<?php // pineapple_reset_password.php  
	// force https, for web server when live (sikp if development server.
	if( substr_compare($_SERVER['HTTP_HOST'], 'localhost', 0, 9) != 0 )
	{
		if($_SERVER["HTTPS"] != "on"){
			header("Location: https://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]);
			exit();
		}
	}

	require_once "./pineapple.php";		// this file has the menu, header and css code for the site
	require_once "./mysql/helper.php";
	
	// This line renders the menu and header for the site
    pineapple_html_begin("Pineapple PNP", "Pineapple Forgot Password");
	
	$id = $_GET["id"];

	if (!isset($_POST['submitok'])):
    // Display the user signup form
	
?>

<h3>Reset Password</h3>
<form method="post" action="<?=$_SERVER['PHP_SELF']."?tag=submit&id=".$id?>">
<table border="0" cellpadding="0" cellspacing="5">
	<tr>
        <td align="right">
            <p>Password</p>
        </td>
        <td>
            <input name="pass1" type="password" maxlength="100" size="25" />
        </td>
    </tr>
	<tr>
        <td align="right">
            <p>Re-enter Password</p>
        </td>
        <td>
            <input name="pass2" type="password" maxlength="100" size="25" />
        </td>
    </tr>
    <tr>
        <td align="right" colspan="2">
            <hr noshade="noshade" />
            <input type="reset" value="Reset Form" />
            <input type="submit" name="submitok" value="OK"/>
        </td>
    </tr>
</table>
</form>

    <?php
else:
	// || = or
	if ($_POST['pass1']=='' || $_POST['pass2']=='') {
		?>
		<script>
		alert("One or more required fields were left blank. Please fill them in and try again.");
		history.back();
        </script>
		<?php
		exit;
    }
	
	// Verify passwords match
	if ($_POST['pass1'] <> $_POST['pass2'])
	{
		?>
		<script>
		alert("The passwords do not match.");
		history.back();
        </script>
		<?php
		exit;
	}
	
	$db = db_connect("pontech_pineapplepnp");
	$sql = "SELECT email FROM password_recover WHERE resetstr = '$id'";
	// execute sql statement
	$result = $db->query($sql);
    //$result = mysql_query($sql);
	if (!$result)
	{
		echo 'Could not run query: ' . mysql_error();
		exit;
	}
	//$row = mysql_fetch_row($result);
	$uemail = $result->fetchColumn(0);
	
	//update password
	$sql = "UPDATE user SET password = PASSWORD('$_POST[pass1]') WHERE email = '$uemail'";
	// execute sql statement
	$result = $db->query($sql);
	
	$sql = "DELETE FROM password_recover WHERE email = '$uemail'";
	// execute sql statement
	$result = $db->query($sql);
?>
    <p><strong>Your password has been reset</strong></p>
	<p>Please click <a href="pineapple_login.php">here</a> to log in.</p>
<?php
endif;
	// This is the end of the HTML body, scripting starts after this.
	pineapple_script_end();
	// This is the end of the HTML file, scripting starts after this.
	pineapple_html_end();
?>