prepare('UPDATE customers SET password_hash=? WHERE id=?') ->execute([password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]), $uid]); unset($_SESSION['pw_reset_uid']); flash('Password updated. You can now sign in.'); redirect('/login'); } $step = 2; } else { // ---- Step 1: verify username + keyfile ---- if (rate_limit('forgot_pw', 5, 600)) { $errors['username'] = 'Too many attempts. Please wait a few minutes.'; } $username = trim($_POST['username'] ?? ''); if (!$errors && $username === '') $errors['username'] = 'Username required.'; $raw_key = ''; if (!$errors) { if (!empty($_FILES['keyfile']['tmp_name'])) { if ($_FILES['keyfile']['size'] > 8192) { $errors['keyfile'] = 'Invalid keyfile.'; } else { $content = @file_get_contents($_FILES['keyfile']['tmp_name']); $raw_key = $content !== false ? parse_login_key($content) : ''; } } if ($raw_key === '') { $pasted = trim($_POST['keytext'] ?? ''); $raw_key = $pasted !== '' ? parse_login_key($pasted) : ''; } if ($raw_key === '') $errors['keyfile'] = 'No valid keyfile or key provided.'; } if (!$errors) { $key_hash = hash('sha256', $raw_key); $s = $pdo->prepare('SELECT * FROM customers WHERE username=? AND login_key_hash=? AND active=1'); $s->execute([strtolower($username), $key_hash]); $cust = $s->fetch(); if ($cust) { $_SESSION['pw_reset_uid'] = (int) $cust['id']; $step = 2; } else { // Generic error — don't reveal whether username or key was wrong $errors['username'] = 'Username and keyfile did not match any account.'; } } } } // If session already has a verified uid (e.g. page reload) stay on step 2 if (!$errors && isset($_SESSION['pw_reset_uid']) && $_SESSION['pw_reset_uid'] > 0 && $step === 1) { $step = 2; } $page_title = 'Account recovery'; require __DIR__ . '/includes/header.php'; ?>

Account recovery

✓ Keyfile verified. Set a new password below.

Enter your username and upload your login keyfile to verify your identity and reset your password.

No keyfile? If you no longer have your keyfile and have also forgotten your password, your account cannot be recovered. This is by design — the keyfile is your proof of identity.