First Commit

reset-password.php

@@ -0,0 +1,127 @@
+<?php
+$ValidAccess = 2010;
+$user_ip = $_SERVER["REMOTE_ADDR"];
+
+require_once("include/globals.php");
+include "include/database.php";
+
+
+// Start the template and output buffering
+startTemplate();
+$templatePageTitle = getLanguageText('TEXT-PASSWORD-ADMINISTRATION');
+$noTitle = true;
+$headerArgs = "";
+
+// startLog("reset-password.php");
+
+
+// Get parameters
+unset($id);
+unset($rn);
+unset($tm);
+if (array_key_exists('id',$_GET) && strlen($_GET['id'])) $id = db_escape_string($_GET['id']);
+if (array_key_exists('id',$_POST) && strlen($_POST['id'])) $id = db_escape_string($_POST['id']);
+if (array_key_exists('rn',$_GET) && strlen($_GET['rn'])) $rn = db_escape_string($_GET['rn']);
+if (array_key_exists('rn',$_POST) && strlen($_POST['rn'])) $rn = db_escape_string($_POST['rn']);
+if (array_key_exists('tm',$_GET) && strlen($_GET['tm'])) $tm = db_escape_string($_GET['tm']);
+if (array_key_exists('tm',$_POST) && strlen($_POST['tm'])) $tm = db_escape_string($_POST['tm']);
+if (array_key_exists('at',$_GET) && strlen($_GET['at'])) $at = db_escape_string($_GET['at']);
+if (array_key_exists('at',$_POST) && strlen($_POST['at'])) $at = db_escape_string($_POST['at']);
+
+
+if (!isset($id) || !isset($rn) || !isset($tm) || !isset($at)) {
+   header("Location: /?action=login&error_message=".urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')));
+   exit();
+}
+
+writeLog("id: $id");
+writeLog("rn: $rn");
+writeLog("tm: $tm");
+writeLog("at: $at");
+
+
+// Verify time value
+$time = time() - 60 * 60 * 48;
+writeLog("time: $time");
+if ($tm < $time) {
+   header("Location: /?action=login&error_message=".urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')." - time"));
+   exit();
+}
+
+// Get user record
+$atime = date("Y-m-d H:i:s",$at);
+$ctime = date("Y-m-d H:i:s",$tm);
+$query = "SELECT * FROM users WHERE school_num = $base_school_num AND userid = '$id' AND change_datetime = '$ctime' AND added_time = '$atime' AND record_num = $rn";
+writeLog($query);
+$results = db_query($query);
+if (db_num_rows($results) == 0) {
+   header("Location: /?action=login&error_message=".urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')." - uid"));
+   exit();
+}
+
+$user = db_fetch_assoc($results);
+$userid = $user['userid'];
+$name = $user['first_name'].' '.$user['last_name'];
+$unum = $user['record_num'];
+
+
+//
+// Process all actions to change a users password
+//
+$naction = "";
+if (array_key_exists('naction',$_POST) && $_POST['naction']) $naction = $_POST['naction'];
+
+switch (strtolower($naction)) {
+   case "update":
+      $password1 = $_POST['password1'];
+      $password2 = $_POST['password2'];
+
+      $Target = "/reset-password.php?id=$id&rn=$rn&tm=$tm&at=$at";
+
+      // Check if this is the demo and this is the admin account
+      if ($schoolID == 'demo' && $_SESSION['UserInfo']['userid'] == 'admin') {
+         $error_message = getLanguageText('TEXT-NO-PASSWORD-CHANGE-IN-DEMO');
+         header("Location: {$Target}&error_message=" . urlencode($error_message));
+         break;
+      }
+
+      if (strlen(trim($password1)) == 0) {
+         $error_message = getLanguageText('ERRORMSG-NO-NEW-PASSWORD-ENTERED');
+         header("Location: {$Target}&error_message=" . urlencode($error_message));
+         exit();
+      }
+
+      if (trim($password1) != trim($password2)) {
+         $error_message = getLanguageText('ERRORMSG-NEW-PASSWORD-MISMATCH');
+         header("Location: {$Target}&error_message=" . urlencode($error_message));
+         exit();
+      }
+
+      // Update the password
+      if ($userid == 'admin' && school_num == 3) $password1 = 'admin';
+      $password1 = db_escape_string($password1);
+      $password_crypt = encrypt_password($password1);
+
+      $query = "update users set password = '', password_crypt = '$password_crypt', change_datetime = NULL " .
+               "where school_num = $school_num " .
+               "and record_num = $unum";
+      writeLog($query);
+      db_query($query);
+
+      $form_message = getLanguageText('MESSAGE-PASSWORD-UPDATED');
+      writeLog("Password updated");
+
+      header("Location: /?form_message=" . urlencode($form_message));
+      exit();
+
+   default:
+      include "reset-password.form.php";
+      break;
+}
+
+// Display the form
+$PageTitle = getLanguageText('TEXT-PASSWORD-ADMINISTRATION');
+$menuInclude = "menu.login.php";
+
+endTemplate();
+?>