mattia/mordApp
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security patch, kick out potential intruder

Browse Source
This commit is contained in:
Mattia Mascarello 2021-08-21 17:03:27 +02:00 committed by GitHub
parent a3a5f23825
commit 4f4e366948
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
resend.php
View File

@ -21,11 +21,12 @@ if(!$u["verified"] && $u){
<?php <?php
} }
elseif($_POST["action"]=="chpass"){ elseif($_POST["action"]=="chpass"){
$q = $p->prepare("UPDATE Users SET passwordHash=:ph, emailToken=:ett WHERE emailToken=:et "); $q = $p->prepare("UPDATE Users SET passwordHash=:ph, emailToken=:ett, token=:sessionToken WHERE emailToken=:et ");
$q->execute([ $q->execute([
":ph" => password_hash($_POST["password"],PASSWORD_DEFAULT), ":ph" => password_hash($_POST["password"],PASSWORD_DEFAULT),
":et" => $_POST["tk"], ":et" => $_POST["tk"],
":ett" => bin2hex(random_bytes(16)) ":ett" => bin2hex(random_bytes(16)),
":sessionToken" => bin2hex(random_bytes(16))
]); ]);
http_response_code(302); http_response_code(302);
header("Location: ."); header("Location: .");