<?php
if(isset($_GET['id']) && isset($_GET['token'])){
require 'base.php';
require_once 'functions.php';
$req = $pdo->prepare('SELECT * FROM users WHERE id = ? AND reset_token IS NOT NULL AND reset_token = ? AND reset_at > DATE_SUB(NOW(), INTERVAL 30 MINUTE');
$req->execute([$_GET['id'], $_GET['token']]);
$user = $req->fetch();
if($user){
if(!empty($_POST)){

if(!empty($_POST['password']) && $_POST['password'] == $_POST['password_confirm']){
$password = password_hash($_POST['password'], PASSWORD_BCRYPT);
$pdo->prepare('UPDATE users SET password = ?, reset_at = NULL, rset_token = NULL')->execute([$password]);
session_start();
$_SESSION['flash']['success'] = "Votre mot de passe a bien été changé !";
$_SESSION['auth'] = $user;
header('Location: compte.php');
exit();
}

}
}else {
  session_start();
  $_SESSION['flash']['danger'] = "Ce lien n'est pas valide !";
    header('Location: connexion.php');
    exit();
}
}else {
  header('Location: connexion.php');
  exit();
}
?>
<?php require '../elements/espace_membre.php'; ?>
<h1>Réintialiser mon mot de passe </h1>
<form action="" method="POST">

  <label for="">Mot de passe : </label>
  <input type="password" name="password" /><br/><br/>

  <label for="">Confirmation du mot de passe : </label>
  <input type="password" name="password_confirm" /><br/><br/>



  <button type="submit">Réinitaliser mon mot de passe</button>

</form>