Saving score... 
Caught error in evaluating a function in a question: '; - echo Sanitize::encodeStringForDisplay($thrownerror->getMessage()); - echo '
'; - } - } - if (!isset($answeights)) { - return array(1); - } else if (is_array($answeights)) { - return $answeights; - } else { - return explode(',',$answeights); - } -} - -function printscore($sc,$qsetid,$seed) { - global $DBH,$imasroot,$staticroot; - $poss = 1; - if (strpos($sc,'~')===false) { - $sc = str_replace('-1','N/A',$sc); - $out = sprintf(_('%1$s out of %2$s'), $sc, $poss); - $pts = $sc; - if (!is_numeric($pts)) { $pts = 0;} - } else { - $stm = $DBH->prepare("SELECT control FROM imas_questionset WHERE id=:id"); - $stm->execute(array(':id'=>$qsetid)); - $control = $stm->fetchColumn(0); - $ptposs = getansweights($control,$seed); - for ($i=0; $i![\"$alt\"/](\"$staticroot/img/$pm.gif\")
";
- $scarr[$k] = "$bar $v/{$ptposs[$k]}";
- }
- $sc = implode(', ',$scarr);
- //$ptposs = implode(', ',$ptposs);
- $out = sprintf(_('%1$s out of %2$s (parts: %3$s)'), $pts, $poss, $sc);
- }
- $bar = ' ';
- return $bar . $out;
-}
-
-function getpts($sc) {
- if (strpos($sc,'~')===false) {
- if ($sc>0) {
- return $sc;
- } else {
- return 0;
- }
- } else {
- $sc = explode('~',$sc);
- $tot = 0;
- foreach ($sc as $s) {
- if ($s>0) {
- $tot+=$s;
- }
- }
- return round($tot,1);
- }
-}
-
-
-?>
diff --git a/OEAembedq.php b/OEAembedq.php
deleted file mode 100644
index 3574d2a9eb..0000000000
--- a/OEAembedq.php
+++ /dev/null
@@ -1,447 +0,0 @@
-6,
- 'graphdisp'=>1,
- 'drawentry'=>1,
- 'useed'=>1,
- 'livepreview'=>1);
-
-$prefcookie = json_decode($_COOKIE["OEAembeduserprefs"], true);
-$_SESSION['userprefs'] = array();
-foreach($prefdefaults as $key=>$def) {
- if ($prefcookie!==null && isset($prefcookie[$key])) {
- $_SESSION['userprefs'][$key] = filter_var($prefcookie[$key], FILTER_SANITIZE_NUMBER_INT);
- } else {
- $_SESSION['userprefs'][$key] = $def;
- }
-}
-if (isset($_GET['graphdisp'])) { //currently same is used for graphdisp and drawentry
- $_SESSION['userprefs']['graphdisp'] = filter_var($_GET['graphdisp'], FILTER_SANITIZE_NUMBER_INT);
- $_SESSION['userprefs']['drawentry'] = filter_var($_GET['graphdisp'], FILTER_SANITIZE_NUMBER_INT);
- setcookie("OEAembeduserprefs", json_encode(array(
- 'graphdisp'=>$_SESSION['userprefs']['graphdisp'],
- 'drawentry'=>$_SESSION['userprefs']['drawentry']
- )),0,'','',false,true);
-}
-foreach(array('graphdisp','mathdisp','useed') as $key) {
- $_SESSION[$key] = $_SESSION['userprefs'][$key];
-}
-
-$_SESSION['secsalt'] = "12345";
-$cid = "embedq";
-$showtips = 2;
-$useeqnhelper = 4;
-$courseUIver = 1;
-
-$placeinhead = '';
-
-$issigned = false;
-if (isset($_GET['jwt'])) {
- try {
- //decode JWT. Stupid hack to convert it into an assocc array
- $QS = json_decode(json_encode(JWT::decode($_GET['jwt'])), true);
- } catch (Exception $e) {
- echo "JWT Error: ".$e->getMessage();
- exit;
- }
-
- if (isset($QS['auth'])) {
- $issigned = true;
- }
-} else {
- $QS = $_GET;
-}
-if (isset($QS['jssubmit']) && $QS['jssubmit']==0) {
- $jssubmit = false;
-} else {
- $jssubmit = true;
-}
-
-if (empty($QS['id'])) {
- echo 'Need to supply an id';
- exit;
-}
-
-$qsetid=intval($QS['id']);
-
-$page_formAction = "OEAembedq.php?id=$qsetid";
-
-if (isset($_GET['frame_id'])) {
- $frameid = preg_replace('/[^\w:.-]/','',$_GET['frame_id']);
- $page_formAction .= '&frame_id='.$frameid;
-} else {
- $frameid = "OEAembedq-$qsetid";
-}
-if (isset($_REQUEST['theme'])) {
- $theme = preg_replace('/\W/','',$_REQUEST['theme']);
- $page_formAction .= '&theme='.$theme;
- $_SESSION['coursetheme'] = $theme.'.css';
-}
-
-
-$showans = false;
-
-$flexwidth = true; //tells header to use non _fw stylesheet
-$placeinhead .= '';
-$placeinhead .= '';
-if ($_SESSION['mathdisp']==1 || $_SESSION['mathdisp']==3) {
- //in case MathJax isn't loaded yet
- $placeinhead .= '';
-}
-$useeditor = 1;
-require_once "./assessment/header.php";
-
-if ($_SESSION['graphdisp'] == 1) {
- echo '';
-} else {
- echo '';
-}
-
-//seeds 1-4999 are for summative requests that are signed
-//seeds 5000-9999 are for formative requests (unsigned)
-
-if (isset($QS['showscored'])) {
- //DE is requesting that the question be redisplayed with right/wrong markers
-
- $lastanswers = array();
- $rawscores = array();
- list($seed, $rawscores[0], $lastanswers[0]) = explode(';', $QS['showscored'], 3);
- $colors = explode('~',$rawscores[0]);
- $seed = intval($seed);
-
- $showans = (($issigned || $seed>4999) && (!isset($QS['showans']) || $QS['showans']=='true'));
-
-
- displayq(0, $qsetid, $seed, $showans?2:0, true, 0,false,false,false,$colors);
-
-} else if (isset($_POST['seed'])) {
- //time to score the question
- $seed = intval($_POST['seed']);
- $scoredonsubmit = false;
- if (isset($_POST['auth'])) {
- $stm = $DBH->prepare("SELECT password FROM imas_users WHERE SID=:SID");
- $stm->execute(array(':SID'=>Sanitize::stripHtmlTags($_POST['auth'])));
- $row = $stm->fetch(PDO::FETCH_NUM);
- $key = $row[0];
- $jwtcheck = json_decode(json_encode(JWT::decode($_POST['jwtchk'], $key)), true);
- if ($jwtcheck['id'] != $qsetid || $jwtcheck['seed'] != $seed) {
- echo "ID/Seed did not check";
- exit;
- } else if ($seed>4999) {
- echo "Seed invalid";
- exit;
- }
- $scoredonsubmit = $jwtcheck['scoredonsubmit'];
- $showans = $jwtcheck['showans'];
- } else {
- $key = '';
- if ($seed<5000) {
- echo "Seed invalid";
- exit;
- }
- $scoredonsubmit = isset($_POST['showscoredonsubmit']);
- $showans = $_POST['showans'];
- }
-
- $lastanswers = array();
- $rawscores = array();
- list($score,$rawscores[0]) = scoreq(0,$qsetid,$seed,$_POST['qn0'],1);
- if (strpos($score,'~')===false) {
- $after = round($score,1);
- if ($after < 0) { $after = 0;}
- } else {
- $fparts = explode('~',$score);
- $after = array();
- foreach ($fparts as $k=>$fpart) {
- $after[$k] = round($fpart,2);
- if ($after[$k]<0) {$after[$k]=0;}
- }
- $after = implode('~',$after);
- }
- if (strpos($rawscores[0],'~')===false) {
- $rawafter = round($rawscores[0],1);
- if ($rawafter < 0) { $rawafter = 0;}
- } else {
- $fparts = explode('~',$rawscores[0]);
- $rawafter = array();
- foreach ($fparts as $k=>$fpart) {
- $rawafter[$k] = round($fpart,2);
- if ($rawafter[$k]<0) {$rawafter[$k]=0;}
- }
- $rawafter = implode('~',$rawafter);
- }
-
- $pts = getpts($after);
-
- $params = array('id'=>$qsetid, 'score'=>$pts, 'redisplay'=>"$seed;$rawafter;{$lastanswers[0]}");
- if (isset($_POST['auth'])) {
- $params["auth"] = $_POST['auth'];
- }
-
- $signed = JWT::encode($params, $key);
-
- echo '';
- if ($scoredonsubmit) {
- $colors = explode('~',$rawafter);
-
- // set above
- // $showans = (($issigned || $seed>4999) && (!isset($QS['showans']) || $QS['showans']=='true'));
-
- displayq(0, $qsetid, $seed, $showans?2:0, true, 0,false,false,false,$colors);
- } else {
- echo 'Saving score...
Caught error in evaluating a function in a question: '; - echo Sanitize::encodeStringForDisplay($thrownerror->getMessage()); - echo '
'; - } - } - if (!isset($answeights)) { - return array(1); - } else if (is_array($answeights)) { - return $answeights; - } else { - return explode(',',$answeights); - } -} - -function printscore($sc,$qsetid,$seed) { - global $DBH,$imasroot,$staticroot; - $poss = 1; - if (strpos($sc,'~')===false) { - $sc = str_replace('-1','N/A',$sc); - $out = sprintf(_('%1$s out of %2$s'), $sc, $poss); - $pts = $sc; - if (!is_numeric($pts)) { $pts = 0;} - } else { - $stm = $DBH->prepare("SELECT control FROM imas_questionset WHERE id=:id"); - $stm->execute(array(':id'=>$qsetid)); - $control = $stm->fetchColumn(0); - $ptposs = getansweights($control,$seed); - for ($i=0; $i";
- $scarr[$k] = "$bar $v/{$ptposs[$k]}";
- }
- $sc = implode(', ',$scarr);
- //$ptposs = implode(', ',$ptposs);
- $out = sprintf(_('%1$s out of %2$s (parts: %3$s)'), $pts, $poss, $sc);
- }
- $bar = ' ';
- return $bar . $out;
-}
-
-function getpts($sc) {
- if (strpos($sc,'~')===false) {
- if ($sc>0) {
- return $sc;
- } else {
- return 0;
- }
- } else {
- $sc = explode('~',$sc);
- $tot = 0;
- foreach ($sc as $s) {
- if ($s>0) {
- $tot+=$s;
- }
- }
- return round($tot,1);
- }
-}
-
-
-?>
diff --git a/actions.php b/actions.php
index 90d9d7aa51..84d89ff40d 100644
--- a/actions.php
+++ b/actions.php
@@ -67,7 +67,7 @@
$stm->execute(array(':cid'=>$_POST['courseid']));
$line = $stm->fetch(PDO::FETCH_ASSOC);
- if ($line==null) {
+ if ($line==false) {
$error = _('Course not found');
} else if (($line['allowunenroll']&2)==2) {
$error = _('Course is closed for self enrollment');
@@ -99,11 +99,8 @@
exit;
}
- if (isset($CFG['GEN']['newpasswords'])) {
- $md5pw = password_hash($_POST['pw1'], PASSWORD_DEFAULT);
- } else {
- $md5pw = md5($_POST['pw1']);
- }
+ $pwhash = password_hash($_POST['pw1'], PASSWORD_DEFAULT);
+
if ($emailconfirmation) {$initialrights = 0;} else {$initialrights = 10;}
if (isset($_POST['msgnot'])) {
$msgnot = 1;
@@ -162,7 +159,7 @@
$stm = $DBH->prepare($query);
$stm->execute(array(
':SID'=>$_POST['SID'],
- ':password'=>$md5pw,
+ ':password'=>$pwhash,
':rights'=>$initialrights,
':FirstName'=>Sanitize::stripHtmlTags($_POST['firstname']),
':LastName'=>Sanitize::stripHtmlTags($_POST['lastname']),
@@ -290,8 +287,8 @@
$query = "SELECT id,email,rights,jsondata FROM imas_users WHERE SID=:sid";
$stm = $DBH->prepare($query);
$stm->execute(array(':sid'=>$_POST['username']));
- if ($stm->rowCount()>0) {
- list($id,$email,$rights,$jsondata) = $stm->fetch(PDO::FETCH_NUM);
+ list($id,$email,$rights,$jsondata) = $stm->fetch(PDO::FETCH_NUM);
+ if ($id !== null) {
$jsondata = json_decode($jsondata,true);
if (isset($jsondata['lastemail']) && time() - $jsondata['lastemail'] < 60) {
echo 'Please wait and try again';
@@ -342,6 +339,7 @@
if (function_exists('getInstructorSupport')) {
getInstructorSupport($rights);
}
+
require_once "footer.php";
exit;
} else {
@@ -360,15 +358,39 @@
$linkdata = verify_pwreset_link($_POST['code']);
if (isset($linkdata['uid'])) {
- if (isset($CFG['GEN']['newpasswords'])) {
- $newpw = password_hash($_POST['pw1'], PASSWORD_DEFAULT);
- } else {
- $newpw = md5($_POST['pw1']);
- }
+ $newpw = password_hash($_POST['pw1'], PASSWORD_DEFAULT);
+
+ $stm = $DBH->prepare("SELECT jsondata,email FROM imas_users WHERE id=:id");
+ $stm->execute(array(':id'=>$linkdata['uid']));
+ list($jsondata,$oldemail) = $stm->fetch(PDO::FETCH_NUM);
+ json_decode($jsondata, true);
+ if (!is_array($jsondata)) {
+ $jsondata = [];
+ }
+
+ if (!isset($jsondata['chglog'])) {
+ $jsondata['chglog'] = [];
+ }
+ $now = time();
+ $jsondata['chglog'][$now] = ['chgpw' => 1];
+
+ $qarr = array(':id'=>$linkdata['uid'], ':jsondata'=>json_encode($jsondata),
+ ':now'=>time(), ':newpw'=>$newpw);
+ $query = "UPDATE imas_users SET password=:newpw,jsondata=:jsondata,lastemail=:now WHERE id=:id LIMIT 1";
+
+ if ($linkdata['recoverylink'] && !empty($_POST['email'])) {
+ $newemail = Sanitize::emailAddress(trim($_POST['email']));
+ if ($newemail !== '' && $newemail != $oldemail) {
+ $query = "UPDATE imas_users SET password=:newpw,jsondata=:jsondata,lastemail=:now,email=:email WHERE id=:id LIMIT 1";
+ $qarr[':email'] = $newemail;
+ $jsondata['chglog'][$now]['oldemail'] = $oldemail;
+ $jsondata['chglog'][$now]['newemail'] = $newemail;
+ }
+ }
+
+ $stm = $DBH->prepare($query);
+ $stm->execute($qarr);
- $query = "UPDATE imas_users SET password=:newpw WHERE id=:id LIMIT 1";
- $stm = $DBH->prepare($query);
- $stm->execute(array(':id'=>$linkdata['uid'], ':newpw'=>$newpw));
echo _("Password Reset"),". ";
echo "",_("Login with your new password"),"";
} else {
@@ -398,13 +420,14 @@
$query = "SELECT id,SID,lastaccess,jsondata FROM imas_users WHERE email=:email AND SID NOT LIKE 'lti-%'";
$stm = $DBH->prepare($query);
$stm->execute(array(':email'=>$_POST['email']));
- if ($stm->rowCount() > 0) {
- $cnt = $stm->rowCount();
+ $allrows = $stm->fetchAll(PDO::FETCH_ASSOC);
+ if (count($allrows)>0) {
+ $cnt = count($allrows);
$message = "".sprintf(_("This is an automated message from %s. Do not respond to this email"),$installname)."
\r\n"; $message .= "".sprintf(_("Your email was entered in the Username Lookup page on %s. If you did not do this, you may ignore and delete this message."),$installname)." "; $message .= _("All usernames using this email address are listed below")."
";
$ids = array();
- while ($row = $stm->fetch(PDO::FETCH_ASSOC)) {
+ foreach ($allrows as $row) {
$jsondata = json_decode($row['jsondata'],true);
if (isset($jsondata['lastemail']) && time() - $jsondata['lastemail'] < 60) {
echo 'Please wait and try again';
@@ -416,7 +439,7 @@
} else {
$lastlogin = date("n/j/y g:ia",$row['lastaccess']);
}
- $message .= _("Username").": {$row['SID']}. "._("Last logged in").": $lastlogin
";
+ $message .= _("Username").": ".Sanitize::encodeStringForDisplay($row['SID']).". "._("Last logged in").": " . Sanitize::encodeStringForDisplay($lastlogin). "
";
if (is_array($jsondata)) {
$jsondata['lastemail'] = time();
@@ -438,7 +461,7 @@
$query = "SELECT SID,lastaccess FROM imas_users WHERE email=:email AND SID LIKE 'lti-%'";
$stm = $DBH->prepare($query);
$stm->execute(array(':email'=>$_POST['email']));
- if ($stm->rowCount() > 0) {
+ if ($stm->fetchColumn(0) !== false) {
echo _("Your account can only be accessed through your school's learning management system.")," ",_("Return to login page"),"";
} else {
echo _("No usernames match this email address, or the email address provided is invalid.")," ",_("Return to login page"),"";
@@ -450,22 +473,37 @@
if (isset($_GET['originalSID']) && $_GET['originalSID']==$_GET['SID']) {
echo "true";
exit;
+ } else if (!isset($_GET['SID'])) {
+ echo "false";
+ exit;
}
$stm = $DBH->prepare("SELECT id FROM imas_users WHERE SID=:SID");
$stm->execute(array(':SID'=>$_GET['SID']));
- if ($stm->rowCount()>0) {
+ if ($stm->fetchColumn(0) !== false) {
echo "false";
} else {
echo "true";
}
exit;
- }
+ } else if (isset($_GET['action']) && $_GET['action']=='unsubscribe') {
+ require_once "init_without_validate.php";
+ if (!empty($_GET['email']) && !empty($_GET['ver']) &&
+ hash_equals(hash_hmac('sha256', $_GET['email'], $GLOBALS['CFG']['email']['secsalt'] ?? '123'), $_GET['ver'])
+ ) {
+ $stm = $DBH->prepare("UPDATE imas_users SET msgnotify=0 WHERE email=?");
+ $stm->execute([$_GET['email']]);
+ echo _('The account(s) using this email have been updated to not send email notifications of new messages. You can re-enable email notifications by editing your user profile.');
+ } else {
+ echo 'Invalid link';
+ }
+ exit;
+ }
require_once "init.php";
if (isset($_GET['action']) && $_GET['action']=="logout") {
$_SESSION = array();
if (isset($_COOKIE[session_name()])) {
- setcookie(session_name(), '', time()-42000, '/', '', false, true);
+ setsecurecookie(session_name(), '', time()-42000, true);
}
session_destroy();
} else if (isset($_GET['action']) && ($_GET['action']=="chgpwd" || $_GET['action']=="forcechgpwd")) {
@@ -485,16 +523,13 @@
exit;
}
}
- if ((md5($_POST['oldpw'])==$line['password'] || (isset($CFG['GEN']['newpasswords']) && password_verify($_POST['oldpw'],$line['password']))) && ($_POST['pw1'] == $_POST['pw2']) && $myrights>5) {
- if (isset($CFG['GEN']['newpasswords'])) {
- $newpw = password_hash($_POST['pw1'], PASSWORD_DEFAULT);
- } else {
- $newpw =md5($_POST['pw1']);
- }
+ if (password_verify($_POST['oldpw'],$line['password']) && ($_POST['pw1'] == $_POST['pw2']) && $myrights>5) {
+ $newpw = password_hash($_POST['pw1'], PASSWORD_DEFAULT);
+
$stm = $DBH->prepare("UPDATE imas_users SET password=:newpw,forcepwreset=0 WHERE id=:uid LIMIT 1");
$stm->execute(array(':uid'=>$userid, ':newpw'=>$newpw));
- $jsondata = json_decode($jsondata,true);
+ $jsondata = json_decode($line['jsondata'],true);
if ($_GET['action']=="chgpwd") {
require_once "./includes/email.php";
$message = '
'._('This is an automated message. Do not reply to this email.').'
'; @@ -520,6 +555,11 @@ } else { $jsondata = ['lastemail' => time()]; } + if (!isset($jsondata['chglog'])) { + $jsondata['chglog'] = []; + } + $jsondata['chglog'][time()] = ['chgpw' => 1]; + $query = "UPDATE imas_users SET jsondata=:jsondata WHERE id=:id"; $stm = $DBH->prepare($query); $stm->execute(array(':jsondata'=>json_encode($jsondata), ':id'=>$userid)); @@ -582,7 +622,7 @@ } else { $stm = $DBH->prepare("SELECT id FROM imas_teachers WHERE userid=:uid AND courseid=:cid"); $stm->execute(array(':uid'=>$userid, ':cid'=>$_POST['cid'])); - if ($stm->rowCount() > 0) { + if ($stm->fetchColumn(0) !== false) { require_once "header.php"; echo $pagetopper; echo _("You are a teacher for this course, and can't enroll as a student. Use Student View to see the class from a student's perspective, or create a dummy student account. "); @@ -592,7 +632,7 @@ } $stm = $DBH->prepare("SELECT id FROM imas_tutors WHERE userid=:uid AND courseid=:cid"); $stm->execute(array(':uid'=>$userid, ':cid'=>$_POST['cid'])); - if ($stm->rowCount() > 0) { + if ($stm->fetchColumn(0) !== false) { require_once "header.php"; echo $pagetopper; echo _("You are a tutor for this course, and can't enroll as a student. "); @@ -602,7 +642,7 @@ } $stm = $DBH->prepare("SELECT id FROM imas_students WHERE userid=:uid AND courseid=:cid"); $stm->execute(array(':uid'=>$userid, ':cid'=>$_POST['cid'])); - if ($stm->rowCount() > 0) { + if ($stm->fetchColumn(0) !== false) { require_once "header.php"; echo $pagetopper; echo _("You are already enrolled in the course. Click on the course name on the main page to access the course"),"\n"; @@ -665,7 +705,7 @@ $cid = Sanitize::courseId($_GET['cid']); $stm = $DBH->prepare("SELECT allowunenroll FROM imas_courses WHERE id=:cid"); $stm->execute(array(':cid'=>$cid)); - if ($stm->fetchColumn()==1) { + if (($stm->fetchColumn()&1)==1) { $stm = $DBH->prepare("DELETE FROM imas_students WHERE userid=:uid AND courseid=:cid"); $stm->execute(array(':uid'=>$userid,':cid'=>$cid)); /* @@ -761,19 +801,18 @@ } $layoutstr = implode('|',$homelayout); + $chguserimg = ''; if (is_uploaded_file($_FILES['stupic']['tmp_name'])) { - processImage($_FILES['stupic'],$userid,200,200); - processImage($_FILES['stupic'],'sm'.$userid,40,40); - $chguserimg = ",hasuserimg=1"; + $savedimg = processImage($_FILES['stupic'],$userid,200,200); + if ($savedimg) { + processImage($_FILES['stupic'],'sm'.$userid,40,40); + $chguserimg = ",hasuserimg=1"; + } } else if (isset($_POST['removepic'])) { deletecoursefile('userimg_'.$userid.'.jpg'); deletecoursefile('userimg_sm'.$userid.'.jpg'); $chguserimg = ",hasuserimg=0"; - } else { - $chguserimg = ''; - } - - //DEB $query = "UPDATE imas_users SET FirstName='{$_POST['firstname']}',LastName='{$_POST['lastname']}',email='{$_POST['email']}',msgnotify=$msgnot,qrightsdef=$qrightsdef,deflib='$deflib',usedeflib='$usedeflib',homelayout='$layoutstr',theme='{$_POST['theme']}',listperpage='$perpage'$chguserimg "; + } $stm = $DBH->prepare("SELECT email,jsondata,mfa,password FROM imas_users WHERE id=?"); $stm->execute(array($userid)); @@ -795,7 +834,7 @@ trim($old_email) != trim($_POST['email']) ) { // these changes require security check - if ((md5($_POST['oldpw'])==$oldpw || (isset($CFG['GEN']['newpasswords']) && password_verify($_POST['oldpw'],$oldpw))) && $myrights>5) { + if (password_verify($_POST['oldpw'],$oldpw) && $myrights>5) { // pw ok } else { require_once "header.php"; @@ -829,16 +868,15 @@ ':deflib'=>$deflib, ':usedeflib'=>$usedeflib, ':theme'=>'', ':listperpage'=>$perpage, ':uid'=>$userid)); $pwchanged = false; + $acctchangelog = []; if (isset($_POST['dochgpw'])) { if ($_POST['pw1'] == $_POST['pw2'] && $myrights>5) { - if (isset($CFG['GEN']['newpasswords'])) { - $newpw = password_hash($_POST['pw1'], PASSWORD_DEFAULT); - } else { - $newpw =md5($_POST['pw1']); - } + $newpw = password_hash($_POST['pw1'], PASSWORD_DEFAULT); + $stm = $DBH->prepare("UPDATE imas_users SET password = :newpw WHERE id = :uid"); $stm->execute(array(':uid'=>$userid, ':newpw'=>$newpw)); $pwchanged = true; + $acctchangelog['chgpw'] = 1; } else { require_once "header.php"; echo $pagetopper; @@ -878,6 +916,9 @@ $stm = $DBH->prepare("UPDATE imas_users SET mfa = '' WHERE id = :uid"); $stm->execute(array(':uid'=>$userid)); } + if ($_POST['dochgmfa'] != $lastmfatype) { + $acctchangelog['oldmfa'] = $lastmfatype; + } require_once "includes/userprefs.php"; storeUserPrefs(); @@ -890,6 +931,7 @@ $message .= ''.sprintf(_('Hi, your account details on %s were recently changed.'), $installname).' '; if ($old_email != $_POST['email']) { $message .= sprintf(_('Your email address was changed to %s.'), Sanitize::encodeStringForDisplay($_POST['email'])).' '; + $acctchangelog['oldemail'] = $old_email; } if ($pwchanged) { $message .= _('Your password was changed.'); @@ -915,9 +957,6 @@ } else { $jsondata = ['lastemail' => time()]; } - $query = "UPDATE imas_users SET jsondata=:jsondata WHERE id=:id"; - $stm = $DBH->prepare($query); - $stm->execute(array(':jsondata'=>json_encode($jsondata), ':id'=>$userid)); if ($pwchanged) { // record last password update time @@ -927,6 +966,16 @@ $_SESSION['started'] = time()+1; } } + if (!empty($acctchangelog)) { + if (!isset($jsondata['chglog'])) { + $jsondata['chglog'] = []; + } + $jsondata['chglog'][time()] = $acctchangelog; + + $query = "UPDATE imas_users SET jsondata=:jsondata WHERE id=:id"; + $stm = $DBH->prepare($query); + $stm->execute(array(':jsondata'=>json_encode($jsondata), ':id'=>$userid)); + } } else if (isset($_POST['action']) && $_POST['action'] == 'cleartrustedmfa') { $stm = $DBH->prepare("SELECT mfa FROM imas_users WHERE id= :uid"); @@ -958,7 +1007,13 @@ $stm->execute(array(':uid'=>$userid, ':hidelist'=>$hidelist)); } if ($isgb) { - echo '
',_('Changes Recorded.'),' '; + echo '',_('Changes Recorded.'); + if ($_GET['action']=="chguserinfo") { + echo ' ' . _('You may need to refresh the page to have new accessiblity settings applied.'); + } + echo ''; + echo ''; + echo ''; } else if (isset($_SESSION['ltiitemtype']) && $_SESSION['ltiitemtype']==0) { $stm = $DBH->prepare("SELECT courseid FROM imas_assessments WHERE id=:id"); $stm->execute(array(':id'=>$_SESSION['ltiitemid'])); diff --git a/admin/FCMsetup.php b/admin/FCMsetup.php index e2c053be24..581f23007a 100644 --- a/admin/FCMsetup.php +++ b/admin/FCMsetup.php @@ -14,33 +14,39 @@ exit; } -$placeinhead = ' - +$placeinhead = ' + '; - +$pagetitle = _('Notification Settings'); require_once "../header.php"; ?> + +
If you would like to receive new message notifications from this system, even when not visiting this site, click the button below. When your browser asks for permissions, click Allow. Note this system only works in some browsers diff --git a/admin/actions.php b/admin/actions.php index 237d34b5f5..6d070dbace 100644 --- a/admin/actions.php +++ b/admin/actions.php @@ -53,16 +53,22 @@ echo _("You don't have the authority for this action"); break; } + if (!isset($_POST['challenge']) || $_POST['challenge'] !== $_SESSION['secchallenge']) { + echo _('Error'); + exit; + } if ($_POST['newrights']>$myrights) { $_POST['newrights'] = $myrights; } $stm = $DBH->prepare("SELECT rights,groupid,jsondata FROM imas_users WHERE id=:id"); $stm->execute(array(':id'=>$_GET['id'])); - list($oldrights,$oldgroupid,$oldjsondata) = $stm->fetch(PDO::FETCH_NUM); + $row = $stm->fetch(PDO::FETCH_NUM); if ($row === false) { echo _("invalid id"); exit; - } else if ($myrights < 100 && ($myspecialrights&32)!=32 && $oldgroupid!=$groupid) { + } + list($oldrights,$oldgroupid,$oldjsondata) = $row; + if ($myrights < 100 && ($myspecialrights&32)!=32 && $oldgroupid!=$groupid) { echo "You don't have the authority for this action"; exit; } @@ -97,11 +103,8 @@ if ((isset($_POST['specialrights64']) && $myrights==100) || $_POST['newrights']==100) { $specialrights += 64; } - if (isset($CFG['GEN']['newpasswords'])) { - $hashpw = password_hash($_POST['newpassword'], PASSWORD_DEFAULT); - } else { - $hashpw = md5($_POST['newpassword']); - } + $hashpw = password_hash($_POST['newpassword'], PASSWORD_DEFAULT); + if ($_POST['newrights']>$myrights) { //checked above, but do it again $_POST['newrights'] = $myrights; } @@ -181,12 +184,22 @@ if ($chgJsondata) { $query .= ',jsondata=:jsondata'; } + if (!empty($_POST['removefromgroup'])) { + $query .= ',groupid=0'; // move to default group + $newgroup = 0; + } if (isset($_POST['doresetpw'])) { $query .= ',password=:password'; } $query .= " WHERE id=:id AND groupid=:groupid AND rights<100"; $stm = $DBH->prepare($query); $stm->execute($arr); + + if (!empty($_POST['removefromgroup'])) { + // fix library group + $stm = $DBH->prepare("UPDATE imas_libraries SET groupid=0 WHERE ownerid=:ownerid"); + $stm->execute(array(':ownerid'=>$_GET['id'])); + } } //if student being promoted, enroll in teacher enroll courses @@ -253,24 +266,16 @@ case "resetpwd": if ($myrights < 75) { echo "You don't have the authority for this action"; break;} if (isset($_POST['newpw'])) { - if (isset($CFG['GEN']['newpasswords'])) { - $md5pw = password_hash($_POST['newpw'], PASSWORD_DEFAULT); - } else { - $md5pw = md5($_POST['newpw']); - } + $pwhash = password_hash($_POST['newpw'], PASSWORD_DEFAULT); } else { - if (isset($CFG['GEN']['newpasswords'])) { - $md5pw = password_hash("password", PASSWORD_DEFAULT); - } else { - $md5pw =md5("password"); - } + $pwhash = password_hash("password", PASSWORD_DEFAULT); } if ($myrights < 100) { $stm = $DBH->prepare("UPDATE imas_users SET password=:password WHERE id=:id AND groupid=:groupid AND rights<100"); - $stm->execute(array(':password'=>$md5pw, ':id'=>$_GET['id'], ':groupid'=>$groupid)); + $stm->execute(array(':password'=>$pwhash, ':id'=>$_GET['id'], ':groupid'=>$groupid)); } else { $stm = $DBH->prepare("UPDATE imas_users SET password=:password WHERE id=:id"); - $stm->execute(array(':password'=>$md5pw, ':id'=>$_GET['id'])); + $stm->execute(array(':password'=>$pwhash, ':id'=>$_GET['id'])); } break; case "anonuser": @@ -300,7 +305,7 @@ } if ($stm->rowCount()==0) { break;} $toDelTable = array('user_prefs', 'students', 'teachers', 'tutors', - 'assessment_sessions', 'exceptions', 'bookmarks', 'content_track', + 'assessment_sessions', 'assessment_records', 'exceptions', 'bookmarks', 'content_track', 'forum_views', 'forum_subscriptions', 'grades', 'ltiusers', 'stugroupmembers'); foreach ($toDelTable as $table) { $stm = $DBH->prepare("DELETE FROM imas_$table WHERE userid=:userid"); @@ -349,6 +354,10 @@ if ($_POST['newrights']>$myrights) { $_POST['newrights'] = $myrights; } + if (!isset($_POST['challenge']) || $_POST['challenge'] !== $_SESSION['secchallenge']) { + echo _('Error'); + exit; + } $stm = $DBH->prepare("SELECT id FROM imas_users WHERE SID=:SID"); $stm->execute(array(':SID'=>$_POST['SID'])); $row = $stm->fetch(PDO::FETCH_NUM); @@ -358,11 +367,8 @@ echo "",_("Change rights for existing user"),"