diff options
Diffstat (limited to 'app/class')
| -rw-r--r-- | app/class/Application.php | 2 | ||||
| -rw-r--r-- | app/class/Controllerconnect.php | 4 | ||||
| -rw-r--r-- | app/class/Controlleruser.php | 7 | ||||
| -rw-r--r-- | app/class/Model.php | 1 | ||||
| -rw-r--r-- | app/class/Modeluser.php | 27 | ||||
| -rw-r--r-- | app/class/User.php | 18 |
6 files changed, 28 insertions, 31 deletions
diff --git a/app/class/Application.php b/app/class/Application.php index 4ddf37e..48d898c 100644 --- a/app/class/Application.php +++ b/app/class/Application.php @@ -129,7 +129,7 @@ class Application <h2> <label for="password">Your password</label> </h2> - <input type="password" name="userinit[password]" id="password" minlength="4" maxlength="64" required> + <input type="password" name="userinit[password]" id="password" minlength="<?= Wcms\Model::PASSWORD_MIN_LENGTH ?>" maxlength="<?= Wcms\Model::PASSWORD_MAX_LENGTH ?>" required> <p><i>Your user passworder as first administrator.</i></p> </div> <input type="submit" value="set"> diff --git a/app/class/Controllerconnect.php b/app/class/Controllerconnect.php index e9af86a..8555e92 100644 --- a/app/class/Controllerconnect.php +++ b/app/class/Controllerconnect.php @@ -36,8 +36,8 @@ class Controllerconnect extends Controller public function login($route, $id = null) { - if (isset($_POST['pass'])) { - $this->user = $this->usermanager->passwordcheck($_POST['pass']); + if (!empty($_POST['pass']) && !empty($_POST['user'])) { + $this->user = $this->usermanager->passwordcheck($_POST['user'], $_POST['pass']); if ($this->user != false) { if ($this->user->expiredate() === false || $this->user->level() === 10 || $this->user->expiredate('date') > $this->now) { $this->user->connectcounter(); diff --git a/app/class/Controlleruser.php b/app/class/Controlleruser.php index 0ec8092..1586679 100644 --- a/app/class/Controlleruser.php +++ b/app/class/Controlleruser.php @@ -33,6 +33,9 @@ class Controlleruser extends Controller if($this->user->iseditor()) { $user = $this->usermanager->get($this->user); $user->hydrate($_POST); + if ($_POST['passwordhash']) { + $user->hashpassword(); + } $this->usermanager->add($user); $this->routedirect('user'); } else { @@ -50,7 +53,7 @@ class Controlleruser extends Controller $user = new User($_POST); if(empty($user->id()) || $this->usermanager->get($user)) { $this->routedirectget('user', ['error' => 'wrong_id']); - } elseif(empty($user->password()) || $this->usermanager->passwordexist($user->password()) || !$user->validpassword()) { + } elseif(empty($user->password()) || !$user->validpassword()) { $this->routedirectget('user', ['error' => 'change_password']); } else { if($user->passwordhashed()) { @@ -102,7 +105,7 @@ class Controlleruser extends Controller $userupdate->hydrate($_POST); if(empty($userupdate->id())) { $this->routedirectget('user', ['error' => 'wrong_id']); - } elseif (!empty($_POST['password']) && (empty($userupdate->password()) || $this->usermanager->passwordexist($userupdate->password()) || !$userupdate->validpassword())) { + } elseif (!empty($_POST['password']) && (empty($userupdate->password()) || !$userupdate->validpassword())) { $this->routedirectget('user', ['error' => 'password_unvalid']); } elseif (empty($userupdate->level())) { $this->routedirectget('user', ['error' => 'wrong_level']); diff --git a/app/class/Model.php b/app/class/Model.php index 6a8f111..1d8d27a 100644 --- a/app/class/Model.php +++ b/app/class/Model.php @@ -88,7 +88,6 @@ abstract class Model const TEXT_ELEMENTS = ['header', 'nav', 'main', 'aside', 'footer']; const MAX_ID_LENGTH = 64; - const PASSWORD_HASH = true; const PASSWORD_MIN_LENGTH = 4; const PASSWORD_MAX_LENGTH = 32; diff --git a/app/class/Modeluser.php b/app/class/Modeluser.php index 9ee04ba..3f459b2 100644 --- a/app/class/Modeluser.php +++ b/app/class/Modeluser.php @@ -126,14 +126,15 @@ class Modeluser extends Modeldb /** * Check if the password is used, and return by who * + * @param string $userid user ID * @param string $pass password clear * - * @return mixed User or false + * @return User|bool User or false */ - public function passwordcheck(string $pass) + public function passwordcheck(string $userid, string $pass) { - $userdatalist = $this->getlister(); - foreach ($userdatalist as $user) { + $user = $this->get($userid); + if ($user !== false) { if ($user->passwordhashed()) { if (password_verify($pass, $user->password())) { return $user; @@ -141,29 +142,13 @@ class Modeluser extends Modeldb } else { if ($user->password() === $pass) { return $user; - } + } } } return false; } /** - * Return information if the password is already used or not - * - * @param string $pass password clear - * - * @return bool password exist or not - */ - public function passwordexist(string $pass) : bool - { - if ($this->passwordcheck($pass) !== false) { - return true; - } else { - return false; - } - } - - /** * @param User $user * * @return bool depending on success diff --git a/app/class/User.php b/app/class/User.php index b735309..518b096 100644 --- a/app/class/User.php +++ b/app/class/User.php @@ -208,11 +208,21 @@ class User extends Item - - public function hashpassword() + /** + * Hash the password and set `$passwordhashed` to true. + * + * @return bool true in cas of success, otherwise false. + */ + public function hashpassword() : bool { - $this->password = password_hash($this->password, PASSWORD_DEFAULT); - $this->passwordhashed = true; + $hashedpassword = password_hash($this->password, PASSWORD_DEFAULT); + if (!empty($hashedpassword)) { + $this->password = $hashedpassword; + $this->passwordhashed = true; + return true; + } else { + return false; + } } public function validpassword() |