diff --git a/buckler.py b/buckler.py index e31f67c..9acd346 100644 --- a/buckler.py +++ b/buckler.py @@ -58,11 +58,33 @@ async def index(request): return render_template("index.html", request, locals()) -@routes.get(config.url_prefix + '/change_password', name='change_password') +@routes.post(config.url_prefix + '/change_password', name='change_password') @auth.auth_required async def change_password(request): """Allows a user to change their password.""" - pass + data = await request.post() + current_pw = data.get('current_password') + new_pw = data.get('new_password') + verify_pw = data.get('verify_password') + + if not all(current_pw, new_pw, verify_pw): + return + if not new_pw == verify_pw: + return + + async with request.app['pool'].acquire() as conn: + pw_hash = conn.fetchrow( + "SELECT password_hash FROM user_info WHERE id = $1", + request['session']['id']) + if not argon2.verify(current_pw, pw_hash['password_hash']): + return + h = argon2.hash(new_pw) + conn.execute( + "UPDATE user_info SET password_hash = $1 WHERE id = $2", + h, request['session']['id']) + index_url = request.app.router['index'].url_for() + raise web.HTTPFound(location=index_url) + @routes.get(config.url_prefix + '/login', name='login') diff --git a/static/buckler.css b/static/buckler.css index 0321854..1a070fc 100644 --- a/static/buckler.css +++ b/static/buckler.css @@ -54,3 +54,17 @@ tr { td { text-align: center; } + +#change_password { + border: none; + border-collapse: separate; + width: auto; +} + +#change_password tr { + border: none; +} + +#change_password td { + text-align: left; +} diff --git a/templates/index.html b/templates/index.html index 5d7734f..f62f02f 100644 --- a/templates/index.html +++ b/templates/index.html @@ -63,12 +63,20 @@

- -
- -
- -
+ + + + + + + + + + + + + +