huntingclubroster/classes/Authentication.php

<?php

/** Reset page controller; account storage and email are shared with the other flows. */
class Authentication extends Base {

    public function resetPassword() {
        $token = $_POST['token'] ?? $_GET['token'] ?? '';
        $params = ['TOKEN' => $token, 'MESSAGE' => '', 'ERROR' => '', 'COMPLETE' => 'FALSE'];
        if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
            $this->requireCsrf();
            if (($_POST['step'] ?? '') === 'reset') {
                try {
                    $auth = new AuthService();
                    if (!$auth->allowAttempt('reset-submit-ip', $_SERVER['REMOTE_ADDR'] ?? '', 20, 900)) {
                        throw new InvalidArgumentException('Too many attempts. Please try again later.');
                    }
                    if (!$auth->resetPassword($token, $_POST['user_password'] ?? '', $_POST['user_password_confirm'] ?? '')) {
                        throw new InvalidArgumentException('This reset link is invalid or expired. Request a new link.');
                    }
                    $this->logoutSession();
                    $_SESSION['password_reset_success'] = true;
                    header('Location: main.php?Xaction=resetpassword', true, 303);
                    exit;
                } catch (InvalidArgumentException $e) {
                    $params['ERROR'] = $e->getMessage();
                }
            } else {
                try {
                    (new AuthService())->requestReset(trim($_POST['user_email'] ?? ''));
                } catch (Throwable $e) {
                    error_log('Password reset request failed: ' . $e->getMessage());
                }
                $_SESSION['password_reset_requested'] = true;
                header('Location: main.php?Xaction=resetpassword', true, 303);
                exit;
            }
        }
        if (!empty($_SESSION['password_reset_success'])) {
            $params['MESSAGE'] = 'Your password has been changed. Please sign in with your new password.';
            $params['COMPLETE'] = 'TRUE';
            unset($_SESSION['password_reset_success']);
        } elseif (!empty($_SESSION['password_reset_requested'])) {
            $params['MESSAGE'] = 'If an active account matches, you will receive a password reset link. The link expires in 30 minutes.';
            unset($_SESSION['password_reset_requested']);
        }
        echo $this->applyXSL('<XML/>', $this->getXSL('resetPassword'), $params);
        exit;
    }
}