lostPassword.php 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * SCRIPT PURPOSE :
  5. *
  6. * This script allows users to retrieve the password of their profile(s)
  7. * on the basis of their e-mail address. The password is send via email
  8. * to the user.
  9. *
  10. * Special case : If the password are encrypted in the database, we have
  11. * to generate a new one.
  12. *
  13. * @todo refactor, move relevant functions to code libraries
  14. *
  15. * @package chamilo.auth
  16. */
  17. /**
  18. * Code
  19. */
  20. // name of the language file that needs to be included
  21. $language_file = 'registration';
  22. require_once '../inc/global.inc.php';
  23. require_once api_get_path(LIBRARY_PATH).'login.lib.php';
  24. require_once api_get_path(LIBRARY_PATH).'mail.lib.inc.php';
  25. require_once api_get_path(LIBRARY_PATH).'custompages.lib.php';
  26. // Custom pages
  27. // Had to move the form handling in here, because otherwise there would
  28. // already be some display output.
  29. global $_configuration;
  30. if (api_get_setting('use_custom_pages') == 'true') {
  31. if (isset ($_POST['user']) && isset ($_POST['email'])) {
  32. $user = $_POST['user'];
  33. $email = $_POST['email'];
  34. $condition = '';
  35. if (!empty($email)) {
  36. $condition = " AND LOWER(email) = '".Database::escape_string($email)."' ";
  37. }
  38. $tbl_user = Database :: get_main_table(TABLE_MAIN_USER);
  39. $query = " SELECT user_id AS uid, lastname AS lastName, firstname AS firstName,
  40. username AS loginName, password, email, status AS status,
  41. official_code, phone, picture_uri, creator_id
  42. FROM ".$tbl_user."
  43. WHERE ( username = '".Database::escape_string($user)."' $condition ) ";
  44. $result = Database::query($query);
  45. $num_rows = Database::num_rows($result);
  46. if ($result && $num_rows > 0) {
  47. if ($num_rows > 1) {
  48. $by_username = false; // more than one user
  49. while ($data = Database::fetch_array($result)) {
  50. $user[] = $data;
  51. }
  52. } else {
  53. $by_username = true; // single user (valid user + email)
  54. $user = Database::fetch_array($result);
  55. }
  56. if ($_configuration['password_encryption'] != 'none') {
  57. Login::handle_encrypted_password($user, $by_username);
  58. } else {
  59. Login::send_password_to_user($user, $by_username);
  60. }
  61. } else {
  62. Display::display_error_message(get_lang('NoUserAccountWithThisEmailAddress'));
  63. }
  64. $msg = Login::reset_password($_GET["reset"], $_GET["id"], true);
  65. CustomPages::displayPage('lostpassword-feedback');
  66. }
  67. else {
  68. CustomPages::displayPage('lostpassword');
  69. }
  70. }
  71. $tool_name = get_lang('LostPassword');
  72. Display :: display_header($tool_name);
  73. $this_section = SECTION_CAMPUS;
  74. $tool_name = get_lang('LostPass');
  75. // Forbidden to retrieve the lost password
  76. if (api_get_setting('allow_lostpassword') == 'false') {
  77. api_not_allowed();
  78. }
  79. if (isset ($_GET['reset']) && isset ($_GET['id'])) {
  80. //$msg = Login::reset_password($_GET["reset"], $_GET["id"], true);
  81. $msg1= '<a href="'.api_get_path(WEB_CODE_PATH).'auth/lostPassword.php" class="fake_button_back" >'.get_lang('Back').'</a>';
  82. echo '<br /><br /><div class="actions" >'.$msg1.'</div>';
  83. } else {
  84. $form = new FormValidator('lost_password');
  85. $form->addElement('header', '', $tool_name);
  86. $form->addElement('text', 'user', array(get_lang('LoginOrEmailAddress'), get_lang('EnterEmailUserAndWellSendYouPassword')), array('size'=>'40'));
  87. //$form->applyFilter('email','strtolower');
  88. $form->addElement('style_submit_button', 'submit', get_lang('Send'),'class="a_button gray"');
  89. // setting the rules
  90. $form->addRule('user', get_lang('ThisFieldIsRequired'), 'required');
  91. if ($form->validate()) {
  92. $values = $form->exportValues();
  93. if(strpos($values['user'],'@')){
  94. $user = strtolower($values['user']);
  95. $email = TRUE;
  96. } else {
  97. $user = strtolower($values['user']);
  98. $email = FALSE;
  99. }
  100. $condition = '';
  101. if ($email) {
  102. $condition = "LOWER(email) = '".Database::escape_string($user)."' ";
  103. } else {
  104. $condition = "LOWER(username) = '".Database::escape_string($user)."'";
  105. }
  106. $tbl_user = Database :: get_main_table(TABLE_MAIN_USER);
  107. $query = "SELECT user_id AS uid, lastname AS lastName, firstname AS firstName, ".
  108. "username AS loginName, password, email, status AS status, ".
  109. "official_code, phone, picture_uri, creator_id ".
  110. "FROM ".$tbl_user." ".
  111. "WHERE ( $condition ) ";
  112. $result = Database::query($query);
  113. $num_rows = Database::num_rows($result);
  114. if ($result && $num_rows > 0) {
  115. $by_username = true;
  116. $users = Database::store_result($result);
  117. foreach( $users as $user ) {
  118. if ($_configuration['password_encryption'] != 'none') {
  119. Login::handle_encrypted_password($user, $by_username);
  120. } else {
  121. Login::send_password_to_user($user, $by_username);
  122. }
  123. }
  124. } else {
  125. Display::display_warning_message(get_lang('NoUserAccountWithThisEmailAddress'));
  126. }
  127. } else {
  128. $form->display();
  129. }
  130. }
  131. Display::display_footer();