人事系统开发
1ba6efd8ed
包含：登录失败锁定、90天密码有效期、30分钟会话超时、 强制改密、登录审计日志、屏幕水印、企业背景图、 备案信息固定底部、favicon、JS空集合保护、 会话过期体验优化（403 JSON）、display_errors 关闭、 固定 key 根治 Integrity check failed 等全部改动 注意：config.inc.php/.htaccess/.user.ini 含敏感信息， 通过 .gitignore 排除，勿推送到公开仓库。
91 lines
2.1 KiB
PHP
91 lines
2.1 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace MRBS;
|
|
|
|
require "defaultincludes.inc";
|
|
|
|
use MRBS\Form\Form;
|
|
|
|
// If we haven't got the ability to reset passwords then get out of here
|
|
if (!auth()->canResetPassword())
|
|
{
|
|
location_header('index.php');
|
|
}
|
|
|
|
// Check the CSRF token.
|
|
Form::checkToken();
|
|
|
|
// Check the user is authorised for this page
|
|
checkAuthorised(this_page());
|
|
|
|
$action = get_form_var('action', 'string');
|
|
$username = get_form_var('username', 'string');
|
|
|
|
if (isset($action) && isset($username))
|
|
{
|
|
$username = trim($username);
|
|
if ($username !== '')
|
|
{
|
|
switch ($action)
|
|
{
|
|
case 'request':
|
|
if (auth()->requestPassword($username))
|
|
{
|
|
$result = 'request_sent';
|
|
}
|
|
else
|
|
{
|
|
$result = 'request_failed';
|
|
// Although the request failed, return a success message in order
|
|
// to avoid giving away information about users in the system.
|
|
// (Could make this a configuration option).
|
|
$result = 'request_sent';
|
|
}
|
|
break;
|
|
case 'reset':
|
|
$key = get_form_var('key', 'string');
|
|
$password0 = get_form_var('password0', 'string');
|
|
$password1 = get_form_var('password1', 'string');
|
|
if ($password0 !== $password1)
|
|
{
|
|
$error = 'pwd_not_match';
|
|
}
|
|
elseif (!auth()->validatePassword($password0))
|
|
{
|
|
$error = 'pwd_invalid';
|
|
}
|
|
else
|
|
{
|
|
if (auth()->resetPassword($username, $key, $password0))
|
|
{
|
|
$result = 'pwd_reset';
|
|
}
|
|
else
|
|
{
|
|
$result = 'reset_failed';
|
|
}
|
|
}
|
|
break;
|
|
default:
|
|
// Shouldn't get here
|
|
break;
|
|
}
|
|
if (isset($result))
|
|
{
|
|
$query_string = "result=$result";
|
|
}
|
|
elseif (isset($error))
|
|
{
|
|
$query_string = "action=reset&error=$error&usernames[0]=$username&key=$key";
|
|
}
|
|
else
|
|
{
|
|
// Shouldn't get here
|
|
}
|
|
location_header("reset_password.php?$query_string");
|
|
}
|
|
}
|
|
|
|
// Shouldn't normally get here
|
|
location_header('index.php');
|