45 lines
1.6 KiB
PHP
45 lines
1.6 KiB
PHP
<?php
|
|
require __DIR__ . '/../incl/util.php';
|
|
setPlainHeader();
|
|
checkClientDatabaseVersion();
|
|
$conn = newConnection();
|
|
|
|
$post = getPostData();
|
|
$oldpassword = $post['oldpassword'] ?? '';
|
|
$newpassword = $post['newpassword'] ?? '';
|
|
$token = $post['token'] ?? '';
|
|
$username = $post['username'] ?? '';
|
|
|
|
if (!preg_match('/^(?=.*[A-Za-z])(?=.*\d)[A-Za-z\d!@#$%^&*()_\-+=]{8,}$/', $newpassword)) {
|
|
exitWithMessage(json_encode(["success" => false, "message" => "New password must be at least 8 characters with at least one letter and one number"]));
|
|
}
|
|
|
|
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND token = ?");
|
|
$stmt->bind_param("ss", $username, $token);
|
|
$stmt->execute();
|
|
$result = $stmt->get_result();
|
|
|
|
if ($result->num_rows > 0) {
|
|
$user = $result->fetch_assoc();
|
|
if (!password_verify($oldpassword, $user['password'])) {
|
|
exitWithMessage(json_encode(["success" => false, "message" => "Old password is incorrect"]));
|
|
}
|
|
if (password_verify($newpassword, $user['password'])) {
|
|
exitWithMessage(json_encode(["success" => false, "message" => "New password cannot be the same as the old password"]));
|
|
}
|
|
$id = $user['id'];
|
|
} else {
|
|
exitWithMessage(json_encode(["success" => false, "message" => "Invalid session token or username, please refresh login"]));
|
|
}
|
|
|
|
$hashednewpassword = password_hash($newpassword, PASSWORD_DEFAULT);
|
|
$token = bin2hex(random_bytes(256));
|
|
|
|
$stmt = $conn->prepare("UPDATE users SET token = ?, password = ? WHERE id = ?");
|
|
$stmt->bind_param("sss", $token, $hashednewpassword, $id);
|
|
|
|
$stmt->execute();
|
|
$stmt->close();
|
|
$conn->close();
|
|
|
|
echo encrypt(json_encode(["success" => true, "token" => $token])); |