From fafaf397e9db5ed840f1eea3dfb77cddf2c3b9cf Mon Sep 17 00:00:00 2001
From: Starbeamrainbowlabs <sbrl@starbeamrainbowlabs.com>
Date: Fri, 23 Dec 2016 18:06:04 +0000
Subject: [PATCH] Bugfix: Make password chainging work.

---
 build/index.php                      | 23 ++++++++++++++++++-----
 module_index.json                    |  2 +-
 modules/feature-user-preferences.php | 23 ++++++++++++++++++-----
 3 files changed, 37 insertions(+), 11 deletions(-)

diff --git a/build/index.php b/build/index.php
index 7a63990..9d39daa 100644
--- a/build/index.php
+++ b/build/index.php
@@ -3810,14 +3810,22 @@ register_module([
  		 * ██      ██   ██ ███████ ██      ███████
  		 */
 		add_action("user-preferences", function() {
-			global $env;
+			global $env, $settings;
 			
 			if(!$env->is_logged_in)
 			{
 				exit(page_renderer::render_main("Error  - $settings->sitename", "<p>Since you aren't logged in, you can't change your preferences. This is because stored preferences are tied to each registered user account. You can login <a href='?action=login&returnto=" . rawurlencode("?action=user-preferences") . "'>here</a>.</p>"));
 			}
 			
+			$statusMessages = [
+				"change-password" => "Password changed successfully!"
+			];
+			
 			$content = "<h2>User Preferences</h2>\n";
+			if(isset($_GET["success"]) && $_GET["success"] === "yes")
+			{
+				$content .= "<p class='user-prefs-status-message'><em>" . $statusMessages[$_GET["operation"]] . "</em></p>\n";
+			}
 			$content .= "<label for='username'>Username:</label>\n";
 			$content .= "<input type='text' name='username' value='$env->user' readonly />\n";
 			$content .= "<h3>Change Password</h3\n>";
@@ -3838,21 +3846,26 @@ register_module([
 		});
 		
 		add_action("change-password", function() {
-		    global $env;
+		    global $env, $settings;
+			
 			// Make sure the new password was typed correctly
 			// This comes before the current password check since that's more intensive
 			if($_POST["new-pass"] !== $_POST["new-pass-confirm"]) {
-				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>The new password you typed twice didn't match. <a href='javascript:history.back();'>Go back</a>.</p>"));
+				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>The new password you typed twice didn't match! <a href='javascript:history.back();'>Go back</a>.</p>"));
 			}
 			// Check the current password
 			if(hash_password($_POST["current-pass"]) !== $env->user_data->password) {
-				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>Error: You typed your current password incorrectly. <a href='javascript:history.back();'>Go back</a>.</p>"));
+				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>Error: You typed your current password incorrectly! <a href='javascript:history.back();'>Go back</a>.</p>"));
 			}
 			
 			// All's good! Go ahead and change the password.
-			$env->user_data->password = hash_password($_POST["current-pass"]);
+			$env->user_data->password = hash_password($_POST["new-pass"]);
 			// Save the userdata back to disk
 			save_userdata();
+			
+			http_response_code(307);
+			header("location: ?action=user-preferences&success=yes&operation=change-password");
+			exit(page_renderer::render_main("Password Changed Successfully", "<p>You password was changed successfully. <a href='?action=user-preferences'>Go back to the user preferences page</a>.</p>"));
 		});
 		
 		/**
diff --git a/module_index.json b/module_index.json
index 82b0723..a69c94a 100755
--- a/module_index.json
+++ b/module_index.json
@@ -104,7 +104,7 @@
         "author": "Starbeamrainbowlabs",
         "description": "Adds a user preferences page, letting pople do things like change their email address and password.",
         "id": "feature-user-preferences",
-        "lastupdate": 1482357790,
+        "lastupdate": 1482516311,
         "optional": false
     },
     {
diff --git a/modules/feature-user-preferences.php b/modules/feature-user-preferences.php
index 3186e2c..81e2cac 100644
--- a/modules/feature-user-preferences.php
+++ b/modules/feature-user-preferences.php
@@ -28,14 +28,22 @@ register_module([
  		 * ██      ██   ██ ███████ ██      ███████
  		 */
 		add_action("user-preferences", function() {
-			global $env;
+			global $env, $settings;
 			
 			if(!$env->is_logged_in)
 			{
 				exit(page_renderer::render_main("Error  - $settings->sitename", "<p>Since you aren't logged in, you can't change your preferences. This is because stored preferences are tied to each registered user account. You can login <a href='?action=login&returnto=" . rawurlencode("?action=user-preferences") . "'>here</a>.</p>"));
 			}
 			
+			$statusMessages = [
+				"change-password" => "Password changed successfully!"
+			];
+			
 			$content = "<h2>User Preferences</h2>\n";
+			if(isset($_GET["success"]) && $_GET["success"] === "yes")
+			{
+				$content .= "<p class='user-prefs-status-message'><em>" . $statusMessages[$_GET["operation"]] . "</em></p>\n";
+			}
 			$content .= "<label for='username'>Username:</label>\n";
 			$content .= "<input type='text' name='username' value='$env->user' readonly />\n";
 			$content .= "<h3>Change Password</h3\n>";
@@ -56,21 +64,26 @@ register_module([
 		});
 		
 		add_action("change-password", function() {
-		    global $env;
+		    global $env, $settings;
+			
 			// Make sure the new password was typed correctly
 			// This comes before the current password check since that's more intensive
 			if($_POST["new-pass"] !== $_POST["new-pass-confirm"]) {
-				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>The new password you typed twice didn't match. <a href='javascript:history.back();'>Go back</a>.</p>"));
+				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>The new password you typed twice didn't match! <a href='javascript:history.back();'>Go back</a>.</p>"));
 			}
 			// Check the current password
 			if(hash_password($_POST["current-pass"]) !== $env->user_data->password) {
-				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>Error: You typed your current password incorrectly. <a href='javascript:history.back();'>Go back</a>.</p>"));
+				exit(page_renderer::render_main("Password mismatch - $settings->sitename", "<p>Error: You typed your current password incorrectly! <a href='javascript:history.back();'>Go back</a>.</p>"));
 			}
 			
 			// All's good! Go ahead and change the password.
-			$env->user_data->password = hash_password($_POST["current-pass"]);
+			$env->user_data->password = hash_password($_POST["new-pass"]);
 			// Save the userdata back to disk
 			save_userdata();
+			
+			http_response_code(307);
+			header("location: ?action=user-preferences&success=yes&operation=change-password");
+			exit(page_renderer::render_main("Password Changed Successfully", "<p>You password was changed successfully. <a href='?action=user-preferences'>Go back to the user preferences page</a>.</p>"));
 		});
 		
 		/**
