Sky/Dragon-Knight
Sky/Dragon-Knight
1
0
Fork 0
Code Issues Pull Requests Activity

Repair all users page functionality

Browse Source
This commit is contained in:
Sky Johnson 2024-12-12 12:05:28 -06:00
parent 2b6ec4d4ab
commit b4d188de16
6 changed files with 194 additions and 176 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
public/index.php
View File

@ -115,7 +115,7 @@ function dotown()
while ($onlinerow = $onlinequery->fetchArray(SQLITE3_ASSOC)) { while ($onlinerow = $onlinequery->fetchArray(SQLITE3_ASSOC)) {
$online_count++; $online_count++;
$online_rows[] = "<a href=\"index.php?do=onlinechar:".$onlinerow["id"]."\">".$onlinerow["username"]."</a>" . ", "; $online_rows[] = "<a href=\"index.php?do=onlinechar:".$onlinerow["id"]."\">".$onlinerow["username"]."</a>";
} }
$townrow["whosonline"] = "<table width=\"95%\"><tr><td class=\"title\">Who's Online</td></tr><tr><td>\n"; $townrow["whosonline"] = "<table width=\"95%\"><tr><td class=\"title\">Who's Online</td></tr><tr><td>\n";

2
public/install.php
View File

@ -621,7 +621,7 @@ function second()
`username` TEXT NOT NULL, `username` TEXT NOT NULL,
`password` TEXT NOT NULL, `password` TEXT NOT NULL,
`email` TEXT NOT NULL, `email` TEXT NOT NULL,
`verify` INTEGER NOT NULL default 0, `verify` TEXT NOT NULL default '',
`regdate` datetime NOT NULL default CURRENT_TIMESTAMP, `regdate` datetime NOT NULL default CURRENT_TIMESTAMP,
`onlinetime` datetime NOT NULL default CURRENT_TIMESTAMP, `onlinetime` datetime NOT NULL default CURRENT_TIMESTAMP,
`authlevel` INTEGER NOT NULL default 0, `authlevel` INTEGER NOT NULL default 0,

5
public/login.php
View File

@ -2,10 +2,7 @@
// login.php :: Handles logins and cookies. // login.php :: Handles logins and cookies.
if (!file_exists('../.installed')) { if (!file_exists('../.installed')) redirect('install.php');
header('Location: install.php');
exit;
}
require_once '../src/lib.php'; require_once '../src/lib.php';

327
public/users.php
View File

@ -1,239 +1,252 @@
<?php // users.php :: Handles user account functions. <?php
include('lib.php'); // users.php :: Handles user account functions.
$link = opendb();
if (isset($_GET["do"])) { if (!file_exists('../.installed')) redirect('install.php');
$do = $_GET["do"]; require_once '../src/lib.php';
if ($do == "register") { register(); }
elseif ($do == "verify") { verify(); }
elseif ($do == "lostpassword") { lostpassword(); }
elseif ($do == "changepassword") { changepassword(); }
} $controlrow = get_control_row();
function register() { // Register a new account. $do = $_GET['do'] ?? 'register';
match ($do) {
'verify' => verify(),
'lostpassword' => lostpassword(),
'changepassword' => changepassword(),
default => register()
};
$controlquery = doquery("SELECT * FROM {{table}} WHERE id='1' LIMIT 1", "control"); /**
$controlrow = mysql_fetch_array($controlquery); * Register a new account.
*/
function register()
{
global $controlrow;
if (isset($_POST["submit"])) { if (isset($_POST["submit"])) {
$u = trim($_POST['username'] ?? '');
$e = trim($_POST['email1'] ?? '');
$e2 = trim($_POST['email2'] ?? '');
$p = $_POST['password1'] ?? '';
$p2 = $_POST['password2'] ?? '';
extract($_POST); $errors = [];
$errors = 0; $errorlist = "";
// Process username. // Process username.
if ($username == "") { $errors++; $errorlist .= "Username field is required.<br>"; } if (empty($u) || strlen($u) < 3 || strlen($u) > 18 || !ctype_alnum(str_replace(' ', '', $u))) {
if (preg_match("/[^A-z0-9_\-]/", $username)==1) { $errors++; $errorlist .= "Username must be alphanumeric.<br>"; } // Thanks to "Carlos Pires" from php.net! $errors[] = 'Username is required and must be between 3 and 18 characters long and contain only
$usernamequery = doquery("SELECT username FROM {{table}} WHERE username='$username' LIMIT 1","users"); alphanumeric characters and spaces.';
if (mysql_num_rows($usernamequery) > 0) { $errors++; $errorlist .= "Username already taken - unique username required.<br>"; } }
if (db()->exists('users', 'username', $u)) {
$errors[] = 'Username already taken. Try another.';
}
// Process email address. // Process email address.
if ($email1 == "" || $email2 == "") { $errors++; $errorlist .= "Email fields are required.<br>"; } if (empty($e) || strlen($e) > 255 || !filter_var($e, FILTER_VALIDATE_EMAIL)) {
if ($email1 != $email2) { $errors++; $errorlist .= "Emails don't match.<br>"; } $errors[] = 'Email is required must be a valid email address.';
if (! is_email($email1)) { $errors++; $errorlist .= "Email isn't valid.<br>"; } }
$emailquery = doquery("SELECT email FROM {{table}} WHERE email='$email1' LIMIT 1","users");
if (mysql_num_rows($emailquery) > 0) { $errors++; $errorlist .= "Email already taken - unique email address required.<br>"; } if ($e !== $e2) {
$errors[] = 'Verify Email must match.';
}
if (db()->exists('users', 'email', $e)) {
$errors[] = 'Email already taken. Forgot your password?';
}
// Process password. // Process password.
if (trim($password1) == "") { $errors++; $errorlist .= "Password field is required.<br>"; } if (empty($p) || strlen($p) < 6) {
if (preg_match("/[^A-z0-9_\-]/", $password1)==1) { $errors++; $errorlist .= "Password must be alphanumeric.<br>"; } // Thanks to "Carlos Pires" from php.net! $errors[] = 'Password is required and must be at least 6 characters long.';
if ($password1 != $password2) { $errors++; $errorlist .= "Passwords don't match.<br>"; } }
$password = md5($password1);
if ($errors == 0) { if ($p2 !== $p) {
$errors[] = 'Verify Password must match.';
}
if ($controlrow["verifyemail"] == 1) { $password = password_hash($p, PASSWORD_ARGON2ID);
$verifycode = "";
for ($i=0; $i<8; $i++) {
$verifycode .= chr(rand(65,90));
}
} else {
$verifycode='1';
}
$query = doquery("INSERT INTO {{table}} SET id='',regdate=NOW(),verify='$verifycode',username='$username',password='$password',email='$email1',charclass='$charclass'", "users") or die(mysql_error()); if (count($errors) !== 0) {
$err = "<ul>";
foreach ($errors as $error) $err .= "<li>$error</li>";
$err .= "</ul>";
$page = "The following error(s) occurred when your account was being made:<br><span style=\"color:red;\">$err</span><br>Please go back and try again.";
} else {
$token = ($controlrow['verifyemail'] == true) ? token(8) : 'g2g';
db()->query('INSERT INTO users (verify, username, password, email, charclass) VALUES (?, ?, ?, ?, ?)', [
$token, $u, $password, $e, $_POST['charclass'] ?? 1
]);
if ($controlrow["verifyemail"] == 1) { if ($controlrow['verifyemail'] == true) {
if (sendregmail($email1, $verifycode) == true) { if (sendregmail($e, $token)) {
$page = "Your account was created successfully.<br><br>You should receive an Account Verification email shortly. You will need the verification code contained in that email before you are allowed to log in. Once you have received the email, please visit the <a href=\"users.php?do=verify\">Verification Page</a> to enter your code and start playing."; $page = "Your account was created successfully.<br><br>You should receive an Account Verification email shortly. You will need the verification code contained in that email before you are allowed to log in. Once you have received the email, please visit the <a href=\"users.php?do=verify\">Verification Page</a> to enter your code and start playing.";
} else { } else {
$page = "Your account was created successfully.<br><br>However, there was a problem sending your verification email. Please check with the game administrator to help resolve this problem."; $page = "Your account was created successfully.<br><br>However, there was a problem sending your verification email. Please check with the game administrator to help resolve this problem.";
} }
} else { } else {
$page = "Your account was created succesfully.<br><br>You may now continue to the <a href=\"login.php?do=login\">Login Page</a> and continue playing ".$controlrow["gamename"]."!"; $page = "Your account was created succesfully.<br><br>You may now continue to the <a href=\"login.php?do=login\">Login Page</a> and continue playing ".$controlrow["gamename"]."!";
} }
}
} else {
$page = "The following error(s) occurred when your account was being made:<br><span style=\"color:red;\">$errorlist</span><br>Please go back and try again.";
}
} else { } else {
if ($controlrow["verifyemail"] == true) {
$page = gettemplate("register");
if ($controlrow["verifyemail"] == 1) {
$controlrow["verifytext"] = "<br><span class=\"small\">A verification code will be sent to the address above, and you will not be able to log in without first entering the code. Please be sure to enter your correct email address.</span>"; $controlrow["verifytext"] = "<br><span class=\"small\">A verification code will be sent to the address above, and you will not be able to log in without first entering the code. Please be sure to enter your correct email address.</span>";
} else { } else {
$controlrow["verifytext"] = ""; $controlrow["verifytext"] = "";
} }
$page = parsetemplate($page, $controlrow);
$page = parsetemplate(gettemplate("register"), $controlrow);
} }
$topnav = "<a href=\"login.php?do=login\"><img src=\"images/button_login.gif\" alt=\"Log In\" border=\"0\" /></a><a href=\"users.php?do=register\"><img src=\"images/button_register.gif\" alt=\"Register\" border=\"0\" /></a><a href=\"help.php\"><img src=\"images/button_help.gif\" alt=\"Help\" border=\"0\" /></a>"; $topnav = "<a href=\"login.php?do=login\"><img src=\"images/button_login.gif\" alt=\"Log In\" border=\"0\" /></a><a href=\"users.php?do=register\"><img src=\"images/button_register.gif\" alt=\"Register\" border=\"0\" /></a><a href=\"help.php\"><img src=\"images/button_help.gif\" alt=\"Help\" border=\"0\" /></a>";
display($page, "Register", false, false, false); display($page, "Register", false, false, false);
} }
function verify() { function verify()
{
if (isset($_POST["submit"])) { if (isset($_POST["submit"])) {
extract($_POST); $u = trim($_POST['username'] ?? '');
$userquery = doquery("SELECT username,email,verify FROM {{table}} WHERE username='$username' LIMIT 1","users"); $e = trim($_POST['email'] ?? '');
if (mysql_num_rows($userquery) != 1) { die("No account with that username."); } $t = trim($_POST['token'] ?? '');
$userrow = mysql_fetch_array($userquery);
if ($userrow["verify"] == 1) { die("Your account is already verified."); } $query = db()->query('SELECT id FROM users WHERE username=? AND email=? AND verify=? LIMIT 1;', [$u, $e, $t]);
if ($userrow["email"] != $email) { die("Incorrect email address."); } if ($query === false) exit('Verification failed. Go back, double-check your details, and try again.');
if ($userrow["verify"] != $verify) { die("Incorrect verification code."); }
// If we've made it this far, should be safe to update their account. db()->query("UPDATE users SET verify='g2g' WHERE username=?;", [$u]);
$updatequery = doquery("UPDATE {{table}} SET verify='1' WHERE username='$username' LIMIT 1","users");
display("Your account was verified successfully.<br><br>You may now continue to the <a href=\"login.php?do=login\">Login Page</a> and start playing the game.<br><br>Thanks for playing!","Verify Email",false,false,false); display("Your account was verified successfully.<br><br>You may now continue to the <a href=\"login.php?do=login\">Login Page</a> and start playing the game.<br><br>Thanks for playing!","Verify Email",false,false,false);
} }
$page = gettemplate("verify");
$topnav = "<a href=\"login.php?do=login\"><img src=\"images/button_login.gif\" alt=\"Log In\" border=\"0\" /></a><a href=\"users.php?do=register\"><img src=\"images/button_register.gif\" alt=\"Register\" border=\"0\" /></a><a href=\"help.php\"><img src=\"images/button_help.gif\" alt=\"Help\" border=\"0\" /></a>";
display($page, "Verify Email", false, false, false);
$topnav = "<a href=\"login.php?do=login\"><img src=\"images/button_login.gif\" alt=\"Log In\" border=\"0\" /></a><a href=\"users.php?do=register\"><img src=\"images/button_register.gif\" alt=\"Register\" border=\"0\" /></a><a href=\"help.php\"><img src=\"images/button_help.gif\" alt=\"Help\" border=\"0\" /></a>";
display(gettemplate("verify"), "Verify Email", false, false, false);
} }
function lostpassword() { function lostpassword()
{
if (isset($_POST["submit"])) { if (isset($_POST["submit"])) {
extract($_POST); $e = trim($_POST['email'] ?? '');
$userquery = doquery("SELECT email FROM {{table}} WHERE email='$email' LIMIT 1","users");
if (mysql_num_rows($userquery) != 1) { die("No account with that email address."); } if (!db()->exists('users', 'email', $e)) exit("No account with that email address.");
$newpass = "";
for ($i=0; $i<8; $i++) { $newpass = token(16);
$newpass .= chr(rand(65,90)); $hashed = password_hash($newpass, PASSWORD_ARGON2ID);
}
$md5newpass = md5($newpass); db()->query('UPDATE users SET password=? WHERE email=?;', [$hashed, $e]);
$updatequery = doquery("UPDATE {{table}} SET password='$md5newpass' WHERE email='$email' LIMIT 1","users");
if (sendpassemail($email,$newpass) == true) { if (sendpassemail($e, $newpass)) {
display("Your new password was emailed to the address you provided.<br><br>Once you receive it, you may <a href=\"login.php?do=login\">Log In</a> and continue playing.<br><br>Thank you.","Lost Password",false,false,false); display("Your new password was emailed to the address you provided.<br><br>Once you receive it, you may <a href=\"login.php?do=login\">Log In</a> and continue playing.<br><br>Thank you.","Lost Password",false,false,false);
} else { } else {
display("There was an error sending your new password.<br><br>Please check with the game administrator for more information.<br><br>We apologize for the inconvience.","Lost Password",false,false,false); display("There was an error sending your new password.<br><br>Please check with the game administrator for more information.<br><br>We apologize for the inconvience.","Lost Password",false,false,false);
} }
die();
} }
$page = gettemplate("lostpassword");
$topnav = "<a href=\"login.php?do=login\"><img src=\"images/button_login.gif\" alt=\"Log In\" border=\"0\" /></a><a href=\"users.php?do=register\"><img src=\"images/button_register.gif\" alt=\"Register\" border=\"0\" /></a><a href=\"help.php\"><img src=\"images/button_help.gif\" alt=\"Help\" border=\"0\" /></a>"; $topnav = "<a href=\"login.php?do=login\"><img src=\"images/button_login.gif\" alt=\"Log In\" border=\"0\" /></a><a href=\"users.php?do=register\"><img src=\"images/button_register.gif\" alt=\"Register\" border=\"0\" /></a><a href=\"help.php\"><img src=\"images/button_help.gif\" alt=\"Help\" border=\"0\" /></a>";
display($page, "Lost Password", false, false, false); display(gettemplate("lostpassword"), "Lost Password", false, false, false);
} }
function changepassword() { function changepassword()
{
if (isset($_POST["submit"])) { if (isset($_POST["submit"])) {
extract($_POST); $u = trim($_POST['username'] ?? '');
$userquery = doquery("SELECT * FROM {{table}} WHERE username='$username' LIMIT 1","users"); $p = $_POST['password'] ?? '';
if (mysql_num_rows($userquery) != 1) { die("No account with that username."); } $np = $_POST['new_password'] ?? '';
$userrow = mysql_fetch_array($userquery); $np2 = $_POST['new_password2'] ?? '';
if ($userrow["password"] != md5($oldpass)) { die("The old password you provided was incorrect."); }
if (preg_match("/[^A-z0-9_\-]/", $newpass1)==1) { die("New password must be alphanumeric."); } // Thanks to "Carlos Pires" from php.net!
if ($newpass1 != $newpass2) { die("New passwords don't match."); }
$realnewpass = md5($newpass1);
$updatequery = doquery("UPDATE {{table}} SET password='$realnewpass' WHERE username='$username' LIMIT 1","users");
if (isset($_COOKIE["dkgame"])) { setcookie("dkgame", "", time()-100000, "/", "", 0); }
display("Your password was changed successfully.<br><br>You have been logged out of the game to avoid cookie errors.<br><br>Please <a href=\"login.php?do=login\">log back in</a> to continue playing.","Change Password",false,false,false);
die();
}
$page = gettemplate("changepassword");
$topnav = "<a href=\"login.php?do=login\"><img src=\"images/button_login.gif\" alt=\"Log In\" border=\"0\" /></a><a href=\"users.php?do=register\"><img src=\"images/button_register.gif\" alt=\"Register\" border=\"0\" /></a><a href=\"help.php\"><img src=\"images/button_help.gif\" alt=\"Help\" border=\"0\" /></a>";
display($page, "Change Password", false, false, false);
$user = db()->query("SELECT password FROM users WHERE username=? LIMIT 1;", [$u]);
$user = $user->fetchArray(SQLITE3_ASSOC);
if ($user === false) exit("No account with that username.");
if (!password_verify($p, $user['password'])) exit("The old password you provided was incorrect.");
if (empty($np) || strlen($np) < 6) {
$errors[] = 'New password is required and must be at least 6 characters long.';
}
if ($np2 !== $np) {
$errors[] = 'Verify New Password must match.';
}
$realnewpass = password_hash($np, PASSWORD_ARGON2ID);
db()->query('UPDATE users SET password=? WHERE username=?;', [$u]);
set_cookie('dkgame', '', -3600);
display("Your password was changed successfully.<br><br>You have been logged out of the game to avoid errors.<br><br>Please <a href=\"login.php?do=login\">log back in</a> to continue playing.","Change Password",false,false,false);
}
$topnav = "<a href=\"login.php?do=login\"><img src=\"images/button_login.gif\" alt=\"Log In\" border=\"0\" /></a><a href=\"users.php?do=register\"><img src=\"images/button_register.gif\" alt=\"Register\" border=\"0\" /></a><a href=\"help.php\"><img src=\"images/button_help.gif\" alt=\"Help\" border=\"0\" /></a>";
display(gettemplate("changepassword"), "Change Password", false, false, false);
} }
function sendpassemail($emailaddress, $password) { function sendpassemail($emailaddress, $password)
{
$controlquery = doquery("SELECT * FROM {{table}} WHERE id='1' LIMIT 1", "control"); global $controlrow;
$controlrow = mysql_fetch_array($controlquery);
extract($controlrow); extract($controlrow);
$email = <<<END $email = <<<HTML
You or someone using your email address submitted a Lost Password application on the $gamename server, located at $gameurl. You or someone using your email address submitted a Lost Password application on the $gamename server, located at $gameurl.
We have issued you a new password so you can log back into the game. We have issued you a new password so you can log back into the game.
Your new password is: $password Your new password is: $password
Thanks for playing. Thanks for playing.
END; HTML;
$status = mymail($emailaddress, "$gamename Lost Password", $email); $status = mymail($emailaddress, "$gamename Lost Password", $email);
return $status; return $status;
} }
function sendregmail($emailaddress, $vercode) { function sendregmail($emailaddress, $vercode)
{
$controlquery = doquery("SELECT * FROM {{table}} WHERE id='1' LIMIT 1", "control"); global $controlrow;
$controlrow = mysql_fetch_array($controlquery);
extract($controlrow); extract($controlrow);
$verurl = $gameurl . "?do=verify"; $verurl = $gameurl . "?do=verify";
$email = <<<END $email = <<<HTML
You or someone using your email address recently signed up for an account on the $gamename server, located at $gameurl. You or someone using your email address recently signed up for an account on the $gamename server, located at $gameurl.
This email is sent to verify your registration email. In order to begin using your account, you must verify your email address. This email is sent to verify your registration email. In order to begin using your account, you must verify your email address.
Please visit the Verification Page ($verurl) and enter the code below to activate your account. Please visit the Verification Page ($verurl) and enter the code below to activate your account.
Verification code: $vercode Verification code: $vercode
If you were not the person who signed up for the game, please disregard this message. You will not be emailed again. If you were not the person who signed up for the game, please disregard this message. You will not be emailed again.
END; HTML;
$status = mymail($emailaddress, "$gamename Account Verification", $email); $status = mymail($emailaddress, "$gamename Account Verification", $email);
return $status; return $status;
} }
function mymail($to, $title, $body, $from = '') { // thanks to arto dot PLEASE dot DO dot NOT dot SPAM at artoaaltonen dot fi. /**
* thanks to arto dot PLEASE dot DO dot NOT dot SPAM at artoaaltonen dot fi.
*/
function mymail($to, $title, $body, $from = '')
{
global $controlrow;
extract($controlrow);
$controlquery = doquery("SELECT * FROM {{table}} WHERE id='1' LIMIT 1", "control"); $from = trim($from);
$controlrow = mysql_fetch_array($controlquery);
extract($controlrow);
if (!$from) $from = '<'.$controlrow["adminemail"].'>';
$from = trim($from); $rp = $controlrow["adminemail"];
$org = '$gameurl';
$mailer = 'PHP';
if (!$from) { $head = '';
$from = '<'.$controlrow["adminemail"].'>'; $head .= "Content-Type: text/plain \r\n";
} $head .= "Date: ". date('r'). " \r\n";
$head .= "Return-Path: $rp \r\n";
$head .= "From: $from \r\n";
$head .= "Sender: $from \r\n";
$head .= "Reply-To: $from \r\n";
$head .= "Organization: $org \r\n";
$head .= "X-Sender: $from \r\n";
$head .= "X-Priority: 3 \r\n";
$head .= "X-Mailer: $mailer \r\n";
$rp = $controlrow["adminemail"]; $body = str_replace("\r\n", "\n", $body);
$org = '$gameurl'; $body = str_replace("\n", "\r\n", $body);
$mailer = 'PHP';
$head = '';
$head .= "Content-Type: text/plain \r\n";
$head .= "Date: ". date('r'). " \r\n";
$head .= "Return-Path: $rp \r\n";
$head .= "From: $from \r\n";
$head .= "Sender: $from \r\n";
$head .= "Reply-To: $from \r\n";
$head .= "Organization: $org \r\n";
$head .= "X-Sender: $from \r\n";
$head .= "X-Priority: 3 \r\n";
$head .= "X-Mailer: $mailer \r\n";
$body = str_replace("\r\n", "\n", $body);
$body = str_replace("\n", "\r\n", $body);
return mail($to, $title, $body, $head);
return mail($to, $title, $body, $head);
} }
?>

8
src/lib.php
View File

@ -322,3 +322,11 @@ function special_to_string(string $special): string
default => $special default => $special
}; };
} }
/**
* Generate a pretty dope token.
*/
function token($length = 32): string
{
return bin2hex(random_bytes($length));
}

26
templates/verify.php
View File

@ -1,14 +1,14 @@
<?php <?php
$template = <<<THEVERYENDOFYOU
<form action="users.php?do=verify" method="post"> $template = <<<HTML
<table width="80%"> <form action="users.php?do=verify" method="post">
<tr><td colspan="2">Thank you for registering a character. Please enter your username, email address, and the verification code <table width="80%">
that was emailed to you to unlock your character.</td></tr> <tr><td colspan="2">Thank you for registering a character. Please enter your username, email address, and the verification code
<tr><td width="20%">Username:</td><td><input type="text" name="username" size="30" maxlength="30" /></td></tr> that was emailed to you to unlock your character.</td></tr>
<tr><td>Email Address:</td><td><input type="text" name="email" size="30" maxlength="100" /></td></tr> <tr><td width="20%">Username:</td><td><input type="text" name="username" size="30" maxlength="30" /></td></tr>
<tr><td>Verification Code:</td><td><input type="text" name="verify" size="10" maxlength="8" /><br><br><br></td></tr> <tr><td>Email Address:</td><td><input type="text" name="email" size="30" maxlength="100" /></td></tr>
<tr><td colspan="2"><input type="submit" name="submit" value="Submit" /> <input type="reset" name="reset" value="Reset" /></td></tr> <tr><td>Verification Code:</td><td><input type="text" name="token" /><br><br><br></td></tr>
</table> <tr><td colspan="2"><input type="submit" name="submit" value="Submit" /> <input type="reset" name="reset" value="Reset" /></td></tr>
</form> </table>
THEVERYENDOFYOU; </form>
?> HTML;