diff --git a/functions.inc.php b/functions.inc.php index 6254bf4..2758930 100644 --- a/functions.inc.php +++ b/functions.inc.php @@ -35,24 +35,13 @@ if (DEBUG == 'true') { // Action: Check if a session already exists, if not redirect to login.php // Call: check_session() -or- check_user_session() // -function check_session() { +function check_session($session = "sessid") { session_start(); - if (empty($_SESSION['sessid']['username'])) { + if (empty($_SESSION[$session]['username'])) { header("Location: login.php"); exit; } - $SESSID_USERNAME = $_SESSION['sessid']['username']; - return $SESSID_USERNAME; -} - -function check_user_session() { - session_start(); - if (empty($_SESSION['userid']['username'])) { - header("Location: login.php"); - exit; - } - $USERID_USERNAME = $_SESSION['userid']['username']; - return $USERID_USERNAME; + return $_SESSION[$session]['username']; } // diff --git a/languages/en.lang b/languages/en.lang index 24f6678..f2b6b76 100644 --- a/languages/en.lang +++ b/languages/en.lang @@ -255,5 +255,7 @@ $LANG['Logging_mailbox_add'] = 'add mailbox'; $LANG['Logging_mailbox_edit'] = 'edit mailbox'; $LANG['Logging_mailbox_delete'] = 'delete mailbox'; +$LANG['Logging_password_change'] = 'change password'; + $LANG['Search_welcome'] = 'Searching for: '; ?> diff --git a/list-virtual.php b/list-virtual.php index 9c79c8f..cc9fc89 100644 --- a/list-virtual.php +++ b/list-virtual.php @@ -35,7 +35,6 @@ if ($_SERVER['REQUEST_METHOD'] == "GET") { $list_mailbox = list_mailboxes($domain, $offset, $limit); } } - include './templates/header.tpl'; include './templates/menu.tpl'; include './templates/list-virtual.tpl'; diff --git a/login.php b/login.php index e7d9084..8a716cb 100644 --- a/login.php +++ b/login.php @@ -33,6 +33,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { $sth->execute(); $row = $sth->fetch(PDO::FETCH_COLUMN); } + if (!empty($row)) { if (!password_verify($password, $row)) { $message = $LANG['Login_incorrect']; @@ -41,6 +42,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { $message = $LANG['Login_incorrect']; } + if (empty($message)) { session_start(); $_SESSION['sessid']['username'] = $username; diff --git a/logout.php b/logout.php index 550fccf..2d6569d 100644 --- a/logout.php +++ b/logout.php @@ -17,8 +17,7 @@ // // -none- // -require("./config.inc.php"); -require("./functions.inc.php"); +require_once './functions.inc.php'; $SESSID_USERNAME = check_session(); diff --git a/password.php b/password.php index d03a0e0..fff4275 100644 --- a/password.php +++ b/password.php @@ -11,56 +11,56 @@ // // Template Variables: // -// tMessage +// message // // Form POST \ GET Variables: // -// fPassword_current -// fPassword -// fPassword2 +// password_current +// password1 +// password2 // -require("./functions.inc.php"); -include("./languages/" . check_language() . ".lang"); +require_once './functions.inc.php'; +include './languages/' . check_language() . '.lang'; $SESSID_USERNAME = check_session(); if ($_SERVER['REQUEST_METHOD'] == "POST") { - $fPassword_current = escape_string($_POST['fPassword_current']); - $fPassword = escape_string($_POST['fPassword']); - $fPassword2 = escape_string($_POST['fPassword2']); - $username = $SESSID_USERNAME; + $password_current = filter_input(INPUT_POST, 'password_current', FILTER_DEFAULT); + $password1 = filter_input(INPUT_POST, 'password1', FILTER_DEFAULT); + $password2 = filter_input(INPUT_POST, 'password2', FILTER_DEFAULT); - $result = db_query("SELECT * FROM admin WHERE username='$username'"); - if ($result['rows'] == 1) { - $row = db_array($result['result']); - if (!password_verify($fPassword_current, $row['assword'])) { - $error = 1; - $pPassword_password_current_text = $LANG['Password_password_current_text_error']; - } - } else { - $error = 1; - $pPassword_email_text = $LANG['Password_email_text_error']; + if (empty($password_current) || empty($password1) || $password1 != $password2) { + $message = $LANG['Password_password_text_error']; } - if (empty($fPassword) or ($fPassword != $fPassword2)) - { - $error = 1; - $pPassword_password_text = $LANG['Password_password_text_error']; - } - - if ($error != 1) { - $password = pacrypt($fPassword); - $result = db_query("UPDATE admin SET password='$password',modified=NOW() WHERE username='$username'"); - if ($result['rows'] == 1) { - $tMessage = $LANG['Password_result_succes']; - } else { - $tMessage = $LANG['Password_result_error']; + if (empty($message) && !empty($password_current)) { + $dbh = connect_db(); + $sth = $dbh->prepare("SELECT password FROM admin WHERE username=?"); + $sth->bindParam(1, $username, PDO::PARAM_STR); + $sth->execute(); + $row = $sth->fetch(PDO::FETCH_COLUMN); + if (!password_verify($password_current, $row)) { + $message = $LANG['Password_password_current_text_error']; } + } + + if (empty($message) && !empty($password1)) { + $hashed = bcrypt($password1); + try { + $dbh = connect_db(); + $sth = $dbh->prepare("UPDATE admin SET password=?,modified=NOW() WHERE username=?"); + $sth->bindParam(1, $hashed, PDO::PARAM_STR); + $sth->bindParam(2, $username, PDO::PARAM_STR); + $sth->execute(); + $message = $LANG['Password_result_succes']; + } catch(PDOException $e) { + $message = $LANG['Password_result_error']; + } } } -include("./templates/header.tpl"); -include("./templates/menu.tpl"); -include("./templates/password.tpl"); -include("./templates/footer.tpl"); +include './templates/header.tpl'; +include './templates/menu.tpl'; +include './templates/password.tpl'; +include './templates/footer.tpl'; ?> diff --git a/sendmail.php b/sendmail.php index 495b481..16dadfa 100644 --- a/sendmail.php +++ b/sendmail.php @@ -47,7 +47,6 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { } } } - include './templates/header.tpl'; include './templates/menu.tpl'; include './templates/sendmail.tpl'; diff --git a/templates/password.tpl b/templates/password.tpl index 5672e74..d0fc38f 100644 --- a/templates/password.tpl +++ b/templates/password.tpl @@ -2,33 +2,29 @@
- + - - - + - - + - - + - + - +

 
diff --git a/templates/users_login.tpl b/templates/users_login.tpl index 520ceb4..8338af5 100644 --- a/templates/users_login.tpl +++ b/templates/users_login.tpl @@ -6,17 +6,17 @@ - + - + - + diff --git a/templates/users_password.tpl b/templates/users_password.tpl index bbaae9a..12742ac 100644 --- a/templates/users_password.tpl +++ b/templates/users_password.tpl @@ -7,28 +7,24 @@ - - - -   - + - + diff --git a/templates/users_vacation-get.tpl b/templates/users_vacation-get.tpl deleted file mode 100644 index f537d5f..0000000 --- a/templates/users_vacation-get.tpl +++ /dev/null @@ -1,9 +0,0 @@ -
-
- - - - -
-
-
diff --git a/templates/users_vacation.tpl b/templates/users_vacation.tpl index 8092423..2c09061 100644 --- a/templates/users_vacation.tpl +++ b/templates/users_vacation.tpl @@ -4,25 +4,29 @@

+ - +   -   - + + + + - + diff --git a/users/edit-alias.php b/users/edit-alias.php index 9d6faa1..215653d 100644 --- a/users/edit-alias.php +++ b/users/edit-alias.php @@ -20,12 +20,10 @@ // fDomain // fGoto // -require("../variables.inc.php"); -require("../config.inc.php"); require("../functions.inc.php"); include("../languages/" . check_language() . ".lang"); -$USERID_USERNAME = check_user_session(); +$USERID_USERNAME = check_session('userid'); $USERID_DOMAIN = substr(strrchr($USERID_USERNAME, "@"), 1); if ($_SERVER['REQUEST_METHOD'] == "GET") { diff --git a/users/login.php b/users/login.php index 687252b..b63e049 100644 --- a/users/login.php +++ b/users/login.php @@ -9,46 +9,47 @@ // // Template File: login.tpl // -// Template Variables: +// Template variables: // -// tMessage -// tUsername +// message +// username // -// Form POST \ GET Variables: +// GET / POST variables: // -// fUsername -// fPassword +// username +// password // -require("../variables.inc.php"); -require("../config.inc.php"); -require("../functions.inc.php"); -include("../languages/" . check_language() . ".lang"); +require_once '../functions.inc.php'; +include '../languages/' . check_language () . '.lang'; if ($_SERVER['REQUEST_METHOD'] == "POST") { - $fUsername = escape_string($_POST['fUsername']); - $fPassword = escape_string($_POST['fPassword']); + $username = filter_input(INPUT_POST, 'username', FILTER_VALIDATE_EMAIL); + $password = filter_input(INPUT_POST, 'password', FILTER_DEFAULT); - $result = db_query("SELECT password FROM mailbox WHERE username='$fUsername' AND active='1'"); - if ($result['rows'] == 1) { - $row = db_array($result['result']); - if (!password_verify($fPassword, $row['assword'])) { - $error = 1; - $tMessage = $LANG['Login_password_incorrect']; - $tUsername = $fUsername; - } - } else { - $error = 1; - $tMessage = $LANG['Login_username_incorrect']; + if (!empty($username) && !empty($password)) { + $dbh = connect_db(); + $sth = $dbh->prepare("SELECT password FROM mailbox WHERE username=?"); + $sth->bindParam(1, $username, PDO::PARAM_STR); + $sth->execute(); + $row = $sth->fetch(PDO::FETCH_COLUMN); } - if ($error != 1) { + if (!empty($row)) { + if (!password_verify($password, $row)) { + $message = $LANG['Login_incorrect']; + } + } else { + $message = $LANG['Login_incorrect']; + } + + if (empty($message)) { session_start(); - $_SESSION['userid']['username'] = $fUsername; + $_SESSION['userid']['username'] = $username; header("Location: main.php"); exit; } } -include("../templates/header.tpl"); -include("../templates/users_login.tpl"); -include("../templates/footer.tpl"); +include '../templates/header.tpl'; +include '../templates/users_login.tpl'; +include '../templates/footer.tpl'; ?> diff --git a/users/logout.php b/users/logout.php index 2f7ebf8..3eebb19 100644 --- a/users/logout.php +++ b/users/logout.php @@ -17,10 +17,9 @@ // // -none- // -require("../config.inc.php"); -require("../functions.inc.php"); +require_once '../functions.inc.php'; -$USERID_USERNAME = check_user_session(); +$USERID_USERNAME = check_session('userid'); session_unset(); session_destroy(); diff --git a/users/main.php b/users/main.php index f40bd2c..4d5166d 100644 --- a/users/main.php +++ b/users/main.php @@ -17,13 +17,13 @@ // // -none- // -require("../config.inc.php"); -require("../functions.inc.php"); -include("../languages/" . check_language() . ".lang"); +require_once '../functions.inc.php'; -$USERID_USERNAME = check_user_session(); +include '../languages/' . check_language() . '.lang'; -include("../templates/header.tpl"); -include("../templates/users_menu.tpl"); -include("../templates/users_main.tpl"); -include("../templates/footer.tpl"); +$SESSID_USERNAME = check_session('userid'); + +include '../templates/header.tpl'; +include '../templates/users_menu.tpl'; +include '../templates/users_main.tpl'; +include '../templates/footer.tpl'; diff --git a/users/password.php b/users/password.php index 3fa0503..044ff3d 100644 --- a/users/password.php +++ b/users/password.php @@ -7,64 +7,62 @@ // // File: password.php // -// Template File: users_password.tpl +// Template File: password.tpl // // Template Variables: // -// tMessage +// message // // Form POST \ GET Variables: // -// fPassword_current -// fPassword -// fPassword2 +// password_current +// password1 +// password2 // -require("../variables.inc.php"); -require("../config.inc.php"); -require("../functions.inc.php"); -include("../languages/" . check_language() . ".lang"); +require_once '../functions.inc.php'; +include '../languages/' . check_language() . '.lang'; -$USERID_USERNAME = check_user_session(); -$USERID_DOMAIN = substr(strrchr($USERID_USERNAME, "@"), 1); +$SESSID_USERNAME = check_session('userid'); +$admin = $SESSID_USERNAME ?? ADMIN_EMAIL; if ($_SERVER['REQUEST_METHOD'] == "POST") { - $fPassword_current = escape_string($_POST['fPassword_current']); - $fPassword = escape_string($_POST['fPassword']); - $fPassword2 = escape_string($_POST['fPassword2']); - - $username = $USERID_USERNAME; + $username = $SESSID_USERNAME; + $password_current = filter_input(INPUT_POST, 'password_current', FILTER_DEFAULT); + $password1 = filter_input(INPUT_POST, 'password1', FILTER_DEFAULT); + $password2 = filter_input(INPUT_POST, 'password2', FILTER_DEFAULT); - $result = db_query("SELECT * FROM mailbox WHERE username='$username'"); - if ($result['rows'] == 1) { - $row = db_array($result['result']); - if (!password_verify($fPassword_current, $row['assword'])) { - $error = 1; - $pPassword_password_current_text = $LANG['Password_password_current_text_error']; - } - } else { - $error = 1; - $pPassword_email_text = $LANG['Password_email_text_error']; + if (empty($password_current) || empty($password1) || $password1 != $password2) { + $message = $LANG['Password_password_text_error']; } - if (empty($fPassword) or ($fPassword != $fPassword2)) - { - $error = 1; - $pPassword_password_text = $LANG['Password_password_text_error']; - } - - if ($error != 1) { - $password = pacrypt($fPassword); - $result = db_query("UPDATE mailbox SET password='$password',modified=NOW(),scheme='' WHERE username='$username'"); - if ($result['rows'] == 1) { - $tMessage = $LANG['Password_result_succes']; - db_log($USERID_USERNAME, $USERID_DOMAIN, "change password", "$USERID_USERNAME"); - } else { - $tMessage = $LANG['Password_result_error']; + if (empty($message) && !empty($password_current)) { + $dbh = connect_db(); + $sth = $dbh->prepare("SELECT password FROM mailbox WHERE username=?"); + $sth->bindParam(1, $username, PDO::PARAM_STR); + $sth->execute(); + $row = $sth->fetch(PDO::FETCH_COLUMN); + if (!password_verify($password_current, $row)) { + $message = $LANG['Password_password_current_text_error']; } + } + + if (empty($message) && !empty($password1)) { + $hashed = bcrypt($password1); + try { + $dbh = connect_db(); + $sth = $dbh->prepare("UPDATE mailbox SET password=?,modified=NOW() WHERE username=?"); + $sth->bindParam(1, $hashed, PDO::PARAM_STR); + $sth->bindParam(2, $username, PDO::PARAM_STR); + $sth->execute(); + logging($admin, substr(strrchr($SESSID_USERNAME, "@"), 1), $LANG['Logging_password_change'], $admin); + $message = $LANG['Password_result_succes']; + } catch(PDOException $e) { + $message = $LANG['Password_result_error']; + } } } -include("../templates/header.tpl"); -include("../templates/users_menu.tpl"); -include("../templates/users_password.tpl"); -include("../templates/footer.tpl"); +include '../templates/header.tpl'; +include '../templates/users_menu.tpl'; +include '../templates/password.tpl'; +include '../templates/footer.tpl'; ?> diff --git a/users/vacation.php b/users/vacation.php index 3200ad3..bece113 100644 --- a/users/vacation.php +++ b/users/vacation.php @@ -20,58 +20,62 @@ // fSubject // fBody // -require("../variables.inc.php"); -require("../config.inc.php"); -require("../functions.inc.php"); -include("../languages/" . check_language() . ".lang"); +require_once '../functions.inc.php'; +include '../languages/' . check_language() . '.lang'; -$USERID_USERNAME = check_user_session(); -$USERID_DOMAIN = substr(strrchr($USERID_USERNAME, "@"), 1); +$SESSID_USERNAME = check_session('userid'); +$USERID_DOMAIN = substr(strrchr($SESSID_USERNAME, "@"), 1); if ($_SERVER['REQUEST_METHOD'] == "GET") { - $result = db_query("SELECT * FROM vacation WHERE email='$USERID_USERNAME'"); - if ($result['rows'] == 1) { - $row = db_array($result['result']); - $tMessage = $LANG['UsersVacation_welcome_text']; - $template = "users_vacation-get.tpl"; + $dbh = connect_db(); + $sth = $dbh->prepare("SELECT COUNT(*) FROM vacation WHERE email=?"); + $sth->execute(array($SESSID_USERNAME)); + + if ($sth->fetchColumn() == 1) { + $action = 'back'; + $message = $LANG['UsersVacation_welcome_text']; } else { - $template = "users_vacation.tpl"; + $action = 'away'; } - - include("../templates/header.tpl"); - include("../templates/users_menu.tpl"); - include("../templates/$template"); - include("../templates/footer.tpl"); } if ($_SERVER['REQUEST_METHOD'] == "POST") { - if (isset($_POST['fSubject'])) $fSubject = escape_string($_POST['fSubject']); - if (isset($_POST['fBody'])) $fBody = escape_string($_POST['fBody']); + $subject = filter_input(INPUT_POST, 'subject', FILTER_DEFAULT); + $body = filter_input(INPUT_POST, 'body', FILTER_DEFAULT); - if (!empty($_POST['fBack'])) { - $result = db_query("DELETE FROM vacation WHERE email='$USERID_USERNAME'"); - if ($result['rows'] != 1) { - $error = 1; - $tMessage = $LANG['UsersVacation_result_error']; + if (!empty($_POST['back'])) { + $action = 'back'; + $dbh = connect_db(); + $sth = $dbh->prepare("DELETE FROM vacation WHERE email=?"); + $sth->bindParam(1, $SESSID_USERNAME, PDO::PARAM_STR); + $sth->execute(); + if ($sth->rowCount() != 1) { + $message = $LANG['UsersVacation_result_error']; } else { - $tMessage = $LANG['UsersVacation_result_succes']; + $action = 'away'; + $essage = $LANG['UsersVacation_result_succes']; } } - if (!empty($_POST['fAway'])) { - $result = db_query("INSERT INTO vacation (email,subject,body,cache,domain,created,active) VALUES ('$USERID_USERNAME','$fSubject','$fBody','','$USERID_DOMAIN',NOW(),'1')"); - if ($result['rows'] != 1) { - $error = 1; - $tMessage = $LANG['UsersVacation_result_error']; - } else { + if (!empty($_POST['away'])) { + $action = 'away'; + try { + $dbh = connect_db(); + $sth = $dbh->prepare("INSERT INTO vacation (email,subject,body,cache,domain,created) VALUES (?,?,?,'',?,NOW())"); + $sth->bindParam(1, $SESSID_USERNAME, PDO::PARAM_STR); + $sth->bindParam(2, $subject, PDO::PARAM_STR); + $sth->bindParam(3, $body, PDO::PARAM_STR); + $sth->bindParam(4, $USERID_DOMAIN, PDO::PARAM_STR); + $sth->execute(); header("Location: main.php"); - exit; + } catch(PDOException $e) { + $message = $LANG['UsersVacation_result_error'] . " " . $e->getMessage(); } } - include("../templates/header.tpl"); - include("../templates/users_menu.tpl"); - include("../templates/users_vacation.tpl"); - include("../templates/footer.tpl"); } +include '../templates/header.tpl'; +include '../templates/users_menu.tpl'; +include '../templates/users_vacation.tpl'; +include '../templates/footer.tpl'; ?>