public bool CreateUser(UserInfo userInfo)
{
var salt = _helper.GenerateSalt();
var pas = _helper.EncodePassword(userInfo.Password, salt);
using (var connection = new SqlConnection(_configurationService.DatabaseConnectionString))
{
using (var command = connection.CreateCommand())
{
command.CommandType = CommandType.StoredProcedure;
command.CommandText = "sp_CreateUser";
command.Parameters.AddWithValue("@Login", userInfo.Login).SqlDbType = SqlDbType.NVarChar;
command.Parameters.AddWithValue("@Password", pas).SqlDbType = SqlDbType.NVarChar;
command.Parameters.AddWithValue("@PasswordSalt", salt).SqlDbType = SqlDbType.NVarChar;
command.Parameters.AddWithValue("@Email", userInfo.Email).SqlDbType = SqlDbType.NVarChar;
command.Parameters.AddWithValue("@Fio", userInfo.Fio).SqlDbType = SqlDbType.NVarChar;
command.Parameters.AddWithValue("@Address", userInfo.Address).SqlDbType = SqlDbType.NVarChar;
command.Parameters.AddWithValue("@Phone", userInfo.Phone).SqlDbType = SqlDbType.NVarChar;
command.Parameters.AddWithValue("@Mobile", userInfo.Mobile).SqlDbType = SqlDbType.NVarChar;
command.Parameters.AddWithValue("@Country", userInfo.Country).SqlDbType = SqlDbType.Char;
command.Parameters.AddWithValue("@Zip", userInfo.Zip).SqlDbType = SqlDbType.NVarChar;
var retParam = command.Parameters.AddWithValue("@Return", SqlDbType.Int);
retParam.Direction = ParameterDirection.ReturnValue;
connection.Open();
command.ExecuteNonQuery();
return((int)retParam.Value == 1);
}
}
}
public bool UpdateUserPassword(Guid userId, string newPassword, string oldPassword)
{
using (var connection = new SqlConnection(_configurationService.DatabaseConnectionString))
{
connection.Open();
string passhash;
string passsalt;
using (var command = connection.CreateCommand())
{
command.CommandText = "SELECT Password, PasswordSalt FROM aspnet_Membership WHERE UserId=@UserId";
command.Parameters.AddWithValue("@UserId", userId).SqlDbType = SqlDbType.UniqueIdentifier;
using (var reader = command.ExecuteReader())
{
if (!reader.Read())
{
throw new Exception("Пользователь не найден");
}
passhash = (string)reader["Password"];
passsalt = (string)reader["PasswordSalt"];
}
}
var currentHash = _helper.EncodePassword(oldPassword, passsalt);
if (currentHash != passhash)
{
throw new Exception("Неверный пароль.");
}
using (var command = connection.CreateCommand())
{
command.CommandText = "UPDATE aspnet_Membership SET Password = @pass WHERE UserId = @userId";
command.Parameters.AddWithValue("@pass", currentHash).SqlDbType = SqlDbType.NVarChar;
command.Parameters.AddWithValue("@userId", userId).SqlDbType = SqlDbType.UniqueIdentifier;
var p = command.ExecuteNonQuery();
return(p == 1);
}
}
}