<?php
if(!defined('R_P')) exit('Access Denied');
$step = intval($_GET['step']) ? intval($_GET['step']) : 1;
if ( $step == 2 ){
	$username = trim($_POST['username']);
	$email = trim($_POST['email']);
	$user   = qdb::QueryFirst("select uid, username, email, email_verify from ".TABLEPRE."user where username='{$username}' " );
	if(empty($user)){
		qbase::showmsg( "对不起，此用户名不存在！" );
	}else{
		if($user['email'] != $email) qbase::showmsg( "出错了：输入的邮箱不正确" );
		if($user['email_verify'] == 0) qbase::showmsg( "出错了：该邮箱没有经过验证,不能用来找回密码" );
		qbase::get_object("sendmail", $user['username'], $user['email'])->op_password($user['uid']);
		$wait = 5;
		qbase::showmsg( "一封邮件已经发送到&lt;<font color='blue'>{$user['email']}</font>&gt;,请24小时内查收以继续找回密码", "default", "user.php?ac=password");
	}
}elseif ( $step == 3 ){
	if(empty($_GET['verify'])) qbase::showmsg("提交了错误的请求", SKIN, "user.php?ac=password");
	$verify_data = array();
	$verify = trim($_GET['verify']);
	parse_str(qbase::authcode(trim(urldecode($verify)), "DECODE"), $verify_data);
	if(empty($verify_data) || empty($verify_data['uid']) || empty($verify_data['email']) || empty($verify_data['dateline'])) qbase::showmsg("提交了错误的请求", SKIN, "user.php?ac=password");
	$verify_data['uid'] = intval($verify_data['uid']);
	$verify_data['dateline'] = intval($verify_data['dateline']);
	$verify_data['email'] = addslashes($verify_data['email']);
	$verify_hash = $verify_data['verify'];
	unset($verify_data['verify']);
	if($verify_hash != substr(md5(qbase::array2string($verify_data) . $_SET['passport_key']), 0, 12)) qbase::showmsg("提交了错误的请求", SKIN, "user.php?ac=password");
	
	$num = qdb::queryAlone("select count(*) as num from ".TABLEPRE."user where uid = '{$verify_data['uid']}' and email = '{$verify_data['email']}' and email_verify = 1");
	if($num == 0 || $verify_data['dateline'] - $_SERVER['REQUEST_TIME'] > 3600 * 24) qbase::showmsg("提交了错误的请求，该请求可能已过期了", SKIN, "user.php?ac=password");
	if($_POST['myFormAc'] == 'update'){
		$password = trim($_POST['password']);
		$pwdconfirm = trim($_POST['pwdconfirm']);
		if(!$password || $password != $pwdconfirm){
			qbase::showmsg("请重新检查一下,输入的密码有点问题！" );
		}
		$password = md5(stripslashes($password));
		qdb::Query("update ".TABLEPRE."user set password='{$password}' where uid='{$verify_data['uid']}'" );
		qbase::get_object('login')->delete_user_cache($verify_data['uid']);
		qbase::showmsg( "密码设置成功，你可以使用新密码登录！", SKIN, "user.php?ac=login" );
	}
}
include qbase::template($_SET['skin']  . '/user/password');
?>
