128 lines
4.3 KiB
PHP
128 lines
4.3 KiB
PHP
<?php
|
|
$ValidAccess = 2010;
|
|
$user_ip = $_SERVER["REMOTE_ADDR"];
|
|
|
|
require_once("include/globals.php");
|
|
include "include/database.php";
|
|
|
|
|
|
// Start the template and output buffering
|
|
startTemplate();
|
|
$templatePageTitle = getLanguageText('TEXT-PASSWORD-ADMINISTRATION');
|
|
$noTitle = true;
|
|
$headerArgs = "";
|
|
|
|
// startLog("reset-password.php");
|
|
|
|
|
|
// Get parameters
|
|
unset($id);
|
|
unset($rn);
|
|
unset($tm);
|
|
if (array_key_exists('id',$_GET) && strlen($_GET['id'])) $id = db_escape_string($_GET['id']);
|
|
if (array_key_exists('id',$_POST) && strlen($_POST['id'])) $id = db_escape_string($_POST['id']);
|
|
if (array_key_exists('rn',$_GET) && strlen($_GET['rn'])) $rn = db_escape_string($_GET['rn']);
|
|
if (array_key_exists('rn',$_POST) && strlen($_POST['rn'])) $rn = db_escape_string($_POST['rn']);
|
|
if (array_key_exists('tm',$_GET) && strlen($_GET['tm'])) $tm = db_escape_string($_GET['tm']);
|
|
if (array_key_exists('tm',$_POST) && strlen($_POST['tm'])) $tm = db_escape_string($_POST['tm']);
|
|
if (array_key_exists('at',$_GET) && strlen($_GET['at'])) $at = db_escape_string($_GET['at']);
|
|
if (array_key_exists('at',$_POST) && strlen($_POST['at'])) $at = db_escape_string($_POST['at']);
|
|
|
|
|
|
if (!isset($id) || !isset($rn) || !isset($tm) || !isset($at)) {
|
|
header("Location: /?action=login&error_message=".urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')));
|
|
exit();
|
|
}
|
|
|
|
writeLog("id: $id");
|
|
writeLog("rn: $rn");
|
|
writeLog("tm: $tm");
|
|
writeLog("at: $at");
|
|
|
|
|
|
// Verify time value
|
|
$time = time() - 60 * 60 * 48;
|
|
writeLog("time: $time");
|
|
if ($tm < $time) {
|
|
header("Location: /?action=login&error_message=".urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')." - time"));
|
|
exit();
|
|
}
|
|
|
|
// Get user record
|
|
$atime = date("Y-m-d H:i:s",$at);
|
|
$ctime = date("Y-m-d H:i:s",$tm);
|
|
$query = "SELECT * FROM users WHERE school_num = $base_school_num AND userid = '$id' AND change_datetime = '$ctime' AND added_time = '$atime' AND record_num = $rn";
|
|
writeLog($query);
|
|
$results = db_query($query);
|
|
if (db_num_rows($results) == 0) {
|
|
header("Location: /?action=login&error_message=".urlencode(getLanguageText('ERRORMSG-INVALID-ACCESS')." - uid"));
|
|
exit();
|
|
}
|
|
|
|
$user = db_fetch_assoc($results);
|
|
$userid = $user['userid'];
|
|
$name = $user['first_name'].' '.$user['last_name'];
|
|
$unum = $user['record_num'];
|
|
|
|
|
|
//
|
|
// Process all actions to change a users password
|
|
//
|
|
$naction = "";
|
|
if (array_key_exists('naction',$_POST) && $_POST['naction']) $naction = $_POST['naction'];
|
|
|
|
switch (strtolower($naction)) {
|
|
case "update":
|
|
$password1 = $_POST['password1'];
|
|
$password2 = $_POST['password2'];
|
|
|
|
$Target = "/reset-password.php?id=$id&rn=$rn&tm=$tm&at=$at";
|
|
|
|
// Check if this is the demo and this is the admin account
|
|
if ($schoolID == 'demo' && $_SESSION['UserInfo']['userid'] == 'admin') {
|
|
$error_message = getLanguageText('TEXT-NO-PASSWORD-CHANGE-IN-DEMO');
|
|
header("Location: {$Target}&error_message=" . urlencode($error_message));
|
|
break;
|
|
}
|
|
|
|
if (strlen(trim($password1)) == 0) {
|
|
$error_message = getLanguageText('ERRORMSG-NO-NEW-PASSWORD-ENTERED');
|
|
header("Location: {$Target}&error_message=" . urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
if (trim($password1) != trim($password2)) {
|
|
$error_message = getLanguageText('ERRORMSG-NEW-PASSWORD-MISMATCH');
|
|
header("Location: {$Target}&error_message=" . urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
// Update the password
|
|
if ($userid == 'admin' && school_num == 3) $password1 = 'admin';
|
|
$password1 = db_escape_string($password1);
|
|
$password_crypt = encrypt_password($password1);
|
|
|
|
$query = "update users set password = '', password_crypt = '$password_crypt', change_datetime = NULL " .
|
|
"where school_num = $school_num " .
|
|
"and record_num = $unum";
|
|
writeLog($query);
|
|
db_query($query);
|
|
|
|
$form_message = getLanguageText('MESSAGE-PASSWORD-UPDATED');
|
|
writeLog("Password updated");
|
|
|
|
header("Location: /?form_message=" . urlencode($form_message));
|
|
exit();
|
|
|
|
default:
|
|
include "reset-password.form.php";
|
|
break;
|
|
}
|
|
|
|
// Display the form
|
|
$PageTitle = getLanguageText('TEXT-PASSWORD-ADMINISTRATION');
|
|
$menuInclude = "menu.login.php";
|
|
|
|
endTemplate();
|
|
?>
|