<?php
/**
 * MachForm
 * 
 * © 2007–2025 Appnitro Software. All rights reserved.
 * 
 * This source code is proprietary and may not be copied, modified,
 * or distributed in any form without express written permission from Appnitro Software.
 * 
 * License information: https://www.machform.com/license-agreement/
 */
	$is_ajax = true;

	require('config.php');
	require('lib/db-session-handler.php');
	require('includes/init.php');
	require('includes/db-core.php');
	require('includes/helper-functions.php');
	require('includes/check-session.php');

	require('includes/filter-functions.php');
	require('lib/password-hash.php');
	require('lib/phpmailer/vendor/autoload.php');
	
	$_POST = json_decode(file_get_contents('php://input'), true);
	
	$dbh = mf_connect_db();
	$mf_settings = mf_get_settings($dbh);
	
	$input = mf_sanitize($_POST);

	if(empty($input['np']) && empty($input['user_id'])){
		die("Error! You can't open this file directly");
	}else{
		$user_id        = (int) $input['user_id'];
		$reset_method   = trim($input['reset_method'] ?? 'email'); //email or link
		$csrf_token 	= $input['csrf_token'];
	}

	//validate CSRF token
	mf_verify_csrf_token($csrf_token);
	
	//only administrator is allowed to access this page
	if(empty($_SESSION['mf_user_privileges']['priv_administer'])){
        die("Error! You don't have permission to access this page.");
    }

    //generate reset token
	$reset_token = bin2hex(random_bytes(32)); // 64 character hex string

	//hash before storing in database 
	$reset_hash = hash('sha256', $reset_token).'|24'; //append '|24' to set 24 hour expiry

	//save it into ap_users table
	$query 	= "UPDATE ".MF_TABLE_PREFIX."users SET reset_hash=?,reset_date=now() WHERE user_id=?"; 
	$params = array($reset_hash,$user_id);
					
	mf_do_query($query,$params,$dbh);
	
    //generate reset token
	$reset_token = bin2hex(random_bytes(32)); // 64 character hex string

	//hash before storing in database 
	$reset_hash = hash('sha256', $reset_token).'|1'; //append '|1' to set 1 hour expiry

	//save it into ap_users table
	$query 	= "UPDATE ".MF_TABLE_PREFIX."users SET reset_hash=?,reset_date=now() WHERE user_id=?"; 
	$params = array($reset_hash,$user_id);
					
	mf_do_query($query,$params,$dbh);
	
	//construct reset url
	$q_string  = base64_encode("user_id={$user_id}&reset_token={$reset_token}");
	$reset_url = $mf_settings['base_url'].'reset.php?q='.$q_string;

    //if reset method is email, send the reset link to user email
    if($reset_method == 'email'){
        //get user email and first name
        $query  = "SELECT user_email,user_fullname FROM `".MF_TABLE_PREFIX."users` WHERE `user_id`=?";
        $params = array($user_id);
        
        $sth = mf_do_query($query,$params,$dbh);
        $row = mf_do_fetch_result($sth);
        
        $target_email = $row['user_email'];

        $user_fullname_array = explode(' ',$row['user_fullname']);
        $user_firstname 	 = $user_fullname_array[0];

        //send reset link to user
        $reset_result = mf_send_password_reset($dbh,$target_email,$user_firstname,$reset_url);
    }
	
    header('Content-Type: application/json');
    echo json_encode(['status' => 'ok', 'reset_url' => $reset_url]);