recover.php

<?php
require_once realpath(dirname(__FILE__) . "/class/init.php");
require realpath(dirname(__FILE__) . "/control/session/unsaved.php");
//will accept email address
if(isset($_POST['fp-but']) && isset($_GET['rcvr_n']) && $_GET['rcvr_n']==$_SESSION['email_sub_nonce']) {
    unset($_SESSION['email_sub_nonce']);
    try {
        $_email = Util::sanitize($_POST['fp-email'], WRITALE_INPT_EMAIL);
        $_res = $_mysql->query("SELECT userid,firstname FROM user WHERE email = '$_email'");
        if ($_res->num_rows != 1) {
            $_notfound = 1;
        } else {
            $row = $_res->fetch_assoc();
            $rec_nonce = Util::getNonce(62, $row['userid'], 'R');
            $fn = $row['firstname'];
            $link = $_protocol . $_SERVER['HTTP_HOST'] . '/recover?d=' . $row['userid'] . '&r_n=' . $rec_nonce;
            
            $param = array(
                'greeting' => 'Hi ' . $row['firstname'] . '!',
                'body' => '<h3 style="line-height: 160%;font-weight:bold;">'
                        . ' It\'s sad that you lost access to your Writale account and are having this trouble.</h3>'
                            . ' While we can\'t give back your old password, '
                            . ' you can safely, create a new one from here. Click on the button below.<br /><br />'
                        . '<table>'
                            . '<tr>'
                                . '<td id="mail-button" style="
                                        font-family:arial,helvetica,sans-serif;
                                        font-weight:bold;
                                        width : 190px;
                                        height: 30px;
                                        background-image : -webkit-gradient(linear, left top, left bottom, color-stop(0, #45a5ef), color-stop(1, #1178c8));
                                        background-image : -o-linear-gradient(top, #45a5ef 0%, #1178c8 100%);
                                        background-image : -ms-linear-gradient(top, #45a5ef 0%, #1178c8 100%);
                                        background-image : -moz-linear-gradient(top, #45a5ef 0%, #1178c8 100%);
                                        background-image : -webkit-linear-gradient(top, #45a5ef 0%, #1178c8 100%);
                                        background-image : linear-gradient(to bottom, #45a5ef 0%, #1178c8 100%);
                                        color :white;
                                        text-align : center;
                                        background-color : #1178c8;
                                        border : solid 1px #5173e0;
                                        border-radius : 3px;
                                        -moz-border-radius : 3px;
                                        -o-border-radius : 3px;
                                        -ms-border-radius : 3px;
                                        -webkit-border-radius : 3px;
                                        display : block;
                                        vertical-align : middle;">'
                                . '<a id="mail-link" style="'
                                . 'text-decoration : none;
                                        line-height : 30px;
                                        width : 100%;
                                        color : white;
                                        display : inline-block;
                                        vertical-align : middle;" '
                                . 'href="' . $link . '">'
                        . 'Recover my account</a></td></tr></table>',
                'footer' => 'Writale &copy; 2014 <strong>&middot;</strong>'
                            . ' This email was sent by a robot. Please do not reply.',
                'type' => 1
            );
            
            $mail = new HtmlMail($param, $_email, 'Recover Your Writale Account', 'Writale <service@writale.com>');
            $mail->prepare ();
            $mail->send ();
            $_sent = 1;
        }
    } catch (Exception $ex) {
        Util::__errorSummary(WRITALE_ERR_GEN, $ex);
    }
}

//will update password
else if(isset($_POST['fp-pwd-sbmt']) && isset($_GET['c_n']) 
        && isset($_SESSION['change_nonce']) && $_GET['c_n']==$_SESSION['change_nonce']) {
    unset($_SESSION['change_nonce']);
    $_id = $_POST['rcvr_i'];
    try {
        $passwd = Util::sanitize($_POST['fp-pwd'], WRITALE_INPT_PASSWD);
        if(strlen($passwd) < 6) {
            $_error['sp'] = 1;
        }
        else {
            $_mysql->autocommit(false);
            $acc = new AccountUtility($_id, array('newpasswd' => $passwd));
            $acc->updatePassword();
            $_mysql->commit();
            $_done = 1;
        }
        
    } catch (Exception $ex) {
        $_error['gen'] = 1;
        $_mysql->rollback();
        if($ex->getCode()==1062) {
            $_error['dup'] = 1;
        }
        Util::__errorSummary(WRITALE_ERR_GEN, $ex);
    }
}

//will show the change password page
if(isset($_GET['d']) && isset($_GET['r_n'])) {
    try {
        $_id = Util::sanitize($_GET['d'], WRITALE_INPT_GEN);
        $nonce = Util::sanitize($_GET['r_n'], WRITALE_INPT_GEN);
        $res = $_mysql->query("SELECT * FROM nonce WHERE (nonce_string = '$nonce' AND userid = '$_id') "
                . "AND purpose = 'R' ");
        if($res->num_rows == 1) {
            $row = $res->fetch_assoc();
            if($row['expired'] == 1)
                $_expired = 1;
            else { 
                $_recover = 1;
                $_mysql->query("UPDATE nonce SET expired = 1 WHERE nonce_string = '$nonce' ");
            }
        }
    } catch (Exception $ex) {
        Util::__errorSummary(WRITALE_ERR_GEN, $ex);
    }
}
?>
<!DOCTYPE html>
<html class="password-recover-all" lang="en">
	<head>
		<title> Recover Password </title>
		<meta http-equiv="content-type" content="text/html;charset=UTF-8" />
		<meta charset="UTF-8" />
		<meta name="description" content ="Writale is a social way to build stories, 
						by leaving it incomplete for people and posting picture, which can fire several stories." />
		
		<meta name ="viewport" content="width=device-width, initial-scale=1.0" />
		<link rel="canonical" href="https://writale.com/error/busted/" />
		<link rel="shortcut icon" type="image/x-icon" href="//<?php echo $_SERVER['HTTP_HOST']; ?>/resource/image/icon/favicon.ico" />
		
                <link rel="stylesheet" type="text/css" href="//<?php echo $_SERVER['HTTP_HOST']; ?>/style/universal.css" />
		<link rel="stylesheet" type="text/css" href="//<?php echo $_SERVER['HTTP_HOST']; ?>/style/style-2192013223.css" />
                
                <script src="//<?php echo $_SERVER['HTTP_HOST']; ?>/script/common.js"></script>

	</head>
	<body id="writale-forgot-password">
            <?php
                include realpath(dirname(__FILE__) . '/control/decorator/combopanel.php');
                ?>
            <?php if(isset($_done)) : 
            ?>
            <div id="congrats-content">
                <div id="msg">
                    <strong>Awesome!</strong> You got your account back.
                </div>
                <div id="congrats-login">   
                    <a href="<?php echo $_protocol.$_SERVER['HTTP_HOST'].'/login'; ?>">
                        <div class="button-std button-blue" id="fp-login">
                        Login
                        </div></a> with your new password!
                </div>
            </div>
            <?php elseif(isset($_recover) || isset($_error)):
                $_change_nonce = Random::getString(18);
                $_SESSION['change_nonce'] = $_change_nonce;
              ?>
            <?php if(isset($_error['sp'])) : ?>
                <div class="fp-message"> Your password should contain at least six characters.</div>
                <?php elseif (isset($_error['dup'])) : ?>
                <div class="fp-message"> You've used this password earlier. You shouldn't use it again!</div>
                <?php endif; ?>
            <div id="change-password-container">
                <div id="change-passwd-title">
                    Enter Your New Password
                </div>
                <form id="ch-pwd-frm" action="<?php echo $_protocol.$_SERVER['HTTP_HOST'].'/recover?c_n='.$_change_nonce; ?>" method="post">
                    <input type="hidden" value="<?php echo $_id; ?>" name="rcvr_i" />
                    <input id="fp-passwd" type="password" name="fp-pwd" />
                    <input type="submit" class="button-std button-blue" name="fp-pwd-sbmt" id="fp-sbmt" value="Done" />
                </form>
                <div id="show-passwd">
                    <input type="checkbox" id="cbox-show-pwd" />
                    <div id="sp-text">
                        Show password
                    </div>
                </div>
                <div id="passwd-content"></div>
                <div class="tiny-error" id="new-pwd-error"></div>
            </div>
            <div id="dont-refresh">
                <ul type="square">
                    <li>Do not refresh this page.</li>
                </ul>
            </div>

            <script>
             (function () {
                 var oErrBoxNewPasswd = _gAny("new-pwd-error");
                 _gAny("ch-pwd-frm").onsubmit = function () {
                         var iPwdLen = _gAny('fp-passwd').value.length;
                         if(iPwdLen === 0) {
                             util.genError(oErrBoxNewPasswd,
                                "You didn't enter the password.");
                               return false; 
                         }
                         else if(iPwdLen < 6) {
                             util.genError(oErrBoxNewPasswd,
                               "Please enter at least six characters as your password.");
                               return false; 
                         }
                         else return true;
                 };
                        
                 addEvent.call(_gAny("sp-text"),'click',function(e) {
                     var target = util.prevSibling(e.target);
                     util.cbToggle(target);
                     if($.createEvent) {
                         var ev  = $.createEvent('Event');
                         ev.initEvent('change',true, true);
                         target.dispatchEvent(ev);
                     }
                     else if($.createEventObject) {
                         var ev = $.createEventObject();
                         target.fireEvent("onchange",ev);
                     }
                 },false);
                 addEvent.call(_gAny('cbox-show-pwd'),'change',showPassword,false);
                 addEvent.call(_gAny("fp-passswd"), 'keyup', showPassword,true);
                 function showPassword () {
                     var cb = _gAny("cbox-show-pwd");
                     if(cb.checked) {
                         _gAny('passwd-content').innerHTML = _gAny("fp-passwd").value;
                     }
                     else {
                         _gAny('passwd-content').innerHTML = "";
                     }
                 }
             })();
            </script>
            <?php else :
                 $_s_nonce =  Random::getString(18);
                 $_SESSION['email_sub_nonce'] = $_s_nonce;
                ?>
                        <?php
                if (isset($_notfound)) :
                    $signup = $_protocol . $_SERVER['HTTP_HOST'] . '/signup';
                    ?>
                    <div class="fp-message"> The email address you entered, is not present with us.
                        <a target="_blank" href="<?php echo $signup ?>">Click here</a> to signup with it.
                    </div>
                <?php
                elseif (isset($_sent)) :
                    preg_match('/@([a-zA-Z0-9\-\.]+$)/', $_email, $email_prov);
                    $email_link = (strstr($email_prov[1], 'yahoo')) ? 'http://mail.' . $email_prov[1] : 'http://' . $email_prov[1];
                    ?>
                    <div class="fp-message"> We have sent an email to <?php echo $_email; ?>. 
                        <a target="_blank" href="<?php echo $email_link ?>">Click here</a>
                        to check it.
                    </div>
                <?php elseif (isset($_expired)) : ?>
                    <div class="fp-message"> The page you are trying to access, has expired.</div>
                <?php endif; ?>
		<div id="forgot-password-content">
		   <div id="fp-dialog">
		     Lost access to your favorite stories?
		   </div>
		   <div id="fp-desc">
			 Regain it in few seconds.
		   </div>
		   <div id="fp-divider"></div>
			<div id="fp-prompt">
			  Enter your registered
			  Email address and we will mail <br /> you a link to
			  recover your password.
			</div>
			<div id="fp-email-form">
                            <form action="<?php echo $_protocol.$_SERVER['HTTP_HOST'].'/recover?rcvr_n='.$_s_nonce; ?>"
                                  method="post" id="recvr-frm">
                               <div id="fp-input">
                                    <input type="text" id="fp-email" name="fp-email" 
                                        <?php if(isset($_POST['fp-but'])) echo 'value="'.$_POST['fp-email'].'"';?>/>
                               </div>
                               <div id="fp-button">
                                   <button type="submit" class="button-std button-blue" id="fp-but" name="fp-but"> Go </button>
                               </div>
                            </form>
                            <script>
                            (function () {
                                _gAny('recvr-frm').onsubmit = function () {
                                   var oEmail = _gAny("fp-email").value,
                                         sPattern = "^[\\s]*[a-zA-Z0-9\\-\\*\\?\\{\\}\\+#$~&!=_|`%\/\^\']" +
                                                     "([\.]?[a-zA-Z0-9\\-\\*\\?\\{\\}\\+#$~&!=_|`%\/\^\'])*" +
                                                    "@[a-zA-Z0-9]([\-]{0,2}[a-zA-Z0-9])*[\.][a-zA-Z]{1,}([\.][a-zA-Z]{2,}){0,5}[\\s]*$",
                                         oEmailRegexp = new RegExp(sPattern),
                                         oErrBox = _gAny("fp-err-message");
                                 
                                   if(oEmail.length === 0) {
                                       util.genError(oErrBox,
                                       'You forgot to enter your Email address!');
                                       return false;
                                   }
                                   
                                   else if(!oEmailRegexp.test(oEmail)) {
                                       util.genError(oErrBox,
                                            "This doesn't seem like an Email address. Please verify it.");
                                       return false;
                                   }
                                   else
                                       return true;
                               };
                            })();
                            </script>
			</div>
                       <div class="tiny-error" id="fp-err-message"></div>
		</div>
            <?php
            endif;
            ?>
           <?php require realpath(dirname(__FILE__) . '/control/decorator/pagefooter.php'); 
            include realpath(dirname(__FILE__).'/control/decorator/utilbottom.php'); ?>
	</body>
</html>