tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Check editor accounts.

Browse Source 
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 5d657d7e45
commit 3df88e0b4c
10 changed files with 217 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/addeditor.php
+32 -6
View File
@@ -6,19 +6,22 @@ $added = FALSE;
$csrf_failed = FALSE;
$hash_failed = FALSE;
$exists = FALSE;
$invalid = array();
if (!isset($_SESSION['editor'])) {
header("Location: /publish/login");
return;
} else if (isset($_POST['adduser']) && !csrf_valid()) {
$csrf_failed = TRUE;
} else if (isset($_POST['adduser']) && ($invalid = new_editor_problems($_POST['username'] ?? NULL, $_POST['password'] ?? NULL))) {
// Nothing is stored; the page lists the problems
} else if (isset($_POST['adduser'])) {
require_once('../open_db.lib.php');
open_db('open');
$table = "editors";
$username = (string)($_POST['username'] ?? '');
$password = password_hash((string)($_POST['password'] ?? ''), password_algorithm());
$email = (string)($_POST['email'] ?? '');
$username = $_POST['username'];
$password = password_hash($_POST['password'], password_algorithm());
$email = is_string($_POST['email'] ?? NULL) ? $_POST['email'] : '';
$found = $db->execute_query("SELECT username FROM $table WHERE username = ?", array($username));
$query = "INSERT INTO $table SET `username` = ?, `password` = ?, `email` = ?";
if ($found && $found->fetch_assoc()) {
@@ -28,13 +31,33 @@ if (!isset($_SESSION['editor'])) {
if (password_hash_is_stored($username, $password)) {
$added = TRUE;
} else {
$db->execute_query("DELETE FROM $table WHERE username = ?", array($username));
remove_editor($username);
$hash_failed = TRUE;
}
$is_admin = TRUE;
}
open_db('close');
}
/*
* The problems with a new username and password, as messages; an empty
* list means that both are fine. The persistent login cookie holds
* "username|key", so a username cannot contain "|".
*/
function new_editor_problems($username, $password) {
$problems = array();
if (!is_string($username) || trim($username) === '')
$problems[] = 'Please enter a username.';
else if ($username !== trim($username) || strlen($username) > 64 || preg_match('/[|\p{Cc}]/u', $username) !== 0)
$problems[] = 'A username has at most 64 characters, with no spaces at the ends and no "|".';
if (!is_string($password) || mb_strlen($password, 'UTF-8') < 12)
$problems[] = 'A password needs at least 12 characters.';
else if (strlen($password) > 1024)
$problems[] = 'A password has at most 1024 characters.';
else if (is_string($username) && strcasecmp($password, $username) === 0)
$problems[] = 'The password cannot be the username.';
return $problems;
}
?>
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
@@ -67,6 +90,9 @@ if (!isset($_SESSION['editor'])) {
<?php if ($exists) { ?>
<p><strong>An editor with that username already exists.</strong></p>
<?php } ?>
<?php foreach ($invalid as $problem) { ?>
<p><strong><?= form_value($problem) ?></strong></p>
<?php } ?>
<?php if ($hash_failed) { ?>
<p><strong>The editor was not added: the editors.password column is too short for the password hash. Widen it to VARCHAR(255).</strong></p>
<?php } ?>
@@ -77,12 +103,12 @@ if (!isset($_SESSION['editor'])) {
<label for="username">Username: </label>
<div class="rightcolumn">
<input type="text" id="username" name="username" />
<input type="text" id="username" name="username" required maxlength="64" autocomplete="off" />
</div>
<label for="password">Password: </label>
<div class="rightcolumn">
<input type="password" id="password" name="password" />
<input type="password" id="password" name="password" required minlength="12" autocomplete="new-password" />
</div>
<label for="email">Email: </label>