Adapts password JS to be used everywhere on the site.

Signed-off-by: Stéphane Jacob <sj@m4x.org>

diff --git a/htdocs/javascript/password.js b/htdocs/javascript/password.js
index 929bd94..4e8b1b9 100644 (file)
--- a/htdocs/javascript/password.js
+++ b/htdocs/javascript/password.js
@@ -18,37 +18,29 @@
  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  ***************************************************************************/
 
-function EnCryptedResponse() {
-    pw1 = document.forms.changepass.nouveau.value;
-    pw2 = document.forms.changepass.nouveau2.value;
-    if (pw1 != pw2) {
-        alert ("\nErreur : les deux champs ne sont pas identiques !")
+function hashResponse(password1, password2, hasConfirmation) {
+    pw1 = $('[name=' + password1 + ']').val();
+    if (hasConfirmation) {
+        pw2 = $('[name=' + password2 + ']').val();
+        if (pw1 != pw2) {
+            alert("\nErreur : les deux champs ne sont pas identiques !");
             return false;
-        exit;
+        }
+        $('[name=' + password2 + ']').val('');
     }
     if (pw1.length < 6) {
-        alert ("\nErreur : le nouveau mot de passe doit faire au moins 6 caractères !")
-            return false;
-        exit;
+        alert("\nErreur : le nouveau mot de passe doit faire au moins 6 caractères !");
+        return false;
     }
-    if (differentTypes(pw1)) {
-        alert ("\nErreur : le nouveau mot de passe doit comporter au moins deux types de caractères parmi les suivants : lettres minuscules, lettres majuscules, chiffres, caractères spéciaux.")
-            return false;
-        exit;
+    if (!differentTypes(pw1)) {
+        alert ("\nErreur : le nouveau mot de passe doit comporter au moins deux types de caractères parmi les suivants : lettres minuscules, lettres majuscules, chiffres, caractères spéciaux.");
+        return false;
     }
 
-    str = hash_encrypt(document.forms.changepass.nouveau.value);
-    document.forms.changepass2.response2.value = str;
-
-    alert ("Le mot de passe que tu as rentré va être chiffré avant de nous parvenir par Internet ! Ainsi il ne circulera pas en clair.");
-    document.forms.changepass2.submit();
+    alert("Le mot de passe que tu as rentré va être chiffré avant de nous parvenir par Internet ! Ainsi il ne circulera pas en clair.");
+    $('[name=' + password1 + ']').val('');
+    $('[name=pwhash]').val(hash_encrypt(pw1));
     return true;
 }
 
-function EncryptedResponseInNestedForm() {
-    $('[name=nouveau]').val($('[name=password]').val());
-    $('[name=nouveau2]').val($('[name=password2]').val());
-    EnCryptedResponse();
-}
-
 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:

diff --git a/modules/googleapps.php b/modules/googleapps.php
index d359446..263a24d 100644 (file)
--- a/modules/googleapps.php
+++ b/modules/googleapps.php
@@ -69,9 +69,9 @@ class GoogleAppsModule extends PLModule
                 } else {
                     $account->set_password_sync(false);
                 }
-            } elseif ($action == 'password' && Post::has('response2') && !$account->sync_password) {
+            } elseif ($action == 'password' && Post::has('pwhash') && Post::t('pwhash') && !$account->sync_password) {
                 S::assert_xsrf_token();
-                $account->set_password(Post::v('response2'));
+                $account->set_password(Post::t('pwhash'));
             }
 
             if ($action == 'suspend' && Post::has('suspend') && $account->active()) {
@@ -104,7 +104,7 @@ class GoogleAppsModule extends PLModule
                 if ($password_sync) {
                     $password = $user->password();
                 } else {
-                    $password = Post::v('response2');
+                    $password = Post::t('pwhash');
                 }
 
                 $account->create($password_sync, $password, $redirect_mails);

diff --git a/modules/platal.php b/modules/platal.php
index e4d07f5..1bc0a94 100644 (file)
--- a/modules/platal.php
+++ b/modules/platal.php
@@ -202,10 +202,10 @@ class PlatalModule extends PLModule
     {
         global $globals;
 
-        if (Post::has('response2'))  {
+        if (Post::has('pwhash') && Post::t('pwhash'))  {
             S::assert_xsrf_token();
 
-            S::set('password', $password = Post::v('response2'));
+            S::set('password', $password = Post::t('pwhash'));
             XDB::execute('UPDATE  accounts
                              SET  password = {?}
                            WHERE  uid={?}', $password,
@@ -365,8 +365,8 @@ Adresse de secours : " . Post::v('email') : ""));
         }
 
         $uid = $ligne["uid"];
-        if (Post::has('response2')) {
-            $password = Post::v('response2');
+        if (Post::has('pwhash') && Post::t('pwhash')) {
+            $password = Post::t('pwhash');
             XDB::query('UPDATE  accounts
                            SET  password={?}
                          WHERE  uid = {?} AND state = \'active\'',

diff --git a/modules/register.php b/modules/register.php
index 34c3ed1..c09d68d 100644 (file)
--- a/modules/register.php
+++ b/modules/register.php
@@ -179,7 +179,7 @@ class RegisterModule extends PLModule
                     $subState->set('services', $services);
 
                     // Validate the password.
-                    if (!Post::v('response2', false)) {
+                    if (!Post::v('pwhash', false)) {
                         $error[] = "Le mot de passe n'est pas valide.";
                     }
 
@@ -211,7 +211,7 @@ class RegisterModule extends PLModule
                         $subState->set('birthdate', sprintf("%04d-%02d-%02d",
                                                             intval($birth[2]), intval($birth[1]), intval($birth[0])));
                         $subState->set('email', Post::t('email'));
-                        $subState->set('password', Post::t('response2'));
+                        $subState->set('password', Post::t('pwhash'));
 
                         // Update the current alert if the birthdate is incorrect,
                         // or if the IP address of the user has been banned.

diff --git a/templates/googleapps/index.tpl b/templates/googleapps/index.tpl
index 2d7846d..643acf7 100644 (file)
--- a/templates/googleapps/index.tpl
+++ b/templates/googleapps/index.tpl
@@ -99,19 +99,19 @@
       </tr>
       <tr class="impair">
         <td colspan="2">
-          <form action="#" method="post" id="changepass">
+          <form action="#" method="post">
           <table class="tinybicol">
             <tr>
               <td class="titre">Nouveau mot de passe</td>
-              <td><input type="password" name="nouveau" onfocus="document.forms.changepass2.password_sync[1].checked = true;" /></td>
+              <td><input type="password" name="new1" onfocus="document.forms.changepass2.password_sync[1].checked = true;" /></td>
             </tr>
             <tr>
               <td class="titre">Vérification</td>
-              <td><input type="password" name="nouveau2" onfocus="document.forms.changepass2.password_sync[1].checked = true;" /></td>
+              <td><input type="password" name="new2" onfocus="document.forms.changepass2.password_sync[1].checked = true;" /></td>
             </tr>
             <tr>
               <td class="titre">Sécurité</td>
-              <td>{checkpasswd prompt="nouveau" submit="create_account" text="Créer mon compte !"}</td>
+              <td>{checkpasswd prompt="new" submit="create_account" text="Créer mon compte !"}</td>
             </tr>
           </table>
           </form>
@@ -173,8 +173,8 @@
         {if $password_sync}
           <input type="submit" value="Créer mon compte !" />
         {else}
-          <input type="hidden" name="response2"  value="" />
-          <input type="submit" name="create_account" value="Créer mon compte !" onclick="EnCryptedResponse(); return false;" />
+          <input type="hidden" name="pwhash" value="" />
+          <input type="submit" name="create_account" value="Créer mon compte !" onclick="return hashResponse('new1', 'new2', true);" />
         {/if}
       </td>
     </tr>
@@ -360,30 +360,31 @@
   {else}
   <tr class="impair"><td colspan="2">
     Changer le mot de passe de ton compte Google Apps&nbsp;:<br /><br />
-    <form action="googleapps/password" method="post" id="changepass">
+    <form action="googleapps/password" method="post">
+      {xsrf_token_field}
       <table class="bicol">
         <tr>
           <td class="titre">Nouveau mot de passe</td>
-          <td><input type="password" name="nouveau" /></td>
+          <td><input type="password" name="new1" /></td>
         </tr>
         <tr>
           <td class="titre">Vérification</td>
-          <td><input type="password" name="nouveau2" /></td>
+          <td><input type="password" name="new2" /></td>
         </tr>
         <tr>
           <td class="titre">Sécurité</td>
-          <td>{checkpasswd prompt="nouveau" submit="create_account" text="Changer mon mot de passe"}</td>
+          <td>{checkpasswd prompt="new1" submit="create_account" text="Changer mon mot de passe"}</td>
         </tr>
         <tr>
           <td></td>
-          <td><input type="submit" name="create_account" value="Changer" onclick="EnCryptedResponse(); return false;" /></td>
+          <td>
+            <input type="hidden" name="pwhash" value="" />
+            <input type="submit" name="create_account" value="Changer" onclick="return hashResponse('new1', 'new2', true);" />
+          </td>
         </tr>
       </table>
     </form>
-    <form action="googleapps/password" method="post" id="changepass2">
-      {xsrf_token_field}
-      <input type="hidden" name="response2"  value="" />
-    </form><br />
+    <br />
     Pour une sécurité optimale, ton mot de passe circule de manière sécurisée (https).
     Il est chiffré irréversiblement sur nos serveurs, ainsi que sur ceux de Google.
   </td></tr>

diff --git a/templates/platal/password.tpl b/templates/platal/password.tpl
index 0343c03..07b01b2 100644 (file)
--- a/templates/platal/password.tpl
+++ b/templates/platal/password.tpl
@@ -37,14 +37,15 @@
 <br />
 <fieldset style="width: 70%; margin-left: 15%">
   <legend>{icon name=lock} Saisie du nouveau mot de passe</legend>
-  <form action="{$smarty.server.REQUEST_URI}" method="post" id="changepass">
+  <form action="{$smarty.server.REQUEST_URI}" method="post">
+  {xsrf_token_field}
     <table style="width: 100%">
       <tr>
         <td class="titre">
           Mot de passe&nbsp;:
         </td>
         <td>
-          <input type="password" size="10" maxlength="256" name="nouveau" />
+          <input type="password" size="10" maxlength="256" name="new1" />
         </td>
       </tr>
       <tr>
@@ -52,7 +53,7 @@
           Retape-le une fois&nbsp;:
         </td>
         <td>
-          <input type="password" size="10" maxlength="256" name="nouveau2" />
+          <input type="password" size="10" maxlength="256" name="new2" />
         </td>
       </tr>
       <tr>
@@ -60,22 +61,17 @@
           Sécurité
         </td>
         <td>
-          {checkpasswd prompt="nouveau" submit="submitn"}
+          {checkpasswd prompt="new1" submit="submitn"}
         </td>
       </tr>
       <tr>
         <td colspan="2" class="center">
-          <input type="submit" value="Changer" name="submitn" onclick="EnCryptedResponse(); return false;" />
+          <input type="hidden" name="pwhash" value="" />
+          <input type="submit" value="Changer" name="submitn" onclick="return hashResponse('new1', 'new2', true);" />
         </td>
       </tr>
     </table>
   </form>
-  <form action="{$smarty.server.REQUEST_URI}" method="post" id="changepass2">
-  <div>
-  {xsrf_token_field}
-  <input type="hidden" name="response2"  value="" />
-  </div>
-  </form>
 </fieldset>
 
 <p>

diff --git a/templates/register/step3.tpl b/templates/register/step3.tpl
index d781942..9aad4fb 100644 (file)
--- a/templates/register/step3.tpl
+++ b/templates/register/step3.tpl
@@ -90,10 +90,10 @@
         <span class="smaller">au moins 6 caractères</span>
       </td>
       <td>
-        <input type="hidden" name="response2" />
-        <input type="password" size="10" maxlength="256" name="password" /><br/>
+        <input type="hidden" name="pwhash" />
+        <input type="password" size="10" maxlength="256" name="password1" /><br/>
         <input type="password" size="10" maxlength="256" name="password2" /> (retape ton mot de passe)<br />
-        {checkpasswd prompt="password" text="Terminer la pré-inscription"}
+        {checkpasswd prompt="password1" text="Terminer la pré-inscription"}
       </td>
     </tr>
   </table>
@@ -132,17 +132,11 @@
     </tr>
     <tr class="impair">
       <td class="center">
-        <input type="submit" name="submitn" value="Continuer" onclick="EncryptedResponseInNestedForm(); return false;" />
+        <input type="submit" name="submitn" value="Continuer" onclick="return hashResponse('password1', 'password2', true);" />
       </td>
     </tr>
   </table>
 </form>
-<form action="register" id="changepass">
-  <div>
-    <input type="hidden" name="nouveau" />
-    <input type="hidden" name="nouveau2" />
-  </div>
-</form>
 {/if}
 
 {* vim:set et sw=2 sts=2 sws=2 enc=utf-8: *}