View Issue Detail

ID	Project	Category	Submitted / Last Updated
01388	UserSpice	Misc	2021-11-08 18:09:29 / 2022-04-10 22:07:54
Reported	Mio Ussum	Assigned To	Unassigned
Priority	none	Reported	5.3.7
Status	closed	Resolution Version and Commit
Summary	Various small bugs
Description	A few bugs i found, with my suggested fixes in git diff notation. 1. In some languages the validation text for min and max is not correct when the GEN_REQ text is used. I worked around it like this, so that languages can define (2 occurences - for min and max): users/classes/Validate.php - $str2 = lang("GEN_REQ"); + $str2 = lang("VAL_ALLOWED") ?? lang("GEN_REQ"); 2. In all cron related scripts, the $settings variable overwrites the global $settings set by init.php. Heres the fix: users/cron/backup.php -$settingsQ = $db->query("Select * FROM settings"); -$settings = $settingsQ->first(); users/cron/cron.php -$settings = $db->query("SELECT cron_ip FROM settings")->first(); users/cron/sample.php -$settings = $db->query("SELECT cron_ip FROM settings")->first(); 3. The condition to allow forgot password functionality is rather weird. I fixed it like this: users/forgot_password.php -if($em->email_login == "yourEmail@gmail.com"){ +if(!$em->email_act){ 4. In forgot_password_reset script, a) use new isUserLoggedIn() function, b) remove hardcoded password length validation, c) verify also vericode expiration: users/forgot_password_reset.php -if ($user->isLoggedIn()) $user->logout(); +if (isUserLoggedIn()) $user->logout(); - 'min' => 6, + 'min' => $settings->min_pw, + 'max' => $settings->max_pw, - if ($ruser->exists() && $ruser->data()->vericode == $vericode) { + if ($ruser->exists() && $ruser->data()->vericode == $vericode && (strtotime($ruser->data()->vericode_expiry) - strtotime(date("Y-m-d H:i:s")) > 0)) { 5. Errors sent by URL are formatted as generic messages, this should fix it: users/include/system_messages_footer.php - 'err'=>"primary", //err= in the url + 'err'=>"danger", //err= in the url 6. Translation is not applied in login form, this fixes it: users/login.php - 'username' => array('display' => 'Username','required' => true), - 'password' => array('display' => 'Password', 'required' => true))); + 'username' => array('display' => lang('GEN_UNAME'),'required' => true), + 'password' => array('display' => lang('GEN_PASS'), 'required' => true))); 7. Various settings.php tweaks, a) use Validate.php for validating confirmation email, b) fix a translation issue, c) fix errors vs. successes formatting, d) fix password display by adding missing javascript users/user_settings.php + ], + 'confemail' => [ + 'display' => lang('EML_CONF'), + 'required' => true, + 'matches' => 'email', - if ($confemail == $email) { + - } else { - $errors[] = lang('EML_MAT'); - } + - 'display' => lang('NEW_PW'), + 'display' => lang('PW_NEW'), - sessionValMessages($successes,$errors); + sessionValMessages($errors, $successes); + <script type="text/javascript"> + $(document).ready(function(){ + $('.password_view_control').hover(function () { + $(this).siblings('input').attr('type', 'text'); + }, function () { + $(this).siblings('input').attr('type', 'password'); + }); + }); +</script> 8. Fix missing translation: users/verify.php - if($new==1){Redirect::to($us_url_root.'users/user_settings.php?msg=Email Updated Successfully');} + if($new==1){Redirect::to($us_url_root.'users/user_settings.php?msg='.$msg);} 9. Unify page header formatting (all other pages use h2): users/views/_forgot_password.php - <h1><?=lang("PW_RESET");?></h1> + <h2><?=lang("PW_RESET");?></h2> 10. Add label to email resend form: users/views/_verify_resend.php + <label for="email"><?=lang("GEN_EMAIL");?></label> 11. Fix standard template dbnav (need to fix 2 occurences): usersc/templates/standard/assets/functions/dbnav.php - $itemString.='<li class="nav-item"><a class="nav-link" href="'.US_URL_ROOT.$menuItem['link'].'"><span class="'.$menuItem['icon_class'].'"></span> '.$menuItem['label'].'</a></li>'; } + $itemString.='<a class="dropdown-item" href="'.US_URL_ROOT.$menuItem['link'].'"><span class="'.$menuItem['icon_class'].'"></span> '.$menuItem['label'].'</a>'; } 12. Bootstrap 4 does not support Popper2, use Popper1 instead: usersc/templates/standard/header.php -<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/2.9.2/umd/popper.min.js" crossorigin="anonymous"></script> +<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.1/umd/popper.min.js" crossorigin="anonymous"></script> 13. Fix missing translation in csrf token error page due to lang key getting replaced: usersc/scripts/token_error.php -// You can decide what you want for that error message here. -if(!isset($lang) \|\| !in_array("MAINT_TOK",$lang)){ - $lang = [ - "MAINT_TOK" => "There was an error with your form. Please go back and try again. Please note that submitting the form by refreshing the page will cause an error. If this continues to happen, please contact the administrator.", - "GEN_BACK" => "Back", - ]; -} 14. Fix for broken Spice Shaker due to R3 root cert expiry (maybe allow configuration of the cacert store somewhere in admin console?). Again, 2 occurences: users/views/_spice_shaker.php + // SSL fix + curl_setopt($ch, CURLOPT_CAINFO, '/path/to/cacert.pem'); + curl_setopt($ch, CURLOPT_CAPATH, '/path/to/cacert.pem');

November 2021

It looks like these bugs cover a large number of different sections in UserSpice - please report them separately so its easier for us to assign them.
November 2021

15. Fix missing translation: users/lang/en-US.php + "REDIR_PW_CHANGE" => "You+must+change+your+password", users/includes/loader.php -if($user->isLoggedIn() && $currentPage != 'user_settings.php' && $user->data()->force_pr == 1) Redirect::to($us_url_root.'users/user_settings.php?err=You+must+change+your+password!'); +if($user->isLoggedIn() && $currentPage != 'user_settings.php' && $user->data()->force_pr == 1) Redirect::to($us_url_root.'users/user_settings.php?err='.lang('REDIR_PW_CHANGE'));
November 2021

https://pastebin.com/gv4PcV1H
November 2021

#1 - 1389 #2 - we do not maintain these crons, just there as examples (there is a new plugin for Cron Jobs) #3 - 1390 #4a - 1391 #4b - 1392 #4c - need more info, couldn't find where you were talking about. Vericode appears to be validated already. #5 - leaving for Dan to review, I don't deal with the error/msgs system #6 - 1393 I'll take care of the rest tomorrow if I have time.
April 2022

Closed as these issues were given other ticket numbers