-
Notifications
You must be signed in to change notification settings - Fork 4
/
_mailNewPassword.php
130 lines (110 loc) · 3.45 KB
/
_mailNewPassword.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
<?php
/*
Copyright 2020 FWBer.com
This file is part of FWBer.
FWBer is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
FWBer is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero Public License for more details.
You should have received a copy of the GNU Affero Public License
along with FWBer. If not, see <https://www.gnu.org/licenses/>.
*/
session_start();
include("_debug.php");
include("_names.php");
include("_init.php");
include("_secrets.php");
$db = mysqli_connect($dburl,$dbuser,$dbpass);
if(!$db)exit(mysqli_connect_error());
//make sure we've got an action.
if(!isset($_GET['email'])||empty($_GET['email']))exit('no email'); else $email= mysqli_escape_string($db,$_GET['email']);
if(!isset($_GET['verifyHash'])||empty($_GET['verifyHash']))exit('no verify'); else $verifyHash= mysqli_escape_string($db,$_GET['verifyHash']);
$dbquerystring = sprintf("SELECT id, verifyHash, dateJoined FROM ".$dbname.".users WHERE email='%s'",$email);
$dbquery = mysqli_query($db,$dbquerystring);
$dbresults = mysqli_fetch_array($dbquery);
$success=false;
if($dbresults)
{
if($verifyHash==$dbresults['verifyHash'])
{
//make new password
$length = 8;
$chars = 'abcdefghijkmnpqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ23456789';
$count = mb_strlen($chars);
for ($i = 0, $newPass = ''; $i < $length; $i++)
{
$index = rand(0, $count - 1);
$newPass .= mb_substr($chars, $index, 1);
}
$dateJoined = $dbresults['dateJoined'];
include("_emailFunctions.php");
$success=true;
$success = sendNewPasswordEmail($email,$newPass,$verifyHash);
if($success==true) //commit the new pass to database.
{
$dbquerystring =
sprintf("UPDATE ".$dbname.".users SET passwordHash = '%s' WHERE email='%s'",
getSaltedPassword($newPass,$dateJoined),
$email
);
if(!mysqli_query($db,$dbquerystring))exit("didn't work");
//done
mysqli_close($db);
}
}
}
?>
<!doctype html>
<html lang="en">
<head>
<title><?php require_once("_names.php"); echo getSiteName(); ?> - Reset Password<?php require_once("_names.php"); echo getTitleTagline(); ?></title>
<?php include("head.php");?>
</head>
<body class="d-flex flex-column h-100">
<?php include("h.php");?>
<div id="mainbody" align="center">
<br>
<br>
<table id="body_table">
<tr>
<td id="middle_column" align="center" valign="top">
<br>
<br>
<br>
<?php
if($success)
{
?>
<div style="color:#0096ff;font-size:14pt;text-shadow:#aad 1px 1px 1px;">
We've sent your new password to you. Please check your email!
<br>
<br>
</div>
<?php
}
else
{
echo '<meta http-equiv="refresh" content="5;url='.getSiteURL().'/signin"/>';
?>
<div style="color:#000;font-size:14pt;text-shadow:#aaa 1px 1px 1px;">
<br><br>
<div style="color:#000;font-size:12pt;text-shadow:#aaa 1px 1px 1px;">
Something went wrong. Your password has not been changed. Please try again later.<br>
<br>
</div>
</div>
<?php
}
?>
</td>
</tr>
</table>
<br>
</div>
<?php include("f.php");?>
</body>
</html>