First Commit

forgot-password.php

@@ -0,0 +1,125 @@
+<?php
+require_once("include/globals.php");
+include "include/database.php";
+
+// Start the template and output buffering
+startTemplate();
+$templatePageTitle = "";
+$noTitle = true;
+$headerArgs = "";
+
+
+$error_message = "";
+
+
+//
+// Handle forgotten passwords
+//
+$naction = "";
+if (array_key_exists('naction',$_POST)) $naction = $_POST['naction'];
+
+switch (strtolower($naction)) {
+   case "send":
+      if (isset($_POST) && (array_key_exists('entered_userid',$_POST) || isset($_POST['entered_email']))) {
+         unset($query);
+
+         // Lookup by user id
+         if (array_key_exists('entered_userid', $_POST) && strlen($_POST['entered_userid']) > 0) {
+            $entered_userid = db_escape_string($_POST['entered_userid']);
+
+            // Define query
+            $query = "select * from users " .
+                     "where school_num = $base_school_num " .
+                     "and userid = '" . db_escape_string($entered_userid) . "'";
+         }
+
+         // Lookup by email
+         if (array_key_exists('entered_email', $_POST) && strlen($_POST['entered_email']) > 0) {
+            $entered_email = db_escape_string($_POST['entered_email']);
+
+            // Define query
+            $query = "select * from users " .
+                     "where school_num = $base_school_num " .
+                     "and email = '$entered_email'";
+         }
+
+         // Get user record
+         if (isset($query)) {
+            $results = db_query($query);
+
+            // If there is not a match then this is an invalid user id
+            if (db_num_rows($results) == 0) {
+               $error_message = "Error: User ID or Email Address Not Found - $query";
+               break;
+            }
+
+            $row = db_fetch_array($results);
+            extract($row);
+
+            if (strlen($email)) {
+
+               $time = time();
+               $change_datetime = date("Y-m-d H:i:s",$time);
+
+               // Validate added_time
+               $aupdate = "";
+               if (is_null($added_time) || strlen($added_time) == 0) {
+                  $aupdate = ", added_time = '$change_datetime'";
+                  $added_time = $change_datetime;
+               }
+
+               // Update user record
+               db_query("UPDATE users SET change_datetime = '$change_datetime'$aupdate WHERE record_num = $record_num");
+
+               // Format reset link
+               $at = urlencode(strtotime($added_time));
+               $ResetLink = $_SERVER['HTTP_HOST'] . "/reset-password.php?id=$userid&rn=$record_num&tm=$time&at=$at";
+               $ResetURL = db_getVal("SELECT url FROM schools WHERE record_num = $base_school_num");
+               $ResetLink = "http://{$ResetURL}/reset-password.php?id=$userid&rn=$record_num&tm=$time&at=$at";
+
+               // if (array_key_exists('HTTPS',$_SERVER)) $ResetLink = "https://$ResetLink";
+               // else $ResetLink = "http://$ResetLink";
+               // $ResetLink = "http://$ResetLink";
+
+               // Prepare to send the email
+               include "include/queuemail.php";
+
+               $emailTo        = $email;
+               $emailReply     = $school_record['school_name'];
+               $emailFrom      = "notifications@easyschoolsoftware.net";
+
+               $emailSubject = $school_record['school_name'] . " " . getLanguageText('FORGOTPASSWORD-TITLE');
+               $emailMessage = getLanguageText('TEXT-RESET-PASSWORD-LINK')."\n\n" .
+                              getLanguageText('TEXT-WEB-ADDRESS').":  http://$currentURL\n" .
+                              getLanguageText('TEXT-USER-ID').":  $userid\n" .
+                              getLanguageText('TEXT-RESET-PASSWORD-LINK').":  $ResetLink\n\n";
+
+               $fromName = getLanguageText('FORGOTPASSWORD-TITLE');
+               QueueEmail($emailTo, $emailFrom, $emailSubject, $emailMessage, $fromName);
+
+               header("Location: /?mode=password");
+               exit();
+            }
+            else {
+               $error_message = getLanguageText('ERRORMSG-NO-EMAIL-ADDRESS');
+               break;
+            }
+         }
+         else {
+            $error_message = getLanguageText('ERRORMSG-INVALID-USERID-ENTERED');
+            break;
+         }
+      }
+
+   default:
+      break;
+}
+
+// Display the form
+$PageTitle = getLanguageText('FORGOTPASSWORD-TITLE');
+$menuInclude = "menu.login.php";
+include "forgot-password.form.php";
+
+endTemplate();
+
+?>