stephan/ms1inscription-v5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor account management functionality to enhance password reset process. Exclude 'compte_reset' from session checks in compte.php to prevent conflicts with active sessions. Implement safe return link handling after logout in inc_fx_compte.php, ensuring users can navigate back to the reset page securely. Add user notifications for active sessions during password reset attempts, aligning with MSIN-4401 requirements for improved user experience.

Browse Source
This commit is contained in:
stephan
2026-07-13 11:19:13 -04:00
parent 4816bcf024
commit 7d08e7ec7c
2 changed files with 83 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
compte.php
View File

@ -107,7 +107,8 @@ if ($strCode != 'compte_login' && $strCode != 'compte_motdepasse' && $strCode !=
}
// Déjà connecté sur login / mot de passe / inscription : accueil compte, sans polluer redirect_after_login.
if (($strCode == 'compte_login' || $strCode == 'compte_motdepasse' || $strCode == 'compte_nouveau' || $strCode == 'compte_reset') && isset($_SESSION['com_id'])) {
// MSIN-4401 — compte_reset exclu : géré dans fxShowFormReset (conflit autre session).
if (($strCode == 'compte_login' || $strCode == 'compte_motdepasse' || $strCode == 'compte_nouveau') && isset($_SESSION['com_id'])) {
header('Location: ' . $vDomaine . '/' . $strPage);
exit;
}

82
php/inc_fx_compte.php
View File

@ -1351,6 +1351,19 @@ function fxLogout($strLangue = 'fr')
exit;
}
// MSIN-4401 — retour vers lien reset après déconnexion (chemin relatif sûr uniquement).
if (!empty($_GET['return'])) {
$strReturn = (string)$_GET['return'];
if ($strReturn !== '' && $strReturn[0] === '/'
&& preg_match('#^/(compte|account)/reset(\?|$)#i', $strReturn)
&& strpos($strReturn, '//') === false
&& strpos($strReturn, "\n") === false
&& strpos($strReturn, "\r") === false) {
header('Location: ' . $vDomaine . $strReturn);
exit;
}
}
header('Location: ' . $vDomaine . '/' . $strPage);
exit;
}
@ -1364,6 +1377,59 @@ function fxShowFormReset($arrData, $strLangue)
$infoCompte = $objDatabase->fxGetRow($sqlCourriel);
if ($infoCompte != null) {
// MSIN-4401 — déjà connecté sous un autre compte : ne pas afficher le formulaire.
$intSessionComId = intval($_SESSION['com_id'] ?? 0);
$intTargetComId = intval($infoCompte['com_id']);
if ($intSessionComId > 0 && $intSessionComId !== $intTargetComId) {
$strSessionLabel = trim(
(string)($_SESSION['com_info']['com_prenom'] ?? $_SESSION['com_prenom'] ?? '')
. ' '
. (string)($_SESSION['com_info']['com_nom'] ?? '')
);
if ($strSessionLabel === '') {
$strSessionLabel = (string)($_SESSION['com_info']['com_courriel'] ?? ('#' . $intSessionComId));
}
$strTargetLabel = trim(($infoCompte['com_prenom'] ?? '') . ' ' . ($infoCompte['com_nom'] ?? ''));
if ($strTargetLabel === '') {
$strTargetLabel = (string)$infoCompte['com_courriel'];
}
$strReturnPath = ($strLangue === 'en' ? '/account' : '/compte') . '/reset?'
. http_build_query(array(
't' => $arrData['t'],
'm' => $arrData['m'],
'id' => $arrData['id'],
));
$strLogoutUrl = $vDomaine . '/logout.php?lang=' . urlencode($strLangue)
. '&return=' . rawurlencode($strReturnPath);
$strStayUrl = $vDomaine . '/' . ($strLangue === 'en' ? 'account' : 'compte');
?>
<div class="alert alert-warning" role="alert">
<?php if ($strLangue === 'en') { ?>
<p class="mb-2">You are currently signed in as
<strong><?php echo htmlspecialchars($strSessionLabel, ENT_QUOTES, 'UTF-8'); ?></strong>.</p>
<p class="mb-3">This link is for
<strong><?php echo htmlspecialchars($strTargetLabel, ENT_QUOTES, 'UTF-8'); ?></strong>
(<?php echo htmlspecialchars((string)$infoCompte['com_courriel'], ENT_QUOTES, 'UTF-8'); ?>).
Sign out first to set that account&rsquo;s password.</p>
<?php } else { ?>
<p class="mb-2">Vous êtes actuellement connecté en tant que
<strong><?php echo htmlspecialchars($strSessionLabel, ENT_QUOTES, 'UTF-8'); ?></strong>.</p>
<p class="mb-3">Ce lien concerne le compte
<strong><?php echo htmlspecialchars($strTargetLabel, ENT_QUOTES, 'UTF-8'); ?></strong>
(<?php echo htmlspecialchars((string)$infoCompte['com_courriel'], ENT_QUOTES, 'UTF-8'); ?>).
Déconnectez-vous d&rsquo;abord pour choisir le mot de passe de ce compte.</p>
<?php } ?>
<a class="btn btn-primary rounded-0 mr-2" href="<?php echo htmlspecialchars($strLogoutUrl, ENT_QUOTES, 'UTF-8'); ?>">
<?php echo ($strLangue === 'en') ? 'Sign out and continue' : 'Se déconnecter et continuer'; ?>
</a>
<a class="btn btn-outline-secondary rounded-0" href="<?php echo htmlspecialchars($strStayUrl, ENT_QUOTES, 'UTF-8'); ?>">
<?php echo ($strLangue === 'en') ? 'Stay on my current account' : 'Rester sur mon compte actuel'; ?>
</a>
</div>
<?php
return;
}
if (true) {
?>
<script type="text/javascript">
@ -1454,8 +1520,22 @@ function fxResetPassword($arrData, $strLangue)
{
global $vDomaine, $objDatabase;
$strPassword = password_hash($objDatabase->fxEscape($arrData['com_password_a']), PASSWORD_DEFAULT);
$intComId = intval($arrData['id']);
$intSessionComId = intval($_SESSION['com_id'] ?? 0);
// MSIN-4401 — refuse si une autre session compte est active
if ($intSessionComId > 0 && $intSessionComId !== $intComId) {
$_SESSION['msg'] = 'e212';
$strPage = ($strLangue === 'en') ? 'account' : 'compte';
?>
<script type="text/javascript">
document.location.href = '<?php echo $vDomaine . '/' . $strPage . '/reset?'
. http_build_query(array('t' => $arrData['t'], 'm' => $arrData['m'], 'id' => $arrData['id'])); ?>';
</script>
<?php
exit;
}
$strPassword = password_hash($objDatabase->fxEscape($arrData['com_password_a']), PASSWORD_DEFAULT);
$sqlUpdate = "UPDATE inscriptions_comptes SET com_password = '" . $strPassword . "',
com_reset_token = ''