<?php # Script 16.10 - forgot_password.php
// This page allows a user to reset their password, if forgotten.
include('../includes/settings.php');

require_once ('includes/config.inc.php'); 
require_once ('mysqli_connect.php'); 
$page_title = 'Forgot Your Password';
include ('includes/header.html');
require_once (MYSQL);
if (isset($_POST["forgot"])) 
{
	// Assume nothing:
	$uid = FALSE;

	// Validate the email address...
	if (!empty($_POST['username']))
	{
		// Check for the existence of that username
		$q = 'SELECT intUserID FROM tblUsers WHERE strUsername="'. mysqli_real_escape_string ($dbc, $_POST['username']) . '"';
		$r = mysqli_query ($dbc, $q) or trigger_error("Query: $q\n<br />MySQL Error: " . mysqli_error($dbc));
		
		if (mysqli_num_rows($r) == 1) 
		{ // Retrieve the user ID:
			list($uid) = mysqli_fetch_array ($r, MYSQLI_NUM); 
		} 
		else 
		{ // No database match made.
			$strValidation .= 'The submitted email address does not match those on file!<br />';
		}
		
	} 
	else 
	{ // No email!
		$strValidation .= 'You forgot to enter your username!<br />';
	} // End of empty($_POST['email']) IF.
	if ($uid) 
	{ // If everything's OK.
		$q = 'SELECT strEmailAddress FROM tblUsers WHERE intUserID="'. $uid . '"';
		$r = mysqli_query ($dbc, $q) or trigger_error("Query: $q\n<br />MySQL Error: " . mysqli_error($dbc));
		if (mysqli_num_rows($r) == 1) 
		{ // Retrieve the user ID:
			list($email) = mysqli_fetch_array ($r, MYSQLI_NUM); 
		} 

		// Create a new, random password:
		$p = substr ( md5(uniqid(rand(), true)), 3, 10);

		// Update the database:
		$q = "UPDATE tblUsers SET strPassword=SHA1('$p') WHERE intUserID=$uid LIMIT 1";

		$r = mysqli_query ($dbc, $q) or trigger_error("Query: $q\n<br />MySQL Error: " . mysqli_error($dbc));
		
		if (mysqli_affected_rows($dbc) == 1) 
		{ // If it ran OK.
			
			// Send an email:
			$body = "Your password to log into ***** has been temporarily changed to ".$p." Please log in using this password and this email address. Then you may change your password to something more familiar.";
			
			$headers .= "MIME-Version: 1.0\r\n";
			$headers .= "Content-Type: text/html; charset=ISO-8859-1\r\n";
			$headers .= "X-Priority: 1\n";
			$headers .= "X-MSMail-Priority: Normal\n";
			$headers .= "X-Mailer: php\n";

			$headers .= "From: Digital Tea<info@digitaltea.com> \r\n";

			$subject = 'Your password has been reset';

			mail ($email, $subject, $body, $headers);
			
			// Print a message and wrap up:
			$strValidation .= '<h3>Your password has been changed. You will receive the new, temporary password at the email address with which you registered. Once you have logged in with this password, you may change it by clicking on the "Change Password" link. If you don\'t see the email please check your spam folder.</h3>';
			echo '<div id="listing">';
		
		
			echo '<div class="error">'.$strValidation.'</div></div>';			
			mysqli_close($dbc);
			include ('includes/footer.html');
			exit(); // Stop the script.
			
		} 
		else 
		{ // If it did not run OK.
			$strValidation .= 'Your password could not be changed due to a system error. We apologize for any inconvenience.<br />'; 
		}

	} 
	else 
	{ // Failed the validation test.
		$strValidation .= 'Please try again.<br />';
	}

	mysqli_close($dbc);

} // End of the main Submit conditional.

?>
<div id="listing">
	<h1>Reset Your Password</h1>
	<p>Enter your username below and your password will be reset.</p> 
	<form action="forgot_password.php" method="post" id="postForm">
		<?php
			if ($strValidation != "")
			{
				echo '<div class="error">'.$strValidation.'</div>';			
			}
		?>
		<label for="username">User Name:</label>
		<input type="text" name="username" value="<?php if (isset($_POST['username'])) echo $_POST['username']; ?>" title="Enter in the username of the account you want the password reset. "/>

		<input type="submit" name="forgot" value="Reset My Password" class="buttonsLINK" title="Click here to reset your password" />
		 <a class="buttonsLINK" href="../cmsAdmin/" title="Click here to cancel your password reset.">Cancel </a>
		<!-- <input type="hidden" name="submitted" value="TRUE" /> -->
	</form>
</div>
<?php
include ('includes/footer.html');
?>
