<?php defined( '_BIGNIGHT_EXEC' ) or die( 'Restricted access' );?>

<?php
	global $error;
	global $user;
	if($user!==null) die();
	if(isset($_POST["reset-submit"])&&!empty($_GET["code"])){
		if (!empty($_POST["password"]) && $_POST["password"]==$_POST["password2"]){
			global $DB;
			$password = $_POST["password"];
			$code = str_replace("'","''",$_GET["code"]);
			$user = $DB->qry("SELECT * FROM users WHERE code='{$code}';",4);
			if($DB->numrows()===0){
				$error = "Invalid reset password code";
			} else {
				$password = md5($password);
				$DB->qry("UPDATE users SET password='{$password}',code='' WHERE code='{$code}';");
				if($DB->numrows()!==0){
					$error = "New password stored for {$user["username"]}.";
					echo "You may now <a href=\"index.php?view=user\">log in</a>.";
				} else $error = "Error changing password. Try again later";
			}
		} else {
			$error = "<font color=\"#FF0000\">Passwords don't match</font>";
		}
	} else if(isset($_GET["reset"])){
		global $DB;
		$code = str_replace("'","''",$_GET["reset"]);
		$user = $DB->qry("SELECT * FROM users WHERE code='{$code}';",4);
		if($DB->numrows()===0){
			$error = "Invalid reset password code";
		} else {
			$error = "Enter new password";
			echo "Enter new password:<br>\n";
			echo "<form name=\"register\" method=\"post\" action=\"index.php?view=forgot&code={$code}\"><table>\n";
			echo "<tr><td>Password:</td><td><input type=\"password\" size=\"15\" name=\"password\"><td></tr>\n";
			echo "<tr><td>Confirm:</td><td><input type=\"password\" name=\"password2\"><td></tr>\n";
			echo "<tr><td></td><td><input type=\"submit\" name=\"reset-submit\" value=\"Register\"></td></tr>\n";
			echo "</table></form>";
		}
	} else if(isset($_POST["email"])){
		global $DB;
		$email = str_replace("'","''",$_POST["email"]);
		$user = $DB->qry("SELECT * FROM users WHERE email='{$email}';",4);
		if($DB->numrows()===0) {
			$error = "E-mail address '$email' not registered.";
		} else {
			if(!empty($user["code"]) && $user["blocked"]==1){
				$error = "Account is yet to be activated. Activation e-mail was re-sent.";
				$message = "Hello, {$user["username"]}\n\nYou have created an account at Big Night Out website.\nPlease follow the link below to activate your account:\n\nhttp://146.245.250.215/~achikin/project/index.php?activate={$user["code"]}\n\nBest regards,\nAdministrator";
				$sent = mail($email, "Big Night Out - User Activation", $message);
				if (!$sent) $error = "<font color=\"#FF0000\">E-mail could not be sent to {$email}. Try again later</font>";
			} else {
				$code = md5($user["username"] . $user["email"] . time());	// generate restore code
				$DB->qry("UPDATE users SET code='{$code}' WHERE username='{$user["username"]}';");
				
				
			//	send email
				$message = "Hello, {$username}\n\nYou have requested a password reset for your account at Big Night Out website.\nPlease follow the link below to reset your password:\n\nhttp://146.245.250.215/~achikin/project/index.php?view=forgot&reset={$code}\n\nBest regards,\nAdministrator";
				$headers = 'From: Big Night Out Admin' . "\r\n" . 'Reply-To: admin@paindealers.org';
				$sent = mail($_POST["email"], "Big Night Out - Password Reset", $message,$headers);
				if ($sent) {
					$error = "Password reset link has been sent to {$email}";
					echo "Follow the link and reset your password.";
				} else $error = "<font color=\"#FF0000\">E-mail could not be sent to {$email}. Try again later</font>";
			}
		}
	} 
	
	if(!isset($error) || $error===""){
		echo "Enter your e-mail address (the one you used to register):<br>\n";
		echo "<form name=\"forgot\" method=\"post\" action=\"index.php?view=forgot\" onSubmit=\"return validateForgotForm()\">\n";
		echo "<input type=\"text\" size=\"35\" name=\"email\">\n";
		echo "<input type=\"submit\" name=\"forgot-submit\" value=\"Reset password\">\n";
		echo "</form>";
	
	}


?>