1<?php
2///////////////////////////////////////////////////////////////////////////////
3//
4// NagiosQL
5//
6///////////////////////////////////////////////////////////////////////////////
7//
8// (c) 2005-2020 by Martin Willisegger
9//
10// Project   : NagiosQL
11// Component : Password administration
12// Website   : https://sourceforge.net/projects/nagiosql/
13// Version   : 3.4.1
14// GIT Repo  : https://gitlab.com/wizonet/NagiosQL
15//
16///////////////////////////////////////////////////////////////////////////////
17//
18// Path settings
19// ===================
20$strPattern = '(admin/[^/]*.php)';
21$preRelPath  = preg_replace($strPattern, '', filter_input(INPUT_SERVER, 'PHP_SELF', FILTER_SANITIZE_STRING));
22$preBasePath = preg_replace($strPattern, '', filter_input(INPUT_SERVER, 'SCRIPT_FILENAME', FILTER_SANITIZE_STRING));
23//
24// Define common variables
25// =======================
26$prePageId     = 31;
27$preContent    = 'admin/password.htm.tpl';
28$preAccess     = 1;
29$preFieldvars  = 1;
30$preShowHeader = 0;
31//
32// Include preprocessing files
33// ===========================
34require $preBasePath.'functions/prepend_adm.php';
35require $preBasePath.'functions/prepend_content.php';
36//
37// Change password
38// =======================
39if (($chkTfValue1 != '') && ($chkTfValue2 != '')) {
40    // Check old password
41    $strSQL    = 'SELECT * FROM `tbl_user` '
42               . "WHERE `username`='".$_SESSION['username']."' AND `password`=MD5('$chkTfValue1')";
43    $booReturn = $myDBClass->hasDataArray($strSQL, $arrDataLines, $intDataCount);
44    if ($booReturn == false) {
45        $myVisClass->processMessage(translate('Error while selecting data from database:'), $strErrorMessage);
46        $myVisClass->processMessage($myDBClass->strErrorMessage, $strErrorMessage);
47    } elseif ($intDataCount == 1) {
48        // Check equality and password length
49        if (($chkTfValue2 === $chkTfValue3) && (strlen($chkTfValue2) >=5)) {
50            // Update database
51            $strSQLUpdate = "UPDATE `tbl_user` SET `password`=MD5('$chkTfValue2'), `last_login`=NOW() "
52                          . "WHERE `username`='".$_SESSION['username']."'";
53            $booReturn = $myDBClass->insertData($strSQLUpdate);
54            if ($booReturn == true) {
55                $myDataClass->writeLog(translate('Password successfully modified'));
56                // Force new login
57                $_SESSION['logged_in'] = 0;
58                $_SESSION['username']  = '';
59                $_SESSION['userid']    = 0;
60                $_SESSION['groupadm']  = 0;
61                $_SESSION['domain']    = 0;
62                header('Location: ' .$SETS['path']['protocol']. '://' .
63                        filter_input(INPUT_SERVER, 'HTTP_HOST', FILTER_SANITIZE_STRING).
64                        $_SESSION['SETS']['path']['base_url']. 'index.php');
65            } else {
66                $myVisClass->processMessage(translate('Error while selecting data from database:'), $strErrorMessage);
67                $myVisClass->processMessage($myDBClass->strErrorMessage, $strErrorMessage);
68            }
69        } else {
70            // New password wrong
71            $myVisClass->processMessage(
72                translate('Password too short or password fields do not match!'),
73                $strErrorMessage
74            );
75        }
76    } else {
77        // Old password wrong
78        $myVisClass->processMessage(translate('The old password is invalid'), $strErrorMessage);
79    }
80} elseif (filter_input(INPUT_POST, 'submit')) {
81    // Wrong data
82    $myVisClass->processMessage(
83        translate('Database entry failed! Not all necessary data filled in!'),
84        $strErrorMessage
85    );
86}
87//
88// Output header variable
89// ======================
90echo $tplHeaderVar;
91//
92// Include content
93// ===============
94foreach ($arrDescription as $elem) {
95    $conttp->setVariable($elem['name'], $elem['string']);
96}
97$conttp->setVariable('LANG_SAVE', translate('Save'));
98$conttp->setVariable('LANG_ABORT', translate('Abort'));
99$conttp->setVariable('FILL_ALLFIELDS', translate('Please fill in all fields marked with an *'));
100$conttp->setVariable('FILL_NEW_PASSWD_NOT_EQUAL', translate('The new passwords don not match!'));
101$conttp->setVariable('FILL_NEW_PWDSHORT', translate('The new password is too short - use at least 6 characters!'));
102if ($strErrorMessage != '') {
103    $conttp->setVariable('ERRORMESSAGE', $strErrorMessage);
104}
105$conttp->setVariable('ACTION_INSERT', filter_input(INPUT_SERVER, 'PHP_SELF', FILTER_SANITIZE_STRING));
106$conttp->setVariable('IMAGE_PATH', $_SESSION['SETS']['path']['base_url']. 'images/');
107// Check access rights for adding new objects
108if ($myVisClass->checkAccountGroup($prePageKey, 'write') != 0) {
109    $conttp->setVariable('ADD_CONTROL', 'disabled="disabled"');
110}
111$conttp->parse('passwordsite');
112$conttp->show('passwordsite');
113//
114// Include footer
115// ==============
116$maintp->setVariable('VERSION_INFO', "<a href='https://sourceforge.net/projects/nagiosql/' "
117                   . "target='_blank'>NagiosQL</a> $setFileVersion");
118$maintp->parse('footer');
119$maintp->show('footer');
120