generated from jric11/baseProject
50 lines
2.4 KiB
PHP
50 lines
2.4 KiB
PHP
<?php
|
|
|
|
/** Reset page controller; account storage and email are shared with the other flows. */
|
|
class Authentication extends Base {
|
|
|
|
public function resetPassword() {
|
|
$token = $_POST['token'] ?? $_GET['token'] ?? '';
|
|
$params = ['TOKEN' => $token, 'MESSAGE' => '', 'ERROR' => '', 'COMPLETE' => 'FALSE'];
|
|
if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
|
|
$this->requireCsrf();
|
|
if (($_POST['step'] ?? '') === 'reset') {
|
|
try {
|
|
$auth = new AuthService();
|
|
if (!$auth->allowAttempt('reset-submit-ip', $_SERVER['REMOTE_ADDR'] ?? '', 20, 900)) {
|
|
throw new InvalidArgumentException('Too many attempts. Please try again later.');
|
|
}
|
|
if (!$auth->resetPassword($token, $_POST['user_password'] ?? '', $_POST['user_password_confirm'] ?? '')) {
|
|
throw new InvalidArgumentException('This reset link is invalid or expired. Request a new link.');
|
|
}
|
|
$this->logoutSession();
|
|
$_SESSION['password_reset_success'] = true;
|
|
header('Location: main.php?Xaction=resetpassword', true, 303);
|
|
exit;
|
|
} catch (InvalidArgumentException $e) {
|
|
$params['ERROR'] = $e->getMessage();
|
|
}
|
|
} else {
|
|
try {
|
|
(new AuthService())->requestReset(trim($_POST['user_email'] ?? ''));
|
|
} catch (Throwable $e) {
|
|
error_log('Password reset request failed: ' . $e->getMessage());
|
|
}
|
|
$_SESSION['password_reset_requested'] = true;
|
|
header('Location: main.php?Xaction=resetpassword', true, 303);
|
|
exit;
|
|
}
|
|
}
|
|
if (!empty($_SESSION['password_reset_success'])) {
|
|
$params['MESSAGE'] = 'Your password has been changed. Please sign in with your new password.';
|
|
$params['COMPLETE'] = 'TRUE';
|
|
unset($_SESSION['password_reset_success']);
|
|
} elseif (!empty($_SESSION['password_reset_requested'])) {
|
|
$params['MESSAGE'] = 'If an active account matches, you will receive a password reset link. The link expires in 30 minutes.';
|
|
unset($_SESSION['password_reset_requested']);
|
|
}
|
|
echo $this->applyXSL('<XML/>', $this->getXSL('resetPassword'), $params);
|
|
exit;
|
|
}
|
|
}
|