<?php
session_start();

// Generate a nonce for inline scripts
$nonce = bin2hex(random_bytes(16));

// Set secure headers including the nonce for inline scripts
header("X-Content-Type-Options: nosniff");
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-$nonce'; style-src 'self' 'unsafe-inline'; img-src 'self' data:");
ob_start();

require_once "../../../controllers/core/inc.login.php";

if($_SESSION['mmsg'] != ''){
    unset($_SESSION['pass_changer_user_id']);
    unset($_SESSION['pass_changer_email']);
}

$cid = 'robi';

if(isset($_POST['submit'])) {

    $passward = auth_encode_sha256($_POST['pass']);
    $uid      = $_POST['uid'];

    if(check_for_login($cid, $uid, $passward, 1)) {

 

        $sql = "SELECT * FROM user_activity_management WHERE username='$uid' AND password='$passward'";
        $qry = db_query($sql);
        $item = mysqli_fetch_object($qry);

        if($item->pass_change == 'YES'){
    echo "
    <form id='postForm' method='POST' action='otp_verification.php'>
          <input type='hidden' name='user_email' value='".$uid."' />
        <input type='hidden' name='ibssignin' value='1' />
    </form>
    <script nonce='$nonce'>
        document.getElementById('postForm').submit();
    </script>
    ";
        } elseif($item->pass_change == 'NO'){
            echo "<script nonce='$nonce'>window.top.location='user_p_update.php';</script>";
        }
    } else {
        $msg = "Invalid Login Information!!!";
    }
}

require_once "../../../controllers/routing/login_interface1.php";
?>
