Project

General

Profile

1 1673 Luisehahne
<?php
2
/**
3
 *
4
 * @category        frontend
5
 * @package         account
6
 * @author          WebsiteBaker Project
7
 * @copyright       2009-2012, WebsiteBaker Org. e.V.
8
 * @link            http://www.websitebaker.org/
9
 * @license         http://www.gnu.org/licenses/gpl.html
10
 * @platform        WebsiteBaker 2.8.x
11
 * @requirements    PHP 5.2.2 and higher
12
 * @version         $Id$
13
 * @filesource      $HeadURL$
14
 * @lastmodified    $Date$
15
 *
16
 */
17
18
/* -------------------------------------------------------- */
19
if(defined('WB_PATH') == false)
20
{
21
	// Stop this file being access directly
22 1773 Luisehahne
		die('<h2 style="color:red;margin:3em auto;text-align:center;">Cannot access this file directly</h2>');
23 1673 Luisehahne
}
24
/* -------------------------------------------------------- */
25 1773 Luisehahne
$bDebugSignup = false;
26
if (!function_exists('ObfuscateIp')) {
27
	function ObfuscateIp() {
28
	    $sClientIp = (isset($_SERVER['REMOTE_ADDR']))
29
	                         ? $_SERVER['REMOTE_ADDR'] : '000.000.000.000';
30
//	    $iClientIp = ip2long($sClientIp);
31
//	    $sClientIp = long2ip(($iClientIp & ~65535));
32
	    return $sClientIp;
33
	}
34
}
35 1673 Luisehahne
36
if (!function_exists('emailAdmin')) {
37
	function emailAdmin() {
38
		global $database,$admin;
39
        $retval = $admin->get_email();
40
        if($admin->get_user_id()!='1') {
41
			$sql  = 'SELECT `email` FROM `'.TABLE_PREFIX.'users` ';
42
			$sql .= 'WHERE `user_id`=\'1\' ';
43
	        $retval = $database->get_one($sql);
44
        }
45
		return $retval;
46
	}
47
}
48
49 1773 Luisehahne
if (!function_exists('deleteOutdatedConfirmations')) {
50
	function deleteOutdatedConfirmations() {
51
		$sql = 'DELETE FROM `'.TABLE_PREFIX.'users` WHERE `confirm_timeout` BETWEEN 1 AND '.time();
52
		WbDatabase::getInstance()->query($sql);
53
	}
54
}
55 1673 Luisehahne
56 1773 Luisehahne
if (!function_exists('checkPassWordConfirmCode')) {
57
	function checkPassWordConfirmCode( $sPassword, $sConfirmCode ) {
58
		if( preg_match('/[0-9a-f]{32}/i', $sConfirmCode) ) {
59
			$sql = 'SELECT `user_id` FROM `'.TABLE_PREFIX.'users` '
60
			     . 'WHERE `password`=\''.md5($sPassword).'\' '
61
			     .       'AND `confirm_code`=\''.$sConfirmCode.'\'';
62
			if( WbDatabase::getInstance()->get_one($sql)) {
63
				return true;
64
			}
65
		}
66
		return false;
67
	}
68
}
69
70
//$_SESSION['username'] = '';
71
//$_SESSION['DISPLAY_NAME'] = '';
72
//$_SESSION['email'] = '';
73
//$_SESSION['display_form'] = true;
74
75
if(isset($_POST['action']) && $_POST['action']=='send')
76
{
77
	$database = WbDatabase::getInstance();
78
79
// add new fields in users
80
	$table_name = TABLE_PREFIX.'users';
81
	$field_name = 'confirm_code';
82
	$description = "VARCHAR( 32 ) NOT NULL DEFAULT '' AFTER `password`";
83
	if(!$database->field_exists($table_name,$field_name)) {
84
		$database->field_add($table_name, $field_name, $description);
85
	}
86
	if($database->set_error()){
87
		msgQueue::add($database->get_error());
88
	}
89
90
	$field_name = 'confirm_timeout';
91
	$description = "INT NOT NULL DEFAULT '0' AFTER `confirm_code`";
92
	if(!$database->field_exists($table_name,$field_name)) {
93
		$database->field_add($table_name, $field_name, $description);
94
	}
95
	if($database->set_error()){
96
		msgQueue::add($database->get_error());
97
	}
98
99
	$_SESSION['username'] = strtolower(strip_tags($wb->get_post_escaped('login_name')));
100 1673 Luisehahne
	$_SESSION['DISPLAY_NAME'] = strip_tags($wb->get_post_escaped('display_name'));
101
	$_SESSION['email'] = $wb->get_post('email');
102 1773 Luisehahne
	$_SESSION['language'] = $wb->get_post('language');
103 1673 Luisehahne
104 1773 Luisehahne
//	$aErrorMsg = array();
105 1673 Luisehahne
106
	if($_SESSION['username'] != "")
107
	{
108
		// Check if username already exists
109
		$sql = 'SELECT `user_id` FROM `'.TABLE_PREFIX.'users` WHERE `username` = \''.$_SESSION['username'].'\'';
110
		if($database->get_one($sql)){
111 1773 Luisehahne
//			$aErrorMsg[] = $MESSAGE['USERS_USERNAME_TAKEN'];
112
			msgQueue::add($MESSAGE['USERS_USERNAME_TAKEN']);
113 1673 Luisehahne
			$_SESSION['username'] = '';
114
		} else {
115 1773 Luisehahne
			if(preg_match('/^[a-z]{1}[a-z0-9_-]{3,}$/i', $_SESSION['username'])==false) {
116
//				$aErrorMsg[] = $MESSAGE['USERS_NAME_INVALID_CHARS'];
117
				msgQueue::add($MESSAGE['USERS_NAME_INVALID_CHARS']);
118 1673 Luisehahne
				$_SESSION['username'] = '';
119
		 	}
120
		}
121
	} else {
122 1773 Luisehahne
//		$aErrorMsg[] = $MESSAGE['LOGIN_USERNAME_BLANK'];
123
		msgQueue::add($MESSAGE['LOGIN_USERNAME_BLANK']);
124 1673 Luisehahne
	}
125
126
	if($_SESSION['DISPLAY_NAME'] == "") {
127 1773 Luisehahne
//		$aErrorMsg[] = $MESSAGE['GENERIC_FILL_IN_ALL'];
128
		msgQueue::add($MESSAGE['GENERIC_FILL_IN_ALL']);
129 1673 Luisehahne
	}
130
131
	if($_SESSION['email'] != "") {
132
		// Check if the email already exists
133
		$sql = 'SELECT `user_id` FROM `'.TABLE_PREFIX.'users` WHERE `email` = \''.mysql_escape_string($_SESSION['email']).'\'';
134
		if($database->get_one($sql)){
135 1773 Luisehahne
//			$aErrorMsg[] = $MESSAGE['USERS_EMAIL_TAKEN'];
136
			msgQueue::add($MESSAGE['USERS_EMAIL_TAKEN']);
137 1673 Luisehahne
			$_SESSION['email'] = '';
138
		} else {
139
			if(!$wb->validate_email($_SESSION['email'])){
140 1773 Luisehahne
//				$aErrorMsg[] = $MESSAGE['USERS_INVALID_EMAIL'];
141
				msgQueue::add($MESSAGE['USERS_INVALID_EMAIL']);
142 1673 Luisehahne
				$_SESSION['email'] = '';
143
			}
144
		}
145
	} else {
146 1773 Luisehahne
//		$aErrorMsg[] = $MESSAGE['SIGNUP_NO_EMAIL'];
147
		msgQueue::add($MESSAGE['SIGNUP_NO_EMAIL']);
148 1673 Luisehahne
	}
149
150 1773 Luisehahne
	if(CONFIRMED_REGISTRATION) {
151
		$iMinPassLength = 6;
152
// receive password vars and calculate needed action
153
		$sNewPassword = $wb->get_post('new_password_1');
154
		$sNewPassword = (is_null($sNewPassword) ? '' : $sNewPassword);
155
		$sNewPasswordRetyped = $wb->get_post('new_password_2');
156
		$sNewPasswordRetyped= (is_null($sNewPasswordRetyped) ? '' : $sNewPasswordRetyped);
157
// validate new password
158
		$sPwHashNew = false;
159
		if($sNewPassword != '') {
160
			if(strlen($sNewPassword) < $iMinPassLength) {
161
//				$err_msg[] = $MESSAGE['USERS_PASSWORD_TOO_SHORT'];
162
				msgQueue::add($MESSAGE['USERS_PASSWORD_TOO_SHORT']);
163
			} else {
164
				if($sNewPassword != $sNewPasswordRetyped) {
165
//					$err_msg[] = $MESSAGE['USERS_PASSWORD_MISMATCH'];
166
					msgQueue::add($MESSAGE['USERS_PASSWORD_MISMATCH']);
167
				} else {
168
					$pattern = '/[^'.$admin->password_chars.']/';
169
					if (preg_match($pattern, $sNewPassword)) {
170
//						$err_msg[] = $MESSAGE['PREFERENCES_INVALID_CHARS'];
171
						msgQueue::add($MESSAGE['PREFERENCES_INVALID_CHARS']);
172
					}else {
173
						$sPwHashNew = md5($sNewPassword);
174
					}
175
				}
176 1673 Luisehahne
			}
177
		} else {
178 1773 Luisehahne
			msgQueue::add($MESSAGE['LOGIN_PASSWORD_BLANK']);
179 1673 Luisehahne
		}
180
181 1773 Luisehahne
	} else {
182
		// Captcha
183
		if(ENABLED_CAPTCHA) {
184
			if(isset($_POST['captcha']) AND $_POST['captcha'] != '')
185
			{
186
				// Check for a mismatch get email user_id
187
				if(!isset($_POST['captcha']) OR !isset($_SESSION['captcha']) OR $_POST['captcha'] != $_SESSION['captcha']) {
188
					$replace = array('SERVER_EMAIL' => emailAdmin() );
189
	//				$aErrorMsg[] = replace_vars($MESSAGE['MOD_FORM_INCORRECT_CAPTCHA'], $replace);
190
					msgQueue::add(replace_vars($MESSAGE['INCORRECT_CAPTCHA'], $replace));
191
				}
192
			} else {
193
				$replace = array('SERVER_EMAIL'=>emailAdmin() );
194
	//			$aErrorMsg[] = replace_vars($MESSAGE['MOD_FORM_INCORRECT_CAPTCHA'],$replace );
195
				msgQueue::add(replace_vars($MESSAGE['INCORRECT_CAPTCHA'],$replace ));
196
			}
197
		}
198
		if(isset($_SESSION['captcha'])) { unset($_SESSION['captcha']); }
199 1673 Luisehahne
200 1773 Luisehahne
		$sNewPassword = '';
201 1673 Luisehahne
		$salt = "abchefghjkmnpqrstuvwxyz0123456789";
202
		srand((double)microtime()*1000000);
203
		$i = 0;
204
		while ($i <= 7) {
205
			$num = rand() % 33;
206
			$tmp = substr($salt, $num, 1);
207 1773 Luisehahne
			$sNewPassword = $sNewPassword . $tmp;
208 1673 Luisehahne
			$i++;
209
		}
210 1773 Luisehahne
		$sPwHashNew = md5($sNewPassword);
211
	}
212 1673 Luisehahne
213 1773 Luisehahne
	if( ($msg = msgQueue::getError()) != '') {
214
// back to signup_form to show errors, otherwise save user and send mail
215
	} else {
216
		$get_ip = ObfuscateIp();
217
		$get_ts = time();
218 1673 Luisehahne
		$sLoginName = $_SESSION['username'];
219 1773 Luisehahne
//		$sDisplayName = $_SESSION['DISPLAY_NAME'];
220
		$sDisplayName = $wb->add_slashes($_SESSION['DISPLAY_NAME']);
221 1673 Luisehahne
		$groups_id = FRONTEND_SIGNUP;
222
		$email_to = $_SESSION['email'];
223
224 1773 Luisehahne
// Delete outdated confirmation IDs
225
		deleteOutdatedConfirmations();
226 1673 Luisehahne
227 1773 Luisehahne
// Create confirmation ID and Timestamp
228
		$sTimeOut = 0; // now + 24hours
229
		$sConfirmationId = '';
230 1673 Luisehahne
231 1773 Luisehahne
		if(CONFIRMED_REGISTRATION) {
232
			$sTimeOut = (string)(time() + 86400); // now + 24hours
233
			$sConfirmationId = md5(md5($sLoginName.$sTimeOut).$sTimeOut);
234
			$sConfirmedLink = WB_URL.'/account/confirm.php?id='.$sConfirmationId;
235
            $sConfirmedLink = '<a href="'.$sConfirmedLink.'">'.$sConfirmedLink.'</a>';
236
		}
237 1673 Luisehahne
238 1773 Luisehahne
// Save new user
239
		$bSaveRegistration = true;
240
241
		$sql  = 'INSERT INTO `'.TABLE_PREFIX.'users` SET ';
242
		$sql .= '`group_id` = \''.$groups_id.'\', ';
243
		$sql .= '`groups_id` = \''.$groups_id.'\', ';
244
		$sql .= '`active` = \''.(CONFIRMED_REGISTRATION ? '0' : '1').'\', ';
245
		$sql .= '`username` = \''.$sLoginName.'\', ';
246
		$sql .= '`password` = \''.$sPwHashNew.'\', ';
247
		$sql .= '`confirm_code` = \''.$sConfirmationId.'\', ';
248
		$sql .= '`confirm_timeout` = \''.$sTimeOut.'\', ';
249
		$sql .= '`display_name` = \''.$sDisplayName.'\', ';
250
		$sql .= '`email` = \''.$email_to.'\', ';
251
		$sql .= '`language` = \''.$_SESSION['language'].'\', ';
252
		$sql .= '`login_when` = \''.$get_ts.'\', ';
253
		$sql .= '`login_ip` = \''.$get_ip.'\' ';
254
255
		if(!$database->query($sql))
256
		{
257
// cancel and break script
258
			$bSaveRegistration = false;
259
			$_SESSION['display_form'] = false;
260
			unset($_SESSION['username']);
261
			unset($_SESSION['DISPLAY_NAME']);
262
			unset($_SESSION['email']);
263
			unset($_POST);
264
			if($database->set_error()){
265
				msgQueue::add($database->get_error());
266 1673 Luisehahne
			}
267 1773 Luisehahne
		} else {
268
			msgQueue::add($MESSAGE['SIGNUP_NEW_USER'],true);
269 1673 Luisehahne
270 1773 Luisehahne
			include(dirname(__FILE__).'/signup_mails.php');
271 1673 Luisehahne
272 1773 Luisehahne
			if($bSaveRegistration && $bSendRegistrationMailtoUser) {
273
			// send success message to screen, no signup form
274 1673 Luisehahne
				$_SESSION['display_form'] = false;
275
			}
276 1773 Luisehahne
277
		} // end success $bSaveRegistration
278 1673 Luisehahne
	}
279 1773 Luisehahne
} // end $_POST['action']
280
// if page_id lost
281
$page_id = isset($_SESSION['PAGE_ID']) ? $_SESSION['PAGE_ID'] : 0;