X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=plugins%2Fchange_password%2Foptions.php;h=feca9422328bc26f8a79726846d61e30066493c3;hb=a15b73a49b070358cf1e8ec699911df67e58ef9e;hp=04a75440e6dc6c7912d4c139acc9ee1520f01ceb;hpb=b11b4108a47cf77f4b3336dc48ee35d34ade6208;p=squirrelmail.git

diff --git a/plugins/change_password/options.php b/plugins/change_password/options.php
index 04a75440..feca9422 100644
--- a/plugins/change_password/options.php
+++ b/plugins/change_password/options.php
@@ -3,43 +3,79 @@
 /**
  * options.php - Change Password HTML page
  *
- * Copyright (c) 2004 The SquirrelMail Project Team
- * Licensed under the GNU GPL. For full terms see the file COPYING.
- *
- * $Id$
+ * @copyright 2004-2010 The SquirrelMail Project Team
+ * @license http://opensource.org/licenses/gpl-license.php GNU Public License
+ * @version $Id$
  * @package plugins
  * @subpackage change_password
  */
 
-define('SM_PATH','../../');
+/**
+ * Include the SquirrelMail initialization file.
+ */
+require('../../include/init.php');
+
+include_once (SM_PATH . 'plugins/change_password/functions.php');
+include_once (SM_PATH . 'functions/forms.php');
+
+/** load default config */
+if (file_exists(SM_PATH . 'plugins/change_password/config_default.php')) {
+    include_once (SM_PATH . 'plugins/change_password/config_default.php');
+} else {
+    // somebody decided to remove default config
+    $cpw_backend = 'template';
+    $cpw_pass_min_length = 4;
+    $cpw_pass_max_length = 25;
+    $cpw_require_ssl = FALSE;
+}
+
+/**
+ * prevent possible corruption of configuration overrides in
+ * register_globals=on and preloaded php scripts.
+ */
+$cpw_ldap=array();
+$cpw_merak=array();
+$cpw_mysql=array();
+$cpw_poppassd=array();
+$cpw_vmailmgrd=array();
+
+/** load site config */
+if (file_exists(SM_PATH . 'config/change_password_config.php')) {
+    include_once (SM_PATH . 'config/change_password_config.php');
+} elseif (file_exists(SM_PATH . 'plugins/change_password/config.php')) {
+    include_once (SM_PATH . 'plugins/change_password/config.php');
+}
 
-require_once (SM_PATH . 'include/validate.php');
-require_once (SM_PATH . 'functions/page_header.php');
-require_once (SM_PATH . 'plugins/change_password/functions.php');
-require_once (SM_PATH . 'plugins/change_password/config.php');
-require_once (SM_PATH . 'functions/forms.php');
+// must load backend libraries here in order to get working change_password_init hook.
+if (file_exists(SM_PATH . 'plugins/change_password/backend/'.$cpw_backend.'.php')) {
+   include_once(SM_PATH . 'plugins/change_password/backend/'.$cpw_backend.'.php');
+}
 
 /* the form was submitted, go for it */
 if(sqgetGlobalVar('cpw_go', $cpw_go, SQ_POST)) {
 
+    // security check
+    sqgetGlobalVar('smtoken', $submitted_token, SQ_POST, '');
+    sm_validate_security_token($submitted_token, 3600, TRUE);
+
     /* perform basic checks */
     $Messages = cpw_check_input();
-    
+
     /* if no errors, go ahead with the actual change */
     if(count($Messages) == 0) {
         $Messages = cpw_do_change();
     }
 }
 
-displayPageHeader($color, 'None');
+displayPageHeader($color);
 
-do_hook('change_password_init');
+do_hook('change_password_init', $null);
 ?>
 
 <br />
 <table align="center" cellpadding="2" cellspacing="2" border="0">
 <tr><td bgcolor="<?php echo $color[0] ?>">
-   <center><b><?php echo _("Change Password") ?></b></center>
+   <div style="text-align: center;"><b><?php echo _("Change Password") ?></b></div>
 </td><?php
 
 if (isset($Messages) && count($Messages) > 0) {
@@ -51,7 +87,8 @@ if (isset($Messages) && count($Messages) > 0) {
 }
 
 ?><tr><td>
-    <?php echo addForm($_SERVER['PHP_SELF'], 'POST'); ?>
+    <?php echo addForm($_SERVER['PHP_SELF'], 'post'); ?>
+    <input type="hidden" name="smtoken" value="<?php echo sm_generate_security_token() ?>" />
     <table>
       <tr>
         <th align="right"><?php echo _("Current Password:")?></th>
@@ -67,10 +104,10 @@ if (isset($Messages) && count($Messages) > 0) {
       </tr>
       <tr>
         <td align="center" colspan="2">
-	<?php echo addSubmit(_("Change Password"), 'cpw_go'); ?></td>
+        <?php echo addSubmit(_("Change Password"), 'cpw_go'); ?></td>
       </tr>
     </table>
     </form>
 </td></tr>
-</tr></table>
+</table>
 </body></html>