documentation/zencart/password__forgotten_8php_source.html

00001 <?php
00009 // reset-token is good for only 24 hours:
00010 define('ADMIN_PWD_TOKEN_DURATION', (24 * 60 * 60) );
00011
00013 require ('includes/application_top.php');
00014 // demo active test
00015 if (zen_admin_demo())
00016 {
00017   $_GET['action'] = '';
00018   $messageStack->add_session(ERROR_ADMIN_DEMO, 'caution');
00019   zen_redirect(zen_href_link(FILENAME_DEFAULT));
00020 }
00021 if (isset($_POST['login']))
00022 {
00023   zen_redirect(zen_href_link(FILENAME_LOGIN, '', 'SSL'));
00024 }
00025 // Slam prevention:
00026 if ($_SESSION['login_attempt'] > 6) {
00027   header('HTTP/1.1 406 Not Acceptable');
00028   exit(0);
00029 }
00030 $error = false;
00031 $reset_token = '';
00032 if (isset($_POST['submit']))
00033 {
00034   if (! $_POST['admin_email'])
00035   {
00036     $error = true;
00037     $email_message = ERROR_WRONG_EMAIL_NULL;
00038   }
00039   $admin_email = zen_db_prepare_input($_POST['admin_email']);
00040   $sql = "select admin_id, admin_name, admin_email, admin_pass from " . TABLE_ADMIN . " where admin_email = :admEmail: LIMIT 1";
00041   $sql = $db->bindVars($sql, ':admEmail:', $admin_email, 'string');
00042   $result = $db->Execute($sql);
00043   if (! ($admin_email == $result->fields['admin_email']))
00044   {
00045     $error = true;
00046     $email_message = MESSAGE_PASSWORD_SENT;
00047   }
00048   // BEGIN SLAM PREVENTION
00049   if ($error == TRUE && $_POST['admin_email'] != '')
00050   {
00051     if (! isset($_SESSION['login_attempt'])) $_SESSION['login_attempt'] = 0;
00052     $_SESSION['login_attempt'] ++;
00053     sleep(3 * $_SESSION['login_attempt']);
00054   } // END SLAM PREVENTION
00055
00056   if ($error == false)
00057   {
00058     $new_password = zen_create_random_value((int)ADMIN_PASSWORD_MIN_LENGTH < 7 ? 7 : (int)ADMIN_PASSWORD_MIN_LENGTH);
00059     $resetToken = (time() + ADMIN_PWD_TOKEN_DURATION) . '}' . zen_encrypt_password($new_password);
00060     $sql = "update " . TABLE_ADMIN . " set reset_token = :token: where admin_id = :admID: ";
00061     $sql = $db->bindVars($sql, ':token:', $resetToken, 'string');
00062     $sql = $db->bindVars($sql, ':admID:', $result->fields['admin_id'], 'string');
00063     $db->Execute($sql);
00064     $html_msg['EMAIL_CUSTOMERS_NAME'] = $result->fields['admin_name'];
00065     $html_msg['EMAIL_MESSAGE_HTML'] = sprintf(TEXT_EMAIL_MESSAGE_PWD_RESET, $_SERVER['REMOTE_ADDR'], $new_password);
00066     zen_mail($result->fields['admin_name'], $result->fields['admin_email'], TEXT_EMAIL_SUBJECT_PWD_RESET, sprintf(TEXT_EMAIL_MESSAGE_PWD_RESET, $_SERVER['REMOTE_ADDR'], $new_password), STORE_NAME, EMAIL_FROM, $html_msg, 'password_forgotten_admin');
00067     $email_message = MESSAGE_PASSWORD_SENT;
00068   }
00069 }
00070 ?>
00071 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
00072 <html xmlns="http://www.w3.org/1999/xhtml" <?php echo HTML_PARAMS; ?>>
00073 <head>
00074 <meta http-equiv="Content-Type" content="text/html; charset=<?php echo CHARSET; ?>">
00075 <title><?php echo TITLE; ?></title>
00076 <link href="includes/stylesheet.css" rel="stylesheet" type="text/css" />
00077 </head>
00078 <body id="login" onload="document.getElementById('admin_email').focus()">
00079 <form id="loginForm" action="<?php echo zen_href_link(FILENAME_PASSWORD_FORGOTTEN, 'action=update', 'SSL'); ?>" method="post">
00080 <?php echo zen_draw_hidden_field('securityToken', $_SESSION['securityToken']); ?>
00081 <fieldset>
00082 <legend><?php echo HEADING_TITLE; ?></legend>
00083 <?php if ($resetToken == '') { ?>
00084 <label for="admin_email"><?php echo TEXT_ADMIN_EMAIL; ?><input type="text" id="admin_email" name="admin_email" value="<?php if ($error) echo zen_output_string($admin_email); ?>" autocomplete="off" /></label>
00085 <?php } ?>
00086 <p class="<?php echo ($error ? 'messageStackError' : 'messageStackSuccess'); ?>"><?php echo $email_message; ?></p>
00087 <?php if ($resetToken == '') { ?>
00088 <input type="submit" name="submit" class="button" value="<?php echo TEXT_BUTTON_REQUEST_RESET; ?>" />
00089 <input type="submit" name="login" class="button" value="<?php echo TEXT_BUTTON_CANCEL; ?>" />
00090 <?php } else { ?>
00091 <input type="submit" name="login" class="button" value="<?php echo TEXT_BUTTON_LOGIN; ?>" />
00092 <?php } ?>
00093 </fieldset>
00094 </form>
00095 </body>
00096 </html>
00097 <?php require('includes/application_bottom.php'); ?>