3 * @copyright Copyright (C) 2010-2023, the Friendica project
5 * @license GNU AGPL version 3 or any later version
7 * This program is free software: you can redistribute it and/or modify
8 * it under the terms of the GNU Affero General Public License as
9 * published by the Free Software Foundation, either version 3 of the
10 * License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU Affero General Public License for more details.
17 * You should have received a copy of the GNU Affero General Public License
18 * along with this program. If not, see <https://www.gnu.org/licenses/>.
22 namespace Friendica\Module\Security;
25 use Friendica\Core\L10n;
26 use Friendica\Core\Renderer;
27 use Friendica\Core\Session\Capability\IHandleUserSessions;
28 use Friendica\Database\DBA;
29 use Friendica\Model\User;
30 use Friendica\Module\Response;
31 use Friendica\Navigation\SystemMessages;
32 use Friendica\Util\Profiler;
33 use Psr\Log\LoggerInterface;
35 class PasswordTooLong extends \Friendica\BaseModule
37 /** @var SystemMessages */
39 /** @var IHandleUserSessions */
42 public function __construct(SystemMessages $sysmsg, L10n $l10n, App\BaseURL $baseUrl, App\Arguments $args, LoggerInterface $logger, Profiler $profiler, Response $response, IHandleUserSessions $userSession, $server, array $parameters = [])
44 parent::__construct($l10n, $baseUrl, $args, $logger, $profiler, $response, $server, $parameters);
46 $this->sysmsg = $sysmsg;
47 $this->userSession = $userSession;
50 protected function post(array $request = [])
52 $newpass = $request['password'];
53 $confirm = $request['password_confirm'];
56 if ($newpass != $confirm) {
57 throw new \Exception($this->l10n->t('Passwords do not match.'));
60 // check if the old password was supplied correctly before changing it to the new value
61 User::getIdFromPasswordAuthentication($this->userSession->getLocalUserId(), $request['password_current']);
63 if (strlen($request['password_current']) <= 72) {
64 throw new \Exception($this->l10n->t('Password does not need changing.'));
67 $result = User::updatePassword($this->userSession->getLocalUserId(), $newpass);
68 if (!DBA::isResult($result)) {
69 throw new \Exception($this->l10n->t('Password update failed. Please try again.'));
72 $this->sysmsg->addInfo($this->l10n->t('Password changed.'));
74 $this->baseUrl->redirect($request['return_url'] ?? '');
75 } catch (\Exception $e) {
76 $this->sysmsg->addNotice($e->getMessage());
77 $this->sysmsg->addNotice($this->l10n->t('Password unchanged.'));
81 protected function content(array $request = []): string
84 if (PASSWORD_DEFAULT !== PASSWORD_BCRYPT) {
85 $this->baseUrl->redirect();
88 $tpl = Renderer::getMarkupTemplate('security/password_too_long.tpl');
89 $o = Renderer::replaceMacros($tpl, [
91 'ptitle' => $this->l10n->t('Password Too Long'),
92 'desc' => $this->l10n->t('Since version 2022.09, we\'ve realized that any password longer than 72 characters is truncated during hashing. To prevent any confusion about this behavior, please update your password to be fewer or equal to 72 characters.'),
93 'submit' => $this->l10n->t('Update Password'),
96 '$baseurl' => $this->baseUrl,
97 '$form_security_token' => self::getFormSecurityToken('security/password_too_long'),
98 '$return_url' => $request['return_url'] ?? '',
100 '$password_current' => ['password_current', $this->l10n->t('Current Password:'), '', $this->l10n->t('Your current password to confirm the changes'), 'required', 'autocomplete="off"'],
101 '$password' => ['password', $this->l10n->t('New Password:'), '', $this->l10n->t('Allowed characters are a-z, A-Z, 0-9 and special characters except white spaces and accentuated letters.') . ' ' . $this->l10n->t('Password length is limited to 72 characters.'), 'required', 'autocomplete="off"', User::getPasswordRegExp()],
102 '$password_confirm' => ['password_confirm', $this->l10n->t('Confirm:'), '', '', 'required', 'autocomplete="off"'],