diff --git a/assets/modul-js/reset-password.js b/assets/modul-js/reset-password.js new file mode 100644 index 0000000..be6cf27 --- /dev/null +++ b/assets/modul-js/reset-password.js @@ -0,0 +1,110 @@ +/* Hotjar */ +(function(h,o,t,j,a,r){ + h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)}; + h._hjSettings={hjid:807847,hjsv:6}; + a=o.getElementsByTagName('head')[0]; + r=o.createElement('script');r.async=1; + r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv; + a.appendChild(r); +})(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv='); + + +/* Drift */ +!function() { +var t; +if (t = window.driftt = window.drift = window.driftt || [], !t.init) return t.invoked ? void (window.console && console.error && console.error("Drift snippet included twice.")) : (t.invoked = !0, +t.methods = [ "identify", "config", "track", "reset", "debug", "show", "ping", "page", "hide", "off", "on" ], +t.factory = function(e) { + return function() { + var n; + return n = Array.prototype.slice.call(arguments), n.unshift(e), t.push(n), t; + }; +}, t.methods.forEach(function(e) { + t[e] = t.factory(e); +}), t.load = function(t) { + var e, n, o, i; + e = 3e5, i = Math.ceil(new Date() / e) * e, o = document.createElement("script"), + o.type = "text/javascript", o.async = !0, o.crossorigin = "anonymous", o.src = "https://js.driftt.com/include/" + i + "/" + t + ".js", + n = document.getElementsByTagName("script")[0], n.parentNode.insertBefore(o, n); +}); +}(); +drift.SNIPPET_VERSION = '0.3.1'; +drift.load('bua4t3vtn9g5'); + +$.urlParam = function(name){ + var results = new RegExp('[\?&]' + name + '=([^&#]*)').exec(window.location.href); + if (results==null){ + return null; + } + else{ + return decodeURI(results[1]) || 0; + } +} + +var Script = function () { + $.validator.setDefaults({ + submitHandler: function() { + var password=$("#password").val(); + var confirm_password=$("#confirm-password").val(); + var reset_token= $.urlParam('reset-token'); + var dataString = 'password=' + password + '&confirm_password=' + confirm_password + '&reset_token=' +reset_token; + console.log(dataString); + if ($.trim(password).length > 0){ + $.ajax({ + type: "POST", + url: "/reset-password/reset", + data: dataString, + cache: false, + beforeSend: function(){ + $("#status").html('

Connecting to server....

'); + }, + complete: function(e, xhr, settings){ + if(e.status === 200){ + $("#status").html("Success: Redirecting to login."); + setTimeout(function () { + window.location.href = "/dashboard"; // The URL that will be redirected too. + }, 3000); + }else{ + //Shake animation effect. + $('form').shake(); + $("#status").html("Error: Please contact support. "); + } + } + + }); + } + return false; + } + }); + + $().ready(function() { + $("#register-form").validate({ + doNotHideMessage: true, + errorElement: 'span', //default input error message container + errorClass: 'help-block help-block-error', // default input error message class + focusInvalid: false, + rules: { + password: { + required: true + }, + + }, + messages: { + + password: { + required: 'password field is required!', + }, + + } + }); + + // checks form for validity + + // propose username by combining first- and lastname + + }); + + + + +}(); \ No newline at end of file diff --git a/includes/core.php b/includes/core.php index 09e9307..2012437 100755 --- a/includes/core.php +++ b/includes/core.php @@ -30,7 +30,7 @@ include_once 'func.class/general.func.php'; include_once 'func.class/core.func.php'; // Redirect to Login if Match the rule -if ($_SERVER["REQUEST_URI"] != "/register" && $_SERVER["REQUEST_URI"] != "/register/send-verification" && $_SERVER["REQUEST_URI"] != "/register/check-verification" && $_SERVER["REQUEST_URI"] != "/register/submit" && $_SERVER["REQUEST_URI"] != "/register/check" && $_SERVER["REQUEST_URI"] != "/register/check" && $_SERVER["REQUEST_URI"] != "/forgot-password/reset" && $_SERVER["REQUEST_URI"] != "/forgot-password" && $_SERVER["REQUEST_URI"] != '/login' && $_SERVER["REQUEST_URI"] != '/login/auth' && !is_login()) { +if (!preg_match("/reset-password?(\w+)/", $_SERVER["REQUEST_URI"] ) && $_SERVER["REQUEST_URI"] != "/register" && $_SERVER["REQUEST_URI"] != "/register/send-verification" && $_SERVER["REQUEST_URI"] != "/register/check-verification" && $_SERVER["REQUEST_URI"] != "/register/submit" && $_SERVER["REQUEST_URI"] != "/register/check" && $_SERVER["REQUEST_URI"] != "/register/check" && $_SERVER["REQUEST_URI"] != "/forgot-password/reset" && $_SERVER["REQUEST_URI"] != "/forgot-password" && $_SERVER["REQUEST_URI"] != '/login' && $_SERVER["REQUEST_URI"] != '/login/auth' && !is_login()) { header('Location: /login'); } else { // Call the Silex after logged in diff --git a/includes/func.class/login.func.php b/includes/func.class/login.func.php index e5c58c2..888f3f0 100755 --- a/includes/func.class/login.func.php +++ b/includes/func.class/login.func.php @@ -85,18 +85,34 @@ $app->post('/login/auth', function (Request $request) { }); $app->post('/forgot-password/reset', function (Request $request) { global $db; - global $global_env; + global $global_env; + global $twilio; + $username = $request->get('username'); + $db->bind("username", $username); - $users = $db->query("SELECT * FROM users WHERE username= :username && status = 1"); + $users = $db->query("SELECT * FROM users WHERE username= :username && status = 1"); + if (count($users) > 0) { - $newPwd = xToken(6); - $encrypt = $newPwd; - // SETELAH DAPAT PASSWORD UPDATE DULU - $db->bind('password', $encrypt); + # generate unique reset token + $reset_token = md5(uniqid($users[0]["user_id"], true)); + + # update user with reset token + $db->bind('reset_token', $reset_token); $db->bind('username', $username); - $update = $db->query("UPDATE users SET password = :password WHERE username = :username"); - if ($update) { + $update = $db->query("UPDATE users SET reset_token = :reset_token WHERE username = :username"); + if ($update) { + # password recovery link + $recovery_link = "https://app.izyim.com/reset-password?reset-token=".$reset_token; + # send link to SMS + $twilio->messages->create( + $username, + array( + 'from' => '+601130115722', + 'body' => 'Your IZIM password recovery link ' .$recovery_link. ' ' + ) + ); + // end todo return new Response('Success', 200); } else { return new Response('Failed', 201); @@ -107,6 +123,38 @@ $app->post('/forgot-password/reset', function (Request $request) { } }); +$app->post('/reset-password/reset', function (Request $request) { + global $db; + global $global_env; + $password = $request->get('password'); + $confirm_password = $request->get('confirm_password'); + $reset_token = $request->get('reset_token'); + + # check if token exist + $db->bind("reset_token", $reset_token); + $users = $db->query("SELECT * FROM users WHERE status = 1 && reset_token= :reset_token"); + + if (count($users) > 0) { + # check confirm password + if ($password != $confirm_password){ + return new Response('Failed, password and confirm is not the same', 201); + } + # update user password + $e_password = password_hash($password, PASSWORD_DEFAULT); + $db->bind('password', $e_password); + $db->bind('reset_token', $reset_token); + $update = $db->query("UPDATE users SET password = :password WHERE reset_token = :reset_token"); + + if ($update) { + return new Response('Success', 200); + } else { + return new Response('Failed', 201); + } + } else { + return new Response('Invalid token.', 201); + } +}); + $app->post('/register/check', function(Request $request) { global $db; $username = $request->get('username'); @@ -138,8 +186,8 @@ $app->post('/register/check-verification', function(Request $request) { $app->post('/register/send-verification', function(Request $request) { global $db; - - global $twilio; + global $twilio; + $username = $request->get('username'); $verification_code = mt_rand(100000,999999); @@ -219,7 +267,19 @@ $app->get('/login', function() { return ""; } }); + $app->get('/forgot-password', function() { + global $app; + $title = "IZYIM - Reset Password"; + if (is_login()) { + return $app->redirect('/dashboard'); + } else { + require_once __DIR__ . '/../tpl/forgot.php'; + return ""; + } +}); + +$app->get('/reset-password', function() { global $app; $title = "IZYIM - Reset Password"; if (is_login()) { @@ -229,6 +289,7 @@ $app->get('/forgot-password', function() { return ""; } }); + $app->get('/register', function() { global $app; $title = "IZYIM - Registration"; diff --git a/includes/func.class/logs/2018-03-15.txt b/includes/func.class/logs/2018-03-15.txt new file mode 100644 index 0000000..8cf21f5 --- /dev/null +++ b/includes/func.class/logs/2018-03-15.txt @@ -0,0 +1,3 @@ +Time : 13:55:05 +SQLSTATE[HY093]: Invalid parameter number +Raw SQL : SELECT * FROM users WHERE username= :username && status = 1 && reset_token= :reset_token diff --git a/includes/tpl/forgot.php b/includes/tpl/forgot.php new file mode 100644 index 0000000..758f963 --- /dev/null +++ b/includes/tpl/forgot.php @@ -0,0 +1,85 @@ + + + + + + + + + + IZYIM | Register + + + + + + + + + + + + + + + + + + + + + + + + + +
+ +
+

Password Recovery

+

Please provide your username to recover your password, we will send you an sms for the new password.

+
+
+
+ +
+ Back + + +
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/includes/tpl/resetpwd.php b/includes/tpl/resetpwd.php index 758f963..1248073 100755 --- a/includes/tpl/resetpwd.php +++ b/includes/tpl/resetpwd.php @@ -36,16 +36,20 @@
-

Password Recovery

-

Please provide your username to recover your password, we will send you an sms for the new password.

+

Reset Recovery

+

Please enter your new password

-
- + +
+
+ +
+ +
Back -
@@ -75,7 +79,7 @@ - +