<?php
ob_start();
session_start();
?>

<html>
 <head>
  <title></title>
 </head>
 <BODY onload="document.Form1.reset(); document.Form1.Password.focus();">
  <center>

<?php
/*
Here we get the username from the variable username stored in $_SESSION which is used to remember the 
username instead of passing the username as a hidden field or asking the user 
to enter it again in this page or using cookies.
*/

function display_form($username)
{
echo <<< Begin

		<H2 align="center">Change Password</H2>
        	</center>
        	<p>
        	<CENTER>
        	<FORM ACTION="{$_SERVER['PHP_SELF']}" NAME="Form1" METHOD="POST">
        	<CENTER>

		<TABLE BGCOLOR="lightgrey" BORDER="1" BORDERCOLOR="gray">
            
		<tr><td colspan="2" align="center">Your username is <b>$username</b>.

		<TR>
        	<TD align="right"><B>Current Password:</B></TD>
        	<TD><INPUT NAME="Password" SIZE="50" type="password"></TD>
        	</TR>

		<TR>
        	<TD align="right"><B>New Password (at least 5 characters):</B></TD>
        	<TD><INPUT NAME="New_Password" SIZE="50" type="password"></TD>
       	</TR>
	
		<TR>
        	<TD align="right"><B>Retype New Password:</B></TD>
        	<TD><INPUT NAME="Retype_New_Password" SIZE="50" type="password"></TD>
       	</TR>

       	<input name='submitted' value='TRUE' type='hidden'>
		<input name="Username" size="30" type='hidden' value="$username">
       	 </TABLE>

		<p></p>

        	<TABLE>
        	<TR>
        	<TD align="center"><INPUT TYPE="submit" VALUE="Change Password">
       	 </TD>
       	 <TD align="center">
       	 <INPUT TYPE="reset" VALUE="RESET">
        	</TD>
        	</TR>
       	 </TABLE>

       	 </FORM>
Begin;
}

function change_password($username,$password,$new_password,$retype_new_password, &$errors)
{	
	$errors = array();
	
	if (strlen($new_password) < 5)
	{
		$errors[] = "The new password must have at least 5 characters.";
		return FALSE;
	}
	if ($new_password != $retype_new_password)
	{
		$errors[] = "The new passwords you entered are not the same.";
		return FALSE;
	}
	@$d = mysql_connect('localhost','abu-jeib','iyad911');
	if (!d)
	{
		echo "Sorry can't process your information at this time.<BR>";
		return FALSE;
	}
	@$select = mysql_select_db('alumni');
	if (!$select)
	{
		echo "Sorry can't process your information at this time.<BR>";
		return FALSE;
	}

	$q = "select count(*) from users where username='$username' and password=sha1('$password')";
	@$r = mysql_query($q);
	if (!$r)
	{
		echo "Sorry can't process your information at this time.<BR>";
		@mysql_close($d);
		return FALSE;
	}

	@$row = mysql_fetch_row($r);
	$k = $row[0];
	if ($k < 1)
	{
		$errors[] = "Check the current password.";
		return FALSE;
	}
	@mysql_free_result($r);
		
	$q = "update users set password=sha1('$new_password') where username='$username' and password=sha1('$password')";
	@$r = mysql_query($q);
	if (!$r)
	{
		echo "Sorry can't process your information at this time.<BR>";
		@mysql_close($d);
		return FALSE;
	}


	@mysql_close($d); 
	return TRUE;
}

/* 
The username was passed to this page in the past as a hidden field or via a cookie.
Here the username is obtained from the variable username in array $_SESSION.
*/

if (isset($_SESSION['username'])) 
{
	$username = $_SESSION['username'];
	if (!empty($username))
	{
		if (isset($_POST['submitted']))
		{	
			//$username = trim(stripslashes($_POST['Username'])); // Taken from form on this page
			$password = trim(stripslashes($_POST['Password']));
			$new_password = trim(stripslashes($_POST['New_Password']));
			$retype_new_password = trim(stripslashes($_POST['Retype_New_Password']));
			$flag = change_password($username,$password,$new_password,$retype_new_password,$errors);
			if (!$flag)
			{
				foreach ($errors as $error)
					echo "$error<br>\n";
			}
			else
			{
				echo "<h2 align='center'>Your password has been changed. Thank you.</h2>";
				echo "<a href='members_alumni_sessions.php'>Back to Members Area</a>\n";	
			}			
		} // if (form submitted)
		else
			display_form($username);
	}
	else
	{
		echo "<p>You are not logged in.</p>\n";
		echo "<a href='current_alumni_sessions.php'>Member Login</a>\n";	
		echo "<a href='new_alumni.php'>New Member</a>\n";

	}
}
else
{
	echo "<p>You are not logged in.</p>\n";
	echo "<a href='current_alumni_sessions.php'>Member Login</a><br>\n";	
	echo "<a href='new_alumni.php'>New Member</a>\n";	
}

ob_end_flush();
?>
</center></body></html>



