Hello.
To introduce our problem, we are using a flatfile database in a non requestable directory through the web on our web server which contains our usernames and passwords (in md5 hash).
The syntax of this 'users.txt' is:
username,md5password
We have made a script that will do the following:
- Check that the current password matches the one in the userx.txt.
- Checks that the new password and confirmed passwords from the password changing form match.
- If so, then it will update users.txt with the new password in md5 with immediate effect.
The problems we're having is that no errors are occuring, but it simply is showing the 'Sorry, the password you entered is not your current password.' even though it is.
Also, we wanted to add a new message to say 'Password successfully changed.' if the whole process is working okay.
I hope this makes sense...
The actual HTML form looks like:
<form action="/account/pass.php" method="post">
<table class="forms" cellpadding="5" cellspacing="0" border="1">
<tr>
<th><label>Current password:</label></th>
<td><input type="password" name="nowpass" maxlength="100" /></td>
</tr>
<tr>
<th><label>New password:</label></th>
<td><input type="password" name="newpass" maxlength="100" /></td>
</tr>
<tr>
<th><label>Confirm password:</label></th>
<td><input type="password" name="newpass2" maxlength="100" /></td>
</tr>
<tr>
<th><label>Human Verification:</label></th>
<td><img src="/img/image.php" alt="Security Code" />
<strong>Code to the left:</strong> <input type="text" name="securitycode" id="securitycode" size="10" maxlength="6" /></td>
</tr>
<tr>
<th><label>Change password:</label></th>
<td colspan="2"><input type="submit" name="submit" value="Update password" /> <input type="reset" value="Reset" /></td>
</tr>
</table>
</form>
and pass.php:
<?php
session_start();
function output_error($text='')
{
include_once('/home/us/account/header.php');
echo "<p>Please correct the following:</p>\n<ul>\n" . $text . "\n</ul>\n";
include_once('/home/us/account/footer.php');
exit();
}
if (!isset($_SESSION['correctcode'])) {
output_error('<li>Please enable cookies.</li>');
}
$correctcode = $_SESSION['correctcode'];
$securitycode = $_POST['securitycode'];
if ($securitycode != $correctcode) {
output_error('<li>The human validation check failed, please try again.</li>');
}
if( md5($oldpass) == $nowpass )
{
if( $newpass == $newpass2 )
{
$file = file( "/home/us/hidden/users.txt" );
// Scan the file for the right line, and replace it, at the same time, build the new file to be written
while( list($key,$val) = each($file) )
{
if( ereg( $user, $val) )
$val = $newpass;
$newfile .= "$key,$val\n";
}
// Now we have a variable $newfile, which contains the contents of the new file to be written
// Write the file
$fp = fopen( "/home/us/hidden/users.txt", "w" );
fwrite( $fp, $newfile, strlen($newfile) );
fclose($fp);
}
else
{
output_error('<li>Sorry, the new and confirmed passwords did not match.</li>');
}
}
else
{
output_error('<li>Sorry, the password you entered is not your current password.</li>');
}
?>
Any help greatly appreciated.
Thanks.
