| 1 |
1425
|
Luisehahne
|
<?php
|
| 2 |
|
|
/**
|
| 3 |
|
|
*
|
| 4 |
|
|
* @category admin
|
| 5 |
|
|
* @package preferences
|
| 6 |
|
|
* @author Independend-Software-Team
|
| 7 |
|
|
* @author WebsiteBaker Project
|
| 8 |
|
|
* @copyright 2004-2009, Ryan Djurovich
|
| 9 |
|
|
* @copyright 2009-2011, Website Baker Org. e.V.
|
| 10 |
|
|
* @link http://www.websitebaker2.org/
|
| 11 |
|
|
* @license http://www.gnu.org/licenses/gpl.html
|
| 12 |
|
|
* @platform WebsiteBaker 2.8.x
|
| 13 |
|
|
* @requirements PHP 5.2.2 and higher
|
| 14 |
|
|
* @version $Id$
|
| 15 |
|
|
* @filesource $HeadURL$
|
| 16 |
|
|
* @lastmodified $Date$
|
| 17 |
|
|
*
|
| 18 |
|
|
*/
|
| 19 |
|
|
|
| 20 |
|
|
|
| 21 |
|
|
// Print admin header
|
| 22 |
|
|
require('../../config.php');
|
| 23 |
|
|
require_once(WB_PATH.'/framework/class.admin.php');
|
| 24 |
1457
|
Luisehahne
|
// suppress to print the header, so no new FTAN will be set
|
| 25 |
|
|
$admin = new admin('Preferences','start', false);
|
| 26 |
1425
|
Luisehahne
|
|
| 27 |
|
|
function save_preferences( &$admin, &$database)
|
| 28 |
|
|
{
|
| 29 |
|
|
global $MESSAGE;
|
| 30 |
|
|
$err_msg = array();
|
| 31 |
|
|
$min_pass_length = 6;
|
| 32 |
|
|
// first check form-tan
|
| 33 |
|
|
if(!$admin->checkFTAN()){ $err_msg[] = $MESSAGE['GENERIC_SECURITY_ACCESS']; }
|
| 34 |
|
|
// Get entered values and validate all
|
| 35 |
|
|
// remove any dangerouse chars from display_name
|
| 36 |
|
|
$display_name = $admin->add_slashes(strip_tags(trim($admin->get_post('display_name'))));
|
| 37 |
|
|
$display_name = ( $display_name == '' ? $admin->get_display_name() : $display_name );
|
| 38 |
|
|
// check that display_name is unique in whoole system (prevents from User-faking)
|
| 39 |
|
|
$sql = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` ';
|
| 40 |
|
|
$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `display_name` LIKE "'.$display_name.'"';
|
| 41 |
|
|
if( $database->get_one($sql) > 0 ){ $err_msg[] = $MESSAGE['USERS']['USERNAME_TAKEN']; }
|
| 42 |
|
|
// language must be 2 upercase letters only
|
| 43 |
|
|
$language = strtoupper($admin->get_post('language'));
|
| 44 |
|
|
$language = (preg_match('/^[A-Z]{2}$/', $language) ? $language : DEFAULT_LANGUAGE);
|
| 45 |
|
|
// timezone must be between -12 and +13 or -20 as system_default
|
| 46 |
|
|
$timezone = $admin->get_post('timezone');
|
| 47 |
|
|
$timezone = (is_numeric($timezone) ? $timezone : -20);
|
| 48 |
|
|
$timezone = ( ($timezone >= -12 && $timezone <= 13) ? $timezone : -20 ) * 3600;
|
| 49 |
|
|
// date_format must be a key from /interface/date_formats
|
| 50 |
|
|
$date_format = $admin->get_post('date_format');
|
| 51 |
|
|
$date_format_key = str_replace(' ', '|', $date_format);
|
| 52 |
|
|
$user_time = true;
|
| 53 |
|
|
include( ADMIN_PATH.'/interface/date_formats.php' );
|
| 54 |
|
|
$date_format = (array_key_exists($date_format_key, $DATE_FORMATS) ? $date_format : 'system_default');
|
| 55 |
|
|
$date_format = ($date_format == 'system_default' ? '' : $date_format);
|
| 56 |
|
|
unset($DATE_FORMATS);
|
| 57 |
|
|
// time_format must be a key from /interface/time_formats
|
| 58 |
|
|
$time_format = $admin->get_post('time_format');
|
| 59 |
|
|
$time_format_key = str_replace(' ', '|', $time_format);
|
| 60 |
|
|
$user_time = true;
|
| 61 |
|
|
include( ADMIN_PATH.'/interface/time_formats.php' );
|
| 62 |
|
|
$time_format = (array_key_exists($time_format_key, $TIME_FORMATS) ? $time_format : 'system_default');
|
| 63 |
|
|
$time_format = ($time_format == 'system_default' ? '' : $time_format);
|
| 64 |
|
|
unset($TIME_FORMATS);
|
| 65 |
|
|
// email should be validatet by core
|
| 66 |
1463
|
Luisehahne
|
$email = trim( $admin->get_post('email') == null ? '' : $admin->get_post('email') );
|
| 67 |
1425
|
Luisehahne
|
if( !$admin->validate_email($email) )
|
| 68 |
|
|
{
|
| 69 |
|
|
$email = '';
|
| 70 |
|
|
$err_msg[] = $MESSAGE['USERS']['INVALID_EMAIL'];
|
| 71 |
|
|
}else {
|
| 72 |
1463
|
Luisehahne
|
if($email != '') {
|
| 73 |
|
|
// check that email is unique in whoole system
|
| 74 |
|
|
$email = $admin->add_slashes($email);
|
| 75 |
|
|
$sql = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` ';
|
| 76 |
|
|
$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `email` LIKE "'.$email.'"';
|
| 77 |
|
|
if( $database->get_one($sql) > 0 ){ $err_msg[] = $MESSAGE['USERS']['EMAIL_TAKEN']; }
|
| 78 |
|
|
}
|
| 79 |
1425
|
Luisehahne
|
}
|
| 80 |
|
|
// receive password vars and calculate needed action
|
| 81 |
|
|
$current_password = $admin->get_post('current_password');
|
| 82 |
|
|
$current_password = ($current_password == null ? '' : $current_password);
|
| 83 |
|
|
$new_password_1 = $admin->get_post('new_password_1');
|
| 84 |
|
|
$new_password_1 = (($new_password_1 == null || $new_password_1 == '') ? '' : $new_password_1);
|
| 85 |
|
|
$new_password_2 = $admin->get_post('new_password_2');
|
| 86 |
|
|
$new_password_2 = (($new_password_2 == null || $new_password_2 == '') ? '' : $new_password_2);
|
| 87 |
|
|
if($current_password == '')
|
| 88 |
|
|
{
|
| 89 |
|
|
$err_msg[] = $MESSAGE['PREFERENCES']['CURRENT_PASSWORD_INCORRECT'];
|
| 90 |
|
|
}else {
|
| 91 |
|
|
// if new_password is empty, still let current one
|
| 92 |
|
|
if( $new_password_1 == '' )
|
| 93 |
|
|
{
|
| 94 |
|
|
$new_password_1 = $current_password;
|
| 95 |
|
|
$new_password_2 = $current_password;
|
| 96 |
|
|
}
|
| 97 |
|
|
|
| 98 |
|
|
// is password lenght matching min_pass_lenght ?
|
| 99 |
|
|
if( $new_password_1 != $current_password )
|
| 100 |
|
|
{
|
| 101 |
|
|
if( strlen($new_password_1) < $min_pass_length )
|
| 102 |
|
|
{
|
| 103 |
|
|
$err_msg[] = $MESSAGE['USERS']['PASSWORD_TOO_SHORT'];
|
| 104 |
|
|
}
|
| 105 |
|
|
$pattern = '/[^'.$admin->password_chars.']/';
|
| 106 |
|
|
if( preg_match($pattern, $new_password_1) )
|
| 107 |
|
|
{
|
| 108 |
|
|
$err_msg[] = $MESSAGE['PREFERENCES']['INVALID_CHARS'];
|
| 109 |
|
|
}
|
| 110 |
|
|
}
|
| 111 |
|
|
// is password lenght matching min_pass_lenght ?
|
| 112 |
|
|
if( $new_password_1 != $current_password && strlen($new_password_1) < $min_pass_length )
|
| 113 |
|
|
{
|
| 114 |
|
|
$err_msg[] = $MESSAGE['USERS']['PASSWORD_TOO_SHORT'];
|
| 115 |
|
|
}
|
| 116 |
|
|
// password_1 matching password_2 ?
|
| 117 |
|
|
if( $new_password_1 != $new_password_2 )
|
| 118 |
|
|
{
|
| 119 |
|
|
$err_msg[] = $MESSAGE['USERS']['PASSWORD_MISMATCH'];
|
| 120 |
|
|
}
|
| 121 |
|
|
}
|
| 122 |
|
|
$current_password = md5($current_password);
|
| 123 |
|
|
$new_password_1 = md5($new_password_1);
|
| 124 |
|
|
$new_password_2 = md5($new_password_2);
|
| 125 |
|
|
// if no validation errors, try to update the database, otherwise return errormessages
|
| 126 |
|
|
if(sizeof($err_msg) == 0)
|
| 127 |
|
|
{
|
| 128 |
|
|
$sql = 'UPDATE `'.TABLE_PREFIX.'users` ';
|
| 129 |
|
|
$sql .= 'SET `display_name` = "'.$display_name.'", ';
|
| 130 |
|
|
$sql .= '`password` = "'.$new_password_1.'", ';
|
| 131 |
1463
|
Luisehahne
|
if($email != '') {
|
| 132 |
|
|
$sql .= '`email` = "'.$email.'", ';
|
| 133 |
|
|
}
|
| 134 |
1425
|
Luisehahne
|
$sql .= '`language` = "'.$language.'", ';
|
| 135 |
|
|
$sql .= '`timezone` = "'.$timezone.'", ';
|
| 136 |
|
|
$sql .= '`date_format` = "'.$date_format.'", ';
|
| 137 |
|
|
$sql .= '`time_format` = "'.$time_format.'" ';
|
| 138 |
|
|
$sql .= 'WHERE `user_id` = '.(int)$admin->get_user_id().' AND `password` = "'.$current_password.'"';
|
| 139 |
|
|
if( $database->query($sql) )
|
| 140 |
|
|
{
|
| 141 |
|
|
$sql_info = mysql_info($database->db_handle);
|
| 142 |
|
|
if(preg_match('/matched: *([1-9][0-9]*)/i', $sql_info) != 1)
|
| 143 |
|
|
{ // if the user_id and password dosn't match
|
| 144 |
|
|
$err_msg[] = $MESSAGE['PREFERENCES']['CURRENT_PASSWORD_INCORRECT'];
|
| 145 |
|
|
}else {
|
| 146 |
|
|
// update successfull, takeover values into the session
|
| 147 |
|
|
$_SESSION['DISPLAY_NAME'] = $display_name;
|
| 148 |
|
|
$_SESSION['LANGUAGE'] = $language;
|
| 149 |
|
|
$_SESSION['TIMEZONE'] = $timezone;
|
| 150 |
|
|
$_SESSION['EMAIL'] = $email;
|
| 151 |
|
|
// Update date format
|
| 152 |
|
|
if($date_format != '') {
|
| 153 |
|
|
$_SESSION['DATE_FORMAT'] = $date_format;
|
| 154 |
|
|
if(isset($_SESSION['USE_DEFAULT_DATE_FORMAT'])) { unset($_SESSION['USE_DEFAULT_DATE_FORMAT']); }
|
| 155 |
|
|
} else {
|
| 156 |
|
|
$_SESSION['USE_DEFAULT_DATE_FORMAT'] = true;
|
| 157 |
|
|
if(isset($_SESSION['DATE_FORMAT'])) { unset($_SESSION['DATE_FORMAT']); }
|
| 158 |
|
|
}
|
| 159 |
|
|
// Update time format
|
| 160 |
|
|
if($time_format != '') {
|
| 161 |
|
|
$_SESSION['TIME_FORMAT'] = $time_format;
|
| 162 |
|
|
if(isset($_SESSION['USE_DEFAULT_TIME_FORMAT'])) { unset($_SESSION['USE_DEFAULT_TIME_FORMAT']); }
|
| 163 |
|
|
} else {
|
| 164 |
|
|
$_SESSION['USE_DEFAULT_TIME_FORMAT'] = true;
|
| 165 |
|
|
if(isset($_SESSION['TIME_FORMAT'])) { unset($_SESSION['TIME_FORMAT']); }
|
| 166 |
|
|
}
|
| 167 |
|
|
}
|
| 168 |
|
|
}else {
|
| 169 |
|
|
$err_msg[] = 'invalid database UPDATE call in '.__FILE__.'::'.__FUNCTION__.'before line '.__LINE__;
|
| 170 |
|
|
}
|
| 171 |
|
|
}
|
| 172 |
|
|
return ( (sizeof($err_msg) > 0) ? implode('<br />', $err_msg) : '' );
|
| 173 |
|
|
}
|
| 174 |
|
|
$retval = save_preferences($admin, $database);
|
| 175 |
|
|
if( $retval == '')
|
| 176 |
|
|
{
|
| 177 |
1467
|
Luisehahne
|
// print the header
|
| 178 |
|
|
$admin->print_header();
|
| 179 |
1425
|
Luisehahne
|
$admin->print_success($MESSAGE['PREFERENCES']['DETAILS_SAVED']);
|
| 180 |
|
|
$admin->print_footer();
|
| 181 |
|
|
}else {
|
| 182 |
1467
|
Luisehahne
|
// print the header
|
| 183 |
|
|
$admin->print_header();
|
| 184 |
1425
|
Luisehahne
|
$admin->print_error($retval);
|
| 185 |
|
|
}
|