forked from rogermoka/Timesheet
-
Notifications
You must be signed in to change notification settings - Fork 0
/
changepwd.php
140 lines (120 loc) · 3.65 KB
/
changepwd.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
<?php
// Authenticate
require("class.AuthenticationManager.php");
require("class.CommandMenu.php");
if (!$authenticationManager->isLoggedIn()) {
Header("Location: login.php?redirect=$_SERVER[PHP_SELF]");
exit;
}
// Connect to database.
$dbh = dbConnect();
$contextUser = strtolower($_SESSION['contextUser']);
$loggedInUser = strtolower($_SESSION['loggedInUser']);
$passwd1 = "";
$passwd2 = "";
$old_pass = "";
//load local vars from superglobals
if (isset($_POST["action"])) {
if (!isset($_POST["passwd1"]) || !isset($_POST["passwd2"]) || !isset($_POST["old_pass"]))
errorPage("Please fill out all fields.");
$passwd1 = $_POST['passwd1'];
$passwd2 = $_POST['passwd2'];
$old_pass = $_POST['old_pass'];
}
//get todays values
$today = time();
$today_year = date("Y", $today);
$today_month = date("n", $today);
$today_day = date("j", $today);
//define the command menu
include("timesheet_menu.inc");
//check for guest user
if ($loggedInUser == 'guest')
$errormsg = "Guest may not change password.";
//check that passwords match
if ($passwd1 != $passwd2)
$errormsg = "Passwords do not match, please try again";
if (empty($errormsg) && !empty($old_pass))
{
$qh = mysql_query("select password, $DATABASE_PASSWORD_FUNCTION('$old_pass') from $USER_TABLE where username='$contextUser'") or die("Unable to select ". mysql_error());
list($check1, $check2) = mysql_fetch_row($qh);
if ($check1 != $check2) {
$errormsg = "Wrong password, sorry!";
}
else {
$qh = mysql_query("update $USER_TABLE set password=$DATABASE_PASSWORD_FUNCTION('$passwd1') where username='$contextUser'");
Header("Location: calendar.php");
exit;
}
}
//if errors, redirect to an error page.
if (!empty($errormsg)) {
Header("Location: error.php?errormsg=$errormsg");
exit;
}
?>
<html>
<head>
<title>Change Password for user <? echo $contextUser; ?></title>
<?php include ("header.inc"); ?>
</head>
<body <? include ("body.inc"); ?> >
<?php include ("banner.inc"); ?>
<form action="changepwd.php" method="post">
<input type="hidden" name="action" value="changePassword" />
<table width="436" align="center" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="100%" class="face_padding_cell">
<!-- include the timesheet face up until the heading start section -->
<? include("timesheet_face_part_1.inc"); ?>
<table width="100%" border="0">
<tr>
<td align="left" nowrap class="outer_table_heading" nowrap>
Change Password:
</td>
</tr>
</table>
<!-- include the timesheet face up until the heading start section -->
<? include("timesheet_face_part_2.inc"); ?>
<table width="100%" align="center" border="0" cellpadding="0" cellspacing="0" class="outer_table">
<tr>
<td>
<table width="100%" border="0" cellpadding="1" cellspacing="2" class="table_body">
<tr>
<td width="150" align="right" nowrap>Old Password:</td>
<td><input type="password" name="old_pass" style="width: 100%;"></td>
</tr>
<tr>
<td width="150" align="right" nowrap>New Password:</td>
<td><input type="password" name="passwd1" style="width: 100%;"></td>
</tr>
<tr>
<td width="150" align="right" nowrap>New Password (again):</td>
<td><input type="password" name="passwd2" style="width: 100%;"></td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<table width="100%" border="0" class="table_bottom_panel">
<tr>
<td align="center">
<input type="submit" value="Change!">
</td>
</tr>
</table>
</td>
</tr>
</table>
<!-- include the timesheet face up until the end -->
<? include("timesheet_face_part_3.inc"); ?>
</td>
</tr>
</table>
</form>
<?
include ("footer.inc");
?>
</BODY>
</HTML>