reset-password.php

<?php
session_start();
require_once 'includes/db_connect.php';
require_once 'includes/auth.php';
require_once 'includes/csrf.php';

$token = $_GET['token'] ?? '';
$error = '';
$validToken = false;

if ($token) {
    $stmt = $pdo->prepare("SELECT id FROM users WHERE reset_token = ? AND reset_expires > NOW()");
    $stmt->execute([$token]);
    $validToken = (bool)$stmt->fetch();
}

if (!$validToken) {
    $error = 'Invalid or expired token';
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && $validToken) {
    if (!validateCsrfToken($_POST['csrf_token'])) {
        $error = 'Invalid request';
    } else {
        $password = $_POST['password'];
        $confirm_password = $_POST['confirm_password'];
        
        if (strlen($password) < 8) {
            $error = 'Password must be at least 8 characters';
        } elseif ($password !== $confirm_password) {
            $error = 'Passwords do not match';
        } else {
            $hashed_password = password_hash($password, PASSWORD_DEFAULT);
            
            $pdo->prepare("UPDATE users SET password = ?, reset_token = NULL, reset_expires = NULL WHERE reset_token = ?")
               ->execute([$hashed_password, $token]);
            
            $_SESSION['success_message'] = 'Your password has been updated. Please login.';
            header('Location: login.php');
            exit();
        }
    }
}

$pageTitle = 'Reset Password';
require_once 'includes/header1.php';
?>

<!-- Form for new password with token as hidden field -->