prepare("SELECT id, full_name FROM employees WHERE email = ?");
$stmt->execute([$email]);
$emp = $stmt->fetch();
// Always show the same success message, whether or not the email exists
// (prevents attackers from checking which emails are registered)
$success = "If an account exists with that email, a password reset link has been sent.";
if ($emp) {
$token = bin2hex(random_bytes(32));
$expires = date('Y-m-d H:i:s', strtotime('+1 hour'));
$upd = $pdo->prepare("UPDATE employees SET reset_token = ?, reset_expires = ? WHERE id = ?");
$upd->execute([$token, $expires, $emp['id']]);
$resetLink = "https://" . $_SERVER['HTTP_HOST'] . BASE_URL . "/employee/reset_password.php?token=" . $token;
$body = "
Reset Your Password
Hi " . e($emp['full_name']) . ",
We received a request to reset your The Umbergaon Jobs password. Click the button below to set a new one. This link expires in 1 hour.
Reset Password
If you didn't request this, you can safely ignore this email.
";
sendSiteEmail($email, $emp['full_name'], "Reset your The Umbergaon Jobs password", $body);
}
}
require_once __DIR__ . '/../includes/header.php';
?>