<?php
/**
 * @version $Id: getpw.php v2.0 $
 * @package PBDigg
 * @copyright Copyright (C) 2007 - 2008 PBDigg.com. All Rights Reserved.
 * @license PBDigg is free software and use is subject to license terms
 */

define('PB_CSCRIPT', 'getpw');
require_once('include/common.inc.php');

if (!$pb_getpw)
{
	showMsg($u_message['getpw_closed']);
}

if ($action == 'send' && ($_PBDEV['CK_HASH'] == $verifyhash))
{
	$username = trim($_POST['username']);
	$email = trim($_POST['email']);
	if (empty($username) || empty($email))
	{
		showMsg($u_message['getpw_illegal_param'], 'getpw.php');
	}
	$rs = $DB->db_fetch_one_array("SELECT uid, adminid, password FROM {$db_prefix}members WHERE username = '$username' AND email = '$email'");
	if ($rs)
	{
		if (('1' == $rs['adminid']) || ('2' == $rs['adminid']))
		{
			showMsg($u_message['getpw_account_invalid'], 'getpw.php');
		}
		if (($timestamp - gCookie('pb_getpw')) < 180)
		{
			showMsg($u_message['getpw_send_limit'], 'getpw.php');
		}
		sCookie('pb_getpw', $timestamp, 3600);
		//send active email
		require_once (PBDIGG_ROOT.'include/mail.inc.php');
		$confirmcode = rawurlencode(PEncode($rs['uid'].'|'.$timestamp.'|'.$rs['password'], $pb_sitehash));
		$mail_content = str_replace(array('[!--username--]','[!--confirmcode--]'), array($username,$confirmcode), $u_message['getpw_email_body']);
		PMail($email, $u_message['getpw_email_subject'], $mail_content);
		showMsg($u_message['getpw_email_success'], $_PBENV['PB_URL']);
	}
	else
	{
		showMsg($u_message['getpw_ue_error'], 'getpw.php');
	}
}
elseif (($action == 'get') && !empty($confirm))
{
	$confirmcode = explode('|', PDecode($confirm, $pb_sitehash));
	if ((count($confirmcode) != 3) || !is_numeric($confirmcode[0]) || !is_numeric($confirmcode[1]) && ($timestamp - $confirmcode[1] > 86400) || (strlen($confirmcode[2]) != 32))
	{
		showMsg($u_message['getpw_illegal_confirm'], 'getpw.php');
	}
	$gpw_uid = (int)$confirmcode[0];
	$gpw_pw = addslashes($confirmcode[2]);
	$rs = $DB->db_fetch_one_array("SELECT adminid FROM {$db_prefix}members WHERE uid = $gpw_uid AND password = '$gpw_pw'");
	if ($rs)
	{
		if (('1' == $rs['adminid']) || ('2' == $rs['adminid']))
		{
			showMsg($u_message['getpw_account_invalid'], 'getpw.php');
		}
		if ($submitted && ($password == $rpassword))
		{
			if (strlen($password) < 6)
			{
				showMsg($u_message['password_less_six']);
			}
			$password = str_replace(array("\t","\r","\n"), '', $password);
			$password = md5($password);
			$DB->db_query("UPDATE {$db_prefix}members SET password = '$password' WHERE uid = $gpw_uid");
			sCookie('pb_getpw', '', -1);
			showMsg($u_message['getpw_reset_success'], 'login.php');
		}
		else
		{
			$TPL->assign('type', 'getpw');
			$TPL->assign('confirm', $confirm);
		}
	}
	else
	{
		showMsg($u_message['getpw_illegal_confirm'], 'getpw.php');
	}
}
$seo['pagetitle'] = $seo['keywords'] = $seo['description'] = $u_message['getpw'];
$TPL->assign('seo', $seo);
PBOutPut('getpw.html');
?>
