<?php


session_start();
if($_SESSION['dbName']==""){
header("location:../index.php");
}

include("config.inc.php");

//Connect to Database
$connection = mysql_connect($config['dbServer'],$config['dbUser'],$config['dbPass']) or die("Could not connect to DB");
mysql_select_db($_SESSION['dbName'],$connection) or die("Could not find DB");

$querylog="select * from ".$_SESSION['dbLabel'].".login where user_account='".$_SESSION['useraccount']."' and Upper(Login_Schema) = Upper('".$_SESSION['dbName']."')  ";
$resultlog=mysql_query($querylog) or die(mysql_error());
while($rows=mysql_fetch_array($resultlog)){
extract($rows);

}

$act = $_GET['act'];
$message = "";

$HideMenu   = $_POST["HideMenu"]; if ($HideMenu == ""){$HideMenu = $_GET["HideMenu"];}   

if ($act == 'changePassword'){
	
	$old_pass = $txtPassword;
	$new_pass = $txtNewPassword;
	$conf_pass = $txtNewPasswordRepeat;
	
	if ($old_pass == '' || $new_pass == '' || strlen($conf_pass) > 15 ) {
      if ($old_pass == '' || $new_pass == '')
	     $message="Passwords cannot be blank.";
	  else if (strlen($conf_pass) > 15 )
	     $message="New password cannot be greater than 15 characters."; 
	} else {  

		if ($config['EncryptPassMod'] == 1)	
			$querypass="select ".$_SESSION['dbLabel'].".encryptpassword('$old_pass') as oldpass";
		else
			$querypass="select '$old_pass' as oldpass";
			
		$resultpass=mysql_query($querypass, $connection) or die(mysql_error());
		while($rows=mysql_fetch_array($resultpass)){
			extract($rows);
		}
		
		$old_pass = $oldpass;
		$queryusers="select user_password from ".$_SESSION['dbLabel'].".users where user_account='".$_SESSION['useraccount']."' and user_password='$old_pass'";
		$resultusers=mysql_query($queryusers, $connection) or die(mysql_error());

		$uf = mysql_fetch_row($resultusers);
		if(mysql_num_rows($resultusers)!=0 && ($old_pass==$uf[0] || strtoupper($old_pass)==$uf[0] )){

			/*//CHECK IF PASS IS CONFIRMED
			$new_pass=preg_replace("/[^a-zA-Z0-9s]/", "", $new_pass);
			$conf_pass=preg_replace("/[^a-zA-Z0-9s]/", "", $conf_pass);*/

			if ($config['EncryptPassMod'] == 1)
				$querypass="select ".$_SESSION['dbLabel'].".encryptpassword('$new_pass') as newpass";
			else
				$querypass="select '$new_pass' as newpass";
				
		
			$resultpass=mysql_query($querypass, $connection) or die(mysql_error());
			while($rows=mysql_fetch_array($resultpass)){
				extract($rows);
			}
			
			$new_pass1=$newpass;
			if($new_pass==$conf_pass && $new_pass1!=$old_pass){

				//Change PASSWORD

				//$new_pass=$newpass;
				
		$queryCheckComplex = "select * from ".$_SESSION['dbLabel'].".users where user_account = '".$_SESSION['useraccount']."'";
//echo $queryCheckComplex; exit;
//echo $connection; exit;
$resultCheckComplex = mysql_query($queryCheckComplex, $connection);
$rowCheckComplex = mysql_fetch_array($resultCheckComplex);
extract($rowCheckComplex);

$uppercase = preg_match('@[A-Z]@', $new_pass1);
$lowercase = preg_match('@[a-z]@', $new_pass1);
$number    = preg_match('@[0-9]@', $new_pass1);
$special = preg_match('/[\'\/~`\!@#\$%\^&\*\(\)_\-\+=\{\}\[\]\|;:"\<\>,\.\?\\\]/', $new_pass1);

if($user_complex_password == 1){
if($uppercase && $lowercase && $number && $special &&  strlen($new_pass1) >= 8) {
				$querychangepass = "UPDATE ".$_SESSION['dbLabel'].".users SET user_password='".$new_pass1 ."', user_expirydate = DATE_ADD(now(),INTERVAL 180 DAY)  WHERE user_account='".$_SESSION['useraccount']."' ";
				$resultchangepass = mysql_query($querychangepass, $connection) or die(mysql_error()); 
				//echo $querychangepass;
				
				//mysql_query("COMMIT");
				//mysql_close($connection);
				
				$txtPassword = '';
				$txtNewPassword = '';
				$txtNewPasswordRepeat = '';
		
				header("Location:menu.php");
				}
				else
				{
				    
					$message="Password should contain at least 8 characters having at least one alphabetical, one numerical value, one special character, one lower case letter, and one upper case letter.";
				}
			}
			else
			{
			    $querychangepass = "UPDATE ".$_SESSION['dbLabel'].".users SET user_password='".$new_pass1 ."', user_expirydate = DATE_ADD(now(),INTERVAL 180 DAY)  WHERE user_account='".$_SESSION['useraccount']."' ";
				$resultchangepass = mysql_query($querychangepass, $connection) or die(mysql_error()); 
				//echo $querychangepass;
				
				//mysql_query("COMMIT");
				//mysql_close($connection);
				
				$txtPassword = '';
				$txtNewPassword = '';
				$txtNewPasswordRepeat = '';
		
				header("Location:menu.php");
				}
			}
			else {
				if ($new_pass!=$conf_pass)
				  $message="You entered two different Passwords. Please Try again.";
				else
				  if ($new_pass1==$old_pass)
					  $message="New Password should be different than old password. Please Try again.";
			}
		}
		else{
			$message="The old password you entered is incorrect";
		}
	}

}

print <<< HERE
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256" />
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> 
<meta name="viewport" content="width=device-width, initial-scale=1.0"> 
<link rel="stylesheet" type="text/css" media="all" href="css-v2/style.css">
<script type="text/javascript" language="javascript">
<!--

function checkPassword(){
	x = document.frm1;
	if (x.txtPassword.value == '' || x.txtNewPassword.value == '' || x.txtNewPassword.value != x.txtNewPasswordRepeat.value){
	alert('Passwords cannot be blank. New Password values should be the same.');
	x.txtPassword.focus();
	}else{
		x.submit();
	}
}

function ClearForm() {
  x = document.frm1;
  x.txtPassword.value = '';
  x.txtNewPassword.value = '';  
  x.txtNewPasswordRepeat.value = '';
  
  x.txtPassword.focus();

}

function setfocus() {

  x = document.frm1;
  x.txtPassword.focus();
}

-->
</script>
<title>Change Password </title>

<style type="text/css">
<!--
body,td,th {
	font-family: Verdana, Arial, Helvetica, sans-serif;
	font-size: 14px;
}
a:link {
	text-decoration: none;
}
a:visited {
	text-decoration: none;
}
a:hover {
	text-decoration: none;
}
a:active {
	text-decoration: none;
}
.style1 {
	font-family: Arial;
	font-size: 12px;
	color: #4069A7;
	font-weight: bold;
}
.style2 {
	color: #FF0000;
	font-family: Verdana, Arial, Helvetica, sans-serif;
	font-size: 10px;
}
.style3 {
	color: #4069A7;
	font-family: Verdana, Arial, Helvetica, sans-serif;
	font-size: 10px;
}
.style8 {font-size: 11px; color: #999999; font-weight: bold; }
.style11 {font-size: 11px}
body {
	margin-top: 0px;
}
-->
</style>

</head>
<body onload='return setfocus();'>

			


	<form name='frm1' method='post' action='change_password2.php?act=changePassword'>
	<input type='hidden' name='HideMenu' value='$HideMenu'>
HERE;
	

echo"<table cellpadding='0' cellspacing='0' border='0'  align='center' class='layout-width'>";
if ($HideMenu != 1) include_once("header2.php");
echo" <tr><td  valign='top'>";

if ($HideMenu != 1) include_once("sidemenu.php");
echo"  </td></tr>";


echo" <tr style='height:26px;'>
		<td  valign='top' id='content-top'>
			<table border='0' cellpadding='0' cellspacing='0' style='table-layout:fixed; height:26px;' class='layout-width'>
			<tr style='height:26px;'>
				<td style='width:38px; height:26px;'>&nbsp;</td>
				<td valign='middle' style='width:300px; height:26px;'><span class='title'>Password Expired</span></td>
				<td class='message' valign='middle' style='height:26px;'></td>
			</tr></table>
		</td>
	  </tr>";

echo"<tr>
		<td  height='34'  valign='top' id='content-top2'>
			<table border='0' cellpadding='0' cellspacing='0' class='layout-width'>
			<tr>
				<td width='20'  height='34'>&nbsp;</td>
				<td valign='middle' height='34' width='420px' align='left'>";



			
echo"	</td></tr></table>";
echo"</td></tr>";				

		
echo"<tr><td id='content-body'>
<table border='0'  align='center' valign='top' width=100% class='tablecontent'>
   <tr bgcolor='#F7F7F7'><td valign='top' align='left' colspan='10'>";	


print<<<HERE
   
	 <table height="300" border="0" align="center" width="100%" cellpadding='0' cellspacing='0'>
     <tr><td align="left" valign="top">
HERE;

	
	 
print <<< HERE
         </td>
        </tr>
		
		<tr><td align='center'><table height="150" border="0" align="center" width="50%">
		<tr height='15'><td width='50%' colspan='2' align='center' bgcolor='#F5F5F5'><span class="style2"> 
HERE;
		echo $message; 

print <<< HERE
		</span></td></tr>
		<tr>
			<td width='50%' align='right' bgcolor='#F5F5F5'><span class="style1">Old Password</span></td>
HERE;

			echo"<td width='50%' bgcolor='#F5F5F5'><input type='password' name='txtPassword' value='$txtPassword' style='width:130px; color: #003366; font-family: Arial; font-weight: none; font-size: 12;'></td>";
			
print <<< HERE
		</tr>
		<tr>
			<td width='50%' align='right' bgcolor='#F5F5F5'><span class="style1">New Password</span></td>
HERE;
			echo"<td width='50%' bgcolor='#F5F5F5'><input type='password' name='txtNewPassword' value='$txtNewPassword' style='width:130px; color: #003366; font-family: Arial; font-weight: none; font-size: 12;'></td>";
			
print <<< HERE
		</tr>
		<tr height='15'><td width='50%' colspan='2' align='center' bgcolor='#F5F5F5'><span class="style3"> ( max = 15 characters; case sensitive; allowed characters [a-z,A-Z,0-9] ) </span></td></tr>
		<tr>
			<td width='50%' align='right' bgcolor='#F5F5F5'><span class="style1">Confirm New Password</span></td>
HERE;
			echo"<td width='50%' bgcolor='#F5F5F5'><input type='password' name='txtNewPasswordRepeat' value='$txtNewPasswordRepeat' style='width:130px; color: #003366; font-family: Arial; font-weight: none; font-size: 12;'></td>";
			
print <<< HERE
		</tr>
	<tr><td align='center' colspan='2'>
	<button type='submit' id='btnsubmit' name='btnsubmit'  title='Change'><span><span>Change</span></span></button>
	<button type='button' id='btnClear' name='btnClear'  title='Clear' onClick='ClearForm();return false;'><span><span>Clear</span></span></button>
</td></tr>
		</table></td></tr>
	</table>
HERE;
	

echo"   </table></td></tr><tr height='30'><td align='center' id='content-bottom' ></td></tr>";  
echo"</form></body></html>";

?>