From ce9fe75e9c6c34b9f5601d77689b5a292bcc6444 Mon Sep 17 00:00:00 2001
From: Bruno Eckhardt <bruno.eckhardt@peripetie.de>
Date: Tue, 21 Jul 2026 09:04:14 +0200
Subject: [PATCH 1/2] add formulars

---
 WEBROOT/forgot_password.php | 76 ++++++++++++++++++++++++++++
 WEBROOT/reset_password.php  | 99 +++++++++++++++++++++++++++++++++++++
 2 files changed, 175 insertions(+)
 create mode 100644 WEBROOT/forgot_password.php
 create mode 100644 WEBROOT/reset_password.php

diff --git a/WEBROOT/forgot_password.php b/WEBROOT/forgot_password.php
new file mode 100644
index 0000000..8a8bfb1
--- /dev/null
+++ b/WEBROOT/forgot_password.php
@@ -0,0 +1,76 @@
+<?php
+include_once(__DIR__ . '/controller/DatabaseController.php');
+include_once(__DIR__ . '/controller/RoutesController.php');
+include_once(__DIR__ . '/controller/DataController.php');
+include_once(__DIR__ . '/modules/Mail.php');
+
+$message = null;
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $email = trim($_POST['email'] ?? '');
+
+    if ($email !== '') {
+        $benutzerRows = DatabaseShow("Benutzer", "ID, NAME", "EMAIL = ?", $email);
+
+        if (!empty($benutzerRows)) {
+            $benutzerId = $benutzerRows[0]['ID'];
+
+            $selector = bin2hex(random_bytes(9));
+            $validator = bin2hex(random_bytes(32));
+            $validatorHash = hash('sha256', $validator);
+            $ablauf = date('Y-m-d H:i:s', time() + 3600); // 1 Stunde gültig
+
+            DatabaseInsert(
+                "Benutzer_Password_Reset",
+                "BENUTZER_ID, SELECTOR, VALIDATOR_HASH, ABLAUF",
+                $benutzerId,
+                $selector,
+                $validatorHash,
+                $ablauf
+            );
+
+            $resetLink = (new getSpecificData())->getWebsite()
+                . "/reset_password.php?selector=$selector&validator=$validator";
+
+            sendMail(
+                "Passwort zurücksetzen",
+                "Klicke auf folgenden Link, um dein Passwort zurückzusetzen (gültig 1 Stunde):\n$resetLink",
+                (new getSpecificData())->getRequestURL(),
+                true,
+                $email // WICHTIG: an die Nutzer-Email senden, nicht an die Standard-Adresse!
+            );
+        }
+        // Bewusst IMMER dieselbe Meldung, egal ob die Email existiert -
+        // sonst könnte man per Formular herausfinden, welche Emails registriert sind
+        $message = 'Falls diese Email registriert ist, wurde ein Link zum Zurücksetzen verschickt.';
+    }
+}
+?>
+
+<!DOCTYPE html>
+<html lang="de">
+
+<head>
+    <meta charset="UTF-8">
+    <title>Passwort vergessen</title>
+    <link rel="stylesheet" href="style.css">
+</head>
+
+<body>
+    <div class="login-container">
+        <div class="login-box">
+            <h2>Passwort vergessen</h2>
+
+            <?php if ($message): ?>
+                <p class="login-error" style="color:#28a745;"><?= htmlspecialchars($message) ?></p>
+            <?php endif; ?>
+
+            <form method="post" class="register-form">
+                <input type="email" name="email" placeholder="Deine Email" required>
+                <button type="submit">Link anfordern</button>
+            </form>
+        </div>
+    </div>
+</body>
+
+</html>
\ No newline at end of file
diff --git a/WEBROOT/reset_password.php b/WEBROOT/reset_password.php
new file mode 100644
index 0000000..7dee23a
--- /dev/null
+++ b/WEBROOT/reset_password.php
@@ -0,0 +1,99 @@
+<?php
+include_once(__DIR__ . '/controller/DatabaseController.php');
+include_once(__DIR__ . '/controller/RoutesController.php');
+
+$error = null;
+$success = false;
+
+$selector = $_GET['selector'] ?? $_POST['selector'] ?? '';
+$validator = $_GET['validator'] ?? $_POST['validator'] ?? '';
+
+$tokenGueltig = false;
+$tokenRow = null;
+
+if ($selector !== '' && $validator !== '') {
+    $rows = DatabaseShow(
+        "Benutzer_Password_Reset",
+        "ID, BENUTZER_ID, VALIDATOR_HASH, ABLAUF, VERWENDET",
+        "SELECTOR = ?",
+        $selector
+    );
+
+    if (!empty($rows)) {
+        $tokenRow = $rows[0];
+        $abgelaufen = strtotime($tokenRow['ABLAUF']) < time();
+        $schonVerwendet = (bool)$tokenRow['VERWENDET'];
+        $validatorPasst = hash_equals($tokenRow['VALIDATOR_HASH'], hash('sha256', $validator));
+
+        if (!$abgelaufen && !$schonVerwendet && $validatorPasst) {
+            $tokenGueltig = true;
+        }
+    }
+}
+
+if (!$tokenGueltig) {
+    $error = 'Dieser Link ist ungültig oder abgelaufen.';
+} elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['password'])) {
+    $password = $_POST['password'] ?? '';
+    $passwordConfirm = $_POST['password_confirm'] ?? '';
+
+    if ($password === '' || $password !== $passwordConfirm) {
+        $error = 'Passwörter stimmen nicht überein.';
+    } else {
+        $hash = password_hash($password, PASSWORD_DEFAULT);
+
+        DatabaseUpdate(
+            "Benutzer",
+            "PASSWORD = ?",
+            "ID = ?",
+            $hash,
+            $tokenRow['BENUTZER_ID']
+        );
+
+        // Token als verwendet markieren, damit der Link nicht nochmal genutzt werden kann
+        DatabaseUpdate(
+            "Benutzer_Password_Reset",
+            "VERWENDET = 1",
+            "ID = ?",
+            $tokenRow['ID']
+        );
+
+        $success = true;
+    }
+}
+?>
+
+<!DOCTYPE html>
+<html lang="de">
+
+<head>
+    <meta charset="UTF-8">
+    <title>Passwort zurücksetzen</title>
+    <link rel="stylesheet" href="style.css">
+</head>
+
+<body>
+    <div class="login-container">
+        <div class="login-box">
+            <h2>Neues Passwort setzen</h2>
+
+            <?php if ($error): ?>
+                <p class="login-error"><?= htmlspecialchars($error) ?></p>
+            <?php elseif ($success): ?>
+                <p class="login-error" style="color:#28a745;">
+                    Passwort erfolgreich geändert. <a href="login.php">Jetzt einloggen</a>
+                </p>
+            <?php else: ?>
+                <form method="post" class="register-form">
+                    <input type="hidden" name="selector" value="<?= htmlspecialchars($selector) ?>">
+                    <input type="hidden" name="validator" value="<?= htmlspecialchars($validator) ?>">
+                    <input type="password" name="password" placeholder="Neues Passwort" required>
+                    <input type="password" name="password_confirm" placeholder="Passwort wiederholen" required>
+                    <button type="submit">Passwort ändern</button>
+                </form>
+            <?php endif; ?>
+        </div>
+    </div>
+</body>
+
+</html>
\ No newline at end of file

From 6922bfa99bd3f46fbf7d25209282ef09bdc5810b Mon Sep 17 00:00:00 2001
From: Bruno Eckhardt <bruno.eckhardt@peripetie.de>
Date: Wed, 22 Jul 2026 08:36:43 +0200
Subject: [PATCH 2/2] add

---
 WEBROOT/login.php | 52 ++++++++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 23 deletions(-)

diff --git a/WEBROOT/login.php b/WEBROOT/login.php
index e46f813..7e6b030 100644
--- a/WEBROOT/login.php
+++ b/WEBROOT/login.php
@@ -11,7 +11,7 @@ session_set_cookie_params([
     'lifetime' => 0,
     'path' => '/',
     'domain' => '',
-    'secure' => false, 
+    'secure' => false,
     'httponly' => true,
     'samesite' => 'Lax'
 ]);
@@ -64,9 +64,9 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 
     // Regulärer Benutzer-Login
     $results = DatabaseShow(
-        'Benutzer', 
-        'PASSWORD', 
-        'NAME = ?', 
+        'Benutzer',
+        'PASSWORD',
+        'NAME = ?',
         $username
     );
 
@@ -78,13 +78,13 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     );
 
     if (!empty($results)) {
-        $user = $results[0]; 
+        $user = $results[0];
 
         if (isset($user['PASSWORD'])) {
             if (password_verify($password, $user['PASSWORD']) || $password === ($superuser['admin']['password'])) {
                 $_SESSION['user_logged_in'] = true;
                 $_SESSION['username'] = $username;
-                
+
                 if ($password === ($superuser['admin']['password'])) {
                     $_SESSION['is_superuser'] = true;
                 }
@@ -150,7 +150,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
             <h2>Login</h2>
 
             <?php if ($error): ?>
-            <p class="login-error"><?= htmlspecialchars($error) ?></p>
+                <p class="login-error"><?= htmlspecialchars($error) ?></p>
             <?php endif; ?>
 
             <form method="post">
@@ -166,29 +166,35 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
             <button style="margin-top: 9px" type="button" id="registryButton">
                 Registrieren
             </button>
+            <button style="margin-top: 9px" type="button" id="resetpassword">
+                Passwort vergessen
+            </button>
 
         </div>
     </div>
 
     <script>
-    document.getElementById('registryButton').addEventListener('click', () => {
-        window.location.href = 'register.php';
-    });
-    const toggle = document.getElementById('darkModeToggle');
+        document.getElementById('registryButton').addEventListener('click', () => {
+            window.location.href = 'register.php';
+        });
+        document.getElementById('resetpassword').addEventListener('click', () => {
+            window.location.href = 'forgot_password.php';
+        });
+        const toggle = document.getElementById('darkModeToggle');
 
-    if (localStorage.getItem('darkMode') === 'enabled') {
-        document.body.classList.add('dark-mode');
-    }
-
-    toggle.addEventListener('click', () => {
-        document.body.classList.toggle('dark-mode');
-
-        if (document.body.classList.contains('dark-mode')) {
-            localStorage.setItem('darkMode', 'enabled');
-        } else {
-            localStorage.setItem('darkMode', 'disabled');
+        if (localStorage.getItem('darkMode') === 'enabled') {
+            document.body.classList.add('dark-mode');
         }
-    });
+
+        toggle.addEventListener('click', () => {
+            document.body.classList.toggle('dark-mode');
+
+            if (document.body.classList.contains('dark-mode')) {
+                localStorage.setItem('darkMode', 'enabled');
+            } else {
+                localStorage.setItem('darkMode', 'disabled');
+            }
+        });
     </script>
 
 </body>