From 61ee2327bff6598873c61afa7b817a9802e8d320 Mon Sep 17 00:00:00 2001 From: drlippman Date: Wed, 27 Dec 2017 12:59:26 -0800 Subject: [PATCH] Feature to force password reset on first login after manual reset --- actions.php | 8 +++----- admin/actions.php | 22 +--------------------- admin/forms.php | 10 ---------- admin/importstu.php | 4 ++-- course/listusers.php | 6 +++--- forms.php | 10 ++++++++-- includes/newusercommon.php | 5 ++++- javascript/jquery.validate.min.js | 3 +++ validate.php | 8 ++++++-- 9 files changed, 30 insertions(+), 46 deletions(-) diff --git a/actions.php b/actions.php index 51ee0bfb1a..f0d87e1d68 100644 --- a/actions.php +++ b/actions.php @@ -414,7 +414,7 @@ setcookie(session_name(), '', time()-42000, '/'); } session_destroy(); - } else if ($_GET['action']=="chgpwd") { + } else if ($_GET['action']=="chgpwd" || $_GET['action']=="forcechgpwd") { //DB $query = "SELECT password FROM imas_users WHERE id = '$userid'"; //DB $result = mysql_query($query) or die("Query failed : " . mysql_error()); //DB $line = mysql_fetch_array($result, MYSQL_ASSOC); @@ -427,12 +427,10 @@ } else { $newpw =md5($_POST['pw1']); } - //DB $query = "UPDATE imas_users SET password='$md5pw' WHERE id='$userid'"; - //DB mysql_query($query) or die("Query failed : " . mysql_error()); - $stm = $DBH->prepare("UPDATE imas_users SET password=:newpw WHERE id=:uid LIMIT 1"); + $stm = $DBH->prepare("UPDATE imas_users SET password=:newpw,forcepwreset=0 WHERE id=:uid LIMIT 1"); $stm->execute(array(':uid'=>$userid, ':newpw'=>$newpw)); } else { - echo "Password change failed. Try Again\n"; + echo "Password change failed. Try Again\n"; echo "\n"; exit; } diff --git a/admin/actions.php b/admin/actions.php index ae233f153d..5ebac77c2e 100644 --- a/admin/actions.php +++ b/admin/actions.php @@ -108,7 +108,7 @@ $query .= ',SID=:SID'; } if (isset($_POST['doresetpw'])) { - $query .= ',password=:password'; + $query .= ',password=:password,forcepwreset=1'; } $query .= " WHERE id=:id"; $stm = $DBH->prepare($query); @@ -212,26 +212,6 @@ deletealluserfiles($_GET['id']); //todo: delete courses if any break; - case "chgpwd": - $stm = $DBH->prepare("SELECT password FROM imas_users WHERE id=:id"); - $stm->execute(array(':id'=>$userid)); - $line = $stm->fetch(PDO::FETCH_ASSOC); - - if ((md5($_POST['oldpw'])==$line['password'] || (isset($CFG['GEN']['newpasswords']) && password_verify($_POST['oldpw'], $line['password'])) ) && ($_POST['newpw1'] == $_POST['newpw2'])) { - $md5pw =md5($_POST['newpw1']); - if (isset($CFG['GEN']['newpasswords'])) { - $md5pw = password_hash($_POST['newpw1'], PASSWORD_DEFAULT); - } else { - $md5pw = md5($_POST['newpw1']); - } - $stm = $DBH->prepare("UPDATE imas_users SET password=:password WHERE id=:id"); - $stm->execute(array(':password'=>$md5pw, ':id'=>$userid)); - } else { - echo "Password change failed. Try Again\n"; - echo "\n"; - exit; - } - break; case "newadmin": if ($myrights < 75 && ($myspecialrights&16)!=16 && ($myspecialrights&32)!=32) { echo "You don't have the authority for this action"; break;} if ($_POST['newrights']>$myrights) { diff --git a/admin/forms.php b/admin/forms.php index c277001b85..694bccf391 100644 --- a/admin/forms.php +++ b/admin/forms.php @@ -67,16 +67,6 @@ echo "

\n"; echo ''; break; - case "chgpwd": - echo '

Change Your Password

'; - echo "
\n"; - echo ''; - echo "Enter old password:
\n"; - echo "Enter new password:
\n"; - echo "Verify new password:
\n"; - echo '
'; - break; - case "chgrights": case "newadmin": echo "
prepare("INSERT INTO imas_users (SID,FirstName,LastName,email,rights,password) VALUES (:SID, :FirstName, :LastName, :email, :rights, :password)"); + $stm = $DBH->prepare("INSERT INTO imas_users (SID,FirstName,LastName,email,rights,password,forcepwreset) VALUES (:SID, :FirstName, :LastName, :email, :rights, :password, 1)"); $stm->execute(array(':SID'=>$arr[0], ':FirstName'=>$arr[1], ':LastName'=>$arr[2], ':email'=>$arr[3], ':rights'=>10, ':password'=>$pw)); $id = $DBH->lastInsertId(); } @@ -328,7 +328,7 @@ function parsecsv($data) { ?> - + $v) { echo "\n"; diff --git a/course/listusers.php b/course/listusers.php index 4fba31cf08..0cd17cf9d0 100644 --- a/course/listusers.php +++ b/course/listusers.php @@ -204,8 +204,8 @@ //DB $query .= "VALUES ('{$_POST['SID']}','$md5pw',10,'{$_POST['firstname']}','{$_POST['lastname']}','{$_POST['email']}',0);"; //DB mysql_query($query) or die("Query failed : " . mysql_error()); //DB $newuserid = mysql_insert_id(); - $query = "INSERT INTO imas_users (SID, password, rights, FirstName, LastName, email, msgnotify) "; - $query .= "VALUES (:SID, :password, :rights, :FirstName, :LastName, :email, :msgnotify);"; + $query = "INSERT INTO imas_users (SID, password, rights, FirstName, LastName, email, msgnotify, forcepwreset) "; + $query .= "VALUES (:SID, :password, :rights, :FirstName, :LastName, :email, :msgnotify, 1);"; $stm = $DBH->prepare($query); $stm->execute(array(':SID'=>$_POST['SID'], ':password'=>$md5pw, ':rights'=>10, ':FirstName'=>$_POST['firstname'], ':LastName'=>$_POST['lastname'], ':email'=>$_POST['email'], ':msgnotify'=>0)); @@ -321,7 +321,7 @@ $newpw = md5($_POST['pw1']); } //DB $query .= ",password='$newpw'"; - $query .= ",password=:password"; + $query .= ",password=:password,forcepwreset=1"; $qarr[':password'] = $newpw; $msgout .= '

Password updated

'; } diff --git a/forms.php b/forms.php index 022f259760..16daa98b0a 100644 --- a/forms.php +++ b/forms.php @@ -94,12 +94,18 @@ include($studentTOS); } break; + case "forcechgpwd": case "chgpwd": - if ($gb == '') { + if ($gb == '' && $_GET['action']!='forcechgpwd') { echo "
Home > Change Password
\n"; } echo '

Change Your Password

'; - echo "\n"; + if ($_GET['action']=='forcechgpwd') { + echo '

'._('To ensure the security of your account, we are requiring a password change. Please select a new password.').'

'; + echo "\n"; + } else { + echo "\n"; + } echo "
\n"; echo "
\n"; echo "
\n"; diff --git a/includes/newusercommon.php b/includes/newusercommon.php index 3b1f334950..02a664d86b 100644 --- a/includes/newusercommon.php +++ b/includes/newusercommon.php @@ -28,10 +28,13 @@ function showNewUserValidation($formname, $extrarequired=array(), $requiredrules echo '" }, pw1: { - required: '.(isset($requiredrules['pw1'])?$requiredrules['pw1']:'true').','; + required: '.(isset($requiredrules['pw1'])?$requiredrules['pw1']:'true').','; if (isset($CFG['acct']['passwordFormat'])) { echo 'pattern: '.$CFG['acct']['passwordFormat'].','; } + if (in_array('oldpw', $extrarequired)) { + echo 'notEqual: "#oldpw",'; + } echo 'minlength: '.(isset($CFG['acct']['passwordMinlength'])?$CFG['acct']['passwordMinlength']:6).' }, pw2: { diff --git a/javascript/jquery.validate.min.js b/javascript/jquery.validate.min.js index 44102f91bd..ec1b71c95b 100644 --- a/javascript/jquery.validate.min.js +++ b/javascript/jquery.validate.min.js @@ -18,3 +18,6 @@ $.validator.addMethod( "pattern", function( value, element, param ) { } return isok; }, "Invalid format." ); +$.validator.addMethod("notEqual", function(value, element, param) { + return this.optional(element) || value != $(param).val(); +}, "This has to be different..."); diff --git a/validate.php b/validate.php index ec987db140..dc82951faf 100644 --- a/validate.php +++ b/validate.php @@ -277,7 +277,6 @@ $stm->execute(array(':lastaccess'=>$now, ':id'=>$userid)); } - if (!empty($_SERVER['QUERY_STRING'])) { $querys = '?' . Sanitize::fullQueryString($_SERVER['QUERY_STRING']) . (isset($addtoquerystring) ? '&' . Sanitize::fullQueryString($addtoquerystring) : ''); } else { @@ -326,7 +325,7 @@ //$username = $_COOKIE['username']; $query = "SELECT SID,rights,groupid,LastName,FirstName,deflib"; if (strpos(basename($_SERVER['PHP_SELF']),'upgrade.php')===false) { - $query .= ',listperpage,hasuserimg,theme,specialrights,FCMtoken'; + $query .= ',listperpage,hasuserimg,theme,specialrights,FCMtoken,forcepwreset'; } //DB $query .= " FROM imas_users WHERE id='$userid'"; //DB $result = mysql_query($query) or die("Query failed : " . mysql_error()); @@ -359,6 +358,11 @@ if (isset($sessiondata['userprefs']['usertheme']) && strcmp($sessiondata['userprefs']['usertheme'],'0')!=0) { $coursetheme = $sessiondata['userprefs']['usertheme']; } + + if (!empty($line['forcepwreset']) && (empty($_GET['action']) || $_GET['action']!='forcechgpwd') && (!isset($sessiondata['ltiitemtype']) || $sessiondata['ltirole']!='learner')) { + header('Location: ' . $GLOBALS['basesiteurl'] . '/forms.php?action=forcechgpwd'); + exit; + } $basephysicaldir = rtrim(dirname(__FILE__), '/\\'); if ($myrights==100 && (isset($_GET['debug']) || isset($sessiondata['debugmode']))) {