<?php

// +----------------------------------------------------------------------+
// | OpenConf                                                             |
// +----------------------------------------------------------------------+
// | Copyright (c) 2002-2008 Zakon Group LLC.  All Rights Reserved.       |
// +----------------------------------------------------------------------+
// | This source file is subject to the OpenConf License, available on    |
// | the OpenConf web site: www.OpenConf.com                              |
// +----------------------------------------------------------------------+

require_once "../include.php";

printHeader("Reset Password",3);

if (isset($_POST['submit']) && ($_POST['submit'] == "Reset Password") && preg_match("/^[\w\.\-]+$/",$_POST['uname']) && !empty($_POST['email'])) {
	$q = "SELECT reviewerid, username, email FROM " . OCC_TABLE_REVIEWER . " WHERE username='" . oc_strtolower($_POST['uname']) . "'";
	$r = ocsql_query($q) or err("Error checking username ".mysql_errno());
	if (($rnum=mysql_num_rows($r)) == 0) { print '<center><span class="warn">Invalid username.</span></center><p>'; }
	elseif ($rnum > 1) { err("multiple accounts with this username"); }
	else {
		$e = mysql_fetch_array($r);
		if (oc_strtolower($e['email']) != oc_strtolower($_POST['email'])) {
			print '<center><span class="warn">Email does not match username.</span></center><p>';
		}
		else {  // username valid, reset pwd
			$newpwd = newPassword();
			$q2 = "UPDATE " . OCC_TABLE_REVIEWER . " SET password='" . hashPassword($newpwd) . "' WHERE reviewerid='" . $e['reviewerid'] . "'";
			$r2 = ocsql_query($q2) or err("unable to update password");
			$msg = '
Per your request, we have issued you a new password for accessing the ' . $OC_configAR['OC_confName'] . ' OpenConf system.  The new password is:

	' . $newpwd . '

You may change this password at any time by signing in to the OpenConf system and updating your profile.

';
			if (sendEmail($_POST['email'], "Reviewer Password Reset", $msg, $OC_configAR['OC_notifyReviewerReset'])) {
				print 'We have emailed you a new password.  Once you receive it, please <a href="signin.php">sign in</a> and change it.<p>';
			} else {
				warn('We have reset your password, but have been unable to email it to you.  Please contact the administrator.');
			}
			printFooter();
			exit;
		}
	}
}
else {
	print "<center><b>Please enter your username and the email you registered with below</b></center><p>\n";
}

print '
<center>
<form method="post" action="'.$_SERVER['PHP_SELF'].'">
<table border=0>
<tr><td><b>Username:</b></td><td><input size=20 name="uname" value="' . varValue('uname', $_POST) . '"></td></tr>
<tr><td><b>Email:</b></td><td><input size=20 name="email" value="' . varValue('email', $_POST) . '"></td></tr>
<tr><th align="center" colspan=2><br><input type="submit" name="submit" value="Reset Password"></th></tr>
</table>
</form>
</center>
<p>
';

printFooter();

?>
