Add self-registration: free accounts via email + self-hosted CAPTCHA

New public register.php flow: email + a GD-rendered math CAPTCHA (no third-party service), a mailed temporary password doubling as email verification, forced password change on first login. Gated behind a new ALLOW_SELF_REGISTRATION toggle (default off). Login moves from username to email (falls back to username for pre-migration accounts without one yet, mirroring qr-vip's existing migration 006 pattern) - self-registration needs email as the identifier. New set_email.php interstitial for legacy accounts. Adds a small PHPMailer-based Mailer class (SMTP, with an unauthenticated-relay option via MAIL_SMTP_AUTH=false) since no mail infrastructure existed in this app before.
2026-07-14 04:05:25 +02:00
parent e66f3a0360
commit a692304748
15 changed files with 525 additions and 13 deletions
@@ -13,3 +13,19 @@ DATABASE_PREFIX=
 DATABASE_CHARSET=utf8

 MYSQL_ROOT_PASSWORD=change-me-to-a-strong-root-password
+
+# Self-registration: lets visitors create their own free 'admin' account
+# (email + CAPTCHA -> mailed password -> forced reset on first login).
+ALLOW_SELF_REGISTRATION=false
+
+# Only needed when ALLOW_SELF_REGISTRATION=true.
+MAIL_HOST=
+MAIL_PORT=587
+MAIL_ENCRYPTION=tls
+# Set to false to relay unauthenticated through an internal mail server (no
+# MAIL_USERNAME/MAIL_PASSWORD needed in that case).
+MAIL_SMTP_AUTH=true
+MAIL_USERNAME=
+MAIL_PASSWORD=
+MAIL_FROM_ADDRESS=noreply@example.com
+MAIL_FROM_NAME=QRForge
@@ -95,6 +95,7 @@ RUN cp -R ./php-qrcode/src /var/www/html/

 WORKDIR /var/www/html
 RUN composer update
+RUN composer require phpmailer/phpmailer:^6.9
 COPY ./src ./
 RUN chmod 755 *;

@@ -0,0 +1,51 @@
+-- Self-registration: adds email as the login identifier (mirrors qr-vip's
+-- 006_vip_and_create_rights.sql email migration) plus a marker for
+-- self-registered accounts.
+
+SET @db := DATABASE();
+
+-- 1. email: becomes the login identifier going forward. Nullable so existing accounts (which
+--    have no email) don't violate a NOT NULL constraint; a unique index still allows unlimited
+--    NULLs in InnoDB, so pre-existing NULL-email rows never collide with each other.
+SET @col_exists := (
+  SELECT COUNT(*) FROM information_schema.COLUMNS
+  WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'email'
+);
+SET @sql := IF(@col_exists = 0,
+  'ALTER TABLE `users` ADD COLUMN `email` VARCHAR(255) DEFAULT NULL',
+  'SELECT 1');
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @idx_exists := (
+  SELECT COUNT(*) FROM information_schema.STATISTICS
+  WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND INDEX_NAME = 'email'
+);
+SET @sql := IF(@idx_exists = 0,
+  'ALTER TABLE `users` ADD UNIQUE KEY `email` (`email`)',
+  'SELECT 1');
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- 2. must_set_email: forces existing (pre-migration) accounts through a one-time "set your
+--    email" interstitial on next login, mirroring must_change_password. New accounts created
+--    after this migration always have an email from creation, so they never get this flag.
+SET @col_exists := (
+  SELECT COUNT(*) FROM information_schema.COLUMNS
+  WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'must_set_email'
+);
+SET @sql := IF(@col_exists = 0,
+  'ALTER TABLE `users` ADD COLUMN `must_set_email` TINYINT(1) NOT NULL DEFAULT 0',
+  'SELECT 1');
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+UPDATE `users` SET `must_set_email` = 1 WHERE `email` IS NULL;
+
+-- 3. self_registered_at: NULL for accounts created by an admin/super, set for accounts created
+--    through register.php. Purely informational/reporting for now.
+SET @col_exists := (
+  SELECT COUNT(*) FROM information_schema.COLUMNS
+  WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'self_registered_at'
+);
+SET @sql := IF(@col_exists = 0,
+  'ALTER TABLE `users` ADD COLUMN `self_registered_at` DATETIME DEFAULT NULL',
+  'SELECT 1');
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
@@ -31,6 +31,15 @@ services:
      DATABASE_PASSWORD: "${DATABASE_PASSWORD:?set DATABASE_PASSWORD in .env}"
      DATABASE_PREFIX: "${DATABASE_PREFIX:-}"
      DATABASE_CHARSET: "${DATABASE_CHARSET:-utf8}"
+      ALLOW_SELF_REGISTRATION: "${ALLOW_SELF_REGISTRATION:-false}"
+      MAIL_HOST: "${MAIL_HOST:-}"
+      MAIL_PORT: "${MAIL_PORT:-587}"
+      MAIL_ENCRYPTION: "${MAIL_ENCRYPTION:-tls}"
+      MAIL_SMTP_AUTH: "${MAIL_SMTP_AUTH:-true}"
+      MAIL_USERNAME: "${MAIL_USERNAME:-}"
+      MAIL_PASSWORD: "${MAIL_PASSWORD:-}"
+      MAIL_FROM_ADDRESS: "${MAIL_FROM_ADDRESS:-noreply@example.com}"
+      MAIL_FROM_NAME: "${MAIL_FROM_NAME:-QRForge}"
    depends_on:
      qrforge-db:
        condition: service_healthy
@@ -15,6 +15,13 @@ services:
      DATABASE_PASSWORD: "${DATABASE_PASSWORD:?zet DATABASE_PASSWORD in .env}"
      DATABASE_PREFIX: "${DATABASE_PREFIX:-}"
      DATABASE_CHARSET: "${DATABASE_CHARSET:-utf8}"
+      ALLOW_SELF_REGISTRATION: "${ALLOW_SELF_REGISTRATION:-false}"
+      MAIL_HOST: "mailhog"
+      MAIL_PORT: "1025"
+      MAIL_ENCRYPTION: ""
+      MAIL_SMTP_AUTH: "false"
+      MAIL_FROM_ADDRESS: "${MAIL_FROM_ADDRESS:-noreply@example.com}"
+      MAIL_FROM_NAME: "${MAIL_FROM_NAME:-QRForge}"
    ports:
      - "80:80"
    depends_on:
@@ -25,6 +32,14 @@ services:
    networks:
      - qrforge-network

+  mailhog:
+    image: "mailhog/mailhog:v1.0.1"
+    restart: "unless-stopped"
+    ports:
+      - "8025:8025" # web UI: http://localhost:8025
+    networks:
+      - qrforge-network
+
  qrforge-db:
    image: "mysql:8.0"
    restart: "unless-stopped"
@@ -6,17 +6,20 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST')
 {
 	csrf_verify_or_die();

-	$username = filter_input(INPUT_POST, 'username');
+	// Login moves from username to email. Accept either during the transition -
+	// existing pre-migration accounts have no email yet (see must_set_email/set_email.php),
+	// so a plain username must keep working until they've set one.
+	$identifier = filter_input(INPUT_POST, 'email');
 	$password = filter_input(INPUT_POST, 'password');
 	$remember = filter_input(INPUT_POST, 'remember');

-	if (!$username || !$password) {
-		$_SESSION['login_failure'] = 'Invalid username or password';
+	if (!$identifier || !$password) {
+		$_SESSION['login_failure'] = 'Invalid email or password';
 		header('Location: login.php');
 		exit;
 	}

-	if (qr_is_login_locked_out($username)) {
+	if (qr_is_login_locked_out($identifier)) {
 		$_SESSION['login_failure'] = 'Too many failed login attempts. Try again in 15 minutes.';
 		header('Location: login.php');
 		exit;
@@ -25,12 +28,19 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST')
 	// Get DB instance.
 	$db = getDbInstance();

-	$db->where('username', $username);
+	$db->where('email', $identifier);
 	$row = $db->getOne('users');

+	if ($db->count < 1) {
+		// Compatibility fallback for accounts that haven't set an email yet.
+		$db = getDbInstance();
+		$db->where('username', $identifier);
+		$row = $db->getOne('users');
+	}
+
 	if ($db->count >= 1 && password_verify($password, $row['password']))
    {
-		qr_record_login_attempt($username, true);
+		qr_record_login_attempt($identifier, true);

 		// Voorkom session fixation: nieuwe sessie-id na een geslaagde login.
 		session_regenerate_id(true);
@@ -40,6 +50,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST')
        $_SESSION['user_id'] = $row['id'];
 		$_SESSION['username'] = $row['username'];
 		$_SESSION['must_change_password'] = !empty($row['must_change_password']);
+		$_SESSION['must_set_email'] = !empty($row['must_set_email']);
 		$_SESSION['can_view_static'] = !empty($row['can_view_static']);
 		$_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']);
 		$_SESSION['scope_owner_id'] = qr_compute_scope_owner_id($row);
@@ -86,8 +97,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST')
 	}
    else
    {
-		qr_record_login_attempt($username, false);
-		$_SESSION['login_failure'] = 'Invalid username or password';
+		qr_record_login_attempt($identifier, false);
+		$_SESSION['login_failure'] = 'Invalid email or password';
 		header('Location: login.php');
 		exit;
 	}
@@ -0,0 +1,41 @@
+<?php
+// Public endpoint (no auth): renders a self-hosted CAPTCHA image for register.php.
+// No third-party service (reCAPTCHA/Turnstile/etc) - a simple math challenge drawn
+// with GD onto a noisy background, expected answer kept server-side in the session.
+require_once 'includes/bootstrap.php';
+
+$a = random_int(1, 9);
+$b = random_int(1, 9);
+$_SESSION['captcha_answer'] = (string) ($a + $b);
+$text = "{$a} + {$b} =";
+
+$width = 160;
+$height = 60;
+$image = imagecreatetruecolor($width, $height);
+$bg = imagecolorallocate($image, 245, 245, 245);
+$fg = imagecolorallocate($image, 30, 30, 30);
+imagefill($image, 0, 0, $bg);
+
+// Noise: random lines behind the text, purely cosmetic distortion.
+for ($i = 0; $i < 8; $i++) {
+    $lineColor = imagecolorallocate($image, random_int(180, 220), random_int(180, 220), random_int(180, 220));
+    imageline($image, random_int(0, $width), random_int(0, $height), random_int(0, $width), random_int(0, $height), $lineColor);
+}
+
+$fontFile = '/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf';
+if (is_file($fontFile) && function_exists('imagettftext')) {
+    $fontSize = 22;
+    $bbox = imagettfbbox($fontSize, 0, $fontFile, $text);
+    $textWidth = abs($bbox[2] - $bbox[0]);
+    $textHeight = abs($bbox[1] - $bbox[7]);
+    $x = (int) (($width - $textWidth) / 2);
+    $y = (int) (($height + $textHeight) / 2);
+    imagettftext($image, $fontSize, 0, $x, $y, $fg, $fontFile, $text);
+} else {
+    imagestring($image, 5, 10, 20, $text, $fg);
+}
+
+header('Content-Type: image/png');
+header('Cache-Control: no-store, no-cache, must-revalidate');
+imagepng($image);
+imagedestroy($image);
@@ -16,3 +16,14 @@ define('DATABASE_CHARSET', getenv('DATABASE_CHARSET') ?: 'utf8');
 define('TYPE', getenv('TYPE') ?: 'local');
 define('BASE_URL', getenv('BASE_URL') ?: 'http://localhost');
 define('QRCODE_GENERATOR', getenv('QRCODE_GENERATOR') ?: 'external-api.qrserver.com'); // opties: external-api.qrserver.com of internal-chillerlan.qrcode
+
+define('ALLOW_SELF_REGISTRATION', filter_var(getenv('ALLOW_SELF_REGISTRATION'), FILTER_VALIDATE_BOOLEAN));
+
+define('MAIL_HOST', getenv('MAIL_HOST') ?: '');
+define('MAIL_PORT', filter_var(getenv('MAIL_PORT'), FILTER_VALIDATE_INT) ?: 587);
+define('MAIL_ENCRYPTION', getenv('MAIL_ENCRYPTION') !== false ? getenv('MAIL_ENCRYPTION') : 'tls'); // opties: tls, ssl, '' (geen)
+define('MAIL_SMTP_AUTH', getenv('MAIL_SMTP_AUTH') !== false ? filter_var(getenv('MAIL_SMTP_AUTH'), FILTER_VALIDATE_BOOLEAN) : true);
+define('MAIL_USERNAME', getenv('MAIL_USERNAME') ?: '');
+define('MAIL_PASSWORD', getenv('MAIL_PASSWORD') ?: '');
+define('MAIL_FROM_ADDRESS', getenv('MAIL_FROM_ADDRESS') ?: 'noreply@example.com');
+define('MAIL_FROM_NAME', getenv('MAIL_FROM_NAME') ?: 'QRForge');
@@ -12,3 +12,4 @@ require_once __DIR__ . '/security.php';
 qr_session_start();
 qr_enforce_session_timeout();
 qr_enforce_password_change();
+qr_enforce_email_set();
@@ -66,8 +66,11 @@ function qr_enforce_password_change() {
        return;
    }

+    // Also exempt set_email.php - an account can need both flows at once (e.g. a fresh
+    // self-registered row, or a pre-migration account that never set a password either),
+    // and each enforcer redirecting to its own page while blocking the other's would loop forever.
    $current_script = basename(parse_url($_SERVER['SCRIPT_NAME'], PHP_URL_PATH));
-    $exempt = ['change_password.php', 'logout.php'];
+    $exempt = ['change_password.php', 'set_email.php', 'logout.php'];

    if (in_array($current_script, $exempt, true)) {
        return;
@@ -77,6 +80,26 @@ function qr_enforce_password_change() {
    exit;
 }

+/**
+ * Stuurt ingelogde gebruikers zonder e-mailadres naar set_email.php, behalve op de
+ * wijzigingspagina's zelf en logout.
+ */
+function qr_enforce_email_set() {
+    if (empty($_SESSION['user_logged_in']) || empty($_SESSION['must_set_email'])) {
+        return;
+    }
+
+    $current_script = basename(parse_url($_SERVER['SCRIPT_NAME'], PHP_URL_PATH));
+    $exempt = ['set_email.php', 'change_password.php', 'logout.php'];
+
+    if (in_array($current_script, $exempt, true)) {
+        return;
+    }
+
+    header('Location: set_email.php');
+    exit;
+}
+
 /**
 * CSRF-bescherming
 */
@@ -118,6 +141,18 @@ function csrf_verify_header_or_die() {
    }
 }

+/**
+ * Verifieert het antwoord op de zelf-gehoste CAPTCHA (captcha.php). Verbruikt het
+ * verwachte antwoord uit de sessie na de eerste check, zodat elke afbeelding maar
+ * eenmaal te gebruiken is (voorkomt hergebruik van hetzelfde plaatje/antwoord).
+ */
+function captcha_is_valid($submittedAnswer) {
+    $expected = $_SESSION['captcha_answer'] ?? null;
+    unset($_SESSION['captcha_answer']);
+
+    return $expected !== null && is_string($submittedAnswer) && hash_equals($expected, trim($submittedAnswer));
+}
+
 /**
 * Rate limiting op login
 */
@@ -0,0 +1,56 @@
+<?php
+require_once __DIR__.'/../../vendor/autoload.php';
+
+use PHPMailer\PHPMailer\PHPMailer;
+use PHPMailer\PHPMailer\Exception as PHPMailerException;
+
+class Mailer
+{
+    /**
+     * Sends a temporary/initial password to a newly created or provisioned account.
+     * Returns true on success, false on failure (never throws - callers decide how to
+     * surface a mail failure without blocking the account creation itself).
+     */
+    public function sendInitialPassword($toEmail, $tempPassword) {
+        $subject = 'Your ' . MAIL_FROM_NAME . ' account';
+        $body = "An account was created for you.\n\n"
+            . "Email: {$toEmail}\n"
+            . "Temporary password: {$tempPassword}\n\n"
+            . "You'll be asked to set a new password the first time you log in.\n\n"
+            . rtrim(BASE_URL, '/') . "/login.php";
+
+        return $this->send($toEmail, $subject, $body);
+    }
+
+    private function send($toEmail, $subject, $body) {
+        $mail = new PHPMailer(true);
+
+        try {
+            $mail->isSMTP();
+            $mail->Host = MAIL_HOST;
+            $mail->Port = MAIL_PORT;
+            $mail->SMTPAuth = MAIL_SMTP_AUTH;
+
+            if (MAIL_SMTP_AUTH) {
+                $mail->Username = MAIL_USERNAME;
+                $mail->Password = MAIL_PASSWORD;
+            }
+
+            if (MAIL_ENCRYPTION !== '') {
+                $mail->SMTPSecure = MAIL_ENCRYPTION;
+            }
+
+            $mail->setFrom(MAIL_FROM_ADDRESS, MAIL_FROM_NAME);
+            $mail->addAddress($toEmail);
+            $mail->Subject = $subject;
+            $mail->Body = $body;
+            $mail->isHTML(false);
+
+            $mail->send();
+            return true;
+        } catch (PHPMailerException $e) {
+            error_log('Mailer: failed to send to ' . $toEmail . ': ' . $mail->ErrorInfo);
+            return false;
+        }
+    }
+}
@@ -1,5 +1,6 @@
 <?php
 require_once 'config/config.php';
+require_once BASE_PATH . '/lib/Mailer/Mailer.php';

 class Users
 {
@@ -138,6 +139,89 @@ class Users
 	    }
    }

+    /**
+     * Public self-registration (register.php). No session/permission checks - this is
+     * the one path where an unauthenticated visitor creates their own account. Always
+     * creates a free-forever 'admin' (self-scoped, no tenant), matching what a manually
+     * created OSS admin gets. Returns ['ok' => true] on success or
+     * ['ok' => false, 'error' => string] - callers are responsible for flash/redirect,
+     * unlike addUser()/editUser() which redirect themselves (this runs pre-login, on a
+     * page with its own layout).
+     */
+    public function registerSelfUser($email) {
+        if (!ALLOW_SELF_REGISTRATION) {
+            return ['ok' => false, 'error' => 'Self-registration is not enabled.'];
+        }
+
+        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+            return ['ok' => false, 'error' => 'Please enter a valid email address.'];
+        }
+
+        $db = getDbInstance();
+        $db->where('email', $email);
+        $existing = $db->getOne('users');
+
+        if (!empty($existing)) {
+            return ['ok' => false, 'error' => 'An account with this email already exists.'];
+        }
+
+        $username = $this->deriveUniqueUsername($email);
+        $tempPassword = bin2hex(random_bytes(8));
+
+        $data_to_db = [
+            'username' => $username,
+            'password' => password_hash($tempPassword, PASSWORD_DEFAULT),
+            'type' => 'admin',
+            'owner_admin_id' => null,
+            'email' => $email,
+            'must_change_password' => 1,
+            'self_registered_at' => date('Y-m-d H:i:s'),
+        ];
+
+        $db = getDbInstance();
+        $last_id = $db->insert('users', $data_to_db);
+
+        if (!$last_id) {
+            return ['ok' => false, 'error' => 'Could not create the account: ' . $db->getLastError()];
+        }
+
+        audit_log('user_self_registered', 'user', $last_id);
+
+        $mailer = new Mailer();
+        $mailer->sendInitialPassword($email, $tempPassword);
+
+        return ['ok' => true];
+    }
+
+    /**
+     * Derives a username candidate from the email's local part (letters/digits/dot/
+     * underscore/hyphen only, matching validateUsernameAndType()'s rules), appending a
+     * numeric suffix if it's already taken.
+     */
+    private function deriveUniqueUsername($email) {
+        $localPart = strtolower(strstr($email, '@', true) ?: $email);
+        $base = preg_replace('/[^a-z0-9._-]/', '', $localPart);
+        $base = substr($base, 0, 45) ?: 'user';
+
+        if (strlen($base) < 3) {
+            $base = str_pad($base, 3, '0');
+        }
+
+        $candidate = $base;
+        $suffix = 1;
+
+        $db = getDbInstance();
+        $db->where('username', $candidate);
+        while ($db->getOne('users') !== null) {
+            $candidate = $base . $suffix;
+            $suffix++;
+            $db = getDbInstance();
+            $db->where('username', $candidate);
+        }
+
+        return $candidate;
+    }
+
    /**
     * Edit user.
     *
@@ -40,6 +40,7 @@ if (isset($_COOKIE['series_id']) && isset($_COOKIE['remember_token']))
 			$_SESSION['type'] = $row['type'];
 			$_SESSION['username'] = $row['username'];
 			$_SESSION['must_change_password'] = !empty($row['must_change_password']);
+			$_SESSION['must_set_email'] = !empty($row['must_set_email']);
 			$_SESSION['can_view_static'] = !empty($row['can_view_static']);
 			$_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']);
 			$_SESSION['scope_owner_id'] = qr_compute_scope_owner_id($row);
@@ -81,10 +82,12 @@ if (isset($_COOKIE['series_id']) && isset($_COOKIE['remember_token']))
    <div class="card-body login-card-body">
      <p class="login-box-msg">Sign in to start your session</p>

+      <?php include './includes/flash_messages.php'; ?>
+
      <form method="POST" action="authenticate.php">
        <?php echo csrf_field(); ?>
        <div class="input-group mb-3">
-          <input type="text" name="username" class="form-control" placeholder="Username" required="required">
+          <input type="text" name="email" class="form-control" placeholder="Email" required="required">
          <div class="input-group-append">
            <div class="input-group-text">
              <span class="fa fa-user"></span>
@@ -133,6 +136,9 @@ if (isset($_COOKIE['series_id']) && isset($_COOKIE['remember_token']))
 			</div>	
 				<?php endif; ?>

+      <?php if (ALLOW_SELF_REGISTRATION): ?>
+          <p class="mt-3 text-center"><a href="register.php">Register for free</a></p>
+      <?php endif; ?>

    </div>
    <!-- /.login-card-body -->
@@ -0,0 +1,86 @@
+<?php
+require_once 'includes/bootstrap.php';
+require_once 'lib/Users/Users.php';
+
+if (!ALLOW_SELF_REGISTRATION) {
+    header('Location: login.php');
+    exit;
+}
+
+if (isset($_SESSION['user_logged_in']) && $_SESSION['user_logged_in'] === TRUE) {
+    header('Location: index.php');
+    exit;
+}
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    csrf_verify_or_die();
+
+    $email = trim($_POST['email'] ?? '');
+
+    if (!captcha_is_valid($_POST['captcha'] ?? '')) {
+        $_SESSION['failure'] = 'Incorrect CAPTCHA answer, please try again.';
+    } else {
+        $users = new Users();
+        $result = $users->registerSelfUser($email);
+
+        if ($result['ok']) {
+            $_SESSION['success'] = 'Account created! Check your inbox for a temporary password.';
+            header('Location: login.php');
+            exit;
+        }
+
+        $_SESSION['failure'] = $result['error'];
+    }
+}
+?>
+<!DOCTYPE html>
+<html lang="en">
+<title>Register - QRForge</title>
+<?php include './includes/head.php'; ?>
+
+<body class="login-page" style="min-height: 512.391px;">
+    <div class="login-box">
+  <div class="login-logo">
+    <img src="dist/img/brand/logo.svg" alt="QRForge" style="max-width: 260px;">
+  </div>
+
+  <div class="card">
+    <div class="card-body login-card-body">
+      <p class="login-box-msg">Create your free account</p>
+
+      <?php include './includes/flash_messages.php'; ?>
+
+      <form method="POST" action="register.php">
+        <?php echo csrf_field(); ?>
+        <div class="input-group mb-3">
+          <input type="email" name="email" class="form-control" placeholder="Email address" required="required">
+        </div>
+        <div class="mb-3 text-center">
+          <img src="captcha.php" alt="CAPTCHA" id="captcha-image" style="cursor:pointer;" title="Click to refresh">
+        </div>
+        <div class="input-group mb-3">
+          <input type="text" name="captcha" class="form-control" placeholder="Answer the sum above" required="required" autocomplete="off">
+        </div>
+        <div class="row">
+          <div class="col-12">
+            <button type="submit" class="btn btn-primary btn-block">Create account</button>
+          </div>
+        </div>
+      </form>
+
+      <p class="mt-3 text-center"><a href="login.php">Back to login</a></p>
+    </div>
+  </div>
+</div>
+
+<script src="../../plugins/jquery/jquery.min.js"></script>
+<script src="../../plugins/bootstrap/js/bootstrap.bundle.min.js"></script>
+<script src="../../dist/js/adminlte.js"></script>
+<script>
+    document.getElementById('captcha-image').addEventListener('click', function () {
+        this.src = 'captcha.php?' + Date.now();
+    });
+</script>
+
+</body>
+</html>
@@ -0,0 +1,89 @@
+<?php
+require_once 'includes/bootstrap.php';
+
+if (empty($_SESSION['user_logged_in'])) {
+    header('Location: login.php');
+    exit;
+}
+
+$forced = !empty($_SESSION['must_set_email']);
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    csrf_verify_or_die();
+
+    $email = trim($_POST['email'] ?? '');
+
+    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+        $_SESSION['failure'] = 'Please enter a valid email address.';
+    } else {
+        $db = getDbInstance();
+        $db->where('email', $email);
+        $db->where('id', $_SESSION['user_id'], '!=');
+        $existing = $db->getOne('users');
+
+        if (!empty($existing['email'])) {
+            $_SESSION['failure'] = 'An account with this email already exists.';
+        } else {
+            $db = getDbInstance();
+            $db->where('id', $_SESSION['user_id']);
+            $db->update('users', [
+                'email' => $email,
+                'must_set_email' => 0,
+            ]);
+
+            $_SESSION['must_set_email'] = false;
+            audit_log('email_set');
+
+            $_SESSION['success'] = 'Email address saved.';
+            header('Location: index.php');
+            exit;
+        }
+    }
+}
+?>
+<!DOCTYPE html>
+<html lang="en">
+<title>Set email - QRForge</title>
+<?php include './includes/head.php'; ?>
+
+<body class="login-page" style="min-height: 512.391px;">
+    <div class="login-box">
+  <div class="login-logo">
+    <img src="dist/img/brand/logo.svg" alt="QRForge" style="max-width: 260px;">
+  </div>
+
+  <div class="card">
+    <div class="card-body login-card-body">
+      <p class="login-box-msg">
+        <?php echo $forced
+            ? 'Please set an email address for your account before continuing. This will become your login.'
+            : 'Set your email address'; ?>
+      </p>
+
+      <?php include './includes/flash_messages.php'; ?>
+
+      <form method="POST" action="set_email.php">
+        <?php echo csrf_field(); ?>
+        <div class="input-group mb-3">
+          <input type="email" name="email" class="form-control" placeholder="Email address" required="required">
+        </div>
+        <div class="row">
+          <div class="col-12">
+            <button type="submit" class="btn btn-primary btn-block">Save email</button>
+          </div>
+        </div>
+      </form>
+
+      <?php if (!$forced): ?>
+        <p class="mt-3 text-center"><a href="index.php">Back to dashboard</a></p>
+      <?php endif; ?>
+    </div>
+  </div>
+</div>
+
+<script src="../../plugins/jquery/jquery.min.js"></script>
+<script src="../../plugins/bootstrap/js/bootstrap.bundle.min.js"></script>
+<script src="../../dist/js/adminlte.js"></script>
+
+</body>
+</html>