106 lines
4.2 KiB
PHP
106 lines
4.2 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
require_once __DIR__ . '/db/config.php';
|
|
require_once __DIR__ . '/includes/auth_helper.php';
|
|
|
|
$token = $_GET['token'] ?? '';
|
|
$error = '';
|
|
$success = false;
|
|
|
|
if (!$token) {
|
|
header('Location: login.php');
|
|
exit;
|
|
}
|
|
|
|
$stmt = db()->prepare("SELECT * FROM password_resets WHERE token = ? AND expires_at > NOW() LIMIT 1");
|
|
$stmt->execute([$token]);
|
|
$reset = $stmt->fetch();
|
|
|
|
if (!$reset) {
|
|
$error = "This password reset link is invalid or has expired.";
|
|
}
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $reset) {
|
|
$password = $_POST['password'] ?? '';
|
|
$confirm = $_POST['confirm_password'] ?? '';
|
|
|
|
if (strlen($password) < 8) {
|
|
$error = "Password must be at least 8 characters long.";
|
|
} elseif ($password !== $confirm) {
|
|
$error = "Passwords do not match.";
|
|
} else {
|
|
$hashed = password_hash($password, PASSWORD_DEFAULT);
|
|
|
|
db()->beginTransaction();
|
|
try {
|
|
$stmt = db()->prepare("UPDATE users SET password = ?, require_password_change = 0 WHERE email = ?");
|
|
$stmt->execute([$hashed, $reset['email']]);
|
|
|
|
$stmt = db()->prepare("DELETE FROM password_resets WHERE email = ?");
|
|
$stmt->execute([$reset['email']]);
|
|
|
|
// Log the password change activity
|
|
$ip = Auth::getIpAddress();
|
|
$stmt = db()->prepare("INSERT INTO activity_log (tenant_id, action, details) VALUES (?, ?, ?)");
|
|
$stmt->execute([0, 'Password Changed', "Email: {$reset['email']}, IP: $ip"]);
|
|
|
|
db()->commit();
|
|
$success = true;
|
|
} catch (\Exception $e) {
|
|
db()->rollBack();
|
|
$error = "An error occurred while resetting your password.";
|
|
}
|
|
}
|
|
}
|
|
|
|
?>
|
|
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>Reset Password - SR&ED Manager</title>
|
|
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
|
|
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
|
|
<style>
|
|
body { font-family: 'Inter', sans-serif; background-color: #f8fafc; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; }
|
|
.login-card { width: 100%; max-width: 400px; border: none; border-radius: 12px; box-shadow: 0 10px 25px rgba(0,0,0,0.05); }
|
|
.btn-primary { background-color: #3b82f6; border: none; padding: 10px; font-weight: 600; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="card login-card p-4">
|
|
<div class="text-center mb-4">
|
|
<h3 class="fw-bold text-primary">NEW PASSWORD</h3>
|
|
<p class="text-muted small">Please set your new secure password</p>
|
|
</div>
|
|
|
|
<?php if ($success): ?>
|
|
<div class="alert alert-success small">
|
|
Your password has been successfully reset.
|
|
</div>
|
|
<a href="login.php" class="btn btn-primary w-100">Login Now</a>
|
|
<?php elseif ($error && !$reset): ?>
|
|
<div class="alert alert-danger small"><?= htmlspecialchars($error) ?></div>
|
|
<a href="forgot_password.php" class="btn btn-outline-secondary w-100">Request New Link</a>
|
|
<?php else: ?>
|
|
<?php if ($error): ?>
|
|
<div class="alert alert-danger small"><?= htmlspecialchars($error) ?></div>
|
|
<?php endif; ?>
|
|
<form method="POST">
|
|
<div class="mb-3">
|
|
<label class="form-label small fw-bold">New Password</label>
|
|
<input type="password" name="password" class="form-control" placeholder="••••••••" required autofocus>
|
|
<div class="form-text extra-small">Minimum 8 characters.</div>
|
|
</div>
|
|
<div class="mb-3">
|
|
<label class="form-label small fw-bold">Confirm New Password</label>
|
|
<input type="password" name="confirm_password" class="form-control" placeholder="••••••••" required>
|
|
</div>
|
|
<button type="submit" class="btn btn-primary w-100 mb-3">Reset Password</button>
|
|
</form>
|
|
<?php endif; ?>
|
|
</div>
|
|
</body>
|
|
</html>
|