Jump to content

my reset password link is not working now.

jasonc

By jasonc
in PHP Coding Help

 Share

Recommended Posts

jasonc Advanced Member

jasonc

Posted
Posted

for some reason the password reset part of my site has stopped working and I am very sure that nothing has been altered in the related files since they was created.

 

a visitor clicks 'reset password' link on our site and is taken to the following file which initiates the reset password routine.  the visitor would get a link they need to click for the password to be altered and emailed to them.

 

this first file does update the database with a `changeofpasswordcode`and this is emailed as it should be.

 

<?PHP
  include('includes/connection.php');
  include('includes/functions.php');
  date_default_timezone_set('Europe/London');

  if(isset($_POST['reset']) && trim($_POST['reset']) == 'Reset Password') {

    $email    = mysql_real_escape_string($_POST['email']);

    $checkConfirmed = mysql_query("SELECT account_id FROM customers WHERE email='$email' AND verifyCode != '' LIMIT 1");
$checkEmail = mysql_query("SELECT account_id FROM customers WHERE email='$email' LIMIT 1");
$checkVerify = mysql_query("SELECT account_id FROM customers WHERE email='$email' AND verified='No' LIMIT 1");
    $checkBanned = mysql_query("SELECT account_id FROM customers WHERE email='$email' AND suspended='Yes' LIMIT 1");

    if(!$email) {
      $thisError = 'Please enter your e-mail address.';
    } else if(! mysql_num_rows($checkEmail)) {
      $thisError = 'That email address is not registered with us.';
    } else if(mysql_num_rows($checkConfirmed)) {
      $thisError = 'Your email address has not been verified, please check your email and following instructions within.';
    } else if(mysql_num_rows($checkVerify)) {
      $thisError = 'Your account has not been approved by an Admin.';
    } else if(mysql_num_rows($checkBanned)) {
      $thisError = 'Your account has been suspended by an Admin.';
    } else {
      //
    }
  }

  include('includes/header.php'); 
?>
<body>

  <div class="headerBar">
<? include('includes/navigation.php');?>
  </div>

  <? headerText(); ?>

  <div class="content">
    <div class="widthLimiter contentStyle">
      <div class="formWrapper" style="width: 500px;">
        <? if(isset($thisError)) { echo '<div class="errorDiv">',$thisError,'</div>'; } ?>
        <? if(isset($thisSuccess)) { echo '<div class="successDiv">',$thisSuccess,'</div>'; } ?>
        <span class="subHeader">Initiate Password Reset</span>
<? // password reset
$useremail  = isset($_POST['email']) != '' ? trim($_POST['email']) : '' ;
if ($useremail != "") {
// get email and password and email them
$sql = "SELECT * FROM `customers` WHERE (`email` = '" . mysql_real_escape_string($useremail) . "') LIMIT 1";
$res = mysql_query($sql);
$email = @mysql_result($res, 0 ,'email');
$customerName = @mysql_result($res, 0 ,'fullname');
	if(@mysql_num_rows($res) && @mysql_result($res, 0 ,'verified') == "Yes" && @mysql_result($res, 0 ,'suspended') == "No") {
				if(@mysql_result($res, 0 ,'changeofpasswordcode') != "") {
				$randomcode = @mysql_result($res, 0 ,'changeofpasswordcode');
				} else { $randomcode = CreatePasswordResetCode();
						}
	$_SESSION['customerName'] = $customerName;
	$_SESSION['customerEmail'] = $email;
	$_SESSION['randomcode'] = $randomcode;
	createEmailSend('passwordReset', 'Request to reset your password', 'customer');
	$format = 'Y-m-d H:i:s'; $date = date( $format );
	// set value in DB that email WAS sent
										$sql = "UPDATE `customers` SET `changeofpasswordcode` = '" . $randomcode . "', `newpasswordrequestedon` = '" . $date . "' WHERE `email` = '" . mysql_real_escape_string($email) . "' LIMIT 1";
										$res = mysql_query($sql);
	?><br /><br /><div>You will shortly receive an email which contains a reset password link,<br>please check your email and click this link to reset your password.<br /><br />A new password will then be emailed to you.</div><?
	} else { // not valid username entered.
			?><br /><br /><div>If you are having trouble accessing your account please let us know<br />via <a href="mailto:admin@tm2cars.co.uk">email</a> and we shall look into this 
    for you A.S.A.P.</div><?
			}
} else { ?><br /><br /><div style=""><form method="post" action="">Please enter your Email Address for your account in the<br>field below and click 'Reset' to initiate a password reset.<br /><br /><input name="email" type="text" size="25"><input type="submit" name="reset" value=" Reset Password"></form></div>
  <?
  } ?>
      </div>
    </div>
  </div>
<? include('includes/footer.php');?>
</body>
</html>

 

once they get their email they click the link which taken them to the next page which would perform the change of password and have it emailed to them.  the link has the correct `changeofpasswordcode` which is in the database but when the link is clicked the page says that the code is not valid as it is not in the DB.  and then it removes the `changeofpasswordcode`

 

it should only remove the `changeofpasswordcode` once the new password is setup and emailed, so that the link can not be used again.

 

what i do not understand is why the second file does this, can anyone see what i might be doing wrong ?  or what could be causing this  ?

 

<?PHP
  include('includes/connection.php');
  include('includes/functions.php');
  date_default_timezone_set('Europe/London');

  if(isset($_POST['reset']) && trim($_POST['reset']) == 'Reset') {

    $email    = mysql_real_escape_string($_POST['email']);

    $checkVerify = mysql_query("SELECT account_id FROM customers WHERE email='$email' AND verified='No' LIMIT 1");
    $checkBanned = mysql_query("SELECT account_id FROM customers WHERE email='$email' AND suspended='Yes' LIMIT 1");

    if(!$email) {
      $thisError = 'Please enter your e-mail address.';
    } else if(!$password) {
      $thisError = 'Please enter your password.';
    } else if(mysql_num_rows($checkVerify)) {
      $thisError = 'Your account has not been approved by an Admin.';
    } else if(mysql_num_rows($checkBanned)) {
      $thisError = 'Your account has been suspended by an Admin.';
    } else {
      $password = md5($password);

      $checkAccount = mysql_query("SELECT account_id FROM customers WHERE email='$email' AND password='$password' LIMIT 1");
      if(mysql_num_rows($checkAccount)) {
        $_SESSION['FM_user'] = $email;
        header('Location: members.php'); exit;
      } else {
        $thisError = 'Your e-mail address and/or password is incorrect.';
      }
    }
  }

  include('includes/header.php'); 
?>
<body>

  <div class="headerBar">
<? include('includes/navigation.php');?>
  </div>

  <? headerText(); ?>

  <div class="content">
    <div class="widthLimiter contentStyle">
      <div class="formWrapper">
        <? if(isset($thisError)) { echo '<div class="errorDiv">',$thisError,'</div>'; } ?>
        <? if(isset($thisSuccess)) { echo '<div class="successDiv">',$thisSuccess,'</div>'; } ?>
        <span class="subHeader">Initiate Password Reset</span>
<?
//				include("sendmail2010.php");
$securitycode = stripstring($_GET[pwr]);
if ($securitycode != "") { $sql = "SELECT * FROM `customers` WHERE `changeofpasswordcode` = '".mysql_real_escape_string($securitycode)."' LIMIT 1";
$res = mysql_query($sql);
	if (@mysql_num_rows($res) && $securitycode != "") {
	$customerName = @mysql_result($res, 0 ,'fullname');
	$email = @mysql_result($res, 0 ,'email');
	$yourpasswordtologin = CreateNewPassword();
	$format = 'Y-m-d H:i:s'; $date = date( $format );
	$sql = "UPDATE `customers` SET `password` = '" . md5(mysql_real_escape_string($yourpasswordtologin)) . "', `changeofpasswordcode` = '', `newpasswordrequestedon` = '' WHERE `changeofpasswordcode` = '" . mysql_real_escape_string($securitycode) . "' LIMIT 1";
	$res = mysql_query($sql);
	$_SESSION['customerName'] = $customerName;
	$_SESSION['customerEmail'] = $email;
	$_SESSION['generatePass'] = $yourpasswordtologin;
	createEmailSend('newPassword', 'Your new password', 'customer');
	?><div style="margin: 30px;">Thank you for completing your password reset process.<br><br>An email with a randomly generated password has been sent to your email address, please check your email account for this email as you will need this password to access your <?=$_SESSION['siteName'];?> account.<br><br><strong><em>Please check your 'spam folder' in case our emails are showing up there.</em></strong><br><br>You may now <a href="<?=$_SESSION['webAddress'];?>">sign in</a> to your account.</div><?
	} else { ?><div style="margin: 20px;">Sorry the link you clicked is and old password reset link or is not valid, please delete the email.<br><br>If you were trying to reset your password, please click the<br>'Member Login' link on our site and then click the 'Reset Password' link.</div><?
	}
} ?>
      </div>
    </div>
  </div>
<? include('includes/footer.php');?>
</body>
</html>

 

Link to comment
Share on other sites
This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to topic listing
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.