Khaganat-NeL/khanat-opennel-code
2
0
Fork 0
Code Issues 21 Pull requests Projects Releases 1 Packages Wiki Activity

change password is now usable for GM's too by using a GET['id'] param!

Browse source 
--HG--
branch : quitta-gsoc-2013
This commit is contained in:
Quitta 2013-07-01 23:29:16 +02:00
parent 23e9b57703
commit 75ff3e1ed4
6 changed files with 173 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
code/ryzom/tools/server/ryzom_ams/ams_lib/autoload/users.php
View file

@ -313,6 +313,8 @@ class Users{
}
public function check_change_password($values){
//if admin isn't changing others
if(!$values['adminChangesOther']){
if ( isset( $values["user"] ) and isset( $values["CurrentPass"] ) and isset( $values["ConfirmNewPass"] ) and isset( $values["NewPass"] ) ){
$match = $this->checkLoginMatch($values["user"],$values["CurrentPass"]);
$newpass = $this->checkPassword($values["NewPass"]);
@ -322,19 +324,33 @@ class Users{
$newpass = "";
$confpass = "";
}
if ( ( $match != "fail" ) and ( $newpass == "success" ) and ( $confpass == "success" ) ){
}else{
//if admin is indeed changing someone!
if ( isset( $values["user"] ) and isset( $values["ConfirmNewPass"] ) and isset( $values["NewPass"] ) ){
$newpass = $this->checkPassword($values["NewPass"]);
$confpass = $this->confirmPassword($newpass,$values["NewPass"],$values["ConfirmNewPass"]);
}else{
$newpass = "";
$confpass = "";
}
}
if ( !$values['adminChangesOther'] and ( $match != "fail" ) and ( $newpass == "success" ) and ( $confpass == "success" ) ){
return "success";
}else if($values['adminChangesOther'] and ( $newpass == "success" ) and ( $confpass == "success" ) ){
return "success";
}else{
$pageElements = array(
'match_error_message' => $match,
'newpass_error_message' => $newpass,
'confirmnewpass_error_message' => $confpass
);
if(!$values['adminChangesOther']){
$pageElements['match_error_message'] = $match;
if ( $match != "fail" ){
$pageElements['MATCH_ERROR'] = 'FALSE';
}else{
$pageElements['MATCH_ERROR'] = 'TRUE';
}
}
if ( $newpass != "success" ){
$pageElements['NEWPASSWORD_ERROR'] = 'TRUE';
}else{
@ -348,6 +364,29 @@ class Users{
return $pageElements;
}
}
protected function setPassword($user, $pass){
try {
//make connection with and put into shard db
global $cfg;
$dbs = new DBLayer($cfg['db']['shard']);
$dbs->execute("UPDATE user SET Password = :pass WHERE Login = :user ",$values);
return "ok";
}
catch (PDOException $e) {
//oh noooz, the shard is offline! Put in query queue at ams_lib db!
/*try {
$dbl = new DBLayer($cfg['db']['lib']);
$dbl->execute("INSERT INTO ams_querycache (type, query) VALUES (:type, :query)",array("type" => "createUser",
"query" => json_encode(array($values["name"],$values["pass"],$values["mail"]))));
return "shardoffline";
}catch (PDOException $e) {
print_r($e);
return "liboffline";
}*/
}
}
}

21
code/ryzom/tools/server/ryzom_ams/www/html/autoload/webusers.php
View file

@ -48,9 +48,30 @@ class WebUsers extends Users{
}else{
return "fail";
}
}
public function getUsername($id){
global $cfg;
$dbw = new DBLayer($cfg['db']['web']);
$statement = $dbw->execute("SELECT * FROM ams_user WHERE UId=:id", array('id' => $id));
$row = $statement->fetch();
return $row['Login'];
}
public function isLoggedIn(){
if(isset($_SESSION['user'])){
return true;
}
return false;
}
public function isAdmin(){
if(isset($_SESSION['permission']) && $_SESSION['permission'] == 2){
return true;
}
return false;
}
}

42
code/ryzom/tools/server/ryzom_ams/www/html/func/change_password.php
View file

@ -3,23 +3,61 @@
function change_password(){
try{
if(isset($_SESSION["user"])){
//if logged in
if(WebUsers::isLoggedIn()){
if(isset($_POST['target_id'])){
$adminChangesOther = false;
//if target_id is the same as session id or is admin
if( ($_POST['target_id'] == $_SESSION['id']) || WebUsers::isAdmin() ){
if($_POST['target_id'] == $_SESSION['id']){
$target_username = $_SESSION['user'];
}else{
$target_username = WebUsers::getUsername($_POST['target_id']);
//isAdmin is true when it's the admin, but the target_id != own id
$adminChangesOther = true;
$_POST["CurrentPass"] = "dummypass";
}
$id = $_POST['target_id'];
$webUser = new WebUsers();
$params = Array( 'user' => $_SESSION["user"], 'CurrentPass' => $_POST["CurrentPass"], 'NewPass' => $_POST["NewPass"], 'ConfirmNewPass' => $_POST["ConfirmNewPass"]);
$params = Array( 'user' => $target_username, 'CurrentPass' => $_POST["CurrentPass"], 'NewPass' => $_POST["NewPass"], 'ConfirmNewPass' => $_POST["ConfirmNewPass"], 'adminChangesOther' => $adminChangesOther);
$result = $webUser->check_change_password($params);
if ($result == "success"){
//edit stuff into db
$hashpass = crypt($_POST["NewPass"], WebUsers::generateSALT());
print('success!');
exit;
}else{
$result['prevCurrentPass'] = $_POST["CurrentPass"];
$result['prevNewPass'] = $_POST["NewPass"];
$result['prevConfirmNewPass'] = $_POST["ConfirmNewPass"];
$result['permission'] = $_SESSION['permission'];
$result['no_visible_elements'] = 'FALSE';
$result['target_id'] = $_POST['target_id'];
if(isset($_GET['id'])){
if(WebUsers::isAdmin() && ($_POST['target_id'] != $_SESSION['id'])){
$result['isAdmin'] = "TRUE";
}
}
helpers :: loadtemplate( 'settings', $result);
exit;
}
}else{
//ERROR: permission denied!
}
}else{
//ERROR: The form was not filled in correclty
}
}else{
//ERROR: user is not logged in
exit;
}
}catch (PDOException $e) {
//go to error page or something, because can't access website db
print_r($e);

3
code/ryzom/tools/server/ryzom_ams/www/html/func/login.php
View file

@ -10,6 +10,9 @@ function login(){
//handle successful login
$_SESSION['user'] = $_POST["Username"];
$_SESSION['permission'] = $result['Permission'];
$_SESSION['id'] = $result['UId'];
print('id=');
print($_SESSION['id']);
//go back to the index page.
header( 'Location: index.php' );
exit;

21
code/ryzom/tools/server/ryzom_ams/www/html/inc/settings.php Normal file
View file

@ -0,0 +1,21 @@
<?php
function settings(){
if(WebUsers::isLoggedIn()){
//in case id-GET param set it's value as target_id, if no id-param is given, ue the session id.
if(isset($_GET['id'])){
if(WebUsers::isAdmin() && ($_GET['id']!= $_SESSION['id'])){
$result['isAdmin'] = "TRUE";
}
$result['target_id'] = $_GET['id'];
}else{
$result['target_id'] = $_SESSION['id'];
}
return $result;
}else{
//ERROR: not logged in!
print("not logged in!");
exit;
}
}

7
code/ryzom/tools/server/ryzom_ams/www/html/templates/settings.tpl
View file

@ -10,9 +10,10 @@
</div>
<div class="box-content">
<div class="row-fluid">
<form id="changePassword" class="form-vertical" method="post" action="index.php">
<form id="changePassword" class="form-vertical" method="post" action="index.php?page=settings&id={$target_id}">
<legend>Change Password</legend>
{if !isset($isAdmin) or $isAdmin eq "FALSE"}
<div class="control-group {if isset($MATCH_ERROR) and $MATCH_ERROR eq "TRUE"}error{else if
isset($match_error_message) and $match_error_message neq "fail"}success{else}{/if}">
<label class="control-label">Current Password</label>
@ -24,7 +25,7 @@
</div>
</div>
</div>
{/if}
<div class="control-group {if isset($NEWPASSWORD_ERROR) and $NEWPASSWORD_ERROR eq "TRUE"}error{else if
isset($newpass_error_message) and $newpass_error_message eq "success"}success{else}{/if}">
<label class="control-label">New Password</label>
@ -50,7 +51,7 @@
</div>
<input type="hidden" name="function" value="change_password">
<input type="hidden" name="target_id" value="{$target_id}">
<div class="control-group">
<label class="control-label"></label>
<div class="controls">