First Commit

change-password.php

@@ -0,0 +1,103 @@
+<?php
+require_once("include/globals.php");
+include "include/database.php";
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   header("Location: /");
+   exit();
+}
+
+// Start the template and output buffering
+startTemplate();
+$templatePageTitle = getLanguageText('PROFILE-PASSWORD') . ' ' . getLanguageText('TEXT-ADMINISTRATION');
+
+
+
+
+//
+// Process all actions to change a users password
+//
+$naction = "";
+if (array_key_exists('naction',$_POST)) $naction = $_POST['naction'];
+
+switch (strtolower($naction)) {
+   case "update":
+      if ($_SESSION['UserInfo']['userid'] == 'admin') {
+         if ($school_num == 3 || $school_num == 229) {
+            $error_message = getLanguageText('TEXT-UNABLE-TO-UPDATE-DEMO-PASSWORD');
+            $naction = '';
+            header("Location: /?form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+            exit();
+         }
+      }
+
+      $record_num = intval($_SESSION['UserInfo']['record_num']);
+
+      $old_pw_crypt = encrypt_password($_POST['old_password']);
+
+      if ($_SESSION['UserInfo']['password_crypt'] != $old_pw_crypt && $_SESSION['UserInfo']['password'] != $_POST['old_password']) {
+         $error_message = getLanguageText('ERRORMSG-PASSWORD-ERROR')." (1001)";
+         $naction = '';
+         header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+         exit();
+      }
+
+      if (!array_key_exists('password1', $_POST) || strlen($_POST['password1']) == 0) {
+         $error_message = getLanguageText('ERRORMSG-NO-PASSWORD-ENTERED')." (1002)";
+         $naction = '';
+         header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+         exit();
+      }
+
+      if ($_POST['password1'] != $_POST['password2']) {
+         $error_message = getLanguageText('ERRORMSG-PASSWORDS-DO-NOT-MATCH')." (1003)";
+         $naction = '';
+         header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+         exit();
+      }
+
+      // Update the password
+      $rnum = $_SESSION['UserInfo']['record_num'];
+      $password1 = db_escape_string($_POST['password1']);
+      $password_crypt = encrypt_password($password1);
+
+      $query = "update users set password = '', password_crypt = '$password_crypt' " .
+               "where school_num = $base_school_num " .
+               "and record_num = $rnum";
+      $pwQuery = $query;
+      db_query($query);
+
+      // Validate user accounts that are 'Pending'
+      if ($_SESSION['UserInfo']['status'] == 'Pending') {
+         $query = "update users set status = 'Active' where record_num = $rnum";
+         db_query($query);
+         $_SESSION['UserInfo']['status'] = 'Active';
+      }
+
+      $_SESSION['UserInfo']['password'] = $password1;
+
+      // Update past databases for admin users
+      if (in_array($_SESSION['UserInfo']['type'],$AllAdminUserTypes)) {
+         $dir = opendir("databases");
+         while (($file = readdir($dir)) != false) {
+            if ($file == ".") continue;
+            if ($file == "..") continue;
+            if (strstr($file, "hotlunch_") !== false) {
+               db_query("USE $file");
+               db_query($pwQuery);
+            }
+         }
+      }
+
+      $form_message = getLanguageText('MSG-PASSWORD-UPDATED');
+      header("Location: /?form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+
+      break;
+
+   default:
+      include "change-password.form.php";
+      break;
+}
+
+endTemplate();
+?>