<?php


session_start();
include("include/config.php");
include("include/functions/import.php");
$thebaseurl = $config['baseurl'];

if ($_SESSION[USERID] != "" && $_SESSION[USERID] >= 0 && is_numeric($_SESSION[USERID]))
{
	if($_REQUEST[change]!="")
	{
		$query="SELECT password FROM members WHERE USERID='".mysql_real_escape_string($_SESSION[USERID])."'";
        $executequery=$conn->execute($query);
        $getpass = $executequery->fields[password];
		$encodedpass = md5($_POST[cpassword]);
		if ($encodedpass != $getpass )
		{
			$error = "$lang[504]";
		}
		elseif ($_POST[npassword] == "" )
		{
			$error = "$lang[505]";
		}
		elseif ($_POST[npassword] != $_POST[rnpassword])
		{
			$error = "$lang[506]";
		}
		else
		{
			if ($error == "")
			{
				$password = htmlentities(strip_tags($_REQUEST[npassword]));
				$password = escape($password);
				$password = md5($password);
				$query="UPDATE members SET password='".mysql_real_escape_string($password)."' WHERE USERID='$_SESSION[USERID]'";
				$conn->execute($query);
				
				if(mysql_affected_rows()>=1)
				{
					$error = "$lang[507]";
				}
				else
				{
					$error = "$lang[508]";
				}
			}
			else
			{
				$error = "$lang[509]";
			}		
			
		}
	}
	$templateselect = "changepass.tpl";
}
else
{
	header("Location:$config[baseurl]/login.php");exit;
}

$pagetitle = "$lang[24]";
STemplate::assign('pagetitle',$pagetitle);

//TEMPLATES BEGIN
STemplate::assign('error',$error);
STemplate::display('header.tpl');
STemplate::display($templateselect);
STemplate::display('footer.tpl');
//TEMPLATES END
?>