false, 'msg'=>'请输入正确的邮箱地址']).'[[[END]]]';
exit;
}
$stmt = $pdo->prepare("SELECT id FROM users WHERE email = ?");
$stmt->execute([$email]);
$user = $stmt->fetch();
if (!$user) {
echo '[[[START]]]'.json_encode(['success'=>false, 'msg'=>'该邮箱未注册']).'[[[END]]]';
exit;
}
$code = rand(100000, 999999);
$expires = date('Y-m-d H:i:s', time() + 300); // 5分钟有效
$type = 'reset_password';
$pdo->prepare("DELETE FROM email_codes WHERE email = ?")->execute([$email]);
$pdo->prepare("INSERT INTO email_codes SET email=?, code=?, type=?, is_used=0, expires_at=?, created_at=NOW()")
->execute([$email, $code, $type, $expires]);
$subject = '重置密码验证码：' . $code;
$body = "您的重置密码验证码为：$code，有效期5分钟。";
require_once 'includes/mail_helper.php';
$errorInfo = '';
if (send_mail($email, $subject, $body, $errorInfo, 'password_reset', null, null)) {
echo '[[[START]]]'.json_encode(['success'=>true, 'msg'=>'验证码已发送到您的邮箱，请查收。']).'[[[END]]]';
} else {
echo '[[[START]]]'.json_encode(['success'=>false, 'msg'=>'邮件发送失败：' . var_export($errorInfo, true)]).'[[[END]]]';
}
exit;
}
$error = '';
$success = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$email = trim($_POST['email'] ?? '');
$code = trim($_POST['code'] ?? '');
$password = trim($_POST['password'] ?? '');
if (!filter_var($email, FILTER_VALIDATE_EMAIL) || !$code || !$password) {
$error = '请填写所有信息';
} else {
if (!function_exists('checkEmailCode')) require_once __DIR__ . '/includes/email_code_helper.php';
// 使用与发送时一致的类型 'reset_password'，避免类型不匹配导致“验证码过期”
if (!checkEmailCode($email, $code, $pdo, 'reset_password')) {
$error = '验证码错误或已过期';
} else {
$password_hash = Encryption::getInstance()->hashPassword($password);
$stmt = $pdo->prepare("UPDATE users SET password=? WHERE email=?");
$stmt->execute([$password_hash, $email]);
$uid = 0;
try {
$st = $pdo->prepare('SELECT id FROM users WHERE email=? LIMIT 1');
$st->execute([$email]);
$uid = (int) $st->fetchColumn();
} catch (Throwable $e) {
$uid = 0;
}
require_once __DIR__ . '/includes/login_lockout_helper.php';
if (is_file(__DIR__ . '/includes/security_ban_helper.php')) {
require_once __DIR__ . '/includes/security_ban_helper.php';
}
$unlock = ggai_login_lockout_unlock_after_password_reset($email, $uid);
$success = !empty($unlock['permanent_ban'])
? '密码已更新，但账号处于永久封禁，无法登录，请联系客服。'
: '密码重置成功，请登录。';
}
}
}
?>
重置密码