<?php

$key_in = $arg[3];

if (isset($key_in)) {
	if (zero($key_in)) $key_valid = FALSE;
	else $key_valid = $db->quickSQL("SELECT COUNT(user_pwkey) FROM user WHERE user_pwkey='".$key_in."'");
	if ($key_valid) {
		$uid = $db->quickSQL("SELECT uid FROM user WHERE user_pwkey='".$key_in."'");
		$db->quickUPDATE("UPDATE user SET user_pass=user_pwtemp, user_pwtemp=0, user_pwkey=0, user_pwchange=1 WHERE user_pwkey='".$key_in."'");
	} 
}

if (isset($key_in) && $key_valid) {
	$notices = '<div class="success" style="text-align:center;width:500px;margin:0 auto;">Your password has been successfully changed.<br/>You can now login using the temporary password provided in the email.<P><a href="/account/sign-in">Click Here to Login</a></div><br/><br/><br/><br/><br/>'."\n";
	
} else if (isset($key_in) && !$key_valid) {
	$errors = '<div class="errors" style="width:500px;margin:0 auto;">There was an error while processing this request:<ul><li> The specified password change request confirmation key is not valid.</li><li>It is possible that this password change request has already been activated.</li></ul></div><br/><br/><br/><br/><br/>'."\n";
	
} else if (isset($_POST[requestpw])) {
	$exec = TRUE;
	if (!preg_match("/^[A-Z0-9._%-]+@[A-Z0-9._%-]+\.[A-Z]{2,6}$/i", $_POST[email])) { $exec_sql = FALSE; $err .= "<li> Email address submitted is invalid.\n"; }
	
	// FIND EMAIL ADDRESS IN DATABASE
	$email_exists = $db->quickSQL("SELECT COUNT(user_email) FROM user WHERE user_email='".trim($_POST[email])."'");
	if (!$email_exists) { $exec = FALSE; $err .= "<li> The email address submitted could not be found in our database.\n"; }
	
	if ($exec) {
		// GENERATE RANDOM PASSWORD
		$pass = str_random(10);
		$key = str_random(8);
		
		$db->quickUPDATE("UPDATE user SET user_pwtemp='".md5($pass)."', user_pwkey='".$key."' WHERE user_email='".trim($_POST[email])."'");
		
		// SEND EMAIL
        $message .= "You are receiving this email because a request for a new password was submitted for your account at Ressyn.com. If you did not request this password change then please ignore it. If you keep receiving it, please contact the administrator at ".ADMIN_EMAIL.".\n\n";
		$message .= "\nTo use the new password below, you must activate it by clicking on the link provided:\n";
		$message .= BASE_URL."/account/password/forget/".$key."\n\n";
		$message .= "Afterwards, you will be able to login using this password:\n\n";
		$message .= "Password: ".$pass."\n\n\n";
		$message .= "After your first login, you will be prompted to change your password. If you have any difficulties with this process, please contact the administrator at ".ADMIN_EMAIL.".\n\n";
		$message .= "Thank you,\n\n";
		$message .= "The Web Team\n";
		$message .= "Ressyn, LLC.\n";
		$message .= BASE_URL."\n";

		$subject = "Your Ressyn.com Password Request";
		$addhead = "From: " . ADMIN_EMAIL . PHP_EOL . "Reply-To: ".ADMIN_EMAIL;
		mail($_POST[email],$subject,$message,$addhead);
		
		//$notices = '<div class="notices" style="text-align:center;">'."\n";
	}
}

$page_title = "Forget Your Password?";
$no_robots  = TRUE;

include("_header.php");

	echo '<div class="sp-content">'.EOL;
	
	if ($notices) echo "<br/>".$notices;
	if ($errors) echo "<br/>".$errors;

		if (isset($_POST[requestpw]) && !$exec) {
			echo '<div class="errors" style="width:525px;margin:0 auto;"><b>Your password request could not be completed for the following reasons:</b>'."\n";
			echo "<ul>".$err."</ul>\n";
			echo "</div><br/>\n";
		}
	
		if (isset($_POST[requestpw]) && $exec) {
			echo '<br/><div class="success" style="width:650px;margin:0 auto;"><b>An email has been sent to '.$_POST[email].'</b>'."\n";
			echo "<ul>";
			echo "<li> A new password has been created; please check your e-mail for details on how to activate it.\n";
			echo "<li> You may have to check your email system's SPAM box for this email.\n";
			echo "</ul>\n";
			echo '</div><br/><br/><br/><br/><br/>'."\n";
		}	
	
		if ( (!isset($_POST[requestpw]) && !isset($key_in)) || (isset($_POST[requestpw]) && !$exec)) {
			
			echo '<form name="forgetpw" action="'.self().'" method="post">'.EOL;
				
				echo '<fieldset title="Forget Your Password?" id="password-forget"><legend>&nbsp;&nbsp;Forget Your Password?&nbsp;&nbsp;</legend>'.EOL;
				
				echo '<div class="form-row">';
				echo '<P>Your password is encrypted in our database and cannot be retrieved.<br>Please enter the email address associated with your account<br>into this form and a new password will be sent to you.'.EOL;
				echo '</div>';
				
				echo '<div class="form-row2">';
				echo '<label for="email">Email Address:</label> ';
				echo '<input type="text" name="email" style="width:150px" maxlength="32" class="login" />';
				echo '</div>'.EOL;
				
				echo '<div class="form-row2">';
				echo '<input type="submit" name="requestpw" value="Request New Password" class="submit" /> ';
				echo '<input type="button" onclick="window.location.href=\'/account/sign-in\';" value="Cancel" class="submit" />';
				echo '</div>'.EOL;
													
				echo '</fieldset>'.EOL;	
			
			echo '</form>'.EOL;
			
		}
		

	echo '</div>'."\n";
	
include("_footer.php");
?>