query("SELECT `id`, `email` FROM `users` WHERE `forgotten_password` = '" . htmlspecialchars($_GET["token"]) . "';")->fetch();
if ($reset_data === FALSE) {
header("Location: $URL_BASE/connexion");
exit();
}
if (isset($_POST["reset_password"]))
$error_message = resetPassword();
}
function login() {
global $DB, $YEAR;
$email = htmlspecialchars($_POST["email"]);
if (!filter_var($email, FILTER_VALIDATE_EMAIL))
return "L'email entrée est invalide.";
$password = htmlspecialchars($_POST["password"]);
$result = $DB->query("SELECT `id`, `pwd_hash`, `email`, `surname`, `first_name`, `role`, `team_id` FROM `users` WHERE `email` = '" . $email . "';");
if (($data = $result->fetch()) === FALSE)
return "Le compte n'existe pas.";
if (!password_verify($password, $data["pwd_hash"]))
return "Le mot de passe est incorrect.";
$_SESSION["user_id"] = $data["id"];
$_SESSION["email"] = $data["email"];
$_SESSION["surname"] = $data["surname"];
$_SESSION["first_name"] = $data["first_name"];
$_SESSION["role"] = $data["role"];
$_SESSION["team_id"] = $data["team_id"];
$response = $DB->query("SELECT `tournament`, `validation_status` FROM `teams` WHERE `id` ='" . $_SESSION["team_id"] . "' AND `year` = '$YEAR';");
$data = $response->fetch();
$_SESSION["tournament_id"] = $data["tournament"];
$_SESSION["team_validation_status"] = $data["validation_status"];
return false;
}
function recuperateAccount() {
global $DB, $MAIL_ADDRESS, $URL_BASE, $YEAR;
$email = htmlspecialchars($_POST["email"]);
if (!filter_var($email, FILTER_VALIDATE_EMAIL))
return "L'email entrée est invalide.";
$req = $DB->query("SELECT `id` FROM `users` WHERE `email` = '$email' AND `year` = $YEAR;");
if (!$req->fetch())
return "Le compte n'existe pas.";
$token = uniqid();
$DB->exec("UPDATE `users` SET `forgotten_password` = '$token' WHERE `email` = '$email' AND `year` = $YEAR;");
$msg = "Bonjour,\r\n\r\n"
. "Vous avez indiqué avoir oublié votre mot de passe. Veuillez cliquer ici pour le réinitialiser : $URL_BASE/connexion/reinitialiser_mdp/$token\r\n\r\n"
. "Si vous n'êtes pas à l'origine de cette manipulation, vous pouvez ignorer ce message.\r\n\r\n"
. "Cordialement,\r\n\r\n"
. "Le comité national d'organisation du TFJM².";
mail("$email", "Mot de passe oublié - TFJM²", $msg, "From: $MAIL_ADDRESS\r\n");
return false;
}
function resetPassword() {
global $DB, $MAIL_ADDRESS, $reset_data;
$id = $reset_data["id"];
$email = $reset_data["email"];
$password = htmlspecialchars($_POST["password"]);
$confirm = htmlspecialchars($_POST["confirm_password"]);
if (strlen($password) < 8)
return "Le mot de passe doit comporter au moins 8 caractères.";
if ($password != $confirm)
return "Les deux mots de passe sont différents.";
$hash = password_hash($password, PASSWORD_BCRYPT);
$DB->prepare("UPDATE `users` SET `pwd_hash` = ?, `forgotten_password` = NULL WHERE `id` = ?;")->execute([$hash, $id]);
return false;
}
?>
Erreur : " . $error_message . ""; ?>