Estoy usando codigo de jpmaster77 para sistema de usuarios php, este funciona bastante bien, excepto al querer modificar el password, no se si alguien me puede ayudar, tengo la pagina en http://www.cheapwebhost4u.com si alguien puede entrar y ver el problema pueden darse de alto como usuario y quiza quieran cambiar su contraseña, lo cual no es posible.
Gracias de antemano!!!
Los archivos los voy a cortar para que pueda enviarse el tema.
userinfo.php
Código HTML:
<?php if(isset($_SESSION['useredit'])){ unset($_SESSION['useredit']); echo "<h1>User Account Edit Success!</h1>"; echo "<p><b>$session->username</b>, your account has been successfully updated. " ."<a href=\"main.php\">Main</a>.</p>"; } else{ ?> <?php if($session->logged_in){ ?> <h1>User Account Edit : <?php echo $session->username; ?></h1> <?php if($form->num_errors > 0){ echo "<td><font size=\"2\" color=\"#ff0000\">".$form->num_errors." error(s) found</font></td>"; } ?> <div id="userupdate"> <form action="process.php" method="POST"> <p class="grid_2">Name: </p> <p class="left"> <input class="left" type="text" name="name" maxlength="50" value="<?php if($form->value("name") == ""){ echo $session->userinfo['name']; }else{ echo $form->value("name"); } ?>"> <?php echo $form->error("name"); ?> </p> <div class="clear"></div> <p class="grid_2">Current Password: </p> <p class="left"> <input type="password" name="curpass" maxlength="30" value="<?php echo $form->value("curpass"); ?>"> <?php echo $form->error("curpass"); ?> </p> <div class="clear"></div> <p class="grid_2">New Password: </p> <p class="left"> <input class="left" type="password" name="newpass" maxlength="30" value="<?php echo $form->value("newpass"); ?>"> <?php echo $form->error("newpass"); ?> </p> <div class="clear"></div> <p class="grid_2">Email: </p> <p class="left"> <input class="left" type="text" name="email" maxlength="50" value="<?php if($form->value("email") == ""){ echo $session->userinfo['email']; }else{ echo $form->value("email"); } ?>"> <?php echo $form->error("email"); ?> </p> <div class="clear"></div> <p> <input type="hidden" name="subedit" value="1" /> <input type="submit" value="Edit Account" /> </p> </form> </div> <?php echo "[<a href=\"main.php\">Main</a>] "; echo "[<a href=\"userinfo.php?user=$session->username\">My Account</a>] "; } } ?>
Código HTML:
<?php include("../include/session.php"); class Process { /* Class constructor */ function Process(){ global $session; /* User submitted login form */ if(isset($_POST['sublogin'])){ $this->procLogin(); } /* User submitted registration form */ else if(isset($_POST['subjoin'])){ $this->procRegister(); } /* User submitted forgot password form */ else if(isset($_POST['subforgot'])){ $this->procForgotPass(); } /* User submitted edit account form */ else if(isset($_POST['subedit'])){ $this->procEditAccount(); } else if(isset($_POST['subConfirm'])){ $this->procSendConfirm(); } else if(isset($_POST['login_with_hash'])){ $this->procHashLogin($_POST['hash']); } /** * The only other reason user should be directed here * is if he wants to logout, which means user is * logged in currently. */ else if($session->logged_in){ $this->procLogout(); } /** * Should not get here, which means user is viewing this page * by mistake and therefore is redirected. */ else{ header("Location: ../index.php"); } } /** * procEditAccount - Attempts to edit the user's account * information, including the password, which must be verified * before a change is made. */ function procEditAccount(){ global $session, $form; $_POST = $session->cleanInput($_POST); /* Account edit attempt */ $retval = $session->editAccount($_POST['curpass'], $_POST['newpass'], $_POST['email'], $_POST['name']); /* Account edit successful */ if($retval){ $_SESSION['useredit'] = true; header("Location: ".$session->referrer); } /* Error found with form */ else{ $_SESSION['value_array'] = $_POST; $_SESSION['error_array'] = $form->getErrorArray(); //header("Location: ".$session->referrer); } } /** * procSendConfirm - only needs to be used if the administrator * changes the EMAIL_WELCOME from false to true and wants * the users to confirm themselves. (why not?!) */ function procSendConfirm(){ global $session, $form, $database, $mailer; $_POST = $session->cleanInput($_POST); $user = $_POST['user']; $pass = $_POST['pass']; /* Checks that username is in database and password is correct */ $user = stripslashes($user); $result = $database->confirmUserPass($user, md5($pass)); /* Check error codes */ if($result == 1){ $field = "user"; $form->setError($field, "* Username not found"); } elseif($result == 2){ $field = "pass"; $form->setError($field, "* Invalid password"); } /* Check to see if the user is already valid */ $q = "SELECT valid FROM ".TBL_USERS." WHERE username='$user'"; $valid = $database->query($q); $valid = mysql_fetch_array($valid); $valid = $valid['valid']; if($valid == 1){ $field = 'user'; $form->setError($field, "* Username already confirmed."); } /* Return if form errors exist */ if($form->num_errors > 0){ $_SESSION['value_array'] = $_POST; $_SESSION['error_array'] = $form->getErrorArray(); header("Location: ".$session->referrer); } else{ $q = "SELECT username, userid, email FROM ".TBL_USERS." WHERE username='$user'"; $info = $database->query($q) or die(mysql_error()); $info = mysql_fetch_array($info); $username = $info['username']; $userid = $info['userid']; $email = $info['email']; if($mailer->sendConfirmation($username,$userid,$email)){ echo "Your confirmation email has been sent! Back to <a href='main.php'>Main</a>"; } } } function procHashLogin($hash){ global $session, $database; if(substr($hash,0,1) === "#"){ $hash = substr($hash,1); } $user_info = $database->getUserInfoFromHash($hash); if($user_info['hash_generated'] < (time() - (60*60*24*3))){ // if the hash was generated more than 3 days ago, the hash is invalid. // let's invalidate and refuse the hash. $database->updateUserField($user_info['username'], 'hash', $session->generateRandID()); $database->updateUserField($user_info['username'], 'hash_generated', time()); return false; } if($user_info['username'] && $user_info['userid']){ $_SESSION['username'] = $user_info['username']; $_SESSION['userid'] = $user_info['userid']; $session->checkLogin(); die("Logging In..."); } else { die(); } } }; /* Initialize process */ $process = new Process; ?>
