167 lines
7.1 KiB
PHP
167 lines
7.1 KiB
PHP
<?php
|
|
|
|
// +----------------------------------------------------------------------+
|
|
// | OpenConf |
|
|
// +----------------------------------------------------------------------+
|
|
// | Copyright (c) 2002-2020 Zakon Group LLC. All Rights Reserved. |
|
|
// +----------------------------------------------------------------------+
|
|
// | This source file is subject to the OpenConf License, available on |
|
|
// | the OpenConf web site: www.OpenConf.com |
|
|
// +----------------------------------------------------------------------+
|
|
|
|
require_once "../include.php";
|
|
|
|
beginChairSession();
|
|
|
|
printHeader("Change Password", 1);
|
|
|
|
if (! $OC_configAR['OC_chairChangePassword']) {
|
|
warn('Config settings do not permit ' . OCC_WORD_CHAIR . ' to change password');
|
|
}
|
|
|
|
$mfaAddresses = array(
|
|
'' => 'disabled',
|
|
'$OC_pcemail' => 'Chair Email Address: ' . $OC_configAR['OC_pcemail'],
|
|
'$OC_confirmmail' => 'Notification Address: ' . $OC_configAR['OC_confirmmail']
|
|
);
|
|
if (!empty($OC_configAR['OC_chairMFA']) && !isset($mfaAddresses[$OC_configAR['OC_chairMFA']]) && validEmail($OC_configAR['OC_chairMFA'])) {
|
|
$mfaAddresses[$OC_configAR['OC_chairMFA']] = $OC_configAR['OC_chairMFA'];
|
|
}
|
|
|
|
// setup mfa?
|
|
if (isset($_GET['a']) && ($_GET['a'] == 'mfasetup')) {
|
|
if (
|
|
isset($_GET['c'])
|
|
&& (strlen($_GET['c']) == 32)
|
|
&& preg_match("/^SETUP\|\|([^\|]+)\|\|([^\|]+)$/", $OC_configAR['OC_chairMFAcode'], $matches)
|
|
&& ($_GET['c'] == $matches[1])
|
|
&& isset($mfaAddresses[$matches[2]])
|
|
) {
|
|
updateConfigSetting('OC_chairMFA', $matches[2]) or err('Unable to configure authentication address');
|
|
$OC_configAR['OC_chairMFA'] = $matches[2];
|
|
updateConfigSetting('OC_chairMFAcode', '');
|
|
print '<p style="text-align: center;" class="note2">Authentication Address Set</p>';
|
|
} else {
|
|
print '<p style="text-align: center;" class="warn">Authentication Address verification failed</p>';
|
|
}
|
|
printFooter();
|
|
exit;
|
|
}
|
|
|
|
$e = "";
|
|
if (isset($_POST['submit']) && ($_POST['submit'] == "Submit Changes")) {
|
|
// Check for valid submission
|
|
if (!validToken('chair')) {
|
|
warn('Invalid submission');
|
|
}
|
|
|
|
if (!oc_password_verify($_POST['currpwd'], $OC_configAR['OC_chair_pwd'])) {
|
|
$e = 'Current password is incorrect';
|
|
} else {
|
|
// password change?
|
|
if (isset($_POST['pwd1']) && !empty($_POST['pwd1']) && isset($_POST['pwd2']) && !empty($_POST['pwd2'])) {
|
|
if ($_POST['pwd1'] != $_POST['pwd2']) {
|
|
$e = 'New passwords do not match';
|
|
} elseif ($_POST['pwd1'] == $OC_configAR['OC_chair_uname']) {
|
|
$e = 'Password may not match ' . OCC_WORD_CHAIR . ' username';
|
|
} elseif (oc_strlen($_POST['pwd1']) < 10) {
|
|
$e = 'Password must be 10+ characters long';
|
|
} else {
|
|
updateConfigSetting('OC_chair_pwd', oc_password_hash($_POST['pwd1'])) or err('Unable to change password');
|
|
print '<p style="text-align: center;" class="note">Password has been changed</p>';
|
|
}
|
|
}
|
|
// auth change?
|
|
if (isset($_POST['mfa']) && isset($mfaAddresses[$_POST['mfa']]) && ($_POST['mfa'] != $OC_configAR['OC_chairMFA'])) {
|
|
if ($_POST['mfa'] == '') {
|
|
updateConfigSetting('OC_chairMFA', '') or err('Unable to remove authentication address');
|
|
$OC_configAR['OC_chairMFA'] = '';
|
|
} elseif (preg_match("/^\\\$(?:OC_pcemail|OC_confirmmail)$/", $_POST['mfa'])) {
|
|
$code = oc_idGen(32);
|
|
$link = OCC_BASE_URL . 'chair/set_password.php?a=mfasetup&c=' . urlencode($code);
|
|
if (strlen($code) == 32) {
|
|
ocsql_query("UPDATE `" . OCC_TABLE_CONFIG . "` SET `value`='SETUP||" . safeHTMLstr($code) . '||' . safeHTMLstr($_POST['mfa']) . "' WHERE `module`='OC' AND `setting`='OC_chairMFAcode' LIMIT 1") or err('Unable to set authentication code');
|
|
$subject = $OC_configAR['OC_confName'] . ' Multi-Factor Authentication Setup -- action required';
|
|
$body = 'Hello,
|
|
|
|
A request has been received to setup multi-factor authentication for the ' . $OC_configAR['OC_confName'] . ' ' . OCC_WORD_CHAIR . ' account. In order to complete the request, please click the link below prior to signing out of the account:
|
|
|
|
' . $link . '
|
|
|
|
Thank you
|
|
';
|
|
if (oc_mail($OC_configAR[substr($_POST['mfa'], 1)], $subject, $body)) {
|
|
print '<p style="text-align: center;" class="warn">An email has been sent to the Authentication Address below.<br />Click the link in the email prior to signing out.</p>';
|
|
} else {
|
|
$e .= '<br />Sending of message to complete multi-factor authentication failed';
|
|
}
|
|
} else {
|
|
$e .= '<br />Unable to generate authentication code';
|
|
}
|
|
} else {
|
|
$e .= '<br />Invalid auth setting';
|
|
}
|
|
// to change to a custom email address, use the advanced settings feature
|
|
}
|
|
}
|
|
}
|
|
|
|
if (!empty($e)) {
|
|
print '<p style="text-align: center;" class="warn">' . $e . '</p>';
|
|
}
|
|
|
|
print '
|
|
<br />
|
|
<form method="post" action="' . $_SERVER['PHP_SELF'] . '" class="ocform occonfigform">
|
|
<input type="hidden" name="token" value="' . $_SESSION[OCC_SESSION_VAR_NAME]['chairtoken'] . '" />
|
|
|
|
<fieldset id="oc_fs_pw" role="header">
|
|
<legend onclick="oc_fsToggle(this)">New Password <span>(collapse)</span></legend>
|
|
<div id="oc_fs_pw_div">
|
|
<div class="note" style="margin-bottom: 2em;">Enter your new password twice. May be left blank if only changing multi-factor authentication setting below.</div>
|
|
|
|
<div class="field"><label for="pwd1">New Password:</label><input type="password" size="60" maxlength="250" name="pwd1" id="pwd1" /><div class="fieldnote note">10+ characters</div></div>
|
|
|
|
<div class="field"><label for="pwd1">Confirm New:</label><input type="password" size="60" maxlength="250" name="pwd2" id="pwd2" /></div>
|
|
|
|
</div>
|
|
</fieldset>
|
|
|
|
|
|
<fieldset id="oc_fs_mfa" role="header">
|
|
<legend id="oc_fs_mfa_legend" onclick="oc_fsToggle(this)">Multi-Factor Authentication <span>(collapse)</span></legend>
|
|
<div id="oc_fs_mfa_div">
|
|
<div class="note" style="margin-bottom: 2em;">With an authentication address set, when the Chair enters their username and password a code is sent to the selected address which must be entered to complete the sign in process.</div>
|
|
|
|
<div class="field"><label for="mfa">Authentication Address:</label><select name="mfa" id="mfa">' . generateSelectOptions($mfaAddresses, (!empty($OC_configAR['OC_chairMFA']) ? $OC_configAR['OC_chairMFA'] : 'disabled')) . '</select><div class="fieldnote note">When changing this option to a new address, a message is sent to the address with a link that must be clicked in order to confirm messages are received prior to the new address taking effect; click the link right away and before signing out.</div></div>
|
|
|
|
</div>
|
|
</fieldset>
|
|
|
|
|
|
<fieldset id="oc_fs_submit" role="header">
|
|
<legend onclick="oc_fsToggle(this)">Submit <span>(collapse)</span></legend>
|
|
<div id="oc_fs_submit_div">
|
|
<div class="note" style="margin-bottom: 2em;">Enter your current password and click the Submit Changes button.</div>
|
|
|
|
<div class="field"><label for="currpwd">Current Password:</label><input type="password" size="60" maxlength="250" name="currpwd" id="currpwd" /></div>
|
|
|
|
<input type="submit" name="submit" value="Submit Changes" class="submit" style="margin-left: 200px;" />
|
|
|
|
</div>
|
|
</fieldset>
|
|
|
|
</form>
|
|
';
|
|
|
|
if (empty($OC_configAR['OC_chairMFA'])) {
|
|
print '
|
|
<script>
|
|
oc_fsToggle(document.getElementById("oc_fs_mfa_legend"));
|
|
</script>
|
|
';
|
|
}
|
|
|
|
printFooter();
|
|
?>
|