· 9 years ago · Oct 17, 2016, 03:54 AM
1<?php
2session_start();
3require('../../../includes/config.php');
4require('../../../structure/database.php');
5require('../../../structure/base.php');
6require('../../../structure/user.php');
7
8$database = new database($db_host, $db_name, $db_user, $db_password);
9$base = new base($database);
10$user = new user($database);
11
12//set some basic vars
13$username = $user->getUsername($_COOKIE['user'], 2);
14$rank = $user->getRank($username);
15
16//no errors prevalent
17$err = 0;
18if(isset($_POST['password']) || isset($_POST['password2'])) {
19 if($_POST['password'] != $_POST['password2'])
20 {
21 $err = 1;
22 }
23
24 if($err == 0)
25 {
26 //generate a salt
27 $salt = substr(hash(sha256, sha1(time())), 10);
28 $requested_password = $salt.hash(sha256, md5(sha1($_POST['password']))).substr($salt, 0, -51);
29
30 $_SESSION['salt'] = $salt;
31 $_SESSION['password'] = $requested_password;
32 }
33}
34
35?>
36<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
37<html xmlns:IE>
38
39<head>
40 <meta http-equiv="Expires" content="0">
41 <meta http-equiv="Pragma" content="no-cache">
42 <meta http-equiv="Cache-Control" content="no-cache">
43 <meta name="MSSmartTagsPreventParsing" content="TRUE">
44 <meta http-equiv="Content-Type" content="text/html; charset=EUC-JP">
45 <title><?php echo $data['wb_title']; ?></title>
46 <link href="../../../css/basic-3.css" rel="stylesheet" type="text/css" media="all">
47 <link href="../../../css/main/title-5.css" rel="stylesheet" type="text/css" media="all">
48 <script src="http://code.jquery.com/jquery-latest.min.js"></script>
49 <link rel="shortcut icon" href="../../../img/favicon.ico"/>
50 <?php include('../../../includes/google_analytics.html'); ?>
51 <style>
52 fieldset {
53 text-align: left;
54 border: 2px solid #625437;
55 width: 95%;
56 position: relative;
57 margin: 10px;
58 padding-left: 10px;
59 background-color: transparent;
60 }
61
62 legend {
63 color: #625437;
64 font-weight: bold;
65 font-size: 15px;
66 }
67
68 label {
69 display: block;
70 height: 20px;
71 text-align: center;
72 }
73
74 textarea {
75 display: block;
76 width: 200px;
77 height: 100px;
78 }
79
80 </style>
81 <script type="text/javascript">
82 function goBack() {
83 window.history.back();
84 }
85 </script>
86</head>
87
88<div id="body">
89 <?php //$base->getNavBar($username, $path, $rank); ?>
90
91 <div style="text-align: center; background: none;">
92 <div class="titleframe e">
93 <b>Password Support</b><br/>
94 <a href="../../../index">Main Menu</a>
95 </div>
96 </div>
97</div>
98
99<div class="frame e" style="overflow:auto;">
100 <?php
101 //get the users registration date
102 $reg_date = $_POST['month'] . '-' . $_POST['year'];
103
104 //get the contents of the messages
105 $content = nl2br($_POST['message']);
106 if (isset($_POST['message'])) {
107 if (strlen($_POST['message']) > 300) {
108 $content = 'Your entry can\'t be longer than 300 characters!';
109 } else {
110
111 }
112 }
113
114 //make sure user doesn't already have a recovery request submitted
115 $database->processQuery("SELECT * FROM `tracking` WHERE " . time() . " - `time` < 7200 AND `ip` = ? LIMIT 1", array($_SERVER['REMOTE_ADDR']), false);
116
117 if ($database->getRowCount() >= 1) {
118 echo '<center>Oops! You have already submitted a recovery request.<br /><br /> <a href="../../../index"Main Menu</a></center>';
119
120 } elseif (!isset($_POST['username'])) {
121 ?>
122
123 <form action="recover_password.php" method="POST">
124 <input type="text" name="username" maxlength="12"><input type="submit" value="Continue">
125 </form>
126
127 <?php
128 } elseif (!$user->doesExist($_POST['username'])) {
129 echo 'No user exists with that username!<br /> <input type="button" value="Back" onclick="goBack()" />';
130 } else {
131
132 $questions[1] = 'Where was your first vacation? ';
133 $questions[2] = 'Who was your first bestfriend? ';
134 $questions[3] = 'Where were you born? ';
135 $questions[4] = 'What was your first pets name? ';
136 $questions[5] = 'Who was your first boyfriend/girlfriend? ';
137
138 //extract data
139 $data = $database->processQuery("SELECT * FROM `recoveries` WHERE `id` = ? LIMIT 1", array($user->getIdByName($_POST['username'])), false);
140
141 if ($database->getRowCount() == 0 || $user->getUsername($_COOKIE['user'], 2) == $_POST['username']) {
142 echo 'Temporarily disabled! <input type="button" value="Back" onclick="goBack()" />';
143 } elseif (!isset($_POST['answer']) && !isset($_POST['bypass'])) {
144 ?>
145 <fieldset class="question">
146 <legend>Important Information</legend>
147 This form will allow you to request that a new password is set for the account:
148 <b><?php echo '"' . $_POST['username'] . '"'; ?></b>.
149 <br/><br/>
150 <img style="float: left; padding-right: 1px" src="/img/title2/lock.gif">
151 <span style="font-weight: bold; color: rgb(255, 187, 34);">
152  Want to be back in game sooner? If you want to get back in game quickly, <br /> here are a few tips:</span><br /><br />
153
154  Please answer all the questions below to confirm that you are the real owner of the <br /> account.<br /><br />
155  Enter the earliest and most specific information about the account that you can.<br /><br />
156  Take the time to remember as much detail as possible. The more details you give us, <b><br /> the quicker you
157 can be
158 back in game</b>
159 <br/><br/>
160  If you really don't know the answer to a question, leave the answer box blank.<br/><br/>
161 <b>Remember:</b> The more questions you answer correctly, the sooner you can be back in game!
162 </fieldset>
163 <br/>
164 <fieldset class="question">
165 <legend>Answer Recovery Questions</legend>
166 <p style="text-align: center">If you have set these, you must try to answer at least three. Recovery
167 answers
168 have a minimum length of 3 characters.
169 Recovery answers can only contain the characters A-Z, 0-9 and accented characters such as é or
170 ü.
171 Other characters will not count towards the length.</p>
172
173 <label><b>I have not set any recovery questions</b>
174 <input type="checkbox" class="input_control" value="subject"/></label>
175
176 <form action="recover_password.php" method="POST">
177 <input type="hidden" name="username" value="<?php echo $_POST['username']; ?>">
178 <table cellpadding="6" style="margin-left:auto;margin-right:auto;">
179 <?php
180 $i = 0;
181 foreach ($questions as $question) {
182 $i++;
183 ?>
184 <tr>
185 </tr>
186 <tr>
187 <td><?php echo $question; ?> 
188 <input type="text" class="textbox" name="answer[]" maxlength="40" value=""
189 style="display: block; vertical-align: middle"></td>
190 </tr>
191 <?php
192 }
193 ?>
194 </table>
195 </form>
196 </fieldset>
197
198 <?php
199 if($err == 0) {
200 ?>
201 <form action="recover_password.php" method="POST">
202 <fieldset class="password">
203 <legend>Your New Password</legend>
204 <p style="text-align: center">These must match exactly for the appeal to proceed.<br/>
205 For advice on setting a good password, please click <a style="color: rgb(255, 187, 34);"
206 target="_blank"
207 href="/kbase/viewarticle7564.html?article_id=2087">here</a>
208 (Opens in a new window).</p>
209 <table>
210 <tr>
211 <td style="vertical-align: middle"><b>Enter a new password for your account:
212 <input id="password1" name="password" type="password" value="">
213 </td>
214 </tr>
215 <tr>
216 <td style="vertical-align: middle"d><b>          Please
217 enter it again: <input id="password2" name="password2" type="password" value=""></b></td>
218 </tr>
219 </table>
220 </fieldset>
221
222
223 <input type="hidden" name="username" value="<?php echo $_POST['username']; ?>">
224 <input type="hidden" name="bypass">
225 <fieldset class="details">
226 <legend>Other Details</legend>
227 <p style="float: left">When did you create this account? Giving<br/> us both month and year really helps!
228 <span style=" position: absolute; top: 30px; left: 265px">
229 <!-- Month dropdown -->
230 <select name="month" id="reg_date" onchange="" size="1">
231 <option value="January">January</option>
232 <option value="February">February</option>
233 <option value="March">March</option>
234 <option value="April">April</option>
235 <option value="May">May</option>
236 <option value="June">June</option>
237 <option value="July">July</option>
238 <option value="August">August</option>
239 <option value="September">September</option>
240 <option value="October">October</option>
241 <option value="November">November</option>
242 <option value="December">December</option>
243 </select>
244
245 <!-- Year dropdown -->
246 <select name="year" id="reg_date" onchange="" size="1">
247 <option value="2016">2016</option>
248 <option value="2015">2015</option>
249 </select>
250 </span>
251 </p>
252
253 <table>
254 <tr>
255 <td style="vertical-align: middle">
256 If you have any other details which would help you prove your ownership of this
257 account, please enter them here.<br/>
258 Please <b>do not</b> provide us with any of this following personal information, your full
259 name, home
260 address, email address or telephone number.<br/><br/>
261 <span class='textcounter' id="counter1">You have 300 characters remaining</span>
262 </td>
263 <td>
264 <textarea style="height: 120px; width: 450px;" name="message" class="textlimited"
265 data-textcounterid="counter1" maxlength="300" rows="4" cols="50"></textarea><br/>
266 <input type="submit" value="Submit" id="submit" required/>
267 </td>
268 </tr>
269 </table>
270 </form>
271 </fieldset>
272
273 <?php
274 } else {
275 echo '<center>';
276
277 switch($err)
278 {
279 case 1:
280 echo 'The passwords you entered did not match. <input type="button" value="Back" onclick="goBack()" />';
281 break;
282 default:
283 echo 'Undefined error. <input type="button" value="Back" onclick="goBack()" />';
284 break;
285 }
286
287 echo '</center>';
288 }
289
290 } else
291if (isset($_POST['answers'])) {
292 //validate answers
293 $errors = array();
294 $answers = $_POST['answer'];
295 $i = 0;
296
297 foreach ($answers as $answer) {
298 $i++;
299
300 if (strlen($answer) < 3 || strlen($answer) > 40) {
301 $errors[] = 'Question #' . $i . ' must be at least three characters and no more than 26 characters.';
302 }
303
304 if (preg_match('#[^a-zA-Z0-9$/^[\p{L}-]*$/u ]#', $answer)) {
305 $errors[] = 'Question #' . $i . ' contains illegal characters.';
306 }
307 }
308
309 if (count($errors) >= 1) {
310 //back button
311 ?>
312 <center><input type="button" value="Back" onclick="goBack()"/></center> <?php
313
314 //display errors
315 foreach ($errors as $error) {
316 echo $error . '<br/>';
317 }
318 } else {
319 //generate a tracking ID
320 $rand_hash = $base->randomString(11);
321 $tracking_id = substr($rand_hash, 0, 3) . '-' . substr($rand_hash, 4, 3) . '-' . substr($rand_hash, 7, 3);
322
323 //create the recovery request
324 $database->processQuery("INSERT INTO `tracking` VALUES (null, ?, ?, NOW(), ?, ?, 0, ?, ?, ?, ?, ?, ?, ?, ?)", array($user->getIdByName($_POST['username']), $_SERVER['REMOTE_ADDR'], time(), $tracking_id, $answers[1], $answers[2], $answers[3], $answers[4], $answers[5], $content, $reg_date, $requested_password), false);
325
326 ?>
327 <fieldset class="question">
328 <legend>Success!</legend>
329 You have successfully submitted an account recovery request. Your request will be
330 reviewed and processed within the next 48 hours. To track your account recovery
331 progress you can use the <b>recovery tracking ID</b>.<br><br> <b>Please make
332 note</b> of the the tracking ID provided to you and store it in a <b>safe</b>,
333 <b>secure</b> location so you don't lose or forget it.</b>
334 </fieldset>
335 <br/>
336 <br/>
337 <b>Tracking ID: <?php echo $tracking_id; ?></b>
338
339 <?php
340 }
341} else if (isset($_POST['bypass'])) {
342 //generate a tracking ID
343 $rand_hash = $base->randomString(11);
344 $tracking_id = substr($rand_hash, 0, 3) . '-' . substr($rand_hash, 4, 3) . '-' . substr($rand_hash, 7, 3);
345
346 //create the recovery request
347 $database->processQuery("INSERT INTO `tracking` VALUES (null, ?, ?, NOW(), ?, ?, 0, ?, ?, ?, ?, ?, ?, ?, ?)", array($user->getIdByName($_POST['username']), $_SERVER['REMOTE_ADDR'], time(), $tracking_id, 'answer1', 'answer2', 'answer3', 'answer4', 'answer5', $content, $reg_date, $requested_password), false);
348
349 ?>
350 <fieldset class="question">
351 <legend>Success!</legend>
352 You have successfully submitted an account recovery request. Your request will be
353 reviewed and processed within the next 48 hours. To track your account recovery
354 progress you can use the <b>recovery tracking ID</b>.<br><br> <b>Please make
355 note</b> of the the tracking ID provided to you and store it in a <b>safe</b>,
356 <b>secure</b> location so you don't lose or forget it.</b>
357 </fieldset>
358 <br/>
359 <br/>
360 <b>Tracking ID: <?php echo $tracking_id; ?></b>
361
362 <?php
363} else {
364 echo 'Error: dead end.';
365 }
366}
367 ?>
368 <br/>
369 <br/>
370
371 <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
372 <script type="text/javascript">
373 //checks how many characters are remaining
374 // the selector below will catch the keyup events of elements decorated with class textlimited and have a maxlength
375 $('.textlimited[maxlength]').keyup(function () {
376 //get the fields limit
377 var maxLength = $(this).attr("maxlength");
378
379 // check if the limit is passed
380 if (this.value.length > maxLength) {
381 return false;
382 }
383
384 // find the counter element by the id specified in the source input element
385 var counterElement = $(".textcounter#" + $(this).data("textcounterid"));
386 // update counter 's text
387 counterElement.html("You have " + (maxLength - this.value.length) + " chararacters remaining");
388 });
389
390 //checks if the user has selected no recoveries and disables the textareas
391 $(document).ready(function () {
392 $('.input_control').change(function () {
393 $(".textbox").prop('disabled', this.checked);
394 $(".textarea").prop('disabled', this.checked);
395 });
396 $('.input_control').prop('checked', false);
397 $('.input_control').trigger('change');
398 });
399
400 //limits the characters input in the 'other details' text area
401 function charLimit(limitField, limitNum) {
402 if (limitField.value.length > limitNum) {
403 limitField.value = limitField.value.substring(0, limitNum);
404 }
405 }
406 </script>
407 <div style="clear: both;"></div>
408</div>
409</div>
410</div>
411</div>
412
413<div class="tandc"><?php echo $data['wb_foot']; ?></div>
414</div>
415</body>
416</html>