Password problems - Please do help!

[Kyrislian]

Hi there. I've got two problems with my site's password.

 

Firstly, it seems that I cannot change the passwords for the users for them. Whatever I type it, and they try to log in, they still receive the error of "password is invalid."

 

My second problem is, I tried to use my account as a guinea pig (upon reflection, very stupid of me, I know). Now I can't access my account using my old password and the new password I set myself to.

 

Please do help with this! I have a lot of things to update in my site and I can't access it right now! Any help at all will be invaluable to me, so please, any advice you can give I will appreciate it so much.

[.josh]

[Kyrislian]

I apologize for the vague description; I'm rather panicky right now. What information can I supply for help?

[PFMaBiSmAd]

So, what code is used when setting the passwords originally (i.e. the passwords that worked.)

 

What code is used when you attempted to set a new password?

 

What code is checking the password when you attempt to log in?

 

What if anything is currently stored in your user record for the password when you look directly in the database table?

 

Please post any code between

tags so that someone will bother to read it.

 

Do you have a backup of your database so that you could examine the password data in it and/or restore it?

[Kyrislian]

Hopefully this is correct; checking all the files and these seem to be the ones.

 

This is to update the password, along with the user info and such. I've looked through all the other files, so I think this one is a combination of creating users and editing users.;

 

<?
if (!defined('SYSPATH')) header('HTTP/1.1 403 Forbidden');//no direct access

/**
* Author: Andrew Judd
*/

class User extends Base
{
private $db;
private $userInfo = NULL;
private $purify = NULL;

public function __construct ( $db )
{
	parent::__construct ();

	$this -> db = $db;
}

    public static function createUser ( $username, $password, $email, $db )
    {
        Base::_loadLib ( 'Functions' );
	$password = Functions::encryptPassword ( $password );
        $query = 'INSERT INTO `users` ( `username`, `password`, `email` ) VALUES ( %s, %s, %s )';
        $res = $db -> query ( $query, $username, $password, $email );
        $db -> freeResults ( $res );
    }

public function loadFromId ( $id )
{
	$query = 'SELECT `username`, `password`, `email`, `beans`, `den_text`,'
		. '`lastmix`, `admin` FROM `users` WHERE `id` = %u';

	$res = $this -> db -> query ( $query, $id );

	if ( $res != NULL )
	{
		$this -> userInfo = $this -> db -> getArray ( $res );
		$this -> userInfo [ 'id' ] = $id;

            return ( TRUE );
	}

	return ( FALSE );
}

public function loadFromUsername ( $username )
{
	$query = 'SELECT `id`, `password`, `email`, `beans`, `den_text`,'
		. '`lastmix`, `admin` FROM `users` WHERE `username` = %s';

	$res = $this -> db -> query ( $query, $username );

	if ( $res != NULL )
	{
		$this -> userInfo = $this -> db -> getArray ( $res );
		$this -> userInfo [ 'username' ] = $username;

		if ( count ( $this -> userInfo ) == 1 )
		{
			return ( FALSE );
		}

		return ( TRUE );
	}

	return ( FALSE );
}

    public function getInfoField ( $field )
    {
        return ( $this -> userInfo [ $field ] );
    }

public function loadFromSession ()
{
	/* Check the IPs to see if they match */
	if ( $_SESSION [ 'IP' ] != $_SERVER [ 'REMOTE_ADDR' ] )
	{
		/* IPs don't match, so session stealing? */
		$userInfo = NULL;
		return;
	}

	/* Otherwise load in the information */
	$this -> loadFromId ( $_SESSION [ 'userid' ] );

	return ( TRUE );
}

public function getAllPets ()
{
	$query = 'SELECT `id`, `lupine_name`, `lupine_text` FROM `lupines`'
		. ' WHERE `userId` = %u';

	$res = $this -> db -> query ( $query, $this -> userInfo [ 'id' ] );

	if ( $res == NULL )
	{
		return ( NULL );
	}

	$array = $this -> db -> retrieveAllRows ( $res );

	$this -> db -> freeResults ( $res );

	return ( $array );
}

public function getAllItems ()
{
	$query = 'SELECT `itemsowned`.`id`, `itemid`, `name` FROM `itemsowned`
			JOIN `item` ON `itemid` = `item`.`id` WHERE `userid` = %u AND `lupineid` = 0';

	$res = $this -> db -> query ( $query, $this -> userInfo [ 'id' ] );

	if ( $res == NULL )
	{
		return ( NULL );
	}

	$array = $this -> db -> retrieveAllRows ( $res );

	$this -> db -> freeResults ( $res );

	return ( $array );
}

public function getUserInformation ()
{
	return ( $this -> userInfo );
}

public function addMoney ( $amount )
{
	$query = 'UPDATE `users` SET `beans` = `beans` + %d WHERE `id` = %u';
	$this -> db -> query ( $query, $amount, $this -> userInfo [ 'id' ] );

	$this -> userInfo [ 'beans' ] = $this -> userInfo [ 'beans' ] + $amount;
}

    public function updateAdmin ( $isAdmin )
    {
        $query = 'UPDATE `users` SET `admin` = %u WHERE `id` = %u';
        $this -> db -> query ( $query, $isAdmin == TRUE ? 1 : 0, $this -> userInfo [ 'id' ] );
        $this -> userInfo [ 'admin' ] = $isAdmin;
    }

public function updateProfile ( $text )
{
	/* Different, so update it, firstly include HTML Purifier */
	$this -> _loadLib ( 'HTMLPurifierWrapper' );
	$this -> purify = HTMLPurifierWrapper::getInstance ();

	/* Clean the input */
	$this -> userInfo [ 'den_text' ] = $this -> purify -> purify ( trim ( $text ) );

	$query = 'UPDATE `users` SET `den_text` = %h WHERE `id` = %u';
	$this -> db -> query ( $query, $this -> userInfo [ 'den_text' ], $this -> userInfo [ 'id' ] );
}

public function updateEmail ( $email )
{
	$this -> _loadLib ( 'HTMLPurifierWrapper' );
	$this -> purify = HTMLPurifierWrapper::getInstance ();

	$this -> userInfo [ 'email' ] = $this -> purify -> purify ( trim ( $email ) );
	$query = 'UPDATE `users` SET `email` = %s WHERE `id` = %u';
	$this -> db -> query ( $query, $this -> userInfo [ 'email' ], $this -> userInfo [ 'id' ] );
}

public function updatePassword ( $password )
{
	$this -> _loadLib ( 'Functions' );

	$this -> userInfo [ 'password' ] = trim ( Functions::encryptPassword ( $password ) );
	$query = 'UPDATE `users` SET `password` = %s WHERE `id` = %u';

	$this -> db -> query ( $query, $this -> userInfo [ 'password' ], $this -> userInfo [ 'id' ] );
}

public function updateImage ( $file )
{
	global $config;

	/* They uploaded an image */
	$fileCheck = $config [ 'imagesDirect' ] . 'owners/' ;
	$ext = substr ( $file [ 'name' ], strrpos ( $file [ 'name' ], '.' ) );

	$dest = $fileCheck . $this -> userInfo [ 'id' ] . $ext;

	if ( move_uploaded_file ( $file [ 'tmp_name' ], $dest ) == TRUE )
	{
		/* Success, now try to resize */
		$this -> _loadLib ( 'SimpleImage' );
		$image = new SimpleImage ();
		$image -> load ( $dest );
		$image -> resize ( 100, 100 );
		$image -> save ( $dest );

		return ( TRUE );
	}
	else
	{
		return ( FALSE );
	}
}

public function remove ()
{
	global $config;

	/* Remove all items */
	$query = 'DELETE FROM `itemsowned` WHERE `userid` = %u';
	$this -> db -> query ( $query, $this -> userInfo [ 'id' ] );

	$query = 'DELETE FROM `users` WHERE `id` = %u';
	$this -> db -> query ( $query, $this -> userInfo [ 'id' ] );

	/* Remove all lupines */
	$query = 'UPDATE `lupines` SET `userid` = 0 WHERE `userid` = %u';
	$this -> db -> query ( $query, $this -> userInfo [ 'id' ] );

	$file = $config [ 'imagesDirect' ] . 'owners/';

	if ( file_exists ( $file . $this -> userInfo [ 'id' ] . '.jpg' ) == TRUE )
	{
		unlink ( $file . $this -> userInfo [ 'id' ] . '.jpg' );
	}

	if ( file_exists ( $file . $this -> userInfo [ 'id' ] . '_2.jpg' ) == TRUE )
	{
		unlink ( $file . $this -> userInfo [ 'id' ] . '_2.jpg' );
	}
}
}
?>

 

This code is to check the password

<?
if (!defined('SYSPATH')) header('HTTP/1.1 403 Forbidden');//no direct access

/**
* Author: Andrew Judd
*/

class LoginModel extends Base
{
private $db;
private $functions;

public function __construct ( $db )
{
	parent::__construct ();
	$this -> _loadLib ( 'Functions' );
	$this -> db = $db;
}

/* 
 * Called with the controller as follows:
 * LOAD: $this->_loadModel('MODELNAME');
 * INSTANTIATE: $this->model = new MODELNAME();
 * USE: Use the function as you normally would use a function
 */
public function login ( )
{
	$error = array ();

	if ( trim ( $_POST [ 'txtUsername' ] ) == "" )
	{
		$error [] = "Username is required to login.";
	}

	if ( trim ( $_POST [ 'txtPassword' ] ) == "" )
	{
		$error [] = "Password is required to login.";
	}

	if ( count ( $error ) > 0 )
	{
		return ( $error );
	}

	/* Otherwise look further */
	$query = "SELECT `password` FROM `users` WHERE `username` = %s";
	$res = $this -> db -> query ( $query, $_POST [ 'txtUsername' ] );

	/* Check if the username exists */
	if ( $this -> db -> numRows ( $res ) == 0 )
	{
		$error [] = "Username does not exist.";
	}
	else
	{
		/* Username existed...so check for the password */
		$pw = Functions::encryptPassword ( $_POST [ 'txtPassword' ] );

		$userInfo = $this -> db -> getArray ( $res );

		if ( $userInfo [ 'password' ] != $pw )
		{
			$error [] = "Password is invalid.";
		}

		$this -> db -> freeResults ( $res );
	}

	return ( $error );
}

/**
 * This function is used strictly for locating the data and saving it to a
 * session.
 */
public function createSession ()
{
	$query = "SELECT `id` FROM `users` WHERE `username` = %s";
	$res = $this -> db -> query ( $query, $_POST [ 'txtUsername' ] );

	$userId = $this -> db -> getArray ( $res );

	/* Perfect...correct username and password */
	$_SESSION [ 'userid' ] = $userId [ 'id' ];
	$_SESSION [ 'IP' ] = $_SERVER [ 'REMOTE_ADDR' ];
	$_SESSION [ 'access' ] = md5 ( $_SERVER [ 'REMOTE_ADDR' ] );

	$this -> db -> freeResults ( $res );
}
}
?>

 

Regarding the user record, I'm not entirely sure what you mean? I have looked into the database tables though and they do have a field for passwords, which are encrypted.

[PFMaBiSmAd]

Seeing the Functions::encryptPassword() function code would help.

 

There is a trim() function call thrown in the updatePassword() function that is not present in the createUser() or the login code, that if the encryptPassword() function was doing something that left a trim-able character as part of the data, would result in an unmatchable value after using the updatePassword() function.

[Kyrislian]

I found it! ...yes. I'm such a noob with php that even finding the right function is cause for celebration.

 

<?
if (!defined('SYSPATH')) header('HTTP/1.1 403 Forbidden');//no direct access

/**
* Author: Andrew Judd
*/

class Functions
{
/**
 * This function is used in order to generate the encrypted password for any
 * given user.
 */
static function encryptPassword ( $pass, $encKey = "lupine-salt@1234" )
{
	return ( md5 ( $pass.$encKey ) );
}

/**
 * This function is used in order to provide a common looking error message.
 * @param error The error message that will be displayed.
 */
static function error ( $error )
{
	echo ( "<span class = 'error'>ERROR</span>: $error<br />" );
}

static function generateDDLValue ( $current, $value, $text )
{
	$str = "<option value = \"$value\" ";

	if ( $current == $value )
	{
		$str .= " selected = 'selected' ";
	}

	$str .= ">$text</option>";

	return ( $str );
}

static function calculateAge ( $birthday )
{
	return ( datediff ( "yyyy", $birthday, time (), TRUE ) );
}

static function datediff ( $interval, $datefrom, $dateto, $using_timestamps = false )
{
	/*
	 * $interval can be:
	 * yyyy - Number of full years
	 * q - Number of full quarters
	 * m - Number of full months
	 * y - Difference between day numbers
	 * (eg 1st Jan 2004 is "1", the first day. 2nd Feb 2003 is "33". The datediff is "-32".)
	 * d - Number of full days
	 * w - Number of full weekdays
	 * ww - Number of full weeks
	 * h - Number of full hours
	 * n - Number of full minutes
	 * s - Number of full seconds (default)
	 */

	if (!$using_timestamps)
	{
		$datefrom = strtotime($datefrom, 0);
		$dateto = strtotime($dateto, 0);
	}

	$difference = $dateto - $datefrom; // Difference in seconds

	switch($interval)
	{
		case 'yyyy': // Number of full years
			$years_difference = floor($difference / 31536000);
			if (mktime(date("H", $datefrom), date("i", $datefrom), date("s", $datefrom), date("n", $datefrom), date("j", $datefrom), date("Y", $datefrom)+$years_difference) > $dateto)
			{
				$years_difference--;
			}
			if (mktime(date("H", $dateto), date("i", $dateto), date("s", $dateto), date("n", $dateto), date("j", $dateto), date("Y", $dateto)-($years_difference+1)) > $datefrom)
  			{
				$years_difference++;
			}
			$datediff = $years_difference;
			break;
		case "q": // Number of full quarters
			$quarters_difference = floor($difference / 8035200);
			while (mktime(date("H", $datefrom), date("i", $datefrom), date("s", $datefrom), date("n", $datefrom)+($quarters_difference*3), date("j", $dateto), date("Y", $datefrom)) < $dateto)
  			{
				$months_difference++;
			}
			$quarters_difference--;
			$datediff = $quarters_difference;
			break;
		case "m": // Number of full months
			$months_difference = floor($difference / 2678400);
			while (mktime(date("H", $datefrom), date("i", $datefrom), date("s", $datefrom), date("n", $datefrom)+($months_difference), date("j", $dateto), date("Y", $datefrom)) < $dateto)
			{
				$months_difference++;
			}
			$months_difference--;
			$datediff = $months_difference;
			break;
		case 'y': // Difference between day numbers
			$datediff = date("z", $dateto) - date("z", $datefrom);
			break;
		case "d": // Number of full days
			$datediff = floor($difference / 86400);
			break;
		case "w": // Number of full weekdays
			$days_difference = floor($difference / 86400);
			$weeks_difference = floor($days_difference / 7); // Complete weeks
			$first_day = date("w", $datefrom);
			$days_remainder = floor($days_difference % 7);
			$odd_days = $first_day + $days_remainder; // Do we have a Saturday or Sunday in the remainder?
			if ($odd_days > 7)
			{ // Sunday
				$days_remainder--;
			}
			if ($odd_days > 6)
			{ // Saturday
				$days_remainder--;
			}
			$datediff = ($weeks_difference * 5) + $days_remainder;
			break;
		case "ww": // Number of full weeks
			$datediff = floor($difference / 604800);
			break;
		case "h": // Number of full hours
			$datediff = floor($difference / 3600);
  			break;
		case "n": // Number of full minutes
			$datediff = floor($difference / 60);
			break;
		default: // Number of full seconds (default)
			$datediff = $difference;
			break;
	}

	return ( $datediff );
}
}
?>

[PFMaBiSmAd]

The trim() function apparently has no bearing on the problem (the value is an md5() value and it would not have any trim-able (AFAIK) characters on the leading or trailing edge.)

 

You will need to investigate what values your code is using vs what is stored in your table (for example, the change password code could have had an incorrect form and the password used was actually an empty string...)

 

I would take the encryptPassword() code and make it a standalone function in its own .php file and enter the password you just attempted to change your's to and see if the value it returns is what is currently stored in your database table.

 

<?php
   function encryptPassword ( $pass, $encKey = "lupine-salt@1234" )
   {
      return ( md5 ( $pass.$encKey ) );
   }

echo encryptPassword ('put_the_new_password_you_attempted_to_change_yours_to_here');
?>

[PFMaBiSmAd]

Also, I don't specifically see anything in the code posted so far that would allow you to change someone else's password, so it may be that if you attempted to change someone else's that you in fact changed your own to whatever you entered and you should try that value as your password.

[Kyrislian]

PFMaBiSmAd, thank you so much for your time and your explainations, but it seems to be far from what I am able to do. I'll head over to the FreeLancing section and hope someone there can do this for me.

 

Again, thanks so much for your time; I really do appreciate it!

[PFMaBiSmAd]

Just some notes -

 

Since this seems to be related to the updatePassword() processing, best guess is that the code that gets the new password from the form contains an error and is actually passing the updatePassword() function something that is not the actual entered password (probably an empty string or perhaps the password already passed through the md5() function.) This would produce an md5() value, which gets stored in the database table, but it would not match what the login code is doing.

 

The short script I posted above would have produced the md5() value that is stored in your database table. Too bad you could not have gotten to the point of executing that to see if what it produces is what is in your database table. You could also have copy/pasted the value that short code produces into your database table to reset your password to a known value.