<?php

#############################################################################
#           			                   Site@School
# Site@School is a website management system designed for primary schools.
#
# About Site@School:
# Comissioned by: City District 'de Baarsjes', Amsterdam, Netherlands
# Original idea, coding (version 1.0) and design : Mark de Haan (mark@starwave.nl)
# Ideas, improvements, expansions (version 1.1 - 2.4): Fred Stuurman 
# Current coder & maintainer: Fred Stuurman (fc.stuurman@hccnet.nl)
############################################################################
# sendpw.php: last changed 21/08/2006  , version: 2.4.03                                        
#             by Fred Stuurman (fc.stuurman@hccnet.nl)
#$Id: sendpw.php,v 1.2 2006/10/15 19:08:53 fstuurman Exp $
############################################################################
#                        LICENSE INFORMATION
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
##############################################################################

define('IN_SAS', true);

if (IsSet ($_GET['send']))
{
	$send = $_GET['send'];
}
else
{
	$send = "";
}
if (IsSet ($_GET['option']))
{
	$option = $_GET['option'];
}
if (IsSet ($_POST['email']))
{
	if (!get_magic_quotes_gpc())
	{
		$email = htmlspecialchars(addslashes($_POST['email']));
	}
	else
	{
		$email = htmlspecialchars($_POST['email']);
	}
}

include ("configuration/database.inc.php");
include ("core/common.inc.php");
mysql_connect("$db_server", "$db_username", "$db_password");
mysql_select_db("$db_name");

$query = "SELECT config_value FROM $table_configuration WHERE config_key='language'";
$result = mysql_query($query) or die_script(mysql_error());
$language = mysql_result($result, 0);
include ("languages/$language/$language.php");
unset ($query);
unset ($result);

$query = "SELECT config_value FROM $table_configuration WHERE config_key='use_encryption'";
$result = mysql_query($query) or die_script(mysql_error());
$use_encryption = mysql_result($result, 0);

$query = "SELECT config_value FROM $table_configuration WHERE config_key='email'";
$result = mysql_query($query) or die_script(mysql_error());
$site_email = mysql_result($result, 0);

$query = "SELECT config_value FROM $table_configuration WHERE config_key='url'";
$result = mysql_query($query) or die_script(mysql_error());
$site_url = mysql_result($result, 0);

$query = "SELECT config_value FROM $table_configuration WHERE config_key='sitename'";
$result = mysql_query($query) or die_script(mysql_error());
$sitename = mysql_result($result, 0);

if ((IsSet ($_GET['code'])) AND (strlen($_GET['code']) == 20))
{
	require ("core/class.phpmailer.php"); //use the phpmailer class

	if (!get_magic_quotes_gpc())
	{
		$code = htmlspecialchars(addslashes($_GET['code']));
	}
	else
	{
		$code = htmlspecialchars($_GET['code']);
	}
	$password = random_code(6);
	$message_to_sent = $sas_lang['password_reset'] . "<p><b>$password</b>";
	$password = md5($password);
	$query = "SELECT id, email FROM $table_users WHERE code = '" . $code . "' LIMIT 1";
	$result = mysql_query($query) or die_script($query, mysql_error());

	if (mysql_num_rows($result) > 0)
	{
		$id = mysql_result($result, 0, 0);
		$email = mysql_result($result, 0, 1);
		mysql_query("UPDATE $table_users SET code = '', initial = 1,
												invalid_logins = 0,
												password = '$password'
												WHERE id='$id'");

		$mail = new PHPMailer();
		$mail->From = $site_email; //email address of site
		$mail->FromName = $sitename;
		$mail->Subject = $sas_lang[password];
		$mail->Body = $message_to_sent;
		$mail->IsHTML(true);
		$mail->AddAddress($email); //add email address 
		$mail->Send();
		print "<br><br>" . $sas_lang['logged_password_sent'] . " <b>$email</b>.";
	}
	exit;
}

if ($send == "yes")
{
	require ("core/class.phpmailer.php"); //use the phpmailer class

	if (trim($email) != "")
	{
		$query = "SELECT email FROM $table_users WHERE email='" . $email . "'"; //check if email exists      
		$result = mysql_query($query) or die_script(mysql_error());
		if (mysql_num_rows($result) > 0)
		{
			$mail = new PHPMailer();
			$mail->From = $site_email; //email address of site
			$mail->FromName = $sitename;
			$mail->Subject = $sas_lang[password];
			$mail->IsHTML(true);
			$mail->AddAddress($email); //add email address 

			if ($use_encryption == 1)
			{
				$code = random_code(20);
				mysql_query("UPDATE $table_users SET code = '$code' , 
																initial = 1												
																WHERE email='$email'");
				$link = "<a href=" . $site_url . "starnet/sendpw.php?code=$code>";
				$message_to_sent .= str_replace("%link%", $link, $sas_lang['password_will_be_reset']);
				$mail->Body = $message_to_sent;
			}
			else
			{
				$query = "SELECT password FROM $table_users WHERE email='" . $email . "'";
				$result = mysql_query($query) or die_script(mysql_error());
				$password = mysql_result($result, 0);
				unset ($query);
				unset ($result);
				$message_to_sent = $sas_lang['password'] . " :<b> $password </b><p>";
				$mail->Body = $message_to_sent;
			}
			if (!$mail->Send())
			{
				print $sas_lang['mail_sent_failed'];
				print $link;
			}
			else
			{
				print "<br><br>" . $sas_lang['logged_password_sent'] . " <b>$email</b>.";
			}
		}
		else
		{
			print $sas_lang['email_not_exists'];
		}

	}
	else
	{
		print $sas_lang['no_email'];
	}

	if ($option == "public")
	{
		print "<form method=\"post\" action=\"../index.php\">";
	}
	else
	{
		print "<form method=\"post\" action=\"index.php\">";
	}
	print "<br><input type=\"submit\" TABINDEX=3 value=\"" . $sas_lang['goback'] . "\"></font></form>";

	exit;
}
print "<html><title>Site@School</title>
       <BODY bgcolor=\"#FFFFFF\"  background=\"graphics/puzzle_tile.gif\" text=\"#000000\" 
       onLoad=\"self.focus();document.sendpw.email.focus()\">
       <p><img border=\"0\" src=\"graphics/saslogo.gif\"></td>";
print "<br><br><br>" . $sas_lang['logged_email_text'] . "<br><br>
       <form method=\"post\" action=\"sendpw.php?send=yes&option=$option\" name=\"sendpw\">
       <table border=\"0\" cellpadding=\"0\" cellspacing=\"0\" style=\"border-collapse: collapse\">
   <tr>
     <td>
 <font face=\"Verdana\" size=\"2\" color=\"#FFFFFF\">.......</font></td>
     <td align=right>
 <font face=\"Verdana\" size=\"2\">" . $sas_lang['email'] . ":&nbsp;</font></td>
     <td><input type=\"text\" TABINDEX=1 name=\"email\" size=\"45\">
     </td>
   </tr> 
   <tr>
     <td>&nbsp;</td>
     <td>&nbsp;</td>
     <td align=\"right\" height=\"50\"><font face=\"Verdana\">
     <input type=\"submit\" TABINDEX=3 value=\"" . $sas_lang['send'] . "\"></font></td>
   </tr>
 </table></html>";
?>