<?php
// This page allows a logged-in user to change their password.

// Include the configuration file for error management and such.
require_once ('includes/config.inc'); 

// Set the page title and include the HTML header.
$page_title = 'HOW : Change Your Password';
include_once ('includes/header.html');

// If no FullName variable exists (i.e. user not logged in), redirect the user.
if (!isset($_SESSION['FullName'])) {

	header ("Location:  /how/index.php");
	ob_end_clean();
	exit();
	
} else {

	if (isset($_POST['submit'])) { // Handle the form.
	
		require_once ('includes/mysql_connect.php'); // Connect to the database.
				
		// Check for a new password and match against the confirmed password.
		if (eregi ("^[[:alnum:]]{5,20}$", stripslashes(trim($_POST['password1'])))) {
			if ($_POST['password1'] == $_POST['password2']) {
				$p = escape_data($_POST['password1']);
			} else {
				$p = FALSE;
				echo '<p><font color="red" size="+1">Your password did not match the confirmed password!</font></p>';
			}
		} else {
			$p = FALSE;
			echo '<p><font color="red" size="+1">Please enter a valid password!</font></p>';
		}
		
		if ($p) { // If everything's OK.
	
			// Make the query.
			$user = $_SESSION['LoggedInUser'];
			$query = "UPDATE systemusers SET password=PASSWORD('$p') WHERE HOWLogin='$user';";		
			$result = @mysql_query ($query); // Run the query.
			if (mysql_affected_rows() == 1) { // If it ran OK.
			
				// If successful...
				echo '<h3>Your password has been changed.</h3>';
				include ('includes/footer.html'); // Include the HTML footer.
				exit();				
				
			} else { 
			
				// If unsuccessful...
				$message = '<p><font color="red" size="+1">Your password could not be changed due to a system error. We apologize for any inconvenience.</font></p>'; 

			}		
			mysql_close(); // Close the database connection.
	
		} else { // Failed the validation test.
			echo '<p><font color="red" size="+1">Please try again.</font></p>';		
		}
	
	} // End of the main Submit conditional.
	
	?>
	
	<h1>Change Your Password</h1>
	<P>Passwords must be between 5 and 20 characters long. Enter your chosen password twice.</P>
	<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
	<p><b>New Password:&nbsp;&nbsp;</b> <input type="password" name="password1" size="20" maxlength="20" /></p>
	<p><b>Confirm Password:&nbsp;&nbsp;</b> <input type="password" name="password2" size="20" maxlength="20" /></p>
	<input type="submit" name="submit" value="Change My Password" /></p><BR>
	</form><!-- End of Form -->

<?php
} 
include ('includes/footer.html'); // Include the HTML footer.
?>