v1.3.2 - "Passwort vergessen" Funktion hinzugefügt
This commit is contained in:
Borgal
123
forgot_password.php
Executable file
123
forgot_password.php
Executable file
@@ -0,0 +1,123 @@
|
||||
<?php
|
||||
session_start();
|
||||
include('inc/db.php');
|
||||
|
||||
// SMTP-Konfiguration wird über die DB-Einbindung bereits bereitgestellt
|
||||
// (SMTP_HOST, SMTP_USERNAME, etc. müssen in inc/db.php oder einer config.php definiert sein)
|
||||
|
||||
$message = '';
|
||||
$message_type = '';
|
||||
|
||||
if ($_SERVER["REQUEST_METHOD"] == "POST") {
|
||||
$identifier = trim($_POST['identifier']);
|
||||
|
||||
// Benutzer per Username ODER E-Mail finden
|
||||
$stmt = mysqli_prepare($conn, "SELECT id, username, email FROM users WHERE username = ? OR email = ?");
|
||||
mysqli_stmt_bind_param($stmt, "ss", $identifier, $identifier);
|
||||
mysqli_stmt_execute($stmt);
|
||||
$result = mysqli_stmt_get_result($stmt);
|
||||
$user = mysqli_fetch_assoc($result);
|
||||
mysqli_stmt_close($stmt);
|
||||
|
||||
if ($user && !empty($user['email'])) {
|
||||
// Sicherer Token (64 Zeichen hex)
|
||||
$token = bin2hex(random_bytes(32));
|
||||
$expires_at = date('Y-m-d H:i:s', strtotime('+12 hours'));
|
||||
|
||||
// Token in DB speichern
|
||||
$stmt = mysqli_prepare($conn, "INSERT INTO password_reset_tokens (user_id, token, expires_at) VALUES (?, ?, ?)");
|
||||
mysqli_stmt_bind_param($stmt, "iss", $user['id'], $token, $expires_at);
|
||||
mysqli_stmt_execute($stmt);
|
||||
mysqli_stmt_close($stmt);
|
||||
|
||||
// 🔸 PHPMailer – wie in deinem Beispiel
|
||||
try {
|
||||
require_once __DIR__ . '/vendor/autoload.php';
|
||||
|
||||
$mail = new \PHPMailer\PHPMailer\PHPMailer(true);
|
||||
$mail->CharSet = 'UTF-8';
|
||||
$mail->isSMTP();
|
||||
$mail->Host = SMTP_HOST;
|
||||
$mail->SMTPAuth = true;
|
||||
$mail->Username = SMTP_USERNAME;
|
||||
$mail->Password = SMTP_PASSWORD;
|
||||
$mail->SMTPSecure = SMTP_ENCRYPTION;
|
||||
$mail->Port = SMTP_PORT;
|
||||
$mail->setFrom(MAIL_FROM_ADDRESS, MAIL_FROM_NAME);
|
||||
|
||||
$reset_link = "https://domili.borgal.de/reset_password.php?token=" . urlencode($token);
|
||||
|
||||
// Text-Version (für E-Mail-Clients ohne HTML)
|
||||
$text_body = "Hallo {$user['username']},\n\n";
|
||||
$text_body .= "du hast eine Zurücksetzung deines Passworts angefordert.\n";
|
||||
$text_body .= "Klicke auf den folgenden Link (gültig 12 Stunden):\n";
|
||||
$text_body .= "$reset_link\n\n";
|
||||
$text_body .= "Falls du dies nicht angefordert hast, ignoriere diese E-Mail.\n\n";
|
||||
$text_body .= "—\nDein DoMiLi-Admin";
|
||||
|
||||
// HTML-Version (mit lesbarer Formatierung)
|
||||
$html_body = "
|
||||
<p>Hallo <strong>{$user['username']}</strong>,</p>
|
||||
<p>du hast eine Zurücksetzung deines Passworts angefordert.</p>
|
||||
<p>Bitte klicke auf den folgenden Link, um ein neues Passwort festzulegen (gültig für 12 Stunden):</p>
|
||||
<p>
|
||||
<a href=\"$reset_link\" style=\"color: #0d6efd; text-decoration: underline;\">Passwort zurücksetzen</a>
|
||||
</p>
|
||||
<p style=\"margin-top: 16px; color: #555; font-size: 0.95em; line-height: 1.5;\">
|
||||
Falls du diese Anfrage nicht gestellt hast, kannst du diese E-Mail ignorieren.
|
||||
</p>
|
||||
<p style=\"margin-top: 20px; font-size: 0.9em; color: #777;\">
|
||||
—<br>
|
||||
Dein DoMiLi-Admin
|
||||
</p>
|
||||
";
|
||||
|
||||
$mail->isHTML(true);
|
||||
$mail->Subject = "DoMiLi: Passwort zurücksetzen";
|
||||
$mail->Body = $html_body;
|
||||
$mail->AltBody = $text_body;
|
||||
$mail->addAddress($user['email'], $user['username']);
|
||||
$mail->send();
|
||||
|
||||
$message = "Ein Link zum Zurücksetzen wurde an deine E-Mail gesendet.";
|
||||
$message_type = "success";
|
||||
} catch (Exception $e) {
|
||||
error_log("PHPMailer Fehler bei Passwort-Zurücksetzung für {$user['email']}: " . $mail->ErrorInfo);
|
||||
$message = "Fehler beim Senden der E-Mail. Bitte versuche es später erneut.";
|
||||
$message_type = "danger";
|
||||
}
|
||||
} else {
|
||||
// Vage Antwort – Schutz vor Benutzer-Enumeration
|
||||
$message = "Falls ein Konto mit dieser Angabe existiert, wurde eine E-Mail gesendet.";
|
||||
$message_type = "info";
|
||||
}
|
||||
}
|
||||
|
||||
// HTML-Ausgabe
|
||||
require_once 'inc/public_header.php';
|
||||
?>
|
||||
|
||||
<div class="container d-flex justify-content-center align-items-start py-4 pt-5">
|
||||
<div class="card bg-light shadow w-100" style="max-width: 400px;">
|
||||
<div class="card-body">
|
||||
<h4 class="card-title text-center mb-4 fs-3">Passwort vergessen</h4>
|
||||
<?php if ($message): ?>
|
||||
<div class="alert alert-<?= htmlspecialchars($message_type) ?>"><?= htmlspecialchars($message) ?></div>
|
||||
<?php endif; ?>
|
||||
<form method="post">
|
||||
<div class="mb-3">
|
||||
<label for="identifier" class="form-label">Benutzername oder E-Mail</label>
|
||||
<input type="text" class="form-control form-control-lg" id="identifier" name="identifier" required autofocus>
|
||||
</div>
|
||||
<div class="d-grid">
|
||||
<button type="submit" class="btn btn-primary btn-lg">Link senden</button>
|
||||
</div>
|
||||
</form>
|
||||
<div class="text-center mt-3">
|
||||
<a href="login.php" class="text-decoration-none">Zurück zum Login</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<?php include('inc/footer.php'); ?>
|
||||
Reference in New Issue
Block a user