restaurant-ordering-system/reset_password_simple.php at main · loopcraft3/restaurant-ordering-system · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
<?php
// Start session
session_start();

// Include database connection
include_once 'config/database.php';
include_once 'config/config.php';

// Check if user is already logged in
if(isset($_SESSION['user_id'])) {
    // Redirect to appropriate dashboard
    header('Location: index.php');
    exit();
}

$message = '';
$message_type = '';

// Process form submission
if($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Validate input
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';
    $confirm_password = $_POST['confirm_password'] ?? '';

    if(empty($username)) {
        $message = 'Username is required';
        $message_type = 'danger';
    } elseif(empty($password) || empty($confirm_password)) {
        $message = 'Please enter and confirm your new password';
        $message_type = 'danger';
    } elseif($password !== $confirm_password) {
        $message = 'Passwords do not match';
        $message_type = 'danger';
    } elseif(strlen($password) < 8) {
        $message = 'Password must be at least 8 characters long';
        $message_type = 'danger';
    } else {
        // Create database connection
        $database = new Database();
        $db = $database->getConnection();

        try {
            // Begin transaction
            $db->beginTransaction();

            // Check if username exists
            $query = "SELECT id, username FROM users WHERE username = :username AND is_active = TRUE";
            $stmt = $db->prepare($query);
            $stmt->bindParam(':username', $username);
            $stmt->execute();

            if($stmt->rowCount() > 0) {
                $user = $stmt->fetch(PDO::FETCH_ASSOC);

                // Hash the new password
                $password_hash = password_hash($password, PASSWORD_DEFAULT);

                // Update password
                $update_query = "UPDATE users SET password_hash = :password_hash WHERE id = :user_id";
                $update_stmt = $db->prepare($update_query);
                $update_stmt->bindParam(':password_hash', $password_hash);
                $update_stmt->bindParam(':user_id', $user['id']);

                if($update_stmt->execute()) {
                    // Success - commit transaction
                    $db->commit();

                    $message = 'Your password has been successfully updated. You can now login with your new password.';
                    $message_type = 'success';

                    // Create logs directory if it doesn't exist
                    $logs_dir = __DIR__ . '/logs';
                    if (!is_dir($logs_dir)) {
                        mkdir($logs_dir, 0755, true);
                    }

                    // Log the password change to a file
                    $log_file = $logs_dir . '/password_resets.log';
                    $log_message = date('Y-m-d H:i:s') . ' - User ID: ' . $user['id'] . ' - Password reset via simple form';
                    file_put_contents($log_file, $log_message . PHP_EOL, FILE_APPEND);

                } else {
                    // Rollback on failure
                    $db->rollBack();
                    $message = 'Failed to update password. Please try again.';
                    $message_type = 'danger';
                }
            } else {
                // Username not found
                $message = 'Invalid username. Please try again.';
                $message_type = 'danger';
            }
        } catch(PDOException $e) {
            // Rollback on exception
            if ($db->inTransaction()) {
                $db->rollBack();
            }

            $message = 'An error occurred. Please try again later.';
            $message_type = 'danger';
            // Log error
            error_log('Password reset error: ' . $e->getMessage());
        }
    }
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Reset Password - <?php echo SITE_NAME; ?></title>
    <!-- Bootstrap CSS -->
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/bootstrap.min.css" rel="stylesheet">
    <style>
        body {
            background-color: #f8f9fa;
            height: 100vh;
            display: flex;
            align-items: center;
            padding-top: 40px;
            padding-bottom: 40px;
        }
        .form-reset {
            width: 100%;
            max-width: 380px;
            padding: 15px;
            margin: auto;
        }
        .card {
            border-radius: 1rem;
            box-shadow: 0 0.5rem 1rem rgba(0, 0, 0, 0.15);
        }
    </style>
</head>
<body>
    <main class="form-reset">
        <div class="card">
            <div class="card-body p-4 p-sm-5">
                <div class="text-center mb-4">
                    <h1 class="h3 mb-3 fw-normal"><?php echo SITE_NAME; ?></h1>
                    <h2 class="h5 mb-3 fw-normal">Reset Password</h2>
                </div>

                <?php if(!empty($message)): ?>
                    <div class="alert alert-<?php echo $message_type; ?>"><?php echo $message; ?></div>
                <?php endif; ?>

                <?php if($message_type !== 'success'): ?>
                <form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>">
                    <div class="form-floating mb-3">
                        <input type="text" class="form-control" id="username" name="username" placeholder="Username" required>
                        <label for="username">Username</label>
                    </div>

                    <div class="form-floating mb-3">
                        <input type="password" class="form-control" id="password" name="password" placeholder="New Password" required>
                        <label for="password">New Password</label>
                        <div class="form-text">Password must be at least 8 characters long.</div>
                    </div>

                    <div class="form-floating mb-3">
                        <input type="password" class="form-control" id="confirm_password" name="confirm_password" placeholder="Confirm Password" required>
                        <label for="confirm_password">Confirm Password</label>
                    </div>

                    <button class="w-100 btn btn-lg btn-primary" type="submit">Reset Password</button>
                </form>
                <?php else: ?>
                <div class="text-center mt-3">
                    <a href="login.php" class="btn btn-primary">Go to Login</a>
                </div>
                <?php endif; ?>

                <div class="text-center mt-3">
                    <a href="login.php">Back to Login</a>
                </div>
            </div>
        </div>

        <p class="mt-4 mb-3 text-muted text-center">&copy; <?php echo date('Y'); ?> <?php echo SITE_NAME; ?></p>
    </main>

    <!-- Bootstrap JS Bundle with Popper -->
    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/bootstrap.bundle.min.js"></script>
</body>
</html>