<?php $get = ''; foreach($_GET as $key => $value) { $get .= '&'.$key.'='.$value; } if(!isset($main)) { header('Location: index.php?pg='.substr(basename(__FILE__),0,-4).$get); exit; } ?>
<?php
if(isset($_GET['recoverPassword'])) {
    if($main->checkToken() && $main->checkCaptcha()) {
        $email = isset($_POST['email']) && filter_var($_POST['email'], FILTER_VALIDATE_EMAIL) ? $_POST['email'] : '';
        $codigo = isset($_POST['codigo']) ? hash('sha512', $_POST['codigo']) : 'null';
        $password = sha1(isset($_POST['password']) ? $_POST['password'] : 'null');
        $password2 = sha1(isset($_POST['password2']) ? $_POST['password2'] : 'null2');
        if($email != '') {
            if ($stmt = $main->mysqli->prepare('SELECT iduser, estado FROM user WHERE email = ? LIMIT 1')) {
                $stmt->bind_param('s', $email);
                $stmt->execute();
                $stmt->store_result();
                $stmt->bind_result($iduser, $estado);
                $stmt->fetch();
                if ($stmt->num_rows == 1) {
                    if($estado == 1) {
                        if($codigo != 'null') {
                            if ($stmt = $main->mysqli->prepare('SELECT secret FROM recoverpassword WHERE iduser = ? LIMIT 1')) {
                                $stmt->bind_param('s', $iduser);
                                $stmt->execute();
                                $stmt->store_result();
                                $stmt->bind_result($secret);
                                $stmt->fetch();
                                $sql = 'DELETE FROM recoverpassword WHERE iduser = "' . $iduser . '"';
                                $main->mysqli->query($sql) or exit(__LINE__ . ':' . $main->mysqli->error);
                                if(hash_equals($codigo, $secret)) {
                                    if($password == $password2) {
                                        $sql = 'UPDATE user SET clave = "' . $password . '" WHERE iduser = ' . $iduser;
                                        $main->mysqli->query($sql) or exit(__LINE__ . ':' . $main->mysqli->error);
                                        $main->header('login', 'success=Ha cambiado su clave, inicie sesión.');
                                    }
                                    $main->header(__FILE__, 'error=Las contraseñas no coinciden, recupere su clave de nuevo.');
                                }
                            } else {
                                exit(__LINE__ . ':' . $main->mysqli->error);
                            }
                            $main->header(__FILE__, 'error=Código invalido, recupere su clave de nuevo.');
                        } else {
                            $secret = mt_rand(100001, 999999);
                            $hashsecret = hash('sha512', $secret);
                            $sql = 'INSERT INTO recoverpassword(iduser, secret) VALUES (' . $iduser . ', "' . $hashsecret . '")';
                            $main->mysqli->query($sql) or exit(__LINE__ . ':' . $main->mysqli->error);
                            $to = $email;
                            $subject = "Ascofame - Restablecer contraseña " . $main->title;
                            $message = '
                            <html>
                            <head>
                            <title>' . $subject . '</title>
                            </head>
                            <body>Reciba un cordial saludo,<br />Usted ha solicitado recuperar su clave. Ingrese el código inferior en la pagina para continuar:<br /><br /><strong>'.$secret.'</strong>' . $main->firma . '</body>
                            </html>';
                            $headers = "MIME-Version: 1.0" . "\r\n";
                            $headers .= "Content-type:text/html;charset=UTF-8" . "\r\n";
                            $headers .= 'From: <info@ascofame.org.co>' . "\r\n";
                            mail($to,$subject,$message,$headers);
                            $main->header(__FILE__, 'setPassword&success=Se ha enviado un código de verificación a su correo, no cierre esta ventana.');
                        }
                    } else {
                        $main->header(__FILE__, 'error=Su user ha sido desactivado. Contacte al administrador.');
                    }
                    return false;
                } else {
                    $main->header(__FILE__, 'error=El correo electrónico no esta registrado. Intente de nuevo.');
                }
            } else {
                exit(__LINE__ . ':' . $main->mysqli->error);
            }
        }
    }
    $main->header(__FILE__, 'error=Error desconocido');
}
?>
<?php echo $main->formOpen(__FILE__, 'recoverPassword'); ?>
<div class="box-radius login-form">
    <h1>Recuperar clave</h1>
    <div class="form-group">
        <div class="form-input">
            <input name="email" type="email" class="input" placeholder="Correo electrónico" required>
        </div>
    </div>
    <?php if(isset($_GET['setPassword'])) { ?>
    <div class="form-group">
        <div class="form-input">
            <input name="password" type="password" class="input" placeholder="Nueva clave" required>
        </div>
    </div>
    <div class="form-group">
        <div class="form-input">
            <input name="password2" type="password" class="input" placeholder="Digite de nuevo la clave" required>
        </div>
    </div>
    <div class="form-group">
        <div class="form-input">
            <input name="codigo" type="text" class="input" placeholder="Código enviado a su correo" required>
        </div>
    </div>
    <?php } ?>
    <div class="form-group">
        <div class="form-input text-center">
            <img id="captcha_image" src="captcha/captcha.php?rand=<?php rand(); ?>'">
            <br />
            <a href="javascript:refreshCaptcha();" class="label_captcha">Cambiar imagen</a>
            <br />
            <input name="captcha" class="input" type="text" placeholder="Código de imagen" required>
        </div>
    </div>
    <div class="form-group">
        <div class="form-input two-col text-center">
            <input type="submit" class="btn success" value="Recuperar clave">
            <a href="login.php">Volver</a>
        </div>
    </div>
</div>
<?php echo $main->formClose(); ?>