exit_document ("<success request=\"$reason\"></success>");
}
+function success_changepass ($username) {
+ $res = "<success request=\"changepass\"><user>" .
+ htmlspecialchars ($username) .
+ "</user></success>";
+ exit_document ($res);
+}
+
function success_newuser ($username) {
$res = "<success request=\"newuser\"><user>" .
- htmlspecialchars ($user) .
+ htmlspecialchars ($username) .
"</user></success>";
exit_document ($res);
}
error ("server");
}
+function error_wrongpass () {
+ error ("wrongpass");
+}
+
function error_unauthorized () {
error ("unauthorized");
}
return null;
}
+function setcookies ($user, $pwd) {
+ // cookie will be valid for 2 weeks. I've chosen that value
+ // arbitrarily, and it may change in the future.
+ $time = time () + 14 * 60 * 24 * 60;
+ setcookie (sprintf ("%sauth", DBPREFIX), md5 ($pwd), $time, "" , "", false, true);
+ setcookie (sprintf ("%suser", DBPREFIX), $user, $time, "" , "", false, true);
+}
+
function check_auth ($con, $user, $pwd, $auth_only) {
$authentificated = false;
if (isset ($pwd)) {
if ($con->checkpwdmd5 ($user, md5 ($pwd))) {
- // cookie will be valid for 2 weeks. I've chosen that value
- // arbitrarily, and it may change in the future.
- $time = time () + 14 * 60 * 24 * 60;
- setcookie (sprintf ("%sauth", DBPREFIX), md5 ($pwd), $time, "" , "", false, true);
- setcookie (sprintf ("%suser", DBPREFIX), $user, $time, "" , "", false, true);
+ setcookies ($user, $pwd);
$authentificated = true;
if ($auth_only) {
success_auth ($user);
} catch (Exception $e) {}
success_delete_feature ($feature);
+ case "changepass":
+ $currpass = unquote ($_POST ["pass_current"]);
+ if (!$con->checkpwdmd5 ($user, md5 ($currpass))) {
+ error_wrongpass ();
+ }
+ $newpass = unquote ($_POST ["pass_new"]);
+ try {
+ $con->setpwd ($user, $newpass);
+ } catch (Exception $e) {
+ error_server ();
+ }
+ setcookies ($user, $newpass);
+ success_changepass ($user);
+ break;
case "newuser":
if ($user != "admin") {
error_unauthorized ();
if (!$newuser_name) {
error_request ();
}
+ if ($con->user_exists ($newuser_name)) {
+ error_newuser_exists ();
+ }
$newuser_password = unquote ($_POST ["newuser_password"]);
try {
- $con->setpwd ($newuser_name, $newuser_password, false);
+ $con->setpwd ($newuser_name, $newuser_password);
} catch (Exception $e) {
- if ($e->getMessage () == anydbConnection::err_query) {
- error_newuser_exists ();
- } else {
- error_server ();
- }
+ error_server ();
}
success_newuser ($newuser_name);
break;