<?php

include('init.php');
include('libs/functions.php');


if (checklogin($userID, "apps/index.php")) {


$password = trim($_POST['password']);
$currentpassword = trim($_POST['currentpassword']);

$errors = 0;


if ($password <> "" && strlen($password) > 7 && strlen($password) < 21 && check_password($password)) {

$currentpasswordenc = md5("gingerbreadcookies".$currentpassword);
$sql = "SELECT count(user_id) AS cnt FROM tb_user WHERE user_id=$userID AND password='$currentpasswordenc' ";
$rs = $db->Execute($sql);
$cnt = $rs->fields('cnt');
if ($cnt != 1) {
$errors = 1;
$message = "Incorrect current password";
}
else {
if ($status == 7) {
$status=1;
}
else if ($status == 8) {
$status=2;
}
$_SESSION['status'] = $status;
$password = md5("gingerbreadcookies".$password);
$sql = "UPDATE tb_user SET password='$password', status=$status WHERE user_id=$userID";
$rs = $db->Execute($sql);

$sql = "UPDATE tb_user SET failed_login_attempt=0 WHERE user_id=$userID";
$rs = $db->Execute($sql);

$sql = "UPDATE tb_password_update SET last_password_change=getdate() WHERE user_id=$userID";
$rs = $db->Execute($sql);


$sql = "UPDATE tb_password_update SET temp_pass_exp='0', temp_exp_date=NULL WHERE user_id=$userID";
$rs = $db->Execute($sql);

$sql = "INSERT INTO tb_audit (user_id, event, event_date) VALUES ($userID, 'User changed password', getdate())";
$rs = $db->Execute($sql);
}


}
else {
$errors = 1;
$message = "Invalid password";
}





// display error message
if ($errors == 1) {
print_header();
print "<br><hr><h1 align=center>$message</h1><hr><h3 align=center>Please press the Back button to return to previous page</h3>";

print_footer();
}

else {

print_header();

print ("

<table width=800 align=center>
<tr><td>
<BR>
<HR>
<H1 align=center>Thank You!</H1>
<BR>
<HR>
<H3 align=center>Your account has been updated. <A HREF='apps/index.php'>Click here to continue</A></H3>
<BR>
<HR>
</td></tr></table>
");

print_footer();

}


} // end check login

?>