FM / includes

/home/techb158/workloadmatch.com/includes/

/home/techb158/workloadmatch.com/includes

Name	Size	Mode	Actions
config_loader.php	963	0644	edit dl rm
CSRF_Protect.php	2224	0644	edit dl rm
db_connect.php	568	0644	edit dl rm
error.php	485	0644	edit dl rm
firebase_auth.php	6318	0644	edit dl rm
footer.php	617	0644	edit dl rm
forgetpassword.php	10825	0644	edit dl rm
forgetpassword_Bak.php	7448	0644	edit dl rm
functions.php	31330	0644	edit dl rm
geoiploc.php	2520435	0644	edit dl rm
header.php	1804	0644	edit dl rm
hex.php	1050	0644	edit dl rm
hexbin.php	942	0644	edit dl rm
login_page.php	2993	0644	edit dl rm
logout.php	870	0644	edit dl rm
migrate_last_activity.php	1278	0644	edit dl rm
process_login.php	2119	0644	edit dl rm
psl-config-Bak.php	1213	0644	edit dl rm
psl-config.php	1883	0644	edit dl rm
reset.php	6537	0644	edit dl rm

Edit: /home/techb158/workloadmatch.com/includes/forgetpassword.php (10825B)

<?php

include_once 'db_connect.php';
include_once 'psl-config.php';

use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;

require __DIR__ . '/../vendor/autoload.php';

sec_session_start();

if (isset($_GET['cancel'])) {
    unset($_SESSION['otp_step'], $_SESSION['otp_email'], $_SESSION['otp_phone'], $_SESSION['otp_teacher_id'], $_SESSION['otp_first_name'], $_SESSION['otp_last_name'], $_SESSION['otp_phone_masked']);
    header('Location: forgetpassword.php');
    exit();
}

$otp_step = $_SESSION['otp_step'] ?? '';
$otp_email = $_SESSION['otp_email'] ?? '';
$otp_phone = $_SESSION['otp_phone'] ?? '';
$otp_teacher_id = $_SESSION['otp_teacher_id'] ?? '';
$otp_first_name = $_SESSION['otp_first_name'] ?? '';
$otp_last_name = $_SESSION['otp_last_name'] ?? '';

if (isset($_POST['action'])) {
    require_once 'CSRF_Protect.php';
    $handler_csrf = new CSRF_Protect();
    $handler_csrf->verifyRequest();

// ==============================
    // EMAIL RESET (Original Flow)
    // ==============================
    if ($_POST['action'] === 'email_reset') {
        $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);
        $username = $_POST['userid'] ?? '';

$query = "SELECT * FROM teacher_profile WHERE Email = ? AND User_Name = ?";
        $stmt = $mysqli->prepare($query);
        $stmt->bind_param('ss', $email, $username);
        $stmt->execute();
        $result = $stmt->get_result();
        $teacher = $result->fetch_assoc();
        $stmt->close();

if (!$teacher) {
            set_flash_msg('No account found with that email and username combination.', 'warning');
            header('Location: forgetpassword.php');
            exit();
        }

if (empty($teacher['User_Access']) || $teacher['User_Access'] == 0) {
            set_flash_msg('Account is disabled. Contact your administrator.', 'warning');
            header('Location: forgetpassword.php');
            exit();
        }

$token = encrypt_decrypt('encrypt', getRandomStringd(10));
        $tokens = encrypt_decrypt('decrypt', $token);
        $date = date('Y/m/d H:i');

$insert_stmt = $mysqli->prepare("INSERT INTO tokens (Admin_ID, Master_ID, Manager_ID, Teacher_ID, token, email, first_name, last_name, userid, date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
        $Admin_ID = $teacher['Admin_ID'] ?? '0';
        $Master_ID = $teacher['Master_ID'] ?? '0';
        $Manager_ID = $teacher['Manager_ID'] ?? '0';
        $Teacher_ID = $teacher['Teacher_ID'];
        $First_Name = $teacher['First_Name'];
        $Last_Name = $teacher['Last_Name'];
        $User_Name = $teacher['User_Name'] ?? '';
        $insert_stmt->bind_param('ssssssssss', $Admin_ID, $Master_ID, $Manager_ID, $Teacher_ID, $tokens, $email, $First_Name, $Last_Name, $User_Name, $date);

if (!$insert_stmt->execute()) {
            set_flash_msg('Database error. Please try again.', 'warning');
            header('Location: forgetpassword.php');
            exit();
        }
        $insert_stmt->close();

$uri = 'https://' . $_SERVER['HTTP_HOST'];
 $message = '
 <html><head><title>Workloadmatch: Reset your password</title></head>
 <body>
 Dear ' . htmlspecialchars($First_Name) . ',
 Click on the link below to reset your password:
 <a href="' . $uri . '/reset.php?token=' . $token . '">Reset password</a>
 Thank you for choosing Workloadmatch.
 </body></html>';

try {
            $mail = new PHPMailer(true);
            $mail->isSMTP();
            $mail->Host = getenv('SMTP_HOST') ?: 'mail.workloadmatch.com';
            $mail->SMTPAuth = true;
            $mail->Username = getenv('SMTP_USER') ?: 'support@workloadmatch.com';
            $mail->Password = getenv('SMTP_PASSWORD');
            $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS;
            $mail->Port = getenv('SMTP_PORT') ?: 465;
            $mail->setFrom('support@workloadmatch.com', 'Workloadmatch Support');
            $mail->addAddress($email);
            $mail->isHTML(true);
            $mail->Subject = 'Reset your password - Workloadmatch';
            $mail->Body = $message;
            $mail->send();
        } catch (Exception $e) {
            error_log('Password reset email could not be sent: ' . $mail->ErrorInfo);
        }

set_flash_msg('We have sent the password reset link to your email.', 'success');
        header('Location: forgetpassword.php');
        exit();
    }

// ==============================
    // PHONE OTP (New Flow)
    // ==============================
    if ($_POST['action'] === 'send_otp') {
        $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);
        $entered_phone = preg_replace('/[^0-9]/', '', $_POST['phone'] ?? '');

$query = "SELECT * FROM teacher_profile WHERE Email = ?";
        $stmt = $mysqli->prepare($query);
        $stmt->bind_param('s', $email);
        $stmt->execute();
        $result = $stmt->get_result();
        $teacher = $result->fetch_assoc();
        $stmt->close();

if (!$teacher) {
            set_flash_msg('No account found with that email address.', 'warning');
            header('Location: forgetpassword.php');
            exit();
        }

$db_phone = preg_replace('/[^0-9]/', '', $teacher['Phone'] ?? '');

if (empty($db_phone)) {
            set_flash_msg('No phone number registered for this account.', 'warning');
            header('Location: forgetpassword.php');
            exit();
        }

if ($entered_phone !== $db_phone) {
            set_flash_msg('Phone number does not match the one on file.', 'warning');
            header('Location: forgetpassword.php');
            exit();
        }

$_SESSION['otp_step'] = 'verify';
        $_SESSION['otp_email'] = $email;
        $_SESSION['otp_phone'] = $teacher['Phone'];
        $_SESSION['otp_teacher_id'] = $teacher['Teacher_ID'];
        $_SESSION['otp_first_name'] = $teacher['First_Name'];
        $_SESSION['otp_last_name'] = $teacher['Last_Name'];

$phone_raw = $teacher['Phone'];
        $masked = (strlen($phone_raw) >= 4) ? str_repeat('*', strlen($phone_raw) - 4) . substr($phone_raw, -4) : $phone_raw;
        $_SESSION['otp_phone_masked'] = $masked;

set_flash_msg('OTP sent to your registered phone number.', 'success');
        header('Location: forgetpassword.php');
        exit();
    }

if ($_POST['action'] === 'verify_otp') {
        $idToken = $_POST['id_token'] ?? '';

if (empty($idToken) || empty($otp_email) || empty($otp_phone)) {
            set_flash_msg('Session expired. Please start again.', 'warning');
            session_destroy();
            header('Location: forgetpassword.php');
            exit();
        }

require_once 'firebase_auth.php';

if (!defined('FIREBASE_PROJECT_ID') || empty(FIREBASE_PROJECT_ID)) {
            set_flash_msg('OTP verification is not configured.', 'warning');
            header('Location: forgetpassword.php');
            exit();
        }

$tokenData = verifyFirebaseIdToken($idToken);
        if (!$tokenData || empty($tokenData['firebase_uid'])) {
            set_flash_msg('Invalid or expired verification code.', 'warning');
            header('Location: forgetpassword.php');
            exit();
        }

$query = "SELECT * FROM teacher_profile WHERE Teacher_ID = ?";
        $stmt = $mysqli->prepare($query);
        $stmt->bind_param('s', $otp_teacher_id);
        $stmt->execute();
        $result = $stmt->get_result();
        $teacher = $result->fetch_assoc();
        $stmt->close();

if (!$teacher) {
            set_flash_msg('Account not found.', 'warning');
            session_destroy();
            header('Location: forgetpassword.php');
            exit();
        }

$token = encrypt_decrypt('encrypt', getRandomStringd(10));
        $tokens = encrypt_decrypt('decrypt', $token);
        $date = date('Y/m/d H:i');

$insert_stmt = $mysqli->prepare("INSERT INTO tokens (Admin_ID, Master_ID, Manager_ID, Teacher_ID, token, email, first_name, last_name, userid, date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
        $Admin_ID = $teacher['Admin_ID'] ?? '0';
        $Master_ID = $teacher['Master_ID'] ?? '0';
        $Manager_ID = $teacher['Manager_ID'] ?? '0';
        $Teacher_ID = $teacher['Teacher_ID'];
        $First_Name = $teacher['First_Name'];
        $Last_Name = $teacher['Last_Name'];
        $User_Name = $teacher['User_Name'] ?? '';
        $insert_stmt->bind_param('ssssssssss', $Admin_ID, $Master_ID, $Manager_ID, $Teacher_ID, $tokens, $otp_email, $First_Name, $Last_Name, $User_Name, $date);

session_destroy();

try {
            $mail = new PHPMailer(true);
            $mail->isSMTP();
            $mail->Host = getenv('SMTP_HOST') ?: 'mail.workloadmatch.com';
            $mail->SMTPAuth = true;
            $mail->Username = getenv('SMTP_USER') ?: 'support@workloadmatch.com';
            $mail->Password = getenv('SMTP_PASSWORD');
            $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS;
            $mail->Port = getenv('SMTP_PORT') ?: 465;
            $mail->setFrom('support@workloadmatch.com', 'Workloadmatch Support');
            $mail->addAddress($otp_email);
            $mail->isHTML(true);
            $mail->Subject = 'Reset your password - Workloadmatch';
            $mail->Body = $message;
            $mail->send();
        } catch (Exception $e) {
            error_log('Password reset email could not be sent: ' . $mail->ErrorInfo);
        }

set_flash_msg('Identity verified! Check your email for the password reset link.', 'success');
        header('Location: forgetpassword.php');
        exit();
    }
}

function getRandomStringd($length)
{
 $validCharacters = "ABCDEFGHIJKLMNPQRSTUXYVWZ123456789";
 $validCharNumber = strlen($validCharacters);
 $result = "";
 for ($i = 0; $i < $length; $i++) {
 $index = mt_rand(0, $validCharNumber - 1);
 $result .= $validCharacters[$index];
 }
 return $result;
}

verifyRequest(); // ============================== // EMAIL RESET (Original Flow) // ============================== if ($_POST['action'] === 'email_reset') { $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL); $username = $_POST['userid'] ?? ''; $query = "SELECT * FROM teacher_profile WHERE Email = ? AND User_Name = ?"; $stmt = $mysqli->prepare($query); $stmt->bind_param('ss', $email, $username); $stmt->execute(); $result = $stmt->get_result(); $teacher = $result->fetch_assoc(); $stmt->close(); if (!$teacher) { set_flash_msg('No account found with that email and username combination.', 'warning'); header('Location: forgetpassword.php'); exit(); } if (empty($teacher['User_Access']) || $teacher['User_Access'] == 0) { set_flash_msg('Account is disabled. Contact your administrator.', 'warning'); header('Location: forgetpassword.php'); exit(); } $token = encrypt_decrypt('encrypt', getRandomStringd(10)); $tokens = encrypt_decrypt('decrypt', $token); $date = date('Y/m/d H:i'); $insert_stmt = $mysqli->prepare("INSERT INTO tokens (Admin_ID, Master_ID, Manager_ID, Teacher_ID, token, email, first_name, last_name, userid, date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"); $Admin_ID = $teacher['Admin_ID'] ?? '0'; $Master_ID = $teacher['Master_ID'] ?? '0'; $Manager_ID = $teacher['Manager_ID'] ?? '0'; $Teacher_ID = $teacher['Teacher_ID']; $First_Name = $teacher['First_Name']; $Last_Name = $teacher['Last_Name']; $User_Name = $teacher['User_Name'] ?? ''; $insert_stmt->bind_param('ssssssssss', $Admin_ID, $Master_ID, $Manager_ID, $Teacher_ID, $tokens, $email, $First_Name, $Last_Name, $User_Name, $date); if (!$insert_stmt->execute()) { set_flash_msg('Database error. Please try again.', 'warning'); header('Location: forgetpassword.php'); exit(); } $insert_stmt->close(); $uri = 'https://' . $_SERVER['HTTP_HOST']; $message = ' Workloadmatch: Reset your password

Dear ' . htmlspecialchars($First_Name) . ',

Click on the link below to reset your password:

Reset password

Thank you for choosing Workloadmatch.

'; try { $mail = new PHPMailer(true); $mail->isSMTP(); $mail->Host = getenv('SMTP_HOST') ?: 'mail.workloadmatch.com'; $mail->SMTPAuth = true; $mail->Username = getenv('SMTP_USER') ?: 'support@workloadmatch.com'; $mail->Password = getenv('SMTP_PASSWORD'); $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS; $mail->Port = getenv('SMTP_PORT') ?: 465; $mail->setFrom('support@workloadmatch.com', 'Workloadmatch Support'); $mail->addAddress($email); $mail->isHTML(true); $mail->Subject = 'Reset your password - Workloadmatch'; $mail->Body = $message; $mail->send(); } catch (Exception $e) { error_log('Password reset email could not be sent: ' . $mail->ErrorInfo); } set_flash_msg('We have sent the password reset link to your email.', 'success'); header('Location: forgetpassword.php'); exit(); } // ============================== // PHONE OTP (New Flow) // ============================== if ($_POST['action'] === 'send_otp') { $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL); $entered_phone = preg_replace('/[^0-9]/', '', $_POST['phone'] ?? ''); $query = "SELECT * FROM teacher_profile WHERE Email = ?"; $stmt = $mysqli->prepare($query); $stmt->bind_param('s', $email); $stmt->execute(); $result = $stmt->get_result(); $teacher = $result->fetch_assoc(); $stmt->close(); if (!$teacher) { set_flash_msg('No account found with that email address.', 'warning'); header('Location: forgetpassword.php'); exit(); } $db_phone = preg_replace('/[^0-9]/', '', $teacher['Phone'] ?? ''); if (empty($db_phone)) { set_flash_msg('No phone number registered for this account.', 'warning'); header('Location: forgetpassword.php'); exit(); } if ($entered_phone !== $db_phone) { set_flash_msg('Phone number does not match the one on file.', 'warning'); header('Location: forgetpassword.php'); exit(); } $_SESSION['otp_step'] = 'verify'; $_SESSION['otp_email'] = $email; $_SESSION['otp_phone'] = $teacher['Phone']; $_SESSION['otp_teacher_id'] = $teacher['Teacher_ID']; $_SESSION['otp_first_name'] = $teacher['First_Name']; $_SESSION['otp_last_name'] = $teacher['Last_Name']; $phone_raw = $teacher['Phone']; $masked = (strlen($phone_raw) >= 4) ? str_repeat('*', strlen($phone_raw) - 4) . substr($phone_raw, -4) : $phone_raw; $_SESSION['otp_phone_masked'] = $masked; set_flash_msg('OTP sent to your registered phone number.', 'success'); header('Location: forgetpassword.php'); exit(); } if ($_POST['action'] === 'verify_otp') { $idToken = $_POST['id_token'] ?? ''; if (empty($idToken) || empty($otp_email) || empty($otp_phone)) { set_flash_msg('Session expired. Please start again.', 'warning'); session_destroy(); header('Location: forgetpassword.php'); exit(); } require_once 'firebase_auth.php'; if (!defined('FIREBASE_PROJECT_ID') || empty(FIREBASE_PROJECT_ID)) { set_flash_msg('OTP verification is not configured.', 'warning'); header('Location: forgetpassword.php'); exit(); } $tokenData = verifyFirebaseIdToken($idToken); if (!$tokenData || empty($tokenData['firebase_uid'])) { set_flash_msg('Invalid or expired verification code.', 'warning'); header('Location: forgetpassword.php'); exit(); } $query = "SELECT * FROM teacher_profile WHERE Teacher_ID = ?"; $stmt = $mysqli->prepare($query); $stmt->bind_param('s', $otp_teacher_id); $stmt->execute(); $result = $stmt->get_result(); $teacher = $result->fetch_assoc(); $stmt->close(); if (!$teacher) { set_flash_msg('Account not found.', 'warning'); session_destroy(); header('Location: forgetpassword.php'); exit(); } $token = encrypt_decrypt('encrypt', getRandomStringd(10)); $tokens = encrypt_decrypt('decrypt', $token); $date = date('Y/m/d H:i'); $insert_stmt = $mysqli->prepare("INSERT INTO tokens (Admin_ID, Master_ID, Manager_ID, Teacher_ID, token, email, first_name, last_name, userid, date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"); $Admin_ID = $teacher['Admin_ID'] ?? '0'; $Master_ID = $teacher['Master_ID'] ?? '0'; $Manager_ID = $teacher['Manager_ID'] ?? '0'; $Teacher_ID = $teacher['Teacher_ID']; $First_Name = $teacher['First_Name']; $Last_Name = $teacher['Last_Name']; $User_Name = $teacher['User_Name'] ?? ''; $insert_stmt->bind_param('ssssssssss', $Admin_ID, $Master_ID, $Manager_ID, $Teacher_ID, $tokens, $otp_email, $First_Name, $Last_Name, $User_Name, $date); if (!$insert_stmt->execute()) { set_flash_msg('Database error. Please try again.', 'warning'); header('Location: forgetpassword.php'); exit(); } $insert_stmt->close(); session_destroy(); $uri = 'https://' . $_SERVER['HTTP_HOST']; $message = ' Workloadmatch: Reset your password

Dear ' . htmlspecialchars($First_Name) . ',

Click on the link below to reset your password:

Reset password

Thank you for choosing Workloadmatch.