<?php include('_mod_security.php'); ?>
<?php
	// ****** Prepare database query ******
	$hkey_error = 0;
	$hkey = mysqli_real_escape_string($GLOBALS['con'], trim($_GET['hkey']));
	//var_dump($hkey);
	if (empty($hkey) || $hkey == '')
	{
		$hkey_error = 1;
	}
	else
	{
		$sql = "SELECT * FROM admin_users WHERE HashKey = '".$hkey."' AND HashKeyExpires >= NOW()";
		$result = mysqli_query($GLOBALS['con'], $sql);
		if (mysqli_num_rows($result) < 1)
		{
			$hkey_error = 1;
			die('This link is invalid or expired!');
		}
		else
		{
			$row = mysqli_fetch_array($result);
		}
	}
	$form_error = 0;
	$form_error_text = '';
	if ($_POST['Submitted'] == '1')
	{
		$form_pwd1 = mysqli_real_escape_string($GLOBALS['con'], trim($_POST['PWD1']));
		$form_pwd2 = mysqli_real_escape_string($GLOBALS['con'], trim($_POST['PWD2']));
		if ($form_pwd1 == '' || $form_pwd2 == '')
		{
			$form_error = 1;
			$form_error_text = 'Password cannot be blank!';
		}
		if ($form_pwd1 != $form_pwd2)
		{
			$form_error = 1;
			$form_error_text = 'Passwords do not match!';
		}
		if ($form_error != 1)
		{
			$salt = hash('sha512', random_bytes(64));
			$sql = "UPDATE admin_users 
					SET salt = '".$salt."'".
						",password = '".hash('sha512', $salt.$form_pwd1)."'".
						",HashKey = NULL".
						",HashKeyExpires = '1980-01-01'".
					"WHERE HashKey = '".$hkey."'";
			mysqli_query($GLOBALS['con'], $sql);
			if (mysqli_error($GLOBALS['con']) != '')
				echo 'SQL:  '.$sql.'<BR />Database Error - '.mysqli_error($GLOBALS['con']).'<BR />';
			else
			{
				echo '<div style="text-align:center;" align="center" >';
				echo 'Password successfully updated<br /><br />';
				echo '<div style="width:60px; height:16px; margin-left:auto; margin-right:auto;" class="button-mini" onclick="document.location.href=\'index.php?IX=home\'" >';
				echo 'OK';
				echo '</div>';
				echo '</div>';
			}
			exit();
		}
	}
?>

<div align="center">
	Your email address is: 
	<?php echo $row['Email'] ?>
	<br /><br />
    Enter your new Password below.
	<br /><br /><span class="error-text" style="font-size:14pt; color:red;"><?php echo $form_error_text; ?></span><br />
</div>

<form name="frmPwd" id="frmPwd" method="post" action="index.php?IX=pwd_reset&hkey=<?php echo $hkey; ?>" >
	<input type="hidden" id="Submitted" name="Submitted" value="1"  >
	<table width="450" border="0" align="center" cellpadding="0" cellspacing="10" style="border: 1px solid ##166E3E">
		<tr valign="top">
			<td class="label">
				Password:<br />
			</td>
			<td>
				<input type="password" id="PWD1" name="PWD1" class="input-box" style="width:200px;" size="75" maxlength="75" />
			</td>
		</tr>
		<tr valign="top">
			<td class="label">
				Re-enter Password:<br />
			</td>
			<td>
				<input type="password" id="PWD2" name="PWD2" class="input-box" style="width:200px;" size="75" maxlength="75" />
			</td>
		</tr>
		<tr valign="middle">
			<td colspan="2" align="center">
				<input type="submit" name="button" tabindex="4" value="Submit" class="default-button" >
			</td>
		</tr>
	</table>

</form>