cvs: php-hosts-web / TODO forgot.php showinfo.php table.sql

jimw Thu Apr 25 21:24:05 2002 EDT Added files: /php-hosts-web forgot.php Modified files: /php-hosts-web TODO showinfo.php table.sql Log: implement password recovery Index: php-hosts-web/TODO diff -u php-hosts-web/TODO:1.1 php-hosts-web/TODO:1.2 --- php-hosts-web/TODO:1.1 Thu Apr 25 00:14:26 2002 +++ php-hosts-web/TODO Thu Apr 25 21:24:05 2002 @@ -1,4 +1,3 @@ -* password recovery * better error handling in host-add.php for duplicate records * expand the initial email after host creation to explain how the editing works Index: php-hosts-web/showinfo.php diff -u php-hosts-web/showinfo.php:1.6 php-hosts-web/showinfo.php:1.7 --- php-hosts-web/showinfo.php:1.6 Wed Apr 24 23:42:21 2002 +++ php-hosts-web/showinfo.php Thu Apr 25 21:24:05 2002 @@ -145,6 +145,11 @@ } while ($service); ?> </table> +<p>Do you represent this hosting company, want to update the +information, but can't remember your password so you can <a +href="login.php">log in</a>? Then <a href="forgot.php?hostid=<?php +echo $hostid;?>">click here</a> to have instructions on how to change +your password sent to you.</p> <small> NOTE: This site makes no claim that the above information is accurate.<BR> </small> Index: php-hosts-web/table.sql diff -u php-hosts-web/table.sql:1.9 php-hosts-web/table.sql:1.10 --- php-hosts-web/table.sql:1.9 Tue Apr 23 22:17:54 2002 +++ php-hosts-web/table.sql Thu Apr 25 21:24:05 2002 @@ -36,6 +36,7 @@ lastupdate datetime NOT NULL, contact varchar(64) NOT NULL default '', password varchar(13) NOT NULL default '', + forgot varchar(12) default NULL, PRIMARY KEY (HostID), UNIQUE KEY HostName (HostName), UNIQUE KEY HostURL (HostURL), Index: php-hosts-web/forgot.php +++ php-hosts-web/forgot.php <?php require 'shared.inc'; commonHeader("Forgotten Password"); $id = (int)$id; $hostid = (int)$hostid; if ($id && $key) { if ($n1 && $n2) { if ($n1 == $n2) { $passwd = addslashes(crypt(stripslashes($n1), substr(md5(time()), 0, 2))); $res = @mysql_query("UPDATE hosts SET forgot=NULL,password='$passwd' WHERE HostId='$id' AND forgot='$key'"); if ($res && mysql_affected_rows()) { echo '<p>Okay, your password has been changed. You should now be able to <a href="login.php">log in</a> using your new password. If you forget your password again, you\'ll have to start this process over to get a new key to change it again.</p>'; commonFooter(); exit; } else { echo '<p class="warning">Naughty you, the key you used to access this page doesn\'t match what we have on file for that record. You\'ll need to <a href="',$PHP_SELF,'">start this process over</a>.</p>'; } } else { echo '<p class="warning">Those two passwords didn\'t match!</p>'; } } ?> <p>You're in the home stretch now. Just choose a new password (typing it twice, to avoid typos and another trip around this merry-go-round).</p> <form method="post" action="<?php echo $PHP_SELF?>"> <table> <tr> <th align="right">Password:</th> <td><input type="password" name="n1" value="" /></td> </tr> <tr> <th align="right">Again:</th> <td><input type="password" name="n2" value="" /></td> </tr> <tr> <td colspan="2"> <input type="hidden" name="id" value="<?php echo clean($id);?>" /> <input type="hidden" name="key" value="<?php echo clean($key);?>" /> <input type="submit" value="Change Password" /> </td> </tr> </table> </form> <?php commonFooter(); exit; } elseif ($email || ($hostid && $confirmed)) { $res = @mysql_query("SELECT HostId,HostName,contact FROM hosts WHERE " . ($email ? "contact='$email'" : "hostid='$hostid'")); if ($res && ($row = mysql_fetch_assoc($res))) { $newpass = randomString(12); $query = "UPDATE hosts SET forgot='$newpass' WHERE HostId=$row[HostId]"; $res = @mysql_query($query); if ($res) { $body = "Someone filled out the form that says you forgot your hosts.php.net password. If it wasn't you, don't worry too much about it. Unless someone is reading your mail, there's not much they can do. (But you may want to change your password using the instructions below, just to be safe.) To change your password, simply use the URL below and choose a new password. http://hosts.php.net/forgot.php?id=$row[HostId]&key=$newpass Let us know if you have any further problems. -- webmaster@php.net "; mail($row['contact'],"Password change instructions for $row[HostName]",$body,'From: PHP Webmaster <webmaster@php.net>'); echo '<p>Okay, instructions on how to change your password have been sent to your email address. If you don\'t receive them, you\'ll have to contact webmaster@php.net for help.</p>'; commonFooter(); exit; } else { echo '<div class="errors">Something strange happened. You\'ll have to contact webmaster@php.net for help.</div>'; } } else {?> <div class="errors">There's no record with that contact address around here. Perhaps you need to contact webmaster@php.net for help.</div> <?php } } elseif ($hostid) { $host = mysql_get_one("SELECT HostName FROM hosts WHERE HostId=$hostid"); if ($host) {?> <div class="explain">This will send instructions on how the password for the entry about "<?php echo htmlentities($host);?>" to the contact address for that record.</div> <form method="post" action="<?php echo $PHP_SELF?>"> <table> <tr> <td align="center"> <input type="hidden" name="hostid" value="<?php echo $hostid;?>" /> <input type="hidden" name="confirmed" value="1" /> <input type="submit" value="Send Instructions" /> </td> </tr> </table> </form> <?php commonFooter(); exit; } echo '<div class="errors">You\'ve tried to get the password for a hosting company record that does not appear to exist.</div>'; } ?> <p>Forgot your password, huh? Just fill in your contact address, and instructions will be sent to you on how to change your password.</p> <p>If you've also forgotten what contact address you used, you'll need to find your record using the <a href="search.php">search page</a> and click on the link there (at the very bottom of the page) to have the instructions sent to your contact address. (And if that doesn't reach you, you'll just have to contact webmaster@php.net for help.)</p> <form method="post" action="<?php echo $PHP_SELF?>"> <table> <tr> <th align="right"> <label for="email">Contact Email:</labe> </th> <td> <input type="text" id="email" name="email" value="<?php echo clean($email);?>" /> </td> </tr> <tr> <td colspan="2" align="center"> <input type="submit" value="Send Instructions" /> </td> </tr> </table> </form> <?php commonFooter();