Revision 1425
Added by Dietmar almost 14 years ago
save.php | ||
---|---|---|
1 |
<?php
|
|
2 |
/**
|
|
3 |
*
|
|
4 |
* @category admin
|
|
5 |
* @package preferences
|
|
6 |
* @author Independend-Software-Team
|
|
7 |
* @author WebsiteBaker Project
|
|
8 |
* @copyright 2004-2009, Ryan Djurovich
|
|
9 |
* @copyright 2009-2011, Website Baker Org. e.V.
|
|
10 |
* @link http://www.websitebaker2.org/
|
|
11 |
* @license http://www.gnu.org/licenses/gpl.html
|
|
12 |
* @platform WebsiteBaker 2.8.x
|
|
13 |
* @requirements PHP 5.2.2 and higher
|
|
14 |
* @version $Id$
|
|
15 |
* @filesource $HeadURL$
|
|
16 |
* @lastmodified $Date$
|
|
17 |
*
|
|
18 |
*/
|
|
19 |
|
|
20 |
|
|
21 |
// Print admin header
|
|
22 |
require('../../config.php');
|
|
23 |
require_once(WB_PATH.'/framework/class.admin.php');
|
|
24 |
$admin = new admin('Preferences');
|
|
25 |
$js_back = "javascript: history.go(-1);"; // Create a javascript back link
|
|
26 |
|
|
27 |
function save_preferences( &$admin, &$database)
|
|
28 |
{
|
|
29 |
global $MESSAGE;
|
|
30 |
$err_msg = array();
|
|
31 |
$min_pass_length = 6;
|
|
32 |
// first check form-tan
|
|
33 |
if(!$admin->checkFTAN()){ $err_msg[] = $MESSAGE['GENERIC_SECURITY_ACCESS']; }
|
|
34 |
// Get entered values and validate all
|
|
35 |
// remove any dangerouse chars from display_name
|
|
36 |
$display_name = $admin->add_slashes(strip_tags(trim($admin->get_post('display_name'))));
|
|
37 |
$display_name = ( $display_name == '' ? $admin->get_display_name() : $display_name );
|
|
38 |
// check that display_name is unique in whoole system (prevents from User-faking)
|
|
39 |
$sql = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` ';
|
|
40 |
$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `display_name` LIKE "'.$display_name.'"';
|
|
41 |
if( $database->get_one($sql) > 0 ){ $err_msg[] = $MESSAGE['USERS']['USERNAME_TAKEN']; }
|
|
42 |
// language must be 2 upercase letters only
|
|
43 |
$language = strtoupper($admin->get_post('language'));
|
|
44 |
$language = (preg_match('/^[A-Z]{2}$/', $language) ? $language : DEFAULT_LANGUAGE);
|
|
45 |
// timezone must be between -12 and +13 or -20 as system_default
|
|
46 |
$timezone = $admin->get_post('timezone');
|
|
47 |
$timezone = (is_numeric($timezone) ? $timezone : -20);
|
|
48 |
$timezone = ( ($timezone >= -12 && $timezone <= 13) ? $timezone : -20 ) * 3600;
|
|
49 |
// date_format must be a key from /interface/date_formats
|
|
50 |
$date_format = $admin->get_post('date_format');
|
|
51 |
$date_format_key = str_replace(' ', '|', $date_format);
|
|
52 |
$user_time = true;
|
|
53 |
include( ADMIN_PATH.'/interface/date_formats.php' );
|
|
54 |
$date_format = (array_key_exists($date_format_key, $DATE_FORMATS) ? $date_format : 'system_default');
|
|
55 |
$date_format = ($date_format == 'system_default' ? '' : $date_format);
|
|
56 |
unset($DATE_FORMATS);
|
|
57 |
// time_format must be a key from /interface/time_formats
|
|
58 |
$time_format = $admin->get_post('time_format');
|
|
59 |
$time_format_key = str_replace(' ', '|', $time_format);
|
|
60 |
$user_time = true;
|
|
61 |
include( ADMIN_PATH.'/interface/time_formats.php' );
|
|
62 |
$time_format = (array_key_exists($time_format_key, $TIME_FORMATS) ? $time_format : 'system_default');
|
|
63 |
$time_format = ($time_format == 'system_default' ? '' : $time_format);
|
|
64 |
unset($TIME_FORMATS);
|
|
65 |
// email should be validatet by core
|
|
66 |
$email = ( $admin->get_post('email') == null ? '' : $admin->get_post('email') );
|
|
67 |
if( !$admin->validate_email($email) )
|
|
68 |
{
|
|
69 |
$email = '';
|
|
70 |
$err_msg[] = $MESSAGE['USERS']['INVALID_EMAIL'];
|
|
71 |
}else {
|
|
72 |
// check that email is unique in whoole system
|
|
73 |
$email = $admin->add_slashes($email);
|
|
74 |
$sql = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` ';
|
|
75 |
$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `email` LIKE "'.$email.'"';
|
|
76 |
if( $database->get_one($sql) > 0 ){ $err_msg[] = $MESSAGE['USERS']['EMAIL_TAKEN']; }
|
|
77 |
}
|
|
78 |
// receive password vars and calculate needed action
|
|
79 |
$current_password = $admin->get_post('current_password');
|
|
80 |
$current_password = ($current_password == null ? '' : $current_password);
|
|
81 |
$new_password_1 = $admin->get_post('new_password_1');
|
|
82 |
$new_password_1 = (($new_password_1 == null || $new_password_1 == '') ? '' : $new_password_1);
|
|
83 |
$new_password_2 = $admin->get_post('new_password_2');
|
|
84 |
$new_password_2 = (($new_password_2 == null || $new_password_2 == '') ? '' : $new_password_2);
|
|
85 |
if($current_password == '')
|
|
86 |
{
|
|
87 |
$err_msg[] = $MESSAGE['PREFERENCES']['CURRENT_PASSWORD_INCORRECT'];
|
|
88 |
}else {
|
|
89 |
// if new_password is empty, still let current one
|
|
90 |
if( $new_password_1 == '' )
|
|
91 |
{
|
|
92 |
$new_password_1 = $current_password;
|
|
93 |
$new_password_2 = $current_password;
|
|
94 |
}
|
|
95 |
|
|
96 |
// is password lenght matching min_pass_lenght ?
|
|
97 |
if( $new_password_1 != $current_password )
|
|
98 |
{
|
|
99 |
if( strlen($new_password_1) < $min_pass_length )
|
|
100 |
{
|
|
101 |
$err_msg[] = $MESSAGE['USERS']['PASSWORD_TOO_SHORT'];
|
|
102 |
}
|
|
103 |
$pattern = '/[^'.$admin->password_chars.']/';
|
|
104 |
if( preg_match($pattern, $new_password_1) )
|
|
105 |
{
|
|
106 |
$err_msg[] = $MESSAGE['PREFERENCES']['INVALID_CHARS'];
|
|
107 |
}
|
|
108 |
}
|
|
109 |
// is password lenght matching min_pass_lenght ?
|
|
110 |
if( $new_password_1 != $current_password && strlen($new_password_1) < $min_pass_length )
|
|
111 |
{
|
|
112 |
$err_msg[] = $MESSAGE['USERS']['PASSWORD_TOO_SHORT'];
|
|
113 |
}
|
|
114 |
// password_1 matching password_2 ?
|
|
115 |
if( $new_password_1 != $new_password_2 )
|
|
116 |
{
|
|
117 |
$err_msg[] = $MESSAGE['USERS']['PASSWORD_MISMATCH'];
|
|
118 |
}
|
|
119 |
}
|
|
120 |
$current_password = md5($current_password);
|
|
121 |
$new_password_1 = md5($new_password_1);
|
|
122 |
$new_password_2 = md5($new_password_2);
|
|
123 |
// if no validation errors, try to update the database, otherwise return errormessages
|
|
124 |
if(sizeof($err_msg) == 0)
|
|
125 |
{
|
|
126 |
$sql = 'UPDATE `'.TABLE_PREFIX.'users` ';
|
|
127 |
$sql .= 'SET `display_name` = "'.$display_name.'", ';
|
|
128 |
$sql .= '`password` = "'.$new_password_1.'", ';
|
|
129 |
$sql .= '`email` = "'.$email.'", ';
|
|
130 |
$sql .= '`language` = "'.$language.'", ';
|
|
131 |
$sql .= '`timezone` = "'.$timezone.'", ';
|
|
132 |
$sql .= '`date_format` = "'.$date_format.'", ';
|
|
133 |
$sql .= '`time_format` = "'.$time_format.'" ';
|
|
134 |
$sql .= 'WHERE `user_id` = '.(int)$admin->get_user_id().' AND `password` = "'.$current_password.'"';
|
|
135 |
if( $database->query($sql) )
|
|
136 |
{
|
|
137 |
$sql_info = mysql_info($database->db_handle);
|
|
138 |
if(preg_match('/matched: *([1-9][0-9]*)/i', $sql_info) != 1)
|
|
139 |
{ // if the user_id and password dosn't match
|
|
140 |
$err_msg[] = $MESSAGE['PREFERENCES']['CURRENT_PASSWORD_INCORRECT'];
|
|
141 |
}else {
|
|
142 |
// update successfull, takeover values into the session
|
|
143 |
$_SESSION['DISPLAY_NAME'] = $display_name;
|
|
144 |
$_SESSION['LANGUAGE'] = $language;
|
|
145 |
$_SESSION['TIMEZONE'] = $timezone;
|
|
146 |
$_SESSION['EMAIL'] = $email;
|
|
147 |
// Update date format
|
|
148 |
if($date_format != '') {
|
|
149 |
$_SESSION['DATE_FORMAT'] = $date_format;
|
|
150 |
if(isset($_SESSION['USE_DEFAULT_DATE_FORMAT'])) { unset($_SESSION['USE_DEFAULT_DATE_FORMAT']); }
|
|
151 |
} else {
|
|
152 |
$_SESSION['USE_DEFAULT_DATE_FORMAT'] = true;
|
|
153 |
if(isset($_SESSION['DATE_FORMAT'])) { unset($_SESSION['DATE_FORMAT']); }
|
|
154 |
}
|
|
155 |
// Update time format
|
|
156 |
if($time_format != '') {
|
|
157 |
$_SESSION['TIME_FORMAT'] = $time_format;
|
|
158 |
if(isset($_SESSION['USE_DEFAULT_TIME_FORMAT'])) { unset($_SESSION['USE_DEFAULT_TIME_FORMAT']); }
|
|
159 |
} else {
|
|
160 |
$_SESSION['USE_DEFAULT_TIME_FORMAT'] = true;
|
|
161 |
if(isset($_SESSION['TIME_FORMAT'])) { unset($_SESSION['TIME_FORMAT']); }
|
|
162 |
}
|
|
163 |
}
|
|
164 |
}else {
|
|
165 |
$err_msg[] = 'invalid database UPDATE call in '.__FILE__.'::'.__FUNCTION__.'before line '.__LINE__;
|
|
166 |
}
|
|
167 |
}
|
|
168 |
return ( (sizeof($err_msg) > 0) ? implode('<br />', $err_msg) : '' );
|
|
169 |
}
|
|
170 |
$retval = save_preferences($admin, $database);
|
|
171 |
if( $retval == '')
|
|
172 |
{
|
|
173 |
$admin->print_success($MESSAGE['PREFERENCES']['DETAILS_SAVED']);
|
|
174 |
$admin->print_footer();
|
|
175 |
}else {
|
|
176 |
$admin->print_error($retval, $js_back);
|
|
177 |
}
|
|
178 |
|
|
1 |
<?php |
|
2 |
/** |
|
3 |
* |
|
4 |
* @category admin |
|
5 |
* @package preferences |
|
6 |
* @author Independend-Software-Team |
|
7 |
* @author WebsiteBaker Project |
|
8 |
* @copyright 2004-2009, Ryan Djurovich |
|
9 |
* @copyright 2009-2011, Website Baker Org. e.V. |
|
10 |
* @link http://www.websitebaker2.org/ |
|
11 |
* @license http://www.gnu.org/licenses/gpl.html |
|
12 |
* @platform WebsiteBaker 2.8.x |
|
13 |
* @requirements PHP 5.2.2 and higher |
|
14 |
* @version $Id$ |
|
15 |
* @filesource $HeadURL$ |
|
16 |
* @lastmodified $Date$ |
|
17 |
* |
|
18 |
*/ |
|
19 |
|
|
20 |
|
|
21 |
// Print admin header |
|
22 |
require('../../config.php'); |
|
23 |
require_once(WB_PATH.'/framework/class.admin.php'); |
|
24 |
$admin = new admin('Preferences'); |
|
25 |
// $js_back = "javascript: history.go(-1);"; // Create a javascript back link
|
|
26 |
|
|
27 |
function save_preferences( &$admin, &$database) |
|
28 |
{ |
|
29 |
global $MESSAGE; |
|
30 |
$err_msg = array(); |
|
31 |
$min_pass_length = 6; |
|
32 |
// first check form-tan |
|
33 |
if(!$admin->checkFTAN()){ $err_msg[] = $MESSAGE['GENERIC_SECURITY_ACCESS']; } |
|
34 |
// Get entered values and validate all |
|
35 |
// remove any dangerouse chars from display_name |
|
36 |
$display_name = $admin->add_slashes(strip_tags(trim($admin->get_post('display_name')))); |
|
37 |
$display_name = ( $display_name == '' ? $admin->get_display_name() : $display_name ); |
|
38 |
// check that display_name is unique in whoole system (prevents from User-faking) |
|
39 |
$sql = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` '; |
|
40 |
$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `display_name` LIKE "'.$display_name.'"'; |
|
41 |
if( $database->get_one($sql) > 0 ){ $err_msg[] = $MESSAGE['USERS']['USERNAME_TAKEN']; } |
|
42 |
// language must be 2 upercase letters only |
|
43 |
$language = strtoupper($admin->get_post('language')); |
|
44 |
$language = (preg_match('/^[A-Z]{2}$/', $language) ? $language : DEFAULT_LANGUAGE); |
|
45 |
// timezone must be between -12 and +13 or -20 as system_default |
|
46 |
$timezone = $admin->get_post('timezone'); |
|
47 |
$timezone = (is_numeric($timezone) ? $timezone : -20); |
|
48 |
$timezone = ( ($timezone >= -12 && $timezone <= 13) ? $timezone : -20 ) * 3600; |
|
49 |
// date_format must be a key from /interface/date_formats |
|
50 |
$date_format = $admin->get_post('date_format'); |
|
51 |
$date_format_key = str_replace(' ', '|', $date_format); |
|
52 |
$user_time = true; |
|
53 |
include( ADMIN_PATH.'/interface/date_formats.php' ); |
|
54 |
$date_format = (array_key_exists($date_format_key, $DATE_FORMATS) ? $date_format : 'system_default'); |
|
55 |
$date_format = ($date_format == 'system_default' ? '' : $date_format); |
|
56 |
unset($DATE_FORMATS); |
|
57 |
// time_format must be a key from /interface/time_formats |
|
58 |
$time_format = $admin->get_post('time_format'); |
|
59 |
$time_format_key = str_replace(' ', '|', $time_format); |
|
60 |
$user_time = true; |
|
61 |
include( ADMIN_PATH.'/interface/time_formats.php' ); |
|
62 |
$time_format = (array_key_exists($time_format_key, $TIME_FORMATS) ? $time_format : 'system_default'); |
|
63 |
$time_format = ($time_format == 'system_default' ? '' : $time_format); |
|
64 |
unset($TIME_FORMATS); |
|
65 |
// email should be validatet by core |
|
66 |
$email = ( $admin->get_post('email') == null ? '' : $admin->get_post('email') ); |
|
67 |
if( !$admin->validate_email($email) ) |
|
68 |
{ |
|
69 |
$email = ''; |
|
70 |
$err_msg[] = $MESSAGE['USERS']['INVALID_EMAIL']; |
|
71 |
}else { |
|
72 |
// check that email is unique in whoole system |
|
73 |
$email = $admin->add_slashes($email); |
|
74 |
$sql = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` '; |
|
75 |
$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `email` LIKE "'.$email.'"'; |
|
76 |
if( $database->get_one($sql) > 0 ){ $err_msg[] = $MESSAGE['USERS']['EMAIL_TAKEN']; } |
|
77 |
} |
|
78 |
// receive password vars and calculate needed action |
|
79 |
$current_password = $admin->get_post('current_password'); |
|
80 |
$current_password = ($current_password == null ? '' : $current_password); |
|
81 |
$new_password_1 = $admin->get_post('new_password_1'); |
|
82 |
$new_password_1 = (($new_password_1 == null || $new_password_1 == '') ? '' : $new_password_1); |
|
83 |
$new_password_2 = $admin->get_post('new_password_2'); |
|
84 |
$new_password_2 = (($new_password_2 == null || $new_password_2 == '') ? '' : $new_password_2); |
|
85 |
if($current_password == '') |
|
86 |
{ |
|
87 |
$err_msg[] = $MESSAGE['PREFERENCES']['CURRENT_PASSWORD_INCORRECT']; |
|
88 |
}else { |
|
89 |
// if new_password is empty, still let current one |
|
90 |
if( $new_password_1 == '' ) |
|
91 |
{ |
|
92 |
$new_password_1 = $current_password; |
|
93 |
$new_password_2 = $current_password; |
|
94 |
} |
|
95 |
|
|
96 |
// is password lenght matching min_pass_lenght ? |
|
97 |
if( $new_password_1 != $current_password ) |
|
98 |
{ |
|
99 |
if( strlen($new_password_1) < $min_pass_length ) |
|
100 |
{ |
|
101 |
$err_msg[] = $MESSAGE['USERS']['PASSWORD_TOO_SHORT']; |
|
102 |
} |
|
103 |
$pattern = '/[^'.$admin->password_chars.']/'; |
|
104 |
if( preg_match($pattern, $new_password_1) ) |
|
105 |
{ |
|
106 |
$err_msg[] = $MESSAGE['PREFERENCES']['INVALID_CHARS']; |
|
107 |
} |
|
108 |
} |
|
109 |
// is password lenght matching min_pass_lenght ? |
|
110 |
if( $new_password_1 != $current_password && strlen($new_password_1) < $min_pass_length ) |
|
111 |
{ |
|
112 |
$err_msg[] = $MESSAGE['USERS']['PASSWORD_TOO_SHORT']; |
|
113 |
} |
|
114 |
// password_1 matching password_2 ? |
|
115 |
if( $new_password_1 != $new_password_2 ) |
|
116 |
{ |
|
117 |
$err_msg[] = $MESSAGE['USERS']['PASSWORD_MISMATCH']; |
|
118 |
} |
|
119 |
} |
|
120 |
$current_password = md5($current_password); |
|
121 |
$new_password_1 = md5($new_password_1); |
|
122 |
$new_password_2 = md5($new_password_2); |
|
123 |
// if no validation errors, try to update the database, otherwise return errormessages |
|
124 |
if(sizeof($err_msg) == 0) |
|
125 |
{ |
|
126 |
$sql = 'UPDATE `'.TABLE_PREFIX.'users` '; |
|
127 |
$sql .= 'SET `display_name` = "'.$display_name.'", '; |
|
128 |
$sql .= '`password` = "'.$new_password_1.'", '; |
|
129 |
$sql .= '`email` = "'.$email.'", '; |
|
130 |
$sql .= '`language` = "'.$language.'", '; |
|
131 |
$sql .= '`timezone` = "'.$timezone.'", '; |
|
132 |
$sql .= '`date_format` = "'.$date_format.'", '; |
|
133 |
$sql .= '`time_format` = "'.$time_format.'" '; |
|
134 |
$sql .= 'WHERE `user_id` = '.(int)$admin->get_user_id().' AND `password` = "'.$current_password.'"'; |
|
135 |
if( $database->query($sql) ) |
|
136 |
{ |
|
137 |
$sql_info = mysql_info($database->db_handle); |
|
138 |
if(preg_match('/matched: *([1-9][0-9]*)/i', $sql_info) != 1) |
|
139 |
{ // if the user_id and password dosn't match |
|
140 |
$err_msg[] = $MESSAGE['PREFERENCES']['CURRENT_PASSWORD_INCORRECT']; |
|
141 |
}else { |
|
142 |
// update successfull, takeover values into the session |
|
143 |
$_SESSION['DISPLAY_NAME'] = $display_name; |
|
144 |
$_SESSION['LANGUAGE'] = $language; |
|
145 |
$_SESSION['TIMEZONE'] = $timezone; |
|
146 |
$_SESSION['EMAIL'] = $email; |
|
147 |
// Update date format |
|
148 |
if($date_format != '') { |
|
149 |
$_SESSION['DATE_FORMAT'] = $date_format; |
|
150 |
if(isset($_SESSION['USE_DEFAULT_DATE_FORMAT'])) { unset($_SESSION['USE_DEFAULT_DATE_FORMAT']); } |
|
151 |
} else { |
|
152 |
$_SESSION['USE_DEFAULT_DATE_FORMAT'] = true; |
|
153 |
if(isset($_SESSION['DATE_FORMAT'])) { unset($_SESSION['DATE_FORMAT']); } |
|
154 |
} |
|
155 |
// Update time format |
|
156 |
if($time_format != '') { |
|
157 |
$_SESSION['TIME_FORMAT'] = $time_format; |
|
158 |
if(isset($_SESSION['USE_DEFAULT_TIME_FORMAT'])) { unset($_SESSION['USE_DEFAULT_TIME_FORMAT']); } |
|
159 |
} else { |
|
160 |
$_SESSION['USE_DEFAULT_TIME_FORMAT'] = true; |
|
161 |
if(isset($_SESSION['TIME_FORMAT'])) { unset($_SESSION['TIME_FORMAT']); } |
|
162 |
} |
|
163 |
} |
|
164 |
}else { |
|
165 |
$err_msg[] = 'invalid database UPDATE call in '.__FILE__.'::'.__FUNCTION__.'before line '.__LINE__; |
|
166 |
} |
|
167 |
} |
|
168 |
return ( (sizeof($err_msg) > 0) ? implode('<br />', $err_msg) : '' ); |
|
169 |
} |
|
170 |
$retval = save_preferences($admin, $database); |
|
171 |
if( $retval == '') |
|
172 |
{ |
|
173 |
$admin->print_success($MESSAGE['PREFERENCES']['DETAILS_SAVED']); |
|
174 |
$admin->print_footer(); |
|
175 |
}else { |
|
176 |
$admin->print_error($retval);
|
|
177 |
} |
|
178 |
|
|
179 | 179 |
?> |
Also available in: Unified diff
redefined wrong admin backlinks