<!--#include file="../Index_Setting.asp"-->
<!--#include file="../Inc/Cl_ClsEmail.asp"-->
<!--#include file="../Inc/Cl_Md5.asp"-->
<!--#include file="../inc/upiconfig.asp"-->
<%

if Session("GetLostPass")="OK" then Cl.OutErr("您已经取回过密码，请不在一天内重复使用本功能！")
IF HLIntegration = True Then'----------恒浪(Howave.NET)整合开始------------------
Response.Redirect HL_Url&Manage_Url&"User_GetPassword.asp"
End IF'-------------------------------恒浪(Howave.NET)整合结束------------------
dim rsLost,UserName
dim Action,Answer,Password,PwdConfirm,CodeStr
Action=Trim(request("Action"))
UserName=Trim(request("UserName"))
Answer=Trim(request("Answer"))
Password=Trim(request("Password"))
PwdConfirm=Trim(request("PwdConfirm"))
CodeStr=Trim(request("LostPassCode"))

Select Case Action
Case "step1"
	TempStr=Step1
Case "step2"
	TempStr=Step2
Case "step3"
	TempStr=Step3
Case "step4"
	TempStr=Step4
Case Else
	TempStr=Step1
End Select
PageTitle="忘记密码"
Response.write Cl.ReplaceAllFlag(TempStr)

Function Step1()
	Dim strGetCode
	Step1=Split(Template.html(13),"||")(1)
	strGetCode=Split(Template.html(13),"||")(0)
	Step1=Replace(Step1,"{%getcode%}",Replace(strGetCode,"{%getcode%}",Cl.GetCode("LostPassCode")))
End Function

Function Step2()
	if Not Cl.CodeIsTrue(CodeStr,"LostPassCode") then
		Cl.OutErr("<br><li>验证码检验失败，请重新输入</li>")
	end if
	if UserName="" then
		Cl.OutErr("<br><li>用户名不能为空，请输入用户名</li>")
	else
  		if Instr(UserName,"=")>0 or Instr(UserName,"%")>0 or Instr(UserName,chr(32))>0 or Instr(UserName,"?")>0 or Instr(UserName,"&")>0 or Instr(UserName,";")>0 or Instr(UserName,",")>0 or Instr(UserName,"'")>0 or Instr(UserName,",")>0 or Instr(UserName,chr(34))>0 or Instr(UserName,chr(9))>0 or Instr(UserName,"")>0 or Instr(UserName,"$")>0 then
			Cl.OutErr("<br><li>用户名中含有非法字符</li>")
		end if
	end if
	set rsLost=server.createobject("adodb.recordset")
	OpenConn_U : rsLost.open "select " & Db.UserName & "," & Db.UserQuestion & "," & Db.UserAnswer & "," & Db.UserPassword & "," & Db.Userlevel & " from " & Db.UserTable & " where " & Db.UserName & "='" & UserName & "'",Conn_U,1,1
	if rsLost.bof and rsLost.eof then
		Cl.OutErr("<br><li>对不起，你输入的用户名不存在！</li>")
	else
		if cint(rsLost(Db.Userlevel))=1 then Cl.OutErr("<br><li>对不起，此用户为管理员用户，不允许在此取修改密码！</li><li>请联系其它管理员！</li>")

		Step2=Split(Template.html(13),"||")(2)
		Step2=Replace(Step2,"{%userquestion%}",rsLost(Db.UserQuestion))
		Step2=Replace(Step2,"{%username%}",rsLost(Db.UserName))
	end if
	rsLost.close:set rsLost=Nothing
End Function

Function Step3()
	if Answer="" then
		Cl.OutErr("<br><li>请输入提示问题的答案！</li>")
	else
		set rsLost=server.createobject("adodb.recordset")
		OpenConn_U : rsLost.open "select " & Db.UserName & "," & Db.UserQuestion & "," & Db.UserAnswer & "," & Db.UserPassword & " from " & Db.UserTable & " where " & Db.UserName & "='" & UserName & "'",Conn_U,1,1
		if rsLost.bof and rsLost.eof then
			Cl.OutErr("<br><li>对不起，用户名不存在！可能已经被管理员删除了。</li>")
		else
			if rsLost(Db.UserAnswer)<>md5(Answer,16) then Cl.OutErr("<br><li>对不起，你的答案不对！</li>")
			Step3=Split(Template.html(13),"||")(3)
			Step3=Replace(Step3,"{%userquestion%}",rsLost(Db.UserQuestion))
			Step3=Replace(Step3,"{%username%}",rsLost(Db.UserName))
			Step3=Replace(Step3,"{%useranswer%}",rsLost(Db.UserAnswer))
		end if
		rsLost.close:set rsLost=Nothing
	end if
End Function

Function Step4()
	if Password="" or cl.strLength(Password)>12 or cl.strLength(Password)<6 then
		founderr=true
		errmsg=errmsg & "<br><li>请输入密码(不能大于12小于6)</li>"
	else
		if Instr(Password,"=")>0 or Instr(Password,"%")>0 or Instr(Password,chr(32))>0 or Instr(Password,"?")>0 or Instr(Password,"&")>0 or Instr(Password,";")>0 or Instr(Password,",")>0 or Instr(Password,"'")>0 or Instr(Password,",")>0 or Instr(Password,chr(34))>0 or Instr(Password,chr(9))>0 or Instr(Password,"")>0 or Instr(Password,"$")>0 then
			errmsg=errmsg+"<br><li>密码中含有非法字符</li>"
			founderr=true
		end if
	end if
	if PwdConfirm="" then
		founderr=true
		errmsg=errmsg & "<br><li>请输入确认密码(不能大于12小于6)</li>"
	else
		if Password<>PwdConfirm then
			founderr=true
			errmsg=errmsg & "<br><li>密码和确认密码不一致</li>"
		end if
	end if
	if FoundErr=True then
		Cl.OutErr(errmsg)
	else
		set rsLost=server.createobject("adodb.recordset")
		OpenConn_U : rsLost.open "select " & Db.UserName & "," & Db.UserPassword & "," & Db.UserEmail & "," & Db.UserQuestion & "," & Db.UserAnswer & "," & Db.UserLevel & " from " & Db.UserTable & " where " & Db.UserName & "='" & UserName & "'",Conn_U,1,3
		if rsLost.bof and rsLost.eof then
			Cl.OutErr("<br><li>对不起，用户名不存在！可能已经被管理员删除了。</li>")
		else
			if cint(rsLost(Db.Userlevel))=1 then Cl.OutErr("<br><li>对不起，此用户为管理员用户，不允许在此取修改密码！</li><li>请联系其它管理员！</li>")
			if rsLost(Db.UserAnswer)<>Trim(request("OldAnswer")) then
				Cl.OutErr("<br><li>对不起，你的答案不对！</li>")
			else
				if Answer<>"" then rsLost(Db.UserAnswer)=md5(Answer,16)
				rsLost(Db.UserPassword)=md5(Password,16)
				rsLost.update

				Dim ClEmail,Useremail,MailTitle,Mailbody
				Useremail=rsLost(Db.UserEmail)
				MailTitle=Replace(Template.Strings(11),"{%webname%}",Cl.Web_Info(0))
				Mailbody=Template.html(14)
				Mailbody=Replace(Mailbody,"{%username%}",UserName)
				Mailbody=Replace(Mailbody,"{%password%}",PassWord)
				Mailbody=Replace(Mailbody,"{%copyright%}",Cl.Web_info(9))
				Mailbody=Replace(Mailbody,"{%version%}","<a href='http://www.c"&"lwang.net' target=_blank>"&Cl.Web_Version(1)&"</a>")
				Step4=Split(Template.html(13),"||")(4)
				Step4=Replace(Step4,"{%password%}",Password)
				Step4=Replace(Step4,"{%username%}",UserName)
				Set ClEmail = New Cls_SendMail
				ClEmail.SendObject = Cint(Cl.Web_Setting(17))	'设置选取组件
				ClEmail.ServerLoginName = Cl.Web_Setting(19)	'您的邮件服务器登录名
				ClEmail.ServerLoginPass = Cl.Web_Setting(20)	'登录密码
				ClEmail.SendSMTP = Cl.Web_Setting(18)			'SMTP地址
				ClEmail.SendFromEmail = Cl.Web_Info(8)		'发送来源地址
				ClEmail.SendFromName = Cl.Web_Info(0)		'发送人信息
				If ClEmail.ErrCode = 0 Then 
					ClEmail.SendMail Useremail,MailTitle,Mailbody	'执行发送邮件
				End If
				if ClEmail.ErrCode=0 Then
					Step4=Replace(Step4,"{%sendmailmsg%}",Template.Strings(6))
				else
					Step4=Replace(Step4,"{%sendmailmsg%}","")
				end if
				Set ClEmail = Nothing
			end if
		end if
		rsLost.close:set rsLost=Nothing
	end if
	Session("GetLostPass")="OK"
End Function
%>
<%
'===================================================
' CreateLive CMS Version 3.1
'							Powered by Aspoo.CoM
'===================================================
' Mail: aspoo@126.com, Info@aspoo.cn
' Q  Q: 3315263, 596197794
' Msn : aspoo@126.com, Clw866@hotmail.com
' Web : http://www.aspoo.com, http://www.aspoo.net
' Bbs : http://bbs.aspoo.com, http://bbs.aspoo.net
' Copyright (C) 2005 Aspoo.CoM All Rights Reserved.
'===================================================
%>