Code: Select all
session_start();
include "config.php";
global $_CONFIG;
define("MONO_ON", 1);
require "class/class_db_{$_CONFIG['driver']}.php";
$db=new database;
$db->configure($_CONFIG['hostname'],
$_CONFIG['username'],
$_CONFIG['password'],
$_CONFIG['database'],
$_CONFIG['persistent']);
$db->connect();
$c=$db->connection_id;
$set=array();
$settq=$db->query("SELECT * FROM settings");
while($r=$db->fetch_row($settq))
{
$set[$r['conf_name']]=$r['conf_value'];
}
$ips = $db->query("SELECT * FROM `ban_ip` WHERE `ip` = '".$_SERVER['REMOTE_ADDR']."'");
if(mysql_num_rows($ips) >= 1){
die("<br /><br /><center><br /><br /><br /><br /><br /><br /><b><font color='red' size='3'>Your IP has been banned from this game!!</font></b></center></body></html>");
}
print <<<EOF
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8"/>
<meta name="description" content=""/>
<meta name="keywords" content="" />
<meta name="author" content="" />
<link rel="stylesheet" type="text/css" href="css/login_register.css" media="screen" />
<title>{$set['game_name']}</title>
<link rel="icon" type="image/png" href="images/other/Favicon.png">
</head>
<body>
EOF;
$IP = ($_SERVER['HTTP_X_FORWARDED_FOR'])
? $_SERVER['HTTP_X_FORWARDED_FOR']
: $_SERVER['REMOTE_ADDR'];
$year=date('Y');
$ponum2 = mysql_num_rows(mysql_query("SELECT * FROM `users` WHERE `laston` > unix_timestamp()-15*60 AND `force_logout` = 0"));
$ponum = mysql_num_rows(mysql_query("SELECT * FROM `users` WHERE `laston` > unix_timestamp()-1440*60 AND `force_logout` = 0"));
$pnum = mysql_num_rows(mysql_query("SELECT * FROM `users` WHERE `userid` > 0"));
$time = time () ;
$year= date("Y",$time) . "";
print <<<EOF
<div id="header" class="row">
<a href="register.php" class="register"></a>
EOF;
if(isset($_POST['new_pass']) AND isset($_POST['passcode']) AND isset($_POST['password']) AND isset($_POST['password2'])):
{
$_POST['passcode'] = $db->escape($_POST['passcode']);
$_POST['password'] = $db->escape($_POST['password']);
$_POST['password2'] = $db->escape($_POST['password2']);
if($_POST['password'] != $_POST['password2']):
{
print <<<EOF
<div id="bot-content"></div>
<div id="content-container" class= "resetpasspanel">
<h2><font color="#ff0000">Password Reset</h2>Passwords do not match.</font>
</div>
<div id="footer-container" class="wrap">
</div>
</body>
</html>
EOF;
};
endif;
if (strlen($_POST['password']) < 5):
{
print <<<EOF
<div id="bot-content"></div>
<div id="content-container" class= "resetpasspanel">
<h2><font color="#ff0000">Password Reset</h2>Password needs to be 5 characters or more.</font>
</div>
<div id="footer-container" class="wrap">
</div>
</body>
</html>
EOF;
};
endif;
$valid = $db->query("SELECT * FROM `users` WHERE `password_reset` = '".$_POST['passcode']."'");
If(!mysql_num_rows($valid)):
{
print <<<EOF
<div id="bot-content"></div>
<div id="content-container" class= "resetpasspanel">
<h2><font color="#ff0000">Password Reset</h2>Invalid. Stoop! </font>
</div>
<div id="footer-container" class="wrap">
</div>
</body>
</html>
EOF;
};
endif;
$pass = md5($_POST['password']);
$db->query("UPDATE `users` SET `password` = '".$pass."', `password_reset` = '' WHERE `password_reset` = '".$_POST['passcode']."'");
mysql_query("UPDATE `log_reset_password` SET `result` = 1 WHERE `code` = '".$_POST['passcode']."'");
print <<<EOF
<div id="bot-content"></div>
<div id="content-container" class= "resetpasspanel">
<h2><font color="#ff0000">Password Reset</h2>Password changed succesfully.,</font><br />
<a href='login.php'><b><font color='brown'>Back</font></b></a>
</div>
<div id="footer-container" class="wrap">
</div>
body>
</html>
EOF;
}
endif;
If(isset($_GET['passcode'])):
{
$_GET['passcode'] = $db->escape($_GET['passcode']);
$valid = $db->query("SELECT * FROM `users` WHERE `password_reset` = '".$_GET['passcode']."'");
If(!mysql_num_rows($valid)):
{
print <<<EOF
<div id="bot-content"></div>
<div id="content-container" class= "resetpasspanel">
<h2><font color="#ff0000">Password Reset</h2>Invalid. </font>
</div>
<div id="footer-container" class="wrap">
</div>
</body>
</html>
EOF;
};
endif;
print <<<EOF
<div id="bot-content"></div>
<div id="content-container" class= "resetpasspanel">
<h2><font color="#ff0000">Password Reset</h2>
To reset your password, please fill in all the fields then click "Submit".<br />
<form method="POST">
<input type="hidden" name="passcode" value='$_GET[passcode].' />
New Password: <input type="password" name="password" /><br />
Confirm Password: <input type="password" name="password2" /><br />
<input type="submit" name="new_pass" value="Submit" />
</font></form>
</div>
<div id="footer-container" class="wrap">
</div>
</body>
</html>
EOF;
}
endif;
If(isset($_POST['submit']) AND isset($_POST['user']))
{
$_POST['user'] = $db->escape($_POST['user']);
$check = $db->query("SELECT * FROM `users` WHERE `userid` = '".$_POST['user']."' OR `username` = '".$_POST['user']."' OR `email` = '".$_POST['user']."'");
If(!mysql_num_rows($check)):
{
print <<<EOF
<div id="bot-content"></div>
<div id="content-container" class= "resetpasspanel">
<h2><font color="#ff0000">Password Reset</h2>No such user.</font>
<a href='login.php'><b><font color='brown'>Back</font></b></a>
</div>
<div id="footer-container" class="wrap">
</div>
</body>
</html>
EOF;
};
endif;
$user = mysql_fetch_assoc($check);
$random_code = "";
$possible = "2346789bcdfghjkmnpqrtvwxyzBCDFGHJKLMNPQRTVWXYZ";
$maxlength = strlen($possible);
$i = 0;
While($i < 12) {
$char = substr($possible, mt_rand(0, $maxlength-1), 1);
If(!strstr($random_code, $char)) {
$random_code .= $char;
$i++;
}
}
$db->query("UPDATE `users` SET `password_reset` = '".$random_code."' WHERE `userid` = ".$user['userid']);
$subject = "[game name]";
$message = "You have asked to reset your password.
If it was you who asked to get a reset link please visit the link below and follow the instructions. If you have recieved this email and did not ask to have your password reset delete this mail and contact us by using the contact us link on the game and tell us about it. We will then be able to figure out who tried to get your password.
This is the link to visit if you want to reset your password:
http://www.[game name]/reset_password.php?passcode=$random_code
";
$from = "From: **************@*******";
mail($user['email'], $subject, $message, $from);
print <<<EOF
<div id="bot-content"></div>
<div id="content-container" class= "resetpasspanel">
<h2><font color="#ff0000">Password Reset</h2>Please check your email for a confirmation link.</font><br />
<a href='login.php'><b><font color='brown'>Back</font></b></a>
</div>
<div id="footer-container" class="wrap">
</div>
</body>
</html>
EOF;
$IP = $db->escape($_SERVER['REMOTE_ADDR']);
$db->query("INSERT INTO `log_reset_password` VALUES('', {$user['userid']}, '{$random_code}', unix_timestamp(), 0, '$IP')");
}else{
print <<<EOF
<div id="bot-content"></div>
<div id="content-container" class= "resetpasspanel">
<h2><b><font color="#ff0000">Password Reset</font><b></h2>
<form method="POST">
<b><font color="#ff0000">To reset your password type in your username, email address or userid:</font><b><br /><input type="text" name="user" /><br />
<input type="submit" name="submit" value="Submit" />
<b><font color="#ff0000">All attempted password resets are logged.</font><b>
</form>
</div>
<div id="footer-container" class="wrap">
</div>
</body>
</html>
EOF;
}
?>P.S The password never changes after I submit it!
