private/desktop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adasd
All checks were successful
Deploy / deploy-staging (push) Successful in 25s
Details
Deploy / deploy-production (push) Has been skipped
Details

Browse Source
This commit is contained in:
Lars Gebhardt-Kusche
2026-06-15 21:27:08 +02:00
parent 7476f09d19
commit 94ea3c58af
8 changed files with 332 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
public/auth/forgot-password/index.php
View File

@@ -5,23 +5,49 @@ declare(strict_types=1);
require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
use App\ConfigLoader;
use App\PublicFormProtection;
use App\RegistrationService;
session_start();
$projectRoot = dirname(__DIR__, 3);
$registration = new RegistrationService($projectRoot, ConfigLoader::load($projectRoot, 'registration'));
$registrationConfig = ConfigLoader::load($projectRoot, 'registration');
$registration = new RegistrationService($projectRoot, $registrationConfig);
$formProtection = new PublicFormProtection($projectRoot, $registrationConfig);
$message = null;
$error = null;
$username = '';
$csrfToken = (string) ($_SESSION['forgot_password_form_token'] ?? '');
$honeypotField = $formProtection->honeypotField();
if ($csrfToken === '') {
$csrfToken = bin2hex(random_bytes(16));
$_SESSION['forgot_password_form_token'] = $csrfToken;
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$username = trim((string) ($_POST['username'] ?? ''));
$origin = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http') . '://' . ($_SERVER['HTTP_HOST'] ?? 'localhost');
$result = $registration->sendPasswordReset($username, $origin);
$postedToken = (string) ($_POST['csrf_token'] ?? '');
if ($result['success'] ?? false) {
$message = (string) ($result['message'] ?? '');
if ($postedToken === '' || !hash_equals($csrfToken, $postedToken)) {
$error = 'Die Formularprüfung ist fehlgeschlagen. Bitte versuche es erneut.';
} else {
$error = (string) ($result['message'] ?? '');
$protection = $formProtection->guard('password_reset', $_POST);
if (!($protection['success'] ?? false)) {
$error = implode(' ', array_map('strval', (array) ($protection['errors'] ?? [])));
} else {
$origin = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http') . '://' . ($_SERVER['HTTP_HOST'] ?? 'localhost');
$result = $registration->sendPasswordReset($username, $origin);
if ($result['success'] ?? false) {
$message = (string) ($result['message'] ?? '');
$csrfToken = bin2hex(random_bytes(16));
$_SESSION['forgot_password_form_token'] = $csrfToken;
} else {
$error = (string) ($result['message'] ?? '');
}
}
}
}
?><!DOCTYPE html>
@@ -38,7 +64,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
<div class="login-panel-top">
<p class="login-kicker">Kusche.Berlin</p>
<h1>Passwort vergessen</h1>
<p class="login-copy">Gib deinen Benutzernamen an. Wenn der LDAP-Benutzer eine E-Mail-Adresse hat, senden wir einen 8 Stunden gültigen Reset-Link.</p>
<p class="login-copy">Gib deinen Benutzernamen an. Wenn für das Konto eine E-Mail-Adresse hinterlegt ist, senden wir einen 8 Stunden gültigen Link zum Zurücksetzen.</p>
</div>
<?php if ($message !== null): ?>
@@ -50,6 +76,14 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
<?php endif; ?>
<form class="login-form" method="post" action="/auth/forgot-password/">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken, ENT_QUOTES) ?>">
<div class="login-honeypot" aria-hidden="true">
<label>
<span>Website</span>
<input type="text" name="<?= htmlspecialchars($honeypotField, ENT_QUOTES) ?>" value="" tabindex="-1" autocomplete="off">
</label>
</div>
<label class="login-field">
<span>Benutzername</span>
<input type="text" name="username" value="<?= htmlspecialchars($username, ENT_QUOTES) ?>" required>