<?php
/*
 * This file is part of HOAM, copyright (C) 2002-2020 Robert Butler
 *
 * HOAM is free software; you can redistribute it and/or modify it under the
 * terms of the GNU Affero General Public License as published by the Free
 * Software Foundation; either version 3 of the License, or (at your option)
 * any later version.
 *
 * HOAM is distributed in the hope that it will be useful, but WITHOUT ANY
 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
 * details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with HOAM; if not, see http://www.gnu.org/licenses or write to the
 * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301
 *
 * Questions specific to HOAM should be directed to ARP Realty. Please see
 * the HOAM web site at http://hoam.arprs.com/
 *
 * Some portions of HOAM incorporate ideas and/or code from other sources, and
 * those portions are explicitly mentioned and attributed in the relevant
 * section of HOAM source code. Questions about that code should be directed to
 * the original authors.
 *
 */

require_once ('../../hoam/hoam-startup.php');

/*
 *
 * This file simply checks to see whether the given password is correct for the
 * given username.
 *
 */

session_start();

// We assume require that a valid session exists, and use the current user's
// id from it. We're doing this to reduce the likelyhood of password cracks by
// someone remote just constantly running through variations.
if (isset ($_GET['password']) and isset ($_SESSION['current_user']['id'])) {
	$user_class = new HOAM_user ('users');
	
	$trusted_password = $user_class -> superClean ($_GET['password'], $user_class -> returnColumnSize ('password'));
	if ($user_class -> AuthenticateUser ($user_class -> returnAccountName ($_SESSION['current_user']['id']), $trusted_password)) {
		// One, or TRUE, the password is valid
		echo "1";
	} else {
		// Zero, or FALSE, the password is invalid
		echo "0";
	}
	exit ();
}

?>
