| Server IP : 172.67.201.108 / Your IP : 216.73.216.25 Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.5 System : Linux ip-172-31-69-123.ec2.internal 6.1.176-223.369.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jul 24 13:34:27 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.23 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /home/hotel-prod/public_html/mod/ |
Upload File : |
<?php include('_mod_security.php'); ?>
<?php
$done = false;
$form_message = '';
$hkey = $_GET['hkey'];
//var_dump($hkey);
if (!empty($hkey)) :
$sql = "SELECT * FROM sys_users WHERE hash_key = ".$db->quote($hkey)." AND hash_key_expires >= NOW() AND active = 1";
$result = $db->query($sql);
if ($result->rowCount() < 1) :
$hkey_error = 1;
echo '<h1>This link is invalid or expired!</h1>';
return;
else :
$row = $result->fetch(PDO::FETCH_OBJ);
$user_id = $row->user_id;
endif;
endif;
form_prep('', 'basic_info', 'frm_reset', false);
if ($_POST['form_submitted'] == '1') :
form_prep_submit();
form_validate_all();
if (empty($_POST['captcha']) || $_SESSION['lcs_captcha_key_resetform'] != md5($_POST['captcha'])) :
$ar_err['captcha'] = 'Invalid verification!';
$err_flag = true;
endif;
if (!$err_flag) :
if (empty($hkey)) :
$sql = "SELECT * FROM sys_users WHERE email = ".$db->quote($_POST['email'])." AND active = 1";
//echo '==='.$sql.'===';
$result = $db->query($sql) or die('Database error!');
if ($result->rowCount() <= 0) :
$ar_err['email'] = 'Email address not found!';
$err_flag = true;
endif;
if (!$err_flag) :
$row = $result->fetch(PDO::FETCH_OBJ);
$hash_key = hash('sha256', mt_rand(0,2147483647));
$hash_expires = date('Y-m-d H:i:s', strtotime('+3 days'));
$sql = "UPDATE sys_users
SET hash_key = '".$hash_key."'".
",hash_key_expires = '".$hash_expires."'".
" WHERE user_id = ".$row->user_id;
$db->query($sql) or die('Database error!');
//***************** mail using PHPMailer *****************
$mail_to = $_POST['email'];
$mail_subject = 'Password reset instructions - ThoughtGallery.org';
$mail_body = '<html><head>'.
'<style>body {font-family:Arial, Helvetica, sans-serif; font-size:14px;} table {font-size:14px;}</style>'.
'</head><body>'.
"Please click on the link below or cut and paste it into your browser:<br /><br /> ".
'<a href="'.APP_BASE_SECURE."?IX=pwd_reset&hkey=".$hash_key.'">'.APP_BASE_SECURE."?IX=pwd_reset&hkey=".$hash_key."</a> <br /><br />".
"This link will expire 72 hours from the time this email was sent.<br /><br />".
'Form submitted from IP address: '.get_client_ip().
'</body></html>' ;
if (send_mail($mail_subject, $mail_to, '', APP_MAIL_BCC, $mail_body)) :
$form_message = "Your reset instructions have been sent. Please check your email inbox in the next hour.";
else :
$form_message = '<p>There was a problem sending your message.</p><p>Please email us directly at <a href="mailto:'.APP_MAIL_REPLY.'">'.APP_MAIL_REPLY.'</a></p>';
endif;
//**** ************************** *****
$done = true;
else :
$form_message = "Errors found!";
endif;
else :
if (!empty($_POST['password2']) && $_POST['password1'] != $_POST['password2']) :
$ar_err['password2'] = 'New passwords must match!';
$err_flag = true;
endif;
if (!$err_flag) :
try {
$db->beginTransaction();
$sql = "UPDATE sys_users set password = ".$db->quote(trim(password_hash($_POST['password1'], PASSWORD_BCRYPT))).", ".
"hash_key_expires = '1980-01-01 00:00:00', ".
"hash_key = '' ".
"WHERE user_id = ".$user_id." ";
//echo '==='.$sql.'===';
$db->query($sql);
$db->commit();
} catch(Exception $e) {
db_err_rollback($e);
}
form_success();
$form_message .= '<br><p><a href="login">Click Here to Log In</a></p>';
$done = true;
else :
$form_message = "Errors found!";
endif;
endif;
endif;
endif;
?>
<script>
$(document).ready(function()
{
switch_tab('<?php echo $active_tab; ?>');
});
</script>
<h1>Password Reset</h1>
<?php echo form_message($form_message); ?>
<?php
if ($done) :
return;
endif;
?>
<form style="" name="frm_reset" id="frm_reset" method="post" action="">
<input name="form_submitted" type="hidden" value="1" />
<input name="id" type="hidden" value="<?php echo $_REQUEST['id']; ?>" />
<input name="event_id" type="hidden" value="<?php echo $_REQUEST['event_id']; ?>" />
<input name="active_tab" id="active_tab" type="hidden" value="basic_info" />
<?php form_tab_start('basic_info', 'Password Reset'); ?>
<div class="input_column">
<?php
if ($_SESSION['logged_in']) :
$readonly = true;
else :
$readonly = false;
endif;
if (empty($hkey)) :
form_field(['fname'=>'email', 'ftype'=>'text', 'datatype'=>'email', 'fsize'=>75, 'frequired'=>true, 'fdbname'=>'', 'flabel'=>'Your Email', 'qtip'=>'Enter the email address you use to log into the site.']);
else :
form_field(['fname'=>'password1', 'ftype'=>'password', 'fsize'=>75, 'frequired'=>true, 'fdbname'=>'', 'flabel'=>'New Password', 'qtip'=>'Passwords are case sensitive.']);
form_field(['fname'=>'password2', 'ftype'=>'password', 'fsize'=>75, 'frequired'=>true, 'fdbname'=>'', 'flabel'=>'Confirm New Password', 'qtip'=>'Passwords are case sensitive.']);
endif;
echo '<div style="width:45%; min-width:140px; display:inline-block; margin-right:5px;">';
form_field('captcha', 'text', 15, 0, true, false, false, '', '', '', 'Verification Code', null, '', '', 'If you can\'t read the verification code, click the <b>Reload</b> icon.');
echo '</div>';
echo '<div style="width:48%; min-width:140px; display:inline-block; vertical-align:top; margin-top:22px;">';
echo '<img id="reset_captcha" class="captcha" style="vertical-align:middle;" align="middle" src="ajax.php?call=_captcha&captcha_type=resetform" />';
echo '<img style="vertical-align:middle; cursor:pointer;" align="middle" src="img/reload_icon.png" onclick="reload_captcha(\'reset_captcha\', \'resetform\');" />';
echo '</div>';
?>
</div>
<?php form_tab_end(); ?>
<!-- -------------------------------------------------------------------------------------------------------------- -->
<?php form_button_strip('bottom', ['save'=>['show'=>true, 'caption'=>'Submit', 'js' => "sheet_dirty = false; this.form.submit();"], 'save_close'=>['show'=>false], 'save_new'=>['show'=>false]], false); ?>
</form>