104 lines
3.7 KiB
PHP
104 lines
3.7 KiB
PHP
<?php
|
|
require_once("include/globals.php");
|
|
include "include/database.php";
|
|
|
|
if (SessionActive() != 1 || ! UserLoggedIn()) {
|
|
header("Location: /");
|
|
exit();
|
|
}
|
|
|
|
// Start the template and output buffering
|
|
startTemplate();
|
|
$templatePageTitle = getLanguageText('PROFILE-PASSWORD') . ' ' . getLanguageText('TEXT-ADMINISTRATION');
|
|
|
|
|
|
|
|
|
|
//
|
|
// Process all actions to change a users password
|
|
//
|
|
$naction = "";
|
|
if (array_key_exists('naction',$_POST)) $naction = $_POST['naction'];
|
|
|
|
switch (strtolower($naction)) {
|
|
case "update":
|
|
if ($_SESSION['UserInfo']['userid'] == 'admin') {
|
|
if ($school_num == 3 || $school_num == 229) {
|
|
$error_message = getLanguageText('TEXT-UNABLE-TO-UPDATE-DEMO-PASSWORD');
|
|
$naction = '';
|
|
header("Location: /?form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
|
|
exit();
|
|
}
|
|
}
|
|
|
|
$record_num = intval($_SESSION['UserInfo']['record_num']);
|
|
|
|
$old_pw_crypt = encrypt_password($_POST['old_password']);
|
|
|
|
if ($_SESSION['UserInfo']['password_crypt'] != $old_pw_crypt && $_SESSION['UserInfo']['password'] != $_POST['old_password']) {
|
|
$error_message = getLanguageText('ERRORMSG-PASSWORD-ERROR')." (1001)";
|
|
$naction = '';
|
|
header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
if (!array_key_exists('password1', $_POST) || strlen($_POST['password1']) == 0) {
|
|
$error_message = getLanguageText('ERRORMSG-NO-PASSWORD-ENTERED')." (1002)";
|
|
$naction = '';
|
|
header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
if ($_POST['password1'] != $_POST['password2']) {
|
|
$error_message = getLanguageText('ERRORMSG-PASSWORDS-DO-NOT-MATCH')." (1003)";
|
|
$naction = '';
|
|
header("Location: /?action=$action&naction=$naction&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
// Update the password
|
|
$rnum = $_SESSION['UserInfo']['record_num'];
|
|
$password1 = db_escape_string($_POST['password1']);
|
|
$password_crypt = encrypt_password($password1);
|
|
|
|
$query = "update users set password = '', password_crypt = '$password_crypt' " .
|
|
"where school_num = $base_school_num " .
|
|
"and record_num = $rnum";
|
|
$pwQuery = $query;
|
|
db_query($query);
|
|
|
|
// Validate user accounts that are 'Pending'
|
|
if ($_SESSION['UserInfo']['status'] == 'Pending') {
|
|
$query = "update users set status = 'Active' where record_num = $rnum";
|
|
db_query($query);
|
|
$_SESSION['UserInfo']['status'] = 'Active';
|
|
}
|
|
|
|
$_SESSION['UserInfo']['password'] = $password1;
|
|
|
|
// Update past databases for admin users
|
|
if (in_array($_SESSION['UserInfo']['type'],$AllAdminUserTypes)) {
|
|
$dir = opendir("databases");
|
|
while (($file = readdir($dir)) != false) {
|
|
if ($file == ".") continue;
|
|
if ($file == "..") continue;
|
|
if (strstr($file, "hotlunch_") !== false) {
|
|
db_query("USE $file");
|
|
db_query($pwQuery);
|
|
}
|
|
}
|
|
}
|
|
|
|
$form_message = getLanguageText('MSG-PASSWORD-UPDATED');
|
|
header("Location: /?form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
|
|
|
|
break;
|
|
|
|
default:
|
|
include "change-password.form.php";
|
|
break;
|
|
}
|
|
|
|
endTemplate();
|
|
?>
|