Add self-registration: free accounts via email + self-hosted CAPTCHA

New public register.php flow: email + a GD-rendered math CAPTCHA (no third-party service), a mailed temporary password doubling as email verification, forced password change on first login. Gated behind a new ALLOW_SELF_REGISTRATION toggle (default off). Login moves from username to email (falls back to username for pre-migration accounts without one yet, mirroring qr-vip's existing migration 006 pattern) - self-registration needs email as the identifier. New set_email.php interstitial for legacy accounts. Adds a small PHPMailer-based Mailer class (SMTP, with an unauthenticated-relay option via MAIL_SMTP_AUTH=false) since no mail infrastructure existed in this app before.
2026-07-14 04:05:25 +02:00
parent e66f3a0360
commit a692304748
15 changed files with 525 additions and 13 deletions
@@ -0,0 +1,56 @@
+<?php
+require_once __DIR__.'/../../vendor/autoload.php';
+
+use PHPMailer\PHPMailer\PHPMailer;
+use PHPMailer\PHPMailer\Exception as PHPMailerException;
+
+class Mailer
+{
+    /**
+     * Sends a temporary/initial password to a newly created or provisioned account.
+     * Returns true on success, false on failure (never throws - callers decide how to
+     * surface a mail failure without blocking the account creation itself).
+     */
+    public function sendInitialPassword($toEmail, $tempPassword) {
+        $subject = 'Your ' . MAIL_FROM_NAME . ' account';
+        $body = "An account was created for you.\n\n"
+            . "Email: {$toEmail}\n"
+            . "Temporary password: {$tempPassword}\n\n"
+            . "You'll be asked to set a new password the first time you log in.\n\n"
+            . rtrim(BASE_URL, '/') . "/login.php";
+
+        return $this->send($toEmail, $subject, $body);
+    }
+
+    private function send($toEmail, $subject, $body) {
+        $mail = new PHPMailer(true);
+
+        try {
+            $mail->isSMTP();
+            $mail->Host = MAIL_HOST;
+            $mail->Port = MAIL_PORT;
+            $mail->SMTPAuth = MAIL_SMTP_AUTH;
+
+            if (MAIL_SMTP_AUTH) {
+                $mail->Username = MAIL_USERNAME;
+                $mail->Password = MAIL_PASSWORD;
+            }
+
+            if (MAIL_ENCRYPTION !== '') {
+                $mail->SMTPSecure = MAIL_ENCRYPTION;
+            }
+
+            $mail->setFrom(MAIL_FROM_ADDRESS, MAIL_FROM_NAME);
+            $mail->addAddress($toEmail);
+            $mail->Subject = $subject;
+            $mail->Body = $body;
+            $mail->isHTML(false);
+
+            $mail->send();
+            return true;
+        } catch (PHPMailerException $e) {
+            error_log('Mailer: failed to send to ' . $toEmail . ': ' . $mail->ErrorInfo);
+            return false;
+        }
+    }
+}