FM / includes

/home/techb158/workloadmatch.com/workloadmatch.com/BackUp/includes/

/home/techb158/workloadmatch.com/workloadmatch.com/BackUp/includes

Name	Size	Mode	Actions
CSRF_Protect.php	2188	0644	edit dl rm
db_connect.php	694	0644	edit dl rm
error.php	451	0644	edit dl rm
error_log	2418	0644	edit dl rm
forgetpassword.php	6831	0644	edit dl rm
functions.php	24162	0644	edit dl rm
geoiploc.php	2520435	0644	edit dl rm
hex.php	1050	0644	edit dl rm
hexbin.php	942	0644	edit dl rm
logout.php	794	0644	edit dl rm
process_login.php	2884	0644	edit dl rm
process_login_Remove rechaptcha.php	2891	0644	edit dl rm
psl-config.php	1687	0644	edit dl rm
register.inc.php	3304	0644	edit dl rm
register.php	26322	0644	edit dl rm
reset.php	6154	0644	edit dl rm

Edit: /home/techb158/workloadmatch.com/workloadmatch.com/BackUp/includes/register.inc.php (3304B)

<?php

/* 
 * Copyright (C) 2013 peter
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */

include_once 'db_connect.php';
include_once 'psl-config.php';

$error_msg = "";

if (isset($_POST['username'], $_POST['email'], $_POST['p'])) {
 // Sanitize and validate the data passed in
 $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
 $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);
 $email = filter_var($email, FILTER_VALIDATE_EMAIL);
 if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
 // Not a valid email
 $error_msg .= 'The email address you entered is not valid';
 }
 
 $password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING);
 if (strlen($password) != 128) {
 // The hashed pwd should be 128 characters long.
 // If it's not, something really odd has happened
 $error_msg .= 'Invalid password configuration.';
 }

// Username validity and password validity have been checked client side.
 // This should should be adequate as nobody gains any advantage from
 // breaking these rules.
 //
 
 $prep_stmt = "SELECT ID FROM Admin WHERE Email = ? LIMIT 1";
 $stmt = $mysqli->prepare($prep_stmt);
 
 if ($stmt) {
 $stmt->bind_param('s', $email);
 $stmt->execute();
 $stmt->store_result();
 
 if ($stmt->num_rows == 1) {
 // A user with this email address already exists
 $error_msg .= 'A user with this email address already exists.';
 }
 } else {
 $error_msg .= 'Database error';
 }
 
 // TODO: 
 // We'll also have to account for the situation where the user doesn't have
 // rights to do registration, by checking what type of user is attempting to
 // perform the operation.

if (empty($error_msg)) {
        // Create a random salt
        $random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE));

// Create salted password 
        $password = hash('sha512', $password . $random_salt);

// Insert the new user into the database 
        if ($insert_stmt = $mysqli->prepare("INSERT INTO Admin (Username, Email, Password, salt) VALUES (?, ?, ?, ?)")) {
            $insert_stmt->bind_param('ssss', $username, $email, $password, $random_salt);
            // Execute the prepared query.
            if (! $insert_stmt->execute()) {
                header('Location: ../error.php?err=Registration failure: INSERT');
                exit();
            }
        }
        header('Location: ./register_success.php');
        exit();
    }
}

. */ include_once 'db_connect.php'; include_once 'psl-config.php'; $error_msg = ""; if (isset($_POST['username'], $_POST['email'], $_POST['p'])) { // Sanitize and validate the data passed in $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING); $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL); $email = filter_var($email, FILTER_VALIDATE_EMAIL); if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { // Not a valid email $error_msg .= '

The email address you entered is not valid

'; } $password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING); if (strlen($password) != 128) { // The hashed pwd should be 128 characters long. // If it's not, something really odd has happened $error_msg .= '

Invalid password configuration.

'; } // Username validity and password validity have been checked client side. // This should should be adequate as nobody gains any advantage from // breaking these rules. // $prep_stmt = "SELECT ID FROM Admin WHERE Email = ? LIMIT 1"; $stmt = $mysqli->prepare($prep_stmt); if ($stmt) { $stmt->bind_param('s', $email); $stmt->execute(); $stmt->store_result(); if ($stmt->num_rows == 1) { // A user with this email address already exists $error_msg .= '

A user with this email address already exists.

'; } } else { $error_msg .= '

Database error

'; } // TODO: // We'll also have to account for the situation where the user doesn't have // rights to do registration, by checking what type of user is attempting to // perform the operation. if (empty($error_msg)) { // Create a random salt $random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE)); // Create salted password $password = hash('sha512', $password . $random_salt); // Insert the new user into the database if ($insert_stmt = $mysqli->prepare("INSERT INTO Admin (Username, Email, Password, salt) VALUES (?, ?, ?, ?)")) { $insert_stmt->bind_param('ssss', $username, $email, $password, $random_salt); // Execute the prepared query. if (! $insert_stmt->execute()) { header('Location: ../error.php?err=Registration failure: INSERT'); exit(); } } header('Location: ./register_success.php'); exit(); } }