<?php
require_once("include/globals.php");
include "include/database.php";

// Start the template and output buffering
startTemplate();
$templatePageTitle = "";
$noTitle = true;
$headerArgs = "";


$error_message = "";


//
// Handle forgotten passwords
//
$naction = "";
if (array_key_exists('naction',$_POST)) $naction = $_POST['naction'];

switch (strtolower($naction)) {
   case "send":
      if (isset($_POST) && (array_key_exists('entered_userid',$_POST) || isset($_POST['entered_email']))) {
         unset($query);

         // Lookup by user id
         if (array_key_exists('entered_userid', $_POST) && strlen($_POST['entered_userid']) > 0) {
            $entered_userid = db_escape_string($_POST['entered_userid']);

            // Define query
            $query = "select * from users " .
                     "where school_num = $base_school_num " .
                     "and userid = '" . db_escape_string($entered_userid) . "'";
         }

         // Lookup by email
         if (array_key_exists('entered_email', $_POST) && strlen($_POST['entered_email']) > 0) {
            $entered_email = db_escape_string($_POST['entered_email']);

            // Define query
            $query = "select * from users " .
                     "where school_num = $base_school_num " .
                     "and email = '$entered_email'";
         }

         // Get user record
         if (isset($query)) {
            $results = db_query($query);

            // If there is not a match then this is an invalid user id
            if (db_num_rows($results) == 0) {
               $error_message = "Error: User ID or Email Address Not Found - $query";
               break;
            }

            $row = db_fetch_array($results);
            extract($row);

            if (strlen($email)) {

               $time = time();
               $change_datetime = date("Y-m-d H:i:s",$time);

               // Validate added_time
               $aupdate = "";
               if (is_null($added_time) || strlen($added_time) == 0) {
                  $aupdate = ", added_time = '$change_datetime'";
                  $added_time = $change_datetime;
               }

               // Update user record
               db_query("UPDATE users SET change_datetime = '$change_datetime'$aupdate WHERE record_num = $record_num");

               // Format reset link
               $at = urlencode(strtotime($added_time));
               $ResetLink = $_SERVER['HTTP_HOST'] . "/reset-password.php?id=$userid&rn=$record_num&tm=$time&at=$at";
               $ResetURL = db_getVal("SELECT url FROM schools WHERE record_num = $base_school_num");
               $ResetLink = "http://{$ResetURL}/reset-password.php?id=$userid&rn=$record_num&tm=$time&at=$at";

               // if (array_key_exists('HTTPS',$_SERVER)) $ResetLink = "https://$ResetLink";
               // else $ResetLink = "http://$ResetLink";
               // $ResetLink = "http://$ResetLink";

               // Prepare to send the email
               include "include/queuemail.php";

               $emailTo        = $email;
               $emailReply     = $school_record['school_name'];
               $emailFrom      = "notifications@easyschoolsoftware.net";

               $emailSubject = $school_record['school_name'] . " " . getLanguageText('FORGOTPASSWORD-TITLE');
               $emailMessage = getLanguageText('TEXT-RESET-PASSWORD-LINK')."\n\n" .
                              getLanguageText('TEXT-WEB-ADDRESS').":  http://$currentURL\n" .
                              getLanguageText('TEXT-USER-ID').":  $userid\n" .
                              getLanguageText('TEXT-RESET-PASSWORD-LINK').":  $ResetLink\n\n";

               $fromName = getLanguageText('FORGOTPASSWORD-TITLE');
               QueueEmail($emailTo, $emailFrom, $emailSubject, $emailMessage, $fromName);

               header("Location: /?mode=password");
               exit();
            }
            else {
               $error_message = getLanguageText('ERRORMSG-NO-EMAIL-ADDRESS');
               break;
            }
         }
         else {
            $error_message = getLanguageText('ERRORMSG-INVALID-USERID-ENTERED');
            break;
         }
      }

   default:
      break;
}

// Display the form
$PageTitle = getLanguageText('FORGOTPASSWORD-TITLE');
$menuInclude = "menu.login.php";
include "forgot-password.form.php";

endTemplate();

?>