markzz/aurweb.git/web/html/account.php, branch v2.2.1

Enforce e-mail validation during registration

2013-03-19T13:03:34Z

Remove the password field from the account creation form and always send a password reset request via e-mail instead. This ensures that only users with valid e-mail addresses are able to login. Signed-off-by: Lukas Fleischer

Fix default selection on the account edit page

2013-02-10T11:11:36Z

We used a mixture of account type IDs and account type descriptions on the account edit page. This resulted in the account type field always defaulting to "Normal user" after an invalid form had been submitted. Consistently use account type IDs to avoid this. Signed-off-by: Lukas Fleischer

Remove unneeded database connection calls

2013-02-10T11:10:38Z

Since all database related functions will establish a connection when needed, there is no need to pre-emptively try and establish a database connection. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Add database wrapper class and new connection method

2013-02-10T11:10:37Z

Uses the Singleton pattern to ensure all queries use the same database connection that is released upon script completion. All database connections should now be called with DB::connect() and not db_connect(). Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Replace permission check code with can_edit_account()

2013-01-30T08:25:29Z

Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Fix account editing and hijacking vulnerability

2012-11-29T22:23:10Z

Checks are in place to avoid users getting account editing forms they shouldn't have access to. The appropriate checks before editing the account in the backend are not in place. This vulnerability allows a user to craft malicious POST data to edit other user accounts, thereby allowing account hijacking. Add a new flexible function can_edit_account() to determine if a user has appropriate permissions. Run the permission check before processing any account information in the backend. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Overhaul ability to edit own account

2012-09-17T22:59:45Z

* Restructure account.php to remove redundant code. * Remove own_account_details(). * Rework logic check to default to no access to account edit form. * Make default account action viewing account info. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Merge branch 'maint'

2012-07-14T20:52:04Z

Conflicts: web/html/account.php web/html/addvote.php web/html/pkgsubmit.php web/lib/acctfuncs.inc.php web/template/actions_form.php web/template/pkg_comment_form.php web/template/pkg_comments.php web/template/pkg_details.php web/template/pkg_search_results.php web/template/tu_details.php

acctfuncs.inc.php: Move XHTML to account_details.php template

2012-07-06T09:27:16Z

XHTML should be eliminated from lib/ as much as possible. This pulls the XHTML out of the display_account_info function that echoes the code, and moves it to the new account_details.php template file. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

account.php: Pull out DB code

2012-07-06T09:27:03Z

* Move DB code in account.php to new functions in acctfuncs.inc.php * Centralization of DB code important in a future transition to PDO interface * Consolidate redudant SQL statements from DisplayAccount and AccountInfo * Consolidation also adds ability to edit accounts based on username Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer