mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-09-25 09:53:08 +02:00
54 lines
2.1 KiB
PHP
54 lines
2.1 KiB
PHP
<?php
|
|
/**
|
|
* Reset password page (unauthenticated).
|
|
*
|
|
* GET → show a "set new password" form if the token is valid (token in a
|
|
* hidden field, never in a POST-redirect URL).
|
|
* POST → redeem the one-time token, install the new password, redirect to login.
|
|
*/
|
|
require_once __DIR__ . '/../../bootstrap.php';
|
|
require_once APP_ROOT . '/src/AdminAuth.php';
|
|
require_once APP_ROOT . '/src/App.php';
|
|
|
|
// Reset only makes sense with a password configured.
|
|
if (!AdminAuth::hasPassword()) {
|
|
header('Location: /admin/');
|
|
exit;
|
|
}
|
|
|
|
App::boot();
|
|
|
|
$token = trim($_GET['token'] ?? $_POST['token'] ?? '');
|
|
$error = null;
|
|
|
|
// ── POST: redeem token + set new password ─────────────────────────────────
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
if (empty($_POST['csrf_token']) || empty($_SESSION['csrf_token'])
|
|
|| !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
|
|
$error = 'Erreur de sécurité : token invalide.';
|
|
} else {
|
|
$new = $_POST['new_password'] ?? '';
|
|
$conf = $_POST['confirm_password'] ?? '';
|
|
|
|
if (strlen($new) < 12) {
|
|
$error = 'Le mot de passe doit contenir au moins 12 caractères.';
|
|
} elseif ($new !== $conf) {
|
|
$error = 'Les mots de passe ne correspondent pas.';
|
|
} elseif (!AdminAuth::redeemPasswordResetToken($token, $new)) {
|
|
$error = 'Ce lien est invalide, a déjà été utilisé, ou a expiré.';
|
|
} else {
|
|
App::flash('success', 'Mot de passe mis à jour. Connectez-vous.');
|
|
header('Location: /admin/login.php');
|
|
exit;
|
|
}
|
|
}
|
|
}
|
|
|
|
// ── Render (GET, or POST with a validation error) ─────────────────────────
|
|
$pageTitle = 'Réinitialiser le mot de passe';
|
|
$isAdmin = true; $isLogin = true; $bodyClass = 'admin-body';
|
|
require_once APP_ROOT . '/templates/head.php';
|
|
include APP_ROOT . '/templates/header.php';
|
|
include APP_ROOT . '/templates/admin/password-reset.php';
|
|
echo "\n</body>\n</html>";
|