diff --git a/nginx.conf b/nginx.conf index 6f616ef590..d07794342b 100644 --- a/nginx.conf +++ b/nginx.conf @@ -129,7 +129,7 @@ server { rewrite admin/api/(.*) /admin/api/index.php last; # Administration pages - rewrite admin/(attachments|backup|backup/export|backup/restore|configuration|elasticsearch|export|import|instance/edit|instance/update|instances|session-keep-alive|stopwords|system|update) /admin/front.php last; + rewrite admin/(attachments|backup|backup/export|backup/restore|configuration|elasticsearch|export|import|instance/edit|instance/update|instances|password|session-keep-alive|stopwords|system|update) /admin/front.php last; # REST API v3.0 and v3.1 rewrite ^api/v3\.[01]/(.*) /api/index.php last; diff --git a/phpmyfaq/.htaccess b/phpmyfaq/.htaccess index 93ed7c03bd..c7c500ea7e 100644 --- a/phpmyfaq/.htaccess +++ b/phpmyfaq/.htaccess @@ -143,7 +143,7 @@ Header set Access-Control-Allow-Headers "Content-Type, Authorization" # Administration API RewriteRule ^admin/api/(.*) admin/api/index.php [L,QSA] # Administration pages - RewriteRule ^admin/(attachments|backup|backup/export|backup/restore|configuration|elasticsearch|export|import|instance/edit|instance/update|instances|session-keep-alive|stopwords|system|update) admin/front.php [L,QSA] + RewriteRule ^admin/(attachments|backup|backup/export|backup/restore|configuration|elasticsearch|export|import|instance/edit|instance/update|instances|password|session-keep-alive|stopwords|system|update) admin/front.php [L,QSA] # Private APIs RewriteRule ^api/(autocomplete|bookmark/delete|bookmark/create|user/data/update|user/password/update|user/request-removal|user/remove-twofactor|contact|voting|register|captcha|share|comment/create|faq/create|question/create|webauthn/prepare|webauthn/register|webauthn/prepare-login|webauthn/login) api/index.php [L,QSA] # Setup APIs diff --git a/phpmyfaq/admin/header.php b/phpmyfaq/admin/header.php index 6eb3fc0006..814319eab0 100644 --- a/phpmyfaq/admin/header.php +++ b/phpmyfaq/admin/header.php @@ -166,7 +166,6 @@ switch ($action) { case 'user': case 'group': - case 'passwd': case 'cookies': $userPage = true; break; diff --git a/phpmyfaq/admin/index.php b/phpmyfaq/admin/index.php index 63e364d03d..b8e3b42212 100755 --- a/phpmyfaq/admin/index.php +++ b/phpmyfaq/admin/index.php @@ -329,10 +329,6 @@ case 'glossary': require 'glossary.php'; break; - // functions for password administration - case 'passwd': - require 'password.change.php'; - break; // functions for session administration case 'adminlog': require 'statistics.admin-log.php'; diff --git a/phpmyfaq/admin/password.change.php b/phpmyfaq/admin/password.change.php deleted file mode 100644 index 030af3d143..0000000000 --- a/phpmyfaq/admin/password.change.php +++ /dev/null @@ -1,88 +0,0 @@ - - * @copyright 2003-2024 phpMyFAQ Team - * @license https://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0 - * @link https://www.phpmyfaq.de - * @since 2003-02-23 - */ - -use phpMyFAQ\Auth; -use phpMyFAQ\Configuration; -use phpMyFAQ\Enums\PermissionType; -use phpMyFAQ\Filter; -use phpMyFAQ\Session\Token; -use phpMyFAQ\Template\TwigWrapper; -use phpMyFAQ\Translation; -use phpMyFAQ\User\CurrentUser; - -if (!defined('IS_VALID_PHPMYFAQ')) { - http_response_code(400); - exit(); -} - -$faqConfig = $container->get('phpmyfaq.configuration'); -$user = CurrentUser::getCurrentUser($faqConfig); - -$twig = new TwigWrapper(PMF_ROOT_DIR . '/assets/templates'); -$template = $twig->loadTemplate('@admin/user/password.change.twig'); - -if ($user->perm->hasPermission($user->getUserId(), PermissionType::PASSWORD_CHANGE->value)) { - // If we have to save a new password, do that first - $save = Filter::filterInput(INPUT_POST, 'save', FILTER_SANITIZE_SPECIAL_CHARS); - $csrfToken = Filter::filterInput(INPUT_POST, 'csrf', FILTER_SANITIZE_SPECIAL_CHARS); - $successMessage = $errorMessage = ''; - - if (!is_null($save) && Token::getInstance($container->get('session'))->verifyToken('password', $csrfToken)) { - // Define the (Local/Current) Authentication Source - $auth = new Auth($faqConfig); - $authSource = $auth->selectAuth($user->getAuthSource('name')); - $authSource->getEncryptionContainer($user->getAuthData('encType')); - $authSource->setReadOnly($user->getAuthData('readOnly')); - - $oldPassword = Filter::filterInput(INPUT_POST, 'faqpassword_old', FILTER_SANITIZE_SPECIAL_CHARS); - $newPassword = Filter::filterInput(INPUT_POST, 'faqpassword', FILTER_SANITIZE_SPECIAL_CHARS); - $retypedPassword = Filter::filterInput(INPUT_POST, 'faqpassword_confirm', FILTER_SANITIZE_SPECIAL_CHARS); - - if (strlen((string) $newPassword) <= 7 || strlen((string) $retypedPassword) <= 7) { - $errorMessage = Translation::get('ad_passwd_fail'); - } else { - if ( - ($authSource->checkCredentials( - $user->getLogin(), - $oldPassword - )) && ($newPassword == $retypedPassword) - ) { - if (!$user->changePassword($newPassword)) { - $errorMessage = Translation::get('ad_passwd_fail'); - } - $successMessage = Translation::get('ad_passwdsuc'); - } else { - $errorMessage = Translation::get('ad_passwd_fail'); - } - } - } - - $templateVars = [ - 'adminHeaderPasswordChange' => Translation::get('ad_passwd_cop'), - 'successMessage' => $successMessage, - 'errorMessage' => $errorMessage, - 'csrfToken' => Token::getInstance($container->get('session'))->getTokenString('password'), - 'adminMsgOldPassword' => Translation::get('ad_passwd_old'), - 'adminMsgNewPassword' => Translation::get('ad_passwd_new'), - 'adminMsgNewPasswordConfirm' => Translation::get('ad_passwd_con'), - 'adminMsgButtonNewPassword' => Translation::get('ad_passwd_change') - ]; - - echo $template->render($templateVars); -} else { - require __DIR__ . '/no-permission.php'; -} diff --git a/phpmyfaq/assets/templates/admin/header.twig b/phpmyfaq/assets/templates/admin/header.twig index 02e9e06647..4f6a042a94 100644 --- a/phpmyfaq/assets/templates/admin/header.twig +++ b/phpmyfaq/assets/templates/admin/header.twig @@ -76,7 +76,7 @@