X-Git-Url: https://dev.renevier.net/gitweb.cgi?p=syp.git;a=blobdiff_plain;f=api.php;h=fda62ff32389e1a630759a43e5d3643b9b44d29e;hp=af8af1a836a65baef44b819cae3953422d1bb88a;hb=939514b912738c5784b04a0d207db1afd918eb69;hpb=3c74920cb66b4e6c47c7e8a0eaeed40ffb7e8544

diff --git a/api.php b/api.php
index af8af1a..fda62ff 100644
--- a/api.php
+++ b/api.php
@@ -10,9 +10,16 @@ function success ($reason) {
     exit_document ("<success request=\"$reason\"></success>");
 }
 
+function success_changepass ($username) {
+    $res = "<success request=\"changepass\"><user>" .
+            htmlspecialchars ($username) .
+            "</user></success>";
+    exit_document ($res);
+}
+
 function success_newuser ($username) {
     $res = "<success request=\"newuser\"><user>" .
-            htmlspecialchars ($user) .
+            htmlspecialchars ($username) .
             "</user></success>";
     exit_document ($res);
 }
@@ -83,6 +90,10 @@ function error_server () {
     error ("server");
 }
 
+function error_wrongpass () {
+    error ("wrongpass");
+}
+
 function error_unauthorized () {
     error ("unauthorized");
 }
@@ -177,16 +188,20 @@ function unique_file ($dirname, $relpath, $con) {
    return null;
 }
 
+function setcookies ($user, $pwd) {
+    // cookie will be valid for 2 weeks. I've chosen that value
+    // arbitrarily, and it may change in the future.
+    $time = time () + 14 * 60 * 24 * 60;
+    setcookie (sprintf ("%sauth", DBPREFIX), md5 ($pwd), $time, "" , "", false, true);
+    setcookie (sprintf ("%suser", DBPREFIX), $user, $time, "" , "", false, true);
+}
+
 function check_auth ($con, $user, $pwd, $auth_only) {
     $authentificated = false;
 
     if (isset ($pwd)) {
         if ($con->checkpwdmd5 ($user, md5 ($pwd))) {
-            // cookie will be valid for 2 weeks. I've chosen that value
-            // arbitrarily, and it may change in the future.
-            $time = time () + 14 * 60 * 24 * 60;
-            setcookie (sprintf ("%sauth", DBPREFIX), md5 ($pwd), $time, "" , "", false, true);
-            setcookie (sprintf ("%suser", DBPREFIX), $user, $time, "" , "", false, true);
+            setcookies ($user, $pwd);
             $authentificated = true;
             if ($auth_only) {
                 success_auth ($user);
@@ -313,6 +328,20 @@ function main ($con) {
             } catch (Exception $e) {}
 
             success_delete_feature ($feature);
+        case "changepass":
+            $currpass = unquote ($_POST ["pass_current"]);
+            if (!$con->checkpwdmd5 ($user, md5 ($currpass))) {
+                error_wrongpass ();
+            }
+            $newpass = unquote ($_POST ["pass_new"]);
+            try {
+                $con->setpwd ($user, $newpass);
+            } catch (Exception $e) {
+                error_server ();
+            }
+            setcookies ($user, $newpass);
+            success_changepass ($user);
+        break;
         case "newuser":
             if ($user != "admin") {
                 error_unauthorized ();
@@ -321,15 +350,14 @@ function main ($con) {
             if (!$newuser_name) {
                 error_request ();
             }
+            if ($con->user_exists ($newuser_name)) {
+                error_newuser_exists ();
+            }
             $newuser_password = unquote ($_POST ["newuser_password"]);
             try {
-                $con->setpwd ($newuser_name, $newuser_password, false);
+                $con->setpwd ($newuser_name, $newuser_password);
             } catch (Exception $e) {
-                if ($e->getMessage () == anydbConnection::err_query) {
-                    error_newuser_exists ();
-                } else {
-                    error_server ();
-                }
+                error_server ();
             }
             success_newuser ($newuser_name);
         break;