<?php if (!defined('access')) {die("Die gesuchte Ressource wurde entfernt oder umbenannt, oder sie steht vorübergehend nicht zur Verfügung.");} ?>
<p class="page_title">Passwort ändern</p>
<?php 
if (isset($_GET['reset'])) {
	if(isset($_POST['pwReset'])) {


		$strOutputErrorArray = array();
		$account = cleanSqlInput($_POST['pwResetAccount']);
		$email = cleanSqlInput($_POST['pwResetMail']);
		$gefra = cleanSqlInput($_POST['pwResetSecretQuestion']);
		$geant = cleanSqlInput($_POST['pwResetSecretAnswer']);
		$forgot_q = @odbc_exec($odbc_connect, 'USE [' . $_CONFIG['db_databases']['acc'] . '] SELECT [password], [OldPassword], [email], [secretquestion], [secretanswer] FROM [ACCOUNT_TBL] as a LEFT JOIN [ACCOUNT_TBL_DETAIL] as b ON b.[account] = a.[account] WHERE a.[account] = \''.$account.'\'');
		$forgot_a = @odbc_fetch_array($forgot_q);


        if(isSpamming($_POST['inputCheckTimestamp'], $_POST['inputCheckKey'], $_SESSION['inputCheckKey'])) {
            $strOutputErrorArray[] = $_LANG['error_spam'];
        }
		if(empty($account) or empty($email) or empty($gefra) or empty($geant)) {
			$strOutputErrorArray[] = $_LANG['error_fill_in_all_fields'];
		}
		if(odbc_num_rows($forgot_q) < 1) {
			$strOutputErrorArray[] = $_LANG['error_no_account_with_that_name'];
		}
		if(strtolower($email) != strtolower($forgot_a['email']) or $gefra != $forgot_a['secretquestion'] or md5($_CONFIG['security_secretAnswerSalt'].$geant) != $forgot_a['secretanswer']) {
			$strOutputErrorArray[] = $_LANG['error_combination_of_question_answer_mail'];
		}
		if ($forgot_a['OldPassword'] == $forgot_a['password']) {
			$strOutputErrorArray[] = $_LANG['error_already_registration_password'];
		}
		if (empty($forgot_a['OldPassword'])) {
			$strOutputErrorArray[] = $_LANG['error_unable_to_reset_pass'];
		}
		if(count($strOutputErrorArray) > 0) {
			$strOutputNotify = createMessage($strOutputErrorArray, 'fail');
		}
		else {
			$strOutputNotify = createMessage($_LANG['success_reset_password'], 'success');
			odbc_exec($odbc_connect, '
				UPDATE 	[' . $_CONFIG['db_databases']['acc'] . '].[dbo].[ACCOUNT_TBL]
				SET 	[id_no2] = [password],
						[id_no1] = \'' . $forgot_a['OldPassword'] . '\',
						[password] = \'' . $forgot_a['OldPassword'] . '\' 
				WHERE 	[account] = \'' . $account . '\'
				
				UPDATE 	[' . $_CONFIG['db_databases']['acc'] . '].dbo.[ACCOUNT_TBL_DETAIL]
				SET		[latestpassword] = \'' . $forgot_a['OldPassword'] . '\' 
				WHERE 	[account] = \'' . $account . '\'
			');
			mail_FPA($account, $email);
		}
	}
	else {
		$strOutputNotify = createMessage($_LANG['notify_reset_password'], 'hint');
	}
echo '' . $strOutputNotify . '
<hr />
<form method="post">
	<input type="hidden" name="inputCheckTimestamp" value="' . time() . '" />
	<input type="hidden" name="inputCheckKey" value="' . random_string() . '" />
	<input type="text" name="pwResetAccount" id="pwResetAccount" class="account" maxlength="16" placeholder="' . $_LANG['account'] . '" required="required"/><label class="labelRegistration" for="pwResetAccount">' . $_LANG['account'] . ' :</label><br class="clear"/>
	<input type="email" name="pwResetMail" id="pwResetMail" class="email" placeholder="' . $_LANG['mail'] . '" required="required"/><label class="labelRegistration" for="pwResetMail">' . $_LANG['mail'] . ' :</label><br class="clear"/>
	<select name="pwResetSecretQuestion" id="pwResetSecretQuestion" class="frage" required="required">
		<option value="" selected="selected"></option>';
		foreach($_CONFIG['allg_secretquestions'] as $id => $frage) {
echo '					<option value="'.$id.'">'.$frage.'</option>';
		}
echo '	
	</select><label class="labelRegistration" for="pwResetSecretQuestion">' . $_LANG['secret_question'] . ' :</label><br class="clear"/>
	<input type="text" name="pwResetSecretAnswer" id="pwResetSecretAnswer" class="antwort" placeholder="' . $_LANG['secret_answer'] . '" required="required"/><label class="labelRegistration" for="pwResetSecretAnswer">' . $_LANG['secret_answer'] . ' :</label>
	<hr class="clear"/>
	<input style="float:left; margin:10px 0px 10px 190px;" type="submit" name="pwReset" value="' . $_LANG['button_reset_password'] . '" class="button_235"/>
</form>';
}
elseif (isset($_GET['change'])) {
	if(isset($_POST['forgot'])){


		$strOutputErrorArray = array();
		$account = cleanSqlInput($_POST['pwChangeAccount']);
		$email = cleanSqlInput($_POST['pwChangeMail']);
		$gefra = cleanSqlInput($_POST['pwChangeSecretQuestion']);
		$geant = cleanSqlInput($_POST['pwChangeSecretAnswer']);
		$forgot_q = @odbc_exec($odbc_connect, 'SELECT [email], [secretquestion], [secretanswer] FROM [' . $_CONFIG['db_databases']['acc'] . '].[dbo].[ACCOUNT_TBL_DETAIL] WHERE [account] = \''.$account.'\'');
		$forgot_a = @odbc_fetch_array($forgot_q);


        if(isSpamming($_POST['inputCheckTimestamp'], $_POST['inputCheckKey'], $_SESSION['inputCheckKey'])) {
            $strOutputErrorArray[] = $_LANG['error_spam'];
        }
		if(empty($account) or empty($email) or empty($gefra) or empty($geant)) {
			$strOutputErrorArray[] = $_LANG['error_fill_in_all_fields'];
		}
		if(odbc_num_rows($forgot_q) < 1) {
			$strOutputErrorArray[] = $_LANG['error_no_account_with_that_name'];
		}
		if(strtolower($email) != strtolower($forgot_a['email']) or $gefra != $forgot_a['secretquestion'] or md5($_CONFIG['security_secretAnswerSalt'].$geant) != $forgot_a['secretanswer']) {
			$strOutputErrorArray[] = $_LANG['error_combination_of_question_answer_mail'];
		}
		if(count($strOutputErrorArray) > 0) {
			$outputNotify = createMessage($strOutputErrorArray, 'fail');
		}
		else {
			$key = random_string();
			$newpassword = random_string(8);
			$outputNotify = createMessage($_LANG['success_request_change_password'], 'success');
			odbc_exec($odbc_connect, '
				INSERT INTO [' . $_CONFIG['db_databases']['web'] . '].[dbo].[VALIDATE] (
					[key], 
					[type], 
					[account], 
					[timestamp],
					[fieldAlfa]
				) VALUES(
					\'' .  $key . '\',
					1,
					\'' . $account . '\',
					' . time() . ',
					\'' . md5($_CONFIG['allg_svr_salt'].$newpassword) . '\'
				)
			');
			mail_FPB($account, $email, $key, $newpassword);
		}
	}
	else {
		$outputNotify = createMessage($_LANG['notify_request_change_password'], 'hint');
	}
echo '' . $outputNotify . '
<hr />
<form method="post" action=""><br />
	<input type="hidden" name="inputCheckTimestamp" value="' . time() . '" />
	<input type="hidden" name="inputCheckKey" value="' . random_string() . '" />
	<input type="text" name="pwChangeAccount" id="pwChangeAccount" class="account" maxlength="16" placeholder="' . $_LANG['account'] . '" required="required"/><label class="labelRegistration" for="pwChangeAccount">' . $_LANG['account'] . ' :</label><br class="clear"/>
	<input type="email" name="pwChangeMail" id="pwChangeMail" class="email" placeholder="' . $_LANG['mail'] . '" required="required"/><label class="labelRegistration" for="pwChangeMail">' . $_LANG['mail'] . ' :</label><br class="clear"/>
	<select name="pwChangeSecretQuestion" id="pwChangeSecretQuestion" class="frage" required="required">
		<option value="" selected="selected"></option>';
		foreach($_CONFIG['allg_secretquestions'] as $id => $frage) {
echo '		<option value="'.$id.'">'.$frage.'</option>';
		}
echo '	
	</select><label class="labelRegistration" for="pwChangeSecretQuestion">' . $_LANG['secret_question'] . ' :</label><br class="clear"/>
	<input type="text" name="pwChangeSecretAnswer" id="pwChangeSecretAnswer" class="antwort" placeholder="' . $_LANG['secret_answer'] . '" required="required"/><label class="labelRegistration" for="pwChangeSecretAnswer">' . $_LANG['secret_answer'] . ' :</label>
	<hr class="clear"/>
	<input style="float:left; margin:10px 0px 10px 190px;" type="submit" name="forgot" value="' . $_LANG['button_request_new_password'] . '" class="button_235"/>
</form>';
}
else {
echo '
<p>
	' . $_LANG['forgotpw_introduction'] . '
</p>
<hr />
<h2>' . $_LANG['forgotpw_know_regpass_title']  . '</h2>
<a href="index.php?site=forgotpw&amp;reset" class="weiterleitung nound" style="float:right;">
	' . $_LANG['forgotpw_know_regpass_button']  . '
</a>
<p style="padding:0 20px 20px 0;">
	' . $_LANG['forgotpw_know_regpass_description']  . '
</p>
<hr class="clear"/>
<h2>' . $_LANG['forgotpw_changepass_title']  . '</h2>
<a href="index.php?site=forgotpw&amp;change" class="weiterleitung nound" style="float:right;">
	' . $_LANG['forgotpw_changepass_button']  . '
</a>
<p>
	' . $_LANG['forgotpw_changepass_description']  . '
</p>
<hr class="clear"/>
<p>
	' . $_LANG['forgotpw_notify'] . '
</p>';
}