Pb modification mot de pass
Posté : 21 sept. 2013, 18:45
Bonjour, j'ai un petit soucis au niveau de la modification de mot de pass d'un espace membre que j'essaie de créer, en effet lors de l'enregistrement du membre, le mot de pass choisi est chiffré de la forme sha1(md5($password) . s$salt)
Voici la page de modification :
voici la page de login :
Voici la page de modification :
if(isset($_SESSION['name']) && isset($_SESSION['password'])){
$affichepassword = mysql_query("SELECT * FROM `cs_profiles` WHERE `name`='".($_SESSION['name'])."' AND `password`='".($_SESSION['password'])."'");
$resultpassword = mysql_fetch_assoc($affichepassword);
extract($resultpassword);
}
if(isset($_POST['Envoyerpassword'])){
//si pseudo vide
if(empty($_POST['password'])){
echo '<div class="erreur">Veuillez saisir un password!</div>';
}
//c'est ok
else {
//On sélectionne les données
$donneespassword = mysql_query("SELECT password FROM `cs_profiles` WHERE `password`!='{$sPass}'")
or die ('Erreur :'.mysql_error());
while($resultpassword = mysql_fetch_array($donneespassword)){
//on vérifie si le pseudo est utilisé
if(($_POST['password'])== $resultpassword['password']){
echo '<div class="erreur">Ce password est utilisé!</div>'; return false;
}
}
//si c'est ok
//on modifie les données du membre
$modifpassword = mysql_query("UPDATE `cs_profiles` SET `password`='".($_POST['password'])."'
WHERE `status`='active'");
//Si il y a une erreur
if (!$modifpassword) {
die('Requête invalide : ' . mysql_error());
}
//tout est ok
else{
//on informe le membre
echo '<div class="ok">Modification password enregistrées avec succès avec succès! Vous allez être déconnecté du service pour ouvrir une nouvelle session.</div>';
echo '<script type="text/javascript"> window.setTimeout("location=(\'index.php?dec=close&session=new\');",3000) </script>';
}
}
}
voici la page de login :
<?php
class CLogin {
// constructor
function CLogin() {
session_start();
}
// get login box function
function getLoginBox() {
if (isset($_GET['logout'])) { // logout processing
if (isset($_SESSION['member_name']) && isset($_SESSION['member_pass']))
$this->performLogout();
}
if ($_POST && $_POST['Login'] == 'Login' && $_POST['username'] && $_POST['password']) { // login processing
if ($this->checkLogin($_POST['username'], $_POST['password'], false)) { // successful login
$this->performLogin($_POST['username'], $_POST['password']);
header( "Location:{$_SERVER['REQUEST_URI']}" );
exit;
} else { // wrong login
return file_get_contents('templates/login_form.html') . '<h2>Username or Password is incorrect</h2>';
}
} else { // in case if we already logged (on refresh page):
if (isset($_SESSION['member_name']) && $_SESSION['member_name'] && $_SESSION['member_pass']) {
$aReplaces = array(
'{name}' => $_SESSION['member_name'],
'{status}' => $_SESSION['member_status'],
'{role}' => $_SESSION['member_role'],
);
return strtr(file_get_contents('templates/logout_form.html'), $aReplaces);
}
// otherwise - draw login form
return file_get_contents('templates/login_form.html');
}
}
// perform login
function performLogin($sName, $sPass) {
$this->performLogout();
// make variables safe
$sName = $GLOBALS['MySQL']->escape($sName);
$aProfile = $GLOBALS['MySQL']->getRow("SELECT * FROM `cs_profiles` WHERE `name`='{$sName}'");
// $sPassEn = $aProfile['password'];
$iPid = $aProfile['id'];
$sSalt = $aProfile['salt'];
$sStatus = $aProfile['status'];
$sRole = $aProfile['role'];
$sPass = sha1(md5($sPass) . $sSalt);
$_SESSION['member_id'] = $iPid;
$_SESSION['member_name'] = $sName;
$_SESSION['member_pass'] = $sPass;
$_SESSION['member_status'] = $sStatus;
$_SESSION['member_role'] = $sRole;
}
// perform logout
function performLogout() {
unset($_SESSION['member_id']);
unset($_SESSION['member_name']);
unset($_SESSION['member_pass']);
unset($_SESSION['member_status']);
unset($_SESSION['member_role']);
}
// check login
function checkLogin($sName, $sPass, $isHash = true) {
// make variables safe
$sName = $GLOBALS['MySQL']->escape($sName);
$sPass = $GLOBALS['MySQL']->escape($sPass);
$aProfile = $GLOBALS['MySQL']->getRow("SELECT * FROM `cs_profiles` WHERE `name`='{$sName}'");
$sPassEn = $aProfile['password'];
if ($sName && $sPass && $sPassEn) {
if (! $isHash) {
$sSalt = $aProfile['salt'];
$sPass = sha1(md5($sPass) . $sSalt);
}
return ($sPass == $sPassEn);
}
return false;
}
}
$GLOBALS['CLogin'] = new CLogin();