diff options
Diffstat (limited to 'include')
| -rw-r--r-- | include/account.php | 9 | ||||
| -rw-r--r-- | include/auth.php | 13 |
2 files changed, 20 insertions, 2 deletions
diff --git a/include/account.php b/include/account.php index edfd1bf05..138db3290 100644 --- a/include/account.php +++ b/include/account.php @@ -254,6 +254,7 @@ function verify_email_address($arr) { else logger('send_reg_approval_email: failed to ' . $admin['email'] . 'account_id: ' . $arr['account']['account_id']); + return $res; } @@ -476,8 +477,14 @@ function user_approve($hash) { intval(ACCOUNT_PENDING), intval($register[0]['uid']) ); + $r = q("update account set account_flags = (account_flags ^ %d) where (account_flags & %d) and account_id = %d limit 1", + intval(ACCOUNT_UNVERIFIED), + intval(ACCOUNT_UNVERIFIED), + intval($register[0]['uid']) + ); - info( t('Account approved.') . EOL ); + info( t('Account verified. Please login.') . EOL ); + return true; } diff --git a/include/auth.php b/include/auth.php index e8f13d0fb..8e02b7b4f 100644 --- a/include/auth.php +++ b/include/auth.php @@ -35,13 +35,24 @@ function nuke_session() { function account_verify_password($email,$pass) { + $email_verify = get_config('system','verify_email'); + $register_policy = get_config('system','register_policy'); + + // Currently we only verify email address if there is an open registration policy. + // This isn't because of any policy - it's because the workflow gets too complicated if + // you have to verify the email and then go through the account approval workflow before + // letting them login. + + if(($email_verify) && ($register_policy == REGISTER_OPEN) && ($record['account_flags'] & ACCOUNT_UNVERIFIED)) + return null; + $r = q("select * from account where account_email = '%s'", dbesc($email) ); if(! ($r && count($r))) return null; foreach($r as $record) { - if(($record['account_flags'] == ACCOUNT_OK) || ($record['account_flags'] == ACCOUNT_UNVERIFIED) + if(($record['account_flags'] == ACCOUNT_OK) && (hash('whirlpool',$record['account_salt'] . $pass) === $record['account_password'])) { logger('password verified for ' . $email); return $record; |