n'envoie plus le hash du mot de passe directement quand on change de mot de passe

[platal.git] / htdocs / motdepasse.php

<?php
/***************************************************************************
 *  Copyright (C) 2003-2006 Polytechnique.org                              *
 *  http://opensource.polytechnique.org/                                   *
 *                                                                         *
 *  This program is free software; you can redistribute it and/or modify   *
 *  it under the terms of the GNU General Public License as published by   *
 *  the Free Software Foundation; either version 2 of the License, or      *
 *  (at your option) any later version.                                    *
 *                                                                         *
 *  This program is distributed in the hope that it will be useful,        *
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
 *  GNU General Public License for more details.                           *
 *                                                                         *
 *  You should have received a copy of the GNU General Public License      *
 *  along with this program; if not, write to the Free Software            *
 *  Foundation, Inc.,                                                      *
 *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
 ***************************************************************************/

require_once('xorg.inc.php');

if (Post::has('response2'))  {
    require_once('secure_hash.inc.php');
    if (hash_encrypt($_SESSION['password'].":".$_SESSION['session']->challenge) != Post::get('response')) {
        new_skinned_page('motdepasse.tpl', AUTH_MDP);
        $page->addJsLink('javascript/motdepasse.js');
        $page->assign('xorg_title','Polytechnique.org - Mon mot de passe');
        $page->trig('Ancien mot de passe erronné');
        $page->run();
    }
    $password = hash_xor(Post::get('response2'), $_SESSION['password']);
    $_SESSION['password'] = $password;
    
    $globals->xdb->execute('UPDATE auth_user_md5 SET password={?} WHERE user_id={?}', $password, Session::getInt('uid'));
    
    $log =& Session::getMixed('log');
    $log->log('passwd', '');

    if (Cookie::get('ORGaccess')) {
        setcookie('ORGaccess', hash_encrypt($password), (time()+25920000), '/', '' ,0);
    }

    new_skinned_page('motdepasse.success.tpl', AUTH_MDP);
    $page->run();
}

new_skinned_page('motdepasse.tpl', AUTH_MDP);
$page->addJsLink('javascript/motdepasse.js');
$page->assign('xorg_title','Polytechnique.org - Mon mot de passe');
$page->run();
?>