diff --git a/db/config.php b/db/config.php index bf88243..0f9a7ad 100644 --- a/db/config.php +++ b/db/config.php @@ -46,6 +46,13 @@ function db() { submission_date TIMESTAMP DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE );"); + + $pdo->exec("CREATE TABLE IF NOT EXISTS password_resets ( + id INT AUTO_INCREMENT PRIMARY KEY, + email VARCHAR(255) NOT NULL, + token VARCHAR(255) NOT NULL UNIQUE, + expires_at TIMESTAMP NOT NULL + );"); } catch (PDOException $e) { error_log('Database setup failed: ' . $e->getMessage()); // You could display a generic error page here instead of dying diff --git a/forgot_password.php b/forgot_password.php new file mode 100644 index 0000000..d828efc --- /dev/null +++ b/forgot_password.php @@ -0,0 +1,67 @@ + + + + + + + Forgot Password - E-Waste Reclaimer + + + + + + +
+
+
+
+
+

Forgot Password

+
+
+ + + + +

Enter your email address and we will send you a link to reset your password.

+
+
+ + +
+ +
+
+
+
+
+
+ + + + \ No newline at end of file diff --git a/login.php b/login.php index 36c8cc6..50ba462 100644 --- a/login.php +++ b/login.php @@ -109,6 +109,9 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
+
+ Forgot Password? +
diff --git a/reset_password_form.php b/reset_password_form.php new file mode 100644 index 0000000..327a1a9 --- /dev/null +++ b/reset_password_form.php @@ -0,0 +1,85 @@ +prepare("SELECT * FROM password_resets WHERE token = ?"); + $stmt->execute([$token]); + $reset_request = $stmt->fetch(); + + if ($reset_request) { + if ($reset_request['expires'] >= date("U")) { + $token_valid = true; + } else { + $error = "Password reset token has expired."; + } + } else { + $error = "Invalid password reset token."; + } + } catch (PDOException $e) { + $error = "Database error: " . $e->getMessage(); + error_log($error); + } +} +?> + + + + + + Reset Password - E-Waste Reclaimer + + + + + + +
+
+
+
+
+

Reset Password

+
+
+ +
+ + + +
+ +
+ + +
+
+ + +
+ +
+ +

Please return to the forgot password page to request a new link.

+ +
+
+
+
+
+ + + + \ No newline at end of file diff --git a/send_reset_link.php b/send_reset_link.php new file mode 100644 index 0000000..45523b3 --- /dev/null +++ b/send_reset_link.php @@ -0,0 +1,61 @@ +prepare("SELECT id FROM users WHERE email = ?"); + $stmt->execute([$email]); + $user = $stmt->fetch(); + + if ($user) { + $token = bin2hex(random_bytes(50)); + $expires = date("U") + 1800; // 30 minutes + + $stmt = $pdo->prepare("INSERT INTO password_resets (email, token, expires) VALUES (?, ?, ?)"); + $stmt->execute([$email, $token, $expires]); + + $reset_link = "http://" . $_SERVER['HTTP_HOST'] . "/reset_password_form.php?token=" . $token; + + $subject = "Password Reset Request"; + $body = "

Hello,

"; + $body .= "

You requested a password reset. Click the link below to reset your password:

"; + $body .= "

" . $reset_link . "

"; + $body .= "

This link will expire in 30 minutes.

"; + $body .= "

If you did not request a password reset, please ignore this email.

"; + + // Use MailService to send the email + $mail_result = MailService::sendMail($email, $subject, $body, strip_tags($body)); + + if (!empty($mail_result['success'])) { + $message = 'A password reset link has been sent to your email address.'; + $message_type = 'success'; + } else { + $message = 'Could not send the password reset email. Please try again later.'; + error_log("MailService Error: " . ($mail_result['error'] ?? 'Unknown error')); + } + } else { + $message = 'No user found with that email address.'; + } + } catch (PDOException $e) { + $message = "Database error: " . $e->getMessage(); + error_log($message); + } catch (Exception $e) { + $message = "An error occurred: " . $e->getMessage(); + error_log($message); + } + } + $_SESSION['message'] = $message; + $_SESSION['message_type'] = $message_type; + header("Location: forgot_password.php"); + exit; +} diff --git a/update_password.php b/update_password.php new file mode 100644 index 0000000..ad30ae5 --- /dev/null +++ b/update_password.php @@ -0,0 +1,52 @@ +prepare("SELECT * FROM password_resets WHERE token = ?"); + $stmt->execute([$token]); + $reset_request = $stmt->fetch(); + + if ($reset_request && $reset_request['expires'] >= date("U")) { + $email = $reset_request['email']; + $hashed_password = password_hash($password, PASSWORD_DEFAULT); + + $stmt = $pdo->prepare("UPDATE users SET password = ? WHERE email = ?"); + $stmt->execute([$hashed_password, $email]); + + // Delete the used token + $stmt = $pdo->prepare("DELETE FROM password_resets WHERE email = ?"); + $stmt->execute([$email]); + + $_SESSION['message'] = 'Your password has been successfully reset. Please log in with your new password.'; + $_SESSION['message_type'] = 'success'; + header("Location: login.php"); + exit; + } else { + $error = "Invalid or expired password reset token."; + } + } catch (PDOException $e) { + $error = "Database error: " . $e->getMessage(); + error_log($error); + } + } + + // If there was an error, redirect back to the reset form with the token + $_SESSION['error'] = $error; + header("Location: reset_password_form.php?token=" . urlencode($token)); + exit; +} \ No newline at end of file