diff --git a/build/index.php b/build/index.php index e6a1a93..fe5d4e4 100644 --- a/build/index.php +++ b/build/index.php @@ -395,7 +395,7 @@ if($settings->sessionprefix == "auto") ///////////////////////////////////////////////////////////////////////////// /** The version of Pepperminty Wiki currently running. */ $version = "v0.17-dev"; -$commit = "d5b37e3ec04759342e4e5f121fc9912c13af0cd7"; +$commit = "62dff18b4d1785b1ff8544b0e554af0f8ce6ab92"; /// Environment /// /** Holds information about the current request environment. */ $env = new stdClass(); @@ -5613,9 +5613,9 @@ function errorimage($text, $target_size = null) register_module([ "name" => "User Preferences", - "version" => "0.3.2", + "version" => "0.3.3", "author" => "Starbeamrainbowlabs", - "description" => "Adds a user preferences page, letting pople do things like change their email address and password.", + "description" => "Adds a user preferences page, letting people do things like change their email address and password.", "id" => "feature-user-preferences", "code" => function() { global $env, $settings; @@ -5759,14 +5759,17 @@ register_module([ exit(page_renderer::render_main("Password mismatch - $settings->sitename", "
The new password you typed twice didn't match! Go back.
")); } // Check the current password - if(hash_password($_POST["current-pass"]) !== $env->user_data->password) { + if(!verify_password($_POST["current-pass"], $env->user_data->password)) { exit(page_renderer::render_main("Password mismatch - $settings->sitename", "Error: You typed your current password incorrectly! Go back.
")); } // All's good! Go ahead and change the password. $env->user_data->password = hash_password($_POST["new-pass"]); // Save the userdata back to disk - save_userdata(); + if(!save_userdata()) { + http_response_code(503); + exit(page_renderer::render_main("Error Saving Password - $settings->sitename", "While you entered your old password correctly, $settings->sitename encountered an error whilst saving your password to disk! Your password has not been changed. Please contact $settings->admindetails_name for assistance (you can find their email address at the bottom of this page).")); + } http_response_code(307); header("location: ?action=user-preferences&success=yes&operation=change-password"); @@ -7483,7 +7486,12 @@ function hash_password($pass) { $props["options"] ); } - +/** + * Verifies a user's password against a pre-generated hash. + * @param string $pass The user's password. + * @param string $hash The hash to compare against. + * @return bool Whether the password matches the has or not. + */ function verify_password($pass, $hash) { $pass_transformed = base64_encode(hash("sha384", $pass)); return password_verify($pass_transformed, $hash); diff --git a/module_index.json b/module_index.json index 01aae58..d9dac97 100755 --- a/module_index.json +++ b/module_index.json @@ -127,11 +127,11 @@ }, { "name": "User Preferences", - "version": "0.3.2", + "version": "0.3.3", "author": "Starbeamrainbowlabs", - "description": "Adds a user preferences page, letting pople do things like change their email address and password.", + "description": "Adds a user preferences page, letting people do things like change their email address and password.", "id": "feature-user-preferences", - "lastupdate": 1497799247, + "lastupdate": 1526035213, "optional": false }, { @@ -203,7 +203,7 @@ "author": "Starbeamrainbowlabs", "description": "Adds a pair of actions (login and checklogin) that allow users to login. You need this one if you want your users to be able to login.", "id": "page-login", - "lastupdate": 1526034825, + "lastupdate": 1526034977, "optional": false }, { diff --git a/modules/feature-user-preferences.php b/modules/feature-user-preferences.php index 9877acc..b268992 100644 --- a/modules/feature-user-preferences.php +++ b/modules/feature-user-preferences.php @@ -1,9 +1,9 @@ "User Preferences", - "version" => "0.3.2", + "version" => "0.3.3", "author" => "Starbeamrainbowlabs", - "description" => "Adds a user preferences page, letting pople do things like change their email address and password.", + "description" => "Adds a user preferences page, letting people do things like change their email address and password.", "id" => "feature-user-preferences", "code" => function() { global $env, $settings; @@ -147,14 +147,17 @@ register_module([ exit(page_renderer::render_main("Password mismatch - $settings->sitename", "
The new password you typed twice didn't match! Go back.
")); } // Check the current password - if(hash_password($_POST["current-pass"]) !== $env->user_data->password) { + if(!verify_password($_POST["current-pass"], $env->user_data->password)) { exit(page_renderer::render_main("Password mismatch - $settings->sitename", "Error: You typed your current password incorrectly! Go back.
")); } // All's good! Go ahead and change the password. $env->user_data->password = hash_password($_POST["new-pass"]); // Save the userdata back to disk - save_userdata(); + if(!save_userdata()) { + http_response_code(503); + exit(page_renderer::render_main("Error Saving Password - $settings->sitename", "While you entered your old password correctly, $settings->sitename encountered an error whilst saving your password to disk! Your password has not been changed. Please contact $settings->admindetails_name for assistance (you can find their email address at the bottom of this page).")); + } http_response_code(307); header("location: ?action=user-preferences&success=yes&operation=change-password");