You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

53 lines
2.0 KiB

<?php
/**
* Controller to handle user password change requests.
*
* <pre>
* Expected REQUEST parameters
* $_REQUEST['pk'] - The primary key being used for encryption. The browser would have requested this previously
* $_REQUEST['curPass'] - ciphertext of the user's current password
* $_REQUEST['newPass'] - ciphertext of the new password to use
* $_REQUEST['newPass2']) - second copy of ciphertext of the new password to confirm proper user entry.
* </pre>
*
* @package OpenEMR
* @link http://www.open-emr.org
* @author Kevin Yeh <kevin.y@integralemr.com>
* @author Brady Miller <brady.g.miller@gmail.com>
* @copyright Copyright (c) 2013 Kevin Yeh <kevin.y@integralemr.com>
* @copyright Copyright (c) 2013 OEMR <www.oemr.org>
* @copyright Copyright (c) 2017-2019 Brady Miller <brady.g.miller@gmail.com>
* @license https://github.com/openemr/openemr/blob/master/LICENSE CNU General Public License 3
*/
// Set $sessionAllowWrite to true to prevent session concurrency issues during authorization related code
$sessionAllowWrite = true;
require_once("../globals.php");
use OpenEMR\Common\Auth\AuthUtils;
use OpenEMR\Common\Csrf\CsrfUtils;
if (!empty($_POST)) {
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) {
CsrfUtils::csrfNotVerified();
}
}
$curPass = $_REQUEST['curPass'];
$newPass = $_REQUEST['newPass'];
$newPass2 = $_REQUEST['newPass2'];
if ($newPass != $newPass2) {
echo "<div class='alert alert-danger'>" . xlt("Passwords Don't match!") . "</div>";
exit;
}
$authUtilsUpdatePassword = new AuthUtils();
$success = $authUtilsUpdatePassword->updatePassword($_SESSION['authUserID'], $_SESSION['authUserID'], $curPass, $newPass);
if ($success) {
echo "<div class='alert alert-success'>" . xlt("Password change successful") . "</div>";
} else {
// If updatePassword fails the error message is returned
echo "<div class='alert alert-danger'>" . text($authUtilsUpdatePassword->getErrorMessage()) . "</div>";
}