52 lines
2.0 KiB
PHP
52 lines
2.0 KiB
PHP
<?php
|
|
session_start();
|
|
require_once 'db/config.php';
|
|
|
|
if ($_SERVER["REQUEST_METHOD"] == "POST") {
|
|
$token = $_POST['token'] ?? '';
|
|
$password = $_POST['password'] ?? '';
|
|
$password_confirm = $_POST['password_confirm'] ?? '';
|
|
$error = '';
|
|
|
|
if (empty($token) || empty($password) || empty($password_confirm)) {
|
|
$error = "All fields are required.";
|
|
} elseif ($password !== $password_confirm) {
|
|
$error = "Passwords do not match.";
|
|
} elseif (strlen($password) < 8) {
|
|
$error = "Password must be at least 8 characters long.";
|
|
} else {
|
|
try {
|
|
$pdo = db();
|
|
$stmt = $pdo->prepare("SELECT * FROM password_resets WHERE token = ?");
|
|
$stmt->execute([$token]);
|
|
$reset_request = $stmt->fetch();
|
|
|
|
if ($reset_request && $reset_request['expires'] >= date("U")) {
|
|
$email = $reset_request['email'];
|
|
$hashed_password = password_hash($password, PASSWORD_DEFAULT);
|
|
|
|
$stmt = $pdo->prepare("UPDATE users SET password = ? WHERE email = ?");
|
|
$stmt->execute([$hashed_password, $email]);
|
|
|
|
// Delete the used token
|
|
$stmt = $pdo->prepare("DELETE FROM password_resets WHERE email = ?");
|
|
$stmt->execute([$email]);
|
|
|
|
$_SESSION['message'] = 'Your password has been successfully reset. Please log in with your new password.';
|
|
$_SESSION['message_type'] = 'success';
|
|
header("Location: login.php");
|
|
exit;
|
|
} else {
|
|
$error = "Invalid or expired password reset token.";
|
|
}
|
|
} catch (PDOException $e) {
|
|
$error = "Database error: " . $e->getMessage();
|
|
error_log($error);
|
|
}
|
|
}
|
|
|
|
// If there was an error, redirect back to the reset form with the token
|
|
$_SESSION['error'] = $error;
|
|
header("Location: reset_password_form.php?token=" . urlencode($token));
|
|
exit;
|
|
} |