<?php

$errors = array();

if (isset($_GET['q'])) {
$q=$_GET['q']; 
} elseif (isset($_POST['q'])) {
$q=$_POST['q'];} else 
{    
    $errors[]='The page is accesed in error.';
}
   	// Connect to MySQL
	require_once('mysqli_connect.php');

        // print_r($_POST['q']);
	// Was the form submitted?
	if (isset($_POST['submitted'])) {

 // Gather the post data


    if (empty($_POST['email'])) {
        $errors[] = 'You forgot to enter your email.';
    } else {

        $email = mysqli_real_escape_string($dbc, trim($_POST['email']));

                $qq = "SELECT Username FROM users WHERE email='$email' LIMIT 1";

                $rr = mysqli_query($dbc, $qq);
                
                if (mysqli_num_rows($rr) != 1) {
                $errors[] = 'This is a db error';

                 } else {
                      $row = mysqli_fetch_array($rr, MYSQLI_ASSOC);
                      $un=$row['Username'];
                        }
          }    
     
    if (empty($_POST['password'])) {
        $errors[] = 'You forgot to enter your password.';
    } else {
        if ($_POST['password'] != $_POST['confirmpassword']) {
            $errors[] = 'The two passwords provided do not match.';
        } else {
            $p = mysqli_real_escape_string($dbc, trim($_POST['password']));
            $password=SHA1($p);
    }
    }
    if (!empty($errors)) {
      
    } else {
        //if (isset($_POST['q'])) {
        //  $q = $_POST["q"];
	 
       
	    // Use the same salt from the forgot_pass.php file
	    $salt = "PiuwrO1#O0rl@+luH1!froe*l?8oEb!iu)_1Xaspi*(sw(^&.laBr~u3i!c?es-l651";

 	    // Generate the reset key
	    $resetkey = SHA1($salt . $email);
            
	    // Does the new reset key match the old one?
	    if ($resetkey == $q)
	    {
	         $qq2= "UPDATE users SET password=? WHERE Username=?";
                            
                 $stmt = mysqli_prepare($dbc, $qq2);
                 mysqli_stmt_bind_param($stmt, 'ss', $password, $un);
                 mysqli_stmt_execute($stmt);
                     
              if (mysqli_stmt_affected_rows($stmt) == 1) {
                echo '<div><h1>Thank you!</h1>
                    <p>Your new password is now registered.</p></div>';
                 } else {
                      echo '<div><h1>System Error</h1>
                   <p class="error">Password could not be registered due to a system error or not matching passwords.
                    We apologize for any inconvenience.</p>';
                  echo '<p>' . mysqli_error($dbc) . '<br> <br>
                 Query: ' . $qq2 . '</p></div>';
                        }
            }        
  else {

        //The page is accessed in error without q
        require_once('login_functions.inc.php');
        $url = absolute_url('login.php');
        header("Location: $url");
        exit();
 
}
       
  
        
}include 'indexr.php';


            } else{
            include 'indexr.php';
            }
?>
 
<?php
    mysqli_close($dbc);
    
 ?>
