albert/Zeszyt_2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

dodanie csrf, oauth 2, dockerfile

Browse Source
This commit is contained in:
Marcin Cieślikowski
2026-03-16 10:43:19 +01:00
parent 56c7ecff6d
commit df448ea7c1
26 changed files with 916 additions and 318 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/change_password.php
+20 -18
View File
@@ -5,27 +5,28 @@ checkAuth();
$message = '';
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$old_pass = $_POST['old_password'];
$new_pass = $_POST['new_password'];
$confirm_pass = $_POST['confirm_password'];
if ($_SERVER["REQUEST_METHOD"] === "POST") {
requireCsrfToken();
$old_pass = $_POST['old_password'] ?? '';
$new_pass = $_POST['new_password'] ?? '';
$confirm_pass = $_POST['confirm_password'] ?? '';
if ($new_pass !== $confirm_pass) {
$message = '<div class="alert alert-danger">Nowe hasła nie są identyczne!</div>';
$message = '<div class="alert alert-danger">Nowe hasla nie sa identyczne.</div>';
} else {
// Pobierz aktualne hasło z bazy
$stmt = $pdo->prepare("SELECT password FROM " . DB_PREFIX . "users WHERE id = ?");
$stmt->execute([$_SESSION['user_id']]);
$user = $stmt->fetch();
if (password_verify($old_pass, $user['password'])) {
// Hasło poprawne - aktualizujemy
if ($user && password_verify($old_pass, $user['password'])) {
$new_hash = password_hash($new_pass, PASSWORD_BCRYPT);
$update = $pdo->prepare("UPDATE " . DB_PREFIX . "users SET password = ? WHERE id = ?");
$update->execute([$new_hash, $_SESSION['user_id']]);
$message = '<div class="alert alert-success">Hasło zostało zmienione pomyślnie!</div>';
session_regenerate_id(true);
$message = '<div class="alert alert-success">Haslo zostalo zmienione pomyslnie.</div>';
} else {
$message = '<div class="alert alert-danger">Obecne hasło jest nieprawidłowe.</div>';
$message = '<div class="alert alert-danger">Obecne haslo jest nieprawidlowe.</div>';
}
}
}
@@ -35,34 +36,35 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
<html lang="pl">
<head>
<meta charset="UTF-8">
<title>Zmiana hasła - <?php echo APP_NAME; ?></title>
<title>Zmiana hasla - <?php echo e(APP_NAME); ?></title>
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light">
<div class="container py-5">
<div class="card shadow mx-auto" style="max-width: 450px;">
<div class="card-header bg-dark text-white">
<h5 class="mb-0">Zmiana hasła</h5>
<h5 class="mb-0">Zmiana hasla</h5>
</div>
<div class="card-body">
<?php echo $message; ?>
<form method="POST">
<?php echo csrfInput(); ?>
<div class="mb-3">
<label class="form-label">Obecne hasło</label>
<label class="form-label">Obecne haslo</label>
<input type="password" name="old_password" class="form-control" required>
</div>
<hr>
<div class="mb-3">
<label class="form-label">Nowe hasło</label>
<input type="password" name="new_password" class="form-control" required minlength="5">
<label class="form-label">Nowe haslo</label>
<input type="password" name="new_password" class="form-control" required minlength="8">
</div>
<div class="mb-3">
<label class="form-label">Powtórz nowe hasło</label>
<label class="form-label">Powtorz nowe haslo</label>
<input type="password" name="confirm_password" class="form-control" required>
</div>
<div class="d-flex justify-content-between">
<a href="index.php" class="btn btn-secondary">Powrót</a>
<button type="submit" class="btn btn-primary">Zmień hasło</button>
<a href="index.php" class="btn btn-secondary">Powrot</a>
<button type="submit" class="btn btn-primary">Zmien haslo</button>
</div>
</form>
</div>