userhelper: use orm for a few more user-related things
This commit is contained in:
parent
127a868e40
commit
8b1a2406e6
|
@ -23,13 +23,14 @@ abstract class Auth_Base extends Plugin implements IAuthModule {
|
||||||
|
|
||||||
if (!$password) $password = make_password();
|
if (!$password) $password = make_password();
|
||||||
|
|
||||||
$salt = UserHelper::get_salt();
|
$user = ORM::for_table('ttrss_users')->create();
|
||||||
$pwd_hash = UserHelper::hash_password($password, $salt, UserHelper::HASH_ALGOS[0]);
|
|
||||||
|
|
||||||
$sth = $this->pdo->prepare("INSERT INTO ttrss_users
|
$user->salt = UserHelper::get_salt();
|
||||||
(login,access_level,last_login,created,pwd_hash,salt)
|
$user->login = mb_strtolower($login);
|
||||||
VALUES (LOWER(?), 0, null, NOW(), ?,?)");
|
$user->pwd_hash = UserHelper::hash_password($password, $user->salt);
|
||||||
$sth->execute([$login, $pwd_hash, $salt]);
|
$user->access_level = 0;
|
||||||
|
$user->created = 'NOW()';
|
||||||
|
$user->save();
|
||||||
|
|
||||||
return UserHelper::find_user_by_login($login);
|
return UserHelper::find_user_by_login($login);
|
||||||
|
|
||||||
|
|
|
@ -474,8 +474,9 @@ class Feeds extends Handler_Protected {
|
||||||
|
|
||||||
/* bump login timestamp if needed */
|
/* bump login timestamp if needed */
|
||||||
if (time() - $_SESSION["last_login_update"] > 3600) {
|
if (time() - $_SESSION["last_login_update"] > 3600) {
|
||||||
$sth = $this->pdo->prepare("UPDATE ttrss_users SET last_login = NOW() WHERE id = ?");
|
$user = ORM::for_table('ttrss_users')->find_one($_SESSION["uid"]);
|
||||||
$sth->execute([$_SESSION['uid']]);
|
$user->last_login = 'NOW()';
|
||||||
|
$user->save();
|
||||||
|
|
||||||
$_SESSION["last_login_update"] = time();
|
$_SESSION["last_login_update"] = time();
|
||||||
}
|
}
|
||||||
|
|
|
@ -113,7 +113,7 @@ class Pref_Users extends Handler_Administrative {
|
||||||
if ($id == 1) $login = "admin";
|
if ($id == 1) $login = "admin";
|
||||||
if (!$login) return;
|
if (!$login) return;
|
||||||
|
|
||||||
$user->login = $login;
|
$user->login = mb_strtolower($login);
|
||||||
$user->access_level = (int) clean($_REQUEST["access_level"]);
|
$user->access_level = (int) clean($_REQUEST["access_level"]);
|
||||||
$user->email = clean($_REQUEST["email"]);
|
$user->email = clean($_REQUEST["email"]);
|
||||||
|
|
||||||
|
@ -144,30 +144,25 @@ class Pref_Users extends Handler_Administrative {
|
||||||
|
|
||||||
function add() {
|
function add() {
|
||||||
$login = clean($_REQUEST["login"]);
|
$login = clean($_REQUEST["login"]);
|
||||||
$tmp_user_pwd = make_password();
|
|
||||||
$salt = UserHelper::get_salt();
|
|
||||||
|
|
||||||
if (!$login) return; // no blank usernames
|
if (!$login) return; // no blank usernames
|
||||||
|
|
||||||
if (!UserHelper::find_user_by_login($login)) {
|
if (!UserHelper::find_user_by_login($login)) {
|
||||||
|
|
||||||
|
$new_password = make_password();
|
||||||
|
|
||||||
$user = ORM::for_table('ttrss_users')->create();
|
$user = ORM::for_table('ttrss_users')->create();
|
||||||
|
|
||||||
$tmp_user_pwd = make_password();
|
$user->salt = UserHelper::get_salt();
|
||||||
$salt = UserHelper::get_salt();
|
$user->login = mb_strtolower($login);
|
||||||
|
$user->pwd_hash = UserHelper::hash_password($new_password, $user->salt);
|
||||||
$user->login = $login;
|
|
||||||
$user->pwd_hash = UserHelper::hash_password($tmp_user_pwd, $salt);
|
|
||||||
$user->access_level = 0;
|
$user->access_level = 0;
|
||||||
$user->salt = $salt;
|
|
||||||
$user->created = 'NOW()';
|
$user->created = 'NOW()';
|
||||||
$user->save();
|
$user->save();
|
||||||
|
|
||||||
if ($new_uid = UserHelper::find_user_by_login($login)) {
|
if ($new_uid = UserHelper::find_user_by_login($login)) {
|
||||||
|
|
||||||
print T_sprintf("Added user %s with password %s",
|
print T_sprintf("Added user %s with password %s",
|
||||||
$login, $tmp_user_pwd);
|
$login, $new_password);
|
||||||
|
|
||||||
} else {
|
} else {
|
||||||
print T_sprintf("Could not create user %s", $login);
|
print T_sprintf("Could not create user %s", $login);
|
||||||
}
|
}
|
||||||
|
|
|
@ -131,8 +131,9 @@ class UserHelper {
|
||||||
|
|
||||||
} else {
|
} else {
|
||||||
/* bump login timestamp */
|
/* bump login timestamp */
|
||||||
$sth = $pdo->prepare("UPDATE ttrss_users SET last_login = NOW() WHERE id = ?");
|
$user = ORM::for_table('ttrss_users')->find_one($_SESSION["uid"]);
|
||||||
$sth->execute([$_SESSION['uid']]);
|
$user->last_login = 'NOW()';
|
||||||
|
$user->save();
|
||||||
|
|
||||||
$_SESSION["last_login_update"] = time();
|
$_SESSION["last_login_update"] = time();
|
||||||
}
|
}
|
||||||
|
@ -202,38 +203,31 @@ class UserHelper {
|
||||||
|
|
||||||
static function reset_password($uid, $format_output = false, $new_password = "") {
|
static function reset_password($uid, $format_output = false, $new_password = "") {
|
||||||
|
|
||||||
$pdo = Db::pdo();
|
$user = ORM::for_table('ttrss_users')->find_one($uid);
|
||||||
|
$message = "";
|
||||||
|
|
||||||
$sth = $pdo->prepare("SELECT login FROM ttrss_users WHERE id = ?");
|
if ($user) {
|
||||||
$sth->execute([$uid]);
|
|
||||||
|
|
||||||
if ($row = $sth->fetch()) {
|
$login = $user->login;
|
||||||
|
|
||||||
$login = $row["login"];
|
|
||||||
|
|
||||||
$new_salt = self::get_salt();
|
$new_salt = self::get_salt();
|
||||||
$tmp_user_pwd = $new_password ? $new_password : make_password();
|
$tmp_user_pwd = $new_password ? $new_password : make_password();
|
||||||
|
|
||||||
$pwd_hash = self::hash_password($tmp_user_pwd, $new_salt, self::HASH_ALGOS[0]);
|
$pwd_hash = self::hash_password($tmp_user_pwd, $new_salt, self::HASH_ALGOS[0]);
|
||||||
|
|
||||||
$user = ORM::for_table('ttrss_users')->find_one($uid);
|
$user->pwd_hash = $pwd_hash;
|
||||||
|
$user->salt = $new_salt;
|
||||||
if ($user) {
|
$user->save();
|
||||||
$user->pwd_hash = $pwd_hash;
|
|
||||||
$user->salt = $new_salt;
|
|
||||||
$user->save();
|
|
||||||
|
|
||||||
$message = T_sprintf("Changed password of user %s to %s", "<strong>$login</strong>", "<strong>$tmp_user_pwd</strong>");
|
|
||||||
} else {
|
|
||||||
$message = T_sprintf("User not found: %s", $login);
|
|
||||||
}
|
|
||||||
|
|
||||||
if ($format_output)
|
|
||||||
print_notice($message);
|
|
||||||
else
|
|
||||||
print $message;
|
|
||||||
|
|
||||||
|
$message = T_sprintf("Changed password of user %s to %s", "<strong>$login</strong>", "<strong>$tmp_user_pwd</strong>");
|
||||||
|
} else {
|
||||||
|
$message = __("User not found");
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if ($format_output)
|
||||||
|
print_notice($message);
|
||||||
|
else
|
||||||
|
print $message;
|
||||||
}
|
}
|
||||||
|
|
||||||
static function check_otp(int $owner_uid, int $otp_check) : bool {
|
static function check_otp(int $owner_uid, int $otp_check) : bool {
|
||||||
|
|
|
@ -36,27 +36,21 @@
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
$sth = $pdo->prepare("SELECT pwd_hash FROM ttrss_users WHERE id = ?");
|
$user = \ORM::for_table('ttrss_users')->find_one($_SESSION["uid"]);
|
||||||
$sth->execute([$_SESSION['uid']]);
|
|
||||||
|
|
||||||
// user not found
|
if ($user) {
|
||||||
if ($row = $sth->fetch()) {
|
if ($user->pwd_hash != $_SESSION["pwd_hash"]) {
|
||||||
$pwd_hash = $row["pwd_hash"];
|
|
||||||
|
|
||||||
if ($pwd_hash != $_SESSION["pwd_hash"]) {
|
$_SESSION["login_error_msg"] =
|
||||||
|
__("Session failed to validate (password changed)");
|
||||||
|
|
||||||
$_SESSION["login_error_msg"] =
|
return false;
|
||||||
__("Session failed to validate (password changed)");
|
}
|
||||||
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
} else {
|
} else {
|
||||||
|
$_SESSION["login_error_msg"] =
|
||||||
|
__("Session failed to validate (user not found)");
|
||||||
|
|
||||||
$_SESSION["login_error_msg"] =
|
return false;
|
||||||
__("Session failed to validate (user not found)");
|
|
||||||
|
|
||||||
return false;
|
|
||||||
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -146,19 +146,13 @@ class Auth_Internal extends Auth_Base {
|
||||||
|
|
||||||
function check_password(int $owner_uid, string $password, string $service = '') {
|
function check_password(int $owner_uid, string $password, string $service = '') {
|
||||||
|
|
||||||
if (get_schema_version() > 87) {
|
$user = ORM::for_table('ttrss_users')->find_one($owner_uid);
|
||||||
$sth = $this->pdo->prepare("SELECT login,pwd_hash,salt FROM ttrss_users WHERE id = ?");
|
|
||||||
} else {
|
|
||||||
$sth = $this->pdo->prepare("SELECT login,pwd_hash FROM ttrss_users WHERE id = ?");
|
|
||||||
}
|
|
||||||
|
|
||||||
$sth->execute([$owner_uid]);
|
if ($user) {
|
||||||
|
|
||||||
if ($row = $sth->fetch()) {
|
$salt = $user['salt'] ?? "";
|
||||||
|
$login = $user['login'];
|
||||||
$salt = $row['salt'] ?? "";
|
$pwd_hash = $user['pwd_hash'];
|
||||||
$login = $row['login'];
|
|
||||||
$pwd_hash = $row['pwd_hash'];
|
|
||||||
|
|
||||||
list ($pwd_algo, $raw_hash) = explode(":", $pwd_hash, 2);
|
list ($pwd_algo, $raw_hash) = explode(":", $pwd_hash, 2);
|
||||||
|
|
||||||
|
@ -194,33 +188,31 @@ class Auth_Internal extends Auth_Base {
|
||||||
$new_salt = UserHelper::get_salt();
|
$new_salt = UserHelper::get_salt();
|
||||||
$new_password_hash = UserHelper::hash_password($new_password, $new_salt, UserHelper::HASH_ALGOS[0]);
|
$new_password_hash = UserHelper::hash_password($new_password, $new_salt, UserHelper::HASH_ALGOS[0]);
|
||||||
|
|
||||||
$sth = $this->pdo->prepare("UPDATE ttrss_users SET
|
$user = ORM::for_table('ttrss_users')->find_one($owner_uid);
|
||||||
pwd_hash = ?, salt = ?, otp_enabled = false
|
|
||||||
WHERE id = ?");
|
$user->salt = $new_salt;
|
||||||
$sth->execute([$new_password_hash, $new_salt, $owner_uid]);
|
$user->pwd_hash = $new_password_hash;
|
||||||
|
$user->save();
|
||||||
|
|
||||||
if ($_SESSION["uid"] ?? 0 == $owner_uid)
|
if ($_SESSION["uid"] ?? 0 == $owner_uid)
|
||||||
$_SESSION["pwd_hash"] = $new_password_hash;
|
$_SESSION["pwd_hash"] = $new_password_hash;
|
||||||
|
|
||||||
$sth = $this->pdo->prepare("SELECT email, login FROM ttrss_users WHERE id = ?");
|
if ($user->email) {
|
||||||
$sth->execute([$owner_uid]);
|
|
||||||
|
|
||||||
if ($row = $sth->fetch()) {
|
|
||||||
$mailer = new Mailer();
|
$mailer = new Mailer();
|
||||||
|
|
||||||
$tpl = new Templator();
|
$tpl = new Templator();
|
||||||
|
|
||||||
$tpl->readTemplateFromFile("password_change_template.txt");
|
$tpl->readTemplateFromFile("password_change_template.txt");
|
||||||
|
|
||||||
$tpl->setVariable('LOGIN', $row["login"]);
|
$tpl->setVariable('LOGIN', $user->login);
|
||||||
$tpl->setVariable('TTRSS_HOST', Config::get(Config::SELF_URL_PATH));
|
$tpl->setVariable('TTRSS_HOST', Config::get(Config::SELF_URL_PATH));
|
||||||
|
|
||||||
$tpl->addBlock('message');
|
$tpl->addBlock('message');
|
||||||
|
|
||||||
$tpl->generateOutputToString($message);
|
$tpl->generateOutputToString($message);
|
||||||
|
|
||||||
$mailer->mail(["to_name" => $row["login"],
|
$mailer->mail(["to_name" => $user->login,
|
||||||
"to_address" => $row["email"],
|
"to_address" => $user->email,
|
||||||
"subject" => "[tt-rss] Password change notification",
|
"subject" => "[tt-rss] Password change notification",
|
||||||
"message" => $message]);
|
"message" => $message]);
|
||||||
|
|
||||||
|
@ -244,21 +236,22 @@ class Auth_Internal extends Auth_Base {
|
||||||
$test_hash = UserHelper::hash_password($password, $salt, $pwd_algo);
|
$test_hash = UserHelper::hash_password($password, $salt, $pwd_algo);
|
||||||
|
|
||||||
if (hash_equals("$pwd_algo:$raw_hash", $test_hash)) {
|
if (hash_equals("$pwd_algo:$raw_hash", $test_hash)) {
|
||||||
$usth = $this->pdo->prepare("UPDATE ttrss_app_passwords SET last_used = NOW() WHERE id = ?");
|
$pass = ORM::for_table('ttrss_app_passwords')->find_one($row["id"]);
|
||||||
$usth->execute([$row['id']]);
|
$pass->last_used = 'NOW()';
|
||||||
|
|
||||||
if ($pwd_algo != UserHelper::HASH_ALGOS[0]) {
|
if ($pwd_algo != UserHelper::HASH_ALGOS[0]) {
|
||||||
// upgrade password to current algo
|
// upgrade password to current algo
|
||||||
Logger::log(E_USER_NOTICE, "Upgrading app password of user $login to " . UserHelper::HASH_ALGOS[0]);
|
Logger::log(E_USER_NOTICE, "Upgrading app password of user $login to " . UserHelper::HASH_ALGOS[0]);
|
||||||
|
|
||||||
$new_hash = UserHelper::hash_password($password, $salt, UserHelper::HASH_ALGOS[0]);
|
$new_hash = UserHelper::hash_password($password, $salt);
|
||||||
|
|
||||||
if ($new_hash) {
|
if ($new_hash) {
|
||||||
$usth = $this->pdo->prepare("UPDATE ttrss_app_passwords SET pwd_hash = ? WHERE id = ?");
|
$pass->pwd_hash = "$new_hash:$salt";
|
||||||
$usth->execute(["$new_hash:$salt", $row['id']]);
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
$pass->save();
|
||||||
|
|
||||||
return $row['uid'];
|
return $row['uid'];
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue