albert/Zeszyt_2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

dodanie csrf, oauth 2, dockerfile

Browse Source
This commit is contained in:
Marcin Cieślikowski
2026-03-16 10:43:19 +01:00
parent 56c7ecff6d
commit 9023b9a5ed
26 changed files with 872 additions and 274 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/change_password.php
+13 -11
View File
@@ -5,25 +5,26 @@ checkAuth();
$message = '';
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$old_pass = $_POST['old_password'];
$new_pass = $_POST['new_password'];
$confirm_pass = $_POST['confirm_password'];
if ($_SERVER["REQUEST_METHOD"] === "POST") {
requireCsrfToken();
$old_pass = $_POST['old_password'] ?? '';
$new_pass = $_POST['new_password'] ?? '';
$confirm_pass = $_POST['confirm_password'] ?? '';
if ($new_pass !== $confirm_pass) {
$message = '<div class="alert alert-danger">Nowe hasła nie są identyczne!</div>';
$message = '<div class="alert alert-danger">Nowe hasła nie są identyczne.</div>';
} else {
// Pobierz aktualne hasło z bazy
$stmt = $pdo->prepare("SELECT password FROM " . DB_PREFIX . "users WHERE id = ?");
$stmt->execute([$_SESSION['user_id']]);
$user = $stmt->fetch();
if (password_verify($old_pass, $user['password'])) {
// Hasło poprawne - aktualizujemy
if ($user && password_verify($old_pass, $user['password'])) {
$new_hash = password_hash($new_pass, PASSWORD_BCRYPT);
$update = $pdo->prepare("UPDATE " . DB_PREFIX . "users SET password = ? WHERE id = ?");
$update->execute([$new_hash, $_SESSION['user_id']]);
$message = '<div class="alert alert-success">Hasło zostało zmienione pomyślnie!</div>';
session_regenerate_id(true);
$message = '<div class="alert alert-success">Hasło zostało zmienione pomyślnie.</div>';
} else {
$message = '<div class="alert alert-danger">Obecne hasło jest nieprawidłowe.</div>';
}
@@ -35,7 +36,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
<html lang="pl">
<head>
<meta charset="UTF-8">
<title>Zmiana hasła - <?php echo APP_NAME; ?></title>
<title>Zmiana hasła - <?php echo e(APP_NAME); ?></title>
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light">
@@ -47,6 +48,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
<div class="card-body">
<?php echo $message; ?>
<form method="POST">
<?php echo csrfInput(); ?>
<div class="mb-3">
<label class="form-label">Obecne hasło</label>
<input type="password" name="old_password" class="form-control" required>
@@ -54,7 +56,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
<hr>
<div class="mb-3">
<label class="form-label">Nowe hasło</label>
<input type="password" name="new_password" class="form-control" required minlength="5">
<input type="password" name="new_password" class="form-control" required minlength="8">
</div>
<div class="mb-3">
<label class="form-label">Powtórz nowe hasło</label>