hcuResetPwd.prg

<?php
  /*
   * File: hcuResetPwd.prg
   *
   * Purpose:  Allow the user to reset their password and have the new one e-mailed to them.
   *
   */

    // ** SET SCRIPT LEVEL VARIABLE

    // ** INCLUDE MAIN GLOBAL SCRIPT -- Handles security / global variable values
    $serviceSkipCredentials = true;
    $serviceSkipSecurity = true;
    $serviceShowInfo = false;
    $serviceLoadMenu = false;

    require_once(dirname(__FILE__) . '/../library/hcuService.i');

    // ** IMPORT Variables from form
    $HB_ENV["HCUPOST"]= array();
    $dmsValuesList = array('resetLogin'=>'string', 'resetEmail'=>'string', 'action'=>'string');

    HCU_ImportVars($HB_ENV, 'HCUPOST', $dmsValuesList);

    // grab the action
    $action = HCU_array_key_exists("action", $HB_ENV["HCUPOST"]) ? $HB_ENV["HCUPOST"]["action"] : "";

    // ** INSERT BUSINESS LOGIC FOR THIS FORM
    $cu = preg_replace("/[^A-Za-z0-9]/","",$_GET['cu']);
    $cu = substr($cu,0,12);
    $chome = strtolower($cu);

    // see if there is an admin email
    $sql= "select email from cuadmnotify
           where  role='preset' and cu='$cu'";
    $sth = db_query($sql,$dbh);
    list($admEmail) = db_fetch_array($sth,0);
    $admEmail = preg_replace("/ +$/","",$admEmail);
    $admEmail = trim( $admEmail );
    db_free_result($sth);

    // get the return address for sending an email message to the user
    $sql= "select email from cuadmnotify
           where  role='presetfrom' and cu='$cu'";
    $sth = db_query($sql,$dbh);
    list($admFrom) = db_fetch_array($sth,0);
    $admFrom = preg_replace("/ +$/","",$admFrom);
    $admFrom = trim( $admFrom );
    db_free_result($sth);

    // get some configuration settings
    $sql="select flagset, flagset2, coalesce(retrylimit,5), coalesce(gracelimit,5)
          from cuadmin where cu='$cu'";
    $sth = db_query($sql,$dbh);
    list($flagset, $flagset2, $retry, $grace) = db_fetch_array($sth,0);
    db_free_result($sth);


    $featureNotSet = false;
    if ( $admFrom == "" || ($flagset & $CU_MEMRESET) == 0 ) {
      $screenTitle = $MC->msg("Feature Unavailable", HCU_DISPLAY_AS_HTML);
      $screenContents = $MC->msg('Feature Not Set', HCU_DISPLAY_AS_HTML) . ".  " . $MC->msg('Contact CU', HCU_DISPLAY_AS_HTML);
      $featureNotSet = true;
    } else if ( $action == "unlock" ) {
      $msg="";
      # make sure account is valid and email matches here. If not, set msg
      #
      $userName= $HB_ENV["HCUPOST"]["resetLogin"];
      $member = strtolower($userName);
      $member = trim($member);
      if ( preg_match("/[\\\`,\"\s;]/", $member) ) {
        $msg .= $MC->msg("Invalid Username or Password", HCU_DISPLAY_AS_HTML) . "<br>";
      } else {
          $qby='lower(user_name) = ';

        $sql= "select user_id, trim(user_name), email, passwd, failedremain,
               userflags & {$MEM_FORCE_RESET}::int4 from {$HB_ENV["cu"]}user
               where  $qby '" . prep_save($member) . "'";
        $sth = db_query($sql,$dbh);
        $rcount = db_num_rows($sth);
        list( $saveUserId, $saveUser, $savedEmail, $currPasswd, $fRemain, $fReset) =
              db_fetch_array($sth,0);
        $savedEmail = preg_replace("/ +$/","",$savedEmail);
        db_free_result($sth);

        $resetEmail= trim( $HB_ENV["HCUPOST"]["resetEmail"] );
        $resetEmail = ( validateEmail($resetEmail) ? $resetEmail : "");

        if ($rcount == 0 || $resetEmail == "" || strtoupper($savedEmail) != strtoupper($resetEmail)) {
          $msg .= $MC->msg("Email Address Mismatch", HCU_DISPLAY_AS_HTML). "<br>";
        }
        if ($fRemain < 0) {
          $msg .= $MC->msg("Account Locked by Credit Union", HCU_DISPLAY_AS_HTML) . "<br>";
        }
        // FIRST AMERICAN ONLY -- REMOVING TEMPORARILY SO USERS CAN RESET PASSWORD IF SECURITY RESET IS ON
        if ($fReset == 2) {
          $msg .= $MC->msg("Account Flagged for Security Reset", HCU_DISPLAY_AS_HTML) . "<br>";
        }

        // if password is "NULL PASSWORD" it means they haven't signed onto homebanking yet
        if ( trim( $currPasswd ) == "NULL PASSWORD" ) {
          $msg = $MC->msg('Never Logged In Reset', HCU_DISPLAY_AS_HTML);
        }
      }

      if (empty($msg)) {
        // make the new password
        $newPass =`/usr/bin/pwgen --numerals --no-capitalize 8 1`;
        $hash = password_hash(rtrim($newPass), PASSWORD_DEFAULT);

        // update the user's entry
        $updTable = array('user' => array(
                          array(
                            "_action" => "update",
                            "user_id" => $saveUserId
                          )
                        )
                      );
        $updTable['user'][0]['passwd'] = $hash;
        $updTable['user'][0]['forcechange'] = 'Y';
        $updTable['user'][0]['failedremain'] = $retry;
        $updTable['user'][0]['forceremain'] = $grace;
        $updTable['user'][0]['pwchange'] = DBTIMESTAMP_USENOW;

        $updateResults = DataUserTableUpdate($dbh, $HB_ENV, $MC, $updTable, $saveUserId, 'U_UPD', $HB_ENV["platform"],
                                  $HB_ENV["currentscript"], 'U', "Reset Password", $userName, $savedEmail,
                                  $HB_ENV["remoteIp"] );   // don't suppress audit

        if ( $updateResults !== false ) {
          db_free_result($sth);
          # mail new pass ($newpass) to user at $saved_email address
          $notify = new ErrorMail;
          $notify->mailto= $savedEmail;
          $notify->mailfromname = $HB_ENV['orgname'];
          $notify->mailfrom= $admFrom;
          $notify->replyto= $admFrom;
          $notify->subject= $MC->msg("Home Banking Password", HCU_DISPLAY_AS_RAW);
          $notify->msgbody = $MC->msg("password reset requested", HCU_DISPLAY_AS_RAW) . "\n\n";
          $notify->msgbody .= $MC->msg("new password is", HCU_DISPLAY_AS_RAW) . " $newPass\n\n";
          $notify->msgbody .= $MC->combo_msg("Must change password soon", HCU_DISPLAY_AS_RAW, "#NUMREMAIN#", $grace) . "\n\n";
          $notify->msgbody .= date("m/d/Y H:i:s T");
          $notify->callingfunction = __FUNCTION__;
          $notify->file = __FILE__;
          $notify->cu = $cu;
          $notify->SendMail();

          # mail msg that user reset pwd to CU at $adm_email address, if configured
          if ( $admEmail != "" ) {
            $notify = new ErrorMail;
            $notify->mailto=$admEmail;
            $notify->replyto="support@homecu.net";
            $notify->subject="Password Reset for Member $saveUser";
            $notify->msgbody =  "Password Reset for Member $saveUser\n\n";
            $notify->msgbody .= "A new password has been generated for Member $saveUser\n";
            $notify->msgbody .= "and mailed to $savedEmail\n\n";
            $notify->msgbody .= date("m/d/Y H:i:s T");
            $notify->SendMail();
          }

          # show "Password changed and mailed" screen
          $screenTitle = $MC->msg("Reset Password", HCU_DISPLAY_AS_HTML );
          $screenContents = $MC->msg("Mailed Password", HCU_DISPLAY_AS_HTML) .
                            "<br /><br />" .
                            $MC->combo_msg("Mailed Password Warn Junk",HCU_DISPLAY_AS_HTML,"#adm_from#","$admFrom");
        } else {
          $screenTitle = $MC->msg("Reset Password", HCU_DISPLAY_AS_HTML );
          $screenContents = $MC->msg("Unable to update password", HCU_DISPLAY_AS_HTML);
        }
      } else {
          $screenTitle = $MC->msg("Reset Password", HCU_DISPLAY_AS_HTML );
          $screenContents = $msg;

          $action = "error";
      }
    }

    // ** Load any fragments here
    if ( $action != "unlock" ) {
      $resetNoticeAry = Get_NoticeInfo($dbh, $HB_ENV, $MC, "D", "resetMemberPwd");

      $noticeDisplay ="";
      if ($resetNoticeAry['status']['code'] === '000' && count($resetNoticeAry['notice']) > 0 && !$featureNotSet) {
        $noticeDisplay = $resetNoticeAry['notice'][0]['notice_text'];
      } else {
        $screenTitle = $MC->msg("Reset Password", HCU_DISPLAY_AS_HTML );
        $screenContents = $MC->msg("Feature Unavailable", HCU_DISPLAY_AS_HTML);

        // This is an error case.
        $action = "error";
      }
    }

    // ** INCLUDE PRE CONTENT SCRIPT
    require_once(dirname(__FILE__) . '/../includes/hcuPreContent.i');

    /*
     * ** START CONTENT
     */
    ?>

    <style type="text/css">
      .container-fluid-margin {
        margin: 15px;
      }

      .k-block > .k-header {
        white-space: normal;
        height: 100%;
      }

      .hcu-info-margin, .hcu-error-margin {
        margin: 15px 0;
      }

      .hcu-info-padding, .hcu-error-padding {
        padding: 15px;
      }

      .hcu-full-width {
        width: 100%;
      }
      /* top-bottom margin */
      .hcu-container-margin {
        margin: 15px 0;
      }

      .hcu-template .hcu-edit-buttons {
        bottom: initial;
      }

      .hide-for-apps {
        <?php if ( isset( $_COOKIE["cookie"] ) && $_COOKIE["cookie"] == "mobile_app_access" ) { ?>
          display: none;
        <?php } ?>
      }
      </style>
    <?php if ( $action == "unlock") { ?>
      <div class="container-fluid container-fluid-margin hcu-template">
        <div class='well well-sm col-xs-12 col-md-8 col-lg-6'>

          <h3><?php echo $screenTitle; ?></h3>

          <div class='k-block k-info-colored hcu-info-margin'>
              <div class="hcu-info-padding">
                <span><?php print $screenContents; ?></span>
              </div>
          </div>
          <div class="hcu-edit-buttons k-state-default">
            <a href="##" id="btnStartOver"><?php echo $MC->msg('Start Over', HCU_DISPLAY_AS_HTML) ?></a>
            &emsp;
            <a href="##" id="btnBack" class="k-button k-primary hide-for-apps">
              <i class="fa fa-check fa-lg"></i><?php echo $MC->msg('Log In', HCU_DISPLAY_AS_HTML) ?>
            </a>
          </div>
        </div>

      </div>

    <?php } else { ?>


      <div class="container-fluid container-fluid-margin hcu-template">
          <div class='well well-sm col-xs-12 col-md-8 col-lg-6'>
            <h3><?php echo $MC->msg("Reset Password", HCU_DISPLAY_AS_HTML); ?></h3>

            <form class='formInputx' id='formReset' name='formReset' method="post">
              <input type=hidden name='action' value='unlock'>

                <?php if ( strlen( $noticeDisplay ) ) { ?>
                  <div id='noticeContent' class='k-block k-info-colored hcu-info-margin'>
                    <div class="hcu-info-padding">
                      <span><?php print $noticeDisplay; ?></span>
                    </div>
                  </div>
                <?php
                }

                /*
                 * Need to setup the Login ID Text.
                 * Based on settings for the credit union in Monitor, they will either be entering
                 * a 'Login ID' or an 'Account Number'
                 *
                 */
                if (($HB_ENV['flagset2'] & $GLOBALS['CU2_ALIAS_REQ']) > 0 || (($HB_ENV['flagset2'] & $GLOBALS['CU2_ALIAS_OK']) > 0)) {
                  // ** The Credit union IS setup for some form of user alias, required OR allowed
                  // * The member will be asked for Login ID
                  $hbLoginText = $MC->msg('Login ID', HCU_DISPLAY_AS_HTML);
                  $hbLoginValMsg = $MC->msg('Please enter your login id', HCU_DISPLAY_AS_HTML);
                  $hbLoginHelp = "<span class='fa fa-question-circle-o' id='loginTip'></span>";
                } else {
                  // ** The Credit union does not have any alias set.
                  // * the member will be asked for Account Number
                  $hbLoginText = $MC->msg('Account Number', HCU_DISPLAY_AS_HTML);
                  $hbLoginValMsg = $MC->msg('Please enter your account number', HCU_DISPLAY_AS_HTML);
                  $hbLoginHelp = "";
                }

                ?>
              <fieldset class="row">
                <div class="col-xs-12 col-sm-12 hcu-container-margin">
                  <label for="resetLogin">
                    <?php echo $hbLoginText; ?>: <?php echo $hbLoginHelp ?>
                  </label>
                  <input type="text" id="resetLogin" name="resetLogin" class="k-textbox hcu-full-width" value="" required
                    placeholder="<?php echo $hbLoginValMsg; ?>"
                    data-required-msg="<?php echo $MC->msg('Username Required', HCU_DISPLAY_AS_HTML) ?>."/>
                </div>

                <div class="col-xs-12 col-sm-12 hcu-container-margin">
                  <label for="resetEmail"><?php echo $MC->msg('Email Address', HCU_DISPLAY_AS_HTML); ?>:
                    <span class="fa fa-question-circle-o" id="emailTip"></span>
                  </label>
                  <input type="email" id="resetEmail" name="resetEmail" class="k-textbox hcu-full-width" value="" required
                         placeholder="<?php echo $MC->msg('Email Address', HCU_DISPLAY_AS_HTML); ?>"
                         data-required-msg="<?php echo $MC->msg('EMail Missing', HCU_DISPLAY_AS_HTML) ?>."
                         data-email-msg="<?php echo $MC->msg('Email appears invalid', HCU_DISPLAY_AS_HTML); ?>"/>
                </div>
              </fieldset>


              <br/>

              <div class="hcu-edit-buttons k-state-default">
                <a href="##" id="btnBack" class="hide-for-apps"><?php echo $MC->msg('Back', HCU_DISPLAY_AS_HTML) ?></a>
                &emsp;
                <a href="##" id="btnReset" class="k-button k-primary">
                  <i class="fa fa-check fa-lg"></i><?php echo $MC->msg('Reset Password', HCU_DISPLAY_AS_HTML) ?>
                </a>
              </div>

            </form>
          </div>


      </div>

<?php } ?>
<script type="text/javascript">
$(document).ready(function() {
  CloseWaitWindow();

  homecuTooltip.bind({ emailTip: "<?php echo $MC->msg("Match Saved Email", HCU_DISPLAY_AS_JS); ?>" });

  <?php if ( isset($hbLoginHelp) && strlen( $hbLoginHelp ) > 0 ) { ?>

  homecuTooltip.bind({ loginTip: "<?php echo $MC->msg("Username NoBypass Unlock", HCU_DISPLAY_AS_JS); ?>" });

  <?php } ?>

  if ($("#formReset").length > 0) {
    $.homecuValidator.setup({
      formValidate:'formReset',
      formErrorTitle: "<?php echo $MC->msg("Error Occurred", HCU_DISPLAY_AS_JS) ?>",
      formStatusField: 'formStatus',
      validateOnClick: 'btnReset'});
  }

  $('#btnReset').click(function() {
    if ($.homecuValidator.validate()) {
      ShowWaitWindow('Loading Data');
      $('#formReset').submit();
    }
  });

  $('#formReset').keypress(function(e) {
    if (e.which === 13) {
      $('#btnReset').trigger('click');
          return false;
    }
  });

  //if there is an error, display in formStatus
  <?php if($action == "error") { ?>
  $.homecuValidator.displayMessage(<?php echo HCU_JsonEncode($screenContents); ?>, $.homecuValidator.settings.statusError);
  <?php } ?>

  $('#btnBack').click(function() {
    window.location = '<?php echo $HB_ENV['loginscript'] . "?" . $HB_ENV['cuquery']; ?>';
  });

  $('#btnStartOver').click(function() {
    window.location = '<?php echo $HB_ENV['loginpath'] . "/" . $HB_ENV["currentscript"] . "?" . $HB_ENV['cuquery']; ?>';
  });
});
</script>

<?php
    /*
     * ** END CONTENT
     */

    // ** INCLUDE POST CONTENT SCRIPT
    require_once(dirname(__FILE__) . '/../includes/hcuPostContent.i');

?>