<!--#INCLUDE FILE="conn.asp"-->
<!--#INCLUDE FILE="Class_Checkuser.asp"-->
<!--#INCLUDE FILE="inc/Md5.asp"-->
<!--#INCLUDE FILE="Class_Top.asp"-->
<!--#include file="inc/char.asp"-->
<!--#include file="inc/UpiConfig.asp"-->

<%
  '//==恒浪整合取回密码开始==By Howave.Net & SeaShell 2007/06/08==
     Howave_LostPassword     
  '//==恒浪整合取回密码结束====
Response.Expires = -1
Response.ExpiresAbsolute = Now() - 1  
Response.cachecontrol = "no-cache" 

locat="取回密码"
Call top(1,1)
Select Case Request("action")
Case "getpass"
	Call getpass()
Case "answer"
	Call showquestion()
Case "Modify"
	Call ModifyPwd()
Case "SaveNewPwd"%>
	<!--#INCLUDE FILE="inc/validate.asp" -->
	<%Call SaveNewPassword()
Case Else 
	Call showuserform()
End Select


Sub showuserform()
	%>
	<br><br>
			<table cellpadding=5 cellspacing=1 border=0 width=100% Class=TableBorder>
	<form action="Class_GetPasswd.asp" method="post"> 
	<input type=hidden name=action value=answer>
		<tr>
		<th valign=middle colspan=2 align=center>
		<b>取回密码</b>（第一步：用户名）</font></th></tr>
		<tr Class=LightTableBody >
		<td valign=middle width=40% height=60>&nbsp;&nbsp;请输入您在同学录注册时的用户名：</td>
		<td  valign=middle>&nbsp;&nbsp;<INPUT name=username type=text size=30> &nbsp; </td></tr>
			<tr>
		<td Class=DarkTableBody valign=middle colspan=2 align=center><input type=submit name="submit" value="提交" class=button></td></tr></form>
	</table><BR>
	<%
End Sub


Sub showquestion()

dim ErrMsg,FoundErr
dim username

username=replace(trim(Request("username")),"'","")

if username="" Then
	Errmsg=Errmsg+"<br>"+"<li>请确认输入您的用户名或者您的输入有误。"
	founderr=True
Else
	sql="Select locked,userid,question from student where userid='"&username&"'"
	Set rs=conn.execute(sql)
	if rs.eof and rs.bof Then
		Errmsg=Errmsg+"<br>"+"<li>该用户名并没有在同学录注册，请确认输入是否正确。"
		founderr=True
	ElseIf rs("locked")>1 or rs("question")="" or isnull(rs("question")) Then
		 Errmsg=Errmsg+"<br>"+"<li>操作失败！你注册时没有填写取回密码时所需要的信息。"
		founderr=True
	End if
End if

if founderr=True Then
	Call Error("Information",ErrMsg)
	Exit Sub
End if


%>
<br><br><form action="Class_GetPasswd.asp" method="post"> 
<input type=hidden name=Action value=Modify>
<input type=hidden name=username value=<%=username%>>
        <table cellpadding=5 cellspacing=1 border=0 width=100% Class=TableBorder>
    <tr>
    <th  valign=middle colspan=2 align=center>
    <b>取回密码</b>（第二步：回答问题）</font></th></tr>
    <tr Class=LightTableBody>
    <td  valign=middle width=40%>
	&nbsp;&nbsp;<b>密码提示问题：</b></td><td>&nbsp;&nbsp;<%=htmlencode(rs("question"))%></td></tr>
	<tr Class=LightTableBody><td>&nbsp;&nbsp;<b>取回密码答案：</b></td><td>&nbsp;&nbsp;
        <INPUT name=answer type=text size=30> &nbsp; </td></tr>
    <tr Class=LightTableBody><td colspan=2>&nbsp;&nbsp;<img src=images/reminder.gif hspace=3>请填写您正确的问题答案。</td></tr>
	<tr>
    <td Class=DarkTableBody valign=middle colspan=2 align=center><input type=submit name="submit" value="提交" class=button></td></tr></table>
</form>
<%
End Sub



sub ModifyPwd()

	if chkpost=False Then
		ErrMsg=ErrMsg+"<Br>"+"<li>您提交的数据不合法!"
		Call Error("Critical",ErrMsg)
		Exit Sub
	End if

	answer=Request("answer")
	username=Request("username")

	if answer="" Then
		Errmsg=Errmsg+"<br>"+"<li>请确认输入了问题答案。"
		founderr=True
		errorlevel="Information"
	Else
		sql="Select answer,userpwd from student where userid='"&username&"'"
		Set rs=conn.execute(sql)
		answer=md5(answer)
		if rs("answer")<>answer Then
			Errmsg=Errmsg+"<br>"+"<li>操作失败！你的问题回答得不正确。"
			founderr=True
			errorlevel="Exclamation"
		End if
	End if

	if founderr=True Then
		Call Error(errorlevel,ErrMsg)
		Exit Sub
	End if


%>
<br><br><form action="Class_GetPasswd.asp" method="post"> 
<input type=hidden name=Action value=SaveNewPwd>
<input type=hidden name=username value=<%=username%>>
<input type=hidden name=answer value=<%=answer%>>
        <table cellpadding=5 cellspacing=1 border=0 width=100% Class=TableBorder>
    <tr>
    <th  valign=middle colspan=2 align=center>
    <b>取回密码</b>（第三步：修改密码）</font></th></tr>
    <tr Class=LightTableBody>
    <td  valign=middle width=40%>
	&nbsp;&nbsp;<b>请输入新密码：</b></td><td>&nbsp;&nbsp;<INPUT name=userpwd type=password size=30>&nbsp;</td></tr>
	<tr Class=LightTableBody><td>&nbsp;&nbsp;<b>请重复新密码：</b></td><td>&nbsp;&nbsp;<INPUT name=userpwd1 type=password size=30> &nbsp; </td></tr>
   
	<tr>
    <td Class=DarkTableBody valign=middle colspan=2 align=center><input type=submit name="submit" value="提交" class=button></td></tr></table>
</form>
<%
end sub



sub SaveNewPassword()

	if chkpost=False Then
		ErrMsg=ErrMsg+"<Br>"+"<li>您提交的数据不合法!"
		Call Error("Critical",ErrMsg)
		Exit Sub
	End if

	userpwd1=request.form("userpwd1")
	userpwd=request.form("userpwd")
	If userpwd<>userpwd1 then 
		errmsg=errmsg+"<br>"+"<li>您两次输入的密码不一致!"
		founderr=true
		errorlevel="Information"
	end If

	If userpwd1="" or len(userpwd1)<6 or len(userpwd1)>10 then
		errmsg=errmsg+"<br>"+"<li>请确认输入了密码（6-10个字符）！"
		founderr=true
		errorlevel="Information"
	ElseIf isValidstring(userpwd1)<>"" then
		If isValidstring(userpwd1)=" " then invld="空格" Else invld=isValidstring(userpwd1)
		errmsg=errmsg+"<br>"+"<li>密码中含有非法字符&nbsp;<font color=#cc0000>"&invld&"</font>&nbsp;。"
		founderr=true
		errorlevel="Information"
	ElseIf userpwd1=userid then
		errmsg=errmsg+"<br>"+"<li>密码不能和用户名相同！"
		founderr=true
		errorlevel="Information"
	end If

	if founderr=True Then
		Call Error(errorlevel,ErrMsg)
		Exit Sub
	End if

	answer=Request("answer")
	username=Request("username")

	sql="select userpwd,email,realname from student where answer='"&answer&"' and userid='"&username&"'"
	set rs=server.createobject("adodb.recordset")
	rs.open sql,conn,1,3
	if rs.eof and rs.bof then
		errmsg=errmsg+"<br>"+"<li>在修改密码时发生错误!"
		Call Error(errorlevel,ErrMsg)
		exit sub
	else
		useremail=rs("email")
		realname=rs("realname")
		rs("userpwd")=md5(userpwd)
		rs.update
	end if
	rs.close
	set rs=nothing


	RURL="Class_Login.asp?Name="&username
	Rtitle="修改密码成功"
	if SendMailStatus="OK" then
		Rmsg="感谢您使用"&StrVar(1)&"!您的密码已经同时发到了您的邮箱。"
	end if
	Rmsg=Rmsg&"<br><ul><li><a href="&RURL&">登陆同学录</a></li></ul>"
	Redirect 4,RURL,Rtitle,Rmsg


end sub%>

<%Call footer%>
