fixed more language settings in email; marked more strings for translation

[e-DoKo.git] / include / preferences.php

diff --git a/include/preferences.php b/include/preferences.php
index 20b8eb5d5f04a041bdce98fe6e8f9b85ad46bf2a..3517a422a1b828c6e9f178b864fad2b8196922c9 100644 (file)
--- a/include/preferences.php
+++ b/include/preferences.php
@@ -51,6 +51,7 @@ display_user_menu($myid);
 $PREF = DB_get_PREF($myid);
 /* set language chosen in preferences, will become active on the next reload (see index.php)*/
 $_SESSION['language'] = $PREF['language'];
+set_language($PREF['language']);
 $timezone =  DB_get_user_timezone($myid);
 
 DB_update_user_timestamp($myid);
@@ -273,9 +274,9 @@ if(myisset("password0","password1","password2") &&  $_REQUEST["password0"]!="" &
     $changed_password = 1;
 
     /* check if old password matches */
-    $oldpasswd = md5($_REQUEST["password0"]);
-    $password  = DB_get_passwd_by_userid($myid);
-    if(!( ($password == $oldpasswd) || DB_check_recovery_passwords($oldpasswd,$email) ))
+    $result = verify_password($email, $_REQUEST["password0"]);
+
+    if( $result!=0 )
       $changed_password = -1;
 
     /* check if new password has been typed in correctly */
@@ -288,8 +289,19 @@ if(myisset("password0","password1","password2") &&  $_REQUEST["password0"]!="" &
 
     if($changed_password==1)
       {
-       DB_query("UPDATE User SET password='".md5($_REQUEST["password1"]).
+       // create a password hash using the crypt function, need php 5.3 for this
+       // create and random salt
+       $salt = substr(str_replace('+', '.', base64_encode(sha1(microtime(true), true))), 0, 22);
+       // hash incoming password using 12 rounds of blowfish
+       $hash = crypt($_REQUEST["password1"], '$2y$12$' . $salt);
+
+       DB_query("UPDATE User SET password='".$hash.
                 "' WHERE id=".DB_quote_smart($myid));
+
+       /* in case this was done using a recovery password delete that password */
+       $tmppasswd = md5($_REQUEST["password0"]);
+       if(DB_check_recovery_passwords($tmppasswd,$email))
+         DB_delete_recovery_passwords($myid);
       }
     /* error output below */
   }
@@ -546,14 +558,7 @@ echo "</div>\n";
 // add jquery date picker if html5 is not available
 ?>
 <script>
-  var i = document.createElement("input");
-  i.setAttribute("type", "date");
-  if (i.type == "text") {
-    $(":date").dateinput({
-
-        format: 'yyyy-mm-dd',
-      });
-  }
+  $(".date").dateinput({  format: 'yyyy-mm-dd'  });
 </script>
 <?php