WooYun.org

//找回密码第2步
elseif ($act=='get_pass')
{
	$captcha=get_cache('captcha');
	$postcaptcha = trim($_POST['postcaptcha']);
	if($captcha['verify_getpwd']=='1' && empty($postcaptcha))
	{
		showmsg("请填写验证码",1);
 	}
	if ($captcha['verify_getpwd']=='1' &&  strcasecmp($_SESSION['imageCaptcha_content'],$postcaptcha)!=0)
	{
		showmsg("验证码错误",1);
	}
	$postusername=trim($_POST['username'])?trim($_POST['username']):showmsg('请输入用户名！',1);
	if (empty($_POST['email']) || !preg_match("/^\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*$/",$_POST['email']))
	{
	showmsg('电子邮箱格式错误！',1);
	}
	require_once(QISHI_ROOT_PATH.'include/fun_user.php');
	$userinfo=get_user_inusername($postusername);
	if (empty($userinfo) || $userinfo['email']<>$_POST['email'])
	{
	showmsg('用户名或注册邮箱填写错误',1);
	}
	else
	{
			$mailconfig=get_cache('mailconfig');
			$arr['username']=$userinfo['username'];
			$arr['password']=rand(100000,999999);
				if (smtp_mail($userinfo['email'],"找回密码","您的新密码为：".$arr['password']))
				{
					$md5password=md5(md5($arr['password']).$userinfo['pwd_hash'].$QS_pwdhash);
					if (!$db->query( "UPDATE ".table('members')." SET password = '$md5password'  WHERE uid='{$userinfo['uid']}'"))
					{
					showmsg('密码修改失败',1);
					}
 					$smarty->assign('step',"2");
					$smarty->assign('email',$userinfo['email']);
					$smarty->assign('title','找回密码 - '.$_CFG['site_name']);
					$smarty->display('user/getpass.htm');
				}
				else
				{
					showmsg('邮件发送失败，请联系网站管理员',0);
				}
	}
}