pluginhost: do not connect via legacy DB api until requested

[tt-rss.git] / classes / auth / base.php

diff --git a/classes/auth/base.php b/classes/auth/base.php
index 782848a792061f66525aa872419336b3af2b7aa1..dbc77f8cd34e7deb5694ba5c2430fb98e686586e 100644 (file)
--- a/classes/auth/base.php
+++ b/classes/auth/base.php
@@ -1,29 +1,41 @@
 <?php
 class Auth_Base {
+       private $pdo;
+
+       function __construct() {
+               $this->pdo = Db::pdo();
+       }
+
+       /**
+        * @SuppressWarnings(unused)
+        */
        function check_password($owner_uid, $password) {
                return false;
        }
 
+       /**
+        * @SuppressWarnings(unused)
+        */
        function authenticate($login, $password) {
                return false;
        }
 
        // Auto-creates specified user if allowed by system configuration
        // Can be used instead of find_user_by_login() by external auth modules
-       function auto_create_user($login) {
+       function auto_create_user($login, $password = false) {
                if ($login && defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE) {
                        $user_id = $this->find_user_by_login($login);
 
+                       if (!$password) $password = make_password();
+
                        if (!$user_id) {
-                               $login = db_escape_string($login);
                                $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
                                $pwd_hash = encrypt_password($password, $salt, true);
 
-                               $query = "INSERT INTO ttrss_users
+                               $sth = $this->pdo->prepare("INSERT INTO ttrss_users
                                                (login,access_level,last_login,created,pwd_hash,salt)
-                                               VALUES ('$login', 0, null, NOW(), '$pwd_hash','$salt')";
-
-                               db_query($query);
+                                               VALUES (?, 0, null, NOW(), ?,?)");
+                               $sth->execute([$login, $pwd_hash, $salt]);
 
                                return $this->find_user_by_login($login);
 
@@ -36,18 +48,15 @@ class Auth_Base {
        }
 
        function find_user_by_login($login) {
-               $login = db_escape_string($login);
-
-               $result = db_query("SELECT id FROM ttrss_users WHERE
-                       login = '$login'");
+               $sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE
+                       login = ?");
+               $sth->execute([$login]);
 
-               if (db_num_rows($result) > 0) {
-                       return db_fetch_result($result, 0, "id");
+               if ($row = $sth->fetch()) {
+                       return $row["id"];
                } else {
                        return false;
                }
 
        }
 }
-
-?>