toDateTimeString()); $body = << {$lang_recover['mail_this_link']}
$baseUrl/recover.php?id={$arr["id"]}&secret=$hash {$mailFour} EOD; // sent_mail($arr["email"],$SITENAME,$SITEEMAIL,change_email_encode(get_langfolder_cookie(), $title),change_email_encode(get_langfolder_cookie(),$body),"confirmation",true,false,'',get_email_encode(get_langfolder_cookie())); sent_mail($arr["email"],$SITENAME,$SITEEMAIL,$title,$body,"confirmation",true,false,''); } elseif($_SERVER["REQUEST_METHOD"] == "GET" && $take_recover && isset($_GET["id"]) && isset($_GET["secret"])) { $id = intval($_GET["id"] ?? 0); $md5 = $_GET["secret"]; if (!$id) httperr(); if (!\Nexus\Database\NexusDB::cache_get("recover:$md5")) { do_log("secret: $md5 is expired", "error"); httperr(); } $res = sql_query("SELECT username, email, passhash, editsecret FROM users WHERE id = " . sqlesc($id)) or sqlerr(__FILE__, __LINE__); $arr = mysql_fetch_array($res) or httperr(); $email = $arr["email"]; $sec = hash_pad($arr["editsecret"]); if ($md5 != md5($sec . $email . $arr["passhash"] . $sec)) { do_log("secret: $md5 != md5(sec: $sec . email: $email . passhash: {$arr['passhash']} . sec: $sec)","error"); httperr(); } // generate new password; $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; $newpassword = ""; for ($i = 0; $i < 10; $i++) $newpassword .= $chars[mt_rand(0, strlen($chars) - 1)]; $sec = mksecret(); $newpasshash = hash('sha256', $sec.hash('sha256', $newpassword)); $authKey = mksecret(); sql_query("UPDATE users SET secret=" . sqlesc($sec) . ", editsecret='', passhash=" . sqlesc($newpasshash) . ", auth_key=". sqlesc($authKey) . " WHERE id=" . sqlesc($id)." AND editsecret=" . sqlesc($arr["editsecret"])) or sqlerr(__FILE__, __LINE__); if (!mysql_affected_rows()) stderr($lang_recover['std_error'], $lang_recover['std_unable_updating_user_data']); $title = $SITENAME.$lang_recover['mail_two_title']; $body = <<{$lang_recover['mail_here']} {$mailTwoFour} EOD; sent_mail($email,$SITENAME,$SITEEMAIL,$title,$body,"details",true,false,''); } else { stdhead(); $s = ""; ?>

	name="email" autocomplete="email" />