<?php
//Load required scripts
require('../../../inc/connect.php');
require('../../../inc/session.php');
require('../../../inc/crypt.php');

//Get username and password
$password_current  = $_POST['password_current'];
$password1 = $_POST['password1'];
$password2 = $_POST['password2'];

$sql = "SELECT `password` FROM `user` WHERE `id`=$userid";
$query = ExecQuery($mysqli, $sql);

if($query->num_rows < 1)
{
	error("account", "An error occured");
}

$result = $query->fetch_assoc();
$password_hash = $result['password'];

if(!password_verify($password_current, $password_hash))
{
	error("account", "Your current password is incorrect");
}

if($password_current == $password1)
{
	error("account", "Your current password does not differ from the new password");
}

if($password1 != $password2)
{
	error("account", "Your new passwords do not match");
}

//Logout everywhere else
$sql = "DELETE FROM `session` WHERE `user`=$userid AND `id`<>$sessionid";
ExecQuery($mysqli, $sql);

//Change password
$password_hash = password_hash($password1, PASSWORD_BCRYPT);

$sql = "UPDATE `user` SET `password`='$password_hash' WHERE `id`=$userid";
ExecQuery($mysqli, $sql);

success("account", "Your password has been changed");
?>