Store in GIT

manage/php/session/change_password.php

@@ -0,0 +1,49 @@
+<?php
+//Load required scripts
+require('../../../inc/connect.php');
+require('../../../inc/session.php');
+require('../../../inc/crypt.php');
+
+//Get username and password
+$password_current  = $_POST['password_current'];
+$password1 = $_POST['password1'];
+$password2 = $_POST['password2'];
+
+$sql = "SELECT `password` FROM `user` WHERE `id`=$userid";
+$query = ExecQuery($mysqli, $sql);
+
+if($query->num_rows < 1)
+{
+	error("account", "An error occured");
+}
+
+$result = $query->fetch_assoc();
+$password_hash = $result['password'];
+
+if(!password_verify($password_current, $password_hash))
+{
+	error("account", "Your current password is incorrect");
+}
+
+if($password_current == $password1)
+{
+	error("account", "Your current password does not differ from the new password");
+}
+
+if($password1 != $password2)
+{
+	error("account", "Your new passwords do not match");
+}
+
+//Logout everywhere else
+$sql = "DELETE FROM `session` WHERE `user`=$userid AND `id`<>$sessionid";
+ExecQuery($mysqli, $sql);
+
+//Change password
+$password_hash = password_hash($password1, PASSWORD_BCRYPT);
+
+$sql = "UPDATE `user` SET `password`='$password_hash' WHERE `id`=$userid";
+ExecQuery($mysqli, $sql);
+
+success("account", "Your password has been changed");
+?>