<?php

/*

Copyright © 2001 Nick Gammon.

  Author: Nick Gammon <nick@gammon.com.au>
  Web:    http://www.gammon.com.au/
  Date:   February 2001

  This program is free software; you can redistribute it and/or modify 
  it under the terms of the GNU General Public License as published by 
  the Free Software Foundation; either version 2 of the License, 
  or (at your option) any later version. 

  This program is distributed in the hope that it will be useful, 
  but WITHOUT ANY WARRANTY; without even the implied warranty of 
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
  See the GNU General Public License for more details. 

  You should have received a copy of the GNU General Public License 
  along with this program; if not, write to 

  The Free Software Foundation, Inc., 
  59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.


  The Free Software Foundation maintains a web page at: http://www.fsf.org

  See the file gpl.txt for the full GNU General Public License.

*/

require ("config.php");
require ($CONFIG_PATH . "general_config.php");
require ($INCLUDE_DIRECTORY . "common.php");

Init ("Lost/changed password", "lost, changed, password"); 

$forum_name = $control ['forum_name'];

?>

<h1><?php echo $forum_name; ?></h1>

<?php

CheckField ("user identifier", $bbuser_id);
 
if ($action == "change")
  {
  CheckField ("user identifier", $bbuser_id, false);

  if (!$foruminfo)
    Problem ("You have not logged in");
  
  if ($foruminfo ['bbuser_id'] != $bbuser_id && !$foruminfo ['admin'])
    Problem ("You cannot change another user's password");
      
  } // end of amending him
  
if (!$action)
  Problem ("No action specified");
    
if ($action == "change")
  {
      
?>

<hr>
<h2>Password change</h2>

<p>Use this form to change your password for <?php echo $forum_name; ?>.</p>

<p>All fields are required.<br> 
Press the &quot;Change&quot; button when finished, to send your new password to our server.</p>
<?php  
    
  } // end of change password

if ($action == "forgot")
    {
  ?>
  
  <hr>
  <h2>Forgotten password</h2>
  
  <p>Use this form to request that your password be emailed to you.</p>
     
  <?php  
    
    } // end of forgotten password
   
     
$specials = array
  (
  'username'     => array (
                'input' => 'username',
                'description' => 'Name:',
                'comment' => "Enter the user name that you registered for this forum.",
                'size' => 30,
                'maxlength' => 30
                ),    // name
  'oldpassword'     => array (
                'input' => 'oldpassword',
                'type' => 'password',
                'description' => 'Current password:',
                'comment' => 'Enter your current password.',
                'size' => 20,
                'maxlength' => 20
                ),    // oldpassword
  'newpassword'     => array (
                'input' => 'newpassword',
                'type' => 'password',
                'description' => 'New password:',
                'comment' => 'Enter your new password.',
                'size' => 20,
                'maxlength' => 20
                ),    // newpassword
  'confirmpassword'     => array (
                'input' => 'confirmpassword',
                'type' => 'password',
                'description' => 'Confirm password:',
                'comment' => 'Enter your new password again.',
                'size' => 20,
                'maxlength' => 20
                ),    // confirmpassword
  );  // end of specials


if ($action == "Update")
  {
  ValidateOneField ('oldpassword', 'text', true, 20, $specials);
  ValidateOneField ('newpassword', 'text', true, 20, $specials);
  ValidateOneField ('confirmpassword', 'text', true, 20, $specials);
  
  if (!$have_error && $newpassword != $confirmpassword)
    {
    $specials ['confirmpassword'] ['error'] = "Confirmation does not match new password";
    $have_error = true;
    } // end of bad confirmation
    
  } // end of Change requested
else if ($action == "Request password")
  ValidateOneField ('username', 'text', true, 30, $specials);

if ($have_error)
  {
?>
<hr>
<h2>Error in submission</h2>
<p>There were some errors in processing your submission.</p>
<p>Please try again. Thank you.</p> 
  
<?php  
  } // end of error in fields
else
  if ($action == "Update")
    {
    
    echo "<hr><h2>Password change request</h3>\n";
    
    CheckField ("user identifier", $bbuser_id, false);

    if ($foruminfo ['bbuser_id'] != $bbuser_id && !$foruminfo ['admin'])
      Problem ("You cannot change another user's password");
          
    $query = "SELECT * "
           . "FROM bbuser "
           . "WHERE bbuser_id = $bbuser_id";
                                  
    $result = mysql_query ($query) 
        or Problem ("Select of user failed: " . mysql_error ());
    
    if (!($row = mysql_fetch_array ($result)))
      Problem ("User id $bbuser_id is not on file");
      
    mysql_free_result ($result);
        
    if ($oldpassword != $row ['password'])
      {
      $specials ['oldpassword'] ['error'] = "Incorrect old password";
      $have_error = true;
      } // end of bad old password
    else
      {
      $query = "UPDATE bbuser SET "
             . "password = '$newpassword' "
             . "WHERE bbuser_id = $bbuser_id";
  
      $result = mysql_query ($query) 
        or Problem ("Update failed: " . mysql_error ());
  
      if (mysql_affected_rows () > 0)
        echo "<p><b>Password changed.</b></p>\n";
      else
        echo "<p><b>Password not changed.</b></p>\n";
    
    
      echo "<hr>\n";
      bList ();
      LI (); hLink ("Go to $forum_name", "bbshowpost.php");
      LI (); hLink ("Edit my profile", "bbuseredit.php", "action=amend&bbuser_id=$bbuser_id");
      LI (); hLink ("View my profile", "bbshowbio.php", "bbuser_id=$bbuser_id");
      LI (); hLink ("View list of registered users", "bbuserlist.php", "", false); 
      
      eList ();
      MessageTail (false);
      die ();
      } // end of password change 
    } // end of Update 
  else
    if ($action == "Request password")
      {

    echo "<hr><h2>Password mailout request</h3>\n";

     $query = "SELECT * "
           . "FROM bbuser "
           . "WHERE username = '$username'";
                                  
    $result = mysql_query ($query) 
        or Problem ("Select of user failed: " . mysql_error ());
    
    if ($row = mysql_fetch_array ($result))
      {
     
      mysql_free_result ($result);

      $bbuser_id = $row ['bbuser_id'];
      $username = $row ['username'];
      $email = $row ['email'];
      $password = $row ['password'];
      
           
      $today = strftime ("%Y-%m-%d", utctime());   // today's date
     
      if ($row ["date_password_mailed"] == $today)
        {
        echo "<p>A password has already been mailed to you today.</p>\n";
        echo "<p>To guard against someone 'mail bombing' you, only one password";
        echo " will be mailed to you per day. Please try again tomorrow.</p>\n";
        }
      else
        {  
        $forum_url = $control ['forum_url'];

        // send mail message
        
        $mailresult = mail ($username . " <" . $email . ">", 
              "$forum_name password",
              "Hi $username,\n\n" 
            . "As requested, here is your $forum_name password.\n\n"
            . "Forum user name: \"$username\"\n\n"
            . "Password       : \"$password\"\n\n"
            . "You can visit the forum at:\n\n  $forum_url/bbshowpost.php\n\n"
            . $control ['email_signature'],
            // mail header
            "From: " . $control ['email_from'] . "\r\n"
          . "Content-Type: text/plain\r\n"
          . "X-mailer: PHP/" . phpversion()
            );
        
        if (!$mailresult)
          Problem ("An error occurred sending the email message");
        
        echo "<p>Your password is now being emailed to the email address we have ";
        echo "on file for <b>$username</b>. ";
        echo "For privacy reasons we cannot disclose what that is here.</p>\n";
        
        if ($control ['forum_support'])
          {
          echo "<p>If you have changed email addresses since registering, please ";
          echo "send an email to <a href=\"mailto:";
          echo $control ['forum_support'];
          echo "\">";
          echo htmlspecialchars ($control ['forum_support']);
          echo "</a> explaining the problem.</p>\n";
          echo "<p>Please mention your old email address and your new email address \n";
          echo "so we can verify your request.</p>\n";
          echo "<p>Note that we may send an email to your old email address to check ";
          echo "that this request is valid, and wait for a response. This may take some time.</p>\n";
      		}		// end of having a forum support email address
      
        // now update the date we did this
        
        $query = "UPDATE bbuser SET "
            . "date_password_mailed = '$today' "
            . "WHERE bbuser_id = $bbuser_id";
          
        $result = mysql_query ($query) 
            or Problem ("Update of date sent failed: " . mysql_error ());
                
        } // end of mailing password
        
      echo "<hr><p>\n";
      hLink ("Go to $forum_name", "bbshowpost.php");
      echo "</p>";
      MessageTail (false);
      die ();
        
      } // end of user on file
    else
      {
      $specials ['username'] ['error'] = "That user is not on file";
      $have_error = true;
      } // end of user not on file
      
    } // end of Request password  

echo "<form METHOD=post ACTION=\"$PHP_SELF\">\n";

if ($action == 'forgot' || $action == 'Request password')
  {
  $table ['username'] = stripslashes ($username);
  $newaction = 'Request password';
  } // end of forgot
else  
if ($action == 'change' || $action == 'Update')
  {
  $table ['oldpassword'] = "";
  $table ['newpassword'] = "";
  $table ['confirmpassword'] = "";
  $newaction = 'Update';
  } // end of change
  
$params = array
  (
  'LH' => 'valign=top bgcolor="#ADD8E6" align=right',
  'RH' => 'bgcolor="#FAF0E6" align=left'
  );

      
ShowTable ($table, $params, $specials);

echo "<p>";
echo "<input Type=submit Name=action Value=\"$newaction\">";
echo "<input type=hidden name=action Value=\"$newaction\">";
echo "</p>";
?>


<input type=hidden name=bbuser_id value=<?php echo ($bbuser_id); ?>>
<?php FormSession (); ?>

</form>
    
<?php

hLink ("Back to $forum_name", "bbshowpost.php");

MessageTail (false);
?>    
