From 4abe3ecc29bfd7aa1542a9c9aea35281efa9463c Mon Sep 17 00:00:00 2001
From: Starbeamrainbowlabs <sbrl@starbeamrainbowlabs.com>
Date: Fri, 11 May 2018 11:41:40 +0100
Subject: [PATCH] Update the user preferences to support the new password
 hashing system

---
 build/index.php                      | 20 ++++++++++++++------
 module_index.json                    |  8 ++++----
 modules/feature-user-preferences.php | 11 +++++++----
 3 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/build/index.php b/build/index.php
index e6a1a93..fe5d4e4 100644
--- a/build/index.php
+++ b/build/index.php
@@ -395,7 +395,7 @@ if($settings->sessionprefix == "auto")
 /////////////////////////////////////////////////////////////////////////////
 /** The version of Pepperminty Wiki currently running. */
 $version = "v0.17-dev";
-$commit = "d5b37e3ec04759342e4e5f121fc9912c13af0cd7";
+$commit = "62dff18b4d1785b1ff8544b0e554af0f8ce6ab92";
 /// Environment ///
 /** Holds information about the current request environment. */
 $env = new stdClass();
@@ -5613,9 +5613,9 @@ function errorimage($text, $target_size = null)
 
 register_module([
 	"name" => "User Preferences",
-	"version" => "0.3.2",
+	"version" => "0.3.3",
 	"author" => "Starbeamrainbowlabs",
-	"description" => "Adds a user preferences page, letting pople do things like change their email address and password.",
+	"description" => "Adds a user preferences page, letting people do things like change their email address and password.",
 	"id" => "feature-user-preferences",
 	"code" => function() {
 		global $env, $settings;
@@ -5759,14 +5759,17 @@ register_module([
 				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>The new password you typed twice didn't match! <a href='javascript:history.back();'>Go back</a>.</p>"));
 			}
 			// Check the current password
-			if(hash_password($_POST["current-pass"]) !== $env->user_data->password) {
+			if(!verify_password($_POST["current-pass"], $env->user_data->password)) {
 				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>Error: You typed your current password incorrectly! <a href='javascript:history.back();'>Go back</a>.</p>"));
 			}
 			
 			// All's good! Go ahead and change the password.
 			$env->user_data->password = hash_password($_POST["new-pass"]);
 			// Save the userdata back to disk
-			save_userdata();
+			if(!save_userdata()) {
+				http_response_code(503);
+				exit(page_renderer::render_main("Error Saving Password - $settings->sitename", "<p>While you entered your old password correctly, $settings->sitename encountered an error whilst saving your password to disk! Your password has not been changed. Please contact $settings->admindetails_name for assistance (you can find their email address at the bottom of this page)."));
+			}
 			
 			http_response_code(307);
 			header("location: ?action=user-preferences&success=yes&operation=change-password");
@@ -7483,7 +7486,12 @@ function hash_password($pass) {
 		$props["options"]
 	);
 }
-
+/**
+ * Verifies a user's password against a pre-generated hash.
+ * @param	string	$pass	The user's password.
+ * @param	string	$hash	The hash to compare against.
+ * @return	bool	Whether the password matches the has or not.
+ */
 function verify_password($pass, $hash) {
 	$pass_transformed = base64_encode(hash("sha384", $pass));
 	return password_verify($pass_transformed, $hash);
diff --git a/module_index.json b/module_index.json
index 01aae58..d9dac97 100755
--- a/module_index.json
+++ b/module_index.json
@@ -127,11 +127,11 @@
     },
     {
         "name": "User Preferences",
-        "version": "0.3.2",
+        "version": "0.3.3",
         "author": "Starbeamrainbowlabs",
-        "description": "Adds a user preferences page, letting pople do things like change their email address and password.",
+        "description": "Adds a user preferences page, letting people do things like change their email address and password.",
         "id": "feature-user-preferences",
-        "lastupdate": 1497799247,
+        "lastupdate": 1526035213,
         "optional": false
     },
     {
@@ -203,7 +203,7 @@
         "author": "Starbeamrainbowlabs",
         "description": "Adds a pair of actions (login and checklogin) that allow users to login. You need this one if you want your users to be able to login.",
         "id": "page-login",
-        "lastupdate": 1526034825,
+        "lastupdate": 1526034977,
         "optional": false
     },
     {
diff --git a/modules/feature-user-preferences.php b/modules/feature-user-preferences.php
index 9877acc..b268992 100644
--- a/modules/feature-user-preferences.php
+++ b/modules/feature-user-preferences.php
@@ -1,9 +1,9 @@
 <?php
 register_module([
 	"name" => "User Preferences",
-	"version" => "0.3.2",
+	"version" => "0.3.3",
 	"author" => "Starbeamrainbowlabs",
-	"description" => "Adds a user preferences page, letting pople do things like change their email address and password.",
+	"description" => "Adds a user preferences page, letting people do things like change their email address and password.",
 	"id" => "feature-user-preferences",
 	"code" => function() {
 		global $env, $settings;
@@ -147,14 +147,17 @@ register_module([
 				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>The new password you typed twice didn't match! <a href='javascript:history.back();'>Go back</a>.</p>"));
 			}
 			// Check the current password
-			if(hash_password($_POST["current-pass"]) !== $env->user_data->password) {
+			if(!verify_password($_POST["current-pass"], $env->user_data->password)) {
 				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>Error: You typed your current password incorrectly! <a href='javascript:history.back();'>Go back</a>.</p>"));
 			}
 			
 			// All's good! Go ahead and change the password.
 			$env->user_data->password = hash_password($_POST["new-pass"]);
 			// Save the userdata back to disk
-			save_userdata();
+			if(!save_userdata()) {
+				http_response_code(503);
+				exit(page_renderer::render_main("Error Saving Password - $settings->sitename", "<p>While you entered your old password correctly, $settings->sitename encountered an error whilst saving your password to disk! Your password has not been changed. Please contact $settings->admindetails_name for assistance (you can find their email address at the bottom of this page)."));
+			}
 			
 			http_response_code(307);
 			header("location: ?action=user-preferences&success=yes&operation=change-password");
