-
Notifications
You must be signed in to change notification settings - Fork 4
/
_changeEmail.php
104 lines (79 loc) · 3.26 KB
/
_changeEmail.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
<?php
/*
Copyright 2020 FWBer.com
This file is part of FWBer.
FWBer is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
FWBer is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero Public License for more details.
You should have received a copy of the GNU Affero Public License
along with FWBer. If not, see <https://www.gnu.org/licenses/>.
*/
session_start();
include("_init.php");
include("_debug.php");
include("_names.php");
if($_SERVER["REQUEST_METHOD"] != "POST"){header('Location: '.getSiteURL());exit();}
include("_profileVars.php");
include("_secrets.php");
include("_globals.php");
include("_emailFunctions.php");
//first make sure we are a legit user.
if(validateSessionOrCookiesReturnLoggedIn()==false){header('Location: '.getSiteURL());exit();}//full auth for actions
goHomeIfCookieNotSet();
$db = mysqli_connect($dburl,$dbuser,$dbpass);
if(!$db)exit(mysqli_connect_error());
//make sure we've got an action.
if(!isset($_POST['newEmail'])||empty($_POST['newEmail']))exit('newEmail'); else $newEmail= mysqli_escape_string($db,$_POST['newEmail']);
if(!isset($_POST['verifyEmail'])||empty($_POST['verifyEmail']))exit('verifyEmail'); else $verifyEmail= mysqli_escape_string($db,$_POST['verifyEmail']);
if($newEmail!=$verifyEmail)exit("emails don't match");
$email = mysqli_escape_string($db,$_SESSION["email"]);
//make sure email isn't in use
$dbquerystring = sprintf("SELECT id FROM ".$dbname.".users WHERE email='%s'",$newEmail);
$dbquery = mysqli_query($db,$dbquerystring);
$dbresults = mysqli_fetch_array($dbquery);
if($dbresults)exit("Error");
//get my userid
$dbquerystring = sprintf("SELECT id, verifyHash FROM ".$dbname.".users WHERE email='%s'",$email);
$dbquery = mysqli_query($db,$dbquerystring);
$dbresults = mysqli_fetch_array($dbquery);
$userid = $dbresults['id'];
$verifyHash = $dbresults['verifyHash'];
//set new email address
//set verify to 0
$dbquerystring =
sprintf("UPDATE ".$dbname.".users SET email = '%s', verified = '0' WHERE email='%s'",
$newEmail,
$email
);
if(!mysqli_query($db,$dbquerystring))exit("didn't work");
//done
mysqli_close($db);
sendNewEmailAddressVerificationEmail($newEmail,$verifyHash);
setcookie("email","",time()-1000,'/',".".getSiteDomain());
setcookie("token","",time()-1000,'/',".".getSiteDomain());
session_destroy();
?>
<!doctype html>
<html lang="en">
<head>
<title><?php require_once("_names.php"); echo getSiteName(); ?> - Change Email<?php require_once("_init.php");echo getTitleTagline();?></title>
<?php include("head.php");?>
</head>
<body class="d-flex flex-column h-100">
<?php include("h.php");?>
<div id="mainbody" align="center">
<br>
<br>
<br>
<div style="font-size:14px;">
Please check your email at <?php echo $email; ?> to verify your account.
</div>
</div>
<?php include("f.php");?>
</body>
</html>