From bee5fcbe24b90ae8b70845296ffe6078f9f33df6 Mon Sep 17 00:00:00 2001 From: David Goodwin Date: Tue, 13 Aug 2019 09:19:22 +0100 Subject: [PATCH] improve setup form - only display "add superadmin account" if setup password is configured; change verbs depending on context etc; see https://github.com/postfixadmin/postfixadmin/issues/263 --- public/setup.php | 217 +++++++++++++++++++++++------------------------ 1 file changed, 105 insertions(+), 112 deletions(-) diff --git a/public/setup.php b/public/setup.php index 508c3001..0f6c18d3 100644 --- a/public/setup.php +++ b/public/setup.php @@ -276,91 +276,99 @@ require(dirname(__FILE__) . '/../templates/header.php'); if ($error != 0) { print "

Please fix the errors listed above.

"; } else { - print "

Everything seems fine... attempting to create/update database structure

\n"; - require_once(dirname(__FILE__) . '/upgrade.php'); + print "

Everything seems fine... attempting to create/update database structure

\n"; + require_once(dirname(__FILE__) . '/upgrade.php'); - $tUsername = ''; - $setupMessage = ''; - $lostpw_error = 0; + $tUsername = ''; + $setupMessage = ''; + $lostpw_error = 0; - $setuppw = ""; - if (isset($CONF['setup_password'])) { - $setuppw = $CONF['setup_password']; - } - - if (safepost("form") == "setuppw") { - # "setup password" form submitted - if (safepost('setup_password') != safepost('setup_password2')) { - $setupMessage = "The two passwords differ!"; - $lostpw_error = 1; - } else { - list($lostpw_error, $lostpw_result) = check_setup_password(safepost('setup_password'), 1); - $setupMessage = $lostpw_result; - $setuppw = "changed"; - } - } elseif (safepost("form") == "createadmin") { - # "create admin" form submitted - list($pw_check_error, $pw_check_result) = check_setup_password(safepost('setup_password')); - if ($pw_check_result != 'pass_OK') { - $error += 1; - $setupMessage = $pw_check_result; + $setuppw = ""; + if (isset($CONF['setup_password'])) { + $setuppw = $CONF['setup_password']; } - if ($error == 0 && $pw_check_result == 'pass_OK') { - // XXX need to ensure domains table includes an 'ALL' entry. - $table_domain = table_by_key('domain'); - $rows = db_query_all("SELECT * FROM $table_domain WHERE domain = 'ALL'"); - if (empty($rows)) { - db_insert('domain', array('domain' => 'ALL', 'description' => '', 'transport' => '')); // all other fields should default through the schema. + if (safepost("form") == "setuppw") { + # "setup password" form submitted + if (safepost('setup_password') != safepost('setup_password2')) { + $setupMessage = "The two passwords differ!"; + $lostpw_error = 1; + } else { + list($lostpw_error, $lostpw_result) = check_setup_password(safepost('setup_password'), 1); + $setupMessage = $lostpw_result; + $setuppw = "changed"; + } + } elseif (safepost("form") == "createadmin") { + # "create admin" form submitted + list($pw_check_error, $pw_check_result) = check_setup_password(safepost('setup_password')); + if ($pw_check_result != 'pass_OK') { + $error += 1; + $setupMessage = $pw_check_result; } - $values = array( - 'username' => safepost('username'), - 'password' => safepost('password'), - 'password2' => safepost('password2'), - 'superadmin' => 1, - 'domains' => array(), - 'active' => 1, - ); + if ($error == 0 && $pw_check_result == 'pass_OK') { + // XXX need to ensure domains table includes an 'ALL' entry. + $table_domain = table_by_key('domain'); + $rows = db_query_all("SELECT * FROM $table_domain WHERE domain = 'ALL'"); + if (empty($rows)) { + db_insert('domain', array('domain' => 'ALL', 'description' => '', 'transport' => '')); // all other fields should default through the schema. + } + + $values = array( + 'username' => safepost('username'), + 'password' => safepost('password'), + 'password2' => safepost('password2'), + 'superadmin' => 1, + 'domains' => array(), + 'active' => 1, + ); + + list($error, $setupMessage, $errormsg) = create_admin($values); + + if ($error != 0) { + $tUsername = htmlentities($values['username']); + } else { + $setupMessage .= "

You are done with your basic setup. "; + $setupMessage .= "

You can now login to PostfixAdmin using the account you just created."; + } + } + } - list($error, $setupMessage, $errormsg) = create_admin($values); - if ($error != 0) { - $tUsername = htmlentities($values['username']); - } else { - $setupMessage .= "

You are done with your basic setup. "; - $setupMessage .= "

You can now login to PostfixAdmin using the account you just created."; - } + if (!isset($_SERVER['HTTPS'])) { + echo "

Warning: connection not secure, switch to https if possible

"; } - } - if (($setuppw == "" || $setuppw == "changeme" || safeget("lostpw") == 1 || $lostpw_error != 0) /* && $_SERVER['REQUEST_METHOD'] != "POST" */) { - # show "create setup password" form?> + ?>
+ + For a new installation, you need to generate a 'setup_password' to go into your config.local.php file.

+

You can use the form below, or run something like 

php -r 'echo "somesalt:" . sha1("somesalt:" . "password");'
in a shell, after changing the salt.

+EOF; + $change = "Generate"; + } + ?> + +

$CONF['setup_password']

+
- - - - - - - - - + - + @@ -371,62 +379,47 @@ require(dirname(__FILE__) . '/../templates/header.php'); + if ($change != 'Generate') { ?> -
-
- - -

Change setup password

Warning: connection not secure, switch to https if possible

- - - - +

Add a SuperAdmin Account

+ +
+ + +

Create superadmin account

- + + + - - - - - - - - - - - - - - - - - - - - - - - - -

Warning: connection not secure, switch to https if possible
Lost password?
-
-
+ + + + + + + + + + + + + + + + + + + + + -

Since version 2.3 there is no requirement to delete setup.php

Check the config.inc.php file for any other settings that you may need to change.

- +