mod/lostpass.php

   1 <?php
   2 /**
   3  * @file mod/lostpass.php
   4  */
   5
   6 use Friendica\App;
   7 use Friendica\Core\Config;
   8 use Friendica\Core\L10n;
   9 use Friendica\Core\Renderer;
  10 use Friendica\Core\System;
  11 use Friendica\Database\DBA;
  12 use Friendica\Model\User;
  13 use Friendica\Util\DateTimeFormat;
  14 use Friendica\Util\Strings;
  15
  16 require_once 'boot.php';
  17 require_once 'include/enotify.php';
  18 require_once 'include/text.php';
  19
  20 function lostpass_post(App $a)
  21 {
  22         $loginame = Strings::escapeTags(trim($_POST['login-name']));
  23         if (!$loginame) {
  24                 $a->internalRedirect();
  25         }
  26
  27         $condition = ['(`email` = ? OR `nickname` = ?) AND `verified` = 1 AND `blocked` = 0', $loginame, $loginame];
  28         $user = DBA::selectFirst('user', ['uid', 'username', 'email', 'language'], $condition);
  29         if (!DBA::isResult($user)) {
  30                 notice(L10n::t('No valid account found.') . EOL);
  31                 $a->internalRedirect();
  32         }
  33
  34         $pwdreset_token = Strings::getRandomName(12) . mt_rand(1000, 9999);
  35
  36         $fields = [
  37                 'pwdreset' => $pwdreset_token,
  38                 'pwdreset_time' => DateTimeFormat::utcNow()
  39         ];
  40         $result = DBA::update('user', $fields, ['uid' => $user['uid']]);
  41         if ($result) {
  42                 info(L10n::t('Password reset request issued. Check your email.') . EOL);
  43         }
  44
  45         $sitename = Config::get('config', 'sitename');
  46         $resetlink = System::baseUrl() . '/lostpass/' . $pwdreset_token;
  47
  48         $preamble = Strings::deindent(L10n::t('
  49                 Dear %1$s,
  50                         A request was recently received at "%2$s" to reset your account
  51                 password. In order to confirm this request, please select the verification link
  52                 below or paste it into your web browser address bar.
  53
  54                 If you did NOT request this change, please DO NOT follow the link
  55                 provided and ignore and/or delete this email, the request will expire shortly.
  56
  57                 Your password will not be changed unless we can verify that you
  58                 issued this request.', $user['username'], $sitename));
  59         $body = Strings::deindent(L10n::t('
  60                 Follow this link soon to verify your identity:
  61
  62                 %1$s
  63
  64                 You will then receive a follow-up message containing the new password.
  65                 You may change that password from your account settings page after logging in.
  66
  67                 The login details are as follows:
  68
  69                 Site Location:  %2$s
  70                 Login Name:     %3$s', $resetlink, System::baseUrl(), $user['email']));
  71
  72         notification([
  73                 'type'     => SYSTEM_EMAIL,
  74                 'language' => $user['language'],
  75                 'to_name'  => $user['username'],
  76                 'to_email' => $user['email'],
  77                 'uid'      => $user['uid'],
  78                 'subject'  => L10n::t('Password reset requested at %s', $sitename),
  79                 'preamble' => $preamble,
  80                 'body'     => $body
  81         ]);
  82
  83         $a->internalRedirect();
  84 }
  85
  86 function lostpass_content(App $a)
  87 {
  88         $o = '';
  89         if ($a->argc > 1) {
  90                 $pwdreset_token = $a->argv[1];
  91
  92                 $user = DBA::selectFirst('user', ['uid', 'username', 'email', 'pwdreset_time', 'language'], ['pwdreset' => $pwdreset_token]);
  93                 if (!DBA::isResult($user)) {
  94                         notice(L10n::t("Request could not be verified. \x28You may have previously submitted it.\x29 Password reset failed."));
  95
  96                         return lostpass_form();
  97                 }
  98
  99                 // Password reset requests expire in 60 minutes
 100                 if ($user['pwdreset_time'] < DateTimeFormat::utc('now - 1 hour')) {
 101                         $fields = [
 102                                 'pwdreset' => null,
 103                                 'pwdreset_time' => null
 104                         ];
 105                         DBA::update('user', $fields, ['uid' => $user['uid']]);
 106
 107                         notice(L10n::t('Request has expired, please make a new one.'));
 108
 109                         return lostpass_form();
 110                 }
 111
 112                 return lostpass_generate_password($user);
 113         } else {
 114                 return lostpass_form();
 115         }
 116 }
 117
 118 function lostpass_form()
 119 {
 120         $tpl = Renderer::getMarkupTemplate('lostpass.tpl');
 121         $o = Renderer::replaceMacros($tpl, [
 122                 '$title' => L10n::t('Forgot your Password?'),
 123                 '$desc' => L10n::t('Enter your email address and submit to have your password reset. Then check your email for further instructions.'),
 124                 '$name' => L10n::t('Nickname or Email: '),
 125                 '$submit' => L10n::t('Reset')
 126         ]);
 127
 128         return $o;
 129 }
 130
 131 function lostpass_generate_password($user)
 132 {
 133         $o = '';
 134         $a = get_app();
 135
 136         $new_password = User::generateNewPassword();
 137         $result = User::updatePassword($user['uid'], $new_password);
 138         if (DBA::isResult($result)) {
 139                 $tpl = Renderer::getMarkupTemplate('pwdreset.tpl');
 140                 $o .= Renderer::replaceMacros($tpl, [
 141                         '$lbl1'    => L10n::t('Password Reset'),
 142                         '$lbl2'    => L10n::t('Your password has been reset as requested.'),
 143                         '$lbl3'    => L10n::t('Your new password is'),
 144                         '$lbl4'    => L10n::t('Save or copy your new password - and then'),
 145                         '$lbl5'    => '<a href="' . System::baseUrl() . '">' . L10n::t('click here to login') . '</a>.',
 146                         '$lbl6'    => L10n::t('Your password may be changed from the <em>Settings</em> page after successful login.'),
 147                         '$newpass' => $new_password,
 148                         '$baseurl' => System::baseUrl()
 149                 ]);
 150
 151                 info("Your password has been reset." . EOL);
 152
 153                 $sitename = Config::get('config', 'sitename');
 154                 $preamble = Strings::deindent(L10n::t('
 155                         Dear %1$s,
 156                                 Your password has been changed as requested. Please retain this
 157                         information for your records ' . "\x28" . 'or change your password immediately to
 158                         something that you will remember' . "\x29" . '.
 159                 ', $user['username']));
 160                 $body = Strings::deindent(L10n::t('
 161                         Your login details are as follows:
 162
 163                         Site Location:  %1$s
 164                         Login Name:     %2$s
 165                         Password:       %3$s
 166
 167                         You may change that password from your account settings page after logging in.
 168                 ', System::baseUrl(), $user['email'], $new_password));
 169
 170                 notification([
 171                         'type'     => SYSTEM_EMAIL,
 172                         'language' => $user['language'],
 173                         'to_name'  => $user['username'],
 174                         'to_email' => $user['email'],
 175                         'uid'      => $user['uid'],
 176                         'subject'  => L10n::t('Your password has been changed at %s', $sitename),
 177                         'preamble' => $preamble,
 178                         'body'     => $body
 179                 ]);
 180         }
 181
 182         return $o;
 183 }