Digitalstack/ZnoteAAC
2
0
Fork 0
mirror of https://github.com/Znote/ZnoteAAC.git synced 2025-05-03 12:49:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Disable 2FA through Email Fix #249

Browse Source 
And fixed an issue with email activation link when registering an account.
This commit is contained in:
Znote 2017-01-21 23:08:46 +01:00
parent 013e8f1174
commit d5cabac14a
4 changed files with 100 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
engine/function/users.php
View File

@ -1173,11 +1173,12 @@ function user_create_account($register_data, $maildata) {
$account_id = user_id($register_data['name']);
$activeKey = rand(100000000,999999999);
mysql_insert("INSERT INTO `znote_accounts` (`account_id`, `ip`, `created`, `activekey`, `flag`) VALUES ('$account_id', '$ip', '$created', '$activeKey', '$flag')");
$active = ($maildata['register']) ? 0 : 1;
mysql_insert("INSERT INTO `znote_accounts` (`account_id`, `ip`, `created`, `active`, `activekey`, `flag`) VALUES ('$account_id', '$ip', '$created', '$active', '$activeKey', '$flag')");
if ($maildata['register']) {
$thisurl = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
$thisurl = config('site_url') . "$_SERVER[REQUEST_URI]";
$thisurl .= "?authenticate&u=".$account_id."&k=".$activeKey;
$mailer = new Mail($maildata);

2
layout/widgets/login.php
View File

@ -23,7 +23,7 @@
Token::create();
?>
<center> <h3><a href="register.php">New account</a></h3>
<font size="1">- Lost <a href="recovery.php?mode=username">username</a> or <a href="recovery.php?mode=password">password</a>?</font></center>
<font size="1">- <a href="recovery.php">Account Recovery</a></font></center>
</ul>
</form>
</div>

115
recovery.php
View File

@ -59,7 +59,7 @@ if ($config['mailserver']['accountRecovery']) {
<?php
}
} else {
} elseif (!$password) {
// Recover password
$newpass = rand(100000000, 999999999);
$salt = '';
@ -100,37 +100,102 @@ if ($config['mailserver']['accountRecovery']) {
<p>Submitted data is wrong.</p>
<?php
}
} else { // Token
$password = sha1($password);
$user = mysql_select_single("SELECT `a`.`id`, `a`.`name`, `za`.`activekey` FROM `accounts` AS `a` INNER JOIN `znote_accounts` AS `za` ON `a`.`id` = `za`.`account_id` WHERE `a`.`name`='{$username}' AND `a`.`password`='{$password}' AND `a`.`email`='{$email}' LIMIT 1;");
if ($user !== false) {
// Found user
$recoverylink = $config['site_url'] . '/recovery.php?a='.$user['id'].'&k='.$user['activekey'];
$mailer = new Mail($config['mailserver']);
$title = $config['site_title'].": Remove Two-Factor Authentication link";
$body = "<h1>Remove Two-Factor Authentication</h1>";
$body .= "<p>If you really want to remove Two-Factor Authentication, click on the following link:<br>";
$body .= "<a href='$recoverylink' target='_BLANK'>$recoverylink</a><br>";
$body .= "Enjoy your stay at ".$config['mailserver']['fromName'].". <br>";
$body .= "<hr>I am an automatic no-reply e-mail. Any emails sent back to me will be ignored.</p>";
$mailer->sendMail($email, $title, $body, $user['name']);
?>
<h1>Confirm your action through email</h1>
<p>We have sent a confirmation link to <b><?php echo $email; ?></b>.</p>
<p>You must click the link before we remove Two-factor authentication.</p>
<p>If you can't find the email within 5 minutes, check your junk/trash inbox as it may be mislocated there.</p>
<?php
} else {
// Wrong submitted info
?>
<h1>Account recovery failed!</h1>
<p>Submitted data is wrong.</p>
<?php
}
}
} else echo "Captcha image verification was submitted wrong.";
} else {
?>
<h1>Account Recovery</h1>
<!-- HTML code -->
<?php
if (in_array($mode, array('username', 'password'))) {
?>
<form action="" method="POST">
<label for="email">Email:</label><input type="text" name="email" placeholder="name@mail.com"><br>
<label for="Character">Character: </label><input type="text" name="character"><br>
$a = (isset($_GET['a']) && !empty($_GET['a'])) ? (int)$_GET['a'] : false;
$k = (isset($_GET['k']) && !empty($_GET['k'])) ? (int)$_GET['k'] : false;
// Remove Two-Factor Authentication
if ($a !== false && $k !== false) {
$account = mysql_select_single("SELECT `a`.`id`, `a`.`secret`, `za`.`secret` FROM `accounts` AS `a` INNER JOIN `znote_accounts` AS `za` ON `a`.`id`=`za`.`account_id` WHERE `a`.`id`='$a' AND `za`.`activekey`='$k' LIMIT 1;");
if ($account !== false) {
mysql_update("UPDATE `accounts` SET `secret`=NULL WHERE `id`='$a' LIMIT 1;");
mysql_update("UPDATE `znote_accounts` SET `secret`=NULL WHERE `account_id`='$a' LIMIT 1;");
?>
<h1>Two-Factor Authentication disabled.</h1>
<p>You may now login with just your username and password.</p>
<?php
if ($mode === 'password') echo '<label for="username">Username:</label> <input type="text" name="username"><br>';
else echo '<label for="password">Password:</label> <input type="password" name="password"><br>';
if ($config['use_captcha']) {
} else {
?>
<h1>Failed verify your request.</h1>
<p>We are unable to authenticate your account.</p>
<?php
}
} else { // Regular view
?>
<h1>Account Recovery</h1>
<!-- HTML code -->
<?php
if (in_array($mode, array('username', 'password', 'token'))) {
?>
<form action="" method="POST">
<label for="email">Email:</label><input type="text" name="email" placeholder="name@mail.com"><br>
<label for="Character">Character: </label><input type="text" name="character"><br>
<?php
if ($mode === 'password') {
echo '<label for="username">Username:</label> <input type="text" name="username"><br>';
} elseif ($mode === 'password') {
echo '<label for="password">Password:</label> <input type="password" name="password"><br>';
} elseif ($mode === 'token') {
echo '<label for="username">Username:</label> <input type="text" name="username"><br>';
echo '<label for="password">Password:</label> <input type="password" name="password"><br>';
}
if ($config['use_captcha']) {
?>
<b>Write the image symbols in the text field to verify that you are a human:</b>
<img id="captcha" src="captcha/securimage_show.php" alt="CAPTCHA Image" /><br>
<input type="text" name="captcha_code" size="10" maxlength="6" />
<a href="#" onclick="document.getElementById('captcha').src = 'captcha/securimage_show.php?' + Math.random(); return false">[ Different Image ]</a><br><br>
<?php
}
?>
<b>Write the image symbols in the text field to verify that you are a human:</b>
<img id="captcha" src="captcha/securimage_show.php" alt="CAPTCHA Image" /><br>
<input type="text" name="captcha_code" size="10" maxlength="6" />
<a href="#" onclick="document.getElementById('captcha').src = 'captcha/securimage_show.php?' + Math.random(); return false">[ Different Image ]</a><br><br>
<input type="submit" value="Recover Account">
</form>
<?php
} else {
if ($config['twoFactorAuthenticator']) {
?>
<p>Do you wish to recover your <a href="?mode=username">username</a>, <a href="?mode=password">password</a> or remove <a href="?mode=token">Two-factor authentication</a>?</p>
<?php
} else {
?>
<p>Do you wish to recover your <a href="?mode=username">username</a> or <a href="?mode=password">password</a>?</p>
<?php
}
?>
<input type="submit" value="Recover Account">
</form>
<?php
} else {
?>
<p>Do you wish to recover your <a href="?mode=username">username</a> or <a href="?mode=password">password</a>?</p>
<?php
}
}
}
} else {

9
register.php
View File

@ -86,7 +86,7 @@ if (isset($_GET['success']) && empty($_GET['success'])) {
?>
<h1>Email authentication required</h1>
<p>We have sent you an email with an activation link to your submitted email address.</p>
<p>If you can't find the email within 5 minutes, check your junk/trash inbox as it may be mislocated there.</p>
<p>If you can't find the email within 5 minutes, check your <strong>junk/trash inbox (spam filter)</strong> as it may be mislocated there.</p>
<?php
} else echo 'Congratulations! Your account has been created. You may now login to create a character.';
} elseif (isset($_GET['authenticate']) && empty($_GET['authenticate'])) {
@ -94,11 +94,14 @@ if (isset($_GET['success']) && empty($_GET['success'])) {
$auid = (isset($_GET['u']) && (int)$_GET['u'] > 0) ? (int)$_GET['u'] : false;
$akey = (isset($_GET['k']) && (int)$_GET['k'] > 0) ? (int)$_GET['k'] : false;
// Find a match
$user = mysql_select_single("SELECT `id` FROM `znote_accounts` WHERE `account_id`='$auid' AND `activekey`='$akey' AND `active`='0' LIMIT 1;");
$user = mysql_select_single("SELECT `id`, `active` FROM `znote_accounts` WHERE `account_id`='$auid' AND `activekey`='$akey' LIMIT 1;");
if ($user !== false) {
$user = $user['id'];
$active = $user['active'];
// Enable the account to login
mysql_update("UPDATE `znote_accounts` SET `active`='1' WHERE `id`='$user' LIMIT 1;");
if ($active == 0) {
mysql_update("UPDATE `znote_accounts` SET `active`='1' WHERE `id`='$user' LIMIT 1;");
}
echo '<h1>Congratulations!</h1> <p>Your account has been created. You may now login to create a character.</p>';
} else {
echo '<h1>Authentication failed</h1> <p>Either the activation link is wrong, or your account is already activated.</p>';