diff --git a/app/emails/email_test.php b/app/emails/email_test.php
index 4b4756ff99..534ef9c0af 100644
--- a/app/emails/email_test.php
+++ b/app/emails/email_test.php
@@ -41,7 +41,7 @@ if (valid_email($_POST['to'])) {
$eml_body .= "If you received this message, your current SMTP settings are valid.
\n";
ob_start();
- $sent = !send_email($recipient, 'Test Message', $eml_body, $eml_error) ? false : true;
+ $sent = !send_email($recipient, 'Test Message', $eml_body, $eml_error, null, null, 3, 3) ? false : true;
$response = ob_get_clean();
echo $response;
diff --git a/resources/functions.php b/resources/functions.php
index c9e1c81813..d23b6cd79a 100644
--- a/resources/functions.php
+++ b/resources/functions.php
@@ -1391,7 +1391,7 @@ function number_pad($number,$n) {
//function to send email
if (!function_exists('send_email')) {
- function send_email($eml_recipients, $eml_subject, $eml_body, &$eml_error = '', $eml_from_address = '', $eml_from_name = '', $eml_priority = 3) {
+ function send_email($eml_recipients, $eml_subject, $eml_body, &$eml_error = '', $eml_from_address = '', $eml_from_name = '', $eml_priority = 3, $eml_debug_level = 0) {
/*
RECIPIENTS NOTE:
@@ -1484,7 +1484,9 @@ function number_pad($number,$n) {
$mail -> Subject = $eml_subject;
$mail -> MsgHTML($eml_body);
$mail -> Priority = $eml_priority;
- $mail -> SMTPDebug = 3;
+ if (is_numeric($eml_debug_level) && $eml_debug_level > 0) {
+ $mail -> SMTPDebug = $eml_debug_level;
+ }
$address_found = false;
diff --git a/resources/login.php b/resources/login.php
index 281242f502..83666d8c9e 100644
--- a/resources/login.php
+++ b/resources/login.php
@@ -28,8 +28,124 @@
$language = new text;
$text = $language->get(null,'core/user_settings');
+//get action, if any
+ if (isset($_REQUEST['action'])) {
+ $action = check_str($_REQUEST['action']);
+ }
+
+//retrieve parse reset key
+ if ($action == 'define') {
+ $key = $_GET['key'];
+ $key_part = explode('|', decrypt($_SESSION['login']['password_reset_key']['text'], $key));
+ $username = $key_part[0];
+ $domain_uuid = $key_part[1];
+ $password_submitted = $key_part[2];
+ //get current salt, see if same as submitted salt
+ $sql = "select password from v_users where domain_uuid = :domain_uuid and username = :username ";
+ $prep_statement = $db->prepare(check_sql($sql));
+ $prep_statement->bindParam(':domain_uuid', $domain_uuid);
+ $prep_statement->bindParam(':username', $username);
+ $prep_statement->execute();
+ $result = $prep_statement->fetch(PDO::FETCH_NAMED);
+ $password_current = $result['password'];
+ unset($prep_statement, $result);
+
+ //set flag
+ $password_reset = ($username != '' && $domain_uuid == $_SESSION['domain_uuid'] && $password_submitted == $password_current) ? true : false;
+ }
+
+//send password reset link
+ if ($action == 'request') {
+ if (valid_email($_REQUEST['email'])) {
+ $email = check_str($_REQUEST['email']);
+ //see if email exists
+ $sql = "select ";
+ $sql .= "u.username, ";
+ $sql .= "u.password ";
+ $sql .= "from ";
+ $sql .= "v_users as u, ";
+ $sql .= "v_contact_emails as e ";
+ $sql .= "where ";
+ $sql .= "e.domain_uuid = u.domain_uuid ";
+ $sql .= "and e.contact_uuid = u.contact_uuid ";
+ $sql .= "and e.email_address = :email ";
+ $sql .= "and e.domain_uuid = '".$_SESSION['domain_uuid']."' ";
+ $prep_statement = $db->prepare(check_sql($sql));
+ $prep_statement->bindParam(':email', $email);
+ $prep_statement->execute();
+ $result = $prep_statement->fetch(PDO::FETCH_NAMED);
+ unset($prep_statement);
+
+ if ($result['username'] != '') {
+ //generate reset link
+ $key = encrypt($_SESSION['login']['password_reset_key']['text'], $result['username'].'|'.$_SESSION['domain_uuid'].'|'.$result['password']);
+ $reset_link = "https://".$_SESSION['domain_name'].PROJECT_PATH."/login.php?action=define&key=".urlencode($key);
+ $eml_body = "".$reset_link."";
+ //send reset link
+ if (send_email($email, $text['label-reset_link'], $eml_body)) {
+ //email sent
+ message::add($text['message-reset_link_sent'], 'positive', 2500);
+ }
+ else {
+ //email failed
+ message::add($eml_error, 'negative', 5000);
+ }
+ }
+ else {
+ //not found
+ message::add($text['message-invalid_email'], 'negative', 5000);
+ }
+ }
+ else {
+ //not found
+ message::add($text['message-invalid_email'], 'negative', 5000);
+ }
+ }
+
+//reset password
+ if ($action == 'reset') {
+ $authorized_username = check_str($_REQUEST['au']);
+ $username = check_str($_REQUEST['username']);
+ $password_new = check_str($_REQUEST['password_new']);
+ $password_repeat = check_str($_REQUEST['password_repeat']);
+
+ if ($username != '' &&
+ $authorized_username == md5($_SESSION['login']['password_reset_key']['text'].$username) &&
+ $password_new != '' &&
+ $password_repeat != '' &&
+ $password_new == $password_repeat
+ ) {
+
+ if (!check_password_strength($password_new, $text)) {
+ $password_reset = true;
+ }
+ else {
+ $salt = generate_password('20', '4');
+ $sql = "update v_users set ";
+ $sql .= "password = :password, ";
+ $sql .= "salt = :salt ";
+ $sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
+ $sql .= "and username = :username ";
+ $prep_statement = $db->prepare(check_sql($sql));
+ $prep_statement->bindParam(':password', md5($salt.$password_new));
+ $prep_statement->bindParam(':salt', $salt);
+ $prep_statement->bindParam(':username', $username);
+ $prep_statement->execute();
+ unset($prep_statement);
+
+ message::add($text['message-password_reset'], 'positive', 2500);
+ $password_reset = false;
+ }
+ }
+ else {
+ //not found
+ message::add($text['message-invalid_username_mismatch_passwords'], 'negative', 5000);
+ $password_reset = true;
+ }
+ }
+
//get the http values and set as variables
- if (isset($_GET["msg"])) { $msg = check_str($_GET["msg"]); } else { $msg = null; }
+ $msg = isset($_GET["msg"]) ? check_str($_GET["msg"]) : null;
//set variable if not set
if (!isset($_SESSION['login']['domain_name_visible']['boolean'])) { $_SESSION['login']['domain_name_visible']['boolean'] = null; }
@@ -85,31 +201,166 @@
}
//show the content
- echo "\n";
- echo "";
- echo "";
- echo "
";
+ echo "
\n";
+
+ if (!$password_reset) {
+
+ echo "";
+
+ echo "";
+
+ }
+ else {
+
+ echo "\n";
+
+ echo "\n";
+ echo "";
+
+ echo "\n";
+ echo "";
+
+ }
//add the footer
$default_login = true;