<?php

//禁止直接访问
!defined('IN_SYSTEM') && exit('Access Denied');

//是否提交
if($AdminLogin->IsPost(array('oldpw', 'newpw', 'checknewpw', 'SetpwInputKey'), 'SetPw')){
	//来路判断
	if($AdminLogin->CheckHttpReferer(WEB_URL.'/admin/index.php?location=set_pw') == true){
		//验证方法
		$AdminLogin->CheckPostFun = array(
				'oldpw' => array(array('ToUtf8', 'trimall', 'DeleteHtml', 'strip_tags'), array('CheckNull', 'CheckAdminPassword')),
				'newpw' => array(array('ToUtf8', 'trimall', 'DeleteHtml', 'strip_tags'), array('CheckNull', 'CheckAdminPassword')),
				'checknewpw' => array(array('ToUtf8', 'trimall', 'DeleteHtml', 'strip_tags'), array('CheckNull', 'CheckAdminPassword')),
				'SetpwInputKey' => array(array('ToUtf8', 'trimall', 'DeleteHtml', 'strip_tags'), array('CheckNull', 'CheckPostInputKey'))
		);
		//验证数据
		if($AdminLogin->CheckPostValue()){
			//过滤后的用户提交的数据
			$UserPostValue = $AdminLogin->Post;
			//判断InputKey
			if($AdminLogin->CheckValue($UserPostValue['SetpwInputKey'], $_SESSION['SetpwInputKey'])){
				//删除用户提交的InputKey
				unset($UserPostValue['SetpwInputKey']);
				//连接到MYSQL并打开系统数据库
				$DataBase->open_db();
				$DataBase->sel('adminuser', "WHERE `username` = '".$_SESSION['UserName']."'");
				if(count($DataBase->Result) == 1){
					if($AdminLogin->CheckValue(set_password($UserPostValue['oldpw'], $DataBase->Result[0]['key']), $DataBase->Result[0]['password'])){
						if($AdminLogin->CheckValue($UserPostValue['checknewpw'], $UserPostValue['newpw'])){
							$UserPostValue['Key'] = generate_rand_string(50);	//key
							$UserPostValue['newpw'] = set_password($UserPostValue['newpw'], $UserPostValue['Key']);	//密码							
							if($DataBase->up('adminuser', "`password` = '".$UserPostValue['newpw']."', `key` = '".$UserPostValue['Key']."'", "WHERE `username` = '".$_SESSION['UserName']."'")){
								$AdminShowMessage = AdminShowMessage('密码修改成功！', WEB_URL.'/admin/index.php?location=set_pw', 1);
							}
							else{
								$AdminShowMessage = AdminShowMessage('密码修改失败！', WEB_URL.'/admin/index.php?location=set_pw', 0, '#F00');	//密码修改失败
							}
						}
						else{
							$AdminShowMessage = AdminShowMessage('两次输入的密码不一致！', WEB_URL.'/admin/index.php?location=set_pw', 0, '#F00');	//两次输入的新密码不一致
						}
					}
					else{
						$AdminShowMessage = AdminShowMessage('旧密码不对！', WEB_URL.'/admin/index.php?location=set_pw', 0, '#F00');	//旧密码不对
					}
				}
				else{
					$AdminShowMessage = AdminShowMessage('请求失败！', WEB_URL.'/admin/index.php?location=set_pw', 0, '#F00');	//查询结果数不对
				}
				//关闭数据库连接
				$DataBase->close_dblink();
			}
			else{
				$AdminShowMessage = AdminShowMessage('来路不正确！', WEB_URL.'/admin/index.php?location=set_pw', 0, '#F00');	//InputKey不正确
			}
		}
		else{
			$AdminShowMessage = AdminShowMessage('您提交的数据不合法！', WEB_URL.'/admin/index.php?location=set_pw', 0, '#F00');	//验证不通过
		}
	}
	else{
		$AdminShowMessage = AdminShowMessage('来路不正确！', WEB_URL.'/admin/index.php?location=set_pw', 0, '#F00');	//来路不正确
	}
	//销毁inputkey确保只能使用一次
	$_SESSION['SetpwInputKey'] = '';
}
else{
	$AdminShowMessage = AdminShowMessage('提交失败！', WEB_URL.'/admin/index.php?location=set_pw', 0, '#F00');	//表单未提交
}

?>