From 2092bc6b9a0c5e0fca52293c82476b3349b2037b Mon Sep 17 00:00:00 2001
From: =?utf8?q?Paul=20H=C3=A4nsch?= <paul@plutz.net>
Date: Mon, 16 May 2022 14:25:01 +0200
Subject: [PATCH] user passphrase update, improved username form

---
 users.sh | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 52 insertions(+), 6 deletions(-)

diff --git a/users.sh b/users.sh
index 44a5e13..87143d8 100755
--- a/users.sh
+++ b/users.sh
@@ -391,9 +391,35 @@ user_logout(){
 }
 
 user_update(){
-  # passphrase, email
-  :
+  # todo: username update, email update / email confirm
+  local UID	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE
+  # local uname="$(POST uname |STRING)"
+  local uid oldpw pw pwconfirm
+
+        uid="$(POST uid)"
+      oldpw="$(POST oldpw)"
+         pw="$(POST pw |grep -xE '.{6}')"
+  pwconfirm="$(POST pwconfirm)"
+
+
+  read -r UID	UNAME	STATUS	EMAIL	PWSALT	PWHASH	EXPIRE	DEVICES FUTUREUSE <<-EOF
+	$(grep "^${uid}	" "$user_db")
+	EOF
+
+  if [ "$UID" = "$USER_ID" -a "$PWHASH" = "$(user_pwhash "$PWSALT" "$oldpw")" ]; then
+    if [ "$pw" -a "$pw" = "$pwconfirm" ]; then
+      update_user "${uid}" password="$pw"
+      REDIRECT "${_BASE}${PATH_INFO}#UPDATE_SUCCESS"
+    else
+      REDIRECT "${_BASE}${PATH_INFO}#ERROR_PWMISMATCH"
+    fi
+  elif [ "$UID" = "$USER_ID" ]; then
+    REDIRECT "${_BASE}${PATH_INFO}#ERROR_INVALID_AUTH_PASSWORD"
+  else
+    REDIRECT "${_BASE}${PATH_INFO}#ERROR_NOTLOGGEDIN"
+  fi
 }
+
 user_recover(){
   # send recover link
   :
@@ -411,14 +437,34 @@ read_user "$(SESSION_VAR user_id)"
   user_invite)   user_invite ;;
   user_login)    user_login ;;
   user_logout)   user_logout ;;
-  user_update)
-    :;;
+  user_update)   user_update ;;
   user_recover)
     :;;
   user_disable)
     :;;
 esac
 
+w_user_update(){
+  if [ ! "$USER_ID" ]; then
+    cat <<-EOF
+	[div #user_update .nouser
+	This page can only be used by registered users
+	]
+	EOF
+  else
+    cat <<-EOF
+	[form #user_update method=POST
+	  [hidden "uid" "$USER_ID"]
+	  [p .username Logged in as $USER_NAME]
+	  [input type=password name=oldpw placeholder="Current Passphrase"]
+	  [input type=password name=pw placeholder="New Passphrase" pattern=".{6,}"]
+	  [input type=password name=pwconfirm placeholder="Confirm New Passphrase" pattern=".{6,}"]
+	  [submit "action" "user_update" Update Passphrase]
+	]
+	EOF
+  fi
+}
+
 w_user_register(){
   if [ "$(GET user_confirm)" ]; then
     w_user_confirm
@@ -441,7 +487,7 @@ w_user_register(){
   elif [ "$USER_REQUIREEMAIL" != true ]; then
     cat <<-EOF
 	[form #user_register .registername method=POST
-          [input name=uname placeholder="Choose Username" tooltip="Your username may contain any character but the @ sign. It must be at least 3 characters long, and it must start with a letter." pattern="^\[a-zA-Z\]\[a-zA-Z0-9 -~\]{2,127}$" autocomplete=off]
+          [input name=uname placeholder="Choose Username" tooltip="Your username may contain any character but the @ sign. It must be at least 3 characters long, and it must start with a letter." pattern="^\[\\\\p{L}\]\[\\\\p{L}0-9 -~\]{2,127}$" autocomplete=off]
 	  [input type=password name=pw placeholder="Choose Passphrase" pattern=".{6,}"]
 	  [input type=password name=pwconfirm placeholder="Confirm Passphrase" pattern=".{6,}"]
 	  [submit "action" "user_register" Sign Up]
@@ -467,7 +513,7 @@ w_user_confirm(){
 	  $([ "$EMAIL" != '\' ] && printf \
 	    '[input disabled=disabled value="%s" placeholder="Email"]' "$(UNSTRING "$EMAIL" |HTML)"
 	  )
-          [input name=uname placeholder="Choose Username" tooltip="Your username may contain any character but the @ sign. It must be at least 3 characters long, and it must start with a letter." pattern="^\[a-zA-Z\]\[a-zA-Z0-9 -~\]{2,127}$" autocomplete=off]
+          [input name=uname placeholder="Choose Username" tooltip="Your username may contain any character but the @ sign. It must be at least 3 characters long, and it must start with a letter." pattern="^\[\\\\p{L}\]\[\\\\p{L}0-9 -~\]{2,127}$" autocomplete=off]
 	  [input type=password name=pw placeholder="Choose Passphrase" pattern=".{6,}"]
 	  [input type=password name=pwconfirm placeholder="Confirm Passphrase" pattern=".{6,}"]
 	  [submit "action" "user_confirm" Finish Registration]
-- 
2.39.2