int csa_donewpw(void *source, int cargc, char **cargv) { reguser *rup; nick *sender=source; unsigned int same=0; time_t t; int pq; if (cargc<3) { chanservstdmessage(sender, QM_NOTENOUGHPARAMS, "newpass"); return CMD_ERROR; } if (!(rup=getreguserfromnick(sender))) return CMD_ERROR; if (!checkpassword(rup, cargv[0])) { chanservstdmessage(sender, QM_AUTHFAIL); cs_log(sender,"NEWPASS FAIL username %s bad password %s",rup->username,cargv[0]); return CMD_ERROR; } if (strcmp(cargv[1],cargv[2])) { chanservstdmessage(sender, QM_PWDONTMATCH); /* Sorry, passwords do not match */ cs_log(sender,"NEWPASS FAIL username %s new passwords don't match (%s vs %s)",rup->username,cargv[1],cargv[2]); return CMD_ERROR; } if (!strcmp(cargv[0],cargv[1])) { /* If they are the same then continue anyway but don't send the hook later. */ same=1; } pq = csa_checkpasswordquality(cargv[1]); if(pq == QM_PWTOSHORT) { chanservstdmessage(sender, QM_PWTOSHORT); /* new password too short */ cs_log(sender,"NEWPASS FAIL username %s password too short %s (%zu characters)",rup->username,cargv[1],strlen(cargv[1])); return CMD_ERROR; } else if(pq == QM_PWTOWEAK) { chanservstdmessage(sender, QM_PWTOWEAK); /* new password is weak */ cs_log(sender,"NEWPASS FAIL username %s password too weak %s",rup->username,cargv[1]); return CMD_ERROR; } else if(pq == QM_PWTOLONG) { chanservstdmessage(sender, QM_PWTOLONG); /* new password too long */ cs_log(sender,"NEWPASS FAIL username %s password too long %s",rup->username,cargv[1]); return CMD_ERROR; } else if(pq == QM_PWINVALID) { chanservstdmessage(sender, QM_PWINVALID); cs_log(sender,"NEWPASS FAIL username %s password invalid %s",rup->username,cargv[1]); return CMD_ERROR; } else if(pq == -1) { /* all good */ } else { chanservsendmessage(sender, "unknown error in newpass.c... contact #help"); return CMD_ERROR; } t=time(NULL); if(!UHasStaffPriv(rup)) { if(rup->lockuntil && rup->lockuntil > t) { chanservstdmessage(sender, QM_ACCOUNTLOCKED, rup->lockuntil); return CMD_ERROR; } rup->lockuntil=t+7*24*3600; } else { rup->lockuntil=0; } if(rup->lastemail) { freesstring(rup->lastemail); rup->lastemail=NULL; } rup->lastpasschange=t; csdb_accounthistory_insert(sender, rup->password, cargv[1], NULL, NULL); setpassword(rup, cargv[1]); rup->lastauth=time(NULL); chanservstdmessage(sender, QM_PWCHANGED); cs_log(sender,"NEWPASS OK username %s", rup->username); #ifdef AUTHGATE_WARNINGS if(UHasOperPriv(rup)) chanservsendmessage(sender, "WARNING FOR PRIVILEGED USERS: you MUST go to https://auth.quakenet.org and login successfully to update the cache, if you do not your old password will still be usable in certain circumstances."); #endif csdb_updateuser(rup); csdb_createmail(rup, QMAIL_NEWPW); if (!same) triggerhook(HOOK_CHANSERV_PWCHANGE, sender); return CMD_OK; }
int csa_docreateaccount(void *source, int cargc, char **cargv) { nick *sender=(nick *)source; int execute; char *error_username = NULL, *error_password = NULL, *error_email = NULL; char *username = NULL, *password = NULL, *email = NULL; char account_info[512]; char passbuf[512]; int do_create; int activate; if(cargc<5) { controlreply(sender, "CREATEACCOUNT FALSE args"); return CMD_ERROR; } execute = cargv[0][0] == '1'; if(strcmp(cargv[1], "0")) username = cargv[1]; if(strcmp(cargv[2], "0")) email = cargv[2]; if(strcmp(cargv[3], "0")) { int errorcode = decrypt_password(createaccountsecret, KEY_BITS, passbuf, sizeof(passbuf), cargv[3]); if(errorcode) { Error("chanserv_relay",ERR_WARNING,"createaccount unable to decrypt password, error code: %d", errorcode); controlreply(sender, "CREATEACCOUNT FALSE args"); return CMD_ERROR; } password = passbuf; } activate = cargv[4][0] == '1'; if(username) { if (findreguserbynick(username)) { error_username = "******"; } else if(csa_checkaccountname_r(username)) { error_username = "******"; } } if(email) error_email = email_to_error(email); if(password) { int r = csa_checkpasswordquality(password); if(r == QM_PWTOSHORT) { error_password = "******"; } else if(r == QM_PWTOLONG) { error_password = "******"; } else if(r == QM_PWTOWEAK) { error_password = "******"; } else if(r == QM_PWINVALID) { error_password = "******"; } else if(r != -1) { error_password = "******"; } } if(execute && email && password && username && !error_email && !error_password && !error_username) { reguser *rup; do_create = 1; rup = csa_createaccount(username, password, email); if(!activate) USetInactive(rup); cs_log(sender,"CREATEACCOUNT created auth %s (%s) %s",rup->username,rup->email->content,activate?"(active)": "(inactive)"); csdb_createuser(rup); snprintf(account_info, sizeof(account_info), " %u %lu", rup->ID, (unsigned long)rup->lastpasschange); if(!activate) sendemail(rup); } else { account_info[0] = '\0'; do_create = 0; } controlreply(sender, "CREATEACCOUNT %s%s%s%s%s%s%s%s", do_create ? "TRUE" : "FALSE", account_info, email && error_email ? " " : "", email && error_email ? error_email : "", password && error_password ? " " : "", password && error_password ? error_password : "", username && error_username ? " " : "", username && error_username ? error_username : "" ); return CMD_OK; }