diff --git a/passwordreset.php b/passwordreset.php index ec795c321..f537ec5f4 100644 --- a/passwordreset.php +++ b/passwordreset.php @@ -45,11 +45,23 @@ $requestMode = true; $resetMode = false; $email = $_POST['email']; - $user = $db->querySingle("SELECT * FROM user WHERE email = '$email'", true); + + $stmt = $db->prepare("SELECT * FROM user WHERE email = :email"); + $stmt->bindValue(':email', $email, SQLITE3_TEXT); + $user = $stmt->execute()->fetchArray(SQLITE3_ASSOC); + if ($user) { - $db->exec("DELETE FROM password_resets WHERE email = '$email'"); + $stmt = $db->prepare("DELETE FROM password_resets WHERE email = :email"); + $stmt->bindValue(':email', $email, SQLITE3_TEXT); + $stmt->execute(); + $token = bin2hex(random_bytes(32)); - $db->exec("INSERT INTO password_resets (user_id, email, token) VALUES (" . $user['id'] . ", '$email', '$token')"); + + $stmt = $db->prepare("INSERT INTO password_resets (user_id, email, token) VALUES (:user_id, :email, :token)"); + $stmt->bindValue(':user_id', $user['id'], SQLITE3_INTEGER); + $stmt->bindValue(':email', $email, SQLITE3_TEXT); + $stmt->bindValue(':token', $token, SQLITE3_TEXT); + $stmt->execute(); } $hasSuccessMessage = true; } @@ -84,7 +96,11 @@ $reset = $stmt->execute()->fetchArray(SQLITE3_ASSOC); if ($reset) { - $user = $db->querySingle("SELECT * FROM user WHERE email = '" . $reset['email'] . "'", true); + $stmt = $db->prepare("SELECT * FROM user WHERE email = :email"); + $stmt->bindValue(':email', $reset['email'], SQLITE3_TEXT); + $result = $stmt->execute(); + $user = $result->fetchArray(SQLITE3_ASSOC); + if ($password == $confirmPassword) { $passwordHash = password_hash($password, PASSWORD_DEFAULT); $db->exec("UPDATE user SET password = '$passwordHash' WHERE id = " . $user['id']); diff --git a/profile.php b/profile.php index 29e664a19..e968fefd6 100644 --- a/profile.php +++ b/profile.php @@ -1,9 +1,4 @@ diff --git a/service-worker.js b/service-worker.js index 22019bcfe..58a6b2f0c 100644 --- a/service-worker.js +++ b/service-worker.js @@ -4,6 +4,7 @@ self.addEventListener('install', function (event) { const urlsToCache = [ '.', 'index.php', + 'profile.php', 'calendar.php', 'settings.php', 'stats.php', @@ -165,7 +166,7 @@ self.addEventListener('fetch', function (event) { self.addEventListener('fetch', event => { const url = new URL(event.request.url); // Check if the request is for an image in the logos directory - if (url.pathname.startsWith('/images/uploads/logos/')) { + if (url.pathname.includes('images/uploads/logos')) { event.respondWith( caches.match(event.request).then(response => { return response || fetch(event.request).then(response => {