From d5cabac14a8407419996374c31b6378b8194b700 Mon Sep 17 00:00:00 2001 From: Znote Date: Sat, 21 Jan 2017 23:08:46 +0100 Subject: [PATCH] Disable 2FA through Email Fix #249 And fixed an issue with email activation link when registering an account. --- engine/function/users.php | 5 +- layout/widgets/login.php | 2 +- recovery.php | 115 +++++++++++++++++++++++++++++--------- register.php | 9 ++- 4 files changed, 100 insertions(+), 31 deletions(-) diff --git a/engine/function/users.php b/engine/function/users.php index a267154..cc77f7f 100644 --- a/engine/function/users.php +++ b/engine/function/users.php @@ -1173,11 +1173,12 @@ function user_create_account($register_data, $maildata) { $account_id = user_id($register_data['name']); $activeKey = rand(100000000,999999999); - mysql_insert("INSERT INTO `znote_accounts` (`account_id`, `ip`, `created`, `activekey`, `flag`) VALUES ('$account_id', '$ip', '$created', '$activeKey', '$flag')"); + $active = ($maildata['register']) ? 0 : 1; + mysql_insert("INSERT INTO `znote_accounts` (`account_id`, `ip`, `created`, `active`, `activekey`, `flag`) VALUES ('$account_id', '$ip', '$created', '$active', '$activeKey', '$flag')"); if ($maildata['register']) { - $thisurl = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"; + $thisurl = config('site_url') . "$_SERVER[REQUEST_URI]"; $thisurl .= "?authenticate&u=".$account_id."&k=".$activeKey; $mailer = new Mail($maildata); diff --git a/layout/widgets/login.php b/layout/widgets/login.php index eb1869c..1e16d7f 100644 --- a/layout/widgets/login.php +++ b/layout/widgets/login.php @@ -23,7 +23,7 @@ Token::create(); ?>

New account

- - Lost username or password?
+ - Account Recovery diff --git a/recovery.php b/recovery.php index 9fd7f22..935d482 100644 --- a/recovery.php +++ b/recovery.php @@ -59,7 +59,7 @@ if ($config['mailserver']['accountRecovery']) { Submitted data is wrong.

Remove Two-Factor Authentication"; + $body .= "

If you really want to remove Two-Factor Authentication, click on the following link:
"; + $body .= "$recoverylink
"; + $body .= "Enjoy your stay at ".$config['mailserver']['fromName'].".
"; + $body .= "

I am an automatic no-reply e-mail. Any emails sent back to me will be ignored.

"; + $mailer->sendMail($email, $title, $body, $user['name']); + ?> +

Confirm your action through email

+

We have sent a confirmation link to .

+

You must click the link before we remove Two-factor authentication.

+

If you can't find the email within 5 minutes, check your junk/trash inbox as it may be mislocated there.

+ +

Account recovery failed!

+

Submitted data is wrong.

+ -

Account Recovery

- - -
-
-
+ + $a = (isset($_GET['a']) && !empty($_GET['a'])) ? (int)$_GET['a'] : false; + $k = (isset($_GET['k']) && !empty($_GET['k'])) ? (int)$_GET['k'] : false; + + // Remove Two-Factor Authentication + if ($a !== false && $k !== false) { + $account = mysql_select_single("SELECT `a`.`id`, `a`.`secret`, `za`.`secret` FROM `accounts` AS `a` INNER JOIN `znote_accounts` AS `za` ON `a`.`id`=`za`.`account_id` WHERE `a`.`id`='$a' AND `za`.`activekey`='$k' LIMIT 1;"); + if ($account !== false) { + mysql_update("UPDATE `accounts` SET `secret`=NULL WHERE `id`='$a' LIMIT 1;"); + mysql_update("UPDATE `znote_accounts` SET `secret`=NULL WHERE `account_id`='$a' LIMIT 1;"); + ?> +

Two-Factor Authentication disabled.

+

You may now login with just your username and password.

Username:
'; - else echo '
'; - if ($config['use_captcha']) { + } else { + ?> +

Failed verify your request.

+

We are unable to authenticate your account.

+ +

Account Recovery

+ + + +
+
+ Username:
'; + } elseif ($mode === 'password') { + echo '
'; + } elseif ($mode === 'token') { + echo '
'; + echo '
'; + } + + if ($config['use_captcha']) { + ?> + Write the image symbols in the text field to verify that you are a human: + CAPTCHA Image
+ + [ Different Image ]

+ - Write the image symbols in the text field to verify that you are a human: - CAPTCHA Image
- - [ Different Image ]

+ +
+ +

Do you wish to recover your username, password or remove Two-factor authentication?

+ +

Do you wish to recover your username or password?

- - - -

Do you wish to recover your username or password?

-

Email authentication required

We have sent you an email with an activation link to your submitted email address.

-

If you can't find the email within 5 minutes, check your junk/trash inbox as it may be mislocated there.

+

If you can't find the email within 5 minutes, check your junk/trash inbox (spam filter) as it may be mislocated there.

0) ? (int)$_GET['u'] : false; $akey = (isset($_GET['k']) && (int)$_GET['k'] > 0) ? (int)$_GET['k'] : false; // Find a match - $user = mysql_select_single("SELECT `id` FROM `znote_accounts` WHERE `account_id`='$auid' AND `activekey`='$akey' AND `active`='0' LIMIT 1;"); + $user = mysql_select_single("SELECT `id`, `active` FROM `znote_accounts` WHERE `account_id`='$auid' AND `activekey`='$akey' LIMIT 1;"); if ($user !== false) { $user = $user['id']; + $active = $user['active']; // Enable the account to login - mysql_update("UPDATE `znote_accounts` SET `active`='1' WHERE `id`='$user' LIMIT 1;"); + if ($active == 0) { + mysql_update("UPDATE `znote_accounts` SET `active`='1' WHERE `id`='$user' LIMIT 1;"); + } echo '

Congratulations!

Your account has been created. You may now login to create a character.

'; } else { echo '

Authentication failed

Either the activation link is wrong, or your account is already activated.

';