diff --git a/portal/login_reset.php b/portal/login_reset.php index 702c83dd..a6201ff9 100644 --- a/portal/login_reset.php +++ b/portal/login_reset.php @@ -38,9 +38,19 @@ if (!isset($_SESSION)) { $ip = sanitizeInput(getIP()); $user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); +// Get Company Info $company_sql = mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1"); $company_results = mysqli_fetch_array($company_sql); -$company_name = $company_results['company_name']; +$company_name = sanitizeInput($company_results['company_name']); +$company_phone = sanitizeInput(formatPhoneNumber($company_results['company_phone'])); +$company_name_display = $company_results['company_name']; + +// Get settings from get_settings.php and sanitize them +$config_ticket_from_name = sanitizeInput($config_ticket_from_name); +$config_ticket_from_email = sanitizeInput($config_ticket_from_email); +$config_mail_from_name = sanitizeInput($config_mail_from_name); +$config_mail_from_email = sanitizeInput($config_mail_from_email); +$config_base_url = sanitizeInput($config_base_url); DEFINE("WORDING_ERROR", "Something went wrong! Your link may have expired. Please request a new password reset e-mail."); @@ -68,8 +78,8 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { // Send reset email - $subject = mysqli_real_escape_string($mysqli, "Password reset for $company_name ITFlow Portal"); - $body = mysqli_real_escape_string($mysqli, "Hello, $name

Someone (probably you) has requested a new password for your account on $company_name's ITFlow Client Portal.

Please click here to reset your password.

Alternatively, copy and paste this URL into your browser:
$url

If you didn't request this change, you can safely ignore this email.

~
$company_name
Support Department
$config_mail_from_email"); + $subject = "Password reset for $company_name Client Portal"; + $body = "Hello $name,

Someone (probably you) has requested a new password for your account on $company_name\'s Client Portal.

Please click here to reset your password.

Alternatively, copy and paste this URL into your browser:
$url

If you didn't request this change, you can safely ignore this email.

--
$company_name - Support
$config_ticket_from_email
$company_phone"; $data = [ [ @@ -124,8 +134,8 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Contact', log_action = 'Modify', log_description = 'Reset portal password for $email.', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client"); // Send confirmation email - $subject = mysqli_real_escape_string($mysqli, "Password reset confirmation for $company_name ITFlow Portal"); - $body = mysqli_real_escape_string($mysqli, "Hello, $name

Your password for your account on $company_name's ITFlow Client Portal was successfully reset. You should be all set!

If you didn't reset your password, please get in touch ASAP.

~
$company_name
Support Department
$config_mail_from_email"); + $subject = "Password reset confirmation for $company_name Client Portal"; + $body = "Hello $name,

Your password for your account on $company_name\'s Client Portal was successfully reset. You should be all set!

If you didn\'t reset your password, please get in touch ASAP.

~
$company_name - Support
$config_ticket_from_email
$company_phone"; $data = [ @@ -158,16 +168,16 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { } - } ?> + - <?php echo $company_name; ?> | Password Reset + <?php echo nullable_htmlentities($company_name_display); ?> | Password Reset @@ -185,7 +195,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
- +
- - - + + +