<?php # Script 16.11 - change_password.php
// This page allows a logged-in user to change their password.
include('../cmsAdmin/includes/settings.php');

require_once ('includes/config.inc.php'); 
$page_title = 'Change your Password';
include ('includes/header.html');

// If no first_name session variable exists, redirect the user:
if (!isset($_SESSION['strFirstName'])) 
{	
	$url = BASE_URL . 'index.php'; // Define the URL.
	ob_end_clean(); // Delete the buffer.
	header("Location: $url");
	exit(); // Quit the script.
}

// echo 'user' . $_SESSION['intUserID'];
if (isset($_POST['submitted'])) 
{
	require_once (MYSQL);
			
	// Check for a new password and match against the confirmed password:
	$p = FALSE;
	if (preg_match ('/^(\w){4,20}$/', $_POST['password1']) ) 
	{
		if ($_POST['password1'] == $_POST['password2'])
		{
			$p = mysqli_real_escape_string ($dbc, $_POST['password1']);
		} 
		else 
		{
			$strValidation .= 'Your password did not match the confirmed password!<br />';
		}
	} 
	else 
	{
		$strValidation .= 'Please enter a valid password!<br />';
	}
	
	if ($p) 
	{ // If everything's OK.
		// Make the query.
		$q = "UPDATE tblUsers SET strPassword=SHA1('$p') WHERE intUserID={$_SESSION['intUserID']} LIMIT 1";	
		$r = mysqli_query ($dbc, $q) or trigger_error("Query: $q\n<br />MySQL Error: " . mysqli_error($dbc));
		if (mysqli_affected_rows($dbc) == 1) 
		{ // If it ran OK.
		
			// Send an email, if desired.
			$strValidation .= '<h3>Your password has been changed.</h3>';
			echo '<div id="listing">';
			echo '<div class="error">'.$strValidation.'</div></div>';
			mysqli_close($dbc); // Close the database connection.
			include ('includes/footer.html'); // Include the HTML footer.
			exit();
			
		}
		else 
		{ // If it did not run OK.
		
			$strValidation .= 'Your password was not changed. Make sure your new password is different than the current password. Contact the system administrator if you think an error occurred.<br />'; 

		}

	} 
	else 
	{ // Failed the validation test.
		$strValidation .= 'Please try again.<br />';		
	}
	
	mysqli_close($dbc); // Close the database connection.

} // End of the main Submit conditional.

?>
<div id="listing">
	<h1>Change Your Password</h1>
	<form action="change_password.php" method="post" id="postForm">
		<?php
		if ($strValidation != "")
		{
			echo '<div class="error">'.$strValidation.'</div>';			
		}
		?>
		<p>Use only letters, numbers, and the underscore. Must be between 4 and 20 characters long.</p>

		<label for="password1">New Password:</label>
		<input type="password" name="password1" title="Enter in your new password. It must be 4 to 20 characters." id="password1" /> 
		<label for="password2">Confirm New Password:</label>
		<input type="password" name="password2" title="Re-enter your new password"  id="password2"/>
		
		<input type="submit" name="submit" value="Change My Password" class="buttonsLINK" title="Click here to save your new password." />
		 <a class="buttonsLINK" href="../controlPanel/index.php" title="Click here to cancel changing your password.">Cancel </a>
		<input type="hidden" name="submitted" value="TRUE" />
	</form>
</div>
<?php
include ('includes/footer.html');
?>
