<?php
error_reporting(E_ALL & ~E_WARNING & ~E_NOTICE & ~E_DEPRECATED);
ob_start();
session_start();
if(empty($_SERVER['HTTP_X_REQUESTED_WITH']) || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest') {
    die();
}
require_once("../../backend/functions.php");
require_once("../../db/connection.php");
require_once("../../config/config.inc.php");
$id_map = (int)$_POST['id_map'];
$forgot_code = strip_tags($_POST['forgot_code']);
$password = strip_tags($_POST['password']);
$settings_auth = sml_get_viewer_auth_settings($id_map);
if((int)$settings_auth['viewer_auth_mode']<=0 || empty($forgot_code)) {
    ob_end_clean();
    echo json_encode(array("status"=>"error","msg"=>_("Invalid verification code")));
    exit;
}
$settings = get_settings();
set_language($settings['language'],$settings['language_domain']);
$key_enc = PASSWORDS_ENCRYPT_KEY;
$query = "SELECT id,username,email,role,active FROM sml_users WHERE forgot_code=? LIMIT 1;";
if($smt = $mysqli->prepare($query)) {
    $smt->bind_param('s', $forgot_code);
    $result = $smt->execute();
    if($result) {
        $result = get_result($smt);
        if(count($result)==1) {
            $user = array_shift($result);
            $id_user = (int)$user['id'];
            $query = "UPDATE sml_users SET password=AES_ENCRYPT(?, ?),forgot_code='' WHERE id=?;";
            if($smt = $mysqli->prepare($query)) {
                $smt->bind_param('ssi',$password,$key_enc,$id_user);
                if($smt->execute()) {
                    session_regenerate_id(true);
                    $_SESSION['viewer_id_user'] = $id_user;
                    sml_clear_viewer_remember_token();
                    $user_public = array("id"=>$id_user,"username"=>$user['username'],"role"=>$user['role']);
                    if(isset($user['email'])) {
                        $user_public['email'] = $user['email'];
                    }
                    $user_public['markers_total'] = 0;
                    $user_public['markers_pending'] = 0;
                    $query_markers = "SELECT COUNT(*) as total, SUM(CASE WHEN to_validate=1 THEN 1 ELSE 0 END) as pending FROM sml_markers WHERE id_map=? AND id_user=?;";
                    if($smt_markers = $mysqli->prepare($query_markers)) {
                        $smt_markers->bind_param('ii',$id_map,$id_user);
                        if($smt_markers->execute()) {
                            $result_markers = get_result($smt_markers);
                            if(count($result_markers)==1) {
                                $row_markers = array_shift($result_markers);
                                $user_public['markers_total'] = (int)$row_markers['total'];
                                $user_public['markers_pending'] = (int)$row_markers['pending'];
                            }
                        }
                    }
                    ob_end_clean();
                    echo json_encode(array("status"=>"ok","user"=>$user_public));
                    exit;
                }
            }
            ob_end_clean();
            echo json_encode(array("status"=>"error","msg"=>_("Error, retry later")));
            exit;
        }
    }
}
ob_end_clean();
echo json_encode(array("status"=>"error","msg"=>_("Invalid verification code")));
