diff --git a/phpBB/includes/db/schema_data.php b/phpBB/includes/db/schema_data.php index 9d7153f6b6..0447895433 100644 --- a/phpBB/includes/db/schema_data.php +++ b/phpBB/includes/db/schema_data.php @@ -1119,6 +1119,8 @@ $schema_data['phpbb_users'] = array( 'user_password' => array('VCHAR_UNI', ''), 'user_passchg' => array('TIMESTAMP', 0), 'user_pass_convert' => array('BOOL', 0), + 'user_actkey' => array('VCHAR:32', ''), + 'user_newpasswd' => array('VCHAR_UNI', ''), 'user_email' => array('VCHAR_UNI:100', ''), 'user_email_hash' => array('BINT', 0), 'user_birthday' => array('VCHAR:10', ''), @@ -1173,8 +1175,6 @@ $schema_data['phpbb_users'] = array( 'user_msnm' => array('VCHAR_UNI', ''), 'user_jabber' => array('VCHAR_UNI', ''), 'user_website' => array('VCHAR_UNI:200', ''), - 'user_actkey' => array('VCHAR:32', ''), - 'user_newpasswd' => array('VCHAR_UNI:40', ''), 'user_form_salt' => array('VCHAR_UNI:32', ''), 'user_new' => array('BOOL', 1), 'user_reminded' => array('TINT:4', 0), diff --git a/phpBB/install/schemas/firebird_schema.sql b/phpBB/install/schemas/firebird_schema.sql index 937b06eaae..263ebb4490 100644 --- a/phpBB/install/schemas/firebird_schema.sql +++ b/phpBB/install/schemas/firebird_schema.sql @@ -1372,6 +1372,8 @@ CREATE TABLE phpbb_users ( user_password VARCHAR(255) CHARACTER SET UTF8 DEFAULT '' NOT NULL COLLATE UNICODE, user_passchg INTEGER DEFAULT 0 NOT NULL, user_pass_convert INTEGER DEFAULT 0 NOT NULL, + user_actkey VARCHAR(32) CHARACTER SET NONE DEFAULT '' NOT NULL, + user_newpasswd VARCHAR(255) CHARACTER SET UTF8 DEFAULT '' NOT NULL COLLATE UNICODE, user_email VARCHAR(100) CHARACTER SET UTF8 DEFAULT '' NOT NULL COLLATE UNICODE, user_email_hash DOUBLE PRECISION DEFAULT 0 NOT NULL, user_birthday VARCHAR(10) CHARACTER SET NONE DEFAULT '' NOT NULL, @@ -1426,8 +1428,6 @@ CREATE TABLE phpbb_users ( user_msnm VARCHAR(255) CHARACTER SET UTF8 DEFAULT '' NOT NULL COLLATE UNICODE, user_jabber VARCHAR(255) CHARACTER SET UTF8 DEFAULT '' NOT NULL COLLATE UNICODE, user_website VARCHAR(200) CHARACTER SET UTF8 DEFAULT '' NOT NULL COLLATE UNICODE, - user_actkey VARCHAR(32) CHARACTER SET NONE DEFAULT '' NOT NULL, - user_newpasswd VARCHAR(40) CHARACTER SET UTF8 DEFAULT '' NOT NULL COLLATE UNICODE, user_form_salt VARCHAR(32) CHARACTER SET UTF8 DEFAULT '' NOT NULL COLLATE UNICODE, user_new INTEGER DEFAULT 1 NOT NULL, user_reminded INTEGER DEFAULT 0 NOT NULL, diff --git a/phpBB/install/schemas/mssql_schema.sql b/phpBB/install/schemas/mssql_schema.sql index 5df33e8057..11309d67a5 100644 --- a/phpBB/install/schemas/mssql_schema.sql +++ b/phpBB/install/schemas/mssql_schema.sql @@ -1688,6 +1688,8 @@ CREATE TABLE [phpbb_users] ( [user_password] [varchar] (255) DEFAULT ('') NOT NULL , [user_passchg] [int] DEFAULT (0) NOT NULL , [user_pass_convert] [int] DEFAULT (0) NOT NULL , + [user_actkey] [varchar] (32) DEFAULT ('') NOT NULL , + [user_newpasswd] [varchar] (255) DEFAULT ('') NOT NULL , [user_email] [varchar] (100) DEFAULT ('') NOT NULL , [user_email_hash] [float] DEFAULT (0) NOT NULL , [user_birthday] [varchar] (10) DEFAULT ('') NOT NULL , @@ -1742,8 +1744,6 @@ CREATE TABLE [phpbb_users] ( [user_msnm] [varchar] (255) DEFAULT ('') NOT NULL , [user_jabber] [varchar] (255) DEFAULT ('') NOT NULL , [user_website] [varchar] (200) DEFAULT ('') NOT NULL , - [user_actkey] [varchar] (32) DEFAULT ('') NOT NULL , - [user_newpasswd] [varchar] (40) DEFAULT ('') NOT NULL , [user_form_salt] [varchar] (32) DEFAULT ('') NOT NULL , [user_new] [int] DEFAULT (1) NOT NULL , [user_reminded] [int] DEFAULT (0) NOT NULL , diff --git a/phpBB/install/schemas/mysql_40_schema.sql b/phpBB/install/schemas/mysql_40_schema.sql index e546c2e98f..16c26fac4a 100644 --- a/phpBB/install/schemas/mysql_40_schema.sql +++ b/phpBB/install/schemas/mysql_40_schema.sql @@ -981,6 +981,8 @@ CREATE TABLE phpbb_users ( user_password blob NOT NULL, user_passchg int(11) UNSIGNED DEFAULT '0' NOT NULL, user_pass_convert tinyint(1) UNSIGNED DEFAULT '0' NOT NULL, + user_actkey varbinary(32) DEFAULT '' NOT NULL, + user_newpasswd blob NOT NULL, user_email blob NOT NULL, user_email_hash bigint(20) DEFAULT '0' NOT NULL, user_birthday varbinary(10) DEFAULT '' NOT NULL, @@ -1035,8 +1037,6 @@ CREATE TABLE phpbb_users ( user_msnm blob NOT NULL, user_jabber blob NOT NULL, user_website blob NOT NULL, - user_actkey varbinary(32) DEFAULT '' NOT NULL, - user_newpasswd varbinary(120) DEFAULT '' NOT NULL, user_form_salt varbinary(96) DEFAULT '' NOT NULL, user_new tinyint(1) UNSIGNED DEFAULT '1' NOT NULL, user_reminded tinyint(4) DEFAULT '0' NOT NULL, diff --git a/phpBB/install/schemas/mysql_41_schema.sql b/phpBB/install/schemas/mysql_41_schema.sql index eec7b985b0..b345e1f474 100644 --- a/phpBB/install/schemas/mysql_41_schema.sql +++ b/phpBB/install/schemas/mysql_41_schema.sql @@ -981,6 +981,8 @@ CREATE TABLE phpbb_users ( user_password varchar(255) DEFAULT '' NOT NULL, user_passchg int(11) UNSIGNED DEFAULT '0' NOT NULL, user_pass_convert tinyint(1) UNSIGNED DEFAULT '0' NOT NULL, + user_actkey varchar(32) DEFAULT '' NOT NULL, + user_newpasswd varchar(255) DEFAULT '' NOT NULL, user_email varchar(100) DEFAULT '' NOT NULL, user_email_hash bigint(20) DEFAULT '0' NOT NULL, user_birthday varchar(10) DEFAULT '' NOT NULL, @@ -1035,8 +1037,6 @@ CREATE TABLE phpbb_users ( user_msnm varchar(255) DEFAULT '' NOT NULL, user_jabber varchar(255) DEFAULT '' NOT NULL, user_website varchar(200) DEFAULT '' NOT NULL, - user_actkey varchar(32) DEFAULT '' NOT NULL, - user_newpasswd varchar(40) DEFAULT '' NOT NULL, user_form_salt varchar(32) DEFAULT '' NOT NULL, user_new tinyint(1) UNSIGNED DEFAULT '1' NOT NULL, user_reminded tinyint(4) DEFAULT '0' NOT NULL, diff --git a/phpBB/install/schemas/oracle_schema.sql b/phpBB/install/schemas/oracle_schema.sql index ad8d354db9..b819ba2c59 100644 --- a/phpBB/install/schemas/oracle_schema.sql +++ b/phpBB/install/schemas/oracle_schema.sql @@ -1805,6 +1805,8 @@ CREATE TABLE phpbb_users ( user_password varchar2(765) DEFAULT '' , user_passchg number(11) DEFAULT '0' NOT NULL, user_pass_convert number(1) DEFAULT '0' NOT NULL, + user_actkey varchar2(32) DEFAULT '' , + user_newpasswd varchar2(765) DEFAULT '' , user_email varchar2(300) DEFAULT '' , user_email_hash number(20) DEFAULT '0' NOT NULL, user_birthday varchar2(10) DEFAULT '' , @@ -1859,8 +1861,6 @@ CREATE TABLE phpbb_users ( user_msnm varchar2(765) DEFAULT '' , user_jabber varchar2(765) DEFAULT '' , user_website varchar2(600) DEFAULT '' , - user_actkey varchar2(32) DEFAULT '' , - user_newpasswd varchar2(120) DEFAULT '' , user_form_salt varchar2(96) DEFAULT '' , user_new number(1) DEFAULT '1' NOT NULL, user_reminded number(4) DEFAULT '0' NOT NULL, diff --git a/phpBB/install/schemas/postgres_schema.sql b/phpBB/install/schemas/postgres_schema.sql index 4412e29d09..be8af3c873 100644 --- a/phpBB/install/schemas/postgres_schema.sql +++ b/phpBB/install/schemas/postgres_schema.sql @@ -1253,6 +1253,8 @@ CREATE TABLE phpbb_users ( user_password varchar(255) DEFAULT '' NOT NULL, user_passchg INT4 DEFAULT '0' NOT NULL CHECK (user_passchg >= 0), user_pass_convert INT2 DEFAULT '0' NOT NULL CHECK (user_pass_convert >= 0), + user_actkey varchar(32) DEFAULT '' NOT NULL, + user_newpasswd varchar(255) DEFAULT '' NOT NULL, user_email varchar(100) DEFAULT '' NOT NULL, user_email_hash INT8 DEFAULT '0' NOT NULL, user_birthday varchar(10) DEFAULT '' NOT NULL, @@ -1307,8 +1309,6 @@ CREATE TABLE phpbb_users ( user_msnm varchar(255) DEFAULT '' NOT NULL, user_jabber varchar(255) DEFAULT '' NOT NULL, user_website varchar(200) DEFAULT '' NOT NULL, - user_actkey varchar(32) DEFAULT '' NOT NULL, - user_newpasswd varchar(40) DEFAULT '' NOT NULL, user_form_salt varchar(32) DEFAULT '' NOT NULL, user_new INT2 DEFAULT '1' NOT NULL CHECK (user_new >= 0), user_reminded INT2 DEFAULT '0' NOT NULL, diff --git a/phpBB/install/schemas/sqlite_schema.sql b/phpBB/install/schemas/sqlite_schema.sql index 644cf775eb..717b242a57 100644 --- a/phpBB/install/schemas/sqlite_schema.sql +++ b/phpBB/install/schemas/sqlite_schema.sql @@ -952,6 +952,8 @@ CREATE TABLE phpbb_users ( user_password varchar(255) NOT NULL DEFAULT '', user_passchg INTEGER UNSIGNED NOT NULL DEFAULT '0', user_pass_convert INTEGER UNSIGNED NOT NULL DEFAULT '0', + user_actkey varchar(32) NOT NULL DEFAULT '', + user_newpasswd varchar(255) NOT NULL DEFAULT '', user_email varchar(100) NOT NULL DEFAULT '', user_email_hash bigint(20) NOT NULL DEFAULT '0', user_birthday varchar(10) NOT NULL DEFAULT '', @@ -1006,8 +1008,6 @@ CREATE TABLE phpbb_users ( user_msnm varchar(255) NOT NULL DEFAULT '', user_jabber varchar(255) NOT NULL DEFAULT '', user_website varchar(200) NOT NULL DEFAULT '', - user_actkey varchar(32) NOT NULL DEFAULT '', - user_newpasswd varchar(40) NOT NULL DEFAULT '', user_form_salt varchar(32) NOT NULL DEFAULT '', user_new INTEGER UNSIGNED NOT NULL DEFAULT '1', user_reminded tinyint(4) NOT NULL DEFAULT '0', diff --git a/phpBB/phpbb/db/migration/data/v310/passwords_p2.php b/phpBB/phpbb/db/migration/data/v310/passwords_p2.php new file mode 100644 index 0000000000..553e79403d --- /dev/null +++ b/phpBB/phpbb/db/migration/data/v310/passwords_p2.php @@ -0,0 +1,40 @@ + array( + $this->table_prefix . 'users' => array( + 'user_newpasswd' => array('VCHAR:255', ''), + ), + ), + ); + } + + public function revert_schema() + { + return array( + 'change_columns' => array( + $this->table_prefix . 'users' => array( + 'user_newpasswd' => array('VCHAR:40', ''), + ), + ), + ); + } +} diff --git a/tests/functional/forgot_password_test.php b/tests/functional/forgot_password_test.php index 906224efbb..3b6fd15d02 100644 --- a/tests/functional/forgot_password_test.php +++ b/tests/functional/forgot_password_test.php @@ -41,4 +41,17 @@ class phpbb_functional_forgot_password_test extends phpbb_functional_test_case } + public function tearDown() + { + $this->login(); + $this->admin_login(); + + $crawler = self::request('GET', 'adm/index.php?sid=' . $this->sid . '&i=acp_board&mode=security'); + + // Enable allow_password_reset again after test + $form = $crawler->selectButton('Submit')->form(array( + 'config[allow_password_reset]' => 1, + )); + $crawler = self::submit($form); + } } diff --git a/tests/functional/user_password_reset_test.php b/tests/functional/user_password_reset_test.php new file mode 100644 index 0000000000..65222c1aa6 --- /dev/null +++ b/tests/functional/user_password_reset_test.php @@ -0,0 +1,122 @@ +add_lang('ucp'); + $user_id = $this->create_user('reset-password-test-user'); + + $crawler = self::request('GET', "ucp.php?mode=sendpassword&sid={$this->sid}"); + $form = $crawler->selectButton('submit')->form(array( + 'username' => 'reset-password-test-user', + )); + $crawler = self::submit($form); + $this->assertContainsLang('NO_EMAIL_USER', $crawler->text()); + + $crawler = self::request('GET', "ucp.php?mode=sendpassword&sid={$this->sid}"); + $form = $crawler->selectButton('submit')->form(array( + 'username' => 'reset-password-test-user', + 'email' => 'nobody@example.com', + )); + $crawler = self::submit($form); + $this->assertContainsLang('PASSWORD_UPDATED', $crawler->text()); + + // Check if columns in database were updated for password reset + $this->get_user_data(); + $this->assertNotNull($this->user_data['user_actkey']); + $this->assertNotNull($this->user_data['user_newpasswd']); + + // Make sure we know the password + $db = $this->get_db(); + $this->passwords_manager = $this->get_passwords_manager(); + $sql = 'UPDATE ' . USERS_TABLE . " + SET user_newpasswd = '" . $db->sql_escape($this->passwords_manager->hash('reset-password-test-user')) . "' + WHERE user_id = " . $user_id; + $db->sql_query($sql); + } + + public function test_login_after_reset() + { + $this->login('reset-password-test-user'); + } + + public function data_activate_new_password() + { + return array( + array('WRONG_ACTIVATION', false, 'FOOBAR'), + array('ALREADY_ACTIVATED', 2, 'FOOBAR'), + array('PASSWORD_ACTIVATED', false, false), + array('ALREADY_ACTIVATED', false, false), + ); + } + + /** + * @dataProvider data_activate_new_password + */ + public function test_activate_new_password($expected, $user_id, $act_key) + { + $this->add_lang('ucp'); + $this->get_user_data(); + $user_id = (!$user_id) ? $this->user_data['user_id'] : $user_id; + $act_key = (!$act_key) ? $this->user_data['user_actkey'] : $act_key; + + $crawler = self::request('GET', "ucp.php?mode=activate&u=$user_id&k=$act_key&sid={$this->sid}"); + $this->assertContainsLang($expected, $crawler->text()); + } + + public function test_login() + { + $this->add_lang('ucp'); + $crawler = self::request('GET', 'ucp.php'); + $this->assertContains($this->lang('LOGIN_EXPLAIN_UCP'), $crawler->filter('html')->text()); + + $form = $crawler->selectButton($this->lang('LOGIN'))->form(); + $crawler = self::submit($form, array('username' => 'reset-password-test-user', 'password' => 'reset-password-test-user')); + $this->assertNotContains($this->lang('LOGIN'), $crawler->filter('.navbar')->text()); + + $cookies = self::$cookieJar->all(); + + // The session id is stored in a cookie that ends with _sid - we assume there is only one such cookie + foreach ($cookies as $cookie); + { + if (substr($cookie->getName(), -4) == '_sid') + { + $this->sid = $cookie->getValue(); + } + } + + $this->logout(); + + $crawler = self::request('GET', 'ucp.php'); + $this->assertContains($this->lang('LOGIN_EXPLAIN_UCP'), $crawler->filter('html')->text()); + + $form = $crawler->selectButton($this->lang('LOGIN'))->form(); + // Try logging in with the old password + $crawler = self::submit($form, array('username' => 'reset-password-test-user', 'password' => 'reset-password-test-userreset-password-test-user')); + $this->assertContains($this->lang('LOGIN_ERROR_PASSWORD', '', ''), $crawler->filter('html')->text()); + } + + protected function get_user_data() + { + $db = $this->get_db(); + $sql = 'SELECT user_id, username, user_type, user_email, user_newpasswd, user_lang, user_notify_type, user_actkey, user_inactive_reason + FROM ' . USERS_TABLE . " + WHERE username = 'reset-password-test-user'"; + $result = $db->sql_query($sql); + $this->user_data = $db->sql_fetchrow($result); + $db->sql_freeresult($result); + } +}