· 9 years ago · Oct 14, 2016, 03:10 AM
1<?php
2session_start();
3
4error_reporting(E_ALL);
5ini_set('display_errors', true);
6ini_set('scream.enabled', false);
7
8require('../../../includes/config.php');
9require('../../../structure/database.php');
10require('../../../structure/base.php');
11require('../../../structure/user.php');
12
13$database = new database($db_host, $db_name, $db_user, $db_password);
14$base = new base($database);
15$user = new user($database);
16
17//set some basic vars
18$username = $user->getUsername($_COOKIE['user'], 2);
19$rank = $user->getRank($username);
20
21$err = 0;
22
23if(isset($_POST['password']) && isset($_POST['password2'])) {
24 //generate a salt
25 $salt = substr(hash(sha256, sha1(time())), 10);
26 $password = $salt.hash(sha256, md5(sha1($_POST['password']) && $_POST['password2'])).substr($salt, 0, -51);
27
28 $_SESSION['salt'] = $salt;
29 $_SESSION['password'] = $password;
30}
31
32
33?>
34<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
35<html xmlns:IE>
36
37<head>
38 <meta http-equiv="Expires" content="0">
39 <meta http-equiv="Pragma" content="no-cache">
40 <meta http-equiv="Cache-Control" content="no-cache">
41 <meta name="MSSmartTagsPreventParsing" content="TRUE">
42 <meta http-equiv="Content-Type" content="text/html; charset=EUC-JP">
43 <title><?php echo $data['wb_title']; ?></title>
44 <link href="../../../css/basic-3.css" rel="stylesheet" type="text/css" media="all">
45 <link href="../../../css/main/title-5.css" rel="stylesheet" type="text/css" media="all">
46 <script src="http://code.jquery.com/jquery-latest.min.js"></script>
47 <link rel="shortcut icon" href="../../../img/favicon.ico"/>
48 <?php include('../../../includes/google_analytics.html'); ?>
49 <style>
50 fieldset {
51 text-align: left;
52 border: 2px solid #625437;
53 width: 95%;
54 position: relative;
55 margin: 10px;
56 padding-left: 10px;
57 background-color: transparent;
58 }
59
60 legend {
61 color: #625437;
62 font-weight: bold;
63 font-size: 15px;
64 }
65
66 label {
67 display: block;
68 height: 20px;
69 text-align: center;
70 }
71
72 textarea {
73 display: block;
74 width: 200px;
75 height: 100px;
76 }
77
78 </style>
79 <script type="text/javascript">
80 function goBack() {
81 window.history.back();
82 }
83 </script>
84</head>
85
86<div id="body">
87 <?php //$base->getNavBar($username, $path, $rank); ?>
88
89 <div style="text-align: center; background: none;">
90 <div class="titleframe e">
91 <b>Password Support</b><br/>
92 <a href="../../../index">ScapeRune Home</a>
93 </div>
94 </div>
95</div>
96
97<div class="frame e" style="overflow:auto;">
98 <?php
99 //get the users registration date
100 $reg_date = $_POST['month'] . '-' . $_POST['year'];
101
102 //get the contents of the messages
103 $content = nl2br($_POST['message']);
104 if (isset($_POST['message'])) {
105 if (strlen($_POST['message']) > 300) {
106 $content = 'Your entry can\'t be longer than 300 characters!';
107 } else {
108
109 }
110 }
111
112 //make sure user doesn't already have a recovery request submitted
113 $database->processQuery("SELECT * FROM `tracking` WHERE " . time() . " - `time` < 7200 AND `ip` = ? LIMIT 1", array($_SERVER['REMOTE_ADDR']), false);
114
115 if ($database->getRowCount() >= 1) {
116 echo '<center>Oops! You have already submitted a recovery request.<br /><br /> <a href="../../../index"Main Menu</a></center>';
117
118 } elseif (!isset($_POST['username'])) {
119 ?>
120
121 <form action="recover_password.php" method="POST">
122 <input type="text" name="username" maxlength="12"><input type="submit" value="Continue">
123 </form>
124
125 <?php
126 } elseif (!$user->doesExist($_POST['username'])) {
127 echo 'No user exists with that username!<br /> <input type="button" value="Back" onclick="goBack()" />';
128 } else {
129
130 $questions[] = array();
131 $questions[0] = 'Where was your first vacation?:';
132 $questions[1] = 'Who was your first best friend?:';
133 $questions[2] = 'What was your first pets name?:';
134 $questions[3] = 'Who was your first boyfriend/girlfriend?:';
135 $questions[4] = 'What color was your first bedroom?:';
136 $questions[5] = 'Who is your favorite musical artist?';
137
138 //extract data
139 $data = $database->processQuery("SELECT * FROM `recoveries` WHERE `id` = ? LIMIT 1", array($user->getIdByName($_POST['username'])), false);
140
141 if ($database->getRowCount() == 0 || $user->getUsername($_COOKIE['user'], 2) == $_POST['username']) {
142 echo 'Temporarily disabled! <input type="button" value="Back" onclick="goBack()" />';
143 } elseif (!isset($_POST['answer']) && !isset($_POST['bypass'])) {
144 ?>
145 <fieldset class="question">
146 <legend>Important Information</legend>
147 This form will allow you to request that a new password is set for the account:
148 <b><?php echo '"' . $_POST['username'] . '"'; ?></b>.
149 <br/><br/>
150 <img style="float: left; padding-right: 1px" src="/img/title2/lock.gif">
151 <span style="font-weight: bold; color: rgb(255, 187, 34);">
152  Want to be back in game sooner? If you want to get back in game quickly, <br /> here are a few tips:</span><br /><br />
153
154  Please answer all the questions below to confirm that you are the real owner of the <br /> account.<br /><br />
155  Enter the earliest and most specific information about the account that you can.<br /><br />
156  Take the time to remember as much detail as possible. The more detail you give us, <b><br /> the quicker you
157 can be
158 back in game</b>
159 <br/><br/>
160  If you really don't know the answer to a question, leave the answer box blank.<br/><br/>
161 <b>Remember:</b> The more questions you answer correctly, the sooner you can be back in game!
162 </fieldset>
163 <br/>
164 <fieldset class="question">
165 <legend>Answer Recovery Questions</legend>
166 <p style="text-align: center">If you have set these, you must try to answer at least three. Recovery
167 answers
168 have a minimum length of 3 characters.
169 Recovery answers can only contain the characters A-Z, 0-9 and accented characters such as é or
170 ü.
171 Other characters will not count towards the length.</p>
172
173 <label><b>I have not set any recovery questions</b>
174 <input type="checkbox" class="input_control" value="subject"/></label>
175
176 <form action="recover_password.php" method="POST">
177 <input type="hidden" name="username" value="<?php echo $_POST['username']; ?>">
178 <table cellpadding="6" style="margin-left:auto;margin-right:auto;">
179 <?php
180 $i = 0;
181 foreach ($questions as $question) {
182 $i++;
183 ?>
184 <tr>
185 </tr>
186 <tr>
187 <td><?php echo $question; ?> 
188 <input type="text" class="textbox" name="answer[]" maxlength="40"
189 style="display: block;"></td>
190 </tr>
191 <?php
192 }
193 ?>
194 </table>
195 </form>
196 </fieldset>
197
198 <?php/*
199 if(err == 0) {
200 */?>
201 <fieldset class="password">
202 <legend>Your New Password</legend>
203 <p style="text-align: center">These must match exactly for the appeal to proceed.<br/>
204 For advice on setting a good password, please click <a style="color: rgb(255, 187, 34);"
205 target="_blank"
206 href="/kbase/viewarticle7564.html?article_id=2087">here</a>
207 (Opens in a new window).</p>
208 <table>
209 <tr>
210 <td style="vertical-align: middle"><b>Enter a new password for your account:
211 <input id="password1" name="password" type="password" autocomplete="off" value="" maxlength="20"></b>
212 </td>
213 </tr>
214 <tr>
215 <td style="vertical-align: middle"><b>          Please
216 enter it again: <input id="password2" name="password2" type="password" autocomplete="off" value="" maxlength="20"></b></td>
217 </tr>
218 </table>
219 </fieldset>
220
221 <?php
222 /*}
223
224 if(err == 2) {
225 echo 'Passwords do not match!';
226 }
227
228 */?>
229
230
231 <form action="recover_password.php" method="POST">
232 <input type="hidden" name="username" value="<?php echo $_POST['username']; ?>">
233 <input type="hidden" name="bypass">
234 <fieldset class="details">
235 <legend>Other Details</legend>
236 <p style="float: left">When did you create this account? Giving<br/> us both month and year really helps!
237 <span style=" position: absolute; top: 30px; left: 265px">
238 <!-- Month dropdown -->
239 <select name="month" id="reg_date" onchange="" size="1">
240 <option value="January">January</option>
241 <option value="February">February</option>
242 <option value="March">March</option>
243 <option value="April">April</option>
244 <option value="May">May</option>
245 <option value="June">June</option>
246 <option value="July">July</option>
247 <option value="August">August</option>
248 <option value="September">September</option>
249 <option value="October">October</option>
250 <option value="November">November</option>
251 <option value="December">December</option>
252 </select>
253
254 <!-- Year dropdown -->
255 <select name="year" id="reg_date" onchange="" size="1">
256 <option value="2016">2016</option>
257 <option value="2015">2015</option>
258 </select>
259 </span>
260 </p>
261
262 <table>
263 <tr>
264 <td style="vertical-align: middle">
265 If you have any other details which would help you prove your ownership of this
266 account, please enter them here.<br/>
267 Please <b>do not</b> provide us with any of this following personal information, your full
268 name, home
269 address, email address or telephone number.<br/><br/>
270 <span class='textcounter' id="counter1">You have 300 characters remaining</span>
271 </td>
272 <td>
273 <textarea style="height: 120px; width: 450px;" name="message" class="textlimited"
274 data-textcounterid="counter1" maxlength="300" rows="4" cols="50"></textarea><br/>
275 <input type="submit" value="Submit" id="submit"/>
276 </td>
277 </tr>
278 </table>
279 </form>
280 </fieldset>
281
282 <?php
283 } else
284if (isset($_POST['answers'])) {
285 //validate answers
286 $errors = array();
287 $answers = $_POST['answer'];
288 $i = 0;
289
290 foreach ($answers as $answer) {
291 $i++;
292
293 if (strlen($answer) < 3 || strlen($answer) > 35) {
294 $errors[] = 'Question #' . $i . ' must be at least three characters and no more than 26 characters.';
295 }
296
297 if (preg_match('#[^a-zA-Z0-9$/^[\p{L}-]*$/u ]#', $answer)) {
298 $errors[] = 'Question #' . $i . ' contains illegal characters.';
299 }
300 }
301
302 if (count($errors) >= 1) {
303 //back button
304 ?>
305 <center><input type="button" value="Back" onclick="goBack()"/></center> <?php
306
307 //display errors
308 foreach ($errors as $error) {
309 echo $error . '<br/>';
310 }
311 } else {
312 //generate a tracking ID
313 $rand_hash = $base->randomString(11);
314 $tracking_id = substr($rand_hash, 0, 3) . '-' . substr($rand_hash, 4, 3) . '-' . substr($rand_hash, 7, 3);
315
316 //create the recovery request
317 $database->processQuery("INSERT INTO `tracking` VALUES (null, ?, ?, NOW(), ?, ?, 0, ?, ?, ?, ?, ?, ?, ?, ?, ?)", array($user->getIdByName($_POST['username']), $_SERVER['REMOTE_ADDR'], time(), $tracking_id, $answers[0], $answers[1], $answers[2], $answers[3], $answers[4], $answers[5], $content, $reg_date, $password), false);
318
319 ?>
320 <fieldset class="question">
321 <legend>Success!</legend>
322 You have successfully submitted an account recovery request. Your request will be
323 reviewed and processed within the next 48 hours. To track your account recovery
324 progress you can use the <b>recovery tracking ID</b>.<br><br> <b>Please make
325 note</b> of the the tracking ID provided to you and store it in a <b>safe</b>,
326 <b>secure</b> location so you don't lose or forget it.</b>
327 </fieldset>
328 <br/>
329 <br/>
330 <b>Tracking ID: <?php echo $tracking_id; ?></b>
331
332 <?php
333 }
334} else if (isset($_POST['bypass'])) {
335 //generate a tracking ID
336 $rand_hash = $base->randomString(11);
337 $tracking_id = substr($rand_hash, 0, 3) . '-' . substr($rand_hash, 4, 3) . '-' . substr($rand_hash, 7, 3);
338
339 //create the recovery request
340 $database->processQuery("INSERT INTO `tracking` VALUES (null, ?, ?, NOW(), ?, ?, 0, ?, ?, ?, ?, ?, ?, ?, ?, ?)", array($user->getIdByName($_POST['username']), $_SERVER['REMOTE_ADDR'], time(), $tracking_id, 'answer0', 'answer1', 'answer2', 'answer3', 'answer4', 'answer5', $content, $reg_date, $password), false);
341
342 ?>
343 <fieldset class="question">
344 <legend>Success!</legend>
345 You have successfully submitted an account recovery request. Your request will be
346 reviewed and processed within the next 48 hours. To track your account recovery
347 progress you can use the <b>recovery tracking ID</b>.<br><br> <b>Please make
348 note</b> of the the tracking ID provided to you and store it in a <b>safe</b>,
349 <b>secure</b> location so you don't lose or forget it.</b>
350 </fieldset>
351 <br/>
352 <br/>
353 <b>Tracking ID: <?php echo $tracking_id; ?></b>
354
355 <?php
356} else {
357 echo 'Error: dead end.';
358 }
359}
360 ?>
361 <br/>
362 <br/>
363
364 <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
365 <script type="text/javascript">
366
367 jQuery(function(){
368 $("#submit").click(function(){
369 $(".error").hide();
370 var hasError = false;
371 var passwordVal = $("#password").val();
372 var checkVal = $("#password2").val();
373 if (passwordVal == '#password') {
374 $("#password").after('<span class="error">Please enter a password.</span>');
375 hasError = true;
376 } else if (checkVal == '') {
377 $("#password2").after('<span class="error">Please re-enter your password.</span>');
378 hasError = true;
379 } else if (passwordVal != checkVal ) {
380 $("#password2").after('<span class="error">Passwords do not match.</span>');
381 hasError = true;
382 }
383 if(hasError == true) {return false;}
384 });
385 });
386
387 //checks how many characters are remaining
388 // the selector below will catch the keyup events of elements decorated with class textlimited and have a maxlength
389 $('.textlimited[maxlength]').keyup(function () {
390 //get the fields limit
391 var maxLength = $(this).attr("maxlength");
392
393 // check if the limit is passed
394 if (this.value.length > maxLength) {
395 return false;
396 }
397
398 // find the counter element by the id specified in the source input element
399 var counterElement = $(".textcounter#" + $(this).data("textcounterid"));
400 // update counter 's text
401 counterElement.html("You have " + (maxLength - this.value.length) + " chararacters remaining");
402 });
403
404 //checks if the user has selected no recoveries and disables the textareas
405 $(document).ready(function () {
406 $('.input_control').change(function () {
407 $(".textbox").prop('disabled', this.checked);
408 $(".textarea").prop('disabled', this.checked);
409 });
410 $('.input_control').prop('checked', false);
411 $('.input_control').trigger('change');
412 });
413
414 //limits the characters input in the 'other details' text area
415 function charLimit(limitField, limitNum) {
416 if (limitField.value.length > limitNum) {
417 limitField.value = limitField.value.substring(0, limitNum);
418 }
419 }
420 </script>
421 <div style="clear: both;"></div>
422</div>
423</div>
424</div>
425</div>
426
427<div class="tandc"><?php echo $data['wb_foot']; ?></div>
428</div>
429</body>
430</html>