<?php include('_mod_security.php'); ?>
<?php
	$sql = "SELECT * FROM sys_users WHERE user_id = ".$db->quote($_SESSION['user_id'])." AND active = 1";
	$result = $db->query($sql) or die('Database Error!');
	if ($result->rowCount() > 0) :
		$row = $result->fetch(PDO::FETCH_OBJ);
	endif;
	if ($row->password_expired == 1) :
		$form_message = "Password change required!";
	endif;
	if ($_POST['ajax_event_submitted'] == '1') :
		$ar_err = array();
		if (empty($_POST['old_password'])) :
			$ar_err['old_password'] = 'Old password is required!';
			$err_flag = true;
		endif;
		if (!empty($_POST['old_password'])) :
			if (!password_verify($_POST['old_password'], $row->password)) :
				$ar_err['old_password'] = 'Old password is invalid!';
				$err_flag = true;
			endif;
		endif;
		if (empty($_POST['password'])) :
			$ar_err['password'] = 'New password is required!';
			$err_flag = true;
		endif;
		if (!empty($_POST['password']) || !empty($_POST['password2'])) :
			if ($_POST['password'] != $_POST['password2']) :
				$ar_err['password2'] = 'Passwords do not match!';
				$err_flag = true;
			endif;
		endif;
		if (!$err_flag) :
			if (!empty($_POST['password']) || !empty($_POST['password2'])) :
				$_POST['password_expired'] = 1;
			endif;
			$set = 	"password = ".$db->quote(trim(password_hash($_POST['password'], PASSWORD_BCRYPT))).", ".
					"password_expired = 0 ";
			$sql = "UPDATE sys_users set ".$set.
				"WHERE user_id = ".$db->quote(trim($_SESSION['user_id']))." ";
			$db->query($sql) or die('Database Error!');
			$_SESSION['password_expired'] = 0;
			$form_message = "Saved sucessfully!";
			write_log('I', $_SESSION['user_id'], 'User '.$_SESSION['user_full_name'].' changed password');
			echo "<SCRIPT>";
			echo "alert('Saved sucessfully!');";
			$ar_roles = explode(',', get_roles());
			if (!empty($ar_default_start[$ar_roles[0]])) :
				$next_page = $ar_default_start[$ar_roles[0]];
			else :
				$next_page = 'hotels';
			endif;
			echo "window.location.href = 'index.php?IX=".$next_page."'";
			echo "</SCRIPT>";
		else :
			$form_message = "Errors found!";
		endif;
		/*
		*/
	endif;
	
?>

<script>
	$(document).ready(function()	
		{
			$(':input:not(.search)').change(function() {sheet_dirty = true; } );
		}
	)
</script>

<h1>Change Password</h1>
<?php echo form_message($form_message); ?>

<form style="" name="frm_password" id="frm_password" method="post" action="">
	<input name="ajax_event_submitted" type="hidden" value="1" />
	<div class="tab_content" id="tab_content_basic_info" style="display:block;">
		<div class="input_column">
			<?php
				form_field('old_password', 'password', 50, 0, true, false, false, '', '', 'old_password', 'Old Password');
				form_field('password', 'password', 50, 0, true, false, false, '', '', 'password', 'New Password');
				form_field('password2', 'password', 50, 0, true, false, false, '', '', 'password2', 'Re-enter Password');
			?>
		</div>
	</div>
	<!-- -------------------------------------------------------------------------------------------------------------- -->
	<div class="form_strip">
		<input type="button" value="Save" onclick="sheet_dirty = false; this.form.submit();" />
		<input type="button" value="Cancel" onclick="sheet_dirty = false; window.location.href = 'index.php?IX=hotels'" />
		<input type="hidden" name="xsubmit" id="xsubmit" />
	</div>
</form>