$token, 'MESSAGE' => '', 'ERROR' => '', 'COMPLETE' => 'FALSE']; if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') { $this->requireCsrf(); if (($_POST['step'] ?? '') === 'reset') { try { $auth = new AuthService(); if (!$auth->allowAttempt('reset-submit-ip', $_SERVER['REMOTE_ADDR'] ?? '', 20, 900)) { throw new InvalidArgumentException('Too many attempts. Please try again later.'); } if (!$auth->resetPassword($token, $_POST['user_password'] ?? '', $_POST['user_password_confirm'] ?? '')) { throw new InvalidArgumentException('This reset link is invalid or expired. Request a new link.'); } $this->logoutSession(); $_SESSION['password_reset_success'] = true; header('Location: main.php?Xaction=resetpassword', true, 303); exit; } catch (InvalidArgumentException $e) { $params['ERROR'] = $e->getMessage(); } } else { try { (new AuthService())->requestReset(trim($_POST['user_email'] ?? '')); } catch (Throwable $e) { error_log('Password reset request failed: ' . $e->getMessage()); } $_SESSION['password_reset_requested'] = true; header('Location: main.php?Xaction=resetpassword', true, 303); exit; } } if (!empty($_SESSION['password_reset_success'])) { $params['MESSAGE'] = 'Your password has been changed. Please sign in with your new password.'; $params['COMPLETE'] = 'TRUE'; unset($_SESSION['password_reset_success']); } elseif (!empty($_SESSION['password_reset_requested'])) { $params['MESSAGE'] = 'If an active account matches, you will receive a password reset link. The link expires in 30 minutes.'; unset($_SESSION['password_reset_requested']); } echo $this->applyXSL('', $this->getXSL('resetPassword'), $params); exit; } }