<?php
/**
 *
 * @category        frontend
 * @package         account
 * @author          WebsiteBaker Project
 * @copyright       2009-2012, Website Baker Org. e.V.
 * @link            http://www.websitebaker2.org/
 * @license         http://www.gnu.org/licenses/gpl.html
 * @platform        WebsiteBaker 2.8.x
 * @requirements    PHP 5.2.2 and higher
 * @version         $Id: password.php 2 2017-07-02 15:14:29Z Manuela $
 * @filesource        $HeadURL: svn://isteam.dynxs.de/wb/2.10.x/trunk/account/password.php $
 * @lastmodified    $Date: 2017-07-02 17:14:29 +0200 (Sun, 02 Jul 2017) $
 *
 */

// Must include code to stop this file being access directly
if(defined('WB_PATH') == false) { die("Cannot access this file directly"); }

// Get entered values
    $iMinPassLength = 6;
    $sCurrentPassword = $wb->get_post('current_password');
    $sCurrentPassword = (is_null($sCurrentPassword) ? '' : $sCurrentPassword);
    $sNewPassword = $wb->get_post('new_password');
    $sNewPassword = is_null($sNewPassword) ? '' : $sNewPassword;
    $sNewPasswordRetyped = $wb->get_post('new_password2');
    $sNewPasswordRetyped= is_null($sNewPasswordRetyped) ? '' : $sNewPasswordRetyped;
// Check existing password
    $sql  = 'SELECT `password` ';
    $sql .= 'FROM `'.TABLE_PREFIX.'users` ';
    $sql .= 'WHERE `user_id` = '.$wb->get_user_id();
// Validate values
    if (md5($sCurrentPassword) != $database->get_one($sql)) {
        $error[] = $MESSAGE['PREFERENCES_CURRENT_PASSWORD_INCORRECT'];
    }else {
        if(strlen($sNewPassword) < $iMinPassLength) {
            $error[] = $MESSAGE['USERS_PASSWORD_TOO_SHORT'];
        }else {
            if($sNewPassword != $sNewPasswordRetyped) {
                $error[] = $MESSAGE['USERS_PASSWORD_MISMATCH'];
            }else {
                $pattern = '/[^'.$wb->password_chars.']/';
                if (preg_match($pattern, $sNewPassword)) {
                    $error[] = $MESSAGE['PREFERENCES_INVALID_CHARS'];
                }else {
// generate new password hash
                    $sPwHashNew = md5($sNewPassword);
// Update the database
                    $sql  = 'UPDATE `'.TABLE_PREFIX.'users` '
                          . 'SET `password`=\''.$database->escapeString($sPwHashNew).'\' '
                          . 'WHERE `user_id`='.$wb->get_user_id();
                    if ($database->query($sql)) {
                        $success[] = $MESSAGE['PREFERENCES_PASSWORD_CHANGED'];
                    }else {
                        $error[] = $database->get_error();
                    }
                }
            }
        }
    }