Skip to content

GitLab

Commit 098dc6c8 authored by Tanmim Hanifa's avatar Tanmim Hanifa
Browse files

Password hash, duplicate email/username 

- Password hashing is working
- duplicate email/username checking is working
- User profile doesn't show user details, took it out to implement by taking from userID instead of passing details around on every page
parent 3c125984
Hide whitespace changes
Inline Side-by-side
PHP/LoginTDB.php
View file @ 098dc6c8
<?php
require("password.php");
$con = mysqli_connect("localhost", "thani001", "password", "thani001_travelapals");
$username = $_POST["username"];
$password = $_POST["password"];
$statement = mysqli_prepare($con, "SELECT * FROM user WHERE username = ? AND password = ?");
mysqli_stmt_bind_param($statement, "ss", $username, $password);
$statement = mysqli_prepare($con, "SELECT * FROM user WHERE username = ?");
mysqli_stmt_bind_param($statement, "s", $username);
mysqli_stmt_execute($statement);
mysqli_stmt_store_result($statement);
mysqli_stmt_bind_result($statement, $userID, $email, $name, $dob, $password, $username);
mysqli_stmt_bind_result($statement, $colUserID, $colEmail, $colName, $colDob, $colPassword, $colUsername);
$response = array();
$response["success"] = false;
while(mysqli_stmt_fetch($statement)){
$response["success"] = true;
$response["email"] = $email;
$response["name"] = $name;
$response["dob"] = $dob;
$response["username"] = $username;
$response["password"] = $password;
if (password_verify($password, $colPassword)) {
$response["success"] = true;
}
}
echo json_encode($response);
;?>
\ No newline at end of file
echo json_encode($response);
?>
\ No newline at end of file
PHP/RegisterTDB.php
View file @ 098dc6c8
<?php
$con = mysqli_connect("localhost", "thani001", "password", "thani001_travelapals");
require("password.php");
$connect = mysqli_connect("localhost", "thani001", "password", "thani001_travelapals");
$email = $_POST["email"];
$name = $_POST["name"];
$dob = $_POST["dob"];
$password = $_POST["password"];
$email = $_POST["email"];
$username = $_POST["username"];
$password = $_POST["password"];
function registerUser() {
global $connect, $name, $dob, $email, $username, $password;
$passwordHash = password_hash($password, PASSWORD_DEFAULT);
$statement = mysqli_prepare($connect, "INSERT INTO user (name, dob, email, username, password) VALUES (?, ?, ?, ?, ?)");
mysqli_stmt_bind_param($statement, "sisss", $name, $dob, $email, $username, $passwordHash);
mysqli_stmt_execute($statement);
mysqli_stmt_close($statement);
}
function usernameAvailable() {
global $connect, $username;
$statement = mysqli_prepare($connect, "SELECT * FROM user WHERE username = ?");
mysqli_stmt_bind_param($statement, "s", $username);
mysqli_stmt_execute($statement);
mysqli_stmt_store_result($statement);
$count = mysqli_stmt_num_rows($statement);
mysqli_stmt_close($statement);
if ($count < 1){
return true;
}else {
return false;
}
}
function emailAvailable() {
global $connect, $email;
$statement = mysqli_prepare($connect, "SELECT * FROM user WHERE email = ?");
mysqli_stmt_bind_param($statement, "s", $email);
mysqli_stmt_execute($statement);
mysqli_stmt_store_result($statement);
$count = mysqli_stmt_num_rows($statement);
mysqli_stmt_close($statement);
if ($count < 1){
return true;
}else {
return false;
}
}
$statement = mysqli_prepare($con, "INSERT INTO user (email, name, dob, password, username) VALUES (?, ?, ?, ?, ?)");
mysqli_stmt_bind_param($statement, "sssss", $email, $name, $dob, $password, $username);
mysqli_stmt_execute($statement);
$response = array();
$response["success"] = true;
$response["success"] = false;
if (usernameAvailable() && emailAvailable()){
registerUser();
$response["success"] = true;
}
echo json_encode($response);
?>
PHP/backphp/Login.php 0 → 100644
View file @ 098dc6c8
<?php
$con = mysqli_connect("localhost", "jsusz001", "password", "jsusz001_TravelPals");
$username = $_POST["username"];
$password = $_POST["password"];
$statement = mysqli_prepare($con, "SELECT * FROM user WHERE username = ? AND password = ?");
mysqli_stmt_bind_param($statement, "ss", $username, $password);
mysqli_stmt_execute($statement);
mysqli_stmt_store_result($statement);
mysqli_stmt_bind_result($statement, $id, $name, $dob, $password, $picture, $email, $location, $username);
$response = array();
$response["success"] = false;
while(mysqli_stmt_fetch($statement)){
$response["success"] = true;
$response["name"] = $name;
$response["dob"] = $dob;
$response["password"] = $password;
$response["picture"] = $picture;
$response["email"] = $email;
$response["location"] = $location;
$response["username"] = $username;
}
echo json_encode($response);
;?>
\ No newline at end of file
PHP/Login.php → PHP/backphp/LoginTDB.php
View file @ 098dc6c8
......@@ -9,17 +9,20 @@
mysqli_stmt_execute($statement);
mysqli_stmt_store_result($statement);
mysqli_stmt_bind_result($statement, $userID, $name, $age, $password, $username);
mysqli_stmt_bind_result($statement, $userID, $email, $name, $dob, $password, $username);
$response = array();
$response["success"] = false;
while(mysqli_stmt_fetch($statement)){
$response["success"] = true;
//$response["userID"] = $userID
$response["email"] = $email;
$response["name"] = $name;
$response["age"] = $age;
$response["dob"] = $dob;
$response["username"] = $username;
$response["password"] = $password;
}
echo json_encode($response);
......
PHP/backphp/Register.php 0 → 100644
View file @ 098dc6c8
<?php
$con = mysqli_connect("localhost", "jsusz001", "password", "jsusz001_TravelPals");
$name = $_POST["name"];
$dob = $_POST["dob"];
$password = $_POST["password"];
$picture = $_POST["picture"];
$email = $_POST["email"];
$location = $_POST["location"];
$username = $_POST["username"];
$statement = mysqli_prepare($con, "INSERT INTO user (name, dob, password, picture, email, location, username) VALUES (?, ?, ?, ?)");
mysqli_stmt_bind_param($statement, "siss", $name, $dob, $password, $picture, $email, $location, $username);
mysqli_stmt_execute($statement);
$response = array();
$response["success"] = true;
echo json_encode($response);
?>
PHP/Register.php → PHP/backphp/RegisterTDB.php
View file @ 098dc6c8
......@@ -2,14 +2,16 @@
<?php
$con = mysqli_connect("localhost", "thani001", "password", "thani001_travelapals");
$email = $_POST["email"];
$name = $_POST["name"];
$age = $_POST["age"];
$dob = $_POST["dob"];
$password = $_POST["password"];
$username = $_POST["username"];
$statement = mysqli_prepare($con, "INSERT INTO user (name, age, password, username) VALUES (?, ?, ?, ?)");
mysqli_stmt_bind_param($statement, "siss", $name, $age, $password, $username);
$statement = mysqli_prepare($con, "INSERT INTO user (email, name, dob, password, username) VALUES (?, ?, ?, ?, ?)");
mysqli_stmt_bind_param($statement, "sssss", $email, $name, $dob, $password, $username);
mysqli_stmt_execute($statement);
$response = array();
......
PHP/password.php 0 → 100644
View file @ 098dc6c8
<?php
/**
* A Compatibility library with PHP 5.5's simplified password hashing API.
*
* @author Anthony Ferrara <ircmaxell@php.net>
* @license http://www.opensource.org/licenses/mit-license.html MIT License
* @copyright 2012 The Authors
*/
namespace {
if (!defined('PASSWORD_BCRYPT')) {
/**
* PHPUnit Process isolation caches constants, but not function declarations.
* So we need to check if the constants are defined separately from
* the functions to enable supporting process isolation in userland
* code.
*/
define('PASSWORD_BCRYPT', 1);
define('PASSWORD_DEFAULT', PASSWORD_BCRYPT);
define('PASSWORD_BCRYPT_DEFAULT_COST', 10);
}
if (!function_exists('password_hash')) {
/**
* Hash the password using the specified algorithm
*
* @param string $password The password to hash
* @param int $algo The algorithm to use (Defined by PASSWORD_* constants)
* @param array $options The options for the algorithm to use
*
* @return string|false The hashed password, or false on error.
*/
function password_hash($password, $algo, array $options = array()) {
if (!function_exists('crypt')) {
trigger_error("Crypt must be loaded for password_hash to function", E_USER_WARNING);
return null;
}
if (is_null($password) || is_int($password)) {
$password = (string) $password;
}
if (!is_string($password)) {
trigger_error("password_hash(): Password must be a string", E_USER_WARNING);
return null;
}
if (!is_int($algo)) {
trigger_error("password_hash() expects parameter 2 to be long, " . gettype($algo) . " given", E_USER_WARNING);
return null;
}
$resultLength = 0;
switch ($algo) {
case PASSWORD_BCRYPT:
$cost = PASSWORD_BCRYPT_DEFAULT_COST;
if (isset($options['cost'])) {
$cost = (int) $options['cost'];
if ($cost < 4 || $cost > 31) {
trigger_error(sprintf("password_hash(): Invalid bcrypt cost parameter specified: %d", $cost), E_USER_WARNING);
return null;
}
}
// The length of salt to generate
$raw_salt_len = 16;
// The length required in the final serialization
$required_salt_len = 22;
$hash_format = sprintf("$2y$%02d$", $cost);
// The expected length of the final crypt() output
$resultLength = 60;
break;
default:
trigger_error(sprintf("password_hash(): Unknown password hashing algorithm: %s", $algo), E_USER_WARNING);
return null;
}
$salt_req_encoding = false;
if (isset($options['salt'])) {
switch (gettype($options['salt'])) {
case 'NULL':
case 'boolean':
case 'integer':
case 'double':
case 'string':
$salt = (string) $options['salt'];
break;
case 'object':
if (method_exists($options['salt'], '__tostring')) {
$salt = (string) $options['salt'];
break;
}
case 'array':
case 'resource':
default:
trigger_error('password_hash(): Non-string salt parameter supplied', E_USER_WARNING);
return null;
}
if (PasswordCompat\binary\_strlen($salt) < $required_salt_len) {
trigger_error(sprintf("password_hash(): Provided salt is too short: %d expecting %d", PasswordCompat\binary\_strlen($salt), $required_salt_len), E_USER_WARNING);
return null;
} elseif (0 == preg_match('#^[a-zA-Z0-9./]+$#D', $salt)) {
$salt_req_encoding = true;
}
} else {
$buffer = '';
$buffer_valid = false;
if (function_exists('mcrypt_create_iv') && !defined('PHALANGER')) {
$buffer = mcrypt_create_iv($raw_salt_len, MCRYPT_DEV_URANDOM);
if ($buffer) {
$buffer_valid = true;
}
}
if (!$buffer_valid && function_exists('openssl_random_pseudo_bytes')) {
$strong = false;
$buffer = openssl_random_pseudo_bytes($raw_salt_len, $strong);
if ($buffer && $strong) {
$buffer_valid = true;
}
}
if (!$buffer_valid && @is_readable('/dev/urandom')) {
$file = fopen('/dev/urandom', 'r');
$read = 0;
$local_buffer = '';
while ($read < $raw_salt_len) {
$local_buffer .= fread($file, $raw_salt_len - $read);
$read = PasswordCompat\binary\_strlen($local_buffer);
}
fclose($file);
if ($read >= $raw_salt_len) {
$buffer_valid = true;
}
$buffer = str_pad($buffer, $raw_salt_len, "\0") ^ str_pad($local_buffer, $raw_salt_len, "\0");
}
if (!$buffer_valid || PasswordCompat\binary\_strlen($buffer) < $raw_salt_len) {
$buffer_length = PasswordCompat\binary\_strlen($buffer);
for ($i = 0; $i < $raw_salt_len; $i++) {
if ($i < $buffer_length) {
$buffer[$i] = $buffer[$i] ^ chr(mt_rand(0, 255));
} else {
$buffer .= chr(mt_rand(0, 255));
}
}
}
$salt = $buffer;
$salt_req_encoding = true;
}
if ($salt_req_encoding) {
// encode string with the Base64 variant used by crypt
$base64_digits =
'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
$bcrypt64_digits =
'./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
$base64_string = base64_encode($salt);
$salt = strtr(rtrim($base64_string, '='), $base64_digits, $bcrypt64_digits);
}
$salt = PasswordCompat\binary\_substr($salt, 0, $required_salt_len);
$hash = $hash_format . $salt;
$ret = crypt($password, $hash);
if (!is_string($ret) || PasswordCompat\binary\_strlen($ret) != $resultLength) {
return false;
}
return $ret;
}
/**
* Get information about the password hash. Returns an array of the information
* that was used to generate the password hash.
*
* array(
* 'algo' => 1,
* 'algoName' => 'bcrypt',
* 'options' => array(
* 'cost' => PASSWORD_BCRYPT_DEFAULT_COST,
* ),
* )
*
* @param string $hash The password hash to extract info from
*
* @return array The array of information about the hash.
*/
function password_get_info($hash) {
$return = array(
'algo' => 0,
'algoName' => 'unknown',
'options' => array(),
);
if (PasswordCompat\binary\_substr($hash, 0, 4) == '$2y$' && PasswordCompat\binary\_strlen($hash) == 60) {
$return['algo'] = PASSWORD_BCRYPT;
$return['algoName'] = 'bcrypt';
list($cost) = sscanf($hash, "$2y$%d$");
$return['options']['cost'] = $cost;
}
return $return;
}
/**
* Determine if the password hash needs to be rehashed according to the options provided
*
* If the answer is true, after validating the password using password_verify, rehash it.
*
* @param string $hash The hash to test
* @param int $algo The algorithm used for new password hashes
* @param array $options The options array passed to password_hash
*
* @return boolean True if the password needs to be rehashed.
*/
function password_needs_rehash($hash, $algo, array $options = array()) {
$info = password_get_info($hash);
if ($info['algo'] !== (int) $algo) {
return true;
}
switch ($algo) {
case PASSWORD_BCRYPT:
$cost = isset($options['cost']) ? (int) $options['cost'] : PASSWORD_BCRYPT_DEFAULT_COST;
if ($cost !== $info['options']['cost']) {
return true;
}
break;
}
return false;
}
/**
* Verify a password against a hash using a timing attack resistant approach
*
* @param string $password The password to verify
* @param string $hash The hash to verify against
*
* @return boolean If the password matches the hash
*/
function password_verify($password, $hash) {
if (!function_exists('crypt')) {
trigger_error("Crypt must be loaded for password_verify to function", E_USER_WARNING);
return false;
}
$ret = crypt($password, $hash);
if (!is_string($ret) || PasswordCompat\binary\_strlen($ret) != PasswordCompat\binary\_strlen($hash) || PasswordCompat\binary\_strlen($ret) <= 13) {
return false;
}
$status = 0;
for ($i = 0; $i < PasswordCompat\binary\_strlen($ret); $i++) {
$status |= (ord($ret[$i]) ^ ord($hash[$i]));
}
return $status === 0;
}
}
}
namespace PasswordCompat\binary {
if (!function_exists('PasswordCompat\\binary\\_strlen')) {
/**
* Count the number of bytes in a string
*
* We cannot simply use strlen() for this, because it might be overwritten by the mbstring extension.
* In this case, strlen() will count the number of *characters* based on the internal encoding. A
* sequence of bytes might be regarded as a single multibyte character.
*
* @param string $binary_string The input string
*
* @internal
* @return int The number of bytes
*/
function _strlen($binary_string) {
if (function_exists('mb_strlen')) {
return mb_strlen($binary_string, '8bit');
}
return strlen($binary_string);
}
/**
* Get a substring based on byte limits
*
* @see _strlen()
*
* @param string $binary_string The input string
* @param int $start
* @param int $length
*
* @internal
* @return string The substring
*/
function _substr($binary_string, $start, $length) {
if (function_exists('mb_substr')) {
return mb_substr($binary_string, $start, $length, '8bit');
}
return substr($binary_string, $start, $length);
}
/**
* Check if current PHP version is compatible with the library
*
* @return boolean the check result
*/
function check() {
static $pass = NULL;
if (is_null($pass)) {
if (function_exists('crypt')) {
$hash = '$2y$04$usesomesillystringfore7hnbRJHxXVLeakoG8K30oukPsA.ztMG';
$test = crypt("password", $hash);
$pass = $test == $hash;
} else {
$pass = false;
}
}
return $pass;
}
}
}
\ No newline at end of file
PHP/version.php 0 → 100644
View file @ 098dc6c8
<?php
echo 'PHP VERSION: ' . phpversion();
?>
\ No newline at end of file
TravelPals/TravelPals/app/src/main/java/travelpals/travelpals/LoginRequest.java
View file @ 098dc6c8
......@@ -15,6 +15,8 @@ public class LoginRequest extends StringRequest{
private static final String LOGIN_REQUEST_URL = "http://doc.gold.ac.uk/~thani001/travelpals/LoginTDB.php";
// private static final String LOGIN_REQUEST_URL = "http://doc.gold.ac.uk/~thani001/travelpals/backphp/LoginTDB.php";
private Map<String, String> params;
public LoginRequest(String username, String password, Response.Listener<String> listener){
......
TravelPals/TravelPals/app/src/main/java/travelpals/travelpals/RegisterActivity.java
View file @ 098dc6c8
......@@ -53,7 +53,7 @@ public class RegisterActivity extends AppCompatActivity {
RegisterActivity.this.startActivity(intent);
} else {
AlertDialog.Builder builder = new AlertDialog.Builder(RegisterActivity.this);
builder.setMessage("Registration failed")
builder.setMessage("Registration failed. Username or email may already be in use.")
.setNegativeButton("Try again", null)
.create()
.show();
......
TravelPals/TravelPals/app/src/main/java/travelpals/travelpals/RegisterRequest.java
View file @ 098dc6c8
......@@ -12,6 +12,8 @@ import java.util.Map;
public class RegisterRequest extends StringRequest {
private static final String REGISTER_REQUEST_URL = "http://doc.gold.ac.uk/~thani001/travelpals/RegisterTDB.php";
// private static final String REGISTER_REQUEST_URL = "http://doc.gold.ac.uk/~thani001/travelpals/backphp/RegisterTDB.php";
private Map<String, String> params;
public RegisterRequest(String name, String username, String dob, String email, String password, Response.Listener<String> listener){
......
TravelPals/TravelPals/app/src/main/java/travelpals/travelpals/loginActivity.java
View file @ 098dc6c8
......@@ -51,16 +51,16 @@ public class loginActivity extends AppCompatActivity {
boolean success = jsonResponse.getBoolean("success");
if(success){
String name = jsonResponse.getString("name");
String dob = jsonResponse.getString("dob");
String username = jsonResponse.getString("username");
String email = jsonResponse.getString("email");
Intent intent = new Intent(loginActivity.this, MainMenuActivity.class);
intent.putExtra("name", name);
intent.putExtra("dob", dob);
intent.putExtra("username", username);
intent.putExtra("email", email);
// String name = jsonResponse.getString("name");
// String dob = jsonResponse.getString("dob");
// String username = jsonResponse.getString("username");
// String email = jsonResponse.getString("email");
//
Intent intent = new Intent(loginActivity.this, MainMenuActivity.class);
// intent.putExtra("name", name);
// intent.putExtra("dob", dob);
// intent.putExtra("username", username);
// intent.putExtra("email", email);
loginActivity.this.startActivity(intent);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment