You've already forked postfixadmin
mirror of
https://github.com/postfixadmin/postfixadmin.git
synced 2026-10-24 12:19:19 +03:00
possible fix for https://github.com/postfixadmin/postfixadmin/issues/967 CSRF Token changes : rather than have one PFA_Token value in $_SESSION, store a list of them, where each value has a time stamp it was issued on. The aim is to allow the user to have multiple browser tabs open at once - and not have the last tab that loaded trample on others. Tokens expire after 1 hour. Adds a Smarty helper function `{CSRF_Token}` which will output `<input type=hidden name=CSRF_Token value=asdf123>` or `{CSRF_Token type=url}` which outputs a literal string like 'asdf123' suitable for placing in a URL. Adds a PHP exception handler in public/common.php, which could be used to display a more friendly error message/response (but at the moment is fairly minimal). Removes most uses of `die()` within the codebase, and instead moves to throw an exception
124 lines
3.8 KiB
PHP
124 lines
3.8 KiB
PHP
<?php
|
|
|
|
# $Id$
|
|
|
|
class AdminpasswordHandler extends PFAHandler
|
|
{
|
|
protected string $db_table = 'admin';
|
|
protected string $id_field = 'username';
|
|
|
|
# do not skip empty password fields
|
|
protected bool $skip_empty_pass = false;
|
|
|
|
protected function no_domain_field()
|
|
{
|
|
return true;
|
|
}
|
|
|
|
protected function validate_new_id()
|
|
{
|
|
return true;
|
|
}
|
|
|
|
# init $this->struct, $this->db_table and $this->id_field
|
|
protected function initStruct()
|
|
{
|
|
# TODO: shorter PALANG labels ;-)
|
|
|
|
$this->struct = array(
|
|
# field name allow display in... type $PALANG label $PALANG description default / options / ...
|
|
# editing? form list
|
|
'username' => self::pacol(0, 1, 1, 'text', 'admin' , ''),
|
|
'oldpass' => self::pacol(1, 1, 0, 'pass', 'pPassword_password_current' , '', '', array(),
|
|
/*not_in_db*/ 1),
|
|
'password' => self::pacol(1, 1, 0, 'pass', 'pPassword_password' , ''),
|
|
'password2' => self::pacol(1, 1, 0, 'pass', 'pPassword_password2' , '' , '', array(),
|
|
/*not_in_db*/ 0,
|
|
/*dont_write_to_db*/ 1,
|
|
/*select*/ 'password as password2'
|
|
),
|
|
);
|
|
}
|
|
|
|
public function init(string $id): bool
|
|
{
|
|
# hardcode to logged in admin
|
|
if ($this->admin_username == '') {
|
|
throw new \InvalidArgumentException("No admin logged in");
|
|
}
|
|
$this->id = $this->admin_username;
|
|
$this->values['username'] = $this->id;
|
|
$this->struct['username']['default'] = $this->id;
|
|
|
|
# hardcode to edit mode
|
|
$this->new = 0;
|
|
|
|
return parent::init($this->id);
|
|
}
|
|
|
|
public function initMsg()
|
|
{
|
|
$this->msg['error_already_exists'] = 'admin_already_exists'; # probably unused
|
|
$this->msg['error_does_not_exist'] = 'admin_does_not_exist'; # probably unused
|
|
$this->msg['confirm_delete'] = 'confirm_delete_admin'; # probably unused
|
|
|
|
$this->msg['logname'] = 'edit_password';
|
|
$this->msg['store_error'] = 'pPassword_result_error';
|
|
$this->msg['successmessage'] = 'pPassword_result_success';
|
|
}
|
|
|
|
public function webformConfig()
|
|
{
|
|
return array(
|
|
# $PALANG labels
|
|
'formtitle_create' => 'pPassword_welcome',
|
|
'formtitle_edit' => 'pPassword_welcome',
|
|
'create_button' => 'change_password',
|
|
|
|
# various settings
|
|
'required_role' => 'admin',
|
|
'listview' => 'main.php',
|
|
'early_init' => 1,
|
|
|
|
'hardcoded_edit' => true,
|
|
);
|
|
}
|
|
|
|
/**
|
|
* check if old password is correct
|
|
*/
|
|
protected function _validate_oldpass($field, $val)
|
|
{
|
|
$l = new Login('admin');
|
|
if ($l->login($this->id, $val)) {
|
|
return true;
|
|
}
|
|
|
|
$this->errormsg[$field] = Config::lang('pPassword_password_current_text_error');
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* skip default validation (check if password is good enough) for old password
|
|
*/
|
|
protected function _inp_pass($field, $val)
|
|
{
|
|
if ($field == 'oldpass') {
|
|
return true;
|
|
}
|
|
|
|
return parent::_inp_pass($field, $val);
|
|
}
|
|
|
|
/**
|
|
* compare password / password2 field
|
|
* error message will be displayed at the password2 field
|
|
*/
|
|
protected function _validate_password2()
|
|
{
|
|
return $this->compare_password_fields('password', 'password2');
|
|
}
|
|
}
|
|
|
|
/* vim: set expandtab softtabstop=4 tabstop=4 shiftwidth=4: */
|