<?php
  /*

      verifyemail.php

      Allows a user to confirm their email change.

      Changelog:
        2005-07-03 arne_sf: Replaced all instances of column name 'user' for
          table tbl_EmailConfirmation with 'userid'
    
      ----
  
      Copyright (C) 2003  Central Manchester CLC

      This program is free software; you can redistribute it and/or
      modify it under the terms of the GNU General Public License
      as published by the Free Software Foundation version 2.

      This program is distributed in the hope that it will be useful,
      but WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      GNU General Public License for more details.

      You should have received a copy of the GNU General Public License
      along with this program; if not, write to the Free Software
      Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.

   */
   
  // Start session and populate it with data
  session_start();
  
  if ($_SESSION['_id'] == '') {
    require_once 'system/security.php';
    ThrowOut();
  }

  // Page Title
  $ptitle = 'Verify Email';

  // Includes
  require_once 'system/db.php';
  require_once 'system/message.php';
  require 'header.php';
  
  // Language selection
  set_text_domain("verifyemail");

  // Delete unconfirmed entries older than 5 days
  // (only 1 in every 10 page views to reduce load)
  srand((double) microtime() * 1000000);
  $debug = false;
  // Change to true for testing

  if (rand(1,10) == 1 || $debug) {
    $days = 5;
    // delete records older than 5 days
    $olddate = mktime(0,0,0,date("%m"), date("%d") - $days, date("%y"));
    db_send("DELETE FROM tbl_EmailConfirmation WHERE date < $olddate");
  }
?>
  <h1><?php echo gettext("Email verification")?></h1>

<?php
  $id = $_GET['id'];
  $error = false;
  if (isset($id)) {
    // Chack hash against that in the database
    $result = db_recordset("SELECT * FROM tbl_EmailConfirmation WHERE hash='$id'");
    if (count($result) > 0) {
      $_SESSION['_email'] = $result[0]['email'];
      db_send("UPDATE tbl_Users SET email='{$result[0]['email']}'
        WHERE id={$result[0]['userid']}");
      db_send("DELETE FROM tbl_EmailConfirmation WHERE hash='$id'");
?>
  <h2><?php echo gettext("Email address successfully updated.")?></h2>
  
  <div class="block">
    <a href="details.php"><?php echo gettext("Return to details page")?></a>
  </div>
<?php
    } else {
      // Invalid hash entered
      $error = true;
      unset($id);
    }
  }

  if (!isset($id)) {
    // No ID given - ask user to enter it in
    if ($error) {
?>
  <h2><?php echo gettext("<strong>ERROR:</strong> The entered ID is invalid for the email address you specified. Perhaps it was typed incorrectly?<br />\nTIP: Use the copy and paste commands on the unique id to avoid typing errors.")?></h2>
<?php
    } else {
?>
  <h2><?php echo gettext("An email has been sent to the address you have entered.<br />\nYou will need the unique ID code contained within to proceed.")?></h2>
<?php
    }
?>
        
  <div class="block">
    <p><?php echo gettext("Please enter the unique ID given to you in the confirmation email:")?></p>
    <form>
      <div class="labelfieldpair">
        <div class="name">
          <label for="id"><?php echo gettext("ID")?></label>
        </div>
        <div class="field">
          <input type="text" name="id" size="20" />
        </div>
      </div>
      <div class="buttonpanel">
        <input type="submit" value="<?php echo gettext('Confirm email address')?>" />
      </div>
    </form>
  </div>
<?php
  }
  
  // Include
  require 'footer.php';
?>
