Also don't allow username re-use (1d0f7fcc) · Commits · e / infra / docker-welcome

htdocs/create.php

+1 −1

Original line number	Diff line number	Diff line
		@@ -71,7 +71,7 @@ if (hasEmailAlreadyCreatedAnAccount($authmail)) {
		sendAPIResponse(400, createAPIResponse("general", $error_string));
		}

		$auth = isAuthorized(trim($authmail), trim($authsecret));
		$auth = isAuthorized(trim($authmail), trim($authsecret), trim($mbox));
		if (!$auth->success) {
		if (!empty($auth->account)) {
		$error_string = $strings["error_account_done"];

+18 −2

Original line number	Diff line number	Diff line
		@@ -264,6 +264,21 @@ function endsWith(string $string, string $endString): bool
		return (substr($string, -$len) === $endString);
		}

		function usernameUsed(string $username) : bool {
		clearstatcache();
		if (!file_exists("/var/accounts/auth.file.done")) {
		return false;
		}
		$handle = fopen("/var/accounts/auth.file.done", "r");
		while (($line = fgets($handle)) !== false) {
		$authParams = explode(':', $line);
		if (in_array($username, $authParams)) {
		return true;
		}
		}
		return false;
		}

		function authUsed($authstr)
		{
		clearstatcache();
		@@ -282,7 +297,7 @@ function authUsed($authstr)
		}
		}

		function isAuthorized($mail, $secret)
		function isAuthorized($mail, $secret, string $username)
		{
		$handle = fopen("/var/accounts/auth.file", "r");
		$res = new \stdClass();
		@@ -290,7 +305,8 @@ function isAuthorized($mail, $secret)
		while (($line = fgets($handle)) !== false) {
		if (strcmp(trim($line), "$mail:$secret") == 0) {
		$account = authUsed(trim($line));
		if (empty($account)) {
		$usernameUsed = usernameUsed($username);
		if (empty($account) && !$usernameUsed) {
		$res->success = true;
		return $res;
		} else {