<?php
/**
 * MachForm
 * 
 * © 2007–2025 Appnitro Software. All rights reserved.
 * 
 * This source code is proprietary and may not be copied, modified,
 * or distributed in any form without express written permission from Appnitro Software.
 * 
 * License information: https://www.machform.com/license-agreement/
 */
	$is_ajax = true;

	require('config.php');
	require('lib/db-session-handler.php');
	require('includes/init.php');
	require('includes/db-core.php');
	require('includes/helper-functions.php');
	require('includes/check-session.php');

	require('includes/filter-functions.php');
	require('lib/password-hash.php');
	require('lib/phpmailer/vendor/autoload.php');
	
	$_POST = json_decode(file_get_contents('php://input'), true);
	
	$dbh = mf_connect_db();
	$mf_settings = mf_get_settings($dbh);
	
	$input = mf_sanitize($_POST);

	if(empty($input['np']) && empty($input['user_id'])){
		die("Error! You can't open this file directly");
	}else{
		$new_password_plain = $input['np'];
		$csrf_token 	 = $input['csrf_token'];
	}

	//validate CSRF token
	mf_verify_csrf_token($csrf_token);
	
	//make sure user can only change his own password
	$user_id = $_SESSION['mf_user_id']; 
	
	$hasher = new PasswordHash(8, FALSE);
	$new_password_hash = $hasher->HashPassword($new_password_plain);
	
	$query = "UPDATE ".MF_TABLE_PREFIX."users SET user_password = ? WHERE user_id = ?";
	$params = array($new_password_hash,$user_id);
	mf_do_query($query,$params,$dbh);

   	echo '{"status" : "ok"}';
	