<?php
//<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
//sigurnost:
if (!defined('SIGURICA')) die('Nedozvoljen pristup!');
//if ($admin_pristup!=1) die('Nedozvoljen pristup!');

//obrada prosljeđenih varijabli
// list expected fields
$expected = array('q_old_password', 'q_new_password', 'q_new_password2');
// set required fields
$required = array('q_old_password', 'q_new_password', 'q_new_password2');
// create empty array for any missing fields
$missing = array();

// process the $_POST variables
foreach ($_POST as $key => $value) {
	// assign to temporary variable and strip whitespace if not an array
	$temp = is_array($value) ? $value : trim($value);
	// if empty and required, add to $missing array
	if (empty($temp) && in_array($key, $required)) {
		array_push($missing, $key);
	}
	// otherwise, assign to a variable of the same name as $key
	elseif (in_array($key, $expected)) {
		//${$key} = $temp;
		${$key} = mysql_real_escape_string($temp);
	}
}

$error='';
$uspjeh='';

if (empty($missing))  {
	//prvo provjera da li je novi password dvaput upisan isti
	if ($q_new_password!=$q_new_password2) {
		$error.='Pogrešan unos novog passworda (nije bio isti u oba polja u formi za promjenu)<br /><br />';
	}
	
	$q_old_password=sha1($q_old_password);
	$q_new_password=sha1($q_new_password);
	
	//provjera da li postoji korisnik s istim passwordom
	$sql99="select ime_prezime from b7_user where username='$log_username' and passwd='$q_new_password'";
	$rez99=mysql_query($sql99,$conn);
	if ($rez99) $num99=mysql_num_rows($rez99);
	if ($num99>0) {
		$error.='Ne možete koristiti novi password koji ste unjeli, probajte unjeti neki drugi!<br /><br />';
	}
	
	//provjera da li je stari password ispravan
	$sql99="select ime from b7_user where username='$log_username' and passwd='$q_old_password'";
	$rez99=mysql_query($sql99,$conn);
	if ($rez99) $num99=mysql_num_rows($rez99);
	if ($num99=0) {
		$error.='Niste unjeli ispravani stari password!<br /><br />';
	}
	
	if (!$error) 
	{
	
		$result = mysql_query("update b7_user set
				
					passwd='$q_new_password'
					
					where id='$log_username_id'");				
				
		if (!$result) 
		{
			$error.= 'Došlo je do greške pri zapisu u bazu - obavjestiti administratora: '.mysql_error();
		} else 
		{
			$uspjeh.='Uspješno promjenjen password: <b>'.$q_new_password.'</b><br /><br />';
		}
	
	}
	
	
} else {
	$error.='Nisu popunjena sva polja u formi - podaci nisu spremljeni!';
}


?>
<div id="main_content">
<h1>Spremanje novog passworda za korisnika:</h1>
<?php
if ($error) {
	echo '<div class="greska">'.$error.'</div>';
} else {
	echo '<div class="uspjeh">'.$uspjeh.'</div>';
}
?>
<br /><br />
<a href="index.php?akcija=logout">Povratak...</a>
<br /><br />
</div>