Add self-registration: free accounts via email + self-hosted CAPTCHA

New public register.php flow: email + a GD-rendered math CAPTCHA (no
third-party service), a mailed temporary password doubling as email
verification, forced password change on first login. Gated behind a
new ALLOW_SELF_REGISTRATION toggle (default off).

Login moves from username to email (falls back to username for
pre-migration accounts without one yet, mirroring qr-vip's existing
migration 006 pattern) - self-registration needs email as the
identifier. New set_email.php interstitial for legacy accounts.

Adds a small PHPMailer-based Mailer class (SMTP, with an
unauthenticated-relay option via MAIL_SMTP_AUTH=false) since no mail
infrastructure existed in this app before.

This commit is contained in:

Dillard Blom

2026-07-14 04:05:25 +02:00

parent e66f3a0360

commit a692304748

15 changed files with 525 additions and 13 deletions

									
										Dockerfile
									
		+1
		
												View File
												
				@@ -95,6 +95,7 @@ RUN cp -R ./php-qrcode/src /var/www/html/

				WORKDIR /var/www/html

				RUN composer update

				RUN composer require phpmailer/phpmailer:^6.9

				COPY ./src ./

				RUN chmod 755 *;