WooYun.org

/member/resetpassword.php


else if($dopost == "getpasswd")


{


    //修改密码


    if(empty($id))//获取参数ID 没有进过任何处理！！


    {


        ShowMsg("对不起，请不要非法提交","login.php");


        exit();


    }


    $mid = preg_replace("#[^0-9]#", "", $id);//这里匹配出id里面的 数字 然后在下面进行查询


    $row = $db->GetOne("SELECT * FROM #@__pwd_tmp WHERE mid = '$mid'");


    if(empty($row))


    {


        ShowMsg("对不起，请不要非法提交","login.php");


        exit();


    }


    if(empty($setp))


    {


        $tptim= (60*60*24*3);


        $dtime = time();


        if($dtime - $tptim > $row['mailtime'])


        {


            $db->executenonequery("DELETE FROM `#@__pwd_tmp` WHERE `md` = '$id';");


            ShowMsg("对不起，临时密码修改期限已过期","login.php");


            exit();


        }


        require_once(dirname(__FILE__)."/templets/resetpassword2.htm");


    }


    elseif($setp == 2)//我们设置参数setp=2执行到这里


    {


        if(isset($key)) $pwdtmp = $key;//key在我们找回密码的时候会发送给我们！





        $sn = md5(trim($pwdtmp));


        if($row['pwd'] == $sn)


        {


            if($pwd != "")


            {


                if($pwd == $pwdok)


                {


                    $pwdok = md5($pwdok);


                    $sql = "DELETE FROM `#@__pwd_tmp` WHERE `mid` = '$id';";


                    $db->executenonequery($sql);


                    $sql = "UPDATE `#@__member` SET `pwd` = '$pwdok' WHERE `mid` = '$id';";//这里的update就是我们利用的店，pwdok就是我们设置的密码


					echo $sql;


                    if($db->executenonequery($sql))


                    {


                        showmsg('更改密码成功，请牢记新密码', 'login.php');


                        exit;


                    }


                }


            }


            showmsg('对不起，新密码为空或填写不一致', '-1');


            exit;


        }