ZaneYork
/
zoneminder
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rework user saving action to use User object. Implement a duplicate username check. Deprecate php < 5.3 due to lack of bcrypt password hashing functions. Hence deprecate the use of mysql PASSWORD()

This commit is contained in:
Isaac Connor 2021-03-21 09:18:12 -04:00
parent 8a1d13b6cd
commit d0adaeaabe
1 changed files with 48 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

101
web/includes/actions/user.php
View File

@ -18,77 +18,72 @@
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. // Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
// //
if ( $action == 'Save' ) { global $error_message;
if ( canEdit('System') ) {
if ( !empty($_REQUEST['uid']) ) {
$dbUser = dbFetchOne('SELECT * FROM Users WHERE Id=?', NULL, array($_REQUEST['uid']));
} else {
$dbUser = array();
}
$types = array(); if ($action == 'Save') {
if ( isset($_REQUEST['newUser']['MonitorIds']) and is_array($_REQUEST['newUser']['MonitorIds']) ) require_once('includes/User.php');
$uid = isset($_REQUEST['uid']) ? validInt($_REQUEST['uid']) : 0;
$dbUser = new ZM\User($uid);
if (canEdit('System')) {
# Need to check for uniqueness of Username
$user_with_my_username = ZM\User::find_one(array('Username'=>$_REQUEST['newUser']['Username']));
if ($user_with_my_username and
( ( $uid and ($user_with_my_username->Id() != $uid) ) or !$uid)
) {
$error_message = 'There already exists a user with this Username<br/>';
unset($_REQUEST['redirect']);
return;
}
# What other tests should we do?
if (isset($_REQUEST['newUser']['MonitorIds']) and is_array($_REQUEST['newUser']['MonitorIds']))
$_REQUEST['newUser']['MonitorIds'] = implode(',', $_REQUEST['newUser']['MonitorIds']); $_REQUEST['newUser']['MonitorIds'] = implode(',', $_REQUEST['newUser']['MonitorIds']);
if ( !$_REQUEST['newUser']['Password'] ) if (!empty($_REQUEST['newUser']['Password'])) {
$_REQUEST['newUser']['Password'] = password_hash($_REQUEST['newUser']['Password'], PASSWORD_BCRYPT);
} else {
unset($_REQUEST['newUser']['Password']); unset($_REQUEST['newUser']['Password']);
$changes = getFormChanges($dbUser, $_REQUEST['newUser'], $types);
if ( isset($_REQUEST['newUser']['Password']) ) {
if ( function_exists('password_hash') ) {
$pass_hash = '"'.password_hash($_REQUEST['newUser']['Password'], PASSWORD_BCRYPT).'"';
} else {
$pass_hash = ' PASSWORD('.dbEscape($_REQUEST['newUser']['Password']).') ';
ZM\Info('Cannot use bcrypt as you are using PHP < 5.3');
}
if ( $_REQUEST['newUser']['Password'] ) {
$changes['Password'] = 'Password = '.$pass_hash;
} else {
unset($changes['Password']);
}
} }
$changes = $dbUser->changes($_REQUEST['newUser']);
ZM\Debug("Changes: " . print_r($changes, true));
if ( count($changes) ) { if (count($changes)) {
if ( !empty($_REQUEST['uid']) ) { if (!$dbUser->save($changes)) {
dbQuery('UPDATE Users SET '.implode(', ', $changes).' WHERE Id = ?', array($_REQUEST['uid'])); $error_message = $dbUser->get_last_error();
# If we are updating the logged in user, then update our session user data. unset($_REQUEST['redirect']);
if ( $user and ( $dbUser['Username'] == $user['Username'] ) ) { return;
}
if ($uid) {
if ($user and ($dbUser->Username() == $user['Username'])) {
# We are the logged in user, need to update the $user object and generate a new auth_hash # We are the logged in user, need to update the $user object and generate a new auth_hash
$sql = 'SELECT * FROM Users WHERE Enabled=1 AND Id=?'; $sql = 'SELECT * FROM Users WHERE Enabled=1 AND Id=?';
$user = dbFetchOne($sql, NULL, array($_REQUEST['uid'])); $user = dbFetchOne($sql, NULL, array($uid));
# Have to update auth hash in session # Have to update auth hash in session
zm_session_start(); zm_session_start();
generateAuthHash(ZM_AUTH_HASH_IPS, true); generateAuthHash(ZM_AUTH_HASH_IPS, true);
session_write_close(); session_write_close();
} }
} else {
dbQuery('INSERT INTO Users SET '.implode(', ', $changes));
} }
} # end if changes } # end if changes
} else if ( ZM_USER_SELF_EDIT and ( $_REQUEST['uid'] == $user['Id'] ) ) { } else if (ZM_USER_SELF_EDIT and ($uid == $user['Id'])) {
$uid = $user['Id']; if (!empty($_REQUEST['newUser']['Password'])) {
$_REQUEST['newUser']['Password'] = password_hash($_REQUEST['newUser']['Password'], PASSWORD_BCRYPT);
$dbUser = dbFetchOne('SELECT Id, Password, Language FROM Users WHERE Id = ?', NULL, array($uid));
$types = array();
$changes = getFormChanges($dbUser, $_REQUEST['newUser'], $types);
if ( function_exists('password_hash') ) {
$pass_hash = '"'.password_hash($_REQUEST['newUser']['Password'], PASSWORD_BCRYPT).'"';
} else { } else {
$pass_hash = ' PASSWORD('.dbEscape($_REQUEST['newUser']['Password']).') '; unset($_REQUEST['newUser']['Password']);
ZM\Info ('Cannot use bcrypt as you are using PHP < 5.3');
} }
$fields = array('Password'=>'', 'Language'=>'', 'HomeView'=>'');
ZM\Debug("changes: ".print_r(array_intersect_key($_REQUEST['newUser'], $fields),true));
$changes = $dbUser->changes(array_intersect_key($_REQUEST['newUser'], $fields));
ZM\Debug("changes: ".print_r($changes, true));
if ( !empty($_REQUEST['newUser']['Password']) ) { if (count($changes)) {
$changes['Password'] = 'Password = '.$pass_hash; if (!$dbUser->save($changes)) {
} else { $error_message = $dbUser->get_last_error();
unset($changes['Password']); unset($_REQUEST['redirect']);
} return;
if ( count($changes) ) { }
dbQuery('UPDATE Users SET '.implode(', ', $changes).' WHERE Id=?', array($uid));
# We are the logged in user, need to update the $user object and generate a new auth_hash # We are the logged in user, need to update the $user object and generate a new auth_hash
$sql = 'SELECT * FROM Users WHERE Enabled=1 AND Id=?'; $sql = 'SELECT * FROM Users WHERE Enabled=1 AND Id=?';