<?php
rg_log("FILE: /inc/user/forgot");

$forgot_token = rg_var_str("forgot_token");
if (empty($forgot_token)) {
	$forgot_token = empty($paras) ? "" : array_shift($paras);
	$forgot_token = preg_replace("/[^A-Za-z0-9]/", "", $forgot_token);
}

$pass1 = rg_var_str("pass1");
$pass2 = rg_var_str("pass2");
$lock_ip = rg_var_uint("lock_ip");

$_forgot = "";

$errmsg = array();

if ($rg['doit'] == 1) {
	if (strcmp($pass1, $pass2) != 0) {
		$errmsg[] = "Passwords mismatch.";
	} else {
		$r = rg_user_forgot_pass_uid($db, $forgot_token);
		if ($r['ok'] != 1) {
			$_forgot .= "Internal error, try again later.<br />\n";
			return;
		}

		if ($r['uid'] == 0) {
			$_forgot .= "Invalid (or expired) reset pass URL;"
				. " try again.<br />\n";
			return;
		}

		if (!rg_user_set_pass($db, $r['uid'], $pass1)) {
			$_forgot .= "Internal error; try again later.<br />\n";
			return;
		}

		rg_user_forgot_pass_destroy($db, $r['uid']);
		// auto-login
		if (!rg_user_auto_login($db, $r['uid'], $lock_ip,
			$rg['https'], $rg['hostname'], $rg['login_ui'])) {
			$_forgot = rg_template("msg/internal_err.html", TRUE /* xss */);
			return;
		}

		// redirect to home
		$url = rg_re_userpage($rg['login_ui']);
		rg_redirect($url);
	}
}

$rg['forgot_token'] = $forgot_token;
$rg['pass1'] = $pass1;
$rg['pass2'] = $pass2;
$rg['HTML:errmsg'] = rg_template_errmsg($errmsg);
$_forgot .= rg_template("user/forgot.html", $rg, TRUE /* xss */);
?>