FM / includes

/home/techb158/immovalet.ca/report/includes/

/home/techb158/immovalet.ca/report/includes

Name	Size	Mode	Actions
db_connect.php	7824	0666	edit dl rm
db_connects.php	292	0666	edit dl rm
forgetpassword.php	4105	0666	edit dl rm
functions.php	17179	0666	edit dl rm
functions1.php	12247	0666	edit dl rm
logout.php	722	0666	edit dl rm
process_login.php	2203	0666	edit dl rm
psl-config.php	2196	0666	edit dl rm
psl-config 1.php	2107	0666	edit dl rm
psl-config3.php	2107	0666	edit dl rm
psl-configs.php	1674	0666	edit dl rm
register-client.php	7543	0666	edit dl rm
register.inc.php	3390	0666	edit dl rm
register.php	27274	0666	edit dl rm
registerclient.php	8859	0666	edit dl rm
requestsubmission.php	23523	0666	edit dl rm
reset.php	3984	0666	edit dl rm

Edit: /home/techb158/immovalet.ca/report/includes/register.inc.php (3390B)

<?php

/* 
 * Copyright (C) 2013 peter
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */

include_once 'db_connect.php';
include_once 'psl-config.php';

$error_msg = "";

if (isset($_POST['username'], $_POST['email'], $_POST['p'])) {
 // Sanitize and validate the data passed in
 $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
 $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);
 $email = filter_var($email, FILTER_VALIDATE_EMAIL);
 if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
 // Not a valid email
 $error_msg .= 'The email address you entered is not valid';
 }
 
 $password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING);
 if (strlen($password) != 128) {
 // The hashed pwd should be 128 characters long.
 // If it's not, something really odd has happened
 $error_msg .= 'Invalid password configuration.';
 }

// Username validity and password validity have been checked client side.
 // This should should be adequate as nobody gains any advantage from
 // breaking these rules.
 //
 
 $prep_stmt = "SELECT ID FROM Admin WHERE Email = ? LIMIT 1";
 $stmt = $mysqli->prepare($prep_stmt);
 
 if ($stmt) {
 $stmt->bind_param('s', $email);
 $stmt->execute();
 $stmt->store_result();
 
 if ($stmt->num_rows == 1) {
 // A user with this email address already exists
 $error_msg .= 'A user with this email address already exists.';
 }
 } else {
 $error_msg .= 'Database error';
 }
 
 // TODO: 
 // We'll also have to account for the situation where the user doesn't have
 // rights to do registration, by checking what type of user is attempting to
 // perform the operation.

if (empty($error_msg)) {
        // Create a random salt
        $random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE));

// Create salted password 
        $password = hash('sha512', $password . $random_salt);

// Insert the new user into the database 
        if ($insert_stmt = $mysqli->prepare("INSERT INTO Admin (Username, Email, Password, salt) VALUES (?, ?, ?, ?)")) {
            $insert_stmt->bind_param('ssss', $username, $email, $password, $random_salt);
            // Execute the prepared query.
            if (! $insert_stmt->execute()) {
                header('Location: ../error.php?err=Registration failure: INSERT');
                exit();
            }
        }
        header('Location: ./register_success.php');
        exit();
    }
}

. */ include_once 'db_connect.php'; include_once 'psl-config.php'; $error_msg = ""; if (isset($_POST['username'], $_POST['email'], $_POST['p'])) { // Sanitize and validate the data passed in $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING); $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL); $email = filter_var($email, FILTER_VALIDATE_EMAIL); if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { // Not a valid email $error_msg .= '

The email address you entered is not valid

'; } $password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING); if (strlen($password) != 128) { // The hashed pwd should be 128 characters long. // If it's not, something really odd has happened $error_msg .= '

Invalid password configuration.

'; } // Username validity and password validity have been checked client side. // This should should be adequate as nobody gains any advantage from // breaking these rules. // $prep_stmt = "SELECT ID FROM Admin WHERE Email = ? LIMIT 1"; $stmt = $mysqli->prepare($prep_stmt); if ($stmt) { $stmt->bind_param('s', $email); $stmt->execute(); $stmt->store_result(); if ($stmt->num_rows == 1) { // A user with this email address already exists $error_msg .= '

A user with this email address already exists.

'; } } else { $error_msg .= '

Database error

'; } // TODO: // We'll also have to account for the situation where the user doesn't have // rights to do registration, by checking what type of user is attempting to // perform the operation. if (empty($error_msg)) { // Create a random salt $random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE)); // Create salted password $password = hash('sha512', $password . $random_salt); // Insert the new user into the database if ($insert_stmt = $mysqli->prepare("INSERT INTO Admin (Username, Email, Password, salt) VALUES (?, ?, ?, ?)")) { $insert_stmt->bind_param('ssss', $username, $email, $password, $random_salt); // Execute the prepared query. if (! $insert_stmt->execute()) { header('Location: ../error.php?err=Registration failure: INSERT'); exit(); } } header('Location: ./register_success.php'); exit(); } }