<?php
include("postget.php");
include_once("common.php");
$pagetitle = _CHANGE_PASSWORD;

checklevel(2,$_REQUEST['clientid']);


if ($config[56][1]==1){
	messagetop(_CHANGE_NOT_ALLOWED_IN_DEMO_MODE,'','main.php',0); 
}



if($passclick!=""._CHANGE."") {
	include("head_template.php");

	echo '
<div class="container">
	<div class="row">


<table class="table table-bordered">
		<tr>
		<td align="center" width="100%">
';

	?>      	
	<form method="POST"><table><tr><td><?php echo ucfirst(_ENTER_OLD_PASSWORD) ?>:</td><td><input size=40 type=password name=old>
	</td></tr><tr><td><?php echo ucfirst(_ENTER_NEW_PASSWORD) ?>:</td><td><input size=40 type=password name=new[]></td></tr>
	<tr><td><?php echo ucfirst(_REENTER_NEW_PASSWORD) ?>:</td><td><input size=40 type=password name=new[]></td></tr>
	<tr><td><input type=submit name=passclick value=<?php echo _CHANGE ?>></td></tr></table></form>
	<?php		

echo '
		</td>
		</tr>
		</table>
</div>
</div>
';



}else{



	session_start();
	$id = $_SESSION['hd_idc'];
	if(intval($id)!=0){
		$query="SELECT password FROM hd_clients WHERE clientid=$id";
	}else{
		$query="SELECT password FROM hd_users WHERE name='$id'";
	}
	$result=mysql_query($query,$db_link);
	$out=mysql_fetch_row($result);

	if($id>1){
		$query="UPDATE hd_clients SET password='".encrypt($new[0])."' WHERE clientid='$id'";
	}else{
		$newmd5=md5($new[0]);
		$old=md5($old);
		$query="UPDATE hd_users SET password='$newmd5' WHERE name='$id'";
	}

	if($out[0]!=$old){
		messagetop(_ERROR,_OLD_PASSWORD_IS_INVALID,'changepass.php',0); 
	}else if($new[0]!=$new[1]){
		messagetop(_ERROR,_NEW_PASSWORDS_DO_NOT_MATCH,'changepass.php',0); 
	}else{
		if(!mysql_query($query,$db_link)){
			messagetop(_PASSWORD_COULD_NOT_BE_UPDATED,mysql_error(),'changepass.php',0); 
		}else{
			if($id>1){
				messagetop(_THE_CHANGES_WHERE_MADE_SUCCESSFULLY,'','index.php',1);
			}else{
				messagetop(_THE_CHANGES_WHERE_MADE_SUCCESSFULLY,'','main.php',1);
			}
		}
	}
}
?>