diff --git a/activation.php b/activation.php
index 539ea0f..1457616 100644
--- a/activation.php
+++ b/activation.php
@@ -3,80 +3,89 @@
- Reset Password
+ Activate User
-No code delivered. nothing to do here.');
-}
-
-$userid = $_GET['userid'];
-$code = $_GET['code'];
-
-
-$statement = $pdo->prepare("SELECT * FROM users WHERE id = :userid");
-$result = $statement->execute(array('userid' => $userid));
-$user = $statement->fetch();
-
-//check if theres a code for the user delivered
-if($user === null || $user['passwordcode'] === null) {
- die('
- No User matching your request.
');
-}
-
-if($user['passwordcode_time'] === null || strtotime($user['passwordcode_time']) < (time()-24*3600) ) {
- die('
- Ooops. This code isnt valid anymore.
');
+function random_string() {
+ if(function_exists('random_bytes')) {
+ $bytes = random_bytes(16);
+ $str = bin2hex($bytes);
+ } else if(function_exists('openssl_random_pseudo_bytes')) {
+ $bytes = openssl_random_pseudo_bytes(16);
+ $str = bin2hex($bytes);
+ } else if(function_exists('mcrypt_create_iv')) {
+ $bytes = mcrypt_create_iv(16, MCRYPT_DEV_URANDOM);
+ $str = bin2hex($bytes);
+ } else {
+//this should be a unique string. if we use this in prod we should change this.
+ $str = md5(uniqid('thisisnotreallyrandombutthisstringheresomakethislongandmaybewith12345numberskthxbye', true));
+ }
+ return $str;
}
-
-if(sha1($code) != $user['passwordcode']) {
- die('
- Thats not your code. Naughty user!
');
-}
+$showForm = true;
-
+if(isset($_GET['send']) ) {
+ if(!isset($_POST['username']) || empty($_POST['username'])) {
+ $error = "Enter your Username";
+ } else {
+ $statement = $pdo->prepare("SELECT * FROM users WHERE username = :username");
+ $result = $statement->execute(array('username' => $_POST['username']));
+ $user = $statement->fetch();
-if(isset($_GET['send'])) {
- $password = $_POST['password'];
- $password_confirm = $_POST['password_confirm'];
- //regexes for passvalidation:
- $REuppercase = preg_match('@[A-Z]@', $password);
- $RElowercase = preg_match('@[a-z]@', $password);
- $REnumber = preg_match('@[0-9]@', $password);
- $REspecialChars = preg_match('@[^\w]@', $password);
- if($password != $password_confirm) {
- echo "password or confirmed password wrong";
- }
- if(!$REuppercase || !$RElowercase || !$REnumber || !$REspecialChars || strlen($password) < 8) {
- echo 'Password needs to be more complex.
';
- echo 'Please implement at least 8 chars, upper & downer caser, one number & one special char.
';
- $error = true;
-} else {
- $passwordhash = password_hash($password, PASSWORD_DEFAULT);
- $statement = $pdo->prepare("UPDATE users SET password = :passwordhash, passwordcode = NULL, passwordcode_time = NULL WHERE id = :userid");
- $result = $statement->execute(array('passwordhash' => $passwordhash, 'userid'=> $userid ));
+ if($user === false) {
+ $error = "no user found";
+ } else {
+ //check if theres a code already
+ $activationcode = random_string();
+ $statement = $pdo->prepare("UPDATE users SET activationcode = :activationcode, activationcode_time = NOW() WHERE id = :userid");
+ $result = $statement->execute(array('activationcode' => sha1($activationcode), 'userid' => $user['id']));
- if($result) {
- die('Changed password. Going to login now.');
+ $mailrcpt = $user['email'];
+ $mailsubject = "New password for your User";
+ $from = "From: Password Reset Service "; //place a real address if we use this in production
+ $url_activationcode = 'https://loginpagefoo.td00.de/resetpass.php?userid='.$user['id'].'&code='.$activationcode; //this shouldnt be my domain in prod..
+ $text = 'Hallo '.$user['username'].',
+please use the following URL to activate your account in the next 24h:
+'.$url_activationcode.'
+
+If this mail comes unsolicited, please just ignore the mail.
+
+cheers
+loginpagefoo script';
+
+ mail($mailrcpt, $mailsubject, $text, $from);
+
+ echo 'Link send. Going back to profile page. ';
+ $showForm = false;
}
}
}
+
+if($showForm):
+?>
+
+Activate user
+Please enter your username so we can send you a link to activate your account.
+
+
-
-Set new password
-
\ No newline at end of file
+
+
+
+
+
+
+
\ No newline at end of file