diff --git a/forgotpass.php b/forgotpass.php index b404f9a..cb85e48 100644 --- a/forgotpass.php +++ b/forgotpass.php @@ -7,6 +7,11 @@ Enter your email address"; } else { $statement = $pdo->prepare("SELECT * FROM users WHERE email = :email"); @@ -47,8 +52,8 @@ if(isset($_GET['send']) ) { $mailrcpt = $user['email']; $mailsubject = "New password for your User"; - $from = "From: Password Reset Service "; //place a real address if we use this in production - $url_passwordcode = 'https://'.$_SERVER['HTTP_HOST'].'/resetpass.php?userid='.$user['id'].'&code='.$passwordcode; //this shouldnt be my domain in prod.. + $from = "From: Password Reset Service "; + $url_passwordcode = 'https://'.$_SERVER['HTTP_HOST'].'/resetpass.php?userid='.$user['id'].'&code='.$passwordcode; $text = 'Hallo '.$user['username'].', please use the following URL to change your password in the next 24h: '.$url_passwordcode.' diff --git a/resetpass.php b/resetpass.php index b2eda09..04342d9 100644 --- a/resetpass.php +++ b/resetpass.php @@ -9,6 +9,12 @@ No code delivered. nothing to do here.'); } @@ -43,7 +49,7 @@ if(sha1($code) != $user['passwordcode']) { if(isset($_GET['send'])) { $password = $_POST['password']; - $password_confirm = $_POST['password_confirm']; + $password_confirm = $_POST['password_confirm']; //we need to do the whole "is your password secure enough" thingy again here: //regexes for passvalidation: $REuppercase = preg_match('@[A-Z]@', $password); $RElowercase = preg_match('@[a-z]@', $password); @@ -60,7 +66,7 @@ if(isset($_GET['send'])) { $passwordhash = password_hash($password, PASSWORD_DEFAULT); $statement = $pdo->prepare("UPDATE users SET password = :passwordhash, passwordcode = NULL, passwordcode_time = NULL WHERE id = :userid"); $result = $statement->execute(array('passwordhash' => $passwordhash, 'userid'=> $userid )); - + //done. the rest is the same if($result) { die('Changed password. Going to login now.'); }