Central: Add change password

Refs #25 and closes #35

4 files changed, 211 insertions, 0 deletions

@@ -0,0 +1,118 @@
+<?php
+
+/* InstaDisc Server - A Four Island Project */
+
+include('includes/instadisc.php');
+include('includes/template.php');
+
+if (!isset($_GET['submit']))
+{
+        showForm('','','',array());
+} else {
+        $numOfErrors = 0;
+        $errors = array();
+
+        if ($_POST['old'] == '')
+        {
+                addError($numOfErrors, $errors, 'old', 'Old Password is a required field');
+        } else {
+                $getuser = "SELECT * FROM users WHERE username = \"" . mysql_real_escape_string($_SESSION['username']) . "\" AND password = \"" . mysql_real_escape_string(md5($_POST['old'])) . "\"";
+                $getuser2 = mysql_query($getuser);
+                $getuser3 = mysql_fetch_array($getuser2);
+
+                if ($getuser3['password'] != md5($_POST['password']))
+                {
+                        addError($numOfErrors, $errors, 'old', 'Old password is not correct');
+                }
+        }
+
+        if ($_POST['new'] == '')
+        {
+                addError($numOfErrors, $errors, 'new', 'New Password is a required field');
+        }
+
+        if ($_POST['confirm'] == '')
+        {
+                addError($numOfErrors, $errors, 'confirm', 'Confirm New Password is a required field');
+        }
+
+        if ($_POST['new'] != $_POST['confirm'])
+        {
+                addError($numOfErrors, $errors, 'confirm', 'Passwords do not match');
+        }
+
+        if ($numOfErrors > 0)
+        {
+                showForm($_POST['old'], $_POST['new'], $_POST['confirm'], $errors);
+        } else {
+                instaDisc_changePassword($_SESSION['username'], $_POST['new']);
+
+                $template = new FITemplate('changedpassword');
+                $template->add('SITENAME', instaDisc_getConfig('siteName'));
+                $template->display();
+        }
+}
+
+function showForm($old, $new, $confirm, $errors)
+{
+        $template = new FITemplate('changepassword');
+        $template->add('SITENAME', instaDisc_getConfig('siteName'));
+
+        if (isset($errors[1]))
+        {
+                $template->adds('ERROR', array('ex'=>'1'));
+
+                foreach ($errors as $name => $value)
+                {
+                        $template->adds('ERRORS', array(        'NAME' => $name,
+                                                                'MSG' => $value['msg']));
+                }
+        }
+
+        $template->add('OLD_ERR', ifErrors($errors, 'old'));
+        $template->add('NEW_ERR', ifErrors($errors, 'new'));
+        $template->add('CONFIRM_ERR', ifErrors($errors, 'confirm'));
+
+        doErrors($template, $errors, 'old');
+        doErrors($template, $errors, 'new');
+        doErrors($template, $errors, 'confirm');
+
+        $template->add('OLD', $old);
+        $template->add('NEW', $new);
+        $template->add('CONFIRM', $confirm);
+
+        $template->display();
+}
+
+function ifErrors($errors, $id)
+{
+        foreach ($errors as $name => $value)
+        {
+                if ($value['field'] == $id)
+                {
+                        return ' error';
+                }
+        }
+
+        return '';
+}
+
+function doErrors($template, $errors, $id)
+{
+        foreach ($errors as $name => $value)
+        {
+                if ($value['field'] == $id)
+                {
+                        $template->adds(strtoupper($id) . '_ERRS', array(       'NAME' => $name,
+                                                                                'VALUE' => $value['msg']));
+                }
+        }
+}
+
+function addError(&$numOfErrors, &$errors, $field, $msg)
+{
+        $numOfErrors++;
+        $errors[$numOfErrors] = array('field' => $field, 'msg' => $msg);
+}
+
+?>
@@ -397,4 +397,10 @@ function instaDisc_cancelSubscription($username, $url)
         return false;
 }
 
+function instaDisc_changePassword($username, $password)
+{
+        $setpass = "UPDATE users WHERE username = \"" . mysql_real_escape_string($username) . "\" SET password = \"" . mysql_real_escape_string(md5($password)) . "\"";
+        $setpass2 = mysql_query($setpass);
+}
+
 ?>
@@ -0,0 +1,13 @@
+<HTML>
+        <HEAD>
+                <TITLE><!--SITENAME--> InstaDisc Central Server</TITLE>
+        </HEAD>
+
+        <BODY>
+                <CENTER>
+                        <H1>InstaDisc Change Password</H1>
+
+                        <P>You've sucessfully changed your password. Make sure that you change it on your Client as well. <A HREF="userpanel.php">Return to the User Panel</A>
+                </CENTER>
+        </BODY>
+</HTML>
@@ -0,0 +1,74 @@
+<HTML>
+        <HEAD>
+                <TITLE><!--SITENAME--> InstaDisc Central Server</TITLE>
+                <LINK REL="stylesheet" TYPE="text/css" HREF="theme/uniform.css">
+        </HEAD>
+
+        <BODY>
+                <CENTER>
+                        <H1>InstaDisc Change Password</H1>
+
+                        <P>If you would like to change your password, please fill out the form below.
+                </CENTER>
+
+                <FORM CLASS="uniform" ACTION="./changepassword.php?submit=" METHOD="POST">
+
+                        <!--BEGIN ERROR-->
+                        <DIV ID="errorMsg">Uh oh! Validation errors!<P>
+                                <OL>
+                        <!--END ERROR-->
+
+                        <!--BEGIN ERRORS-->
+                                        <LI><A HREF="#error<!--ERRORS.NAME-->"><!--ERRORS.MSG--></A></LI>
+                        <!--END ERRORS-->
+
+                        <!--BEGIN ERROR-->
+                                </OL>
+                        </DIV>
+                        <!--END ERROR-->
+
+                        <FIELDSET CLASS="inlineLabels">
+                                <LEGEND>Password Details</LEGEND>
+
+                                <DIV CLASS="ctrlHolder<!--OLD_ERR-->">
+                                        <!--BEGIN OLD_ERRS-->
+                                                <P ID="error<!--OLD_ERRS.NAME-->" CLASS="errorField"><EM>*</EM>
+                                                        <!--OLD_ERRS.MSG-->
+                                                </P>
+                                        <!--END OLD_ERRS-->
+
+                                        <LABEL FOR="old"><EM>*</EM> Old Password: </LABEL>
+                                        <INPUT TYPE="password" ID="old" NAME="old" CLASS="textInput" VALUE="<!--OLD-->">                        
+                                </DIV>
+
+                                <DIV CLASS="ctrlHolder<!--NEW_ERR-->">
+                                        <!--BEGIN NEW_ERRS-->
+                                                <P ID="error<!--NEW_ERRS.NAME-->" CLASS="errorField"><EM>*</EM>
+                                                        <!--NEW_ERRS.MSG-->
+                                                </P>
+                                        <!--END NEW_ERRS-->
+
+                                        <LABEL FOR="new"><EM>*</EM> New Password: </LABEL>
+                                        <INPUT TYPE="password" ID="new" NAME="new" CLASS="textInput" VALUE="<!--NEW-->">
+                                </DIV>
+
+                                <DIV CLASS="ctrlHolder<!--EMAIL_ERR-->">
+                                        <!--BEGIN CONFIRM_ERRS-->
+                                                <P ID="error<!--CONFIRM_ERRS.NAME-->" CLASS="errorField"><EM>*</EM>
+                                                        <!--CONFIRM_ERRS.MSG-->
+                                                </P>
+                                        <!--END CONFIRM_ERRS-->
+
+                                        <LABEL FOR="confirm"><EM>*</EM> Confirm New Password: </LABEL>
+                                        <INPUT TYPE="password" ID="confirm" NAME="confirm" CLASS="textInput" VALUE="<!--CONFIRM-->">
+
+                                        <P CLASS="formHint">Please re-type your new password</P>
+                                </DIV>
+                        </FIELDSET>
+
+                        <DIV CLASS="buttonHolder">
+                                <INPUT TYPE="submit" NAME="submit" VALUE="Submit">
+                        </DIV>
+                </FORM>
+        </BODY>
+</HTML>