403Webshell
Server IP : 172.67.201.108  /  Your IP : 216.73.216.25
Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.5
System : Linux ip-172-31-69-123.ec2.internal 6.1.176-223.369.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jul 24 13:34:27 UTC 2026 x86_64
User : ec2-user ( 1000)
PHP Version : 8.4.23
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /home/hotel-prod/public_html/mod/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /home/hotel-prod/public_html/mod/pwd_reset.php
<?php include('_mod_security.php'); ?>
<?php
	$done = false;
	$form_message = '';
	$hkey = $_GET['hkey'];
	//var_dump($hkey);
	if (!empty($hkey)) :
		$sql = "SELECT * FROM sys_users WHERE hash_key = ".$db->quote($hkey)." AND hash_key_expires >= NOW() AND active = 1";
		$result = $db->query($sql);
		if ($result->rowCount() < 1) :
			$hkey_error = 1;
			echo '<h1>This link is invalid or expired!</h1>';
			return;
		else :
			$row = $result->fetch(PDO::FETCH_OBJ);
			$user_id = $row->user_id;
		endif;
	endif;
	form_prep('', 'basic_info', 'frm_reset', false);
	if ($_POST['form_submitted'] == '1') :
		form_prep_submit();
		form_validate_all();
		if (empty($_POST['captcha']) || $_SESSION['lcs_captcha_key_resetform'] != md5($_POST['captcha'])) :
			$ar_err['captcha'] = 'Invalid verification!';
			$err_flag = true;
		endif;
		if (!$err_flag) :
			if (empty($hkey)) :
				$sql = "SELECT * FROM sys_users WHERE email = ".$db->quote($_POST['email'])." AND active = 1";
				//echo '==='.$sql.'===';
				$result = $db->query($sql) or die('Database error!');
				if ($result->rowCount() <= 0) :
					$ar_err['email'] = 'Email address not found!';
					$err_flag = true;
				endif;
				if (!$err_flag) :
					$row = $result->fetch(PDO::FETCH_OBJ);
					$hash_key = hash('sha256', mt_rand(0,2147483647));
					$hash_expires = date('Y-m-d H:i:s', strtotime('+3 days'));
					$sql = "UPDATE sys_users 
							SET hash_key = '".$hash_key."'".
								",hash_key_expires = '".$hash_expires."'".
							" WHERE user_id = ".$row->user_id;
					$db->query($sql) or die('Database error!');
					//***************** mail using PHPMailer *****************
					$mail_to = $_POST['email']; 
					$mail_subject = 'Password reset instructions - ThoughtGallery.org';
					$mail_body = '<html><head>'.
								'<style>body {font-family:Arial, Helvetica, sans-serif; font-size:14px;} table {font-size:14px;}</style>'.
								'</head><body>'.
								"Please click on the link below or cut and paste it into your browser:<br /><br /> ".
								'<a href="'.APP_BASE_SECURE."?IX=pwd_reset&hkey=".$hash_key.'">'.APP_BASE_SECURE."?IX=pwd_reset&hkey=".$hash_key."</a> <br /><br />".
								"This link will expire 72 hours from the time this email was sent.<br /><br />".
								'Form submitted from IP address: '.get_client_ip().
								'</body></html>' ;
					
					if (send_mail($mail_subject, $mail_to, '', APP_MAIL_BCC, $mail_body)) :
						$form_message = "Your reset instructions have been sent. Please check your email inbox in the next hour.";
					else :
						$form_message = '<p>There was a problem sending your message.</p><p>Please email us directly at <a href="mailto:'.APP_MAIL_REPLY.'">'.APP_MAIL_REPLY.'</a></p>';
					endif;
					//**** ************************** *****
					$done = true;
				else :
					$form_message = "Errors found!";
				endif;
			else :
				if (!empty($_POST['password2']) && $_POST['password1'] != $_POST['password2']) :
					$ar_err['password2'] = 'New passwords must match!';
					$err_flag = true;
				endif;
				if (!$err_flag) :
					try {
						$db->beginTransaction();
						$sql = "UPDATE sys_users set password = ".$db->quote(trim(password_hash($_POST['password1'], PASSWORD_BCRYPT))).", ".
							"hash_key_expires = '1980-01-01 00:00:00', ".
							"hash_key = '' ".
							"WHERE user_id = ".$user_id."  ";
						//echo '==='.$sql.'===';
						$db->query($sql);
						$db->commit();
					} catch(Exception $e) {
						db_err_rollback($e);
					}
					form_success();
					$form_message .= '<br><p><a href="login">Click Here to Log In</a></p>';
					$done = true;
				else :
					$form_message = "Errors found!";
				endif;
			endif;
		endif;
	endif;
	
?>

<script>
	$(document).ready(function()	
	{
		switch_tab('<?php echo $active_tab; ?>');
	});

</script>

<h1>Password Reset</h1>
<?php echo form_message($form_message); ?>

<?php
	if ($done) :
		return;
	endif;
?>

<form style="" name="frm_reset" id="frm_reset" method="post" action="">
	<input name="form_submitted" type="hidden" value="1" />
	<input name="id" type="hidden" value="<?php echo $_REQUEST['id']; ?>" />
	<input name="event_id" type="hidden" value="<?php echo $_REQUEST['event_id']; ?>" />
	<input name="active_tab" id="active_tab" type="hidden" value="basic_info" />
	<?php form_tab_start('basic_info', 'Password Reset'); ?>
		<div class="input_column">
			<?php
				if ($_SESSION['logged_in']) :
					$readonly = true;
				else :
					$readonly = false;
				endif;
				if (empty($hkey)) :
					form_field(['fname'=>'email', 'ftype'=>'text', 'datatype'=>'email', 'fsize'=>75, 'frequired'=>true, 'fdbname'=>'', 'flabel'=>'Your Email', 'qtip'=>'Enter the email address you use to log into the site.']);
				else :
					form_field(['fname'=>'password1', 'ftype'=>'password', 'fsize'=>75, 'frequired'=>true, 'fdbname'=>'', 'flabel'=>'New Password', 'qtip'=>'Passwords are case sensitive.']);
					form_field(['fname'=>'password2', 'ftype'=>'password', 'fsize'=>75, 'frequired'=>true, 'fdbname'=>'', 'flabel'=>'Confirm New Password', 'qtip'=>'Passwords are case sensitive.']);
				endif;
				echo '<div style="width:45%; min-width:140px; display:inline-block; margin-right:5px;">';
				form_field('captcha', 'text', 15, 0, true, false, false, '', '', '', 'Verification Code', null, '', '', 'If you can\'t read the verification code, click the <b>Reload</b> icon.');
				echo '</div>';
				echo '<div style="width:48%; min-width:140px; display:inline-block; vertical-align:top; margin-top:22px;">';
				echo '<img id="reset_captcha" class="captcha" style="vertical-align:middle;" align="middle" src="ajax.php?call=_captcha&captcha_type=resetform"  />';
				echo '<img style="vertical-align:middle; cursor:pointer;" align="middle" src="img/reload_icon.png" onclick="reload_captcha(\'reset_captcha\', \'resetform\');"  />';
				echo '</div>';
			?>
		</div>
	<?php form_tab_end(); ?>
	<!-- -------------------------------------------------------------------------------------------------------------- -->
	<?php form_button_strip('bottom', ['save'=>['show'=>true, 'caption'=>'Submit', 'js' => "sheet_dirty = false; this.form.submit();"], 'save_close'=>['show'=>false], 'save_new'=>['show'=>false]], false); ?>
</form>

Youez - 2016 - github.com/yon3zu
LinuXploit