99/password.php at master · PinkWrite/99 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
<?php
declare(strict_types=1);
$import = ['auth', 'csrf', 'view', 'html', 'user', 'notify', 'passkey', 'oauth', 'audit'];
require __DIR__ . '/lib/boot.php';
$u = $app->auth->requireUser();
$msg = $err = '';
$uid = $app->auth->id();
$pks = $app->passkey->list($uid);
$oauths = $app->oauth->list($uid);
$canDisable = $pks !== [] && $oauths !== [];
$noPass = !$app->user->passwordLoginOn($u);

if ($_SERVER['REQUEST_METHOD'] === 'POST' && $app->csrf->check()) {
    if (isset($_POST['pw_login_toggle']) && $canDisable) {
        if (isset($_POST['disable_password'])) {
            $app->user->setPassLogin($uid, false);
            $u = $app->user->find($uid) ?? $u;
            $noPass = true;
            $msg = 'Password login is off.';
            $app->audit->record($uid, 'password_off', 'self');
        } elseif (!empty($u['pass'])) {
            $app->user->setPassLogin($uid, true);
            $u = $app->user->find($uid) ?? $u;
            $noPass = false;
            $msg = 'Password login is on.';
            $app->audit->record($uid, 'password_on', 'self');
        }
    } elseif (isset($_POST['disable_password']) && $canDisable) {
        $app->user->setPassLogin($uid, false);
        $u = $app->user->find($uid) ?? $u;
        $noPass = true;
        $msg = 'Password login is off.';
        $app->audit->record($uid, 'password_off', 'self');
    } else {
        $cur = (string) ($_POST['current'] ?? '');
        $p1 = (string) ($_POST['pass1'] ?? '');
        $p2 = (string) ($_POST['pass2'] ?? '');
        if ($p1 === '' && $p2 === '') {
            // checkbox uncheck does not POST here
        } elseif (!$noPass && !password_verify($cur, (string) $u['pass'])) {
            $err = 'Current password is incorrect.';
        } elseif (strlen($p1) < 8 || $p1 !== $p2) {
            $err = 'New passwords must match and be at least 8 characters.';
        } else {
            $app->user->setPassword($uid, $p1);
            $msg = 'Password changed.';
            $noPass = false;
            $u = $app->user->find($uid) ?? $u;
            $app->audit->record($uid, 'password', 'self');
            if ($u['editor_id']) {
                $app->notify->send((int) $u['editor_id'], 'password_change', $u['username'] . ' changed their password', '');
            }
        }
    }
}

$app->view->start('Password', 'locker', 'my');
echo '<h2 class="lt">Password</h2>';
if ($err) {
    echo '<p class="sans noticered">' . h($err) . '</p>';
}
if ($msg) {
    echo '<p class="sans noticegreen">' . h($msg) . '</p>';
}
if ($canDisable) {
    echo '<form method="post" id="nopwform" class="sans">' . $app->csrf->field();
    echo '<input type="hidden" name="pw_login_toggle" value="1">';
    echo '<p><label><input type="checkbox" name="disable_password" id="disable_password" value="1"'
        . ($noPass ? ' checked' : '') . '> Disable password login</label></p>';
    echo '</form>';
}
echo '<form method="post" id="pwform" class="pw-pass-fields' . ($noPass && $canDisable ? ' pw-off' : '') . '">' . $app->csrf->field();
if (!$noPass) {
    echo '<p class="sans">Current<br><input type="password" name="current" required' . ($noPass && $canDisable ? ' disabled' : '') . '></p>';
}
echo '<p class="sans">New<br><input type="password" name="pass1" required' . ($noPass && $canDisable ? ' disabled' : '') . '></p>';
echo '<p class="sans">Confirm<br><input type="password" name="pass2" required' . ($noPass && $canDisable ? ' disabled' : '') . '></p>';
echo '<p><input type="submit" class="lt_button" value="' . ($noPass ? 'Set password' : 'Change password') . '"'
    . ($noPass && $canDisable ? ' disabled' : '') . '></p></form>';
echo '<script>
(function(){
  var cb = document.getElementById("disable_password");
  var form = document.getElementById("pwform");
  var cut = document.getElementById("nopwform");
  if (!cb || !form) return;
  function apply() {
    var on = cb.checked;
    form.classList.toggle("pw-off", on);
    Array.prototype.forEach.call(form.querySelectorAll("input"), function (i) {
      if (i.type === "hidden") return;
      i.disabled = on;
    });
  }
  apply();
  cb.addEventListener("change", function () {
    apply();
    if (cut) cut.submit();
  });
})();
</script>';
$app->view->end();