X-Git-Url: http://git.harvie.cz/?a=blobdiff_plain;ds=sidebyside;f=wwwroot%2Finc%2Feventz%2Freset_password.inc;h=ade11eeda969b279f35dc97ab54a95e1f7c84d58;hb=0f3e30ba49a0ecdce3b731dfd2cc6ef7d50d2e9d;hp=8c3554e561c53887216c1b3a42998e9bb533b76d;hpb=51ff32267c4949bad6a8dddc502cbc01ed56edc8;p=mirrors%2FKyberia-bloodline.git

diff --git a/wwwroot/inc/eventz/reset_password.inc b/wwwroot/inc/eventz/reset_password.inc
index 8c3554e..ade11ee 100644
--- a/wwwroot/inc/eventz/reset_password.inc
+++ b/wwwroot/inc/eventz/reset_password.inc
@@ -1,11 +1,11 @@
 <?php
 function reset_password() {
     global $db,$error;
-    $login = $_POST['login'];
-    $login_type = $_POST['login_type'];
-    $vercode = $_POST['vercode'];
-    $password1 = $_POST['new_password1'];
-    $password2 = $_POST['new_password2'];
+    $login = mysql_real_escape_string($_POST['login']);
+    $login_type = mysql_real_escape_string($_POST['login_type']);
+    $vercode = mysql_real_escape_string($_POST['vercode']);
+    $password1 = mysql_real_escape_string($_POST['new_password1']);
+    $password2 = mysql_real_escape_string($_POST['new_password2']);
 
     if ($login == '') {
         $error="Please enter name or id";
@@ -44,14 +44,15 @@ function reset_password() {
         return false;
     }
 
+    // XXX fix
     $password = md5($password1);
     $q="update users set password='$password' where user_id='$user_id'";
     $db->query($q);
 
-    require(SYSTEM_ROOT.'/inc/ldap.inc');
-    LDAPuser::change_pass_forced($user_id,$password1);
+//    require(INCLUDE_DIR.'ldap.inc');
+//    LDAPuser::change_pass_forced($user_id,$password1);
 
     $error="Password changed. Now you can login with your new password.";
     return false;
 }
-?>
\ No newline at end of file
+?>