Hi
My forgotpass.php function used to work. Suddenly it only works up until you get the message: 'An email has been sent to you with instructions on how to reset your password. <strong>(Mail will not send unless you have an smtp server running locally.)'
However no email is sent. It seems that the function: $passwordMessage = sendPasswordEmail from functions.php is not being called, but I can't work out why.
forgotpass.php:
<?php
include("database.php");
include("functions.php");
$show = 'emailForm'; //which form step to show by default
if ($_SESSION['lockout'] == true && (mktime() > $_SESSION['lastTime'] + 900))
{
$_SESSION['lockout'] = false;
$_SESSION['badCount'] = 0;
}
if (isset($_POST['subStep']) && !isset($_GET['a']) && $_SESSION['lockout'] != true)
{
switch($_POST['subStep'])
{
case 1:
//we just submitted an email or username for verification
$result = checkUNEmail($_POST['uname'],$_POST['email']);
if ($result['status'] == false )
{
$error = true;
$show = 'userNotFound';
} else {
$error = false;
$show = 'securityForm';
$securityUser = $result['userID'];
}
break;
case 2:
//we just submitted the security question for verification
if ($_POST['userID'] != "" && $_POST['answer'] != "")
{
$result = checkSecAnswer($_POST['userID'],$_POST['answer']);
if ($result == true)
{
//answer was right
$error = false;
$show = 'successPage';
$passwordMessage = sendPasswordEmail($_POST['userID']);
$_SESSION['badCount'] = 0;
} else {
//answer was wrong
$error = true;
$show = 'securityForm';
$securityUser = $_POST['userID'];
$_SESSION['badCount']++;
}
} else {
$error = true;
$show = 'securityForm';
}
break;
case 3:
//we are submitting a new password (only for encrypted)
if ($_POST['userID'] == '' || $_POST['key'] == '') header("location: login.php");
if (strcmp($_POST['pw0'],$_POST['pw1']) != 0 || trim($_POST['pw0']) == '')
{
$error = true;
$show = 'recoverForm';
} else {
$error = false;
$show = 'recoverSuccess';
updateUserPassword($_POST['userID'],$_POST['pw0'],$_POST['key']);
}
break;
}
}
elseif (isset($_GET['a']) && $_GET['a'] == 'recover' && $_GET['email'] != "") {
$show = 'invalidKey';
$result = checkEmailKey($_GET['email'],urldecode(base64_decode($_GET['u'])));
if ($result == false)
{
$error = true;
$show = 'invalidKey';
} elseif ($result['status'] == true) {
$error = false;
$show = 'recoverForm';
$securityUser = $result['userID'];
}
}
if ($_SESSION['badCount'] >= 3)
{
$show = 'speedLimit';
$_SESSION['lockout'] = true;
$_SESSION['lastTime'] = '' ? mktime() : $_SESSION['lastTime'];
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Bright-Tutors - Education for Life!</title>
<link href="css/inav-ie-8.css" rel="stylesheet" media="screen">
<link href="css/inav-ie-7.css" rel="stylesheet" media="screen">
<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
<link rel="icon" href="images/favicon.ico" type="image/x-icon">
<style type="text/css">
@import url("css/main.css");
#page {
width: 800px;
font-family: "Trebuchet MS", Arial, Helvetica, sans-serif;
font-size: 12px;
}
#header {
width: 800px;
}
.field {
font-family: Arial, Helvetica, sans-serif;
font-size: 11px;
color: #666;
padding-left: 0px;
text-align: left;
width: 500px;
}
.fieldtext {
font-family: "Trebuchet MS", Arial, Helvetica, sans-serif;
font-size: 12px;
color: #666;
padding-left: 0px;
text-align: left;
width: 800px;
}
.submit {
font-family: "Trebuchet MS", Arial, Helvetica, sans-serif;
font-size: 12px;
color: #666;
width: 100px;
text-align: left;
}
</style>
<script type="text/javascript">
function MM_preloadImages() { //v3.0
var d=document; if(d.images){ if(!d.MM_p) d.MM_p=new Array();
var i,j=d.MM_p.length,a=MM_preloadImages.arguments; for(i=0; i<a.length; i++)
if (a[i].indexOf("#")!=0){ d.MM_p[j]=new Image; d.MM_p[j++].src=a[i];}}
}
</script>
</head>
<body onLoad="MM_preloadImages('library/topbar/topbar_r2_c2_s2.jpg','library/topbar/topbar_r2_c4_s2.jpg','library/topbar/topbar_r2_c6_s2.jpg','library/topbar/topbar_r2_c8_s2.jpg','library/topbar/topbar_r2_c10_s2.jpg','library/topbar/topbar_r2_c12_s2.jpg','library/topbar/topbar_r2_c14_s2.jpg')">
<table width="800" border="0" align="center" cellpadding="1" cellspacing="1">
<tr>
<td width="172"> </td>
<td width="625"> </td>
</tr>
<tr>
<td colspan="2"><div id="header"><hr /></div></td>
</tr>
<tr>
<td colspan="2" align="left"><div id="page">
<?php switch($show) {
case 'emailForm': ?>
<h2>Password Recovery</h2>
<p class="fieldtext">You can use this form to recover your password if you have forgotten it.<br>
Because your password is securely encrypted in our database, it is impossible actually recover your password,
but we will email you a link that
will enable you to reset it securely. <br>
<br>
Enter either your username or your email address below to get started.<br>
<br>
If you answer the security question wrong 3 times you will be locked out. </p>
<span class="field">
<?php if ($error == true) { ?>
You must enter either a username or email address to continue.
<?php } ?>
</span>
<form action="<?= $_SERVER['Login/PHP_SELF']; ?>" method="post" class="field">
<div class="field">
<label for="uname">Username</label>
<br>
<input name="uname" type="text" id="uname" value="" size="30" maxlength="30">
</div>
<div class="field">
<label><br>
- OR -</label>
<br>
<br>
</div>
<div class="field">
<label for="email">Email</label>
<br>
<input name="email" type="text" id="email" value="" size="30" maxlength="255">
</div>
<input type="hidden" name="subStep" value="1" />
<br>
<br>
<div>
<input type="submit" style="margin-left: 0px;" value="Submit " />
</div>
<div class="clear"></div>
</form>
<?php break; case 'securityForm': ?>
<h2>Password Recovery</h2>
<p class="field">Please answer the security question below:</p>
<span class="field">
<?php if ($error == true) { ?>
You must answer the security question correctly to receive your lost password.
<?php } ?>
</span>
<form action="<?= $_SERVER['Login/PHP_SELF']; ?>" method="post" class="field">
<div class="field">
<label>Question<br>
</label>
<?= getSecurityQuestion($securityUser); ?>
</div>
<div class="field">
<label for="answer"><br>
Answer</label>
<br>
<input type="text" name="answer" id="answer" value="" maxlength="255">
</div>
<input type="hidden" name="subStep" value="2" />
<input type="hidden" name="userID" value="<?= $securityUser; ?>" />
<br>
<br>
<div class="field">
<input type="submit" style="margin-left: 0px;" value="Submit" />
</div>
<div class="clear"></div>
</form>
<?php break; case 'userNotFound': ?>
<h2>Password Recovery</h2>
<p class="field">The username or email you entered was not found in our database.<br />
<br />
<a href="forgotpass.php">Click here</a> to try again.</p>
<?php break; case 'successPage': ?>
<h2>Password Recovery</h2>
<p class="field">An email has been sent to you with instructions on how to reset your password. <strong>(Mail will not send unless you have an smtp server running locally.)</strong><br />
<br />
<a href="login.php">Return</a> to the login page. </p>
<?php break;
case 'recoverForm': ?>
<h2>Password Recovery</h2>
<p class="field">Welcome back,
<?= getUserName($securityUser=='' ? $_POST['userID'] : $securityUser); ?>
.</p>
<p class="field">In the fields below, enter your new password.</p>
<span class="field">
<?php if ($error == true) { ?>
The new passwords must match and must not be empty.
<?php } ?>
</span>
<form action="<?= $_SERVER['PHP_SELF']; ?>" method="post" class="field">
<div class="field">
<label for="pw0">New Password</label>
<br>
<input type="password" class="input" name="pw0" id="pw0" value="" maxlength="20">
</div>
<div class="field">
<label for="pw1">Confirm Password</label>
<br>
<input type="password" class="input" name="pw1" id="pw1" value="" maxlength="20">
</div>
<input type="hidden" name="subStep" value="3" />
<input type="hidden" name="userID" value="<?= $securityUser=='' ? $_POST['userID'] : $securityUser; ?>" />
<input type="hidden" name="key" value="<?= $_GET['email']=='' ? $_POST['key'] : $_GET['email']; ?>" />
<div ><br>
<input type="submit" style="margin-left: 0px;" value="Submit" />
</div>
<div class="clear"></div>
</form>
<?php break; case 'invalidKey': ?>
<h2>Invalid Key</h2>
<p class="field">The key that you entered was invalid. Either you did not copy the entire key from the email, you are trying to use the key after it has expired (3 days after request), or you have already used the key in which case it is deactivated.<br />
<br />
<a href="login.php">Return</a> to the login page. </p>
<?php break; case 'recoverSuccess': ?>
<h2>Password Reset</h2>
<p class="field">Congratulations! your password has been reset successfully.</p>
<span class="field"><br />
<br />
<a href="login.php">Return</a> to the login page.
</p>
<?php break; case 'speedLimit': ?>
</span>
<h2>Warning</h2>
<p class="field">You have answered the security question wrong too many times. You will be locked out for 15 minutes, after which you can try again.</p>
<span class="field"><br />
<br />
<a href="forgotpass.php">Return</a> to the login page.
</p>
<?php break; }
ob_flush();
$mySQL->close();
?>
</span></div></td>
</tr>
</table>
</body>
</html>
And this is the relevant part of the functions.php:
function sendPasswordEmail($userID)
{
global $mySQL;
if ($SQL = $mySQL->prepare("SELECT `Username`,`reg_email`,`Password` FROM `tutor_reg` WHERE `ID` = ? LIMIT 1"))
{
$SQL->bind_param('i',$userID);
$SQL->execute();
$SQL->store_result();
$SQL->bind_result($uname,$email,$pword);
$SQL->fetch();
$SQL->close();
$expFormat = mktime(date("H"), date("i"), date("s"), date("m") , date("d")+3, date("Y"));
$expDate = date("Y-m-d H:i:s",$expFormat);
$key = sha1($uname . '_' . $email . rand(0,10000) .$expDate );
if ($SQL = $mySQL->prepare("INSERT INTO `recoveryemails_enc` (`UserID`,`Key`,`expDate`) VALUES (?,?,?)"))
{
$SQL->bind_param('iss',$userID,$key,$expDate);
$SQL->execute();
$SQL->close();
$passwordLink = "<a href=\"?a=recover&email=" . $key . "&u=" . urlencode(base64_encode($userID)) . "\">http://www.bright-tutors.com/forgotpass.php?a=recover&email=" . $key . "&u=" . urlencode(base64_encode($userID)) . "</a>";
$message = "Dear $uname,<br/ >" .
$message ="Please visit the following link to reset your password:<br/ >" .
$message ="Please COPY and PASTE the entire link into your browser. <br/ >" .
$message ="$passwordLink<br/ >" .
$message ="The link will expire after 3 days for security reasons.<br/ >" .
$message ="If you did not request this forgotten password email, no action is needed, your password will not be reset as long as the link above is not visited.<br/ >" .
$message ="Thank You" .
$message ="--Bright-Tutors team<br/ >" .
$headers .= "From: Bright-Tutors <bright-tutors.com> \n";
$headers .= "To-Sender: \n";
$headers .= "X-Mailer: PHP\n"; // mailer
$headers .= "Reply-To: enquiries@bright-tutors\n"; // Reply address
$headers .= "Return-Path: liz.banbury@gmail.com\n"; //Return Path for errors
$headers .= "Content-Type: text/html; charset=iso-8859-1"; //Enc-type
$subject = "Your Lost Password";
@mail($email,$subject,$message,$headers);
return str_replace("\r\n","<br/ >",$message);
}
}
}
Help would be much appreciated as the site needs to be launched and this did used to work. I just have no idea why the email is not being sent.......
