pluginhost: do not connect via legacy DB api until requested

[tt-rss.git] / classes / auth / base.php

diff --git a/classes/auth/base.php b/classes/auth/base.php
index ad7ff36461b8d338c1eba7e4e37dcc772327fdd7..dbc77f8cd34e7deb5694ba5c2430fb98e686586e 100644 (file)
--- a/classes/auth/base.php
+++ b/classes/auth/base.php
@@ -1,35 +1,41 @@
 <?php
 class Auth_Base {
-       protected $link;
+       private $pdo;
 
-       function __construct($link) {
-               $this->link = $link;
+       function __construct() {
+               $this->pdo = Db::pdo();
        }
 
+       /**
+        * @SuppressWarnings(unused)
+        */
        function check_password($owner_uid, $password) {
                return false;
        }
 
+       /**
+        * @SuppressWarnings(unused)
+        */
        function authenticate($login, $password) {
                return false;
        }
 
        // Auto-creates specified user if allowed by system configuration
        // Can be used instead of find_user_by_login() by external auth modules
-       function auto_create_user($login) {
+       function auto_create_user($login, $password = false) {
                if ($login && defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE) {
                        $user_id = $this->find_user_by_login($login);
 
+                       if (!$password) $password = make_password();
+
                        if (!$user_id) {
-                               $login = db_escape_string($this->link, $login);
                                $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
                                $pwd_hash = encrypt_password($password, $salt, true);
 
-                               $query = "INSERT INTO ttrss_users
+                               $sth = $this->pdo->prepare("INSERT INTO ttrss_users
                                                (login,access_level,last_login,created,pwd_hash,salt)
-                                               VALUES ('$login', 0, null, NOW(), '$pwd_hash','$salt')";
-
-                               db_query($this->link, $query);
+                                               VALUES (?, 0, null, NOW(), ?,?)");
+                               $sth->execute([$login, $pwd_hash, $salt]);
 
                                return $this->find_user_by_login($login);
 
@@ -42,18 +48,15 @@ class Auth_Base {
        }
 
        function find_user_by_login($login) {
-               $login = db_escape_string($this->link, $login);
+               $sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE
+                       login = ?");
+               $sth->execute([$login]);
 
-               $result = db_query($this->link, "SELECT id FROM ttrss_users WHERE
-                       login = '$login'");
-
-               if (db_num_rows($result) > 0) {
-                       return db_fetch_result($result, 0, "id");
+               if ($row = $sth->fetch()) {
+                       return $row["id"];
                } else {
                        return false;
                }
 
        }
 }
-
-?>