| 1 |
1425
|
Luisehahne
|
<?php
|
| 2 |
|
|
/**
|
| 3 |
|
|
*
|
| 4 |
|
|
* @category admin
|
| 5 |
|
|
* @package preferences
|
| 6 |
|
|
* @author WebsiteBaker Project
|
| 7 |
1569
|
darkviper
|
* @copyright 2009-2012, Website Baker Org. e.V.
|
| 8 |
1425
|
Luisehahne
|
* @link http://www.websitebaker2.org/
|
| 9 |
|
|
* @license http://www.gnu.org/licenses/gpl.html
|
| 10 |
|
|
* @platform WebsiteBaker 2.8.x
|
| 11 |
|
|
* @requirements PHP 5.2.2 and higher
|
| 12 |
|
|
* @version $Id$
|
| 13 |
|
|
* @filesource $HeadURL$
|
| 14 |
|
|
* @lastmodified $Date$
|
| 15 |
|
|
*
|
| 16 |
|
|
*/
|
| 17 |
|
|
|
| 18 |
|
|
function save_preferences( &$admin, &$database)
|
| 19 |
|
|
{
|
| 20 |
|
|
global $MESSAGE;
|
| 21 |
|
|
$err_msg = array();
|
| 22 |
1569
|
darkviper
|
$iMinPassLength = 6;
|
| 23 |
1804
|
Luisehahne
|
$bPassRequest = false;
|
| 24 |
|
|
$bMailHasChanged = false;
|
| 25 |
1425
|
Luisehahne
|
// first check form-tan
|
| 26 |
1804
|
Luisehahne
|
if(!$admin->checkFTAN()){
|
| 27 |
|
|
$err_msg[] = $MESSAGE['GENERIC_SECURITY_ACCESS'];
|
| 28 |
|
|
} else {
|
| 29 |
1425
|
Luisehahne
|
// Get entered values and validate all
|
| 30 |
|
|
// remove any dangerouse chars from display_name
|
| 31 |
1804
|
Luisehahne
|
$display_name = $admin->add_slashes(strip_tags($admin->StripCodeFromText($admin->get_post('display_name'),true)));
|
| 32 |
|
|
$display_name = ( $display_name == '' ? $admin->get_display_name() : $display_name );
|
| 33 |
|
|
// check that display_name is unique in whoole system (prevents from User-faking)
|
| 34 |
|
|
$sql = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` ';
|
| 35 |
|
|
$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `display_name` LIKE "'.$display_name.'"';
|
| 36 |
|
|
if( $database->get_one($sql) > 0 ){ $err_msg[] = $MESSAGE['USERS_USERNAME_TAKEN']; }
|
| 37 |
1425
|
Luisehahne
|
// language must be 2 upercase letters only
|
| 38 |
1804
|
Luisehahne
|
$language = strtoupper($admin->get_post('language'));
|
| 39 |
|
|
$language = (preg_match('/^[A-Z]{2}$/', $language) ? $language : DEFAULT_LANGUAGE);
|
| 40 |
1425
|
Luisehahne
|
// timezone must be between -12 and +13 or -20 as system_default
|
| 41 |
1804
|
Luisehahne
|
$timezone = $admin->get_post('timezone');
|
| 42 |
|
|
$timezone = (is_numeric($timezone) ? $timezone : -20);
|
| 43 |
|
|
$timezone = ( ($timezone >= -12 && $timezone <= 13) ? $timezone : -20 ) * 3600;
|
| 44 |
1425
|
Luisehahne
|
// date_format must be a key from /interface/date_formats
|
| 45 |
1804
|
Luisehahne
|
$date_format = $admin->get_post('date_format');
|
| 46 |
|
|
$date_format_key = str_replace(' ', '|', $date_format);
|
| 47 |
|
|
$user_time = true;
|
| 48 |
|
|
include( ADMIN_PATH.'/interface/date_formats.php' );
|
| 49 |
|
|
$date_format = (array_key_exists($date_format_key, $DATE_FORMATS) ? $date_format : 'system_default');
|
| 50 |
|
|
$date_format = ($date_format == 'system_default' ? '' : $date_format);
|
| 51 |
|
|
unset($DATE_FORMATS);
|
| 52 |
1782
|
Luisehahne
|
// time_format must be a key from /interface/time_formats
|
| 53 |
1804
|
Luisehahne
|
$time_format = $admin->get_post('time_format');
|
| 54 |
|
|
$time_format_key = str_replace(' ', '|', $time_format);
|
| 55 |
|
|
$user_time = true;
|
| 56 |
|
|
include( ADMIN_PATH.'/interface/time_formats.php' );
|
| 57 |
|
|
$time_format = (array_key_exists($time_format_key, $TIME_FORMATS) ? $time_format : 'system_default');
|
| 58 |
|
|
$time_format = ($time_format == 'system_default' ? '' : $time_format);
|
| 59 |
|
|
unset($TIME_FORMATS);
|
| 60 |
1425
|
Luisehahne
|
// email should be validatet by core
|
| 61 |
1804
|
Luisehahne
|
|
| 62 |
|
|
// $email = trim( $admin->get_post('email') == null ? '' : $admin->get_post('email') );
|
| 63 |
|
|
$email = $admin->add_slashes(strip_tags($admin->StripCodeFromText($admin->get_post('email'),true)));
|
| 64 |
|
|
if( !$admin->validate_email($email) )
|
| 65 |
|
|
{
|
| 66 |
|
|
$email = '';
|
| 67 |
|
|
$err_msg[] = $MESSAGE['USERS_INVALID_EMAIL'];
|
| 68 |
|
|
} else {
|
| 69 |
|
|
if($email != '') {
|
| 70 |
|
|
// check that email is unique in whoole system
|
| 71 |
|
|
$sql = 'SELECT `email` FROM `'.TABLE_PREFIX.'users` ';
|
| 72 |
|
|
$sql .= 'WHERE `user_id` = '.(int)$admin->get_user_id().' AND `email` LIKE "'.$email.'"';
|
| 73 |
|
|
$IsOldMail = $database->get_one($sql);
|
| 74 |
|
|
// check that email is unique in whoole system
|
| 75 |
|
|
$email = $admin->add_slashes($email);
|
| 76 |
|
|
$sql = 'SELECT `email` FROM `'.TABLE_PREFIX.'users` ';
|
| 77 |
|
|
$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `email` LIKE "'.$email.'"';
|
| 78 |
|
|
$checkMail = $database->get_one($sql);
|
| 79 |
|
|
|
| 80 |
|
|
if( $checkMail == $email ){ $err_msg[] = $MESSAGE['USERS_EMAIL_TAKEN']; }
|
| 81 |
|
|
$bMailHasChanged = ($email != $IsOldMail);
|
| 82 |
|
|
}
|
| 83 |
|
|
}
|
| 84 |
|
|
|
| 85 |
1425
|
Luisehahne
|
// receive password vars and calculate needed action
|
| 86 |
1804
|
Luisehahne
|
$sCurrentPassword = $admin->add_slashes($admin->StripCodeFromText($admin->get_post('current_password'),true));
|
| 87 |
|
|
$sNewPassword = $admin->add_slashes($admin->StripCodeFromText($admin->get_post('new_password_1'),true));
|
| 88 |
|
|
$sNewPasswordRetyped = $admin->add_slashes($admin->StripCodeFromText($admin->get_post('new_password_2'),true));
|
| 89 |
|
|
|
| 90 |
|
|
if($bMailHasChanged == true)
|
| 91 |
|
|
{
|
| 92 |
|
|
$bPassRequest = $bMailHasChanged;
|
| 93 |
|
|
} else {
|
| 94 |
|
|
$bPassRequest = ( ( $sCurrentPassword != '') || ($sNewPassword != '') || ($sNewPasswordRetyped != '') ) ? true : false;
|
| 95 |
|
|
}
|
| 96 |
|
|
// Check existing password
|
| 97 |
|
|
$sql = 'SELECT `password` ';
|
| 98 |
|
|
$sql .= 'FROM `'.TABLE_PREFIX.'users` ';
|
| 99 |
|
|
$sql .= 'WHERE `user_id` = '.$admin->get_user_id();
|
| 100 |
|
|
if ( $bPassRequest && md5($sCurrentPassword) != $database->get_one($sql) ) {
|
| 101 |
|
|
// access denied
|
| 102 |
|
|
$err_msg[] = $MESSAGE['PREFERENCES_CURRENT_PASSWORD_INCORRECT'];
|
| 103 |
|
|
} else {
|
| 104 |
|
|
// validate new password
|
| 105 |
|
|
$sPwHashNew = false;
|
| 106 |
|
|
if( ($sNewPassword != '') || ($sNewPasswordRetyped != '') ) {
|
| 107 |
|
|
if(strlen($sNewPassword) < $iMinPassLength) {
|
| 108 |
|
|
$err_msg[] = $MESSAGE['USERS_PASSWORD_TOO_SHORT'];
|
| 109 |
|
|
} else {
|
| 110 |
|
|
if($sNewPassword != $sNewPasswordRetyped) {
|
| 111 |
|
|
$err_msg[] = $MESSAGE['USERS_PASSWORD_MISMATCH'];
|
| 112 |
|
|
} else {
|
| 113 |
|
|
$pattern = '/[^'.$admin->password_chars.']/';
|
| 114 |
|
|
if (preg_match($pattern, $sNewPassword)) {
|
| 115 |
|
|
$err_msg[] = $MESSAGE['PREFERENCES_INVALID_CHARS'];
|
| 116 |
|
|
} else {
|
| 117 |
|
|
$sPwHashNew = md5($sNewPassword);
|
| 118 |
|
|
}
|
| 119 |
|
|
}
|
| 120 |
|
|
}
|
| 121 |
|
|
}
|
| 122 |
|
|
|
| 123 |
|
|
// if no validation errors, try to update the database, otherwise return errormessages
|
| 124 |
|
|
if(sizeof($err_msg) == 0)
|
| 125 |
|
|
{
|
| 126 |
|
|
$sql = 'UPDATE `'.TABLE_PREFIX.'users` ';
|
| 127 |
|
|
$sql .= 'SET `display_name`=\''.$display_name.'\', ';
|
| 128 |
|
|
if($sPwHashNew) {
|
| 129 |
|
|
$sql .= '`password`=\''.$sPwHashNew.'\', ';
|
| 130 |
|
|
}
|
| 131 |
|
|
if($email != '') {
|
| 132 |
|
|
$sql .= '`email`=\''.$email.'\', ';
|
| 133 |
|
|
}
|
| 134 |
|
|
$sql .= '`language`=\''.$language.'\', ';
|
| 135 |
|
|
$sql .= '`timezone`=\''.$timezone.'\', ';
|
| 136 |
|
|
$sql .= '`date_format`=\''.$date_format.'\', ';
|
| 137 |
|
|
$sql .= '`time_format`=\''.$time_format.'\' ';
|
| 138 |
|
|
$sql .= 'WHERE `user_id`='.(int)$admin->get_user_id();
|
| 139 |
|
|
if( $database->query($sql) )
|
| 140 |
|
|
{
|
| 141 |
|
|
// update successfull, takeover values into the session
|
| 142 |
|
|
$_SESSION['DISPLAY_NAME'] = $display_name;
|
| 143 |
|
|
$_SESSION['LANGUAGE'] = $language;
|
| 144 |
|
|
$_SESSION['TIMEZONE'] = $timezone;
|
| 145 |
|
|
$_SESSION['EMAIL'] = $email;
|
| 146 |
|
|
// Update date format
|
| 147 |
|
|
if($date_format != '') {
|
| 148 |
|
|
$_SESSION['DATE_FORMAT'] = $date_format;
|
| 149 |
|
|
if(isset($_SESSION['USE_DEFAULT_DATE_FORMAT'])) { unset($_SESSION['USE_DEFAULT_DATE_FORMAT']); }
|
| 150 |
|
|
} else {
|
| 151 |
|
|
$_SESSION['USE_DEFAULT_DATE_FORMAT'] = true;
|
| 152 |
|
|
if(isset($_SESSION['DATE_FORMAT'])) { unset($_SESSION['DATE_FORMAT']); }
|
| 153 |
|
|
}
|
| 154 |
|
|
// Update time format
|
| 155 |
|
|
if($time_format != '') {
|
| 156 |
|
|
$_SESSION['TIME_FORMAT'] = $time_format;
|
| 157 |
|
|
if(isset($_SESSION['USE_DEFAULT_TIME_FORMAT'])) { unset($_SESSION['USE_DEFAULT_TIME_FORMAT']); }
|
| 158 |
|
|
} else {
|
| 159 |
|
|
$_SESSION['USE_DEFAULT_TIME_FORMAT'] = true;
|
| 160 |
|
|
if(isset($_SESSION['TIME_FORMAT'])) { unset($_SESSION['TIME_FORMAT']); }
|
| 161 |
|
|
}
|
| 162 |
|
|
} else {
|
| 163 |
|
|
$err_msg[] = 'invalid database UPDATE call in '.__FILE__.'::'.__FUNCTION__.'before line '.__LINE__;
|
| 164 |
|
|
}
|
| 165 |
|
|
}
|
| 166 |
|
|
}
|
| 167 |
|
|
|
| 168 |
|
|
}
|
| 169 |
|
|
|
| 170 |
1425
|
Luisehahne
|
return ( (sizeof($err_msg) > 0) ? implode('<br />', $err_msg) : '' );
|
| 171 |
|
|
}
|
| 172 |
1804
|
Luisehahne
|
|
| 173 |
|
|
$config_file = realpath('../../config.php');
|
| 174 |
|
|
if(file_exists($config_file) && !defined('WB_URL'))
|
| 175 |
|
|
{
|
| 176 |
|
|
require_once($config_file);
|
| 177 |
|
|
}
|
| 178 |
|
|
|
| 179 |
|
|
if(!class_exists('admin', false)){ include(WB_PATH.'/framework/class.admin.php'); }
|
| 180 |
|
|
|
| 181 |
|
|
// suppress to print the header, so no new FTAN will be set
|
| 182 |
|
|
$admin = new admin('Preferences','start', false);
|
| 183 |
|
|
|
| 184 |
1425
|
Luisehahne
|
$retval = save_preferences($admin, $database);
|
| 185 |
|
|
if( $retval == '')
|
| 186 |
|
|
{
|
| 187 |
1467
|
Luisehahne
|
// print the header
|
| 188 |
|
|
$admin->print_header();
|
| 189 |
1569
|
darkviper
|
$admin->print_success($MESSAGE['PREFERENCES_DETAILS_SAVED']);
|
| 190 |
1425
|
Luisehahne
|
$admin->print_footer();
|
| 191 |
1804
|
Luisehahne
|
} else {
|
| 192 |
1467
|
Luisehahne
|
// print the header
|
| 193 |
|
|
$admin->print_header();
|
| 194 |
1425
|
Luisehahne
|
$admin->print_error($retval);
|
| 195 |
|
|
}
|