WB 2.08.x

<?php

/**

 *

 * @category        frontend

 * @package         account

 * @author          WebsiteBaker Project

 * @copyright       2009-2012, WebsiteBaker Org. e.V.

 * @link            http://www.websitebaker.org/

 * @license         http://www.gnu.org/licenses/gpl.html

 * @platform        WebsiteBaker 2.8.x

 * @requirements    PHP 5.2.2 and higher

 * @version         $Id$

 * @filesource      $HeadURL$

 * @lastmodified    $Date$

 *

 */

/* -------------------------------------------------------- */

if(!defined('WB_PATH')) {

	require_once(dirname(dirname(__FILE__)).'/framework/globalExceptionHandler.php');

	throw new IllegalFileException();

/* -------------------------------------------------------- */

if (!function_exists('ObfuscateIp')) {

	function ObfuscateIp() {

	    $sClientIp = (isset($_SERVER['REMOTE_ADDR']))

	                         ? $_SERVER['REMOTE_ADDR'] : '000.000.000.000';

//	    $iClientIp = ip2long($sClientIp);

//	    $sClientIp = long2ip(($iClientIp & ~65535));

	    return $sClientIp;

	}

}

if (!function_exists('emailAdmin')) {

	function emailAdmin() {

		global $database,$admin;

		$sql  = 'SELECT `email` FROM `'.TABLE_PREFIX.'users` ';

		$sql .= 'WHERE `user_id`=\'1\' ';

        if(!($retval = $database->get_one($sql))){

            $retval = false;

		return $retval;

	}

}

	function deleteOutdatedConfirmations() {

		$sql = 'DELETE FROM `'.TABLE_PREFIX.'users` WHERE `confirm_timeout` BETWEEN 1 AND '.time();

		WbDatabase::getInstance()->query($sql);

	}

}

	function checkPassWordConfirmCode( $sPassword, $sConfirmCode ) {

		if( preg_match('/[0-9a-f]{32}/i', $sConfirmCode) ) {

			$sql = 'SELECT `user_id` FROM `'.TABLE_PREFIX.'users` '

			     . 'WHERE `password`=\''.md5($sPassword).'\' '

			     .       'AND `confirm_code`=\''.$sConfirmCode.'\'';

			if( WbDatabase::getInstance()->get_one($sql)) {

				return true;

			}

		}

		return false;

	}

}

if($wb->StripCodeFromText($wb->get_post('action'))=='send')

	$database = WbDatabase::getInstance();

// add new fields in users

	$table_name = TABLE_PREFIX.'users';

	$field_name = 'confirm_code';

	$description = "VARCHAR( 32 ) NOT NULL DEFAULT '' AFTER `password`";

	if(!$database->field_exists($table_name,$field_name)) {

		$database->field_add($table_name, $field_name, $description);

	}

	if($database->set_error()){

		msgQueue::add($database->get_error());

	}

	$field_name = 'confirm_timeout';

	$description = "INT NOT NULL DEFAULT '0' AFTER `confirm_code`";

	if(!$database->field_exists($table_name,$field_name)) {

		$database->field_add($table_name, $field_name, $description);

	}

	if($database->set_error()){

		msgQueue::add($database->get_error());

	}

	$_SESSION['DISPLAY_NAME'] = strip_tags($wb->StripCodeFromText($wb->get_post('display_name')));

	$_SESSION['EMAIL'] = strip_tags($wb->StripCodeFromText($wb->get_post('email')));

	$_SESSION['LANGUAGE'] = strip_tags($wb->StripCodeFromText($wb->get_post('language')));

			msgQueue::add($MESSAGE['USERS_USERNAME_TAKEN']);

				msgQueue::add($MESSAGE['USERS_NAME_INVALID_CHARS']);

		}

	} else {

		msgQueue::add($MESSAGE['LOGIN_USERNAME_BLANK']);

    	$sql  = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` ';

    	$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `display_name` LIKE "'.$wb->get_session('DISPLAY_NAME').'"';

    	if( ($iFoundUser = intval($database->get_one($sql))) > 0 ){

            msgQueue::add($MESSAGE['USERS_USERNAME_TAKEN'].' ('.$TEXT['DISPLAY_NAME'].')');

            $_SESSION['DISPLAY_NAME'] = '';

       } else {

            if($wb->get_session('DISPLAY_NAME') == '') {

        	   msgQueue::add($MESSAGE['GENERIC_FILL_IN_ALL'].' ('.$TEXT['DISPLAY_NAME'].')');

            }

       }

		}

	} else {

////		$aErrorMsg[] = $MESSAGE['GENERIC_FILL_IN_ALL'];

//		msgQueue::add($MESSAGE['GENERIC_FILL_IN_ALL'].' ('.$TEXT['DISPLAY_NAME'].')');

//	}

		$iMinPassLength = 6;

// receive password vars and calculate needed action

    	$sNewPassword = ($wb->StripCodeFromText($wb->get_post('new_password_1')));

    	$sNewPasswordRetyped = ($wb->StripCodeFromText($wb->get_post('new_password_2')));

// validate new password

		$sPwHashNew = false;

		if($sNewPassword != '') {

			if(strlen($sNewPassword) < $iMinPassLength) {

				msgQueue::add($MESSAGE['USERS_PASSWORD_TOO_SHORT']);

			} else {

				if($sNewPassword != $sNewPasswordRetyped) {

					msgQueue::add($MESSAGE['USERS_PASSWORD_MISMATCH']);

				} else {

						msgQueue::add($MESSAGE['PREFERENCES_INVALID_CHARS']);

					}else {

						$sPwHashNew = md5($sNewPassword);

					}

				}

		} else {

		// Captcha

		if(ENABLED_CAPTCHA) {

			                      ((defined('OWNER_EMAIL') && OWNER_EMAIL != '') ? OWNER_EMAIL : emailAdmin()));

				// Check for a mismatch get email user_id

				if(!isset($_POST['captcha']) OR !isset($_SESSION['captcha']) OR $_POST['captcha'] != $_SESSION['captcha']) {

			} else {

		}

		if(isset($_SESSION['captcha'])) { unset($_SESSION['captcha']); }

		srand((double)microtime()*1000000);

		$i = 0;

		while ($i <= 7) {

			$num = rand() % 33;

			$tmp = substr($salt, $num, 1);

		}

	}

// back to signup_form to show errors, otherwise save user and send mail

	} else {

		$get_ip = ObfuscateIp();

		$get_ts = time();

		$sDisplayName = $wb->add_slashes($_SESSION['DISPLAY_NAME']);

		deleteOutdatedConfirmations();

		$sTimeOut = 0; // now + 24hours

		$sConfirmationId = '';

			$sTimeOut = (string)(time() + 86400); // now + 24hours

			$sConfirmationId = md5(md5($sLoginName.$sTimeOut).$sTimeOut);

			$sConfirmedLink = WB_URL.'/account/confirm.php?id='.$sConfirmationId;

            $sConfirmedLink = '<a href="'.$sConfirmedLink.'">'.$sConfirmedLink.'</a>';

		}

		$sql  = 'INSERT INTO `'.TABLE_PREFIX.'users` SET ';

		$sql .= '`group_id` = \''.$groups_id.'\', ';

		$sql .= '`groups_id` = \''.$groups_id.'\', ';

		$sql .= '`active` = \''.(CONFIRMED_REGISTRATION ? '0' : '1').'\', ';

		$sql .= '`username` = \''.$sLoginName.'\', ';

		$sql .= '`password` = \''.$sPwHashNew.'\', ';

		$sql .= '`confirm_code` = \''.$sConfirmationId.'\', ';

		$sql .= '`confirm_timeout` = \''.$sTimeOut.'\', ';

		$sql .= '`display_name` = \''.$sDisplayName.'\', ';

		$sql .= '`email` = \''.$email_to.'\', ';

		$sql .= '`login_ip` = \''.$get_ip.'\' ';

		if(!$database->query($sql))

		{

// cancel and break script

			$bSaveRegistration = false;

			$_SESSION['display_form'] = false;

			unset($_SESSION['TIMEZONE']);

			unset($_SESSION['LANGUAGE']);

			if($database->set_error()){

				msgQueue::add($database->get_error());

			// send success message to screen, no signup form

			}

		} // end success $bSaveRegistration