-
-
+ Admin ";
+}
+?>
+
+
+
+ Update password
+
Logout
- | Update Password
-
@@ -162,9 +167,9 @@ else
function updatePass(id)
{
- var pass= prompt("Enter your New Password : ", "...");
+ var pass= prompt("Enter your new password : ", "...");
- if(!confirm('Are you sure to Reset your Password?'))
+ if(!confirm('Are you sure to reset your password?'))
{
return;
}
diff --git a/Reset_password.php b/Reset_password.php
index 95e045c..7af1740 100644
--- a/Reset_password.php
+++ b/Reset_password.php
@@ -46,4 +46,4 @@ $email=$_GET['email'];
-
\ No newline at end of file
+
diff --git a/Script.php b/Script.php
index 5c5a595..144729a 100644
--- a/Script.php
+++ b/Script.php
@@ -10,7 +10,7 @@
session_start();
date_default_timezone_set('Asia/Shanghai');
// CONNeCTION
-$con=mysqli_connect("localhost","Teecloudy","5q7Ol2e!#!","lrr");
+$con=mysqli_connect("localhost","username","password","lrr");
// Check connection
if (mysqli_connect_errno())
{
@@ -30,17 +30,30 @@ if (mysqli_connect_errno())
error_reporting(0);
if (!empty($_POST["frm_signup_1"])) {
- $student_id=mysqli_real_escape_string($con,$_POST["student_id"]);
- $passport=mysqli_real_escape_string($con,$_POST["passport"]);
-
- echo $student_id.' and '.$passport;
+ $student_id = mysqli_real_escape_string($con,$_POST["student_id"]);
+ $passport = mysqli_real_escape_string($con,$_POST["passport"]);
+
+ // validate student number
+ if (strlen($student_id) != 12 || is_numeric($student_id) == FALSE) {
+ $_SESSION["info_signup1"] = "Invalid student number.";
+ header("Location: index.php");
+ return;
+ }
+
+ // passport should be empty (not used)
+ if (strcmp(trim($passport), '') != 0) {
+ $_SESSION["info_signup1"] = "Passport is disused. Please leave it empty.";
+ header("Location: index.php");
+ return;
+ }
+
$result = mysqli_query($con,
"SELECT * FROM `students_data` WHERE Student_ID='$student_id'");
// Just removed this condition from the above command and (Passport_Number='$passport' or Passport_Number = '')
if(mysqli_num_rows($result)==0)
{
- $_SESSION["info_signup1"]="Student Information could not be verified ! Please contact Student Management Office.";
+ $_SESSION["info_signup1"]="Student number could not be verified! Please contact Student Management Office (lanhui at zjnu.edu.cn). Thanks.";
header("Location: index.php");
return;
}
@@ -61,7 +74,7 @@ if (!empty($_POST["frm_signup_1"])) {
}
else
{
- $_SESSION["info_signup1"]="Student ID already in use ! Please contact Student Management Office if you failed to login to your account.";
+ $_SESSION["info_signup1"]="Student ID already in use! Please contact Student Management Office (lanhui at zjnu.edu.cn).";
header("Location: index.php");
return;
}
@@ -83,35 +96,40 @@ if (!empty($_POST["frm_signup_1"])) {
// ############################### CREATE STUDENT USER ##################################
if (!empty($_POST["frm_signup_2"])) {
- $email=mysqli_real_escape_string($con,$_POST["email"]);
- $password=mysqli_real_escape_string($con,$_POST["password"]);
- $confirmpassword=mysqli_real_escape_string($con,$_POST["confirmpassword"]);
- $fullname=mysqli_real_escape_string($con,$_POST["fullname"]);
- $student_id=$_SESSION['user_student_id'];
- $passport= $_SESSION['user_passport'];
- $_SESSION['user_fullname']=$fullname;
- $_SESSION['user_type']="Student";
- $_SESSION['user_email']=$email;
+ $email = mysqli_real_escape_string($con,$_POST["email"]);
+ $password = mysqli_real_escape_string($con,$_POST["password"]);
+ $confirmpassword = mysqli_real_escape_string($con,$_POST["confirmpassword"]);
+ $fullname = mysqli_real_escape_string($con,$_POST["fullname"]);
+ $student_id = $_SESSION['user_student_id'];
+ $passport = $_SESSION['user_passport'];
+ $_SESSION['user_fullname'] = $fullname;
+ $_SESSION['user_type'] = "Student";
+ $_SESSION['user_email'] = $email;
// check confirmed password
if ( strcasecmp( $password, $confirmpassword ) != 0 ){
- $_SESSION['info_signup2']="Incorrect Password confirmation";
- header("Location: signup.php");
- return;
+ $_SESSION['info_signup2']="Password confirmation failed.";
+ header("Location: signup.php");
+ return;
}
- // $containsLetter = preg_match('/[a-zA-Z]/', $password);
- // $containsDigit = preg_match('/\d/', $password);
- // $containsSpecial = preg_match('/[^a-zA-Z\d]/', $password);
- $upperLetter = preg_match('@[A-Z]@', $password);
- $smallLetter = preg_match('@[a-z]@', $password);
- $containsDigit = preg_match('@[0-9]@', $password);
- $containsSpecial = preg_match('@[^\w]@', $password);
+
+ // validate email
+ if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+ $_SESSION['info_signup2']="Invalid email address.";
+ header("Location: signup.php");
+ return;
+ }
+
+ $upperLetter = preg_match('@[A-Z]@', $password);
+ $smallLetter = preg_match('@[a-z]@', $password);
+ $containsDigit = preg_match('@[0-9]@', $password);
+ $containsSpecial = preg_match('@[^\w]@', $password);
$containsAll = $upperLetter && $smallLetter && $containsDigit && $containsSpecial;
- // check for strong password
- if($containsAll < 8)
- {
- $_SESSION['info_signup2']="Password should contain Letters , Numbers and sepcial characters";
- header("Location: signup.php");
- return;
+
+ // check for strong password
+ if($containsAll < 8) {
+ $_SESSION['info_signup2']="Password must have at least characters that include letters, numbers and sepcial characters.";
+ header("Location: signup.php");
+ return;
}
// check if email is taked
$result = mysqli_query($con,
@@ -128,12 +146,12 @@ if (!empty($_POST["frm_signup_1"])) {
. "('$email','$password_hash','$fullname','Student','$student_id','$passport')";
if ($con->query($sql) === TRUE) {
- header("Location: Courses.php");
-
-} else {
- echo "Error: " . $sql . " " . $con->error;
+ header("Location: Courses.php");
+ } else {
+ // echo "Error: " . $sql . " " . $con->error;
+ echo "Something really bad happend during sign up.";
+ }
}
- }
@@ -142,6 +160,24 @@ if (!empty($_POST["frm_signup_1"])) {
if (!empty($_POST["frm_login"])) {
$user=mysqli_real_escape_string($con,$_POST["user"]);
+
+ $is_student_number = 0;
+
+ // Validate student number
+ if (is_numeric($user) && strlen($user) != 12) {
+ $_SESSION["info_login"] = "Invalid student number:"."$user";
+ header("Location: index.php");
+ return;
+ } else {
+ $is_student_number = 1;
+ }
+
+ if ($is_student_number == 0 && !filter_var($user, FILTER_VALIDATE_EMAIL)) {
+ $_SESSION["info_login"] = "Invalid email address: "."$user";
+ header("Location: index.php");
+ return;
+ }
+
$password=mysqli_real_escape_string($con,$_POST["password"]);
// $hashed_password=hash('sha512', $password); Not necessary in the login
$result = mysqli_query($con, "SELECT * FROM users_table WHERE (Student_ID='$user') OR (Email='$user')");
@@ -149,16 +185,16 @@ if(mysqli_num_rows($result)==0)
{
$_SESSION["info_login"]="Inavlid login information.";
-echo $_SESSION["info_login"];
+ echo $_SESSION["info_login"];
-header("Location: index.php");
+ header("Location: index.php");
}
else
{
while($row = mysqli_fetch_assoc($result)) {
// verify the hashed password and unhashed password
$sha512pass = hash('sha512', $password); // for backward compatibility. Old passwords were hashed using SHA512 algorithm.
- if(password_verify($password, $row["Password"]) or $sha512pass == $row["HashPassword"] or $password == $row["Password"]){
+ if(password_verify($password, $row["Password"]) or $sha512pass == $row["HashPassword"]) {
$_SESSION['user_id']=$row['User_ID'];
$_SESSION['user_email']=$row['Email'];
$_SESSION['user_student_id']=$row['Student_ID'];
@@ -205,85 +241,39 @@ header("Location: index.php");
-
// ################################ Recover Password #####################################
if (!empty($_POST["frm_recover_password"])) {
- $email=mysqli_real_escape_string($con,$_POST["email"]);
-
- $result = mysqli_query($con,
- "SELECT * FROM Users_Table WHERE email='$email'");
-if(mysqli_num_rows($result)==0)
- {
- $_SESSION["info_recover_password"]="Email address is not recognised.";
-
+ $student_id = mysqli_real_escape_string($con,$_POST["sno"]);
+ $email = mysqli_real_escape_string($con,$_POST["email"]);
-echo "Email address was not recognised";
-return;
-header("Location: recover_password.php");
- }
- else
- {
- while($row = mysqli_fetch_assoc($result)) {
+ // validate student number
+ if (strlen($student_id) != 12 || is_numeric($student_id) == FALSE) {
+ echo "Invalid student number.";
+ return;
+ }
- $userid=$row['User_ID'];
-
- $email=urlencode($row['Email']);
- $pure_email=$row['Email'];
- $id=$row['Student_ID'];
-
- $token=$userid*$userid*$userid+$userid*0.00343;
-
- $name=$row['Full_Name'];
-$link="Click Here (点击这里) ";
-$msg=urlencode("
Lab Report Repository System - ZJNU
Hi "
-.$name.
-" Here is your password recovery link , "
-.$link.
-" to reset your password , please ignore this message if you did not request password recovery.