From 851ca7fae53e5afbb89472c03c9072aec7eb0f68 Mon Sep 17 00:00:00 2001
From: Marcus Hill <bcf8c9f2@opayq.com>
Date: Sat, 1 Oct 2022 19:32:40 +0100
Subject: [PATCH] Always set a random password for new portal users. This isn't
 an issue at the moment as we don't allow logins with empty passwords but
 better to be safe.

---
 portal/login_reset.php | 1 +
 post.php               | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)
 create mode 100644 portal/login_reset.php

diff --git a/portal/login_reset.php b/portal/login_reset.php
new file mode 100644
index 00000000..b3d9bbc7
--- /dev/null
+++ b/portal/login_reset.php
@@ -0,0 +1 @@
+<?php
diff --git a/post.php b/post.php
index cf3c3ae9..af6755e9 100644
--- a/post.php
+++ b/post.php
@@ -3913,17 +3913,18 @@ if(isset($_POST['add_contact'])){
     $notes = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['notes'])));
     $location_id = intval($_POST['location']);
     $auth_method = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['auth_method'])));
+    $password = password_hash(keygen(), PASSWORD_DEFAULT);
 
 
   if(!file_exists("uploads/clients/$session_company_id/$client_id")) {
         mkdir("uploads/clients/$session_company_id/$client_id");
     }
 
-    mysqli_query($mysqli,"INSERT INTO contacts SET contact_name = '$name', contact_title = '$title', contact_phone = '$phone', contact_extension = '$extension', contact_mobile = '$mobile', contact_email = '$email', contact_notes = '$notes', contact_auth_method = '$auth_method', contact_department = '$department', contact_location_id = $location_id, contact_client_id = $client_id, company_id = $session_company_id");
+    mysqli_query($mysqli,"INSERT INTO contacts SET contact_name = '$name', contact_title = '$title', contact_phone = '$phone', contact_extension = '$extension', contact_mobile = '$mobile', contact_email = '$email', contact_notes = '$notes', contact_auth_method = '$auth_method', contact_password_hash = '$password', contact_department = '$department', contact_location_id = $location_id, contact_client_id = $client_id, company_id = $session_company_id");
 
     $contact_id = mysqli_insert_id($mysqli);
 
-    //Update Primay contact in clients if primary contact is checked
+    //Update Primary contact in clients if primary contact is checked
     if($primary_contact > 0){   
         mysqli_query($mysqli,"UPDATE clients SET primary_contact = $contact_id WHERE client_id = $client_id");
     }