. /** * Verify Page * * @package MantisBT * @copyright Copyright 2000 - 2002 Kenzaburo Ito - kenito@300baud.org * @copyright Copyright 2002 MantisBT Team - mantisbt-dev@lists.sourceforge.net * @author Marcello Scata' ITALY * @link http://www.mantisbt.org * * @uses core.php * @uses authentication_api.php * @uses config_api.php * @uses constant_inc.php * @uses gpc_api.php * @uses print_api.php * @uses user_api.php * * Unhandled exceptions will be caught by the default error handler * @noinspection PhpUnhandledExceptionInspection */ # don't auto-login when trying to verify new user $g_login_anonymous = false; use Mantis\Exceptions\ClientException; require_once( 'core.php' ); require_api( 'authentication_api.php' ); require_api( 'config_api.php' ); require_api( 'constant_inc.php' ); require_api( 'gpc_api.php' ); require_api( 'html_api.php' ); require_api( 'lang_api.php' ); require_api( 'print_api.php' ); require_api( 'string_api.php' ); require_api( 'user_api.php' ); require_api( 'utility_api.php' ); require_css( 'login.css' ); # check if at least one way to get here is enabled if( !auth_signup_enabled() && OFF == config_get( 'lost_password_feature' ) && OFF == config_get( 'send_reset_password' ) ) { throw new ClientException( "Lost password feature is disabled", ERROR_LOST_PASSWORD_NOT_ENABLED ); } $f_user_id = gpc_get_int( 'id' ); $f_confirm_hash = gpc_get_string( 'confirm_hash' ); # Make sure the user exists and extract information $t_row = user_get_row( $f_user_id ); extract( $t_row, EXTR_PREFIX_ALL, 'u' ); # force logout on the current user if already authenticated if( auth_is_user_authenticated() ) { auth_logout(); # reload the page after logout print_header_redirect( 'verify.php?id=' . $f_user_id . '&confirm_hash=' . $f_confirm_hash ); } # Make sure the hash is valid and not meant for an e-mail address validation $t_token_confirm_hash = token_get_value( TOKEN_ACCOUNT_ACTIVATION, $f_user_id ); $t_token_change_email = token_get_value( TOKEN_ACCOUNT_CHANGE_EMAIL, $f_user_id ); if( $t_token_confirm_hash == null || $f_confirm_hash !== $t_token_confirm_hash || $t_token_change_email !== null ) { throw new ClientException( "Invalid confirmation hash", ERROR_LOST_PASSWORD_CONFIRM_HASH_INVALID ); } user_reset_failed_login_count_to_zero( $f_user_id ); user_reset_lost_password_in_progress_count_to_zero( $f_user_id ); # fake login so the user can set their password auth_attempt_script_login( $u_username ); user_increment_login_count( $f_user_id ); $t_can_change_password = auth_can_set_password( $f_user_id ); $t_form_title = lang_get( 'edit_account_title' ); layout_login_page_begin( $t_form_title ); ?>