If current authentication method is set to None, change to Builtin.
To achieve this, the code will look for a valid administration user that will be used to reset the password. This is achieved by searching for the Primary Admin, and then any admin with console access. Once an admin has been found, the must_change_password and change_password flags are set, the password is cleared and the user is automatically logged in before being forced to change the empty password.
If no admin can be located, the script will die to prevent issues and allow manual fixing of the problem. The simpliest way to do this would be to utilise the INSERT statement that is used for the 'admin' user in the cacti.sql's user_auth table, plus the INSERT for user_id 1 into the user_auth_realm table.
* First round of changes for #1717
* Various QA fixes
* Further round of QA
* Add Content-Type to headers
* Another round of QA
* Allow full screen changepassword
* Redirect to permission denied page instead of displaying local message
-issue: basename function undefined during upgrade to 1.0.x
-issue: Storage API and translations required for Change password
function
-issue: ALTER IGNORE still throws an error when attempting to drop the
primary key
-issue: Data Source profile form API generates error when system is half
upgraded
* Fix issue #1122 - Local user login fails with Multi/Single LDAP enabled
Code was not consistent with how it was generating the password hashes and comparing them. To fix this, added compat_password_xxx functions that check for the availability of the newer password_xxx functions and if not present revert back to the md5 version.
Changes made are:
auth_changepassword.php:
* Break out of switch when error message set
* Reduce duplication of code when checking passwords
* Use local variables rather than constantly pulling in request ones
* Use new compat_password_xxx functions
auth_login.php:
* Added some debug logging to identify login issues
* Allow local login even if using ldap
* Use new compat_password_xxx functions
* Remove password from SQL search as hash can change and we don't know what it would have been at the time it was set
user_admin.php
* Use new compat_password_xxx functions
lib\auth.php:
* Added compat_password_verify, compat_password_hash and compat_password_rehash to check for PHP 5.7+ compatible functions other use MD5
* Reduced SQL query to just required user in secpass_login_process()
* Fixed password check in secpass_check_history()
* Fixed return value check of secpass_check_pass() in secpass_login_process()
* Use new compat_password_xxx functions
* Update CHANGELOG
* Fixup for Issue #1122, corrects some minor issues
* Merge branch 'Issue-1122' of https://github.com/netniV/cacti into Issue-1122
Update log message to be warning notj ust a normal message
* Fix issue of local auth bypas
* Update CHANGELOG
Fix up CHANGELOG issues
* Update auth.php
Fix up formatting issues
Corner case where you have forced a password change, but have not
granted that permission to the user. We are also now blocking the save
when the user tries to make this setting.
We need better interactions with the login screen under certain failure
modes. But for now this is good enough.
Fixed "ok" message when changing passwords.
Somethings that still needs to be looked at
1. can i read the friendly_name of the array with read_config_option? I want to read it from the array instead of typing it:
"Require Mix Case: " .read_config_option('secpass_reqmixcase') . "<br>" .
2. Because this function it still forces you to use a new password even to secpass_history default is set to 0. Change secpass_history default to 1 and remove it?
if ($user['password'] == md5(get_nfilter_request_var('password'))) {
$bad_password = true;
$errorMessage = "<span color='#FF0000'>Your new password can not be the same as the old password. Please try again.</span>";
}
3. I had to add font-awesome since it wasn't referenced anywhere in themes. Better way to do it?
Any input is welcome!
cigamit