Project

General

Profile

1
<?php
2
/**
3
 *
4
 * @category        admin
5
 * @package         preferences
6
 * @author          Independend-Software-Team
7
 * @author          WebsiteBaker Project
8
 * @copyright       2004-2009, Ryan Djurovich
9
 * @copyright       2009-2011, Website Baker Org. e.V.
10
 * @link			http://www.websitebaker2.org/
11
 * @license         http://www.gnu.org/licenses/gpl.html
12
 * @platform        WebsiteBaker 2.8.x
13
 * @requirements    PHP 5.2.2 and higher
14
 * @version         $Id: save.php 1463 2011-06-30 23:11:33Z Luisehahne $
15
 * @filesource		$HeadURL: svn://isteam.dynxs.de/wb-archiv/branches/2.8.x/wb/admin/preferences/save.php $
16
 * @lastmodified    $Date: 2011-07-01 01:11:33 +0200 (Fri, 01 Jul 2011) $
17
 *
18
 */
19

    
20

    
21
// Print admin header
22
require('../../config.php');
23
require_once(WB_PATH.'/framework/class.admin.php');
24
// suppress to print the header, so no new FTAN will be set
25
$admin = new admin('Preferences','start', false);
26

    
27
function save_preferences( &$admin, &$database)
28
{
29
	global $MESSAGE;
30
	$err_msg = array();
31
	$min_pass_length = 6;
32
// first check form-tan
33
	if(!$admin->checkFTAN()){ $err_msg[] = $MESSAGE['GENERIC_SECURITY_ACCESS']; }
34
// Get entered values and validate all
35
	// remove any dangerouse chars from display_name
36
	$display_name     = $admin->add_slashes(strip_tags(trim($admin->get_post('display_name'))));
37
	$display_name     = ( $display_name == '' ? $admin->get_display_name() : $display_name );
38
	// check that display_name is unique in whoole system (prevents from User-faking)
39
	$sql  = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` ';
40
	$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `display_name` LIKE "'.$display_name.'"';
41
	if( $database->get_one($sql) > 0 ){ $err_msg[] = $MESSAGE['USERS']['USERNAME_TAKEN']; }
42
// language must be 2 upercase letters only
43
	$language         = strtoupper($admin->get_post('language'));
44
	$language         = (preg_match('/^[A-Z]{2}$/', $language) ? $language : DEFAULT_LANGUAGE);
45
// timezone must be between -12 and +13  or -20 as system_default
46
	$timezone         = $admin->get_post('timezone');
47
	$timezone         = (is_numeric($timezone) ? $timezone : -20);
48
	$timezone         = ( ($timezone >= -12 && $timezone <= 13) ? $timezone : -20 ) * 3600;
49
// date_format must be a key from /interface/date_formats
50
	$date_format      = $admin->get_post('date_format');
51
	$date_format_key  = str_replace(' ', '|', $date_format);
52
	$user_time = true;
53
	include( ADMIN_PATH.'/interface/date_formats.php' );
54
	$date_format = (array_key_exists($date_format_key, $DATE_FORMATS) ? $date_format : 'system_default');
55
	$date_format = ($date_format == 'system_default' ? '' : $date_format);
56
	unset($DATE_FORMATS);
57
// time_format must be a key from /interface/time_formats	
58
	$time_format      = $admin->get_post('time_format');
59
	$time_format_key  = str_replace(' ', '|', $time_format);
60
	$user_time = true;
61
	include( ADMIN_PATH.'/interface/time_formats.php' );
62
	$time_format = (array_key_exists($time_format_key, $TIME_FORMATS) ? $time_format : 'system_default');
63
	$time_format = ($time_format == 'system_default' ? '' : $time_format);
64
	unset($TIME_FORMATS);
65
// email should be validatet by core
66
	$email = trim( $admin->get_post('email') == null ? '' : $admin->get_post('email') );
67
	if( !$admin->validate_email($email) )
68
	{
69
		$email = '';
70
		$err_msg[] = $MESSAGE['USERS']['INVALID_EMAIL'];
71
	}else {
72
		if($email != '') {
73
		// check that email is unique in whoole system
74
			$email = $admin->add_slashes($email);
75
			$sql  = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` ';
76
			$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `email` LIKE "'.$email.'"';
77
			if( $database->get_one($sql) > 0 ){ $err_msg[] = $MESSAGE['USERS']['EMAIL_TAKEN']; }
78
		}
79
	}
80
// receive password vars and calculate needed action
81
	$current_password = $admin->get_post('current_password');
82
	$current_password = ($current_password == null ? '' : $current_password);
83
	$new_password_1   = $admin->get_post('new_password_1');
84
	$new_password_1   = (($new_password_1 == null || $new_password_1 == '') ? '' : $new_password_1);
85
	$new_password_2   = $admin->get_post('new_password_2');
86
	$new_password_2   = (($new_password_2 == null || $new_password_2 == '') ? '' : $new_password_2);
87
	if($current_password == '')
88
	{
89
		$err_msg[] = $MESSAGE['PREFERENCES']['CURRENT_PASSWORD_INCORRECT'];
90
	}else {
91
	// if new_password is empty, still let current one
92
		if( $new_password_1 == '' )
93
		{
94
			$new_password_1 = $current_password;
95
			$new_password_2 = $current_password;
96
		}
97

    
98
	// is password lenght matching min_pass_lenght ?
99
		if( $new_password_1 != $current_password )
100
		{
101
			if( strlen($new_password_1) < $min_pass_length )
102
			{
103
				$err_msg[] = $MESSAGE['USERS']['PASSWORD_TOO_SHORT'];
104
			}
105
			$pattern = '/[^'.$admin->password_chars.']/';
106
			if( preg_match($pattern, $new_password_1) )
107
			{
108
				$err_msg[] = $MESSAGE['PREFERENCES']['INVALID_CHARS'];
109
			}
110
		}
111
	// is password lenght matching min_pass_lenght ?
112
		if( $new_password_1 != $current_password && strlen($new_password_1) < $min_pass_length )
113
		{
114
			$err_msg[] = $MESSAGE['USERS']['PASSWORD_TOO_SHORT'];
115
		}
116
	// password_1 matching password_2 ?
117
		if( $new_password_1 != $new_password_2 )
118
		{
119
			$err_msg[] = $MESSAGE['USERS']['PASSWORD_MISMATCH'];
120
		}
121
	}
122
	$current_password = md5($current_password);
123
	$new_password_1   = md5($new_password_1);
124
	$new_password_2   = md5($new_password_2);
125
// if no validation errors, try to update the database, otherwise return errormessages
126
	if(sizeof($err_msg) == 0)
127
	{
128
		$sql  = 'UPDATE `'.TABLE_PREFIX.'users` ';
129
		$sql .= 'SET `display_name` = "'.$display_name.'", ';
130
		$sql .=     '`password` = "'.$new_password_1.'", ';
131
		if($email != '') {
132
			$sql .=     '`email` = "'.$email.'", ';
133
		}
134
		$sql .=     '`language` = "'.$language.'", ';
135
		$sql .=     '`timezone` = "'.$timezone.'", ';
136
		$sql .=     '`date_format` = "'.$date_format.'", ';
137
		$sql .=     '`time_format` = "'.$time_format.'" ';
138
		$sql .= 'WHERE `user_id` = '.(int)$admin->get_user_id().' AND `password` = "'.$current_password.'"';
139
		if( $database->query($sql) )
140
		{
141
			$sql_info = mysql_info($database->db_handle);
142
			if(preg_match('/matched: *([1-9][0-9]*)/i', $sql_info) != 1)
143
			{  // if the user_id and password dosn't match
144
				$err_msg[] = $MESSAGE['PREFERENCES']['CURRENT_PASSWORD_INCORRECT'];
145
			}else {
146
				// update successfull, takeover values into the session
147
				$_SESSION['DISPLAY_NAME'] = $display_name;
148
				$_SESSION['LANGUAGE'] = $language;
149
				$_SESSION['TIMEZONE'] = $timezone;
150
				$_SESSION['EMAIL'] = $email;
151
				// Update date format
152
				if($date_format != '') {
153
					$_SESSION['DATE_FORMAT'] = $date_format;
154
					if(isset($_SESSION['USE_DEFAULT_DATE_FORMAT'])) { unset($_SESSION['USE_DEFAULT_DATE_FORMAT']); }
155
				} else {
156
					$_SESSION['USE_DEFAULT_DATE_FORMAT'] = true;
157
					if(isset($_SESSION['DATE_FORMAT'])) { unset($_SESSION['DATE_FORMAT']); }
158
				}
159
				// Update time format
160
				if($time_format != '') {
161
					$_SESSION['TIME_FORMAT'] = $time_format;
162
					if(isset($_SESSION['USE_DEFAULT_TIME_FORMAT'])) { unset($_SESSION['USE_DEFAULT_TIME_FORMAT']); }
163
				} else {
164
					$_SESSION['USE_DEFAULT_TIME_FORMAT'] = true;
165
					if(isset($_SESSION['TIME_FORMAT'])) { unset($_SESSION['TIME_FORMAT']); }
166
				}
167
			}
168
		}else {
169
			$err_msg[] = 'invalid database UPDATE call in '.__FILE__.'::'.__FUNCTION__.'before line '.__LINE__;
170
		}
171
	}
172
	return ( (sizeof($err_msg) > 0) ? implode('<br />', $err_msg) : '' );
173
}
174
// print the header
175
$admin->print_header();
176
$retval = save_preferences($admin, $database);
177
if( $retval == '')
178
{
179
	$admin->print_success($MESSAGE['PREFERENCES']['DETAILS_SAVED']);
180
	$admin->print_footer();
181
}else {
182
	$admin->print_error($retval);
183
}
(2-2/2)