mirror of
https://github.com/itflow-org/itflow
synced 2026-11-14 16:37:23 +00:00
203 lines
10 KiB
PHP
203 lines
10 KiB
PHP
<?php
|
|
/*
|
|
* Client Portal
|
|
* Setting a password from a link - Forgot password, and the invite a primary
|
|
* contact or an agent sends - and asking for a Forgot password link.
|
|
*
|
|
* A link is ?email=&token=&client=. Only the token's SHA-256 is kept, and it
|
|
* runs out: an hour for Forgot password, a week for an invite
|
|
* (functions/portal.php). Using it spends it. Asking for a link always says
|
|
* the same thing, whether or not the address has an account, and sends at
|
|
* most one per account every PORTAL_RESET_REQUEST_GAP_MINUTES.
|
|
*/
|
|
|
|
header("Content-Security-Policy: default-src 'self'; img-src 'self' data:");
|
|
header("X-Frame-Options: DENY");
|
|
|
|
require_once '../config.php';
|
|
require_once '../functions.php';
|
|
require_once '../includes/load_global_settings.php';
|
|
|
|
if (intval($config_client_portal_enable) !== 1) {
|
|
header("Location: /login.php");
|
|
exit();
|
|
}
|
|
|
|
require_once __DIR__ . "/../includes/session_init.php";
|
|
require_once "../includes/inc_set_timezone.php";
|
|
|
|
$ip = escapeSql(getIP());
|
|
$user_agent = escapeSql($_SERVER['HTTP_USER_AGENT'] ?? '');
|
|
$can_email = portalMailReady();
|
|
|
|
$company = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT company_name, company_logo FROM companies WHERE company_id = 1"));
|
|
$company_name = (string) ($company['company_name'] ?? '');
|
|
|
|
$message = '';
|
|
$message_type = 'danger';
|
|
$link_user = null;
|
|
$link = ['email' => '', 'token' => '', 'client' => 0];
|
|
|
|
/** A row in the log for a password link - $user_id 0 when the address has no account. */
|
|
$reset_log = function ($action, $description, $user_id, $client_id) use ($mysqli, $ip, $user_agent) {
|
|
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Client Login', log_action = '" . escapeSql($action) . "', log_description = '" . escapeSql($description) . "',
|
|
log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = " . intval($client_id) . ", log_user_id = " . intval($user_id));
|
|
};
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['password_reset_email_request']) && $can_email) {
|
|
|
|
$email = trim((string) ($_POST['email'] ?? ''));
|
|
|
|
// From one address, ten asks in ten minutes is plenty - after that, nothing is sent
|
|
$asked = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM logs WHERE log_type = 'Client Login' AND log_action = 'Reset Requested'
|
|
AND log_ip = '$ip' AND log_created_at > NOW() - INTERVAL 10 MINUTE"))[0]);
|
|
|
|
$row = null;
|
|
if ($asked < 10 && filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
|
$email_sql = escapeSql($email);
|
|
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_id, user_email, contact_name, contact_client_id FROM users
|
|
JOIN contacts ON contact_user_id = user_id
|
|
JOIN clients ON client_id = contact_client_id
|
|
WHERE user_email = '$email_sql' AND user_type = 2 AND user_auth_method = 'local' AND user_status = 1 AND user_archived_at IS NULL
|
|
AND contact_archived_at IS NULL AND client_archived_at IS NULL
|
|
LIMIT 1"));
|
|
}
|
|
$reset_log('Reset Requested', 'Asked for a portal password link for ' . mb_substr($email, 0, 200), intval($row['user_id'] ?? 0), intval($row['contact_client_id'] ?? 0));
|
|
|
|
if ($row) {
|
|
$user_id = intval($row['user_id']);
|
|
$recent = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM logs WHERE log_type = 'Client Login' AND log_action = 'Reset Sent'
|
|
AND log_user_id = $user_id AND log_created_at > NOW() - INTERVAL " . PORTAL_RESET_REQUEST_GAP_MINUTES . " MINUTE"))[0]);
|
|
if (!$recent) {
|
|
portalMailPasswordReset($user_id);
|
|
$reset_log('Reset Sent', 'Emailed a portal password link to ' . $row['user_email'], $user_id, intval($row['contact_client_id']));
|
|
}
|
|
}
|
|
|
|
$message = "If there is a client portal account for that address, a link to reset its password is on its way. It works for " . PORTAL_RESET_LINK_MINUTES . " minutes.";
|
|
$message_type = 'success';
|
|
|
|
} elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['password_reset_set_password'])) {
|
|
|
|
$link = ['email' => (string) ($_POST['email'] ?? ''), 'token' => (string) ($_POST['token'] ?? ''), 'client' => intval($_POST['client'] ?? 0)];
|
|
$link_user = portalPasswordLinkUser($link['email'], $link['token'], $link['client']);
|
|
$password = (string) ($_POST['new_password'] ?? '');
|
|
|
|
if (!$link_user) {
|
|
$message = 'That link has run out or has been used already. Ask for a new one below.';
|
|
} elseif (($problem = userPasswordProblem($password)) !== '') {
|
|
$message = $problem;
|
|
} elseif ($password !== (string) ($_POST['confirm_password'] ?? '')) {
|
|
$message = 'The two passwords are not the same - type it again in both.';
|
|
} else {
|
|
$user_id = intval($link_user['user_id']);
|
|
$hash = escapeSql(password_hash($password, PASSWORD_DEFAULT));
|
|
mysqli_query($mysqli, "UPDATE users SET user_password = '$hash' WHERE user_id = $user_id AND user_type = 2");
|
|
portalPasswordLinkClear($user_id);
|
|
$reset_log('Password Reset', 'Set a new portal password from an emailed link', $user_id, $link['client']);
|
|
portalMailAccountChange($link_user['user_email'], $link_user['contact_name'], 'password_link');
|
|
$_SESSION['login_message'] = 'Your password is set - sign in with it below.';
|
|
$_SESSION['login_message_type'] = 'success';
|
|
header("Location: /login.php");
|
|
exit();
|
|
}
|
|
|
|
} elseif (isset($_GET['token'])) {
|
|
|
|
$link = ['email' => (string) ($_GET['email'] ?? ''), 'token' => (string) $_GET['token'], 'client' => intval($_GET['client'] ?? 0)];
|
|
$link_user = portalPasswordLinkUser($link['email'], $link['token'], $link['client']);
|
|
if (!$link_user) {
|
|
$message = 'That link has run out or has been used already.' . ($can_email ? ' Ask for a new one below.' : ' Ask us for a new one.');
|
|
}
|
|
}
|
|
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html lang="en" data-bs-theme="light" data-lte-color-mode="off">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title><?= escapeHtml($company_name) ?> | <?= $link_user ? 'Set your password' : 'Reset your password' ?></title>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<meta name="robots" content="noindex">
|
|
<link rel="stylesheet" href="/libs/fontawesome-free/css/all.min.css">
|
|
<?php if (file_exists(__DIR__ . '/../uploads/favicon.ico')) { ?>
|
|
<link rel="icon" type="image/x-icon" href="/uploads/favicon.ico">
|
|
<?php } ?>
|
|
<link rel="stylesheet" href="/libs/adminlte/css/adminlte.min.css">
|
|
<link rel="stylesheet" href="/css/itflow_custom.css">
|
|
</head>
|
|
<body class="hold-transition login-page">
|
|
|
|
<div class="login-box">
|
|
<div class="login-logo">
|
|
<?php if (!empty($company['company_logo'])) { ?>
|
|
<img alt="<?= escapeHtml($company_name) ?> logo" height="110" width="380" class="img-fluid" src="/uploads/settings/<?= escapeHtml($company['company_logo']) ?>">
|
|
<?php } else { ?>
|
|
<span class="fw-semibold"><?= escapeHtml($company_name) ?></span>
|
|
<?php } ?>
|
|
</div>
|
|
|
|
<div class="card">
|
|
<div class="card-body login-card-body">
|
|
|
|
<?php if ($link_user) { ?>
|
|
|
|
<h1 class="h5 mb-1">Set your password</h1>
|
|
<p class="text-body-secondary small mb-3">For <?= escapeHtml($link_user['user_email']) ?> - at least <?= USER_PASSWORD_MIN ?> characters.</p>
|
|
|
|
<?php if ($message !== '') { ?>
|
|
<div class="alert alert-<?= $message_type ?> small"><?= escapeHtml($message) ?></div>
|
|
<?php } ?>
|
|
|
|
<form method="post" autocomplete="off">
|
|
<input type="hidden" name="email" value="<?= escapeHtml($link['email']) ?>">
|
|
<input type="hidden" name="token" value="<?= escapeHtml($link['token']) ?>">
|
|
<input type="hidden" name="client" value="<?= intval($link['client']) ?>">
|
|
<input type="text" class="d-none" name="username" value="<?= escapeHtml($link_user['user_email']) ?>" autocomplete="username" aria-hidden="true" tabindex="-1">
|
|
|
|
<div class="input-group mb-3">
|
|
<span class="input-group-text"><i class="fas fa-fw fa-lock"></i></span>
|
|
<input type="password" class="form-control" placeholder="New password" name="new_password" minlength="<?= USER_PASSWORD_MIN ?>" autocomplete="new-password" aria-label="New password" required autofocus>
|
|
</div>
|
|
<div class="input-group mb-3">
|
|
<span class="input-group-text"><i class="fas fa-fw fa-check-double"></i></span>
|
|
<input type="password" class="form-control" placeholder="The same again" name="confirm_password" minlength="<?= USER_PASSWORD_MIN ?>" autocomplete="new-password" aria-label="New password again" required>
|
|
</div>
|
|
|
|
<button type="submit" class="btn btn-primary w-100 mb-3" name="password_reset_set_password">Set password</button>
|
|
</form>
|
|
|
|
<?php } else { ?>
|
|
|
|
<h1 class="h5 mb-1">Reset your password</h1>
|
|
<p class="text-body-secondary small mb-3">For the client portal. Enter the email address you sign in with and we will email you a link.</p>
|
|
|
|
<?php if ($message !== '') { ?>
|
|
<div class="alert alert-<?= $message_type ?> small"><?= escapeHtml($message) ?></div>
|
|
<?php } ?>
|
|
|
|
<?php if ($can_email) { ?>
|
|
<form method="post" autocomplete="off">
|
|
<div class="input-group mb-3">
|
|
<span class="input-group-text"><i class="fas fa-fw fa-envelope"></i></span>
|
|
<input type="email" class="form-control" placeholder="Email address" name="email" maxlength="200" autocomplete="email" aria-label="Email address" required<?= $message_type === 'success' ? '' : ' autofocus' ?>>
|
|
</div>
|
|
<button type="submit" class="btn btn-primary w-100 mb-3" name="password_reset_email_request">Email me a link</button>
|
|
</form>
|
|
<?php } else { ?>
|
|
<div class="alert alert-secondary small">Email is not set up here, so a link can't be sent - ask us to reset it for you.</div>
|
|
<?php } ?>
|
|
|
|
<?php } ?>
|
|
|
|
<a href="/login.php"><i class="fas fa-arrow-left me-1"></i>Back to sign in</a>
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<script src="/js/login_prevent_resubmit.js"></script>
|
|
|
|
</body>
|
|
</html>
|