MPOS / php-mpos

    $aPassword = explode('$', $strPasswordHash);

    count($aPassword) == 1 ? $password_hash = $this->getHash($current, 0) : $password_hash = $this->getHash($current, $aPassword[1], $aPassword[2]);

    $new = $this->getHash($new1, HASH_VERSION, bin2hex(openssl_random_pseudo_bytes(32)));

    if ($this->config['twofactor']['enabled'] && $this->config['twofactor']['options']['changepw']) {

      $tValid = $this->token->isTokenValid($userID, $strToken, 6);

      if ($tValid) {

        if ($this->token->deleteToken($strToken)) {

          $this->log->log("info", $this->getUserName($userID)." deleted change password token");

          // token deleted, continue

        } else {

          $this->log->log("warn", $this->getUserName($userID)." failed to delete the change password token");

          $this->setErrorMessage('Token deletion failed');

          return false;

        }

      } else {

        $this->log->log("error", $this->getUserName($userID)." attempted to use an invalid change password token");

        $this->setErrorMessage('Invalid token');

        return false;

      }

    }

    $stmt = $this->mysqli->prepare("UPDATE $this->table SET pass = ? WHERE ( id = ? AND pass = ? )");

    if ($this->checkStmt($stmt)) {

      $stmt->bind_param('sis', $new, $userID, $password_hash);

      $stmt->execute();

      if ($stmt->errno == 0 && $stmt->affected_rows === 1) {

    $donate = min(100, max(0, floatval($donate)));

    // twofactor - consume the token if it is enabled and valid

    if ($this->config['twofactor']['enabled'] && $this->config['twofactor']['options']['details']) {

      $tValid = $this->token->isTokenValid($userID, $strToken, 5);

      if ($tValid) {

        if ($this->token->deleteToken($strToken)) {

          $this->log->log("info", $this->getUserName($userID)." deleted account update token");

        } else {

          $this->setErrorMessage('Token deletion failed');

          $this->log->log("warn", $this->getUserName($userID)." updated their account details but failed to delete token");

          return false;

        }

      } else {

        $this->setErrorMessage('Invalid token');

        $this->log->log("warn", $this->getUserName($userID)." attempted to use an invalid token account update token");

        return false;

      }

    }

    // If we hide our email or it's not set, fetch current one to update

    if ($email == 'hidden' || $email == NULL)

      $email = $this->getUserEmailById($userID);

    // We passed all validation checks so update the account