From f29bb8688c02325196d7d5bd03fc528414f3055f Mon Sep 17 00:00:00 2001
From: vincent-peugnet <v.peugnet@free.fr>
Date: Thu, 9 Apr 2020 20:19:37 +0200
Subject: connect using user and password close #70

---
 app/class/Controllerconnect.php   |  4 ++--
 app/class/Controlleruser.php      |  4 ++--
 app/class/Modeluser.php           | 27 ++++++---------------------
 app/view/templates/backtopbar.php |  3 ++-
 app/view/templates/connect.php    |  4 +++-
 5 files changed, 15 insertions(+), 27 deletions(-)

(limited to 'app')

diff --git a/app/class/Controllerconnect.php b/app/class/Controllerconnect.php
index e9af86a..8555e92 100644
--- a/app/class/Controllerconnect.php
+++ b/app/class/Controllerconnect.php
@@ -36,8 +36,8 @@ class Controllerconnect extends Controller
 
     public function login($route, $id = null)
     {
-        if (isset($_POST['pass'])) {
-            $this->user = $this->usermanager->passwordcheck($_POST['pass']);
+        if (!empty($_POST['pass']) && !empty($_POST['user'])) {
+            $this->user = $this->usermanager->passwordcheck($_POST['user'], $_POST['pass']);
             if ($this->user != false) {
                 if ($this->user->expiredate() === false || $this->user->level() === 10 || $this->user->expiredate('date') > $this->now) {
                     $this->user->connectcounter();
diff --git a/app/class/Controlleruser.php b/app/class/Controlleruser.php
index 0ec8092..b148f5b 100644
--- a/app/class/Controlleruser.php
+++ b/app/class/Controlleruser.php
@@ -50,7 +50,7 @@ class Controlleruser extends Controller
             $user = new User($_POST);
             if(empty($user->id()) || $this->usermanager->get($user)) {
                 $this->routedirectget('user', ['error' => 'wrong_id']);
-            } elseif(empty($user->password()) || $this->usermanager->passwordexist($user->password()) || !$user->validpassword()) {
+            } elseif(empty($user->password()) || !$user->validpassword()) {
                 $this->routedirectget('user', ['error' => 'change_password']);
             } else {
                 if($user->passwordhashed()) {
@@ -102,7 +102,7 @@ class Controlleruser extends Controller
                     $userupdate->hydrate($_POST);
                     if(empty($userupdate->id())) {
                         $this->routedirectget('user', ['error' => 'wrong_id']);
-                    } elseif (!empty($_POST['password']) && (empty($userupdate->password())  || $this->usermanager->passwordexist($userupdate->password()) || !$userupdate->validpassword())) {
+                    } elseif (!empty($_POST['password']) && (empty($userupdate->password())  || !$userupdate->validpassword())) {
                         $this->routedirectget('user', ['error' => 'password_unvalid']);
                     } elseif (empty($userupdate->level())) {
                         $this->routedirectget('user', ['error' => 'wrong_level']);
diff --git a/app/class/Modeluser.php b/app/class/Modeluser.php
index 9ee04ba..3f459b2 100644
--- a/app/class/Modeluser.php
+++ b/app/class/Modeluser.php
@@ -126,14 +126,15 @@ class Modeluser extends Modeldb
     /**
      * Check if the password is used, and return by who
      * 
+     * @param string $userid user ID
      * @param string $pass password clear
      * 
-     * @return mixed User or false
+     * @return User|bool User or false
      */
-    public function passwordcheck(string $pass)
+    public function passwordcheck(string $userid, string $pass)
     {
-        $userdatalist = $this->getlister();
-        foreach ($userdatalist as $user) {
+        $user = $this->get($userid);
+        if ($user !== false) {
             if ($user->passwordhashed()) {
                 if (password_verify($pass, $user->password())) {
                     return $user;
@@ -141,28 +142,12 @@ class Modeluser extends Modeldb
             } else {
                 if ($user->password() === $pass) {
                     return $user;
-                }
+                }        
             }
         }
         return false;
     }
 
-    /**
-     * Return information if the password is already used or not
-     * 
-     * @param string $pass password clear
-     * 
-     * @return bool password exist or not
-     */
-    public function passwordexist(string $pass) : bool
-    {
-        if ($this->passwordcheck($pass) !== false) {
-            return true;
-        } else {
-            return false;
-        }
-    }
-
     /**
      * @param User $user
      * 
diff --git a/app/view/templates/backtopbar.php b/app/view/templates/backtopbar.php
index 0710c85..597ae6f 100644
--- a/app/view/templates/backtopbar.php
+++ b/app/view/templates/backtopbar.php
@@ -61,7 +61,8 @@ if($user->isadmin()) {
 
 
 <form action="<?= $this->url('log') ?>" method="post" id="connect">
-<input type="password" name="pass" id="loginpass" placeholder="password" autofocus>
+<input type="text" name="user" id="loginuser" autofocus placeholder="user" >
+<input type="password" name="pass" id="loginpass" placeholder="password" >
 <input type="hidden" name="route" value="home">
 <input type="hidden" name="rememberme" value="0">
 <input type="checkbox" name="rememberme" id="rememberme" value="1">
diff --git a/app/view/templates/connect.php b/app/view/templates/connect.php
index 6fd5b14..7f10384 100644
--- a/app/view/templates/connect.php
+++ b/app/view/templates/connect.php
@@ -18,7 +18,9 @@ if(in_array($route, ['pageedit', 'pageread', 'pageread/', 'pageadd'])) {
     echo '<input type="hidden" name="id" value="'. $id .'">';
 }
 ?>
-<input type="password" name="pass" id="loginpass" placeholder="password" autofocus>
+<form action="<?= $this->url('log') ?>" method="post" id="connect">
+<input type="text" name="user" id="loginuser" autofocus placeholder="user" >
+<input type="password" name="pass" id="loginpass" placeholder="password" >
 <input type="hidden" name="rememberme" value="0">
 <input type="checkbox" name="rememberme" id="rememberme" value="1">
 <label for="rememberme">Remember me</label>
-- 
cgit v1.2.3