require('include/global.api'); require('include/person.class'); require('include/admin.api'); $email = ''; if (isset($_POST['action']) && $_POST['action']) { $action = $_POST['action']; $email = $_POST['email']; if (!IsEmail($email)) { $alert = "You have entered an invalid email address."; } else { switch ($action) { case "login": $password = $_POST['password']; if (user_login($email, $password)) { header("Location: index.php"); exit; } else { $alert = "Sorry, could not verify your login credentials."; } break; case "forgot": // verify that email address is on file $sql = "SELECT person_id FROM Persons WHERE email='$email'"; $result = $db->query($sql); if ($db->num_rows($result) != 1) { $alert = "Sorry, we do not have that email address in our records."; break; } list($person_id) = $db->fetch_row($result); // generate random pw $str = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; $end = rand(6,8); $pw = ""; for ($i = 0; $i < $end; $i++) { $index = rand(0, strlen($str) - 1); $pw .= $str[$index]; } // store new pw in database $md5pw = md5($pw); $sql = "UPDATE Persons SET password='$md5pw' WHERE person_id=$person_id"; $result = $db->query($sql); // mail new pw to user $msg = "Your password has been reset to: $pw\n\nhttp://www.kittenrescue.org/krdatabase/login.php"; mail($email, "Kitten Rescue Admin Password", $msg, "From: admin@kittenrescue.org"); $alert = "A new password has been sent to you. Please check your email."; break; } } } else { user_logout(); } ?>