Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

* Finish task #3204.

Browse Source
This commit is contained in:
pengjiangxiu
2017-09-08 14:21:12 +08:00
parent fec29072d9
commit a1570d6b75
14 changed files with 67 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
module/common/model.php
+1
View File
@@ -1137,6 +1137,7 @@ class commonModel extends model
$acls = $app->user->rights['acls'];
$module = strtolower($module);
$method = strtolower($method);
if(isset($rights[$module][$method]))
{
if(empty($acls['views'])) return true;
module/my/control.php
+1
View File
@@ -338,6 +338,7 @@ class my extends control
$this->view->title = $this->lang->my->common . $this->lang->colon . $this->lang->my->editProfile;
$this->view->position[] = $this->lang->my->editProfile;
$this->view->user = $this->user->getById($this->app->user->account);
$this->view->rand = $this->user->updateSessionRandom();
$this->display();
}
module/my/js/editprofile.js
+9
View File
@@ -0,0 +1,9 @@
$(document).ready(function()
{
$('#dataform').submit(function()
{
var password = $('input#verifyPassword').val();
var rand = $('input#verifyRand').val();
$('input#verifyPassword').val(md5(md5(password) + rand));
});
});
module/my/view/editprofile.html.php
+3 -1
View File
@@ -12,11 +12,12 @@
?>
<?php include '../../common/view/header.html.php';?>
<?php include '../../common/view/datepicker.html.php';?>
<?php js::import($jsRoot . 'md5.js');?>
<div class='container mw-800px'>
<div id='titlebar'>
<div class='heading'><i class='icon-pencil'></i> <?php echo $lang->my->editProfile;?></div>
</div>
<form method='post' target='hiddenwin' class='form-condensed'>
<form method='post' target='hiddenwin' class='form-condensed' id='dataform'>
<fieldset>
<legend><?php echo $lang->my->form->lblBasic;?></legend>
<table class='table table-form'>
@@ -113,6 +114,7 @@
</fieldset>
<div class='text-center'><?php echo html::submitButton() . ' &nbsp; ' . html::backButton();?></div>
</form>
<?php echo html::hidden('verifyRand', $rand);?>
</div>
<?php js::set('passwordStrengthList', $lang->user->passwordStrengthList)?>
<script>
module/user/control.php
+10 -3
View File
@@ -414,6 +414,7 @@ class user extends control
$this->view->groupList = $groupList;
$this->view->roleGroup = $roleGroup;
$this->view->deptID = $deptID;
$this->view->rand = $this->user->updateSessionRandom();
$this->display();
}
@@ -460,6 +461,7 @@ class user extends control
$this->view->deptID = $deptID;
$this->view->groupList = $groupList;
$this->view->roleGroup = $roleGroup;
$this->view->rand = $this->user->updateSessionRandom();
$this->display();
}
@@ -494,7 +496,8 @@ class user extends control
$this->view->depts = $this->dept->getOptionMenu();
$this->view->userGroups = implode(',', array_keys($userGroups));
$this->view->groups = $this->loadModel('group')->getPairs();
$this->view->rand = $this->user->updateSessionRandom();
$this->display();
}
@@ -528,6 +531,8 @@ class user extends control
$this->view->title = $this->lang->company->common . $this->lang->colon . $this->lang->user->batchEdit;
$this->view->position[] = $this->lang->user->batchEdit;
$this->view->depts = $this->dept->getOptionMenu();
$this->view->rand = $this->user->updateSessionRandom();
$this->display();
}
@@ -545,7 +550,7 @@ class user extends control
if($this->app->user->admin and $this->app->user->account == $user->account) return;
if($_POST)
{
if(md5($this->post->verifyPassword) != $this->app->user->password) die(js::alert($this->lang->user->error->verifyPassword));
if($this->post->verifyPassword != md5($this->app->user->password . $this->session->rand)) die(js::alert($this->lang->user->error->verifyPassword));
$this->user->delete(TABLE_USER, $userID);
if(!dao::isError())
{
@@ -571,6 +576,7 @@ class user extends control
die(js::locate($this->session->userList, 'parent.parent'));
}
$this->view->rand = $this->user->updateSessionRandom();
$this->display();
}
@@ -760,7 +766,7 @@ class user extends control
}
}
else
{
{
if(!empty($this->config->global->showDemoUsers))
{
$demoUsers = $this->user->getPairs('noletter|noempty|noclosed|nodeleted');
@@ -773,6 +779,7 @@ class user extends control
$this->view->referer = $this->referer;
$this->view->s = zget($this->config->global, 'sn', '');
$this->view->keepLogin = $this->cookie->keepLogin ? $this->cookie->keepLogin : 'off';
$this->view->rand = $this->user->updateSessionRandom();
$this->display();
}
}
module/user/js/common.js
+10
View File
@@ -6,6 +6,16 @@
* @access public
* @return void
*/
$(document).ready(function()
{
$('#dataform').submit(function()
{
var password = $('input#verifyPassword').val();
var rand = $('input#verifyRand').val();
$('input#verifyPassword').val(md5(md5(password) + rand));
});
});
function switchAccount(account, method)
{
if(method == 'dynamic')
module/user/js/login.js
+2 -1
View File
@@ -21,6 +21,7 @@ $(document).ready(function()
$('#login-form form').submit(function()
{
var password = $('input:password').val();
if(password.length != 32 && typeof(md5) == 'function') $('input:password').val(md5(password));
var rand = $('input#verifyRand').val();
if(password.length != 32 && typeof(md5) == 'function') $('input:password').val(md5(md5(password) + rand));
});
})
module/user/model.php
+19 -5
View File
@@ -221,7 +221,7 @@ class userModel extends model
return false;
}
if(empty($_POST['verifyPassword']) or md5($this->post->verifyPassword) != $this->app->user->password)
if(empty($_POST['verifyPassword']) or $this->post->verifyPassword != md5($this->app->user->password . $this->session->rand))
{
dao::$errors['verifyPassword'][] = $this->lang->user->error->verifyPassword;
return false;
@@ -258,7 +258,7 @@ class userModel extends model
*/
public function batchCreate()
{
if(empty($_POST['verifyPassword']) or md5($this->post->verifyPassword) != $this->app->user->password) die(js::alert($this->lang->user->error->verifyPassword));
if(empty($_POST['verifyPassword']) or $this->post->verifyPassword != md5($this->app->user->password . $this->session->rand)) die(js::alert($this->lang->user->error->verifyPassword));
$users = fixer::input('post')->get();
$data = array();
@@ -369,7 +369,7 @@ class userModel extends model
return false;
}
if(empty($_POST['verifyPassword']) or md5($this->post->verifyPassword) != $this->app->user->password)
if(empty($_POST['verifyPassword']) or $this->post->verifyPassword != md5($this->app->user->password . $this->session->rand))
{
dao::$errors['verifyPassword'][] = $this->lang->user->error->verifyPassword;
return false;
@@ -420,16 +420,30 @@ class userModel extends model
}
}
/**
* update session random.
*
* @access public
* @return void
*/
public function updateSessionRandom()
{
$random = mt_rand();
$this->session->set('rand', $random);
return $random;
}
/**
* Batch edit user.
*
*
* @access public
* @return void
*/
public function batchEdit()
{
$data = fixer::input('post')->get();
if(empty($_POST['verifyPassword']) or md5($this->post->verifyPassword) != $this->app->user->password) die(js::alert($this->lang->user->error->verifyPassword));
if(empty($_POST['verifyPassword']) or $this->post->verifyPassword != md5($this->app->user->password . $this->session->rand)) die(js::alert($this->lang->user->error->verifyPassword));
$oldUsers = $this->dao->select('id, account, email')->from(TABLE_USER)->where('id')->in(array_keys($data->account))->fetchAll('id');
$accountGroup = $this->dao->select('id, account')->from(TABLE_USER)->where('account')->in($data->account)->fetchGroup('account', 'id');
module/user/view/batchcreate.html.php
+2
View File
@@ -12,6 +12,7 @@
?>
<?php include '../../common/view/header.html.php';?>
<?php include '../../common/view/datepicker.html.php';?>
<?php js::import($jsRoot . 'md5.js');?>
<?php js::set('roleGroup', $roleGroup);?>
<div id='titlebar'>
<div class='heading'>
@@ -101,6 +102,7 @@ $minWidth = (count($visibleFields) > 5) ? 'w-150px' : '';
<tr><td colspan='<?php echo count($visibleFields) + 6?>' class='text-center'><?php echo html::submitButton() . html::backButton();?></td></tr>
</table>
</form>
<?php echo html::hidden('verifyRand', $rand);?>
<?php $customLink = $this->createLink('custom', 'ajaxSaveCustomFields', 'module=user&section=custom&key=batchCreateFields')?>
<?php include '../../common/view/customfield.html.php';?>
<?php include '../../common/view/footer.html.php';?>
module/user/view/batchedit.html.php
+2
View File
@@ -12,6 +12,7 @@
?>
<?php include '../../common/view/header.html.php';?>
<?php include '../../common/view/datepicker.html.php';?>
<?php js::import($jsRoot . 'md5.js');?>
<div id='titlebar'>
<div class='heading'>
<span class='prefix'><?php echo html::icon($lang->icons['user']);?></span>
@@ -93,6 +94,7 @@ $minWidth = (count($visibleFields) > 7) ? 'w-120px' : '';
<tr><td colspan='<?php echo count($visibleFields) + 4?>' class='text-center'><?php echo html::submitButton() . html::backButton();?></td></tr>
</table>
</form>
<?php echo html::hidden('verifyRand', $rand);?>
<?php $customLink = $this->createLink('custom', 'ajaxSaveCustomFields', 'module=user&section=custom&key=batchEditFields')?>
<?php include '../../common/view/customfield.html.php';?>
<?php include '../../common/view/footer.html.php';?>
module/user/view/create.html.php
+2 -1
View File
@@ -12,6 +12,7 @@
?>
<?php include '../../common/view/header.html.php';?>
<?php include '../../common/view/datepicker.html.php';?>
<?php js::import($jsRoot . 'md5.js');?>
<?php if(!empty($config->safe->mode)) $lang->user->placeholder->password1 = $lang->user->placeholder->passwordStrength[$config->safe->mode]?>
<?php js::set('holders', $lang->user->placeholder);?>
<?php js::set('roleGroup', $roleGroup);?>
@@ -83,10 +84,10 @@
<?php echo html::password('verifyPassword', '', "class='form-control disabled-ie-placeholder' autocomplete='off' placeholder='{$lang->user->placeholder->verify}'");?>
</td>
</tr>
<tr><th></th><td><?php echo html::submitButton() . html::backButton();?></td></tr>
</table>
</form>
<?php echo html::hidden('verifyRand', $rand);?>
</div>
<?php js::set('passwordStrengthList', $lang->user->passwordStrengthList)?>
<?php include '../../common/view/footer.html.php';?>
module/user/view/delete.html.php
+3 -1
View File
@@ -11,12 +11,13 @@
*/
?>
<?php include '../../common/view/header.lite.html.php';?>
<?php js::import($jsRoot . 'md5.js');?>
<div id='titlebar'>
<div class='heading'>
<strong><?php echo $lang->user->delete;?></strong>
</div>
</div>
<form class='form-condensed' method='post' target='hiddenwin' style='padding: 20px 5% 40px'>
<form class='form-condensed' method='post' id='dataform' target='hiddenwin' style='padding: 20px 5% 40px'>
<table class='w-p100 table-form'>
<tr>
<th class='w-120px text-right'>
@@ -30,4 +31,5 @@
</tr>
</table>
</form>
<?php echo html::hidden('verifyRand', $rand);?>
<?php include '../../common/view/footer.lite.html.php';?>
module/user/view/edit.html.php
+2
View File
@@ -12,6 +12,7 @@
?>
<?php include '../../common/view/header.html.php';?>
<?php include '../../common/view/datepicker.html.php';?>
<?php js::import($jsRoot . 'md5.js');?>
<div class='container mw-800px'>
<div id='titlebar'>
<div class='heading'>
@@ -115,6 +116,7 @@
<tr><td colspan='2' class='text-center'><?php echo html::submitButton() . html::backButton();?></td></tr>
</table>
</form>
<?php echo html::hidden('verifyRand', $rand);?>
</div>
<?php js::set('passwordStrengthList', $lang->user->passwordStrengthList)?>
<?php include '../../common/view/footer.html.php';?>
module/user/view/login.html.php
+1
View File
@@ -74,6 +74,7 @@ if(empty($config->notMd5Pwd))js::import($jsRoot . 'md5.js');
<?php if($config->checkVersion):?>
<iframe id='updater' class='hidden' frameborder='0' width='100%' scrolling='no' allowtransparency='true' src="http://api.zentao.net/updater-isLatest-<?php echo $config->version;?>-<?php echo $s;?>.html?lang=<?php echo str_replace('-', '_', $this->app->getClientLang())?>"></iframe>
<?php endif;?>
<?php echo html::hidden('verifyRand', $rand);?>
</div>
</div>
<?php include '../../common/view/footer.lite.html.php';?>