setpw.php File Reference

Change password of a user. More...

Go to the source code of this file.

Functions
	setpw ($smarty, $INPUT, $db)
	Change password.
	send_reminder ($smarty, $INPUT, $db)
	Send a password reminder.

---

Detailed Description

Change password of a user.

Definition in file setpw.php.

---

Function Documentation

send_reminder	(	$	smarty,
		$	INPUT,
		$	db
	)

Send a password reminder.

This function is called by action.php. The forgetful user is sent a password reminder.

Note:

The user is assigned a new password. This is unavoidable because for security reasons, the password is not stored in the database as cleartext, but only as a (one-way) cryptographic hash value. Therefore, the original password cannot be retrieved from the data base.

Definition at line 137 of file setpw.php.

References do_template(), get_item_owner(), send_email(), set_random_pw(), and sql_query().

                                             {

        $p = array('email' => trim($INPUT['email']));
        $ans = sql_query('get_uid', $p, $db);

        if(empty($ans)) {
                $tpl_var = array();
                $tpl_var['errors_info'] = array('email');

                do_template($smarty,'login.tpl', $tpl_var);
                exit(0);
        }

        foreach ($ans as $u) {

                $uid = $u['id'];

                # create random password and mail it to the user
 
                $passwd = set_random_pw($uid, $db);

                $user = get_item_owner("user", $uid, $db);
        
                $email_to = $user['degree_name'] . " ";
                $email_to .= $user['forename'] . " ";
                $email_to .= $user['surname'] . " ";
                $email_to .= "<" . $user['email'] . ">";

                $tpl_vars = array();
                $tpl_vars['user_info'] = $user; 
                $tpl_vars['user_info']['password'] = $passwd;   

                send_email($smarty,'msg_reminder.tpl',$tpl_vars, $email_to);
        }

        do_template($smarty,'reminder.tpl', $tpl_var);
        exit(0);
}

Here is the call graph for this function:

setpw	(	$	smarty,
		$	INPUT,
		$	db
	)

Change password.

This function is called by action.php, and allows the user to change his/her password.

Note:

For security reasons, the password is not stored "in the clear" in the database. Instead, a "checksum" is calculated from the password, (using the cryptographic SHA-1 algorithm), and only the checksum is stored in the database.

It is considered computationally infeasible to calculate a password from a given SHA-1 checksum. However, it is very easy to check whether the user has provided the correct password - you just have to calculate it's SHA-1 checksum and compare it with the value stored in the database.

Definition at line 30 of file setpw.php.

References check_input(), do_template(), sql_exit(), and sql_query().

                                     {
global $_SESSION, $debug_level;

$valid_input = array(
        "pw1"       => "/^.....+$/",
);      

## check user input 

# $INPUT = array_merge($_GET, $_POST);
# $errors = check_input($INPUT, $validation_info); 

if ($debug_level > 10) {
        print "<hr><pre>Input: ";
        print_r($INPUT);
        print "</pre><hr>";
}

#if (!empty($errors)) {
#       user_error("Missing or malformed input parameter(s): " . join($errors, ", "),
#               E_USER_ERROR); 
#}

## process buttons

# "OK" button pressed? 

$display_html_form = (isset($INPUT['b_ok'])) ? FALSE : TRUE;


# "Cancel" button pressed?

if (isset($INPUT['b_cancel'])) {
        return;
}


# stricter checks for user input (per item)

if (!$display_html_form) {

        $errors = check_input($INPUT, $valid_input, FALSE); 

        if ($INPUT['pw1'] != $INPUT['pw2']) {
                $errors[] = 'pw_mismatch';
        }

        if (!empty($errors)) {
                # user input was invalid, user must correct it
                $display_html_form = TRUE;
        } 
}

if ($display_html_form) {

        ## (re-)display the input form

        $tpl_vars = $INPUT;
        $tpl_vars['errors_info'] = $errors;
        do_template($smarty, 'setpw.tpl' , $tpl_vars);
        exit(0);

} else  {


        $param = array(
                "table" => "user",
                "tables" => "user",
                "login" => $_SESSION['user']['login'],
                "password" => "{SHA1}" . sha1($INPUT['password']),
                "data" => array (
                        "password" => "{SHA1}" .  sha1($INPUT['pw1'])
                        ),
                "cond" => "id = ". $_SESSION['user']['id'],
        );

        $ans = sql_query('check_pw', $param, $db);
        sleep(2);

        if (empty($ans)) {
                # wrong login / password, re-display HTML form

                $tpl_vars = $INPUT;
                $tpl_vars['errors_info'] = $errors;
                $tpl_vars['errors_info'][] = 'password';

                do_template($smarty, 'setpw.tpl' , $tpl_vars);
                sql_exit($db);
                exit(0);
        } else {
                sql_query('update', $param, $db);
        }
}

}

Here is the call graph for this function:

---