ThaMunsta/itflow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Client logins/password - Add tracking in DB when passwords are changed/rotated

Browse Source
This commit is contained in:
Marcus Hill
2023-10-01 15:22:42 +01:00
parent 203ef85997
commit c768034a1b
4 changed files with 916 additions and 890 deletions
Download Patch File Download Diff File Expand all files Collapse all files
database_updates.php
+19 -3
View File
@@ -1358,11 +1358,27 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '0.8.5'");
}
//if (CURRENT_DATABASE_VERSION == '0.8.5') {
//Insert queries here required to update to DB version 0.8.6
if (CURRENT_DATABASE_VERSION == '0.8.5') {
// Insert queries here required to update to DB version 0.8.6 (Adding login entry password change tracking)
mysqli_query($mysqli, "ALTER TABLE `logins` ADD `login_password_changed_at` datetime DEFAULT current_timestamp() AFTER `login_accessed_at`");
// For the safest initial value, set login_password_changed_at to when the login entry was created (as there is no guarantee the password was changed just because the record was updated)
$sql_logins = mysqli_query($mysqli, "SELECT login_id, login_created_at FROM logins WHERE login_password IS NOT NULL AND login_archived_at IS NULL");
foreach ($sql_logins as $row) {
$login_id = $row['login_id'];
$login_password_changed_at = $row['login_created_at'];
mysqli_query($mysqli, "UPDATE logins SET login_password_changed_at = '$login_password_changed_at' WHERE login_id = '$login_id'");
}
// Then, update the database to the next sequential version
//mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '0.8.6'");
mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '0.8.6'");
}
//if (CURRENT_DATABASE_VERSION == '0.8.6') {
// Insert queries here required to update to DB version 0.8.7
// Then, update the database to the next sequential version
//mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '0.8.7'");
//}
} else {
database_version.php
+1 -1
View File
@@ -5,4 +5,4 @@
* It is used in conjunction with database_updates.php
*/
DEFINE("LATEST_DATABASE_VERSION", "0.8.5");
DEFINE("LATEST_DATABASE_VERSION", "0.8.6");
db.sql
+1
View File
@@ -759,6 +759,7 @@ CREATE TABLE `logins` (
`login_updated_at` datetime DEFAULT NULL ON UPDATE current_timestamp(),
`login_archived_at` datetime DEFAULT NULL,
`login_accessed_at` datetime DEFAULT NULL,
`login_password_changed_at` datetime DEFAULT current_timestamp(),
`login_contact_id` int(11) NOT NULL DEFAULT 0,
`login_vendor_id` int(11) NOT NULL DEFAULT 0,
`login_asset_id` int(11) NOT NULL DEFAULT 0,
post/login.php
+9
View File
@@ -31,6 +31,15 @@ if(isset($_POST['edit_login'])){
$login_id = intval($_POST['login_id']);
// Determine if the password has actually changed (salt is rotated on all updates, so have to dencrypt both and compare)
$current_password = decryptLoginEntry(mysqli_fetch_row(mysqli_query($mysqli, "SELECT login_password FROM logins WHERE login_id = $login_id"))[0]); // Get current login password
$new_password = decryptLoginEntry($password); // Get the new password being set (already encrypted by the login model)
if ($current_password !== $new_password) {
// The password has been changed - update the DB to track
mysqli_query($mysqli, "UPDATE logins SET login_password_changed_at = NOW() WHERE login_id = $login_id");
}
// Update the login entry with the new details
mysqli_query($mysqli,"UPDATE logins SET login_name = '$name', login_description = '$description', login_uri = '$uri', login_username = '$username', login_password = '$password', login_otp_secret = '$otp_secret', login_note = '$note', login_important = $important, login_contact_id = $contact_id, login_vendor_id = $vendor_id, login_asset_id = $asset_id, login_software_id = $software_id WHERE login_id = $login_id");
// Logging