tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ent-4025-Cambio-de-contrase-en-user-edit-no-pide-contraseña-actual' into 'develop' 

active user password check

See merge request artica/pandorafms!3689
This commit is contained in:
Daniel Rodriguez 2020-12-17 16:48:26 +01:00
parent ec472f6c6f 8aa18a1236
commit b75d1149e0
3 changed files with 97 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

91
pandora_console/godmode/users/configure_user.php
View File

@ -558,15 +558,51 @@ if ($update_user) {
if ($config['user_can_update_password']) { if ($config['user_can_update_password']) {
$password_new = (string) get_parameter('password_new', ''); $password_new = (string) get_parameter('password_new', '');
$password_confirm = (string) get_parameter('password_confirm', ''); $password_confirm = (string) get_parameter('password_confirm', '');
$own_password_confirm = (string) get_parameter('own_password_confirm', '');
if ($password_new != '') { if ($password_new != '') {
$correct_password = false;
$user_credentials_check = process_user_login($config['id_user'], $own_password_confirm, true);
if ($user_credentials_check !== false) {
$correct_password = true;
}
if ($password_confirm == $password_new) { if ($password_confirm == $password_new) {
if ((!is_user_admin($config['id_user']) || $config['enable_pass_policy_admin']) && $config['enable_pass_policy']) { if ($correct_password === true || is_user_admin($config['id_user'])) {
$pass_ok = login_validate_pass($password_new, $id, true); if ((!is_user_admin($config['id_user']) || $config['enable_pass_policy_admin']) && $config['enable_pass_policy']) {
if ($pass_ok != 1) { $pass_ok = login_validate_pass($password_new, $id, true);
ui_print_error_message($pass_ok); if ($pass_ok != 1) {
ui_print_error_message($pass_ok);
} else {
$res2 = update_user_password($id, $password_new);
if ($res2) {
db_process_sql_insert(
'tsesion',
[
'id_sesion' => '',
'id_usuario' => $id,
'ip_origen' => $_SERVER['REMOTE_ADDR'],
'accion' => 'Password change',
'descripcion' => 'Access password updated',
'fecha' => date('Y-m-d H:i:s'),
'utimestamp' => time(),
]
);
$res3 = save_pass_history($id, $password_new);
}
ui_print_result_message(
$res1 || $res2,
__('User info successfully updated'),
__('Error updating user info (no change?)')
);
}
} else { } else {
$res2 = update_user_password($id, $password_new); $res2 = update_user_password($id, $password_new);
if ($res2) { if ($res2) {
$res3 = save_pass_history($id, $password_new);
db_process_sql_insert( db_process_sql_insert(
'tsesion', 'tsesion',
[ [
@ -579,7 +615,6 @@ if ($update_user) {
'utimestamp' => time(), 'utimestamp' => time(),
] ]
); );
$res3 = save_pass_history($id, $password_new);
} }
ui_print_result_message( ui_print_result_message(
@ -589,28 +624,11 @@ if ($update_user) {
); );
} }
} else { } else {
$res2 = update_user_password($id, $password_new); if ($own_password_confirm === '') {
if ($res2) { ui_print_error_message(__('Password of the active user is required to perform password change'));
$res3 = save_pass_history($id, $password_new); } else {
db_process_sql_insert( ui_print_error_message(__('Password of active user is not correct'));
'tsesion',
[
'id_sesion' => '',
'id_usuario' => $id,
'ip_origen' => $_SERVER['REMOTE_ADDR'],
'accion' => 'Password change',
'descripcion' => 'Access password updated',
'fecha' => date('Y-m-d H:i:s'),
'utimestamp' => time(),
]
);
} }
ui_print_result_message(
$res1 || $res2,
__('User info successfully updated'),
__('Error updating user info (no change?)')
);
} }
} else { } else {
db_process_sql_insert( db_process_sql_insert(
@ -877,6 +895,25 @@ if ($config['user_can_update_password']) {
true, true,
true true
).'</span></div>'; ).'</span></div>';
if (!is_user_admin($config['id_user'])) {
$own_pass_confirm = '<div class="label_select_simple"><span>'.html_print_input_text_extended(
'own_password_confirm',
'',
'own_password_confirm',
'',
'20',
'45',
$view_mode,
'',
[
'class' => 'input',
'placeholder' => __('Own password confirmation'),
],
true,
true
).'</span></div>';
}
} }
$own_info = get_user_info($config['id_user']); $own_info = get_user_info($config['id_user']);
@ -1191,7 +1228,7 @@ if (is_metaconsole()) {
if ($id != '' && !$is_err) { if ($id != '' && !$is_err) {
$div_user_info = '<div class="edit_user_info_left">'.$avatar.$user_id_create.'</div> $div_user_info = '<div class="edit_user_info_left">'.$avatar.$user_id_create.'</div>
<div class="edit_user_info_right">'.$user_id_update_view.$full_name.$new_pass.$new_pass_confirm.$global_profile.'</div>'; <div class="edit_user_info_right">'.$user_id_update_view.$full_name.$new_pass.$new_pass_confirm.$own_pass_confirm.$global_profile.'</div>';
} else { } else {
$div_user_info = '<div class="edit_user_info_left">'.$avatar.'</div> $div_user_info = '<div class="edit_user_info_left">'.$avatar.'</div>
<div class="edit_user_info_right">'.$user_id_create.$user_id_update_view.$full_name.$new_pass.$new_pass_confirm.$global_profile.'</div>'; <div class="edit_user_info_right">'.$user_id_create.$user_id_update_view.$full_name.$new_pass.$new_pass_confirm.$global_profile.'</div>';

4
pandora_console/include/styles/pandora.css
View File

@ -4776,7 +4776,9 @@ input:checked + .p-slider:before {
} }
.edit_user_info_right #password_new, .edit_user_info_right #password_new,
.edit_user_info_right #password_conf { .edit_user_info_right #password_conf,
.edit_user_info_right #own_password_confirm,
.edit_user_info_right #current_password {
background-image: url("../../images/user_password.png"); background-image: url("../../images/user_password.png");
} }

41
pandora_console/operation/users/user_edit.php
View File

@ -72,6 +72,7 @@ if (isset($_GET['modified']) && !$view_mode) {
$upd_info['lastname'] = get_parameter_post('lastname', $user_info['lastname']); $upd_info['lastname'] = get_parameter_post('lastname', $user_info['lastname']);
$password_new = get_parameter_post('password_new', ''); $password_new = get_parameter_post('password_new', '');
$password_confirm = get_parameter_post('password_conf', ''); $password_confirm = get_parameter_post('password_conf', '');
$current_password = get_parameter_post('current_password', '');
$upd_info['email'] = get_parameter_post('email', ''); $upd_info['email'] = get_parameter_post('email', '');
$upd_info['phone'] = get_parameter_post('phone', ''); $upd_info['phone'] = get_parameter_post('phone', '');
$upd_info['comments'] = get_parameter_post('comments', ''); $upd_info['comments'] = get_parameter_post('comments', '');
@ -144,21 +145,37 @@ if (isset($_GET['modified']) && !$view_mode) {
} }
if (!empty($password_new)) { if (!empty($password_new)) {
$correct_password = false;
$user_credentials_check = process_user_login($config['id_user'], $current_password, true);
if ($user_credentials_check !== false) {
$correct_password = true;
}
if ($config['user_can_update_password'] && $password_confirm == $password_new) { if ($config['user_can_update_password'] && $password_confirm == $password_new) {
if ((!$is_admin || $config['enable_pass_policy_admin']) if ($correct_password === true) {
&& $config['enable_pass_policy'] if ((!$is_admin || $config['enable_pass_policy_admin'])
) { && $config['enable_pass_policy']
$pass_ok = login_validate_pass($password_new, $id, true); ) {
if ($pass_ok != 1) { $pass_ok = login_validate_pass($password_new, $id, true);
ui_print_error_message($pass_ok); if ($pass_ok != 1) {
ui_print_error_message($pass_ok);
} else {
$return = update_user_password($id, $password_new);
if ($return) {
$return2 = save_pass_history($id, $password_new);
}
}
} else { } else {
$return = update_user_password($id, $password_new); $return = update_user_password($id, $password_new);
if ($return) {
$return2 = save_pass_history($id, $password_new);
}
} }
} else { } else {
$return = update_user_password($id, $password_new); if ($current_password === '') {
$error_msg = __('Current password of user is required to perform password change');
} else {
$error_msg = __('Current password of user is not correct');
}
} }
} else if ($password_new !== 'NON-INIT') { } else if ($password_new !== 'NON-INIT') {
$error_msg = __('Passwords didn\'t match or other problem encountered while updating passwords'); $error_msg = __('Passwords didn\'t match or other problem encountered while updating passwords');
@ -280,9 +297,11 @@ if ($view_mode === false) {
if ($config['user_can_update_password']) { if ($config['user_can_update_password']) {
$new_pass = '<div class="label_select_simple"><span>'.html_print_input_text_extended('password_new', '', 'password_new', '', '25', '45', $view_mode, '', ['class' => 'input', 'placeholder' => __('New Password')], true, true).'</span></div>'; $new_pass = '<div class="label_select_simple"><span>'.html_print_input_text_extended('password_new', '', 'password_new', '', '25', '45', $view_mode, '', ['class' => 'input', 'placeholder' => __('New Password')], true, true).'</span></div>';
$new_pass_confirm = '<div class="label_select_simple"><span>'.html_print_input_text_extended('password_conf', '', 'password_conf', '', '20', '45', $view_mode, '', ['class' => 'input', 'placeholder' => __('Password confirmation')], true, true).'</span></div>'; $new_pass_confirm = '<div class="label_select_simple"><span>'.html_print_input_text_extended('password_conf', '', 'password_conf', '', '20', '45', $view_mode, '', ['class' => 'input', 'placeholder' => __('Password confirmation')], true, true).'</span></div>';
$current_pass = '<div class="label_select_simple"><span>'.html_print_input_text_extended('current_password', '', 'current_password', '', '20', '45', $view_mode, '', ['class' => 'input', 'placeholder' => __('Current password')], true, true).'</span></div>';
} else { } else {
$new_pass = '<i>'.__('You cannot change your password under the current authentication scheme').'</i>'; $new_pass = '<i>'.__('You cannot change your password under the current authentication scheme').'</i>';
$new_pass_confirm = ''; $new_pass_confirm = '';
$current_pass = '';
} }
} }
@ -634,7 +653,7 @@ if (is_metaconsole()) {
<div class="user_edit_first_row"> <div class="user_edit_first_row">
<div class="edit_user_info white_box"> <div class="edit_user_info white_box">
<div class="edit_user_info_left">'.$avatar.$user_id.'</div> <div class="edit_user_info_left">'.$avatar.$user_id.'</div>
<div class="edit_user_info_right">'.$full_name.$email.$phone.$new_pass.$new_pass_confirm.'</div> <div class="edit_user_info_right">'.$full_name.$email.$phone.$new_pass.$new_pass_confirm.$current_pass.'</div>
</div> </div>
<div class="edit_user_autorefresh white_box">'.$autorefresh_show.$time_autorefresh.'</div> <div class="edit_user_autorefresh white_box">'.$autorefresh_show.$time_autorefresh.'</div>
</div> </div>