<%@language = "javascript" %>
<% /*
    $Revision$
    $Id$

    File:           prs_perslid_otp_new_save.asp.asp
    Description:    Verifieert een temp otp-code en maakt hem eventueel definitief
    Parameters:
    Context:        Vanuit prs_perslid_otp_new.asp
    Note:           (Alleen) met FACFAC mag je dat ook bij iemand anders doen
*/
var NO_OTP_OK = true;
var JSON_Result = true;
%>

<!--#include file="../Shared/common.inc"-->
<!--#include file="../aut/login.inc"-->
<%
protectRequest.validateToken();

var theUser_key = getFParamInt("prs_key", user_key);
if (theUser_key != user_key && !user.has("WEB_FACFAC"))
  abort_with_warning(L("lcl_no_auth"));

var otp_code = getFParam("otp_code");
var otp_secret = Session("otp_secret_temp");
var otp_counter = -1;

if (!verify_otp(theUser_key, otp_code, otp_secret , -1))
    abort_with_warning(L("lcl_otp_wrong"));

var sql = "UPDATE prs_perslid"
        + "   SET prs_perslid_otpsecret = " + safe.quoted_sql(otp_secret)
        + "     , prs_perslid_otpcounter = " + otp_counter
        + " WHERE prs_perslid_key = " + theUser_key;
Oracle.Execute(sql);

shared.trackaction("PRSLOG", theUser_key, L("lcl_otp_set"));

var result = { success: true, toaster: L("lcl_otp_saved") };

Session.Contents.Remove("must_set_otp");

Response.Write(JSON.stringify(result));
%>
<% ASPPAGE_END(); %>
