<?php
ini_set("display_errors","1");
ini_set("display_startup_errors","1");
set_magic_quotes_runtime(0);

include("include/dbcommon.php");

if(!@$_SESSION["UserID"] || @$_SESSION["UserID"]=="<Guest>")
{ 
	$_SESSION["MyURL"]=$_SERVER["SCRIPT_NAME"]."?".$_SERVER["QUERY_STRING"];
	header("Location: login.php?message=expired"); 
	return;
}

$message="";
$go=1;

include('include/xtempl.php');
$xt = new Xtempl();

//	Before Process event
if(function_exists("BeforeProcessChangePwd"))
	BeforeProcessChangePwd($conn);

if (@$_POST["btnSubmit"] == "Submit")
{	
	$rstemp=db_query("select * from ##@BUILDER.strLoginTable ts## where 1=0",$conn);
	$go = postvalue("go")+1;
	$xt->assign("backlink_attrs","href=\"javascript:history.go(-".$go.")\"");
	$opass = postvalue("opass");
	$newpass = postvalue("newpass");
	$newpassraw=$newpass;
##if @BUILDER.bEncryptPasswords##
	$opass = md5($opass);
	$newpass = md5($newpass);
##endif##
	
	$value = @$_SESSION["UserID"];
	if(FieldNeedQuotes($rstemp,$cUserNameField))
		$value="'".db_addslashes($value)."'";
	else
		$value=(0+$value);
	$passvalue = $newpass;
	if(FieldNeedQuotes($rstemp,$cPasswordField))
		$passvalue="'".db_addslashes($passvalue)."'";
	else
		$passvalue=(0+$passvalue);


    	$sWhere = " where ".AddFieldWrappers($cUserNameField)."=".$value;
		$strSQL = "select * from ".AddTableWrappers($cLoginTable).$sWhere;
		$rstemp=db_query($strSQL,$conn);

		if($row=db_fetch_array($rstemp))
		{
			if($opass == $row[$cPasswordField])
			{
##if @BUILDER.bStrongPassword##
	if(!checkpassword($newpassraw))
	{
##if @BUILDER.nPwdLen##
		$fmt=##message SEC_PWD_LEN##;
		$fmt=str_replace("%%","##@BUILDER.nPwdLen##",$fmt);
		$message.="<br>".$fmt;
##endif##
##if @BUILDER.nPwdUnique##
		$fmt=##message SEC_PWD_UNIQUE##;
		$fmt=str_replace("%%","##@BUILDER.nPwdUnique##",$fmt);
		$message.="<br>".$fmt;
##endif##
##if @BUILDER.nPwdDigits##
		$fmt=##message SEC_PWD_DIGIT##;
		$fmt=str_replace("%%","##@BUILDER.nPwdDigits##",$fmt);
		$message.="<br>".$fmt;
##endif##
##if @BUILDER.bPwdUpperLower##
		$fmt=##message SEC_PWD_CASE##;
		$message.="<br>".$fmt;
##endif##
	}
	else
	{
##endif##
				$retval=true;
				if(function_exists("BeforeChangePassword"))
					$retval=BeforeChangePassword($_POST["opass"],$_POST["newpass"]);
				if($retval)
				{
					$strSQL= "update ".AddTableWrappers($cLoginTable)." set ".AddFieldWrappers($cPasswordField)."=".$passvalue.$sWhere;
					db_exec($strSQL,$conn);
					if(function_exists("AfterChangePassword"))
						AfterChangePassword($_POST["opass"],$_POST["newpass"]);
					$xt->assign("body",true);
					$xt->display("changepwd_success.htm");
					return;
				}
##if @BUILDER.bStrongPassword##
	}
##endif##
			}
			else
				$message = ##message INVALID_PASSWORD##;
	}
}
else $xt->assign("backlink_attrs","href=\"javascript:history.go(-1)\"");
	
if($message)
{
	$xt->assign("message",$message);
	$xt->assign("message_block",true);
}

$body=array();
$body["begin"]="<script language=\"JavaScript\">
function validate()
{

	
	if (document.forms.form1.cpass.value!=document.forms.form1.newpass.value)
	{	
		alert('".jsreplace(##message DONT_MATCH##).
		"');
		document.forms.form1.newpass.value='';
		document.forms.form1.cpass.value='';
		document.forms.form1.newpass.focus();
		return false;
	}
	return true;
}
</script>
 <form method=\"POST\" action=\"changepwd.##@ext##\" id=form1 name=form1 onsubmit=\"return validate();\">
<input type=hidden name=btnSubmit value=\"Submit\">
<input type=hidden name=go value=\"".$go."\">";
$body["end"]="</form>";
$xt->assignbyref("body",$body);

$templatefile="changepwd.htm";
if(function_exists("BeforeShowChangePwd"))
	BeforeShowChangePwd($xt,$templatefile);

$xt->display($templatefile);
?>