| - |
';
$ret .= '
';
+
+ $pg .= ' | Password Reset'; + $pg .= makeForm(''); + $pg .= " +
" . - "at least one of each uppercase, lowercase and digits, but not Tab"; + $data['error'] = "Password is unsafe"; } elseif ($pass2 != $pass) { @@ -108,7 +133,86 @@ function show_reg($page, $menu, $name, $u) $data['error'] = "Invalid username, password or email address"; } - gopage($data, 'doreg', $page, $menu, $name, $u, true, true, false); + gopage($data, 'doregres', $page, $menu, $name, $u, true, true, false); +} +# +function doreset2($data) +{ + $user = $data['user']; + $email = $data['email']; + + $emailinfo = getOpts($user, emailOptList()); + if ($emailinfo['STATUS'] != 'ok') + syserror(); + + $ans = getAtts($user, 'KLastReset.dateexp'); + if ($ans['STATUS'] != 'ok') + syserror(); + + // If the last attempt hasn't expired don't do anything but show a fake msg + if (!isset($ans['KLastReset.dateexp']) || $ans['KLastReset.dateexp'] == 'Y') + { + // This line $code = isn't an attempt at security - + // it's simply to ensure the username is readable when we get it back + $code = bin2hex($data['user']). '_'; + + // A code that's large enough to not be worth guessing + $ran = $ans['STAMP'].$user.$email.rand(100000000,999999999); + $hash = hash('md4', $ran); + + $ans = setAtts($user, array('ua_KReset.str' => $hash, + 'ua_KReset.date' => 'now+3600', + 'ua_LastReset.date' => 'now+3600')); + if ($ans['STATUS'] != 'ok') + syserror(); + + $ok = passReset($email, $code.$hash, zeip(), $emailinfo); + if ($ok === false) + syserror(); + } + + $pg = ' Reset Sent'; + $pg .= 'An Email has been sent that will allow you to'; + $pg .= ' reset your password.'; + $pg .= ' If you got your username or email address wrong,'; + $pg .= ' you wont get the email.'; + return $pg; +} +# +function try_reset($page, $menu, $name, $u) +{ + $user = getparam('user', false); + $mail = trim(getparam('mail', false)); + + // Slow this right down + usleep(500000); + + $data = array(); + + if (!nuem($user)) + $user = loginStr($user); + + if (!nuem($user) && !nuem($mail)) + { + $ans = userSettings($user); + if ($ans['STATUS'] == 'ok' && isset($ans['email']) && $ans['email'] == $mail) + { + $data = array('user' => $user, 'email' => $mail); + + gopage($data, 'doreset2', $page, $menu, $name, $u, true, true, false); + } + } + + gopage($data, 'doregres', $page, $menu, $name, $u, true, true, false); +} +# +function show_reg($page, $menu, $name, $u) +{ + $reg = getparam('Register', false); + if ($reg !== NULL) + try_reg($page, $menu, $name, $u); + else + try_reset($page, $menu, $name, $u); } # ?> diff --git a/pool/page_reset.php b/pool/page_reset.php new file mode 100644 index 00000000..7dc584fe --- /dev/null +++ b/pool/page_reset.php @@ -0,0 +1,166 @@ +
Password Reset'; + $pg .= 'Your password has been reset,'; + $pg .= ' login with it on the Home page.'; + return $pg; +} +# +function resetfail() +{ + if (isset($_SESSION['reset_user'])) + unset($_SESSION['reset_user']); + if (isset($_SESSION['reset_hash'])) + unset($_SESSION['reset_hash']); + if (isset($_SESSION['reset_email'])) + unset($_SESSION['reset_email']); + $pg = ' Reset Failed'; + $pg .= 'Try again from the Home page Register/Reset button later'; + return $pg; +} +# +function dbreset() +{ + $user = $_SESSION['reset_user']; + $hash = $_SESSION['reset_hash']; + $email = $_SESSION['reset_email']; + + $pass = getparam('pass', true); + $pass2 = getparam('pass2', true); + + if (nuem($pass) || nuem($pass2)) + return allow_reset('Enter both passwords'); + + if ($pass2 != $pass) + return allow_reset("Passwords don't match"); + + if (safepass($pass) !== true) + return allow_reset('Password is unsafe'); + + $ans = getAtts($user, 'KReset.str,KReset.dateexp'); + if ($ans['STATUS'] != 'ok') + return resetfail(); + + if (!isset($ans['KReset.dateexp']) || $ans['KReset.dateexp'] == 'Y') + return resetfail(); + + if (!isset($ans['KReset.str']) || $ans['KReset.str'] != $hash) + return resetfail(); + + $emailinfo = getOpts($user, emailOptList()); + if ($emailinfo['STATUS'] != 'ok') + syserror(); + + $ans = resetPass($user, $pass); + if ($ans['STATUS'] != 'ok') + syserror(); + + unset($_SESSION['reset_user']); + unset($_SESSION['reset_hash']); + unset($_SESSION['reset_email']); + + $ans = expAtts($user, 'KReset'); + + $ok = passWasReset($email, zeip(), $emailinfo); + + return yok(); +} +# +function doreset($data, $u) +{ + // Slow this right down + usleep(500000); + + if (isset($_SESSION['reset_user']) + && isset($_SESSION['reset_hash']) + && isset($_SESSION['reset_email'])) + return dbreset(); + + $code = getparam('code', true); + if (nuem($code)) + return resetfail(); + + $codes = explode('_', $code, 2); + + if (sizeof($codes) != 2) + return resetfail(); + + $userhex = $codes[0]; + + if (strlen($userhex) == 0 || strlen($userhex) % 2) + return resetfail(); + + $user = loginStr(pack("H*" , $userhex)); + + $hash = preg_replace('/[^A-Fa-f0-9]/', '', $codes[1]); + + if (!nuem($user) && !nuem($hash)) + { + $ans = getAtts($user, 'KReset.str,KReset.dateexp'); + if ($ans['STATUS'] != 'ok') + return resetfail(); + + if (!isset($ans['KReset.dateexp']) || $ans['KReset.dateexp'] == 'Y') + return resetfail(); + + if (!isset($ans['KReset.str']) || $ans['KReset.str'] != $hash) + return resetfail(); + + $ans = userSettings($user); + if ($ans['STATUS'] != 'ok') + return resetfail(); + + if (!isset($ans['email'])) + return resetfail(); + + $email = $ans['email']; + + $_SESSION['reset_user'] = $user; + $_SESSION['reset_hash'] = $hash; + $_SESSION['reset_email'] = $email; + + return allow_reset(null); + } + return resetfail(); +} +# +function show_reset($page, $menu, $name, $u) +{ + gopage(array(), 'doreset', $page, $menu, $name, $u, true, true, false); +} +# +?> diff --git a/pool/prime.php b/pool/prime.php index 55fba0b0..5fd579d5 100644 --- a/pool/prime.php +++ b/pool/prime.php @@ -6,28 +6,8 @@ $stt = microtime(); include_once('param.php'); include_once('base.php'); # -function process($p, $user) +function process($p, $user, $menu) { - $menu = array( - 'Home' => array( - 'Home' => '' - ), - 'Account' => array( - 'Workers' => 'workers', - 'Payments' => 'payments', - 'Settings' => 'settings' - ), - 'Pool' => array( - 'Stats' => 'stats', - 'Blocks' => 'blocks' - ), - 'Admin' => NULL, - 'gap' => NULL, - 'Help' => array( - 'Help' => 'help', - 'Payouts' => 'payout' - ) - ); if ($user == 'Kano' || $user == 'ckolivas' || $user == 'wvr2' || $user == 'aphorise') { $menu['Admin']['ckp'] = 'ckp'; @@ -35,7 +15,10 @@ function process($p, $user) $menu['Admin']['AllWork'] = 'allwork'; } else - unset($menu['Admin']); + { + if (isset($menu['Admin'])) + unset($menu['Admin']); + } $page = ''; $n = ''; foreach ($menu as $item => $options) @@ -55,19 +38,52 @@ function process($p, $user) # function check() { + $dmenu = array('Home' => array('Home' => ''), + 'gap' => NULL, + 'Help' => array('Help' => 'help', + 'Payouts' => 'payout')); + $menu = array( + 'Home' => array( + 'Home' => '' + ), + 'Account' => array( + 'Workers' => 'workers', + 'Payments' => 'payments', + 'Settings' => 'settings' + ), + 'Pool' => array( + 'Stats' => 'stats', + 'Blocks' => 'blocks' + ), + 'Admin' => NULL, + 'gap' => NULL, + 'Help' => array( + 'Help' => 'help', + 'Payouts' => 'payout' + ) + ); tryLogInOut(); $who = loggedIn(); if ($who === false) { - if (requestRegister() == true) - showPage('reg', NULL, '', $who); + $p = getparam('k', true); + if ($p == 'reset') + showPage('reset', $dmenu, '', $who); else - showIndex(); + { + if (requestRegister() == true) + showPage('reg', $dmenu, '', $who); + else + { + $p = getparam('k', true); + process($p, $who, $dmenu); + } + } } else { $p = getparam('k', true); - process($p, $who); + process($p, $who, $menu); } } # | |||||||||||||||||||||||||||||||