hash']; list ($pwd_algo, $raw_hash) = explode(":", $pwd_hash, 2); @@ -194,33 +188,31 @@ class Auth_Internal extends Auth_Base { $new_salt = UserHelper::get_salt(); $new_password_hash = UserHelper::hash_password($new_password, $new_salt, UserHelper::HASH_ALGOS[0]); - $sth = $this->pdo->prepare("UPDATE ttrss_users SET - pwd_hash = ?, salt = ?, otp_enabled = false - WHERE id = ?"); - $sth->execute([$new_password_hash, $new_salt, $owner_uid]); + $user = ORM::for_table('ttrss_users')->find_one($owner_uid); + + $user->salt = $new_salt; + $user->pwd_hash = $new_password_hash; + $user->save(); if ($_SESSION["uid"] ?? 0 == $owner_uid) $_SESSION["pwd_hash"] = $new_password_hash; - $sth = $this->pdo->prepare("SELECT email, login FROM ttrss_users WHERE id = ?"); - $sth->execute([$owner_uid]); - - if ($row = $sth->fetch()) { + if ($user->email) { $mailer = new Mailer(); $tpl = new Templator(); $tpl->readTemplateFromFile("password_change_template.txt"); - $tpl->setVariable('LOGIN', $row["login"]); + $tpl->setVariable('LOGIN', $user->login); $tpl->setVariable('TTRSS_HOST', Config::get(Config::SELF_URL_PATH)); $tpl->addBlock('message'); $tpl->generateOutputToString($message); - $mailer->mail(["to_name" => $row["login"], - "to_address" => $row["email"], + $mailer->mail(["to_name" => $user->login, + "to_address" => $user->email, "subject" => "[tt-rss] Password change notification", "message" => $message]); @@ -244,21 +236,22 @@ class Auth_Internal extends Auth_Base { $test_hash = UserHelper::hash_password($password, $salt, $pwd_algo); if (hash_equals("$pwd_algo:$raw_hash", $test_hash)) { - $usth = $this->pdo->prepare("UPDATE ttrss_app_passwords SET last_used = NOW() WHERE id = ?"); - $usth->execute([$row['id']]); + $pass = ORM::for_table('ttrss_app_passwords')->find_one($row["id"]); + $pass->last_used = 'NOW()'; if ($pwd_algo != UserHelper::HASH_ALGOS[0]) { // upgrade password to current algo Logger::log(E_USER_NOTICE, "Upgrading app password of user $login to " . UserHelper::HASH_ALGOS[0]); - $new_hash = UserHelper::hash_password($password, $salt, UserHelper::HASH_ALGOS[0]); + $new_hash = UserHelper::hash_password($password, $salt); if ($new_hash) { - $usth = $this->pdo->prepare("UPDATE ttrss_app_passwords SET pwd_hash = ? WHERE id = ?"); - $usth->execute(["$new_hash:$salt", $row['id']]); + $pass->pwd_hash = "$new_hash:$salt"; } } + $pass->save(); + return $row['uid']; } }