<?php
ob_start();
include ('site.config.php');

//User wants to get reset link

$email_to_reset = "";
$email = "";
$reset_code = "";
$new_password = "";
$error = "";

if(isset($_POST['email_to_reset']) && (strpos($_POST['email_to_reset'], "@") !== false))
{
    
    $check_em = mysql_query("SELECT member_id FROM cms_members WHERE email = '".addslashes($_POST['email_to_reset'])."'");
	$check_em_num = mysql_num_rows($check_em);

	if ($check_em_num > 0 ) {
	   $result = mysql_fetch_array($check_em);
       $memberID = $result['member_id'];
       notificationEmail(0,$memberID,"resetPasswordForEmail");
       $error .= "&bull;  Password reset link sent!<br / >";	
	}
    else{
        $error .= "&bull;  This e-mail address does not exist in the system!<br / >";
    }  
    
}


//User has clicked reset link and entered new password
if(isset($_POST['formType']) && $_POST['formType'] == "resetPassword")
{
   $email = trim($_POST['email']);
   $reset_code = trim($_POST['reset_code']);
   $password = trim($_POST['newPassword']);
   
    
   $check_em = mysql_query("SELECT * FROM cms_members WHERE email = '".addslashes($email)."'");
   $check_em_num = mysql_num_rows($check_em);

	if ($check_em_num > 0 ) {
	   $result = mysql_fetch_array($check_em);
       $memberID = $result['member_id'];
       
       $calculated_reset_code = md5('LeSalt' . $result['email'] . $result['password']);
       
       if($calculated_reset_code == $reset_code)
       {
           include ('site.header.php');
           $resetQuery = mysql_query("UPDATE cms_members SET password = '".md5($password)."' WHERE email = '".addslashes($email)."'");
           echo "<b>Password reset succesful!</b> You will be redirected to login shortly.";
           echo "<br />If you are not redirected, click <a href='acct.php'>here</a>";
           include ('site.footer.php');
           header( "refresh:3;url=acct.php" );
           die();
       }
       else{
        $error .= "&bull;  Invalid Reset Link!<br / >";
    }  	
	}
    else{
        $error .= "&bull;  Invalid Reset Link!<br / >";
    }  
    
    
    
}
include ('site.header.php');


?>
<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="POST">
<div class="form-group">
    <div class="col-sm-offset-2 col-sm-10">
      <div class="col-lg-3"  style="color: blue;"><?php echo $error; ?></div>
    </div>
  </div>

<?php
if(!isset($_GET['reset_code']))
{
    
?>

<div class="form-group">
    <label class="col-lg-2 control-label">E-mail Address:</label>
    <div class="col-lg-3"><input name="email_to_reset" type="text" maxlength="255" class="form-control"/>    </div>
</div>

<div class="form-group">
    <div class="col-sm-offset-2 col-sm-10">
      <button type="submit" name="getResetCode" class="btn btn-default">Get Reset Link </button>
      <input type="hidden" name="formType" value="sendResetLink" />
    </div>
  </div>


<?php
    
}//end if !isset($_GET['reset_code'])
else
{
 
?>

<div class="form-group">
<!-- Reset Code-->
    <input type="hidden" name="reset_code" value="<?php echo $_GET['reset_code'];?>" />
    <input type="hidden" name="email" value="<?php echo $_GET['email'];?>" />
    <label class="col-lg-2 control-label">New Password:</label>
    <div class="col-lg-3"><input name="newPassword" type="password" value="" maxlength="15" class="form-control"/>    </div>
  </div>
  
  <div class="form-group">
    <label class="col-lg-2 control-label">Confirm Password:</label>
    <div class="col-lg-3"><input name="confirm_password" type="password" value="" maxlength="15" class="form-control"/>    </div>
  </div>
  
  <div class="form-group">
    <div class="col-sm-offset-2 col-sm-10">
      <button type="submit" name="changePassword" class="btn btn-default">Change Password</button>
      <input type="hidden" name="formType" value="resetPassword" />
    </div>
  </div>

<?php } //end else !isset($_GET['reset_code']) ?>
</form>
<?php 
include ('site.footer.php');
ob_end_flush();
?>