From 883cbf88d41cfa5b7cc3af95c8e07cb9f21625f6 Mon Sep 17 00:00:00 2001
From: Mischa POSLAWSKY <perl@shiar.org>
Date: Sat, 21 Apr 2018 15:09:21 +0200
Subject: [PATCH] login: link to form to send password reset mail

---
 login.php              | 19 ++++++++++++++++++-
 login/form.inc.php     | 13 +++++++++++++
 login/mailpass.inc.php | 38 ++++++++++++++++++++++++++++++++++++++
 login/mailpass.inc.txt | 13 +++++++++++++
 4 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 login/mailpass.inc.php
 create mode 100644 login/mailpass.inc.txt

diff --git a/login.php b/login.php
index 626281a..5287678 100644
--- a/login.php
+++ b/login.php
@@ -1,7 +1,24 @@
 <?php
 $message = NULL;
 
-if (isset($_POST['login'])) {
+if (isset($_POST['mail'])) {
+	$input = trim($_POST['mail']);
+	$inputq = sprintf('<em>%s</em>', $input);
+	try {
+		require_once 'login/mailpass.inc.php';
+		if ( $found = mailtoken($input) ) {
+			$message = "Er is een e-mail verstuurd naar $inputq.";
+		}
+		else {
+			$message = "E-mailadres $inputq is nergens ingesteld.";
+		}
+	}
+	catch (Exception $e) {
+		$message = "E-mail kon niet verstuurd worden."
+			. " Probeer het later nog eens of neem contact op.";
+	}
+}
+elseif (isset($_POST['login'])) {
 	if ($User = login($_POST['login'], $_POST['pass'])) {
 		login_setcookie();
 	}
diff --git a/login/form.inc.php b/login/form.inc.php
index 9c2a604..b7d8971 100644
--- a/login/form.inc.php
+++ b/login/form.inc.php
@@ -7,3 +7,16 @@
 	<input id="pass" name="pass" type="password" value="" placeholder="Wachtwoord" />
 	<input type="submit" value="Log in" />
 </form>
+
+<?php if (!isset($_POST['mail'])) { ?>
+<p><a onclick="document.getElementById('mailpass').removeAttribute('hidden'); this.remove()">Wachtwoord vergeten?</a></p>
+<?php } ?>
+
+<form id="mailpass" action="/login/mailpass" method="post"<?php if (!isset($_POST['mail'])) { ?> hidden<?php } ?>>
+	<h3>Wachtwoord vergeten</h3>
+	<p>Als er een e-mailadres was ingesteld kun je hieronder een verzoek indienen om opnieuw een wachtwoord in te stellen.</p>
+	<input type="email" id="mail" name="mail" placeholder="E-mailadres" value="<?php
+		if (isset($_POST['mail'])) print htmlspecialchars($_POST['mail']);
+	?>" />
+	<input type="submit" value="Verstuur" />
+</form>
diff --git a/login/mailpass.inc.php b/login/mailpass.inc.php
new file mode 100644
index 0000000..6138ceb
--- /dev/null
+++ b/login/mailpass.inc.php
@@ -0,0 +1,38 @@
+<?php
+function userbymail($email)
+{
+	foreach (glob("profile/*") as $useropt) {
+		if ($mailopt = @file_get_contents("$useropt/email.txt")
+		and rtrim($mailopt) == $email) {
+			return substr($useropt, strlen('profile/'));
+		}
+	}
+	return FALSE;
+}
+
+function mailtoken($email)
+{
+	$found = userbymail($email);
+	if (!$found) return FALSE;
+
+	$token = substr(sha1('$Random'.rand()), 0, 10);
+	if (!file_put_contents("profile/$found/.token", $token))
+		throw new Exception("could not store token for $found");
+
+	$sitename = $_SERVER['HTTP_HOST'];
+	$sitelink = 'https://'.$sitename;
+	$rep = [
+		'[[user]]' => $found,
+		'[[link]]' => "$sitelink/login/pass?token=$found:$token",
+		'[[site]]' => $sitename,
+	];
+
+	$mailbody = file_get_contents('login/mailpass.inc.txt');
+	$mailbody = str_replace(array_keys($rep), array_values($rep), $mailbody);
+	if (!$mailbody) throw new Exception('empty mail body');
+	$mailsub = "Wachtwoord-reset voor $sitename";
+
+	return mail($email, $mailsub, $mailbody);
+	return TRUE;
+}
+
diff --git a/login/mailpass.inc.txt b/login/mailpass.inc.txt
new file mode 100644
index 0000000..9548200
--- /dev/null
+++ b/login/mailpass.inc.txt
@@ -0,0 +1,13 @@
+Beste [[user]],
+
+Voor dit e-mailadres is aangegeven dat de account-gegevens zijn vergeten.
+Ga naar de onderstaande link om een nieuw wachtwoord in te stellen:
+
+	[[link]]
+
+Als dit verzoek niet bekend of nodig is kun je deze mail negeren.
+De login blijft dan ongewijzigd.
+
+Met vriendelijke groet,
+-- 
+[[site]]
-- 
2.30.0