|
1
|
<?php
|
|
2
|
/**
|
|
3
|
*
|
|
4
|
* @category frontend
|
|
5
|
* @package account
|
|
6
|
* @author WebsiteBaker Project
|
|
7
|
* @copyright 2009-2012, WebsiteBaker Org. e.V.
|
|
8
|
* @link http://www.websitebaker.org/
|
|
9
|
* @license http://www.gnu.org/licenses/gpl.html
|
|
10
|
* @platform WebsiteBaker 2.8.x
|
|
11
|
* @requirements PHP 5.2.2 and higher
|
|
12
|
* @version $Id: save_signup.php 1934 2013-07-22 07:54:06Z darkviper $
|
|
13
|
* @filesource $HeadURL: svn://isteam.dynxs.de/wb-archiv/branches/2.8.x/wb/account/save_signup.php $
|
|
14
|
* @lastmodified $Date: 2013-07-22 09:54:06 +0200 (Mon, 22 Jul 2013) $
|
|
15
|
*
|
|
16
|
*/
|
|
17
|
|
|
18
|
/* -------------------------------------------------------- */
|
|
19
|
// Must include code to stop this file being accessed directly
|
|
20
|
if(!defined('WB_PATH')) {
|
|
21
|
require_once(dirname(dirname(__FILE__)).'/framework/globalExceptionHandler.php');
|
|
22
|
throw new IllegalFileException();
|
|
23
|
}
|
|
24
|
/* -------------------------------------------------------- */
|
|
25
|
$bDebugSignup = false;
|
|
26
|
if (!function_exists('ObfuscateIp')) {
|
|
27
|
function ObfuscateIp() {
|
|
28
|
$sClientIp = (isset($_SERVER['REMOTE_ADDR']))
|
|
29
|
? $_SERVER['REMOTE_ADDR'] : '000.000.000.000';
|
|
30
|
// $iClientIp = ip2long($sClientIp);
|
|
31
|
// $sClientIp = long2ip(($iClientIp & ~65535));
|
|
32
|
return $sClientIp;
|
|
33
|
}
|
|
34
|
}
|
|
35
|
|
|
36
|
if (!function_exists('emailAdmin')) {
|
|
37
|
function emailAdmin() {
|
|
38
|
global $database,$admin;
|
|
39
|
$retval = false;
|
|
40
|
$sql = 'SELECT `email` FROM `'.TABLE_PREFIX.'users` ';
|
|
41
|
$sql .= 'WHERE `user_id`=\'1\' ';
|
|
42
|
if(!($retval = $database->get_one($sql))){
|
|
43
|
$retval = false;
|
|
44
|
}
|
|
45
|
return $retval;
|
|
46
|
}
|
|
47
|
}
|
|
48
|
|
|
49
|
if (!function_exists('deleteOutdatedConfirmations')) {
|
|
50
|
function deleteOutdatedConfirmations() {
|
|
51
|
$sql = 'DELETE FROM `'.TABLE_PREFIX.'users` WHERE `confirm_timeout` BETWEEN 1 AND '.time();
|
|
52
|
WbDatabase::getInstance()->query($sql);
|
|
53
|
}
|
|
54
|
}
|
|
55
|
|
|
56
|
if (!function_exists('checkPassWordConfirmCode')) {
|
|
57
|
function checkPassWordConfirmCode( $sPassword, $sConfirmCode ) {
|
|
58
|
if( preg_match('/[0-9a-f]{32}/i', $sConfirmCode) ) {
|
|
59
|
$sql = 'SELECT `user_id` FROM `'.TABLE_PREFIX.'users` '
|
|
60
|
. 'WHERE `password`=\''.md5($sPassword).'\' '
|
|
61
|
. 'AND `confirm_code`=\''.$sConfirmCode.'\'';
|
|
62
|
if( WbDatabase::getInstance()->get_one($sql)) {
|
|
63
|
return true;
|
|
64
|
}
|
|
65
|
}
|
|
66
|
return false;
|
|
67
|
}
|
|
68
|
}
|
|
69
|
|
|
70
|
//if(isset($_POST['action']) && $_POST['action']=='send')
|
|
71
|
if($wb->StripCodeFromText($wb->get_post('action'))=='send')
|
|
72
|
{
|
|
73
|
$database = WbDatabase::getInstance();
|
|
74
|
|
|
75
|
// add new fields in users
|
|
76
|
$table_name = TABLE_PREFIX.'users';
|
|
77
|
$field_name = 'confirm_code';
|
|
78
|
$description = "VARCHAR( 32 ) NOT NULL DEFAULT '' AFTER `password`";
|
|
79
|
if(!$database->field_exists($table_name,$field_name)) {
|
|
80
|
$database->field_add($table_name, $field_name, $description);
|
|
81
|
}
|
|
82
|
if($database->set_error()){
|
|
83
|
msgQueue::add($database->get_error());
|
|
84
|
}
|
|
85
|
|
|
86
|
$field_name = 'confirm_timeout';
|
|
87
|
$description = "INT NOT NULL DEFAULT '0' AFTER `confirm_code`";
|
|
88
|
if(!$database->field_exists($table_name,$field_name)) {
|
|
89
|
$database->field_add($table_name, $field_name, $description);
|
|
90
|
}
|
|
91
|
if($database->set_error()){
|
|
92
|
msgQueue::add($database->get_error());
|
|
93
|
}
|
|
94
|
|
|
95
|
$_SESSION['USERNAME'] = strtolower($wb->StripCodeFromText($wb->get_post('login_name')));
|
|
96
|
$_SESSION['DISPLAY_NAME'] = strip_tags($wb->StripCodeFromText($wb->get_post('display_name')));
|
|
97
|
$_SESSION['EMAIL'] = strip_tags($wb->StripCodeFromText($wb->get_post('email')));
|
|
98
|
$_SESSION['LANGUAGE'] = strip_tags($wb->StripCodeFromText($wb->get_post('language')));
|
|
99
|
// $aErrorMsg = array();
|
|
100
|
|
|
101
|
if($wb->get_session('USERNAME') != "") {
|
|
102
|
// Check if username already exists
|
|
103
|
$sql = 'SELECT `user_id` FROM `'.TABLE_PREFIX.'users` WHERE `username` = \''.$_SESSION['USERNAME'].'\'';
|
|
104
|
if($database->get_one($sql)){
|
|
105
|
// $aErrorMsg[] = $MESSAGE['USERS_USERNAME_TAKEN'];
|
|
106
|
msgQueue::add($MESSAGE['USERS_USERNAME_TAKEN']);
|
|
107
|
$_SESSION['USERNAME'] = '';
|
|
108
|
} else {
|
|
109
|
if(preg_match('/^[a-z]{1}[a-z0-9_-]{3,}$/i', $_SESSION['USERNAME'])==false) {
|
|
110
|
// $aErrorMsg[] = $MESSAGE['USERS_NAME_INVALID_CHARS'];
|
|
111
|
msgQueue::add($MESSAGE['USERS_NAME_INVALID_CHARS']);
|
|
112
|
$_SESSION['USERNAME'] = '';
|
|
113
|
}
|
|
114
|
}
|
|
115
|
} else {
|
|
116
|
// $aErrorMsg[] = $MESSAGE['LOGIN_USERNAME_BLANK'];
|
|
117
|
msgQueue::add($MESSAGE['LOGIN_USERNAME_BLANK']);
|
|
118
|
}
|
|
119
|
|
|
120
|
// check that display_name is unique in whoole system (prevents from User-faking)
|
|
121
|
$sql = 'SELECT COUNT(*) FROM `'.TABLE_PREFIX.'users` ';
|
|
122
|
$sql .= 'WHERE `user_id` <> '.(int)$admin->get_user_id().' AND `display_name` LIKE "'.$wb->get_session('DISPLAY_NAME').'"';
|
|
123
|
if( ($iFoundUser = intval($database->get_one($sql))) > 0 ){
|
|
124
|
msgQueue::add($MESSAGE['USERS_USERNAME_TAKEN'].' ('.$TEXT['DISPLAY_NAME'].')');
|
|
125
|
$_SESSION['DISPLAY_NAME'] = '';
|
|
126
|
} else {
|
|
127
|
if($wb->get_session('DISPLAY_NAME') == '') {
|
|
128
|
msgQueue::add($MESSAGE['GENERIC_FILL_IN_ALL'].' ('.$TEXT['DISPLAY_NAME'].')');
|
|
129
|
}
|
|
130
|
}
|
|
131
|
|
|
132
|
if($wb->get_session('EMAIL') != "") {
|
|
133
|
// Check if the email already exists
|
|
134
|
$sql = 'SELECT `user_id` FROM `'.TABLE_PREFIX.'users` WHERE `email` = \''.$_SESSION['EMAIL'].'\'';
|
|
135
|
if($database->get_one($sql)){
|
|
136
|
msgQueue::add($MESSAGE['USERS_EMAIL_TAKEN']);
|
|
137
|
$_SESSION['EMAIL'] = '';
|
|
138
|
} else {
|
|
139
|
if(!$wb->validate_email($_SESSION['EMAIL'])){
|
|
140
|
msgQueue::add($MESSAGE['USERS_INVALID_EMAIL']);
|
|
141
|
$_SESSION['EMAIL'] = '';
|
|
142
|
}
|
|
143
|
}
|
|
144
|
} else {
|
|
145
|
msgQueue::add($MESSAGE['SIGNUP_NO_EMAIL']);
|
|
146
|
}
|
|
147
|
|
|
148
|
// if($wb->get_session('DISPLAY_NAME') == "") {
|
|
149
|
//// $aErrorMsg[] = $MESSAGE['GENERIC_FILL_IN_ALL'];
|
|
150
|
// msgQueue::add($MESSAGE['GENERIC_FILL_IN_ALL'].' ('.$TEXT['DISPLAY_NAME'].')');
|
|
151
|
// }
|
|
152
|
|
|
153
|
if(CONFIRMED_REGISTRATION) {
|
|
154
|
$iMinPassLength = 6;
|
|
155
|
// receive password vars and calculate needed action
|
|
156
|
// $sNewPassword = $wb->get_post('new_password_1');
|
|
157
|
$sNewPassword = ($wb->StripCodeFromText($wb->get_post('new_password_1')));
|
|
158
|
$sNewPassword = (is_null($sNewPassword) ? '' : $sNewPassword);
|
|
159
|
// $sNewPasswordRetyped = $wb->get_post('new_password_2');
|
|
160
|
$sNewPasswordRetyped = ($wb->StripCodeFromText($wb->get_post('new_password_2')));
|
|
161
|
$sNewPasswordRetyped= (is_null($sNewPasswordRetyped) ? '' : $sNewPasswordRetyped);
|
|
162
|
// validate new password
|
|
163
|
$sPwHashNew = false;
|
|
164
|
if($sNewPassword != '') {
|
|
165
|
if(strlen($sNewPassword) < $iMinPassLength) {
|
|
166
|
msgQueue::add($MESSAGE['USERS_PASSWORD_TOO_SHORT']);
|
|
167
|
} else {
|
|
168
|
if($sNewPassword != $sNewPasswordRetyped) {
|
|
169
|
msgQueue::add($MESSAGE['USERS_PASSWORD_MISMATCH']);
|
|
170
|
} else {
|
|
171
|
$pattern = '/[^'.$wb->password_chars.']/';
|
|
172
|
if (preg_match($pattern, $sNewPassword)) {
|
|
173
|
msgQueue::add($MESSAGE['PREFERENCES_INVALID_CHARS']);
|
|
174
|
}else {
|
|
175
|
$sPwHashNew = md5($sNewPassword);
|
|
176
|
}
|
|
177
|
}
|
|
178
|
}
|
|
179
|
} else {
|
|
180
|
msgQueue::add($MESSAGE['LOGIN_PASSWORD_BLANK']);
|
|
181
|
}
|
|
182
|
|
|
183
|
} else {
|
|
184
|
// Captcha
|
|
185
|
if(ENABLED_CAPTCHA) {
|
|
186
|
// if(isset($_POST['captcha']) AND $_POST['captcha'] != '')
|
|
187
|
$aReplacement = array('webmaster_email' =>
|
|
188
|
((defined('OWNER_EMAIL') && OWNER_EMAIL != '') ? OWNER_EMAIL : emailAdmin()));
|
|
189
|
if($wb->StripCodeFromText($wb->get_post('captcha')) != '')
|
|
190
|
{
|
|
191
|
// Check for a mismatch get email user_id
|
|
192
|
if(!isset($_POST['captcha']) OR !isset($_SESSION['captcha']) OR $_POST['captcha'] != $_SESSION['captcha']) {
|
|
193
|
msgQueue::add(replace_vars($MESSAGE['INCORRECT_CAPTCHA'], $aReplacement));
|
|
194
|
}
|
|
195
|
} else {
|
|
196
|
msgQueue::add(replace_vars($MESSAGE['INCORRECT_CAPTCHA'],$aReplacement ));
|
|
197
|
}
|
|
198
|
}
|
|
199
|
if(isset($_SESSION['captcha'])) { unset($_SESSION['captcha']); }
|
|
200
|
|
|
201
|
$sNewPassword = '';
|
|
202
|
$salt = "abchefghjkmnpqrstuvwxyz0123456789";
|
|
203
|
srand((double)microtime()*1000000);
|
|
204
|
$i = 0;
|
|
205
|
while ($i <= 7) {
|
|
206
|
$num = rand() % 33;
|
|
207
|
$tmp = substr($salt, $num, 1);
|
|
208
|
$sNewPassword = $sNewPassword . $tmp;
|
|
209
|
$i++;
|
|
210
|
}
|
|
211
|
$sPwHashNew = md5($sNewPassword);
|
|
212
|
}
|
|
213
|
|
|
214
|
if( ($msg = msgQueue::getError()) != '') {
|
|
215
|
// back to signup_form to show errors, otherwise save user and send mail
|
|
216
|
} else {
|
|
217
|
$get_ip = ObfuscateIp();
|
|
218
|
$get_ts = time();
|
|
219
|
$sLoginName = $_SESSION['USERNAME'];
|
|
220
|
// $sDisplayName = $_SESSION['DISPLAY_NAME'];
|
|
221
|
$sDisplayName = $wb->add_slashes($_SESSION['DISPLAY_NAME']);
|
|
222
|
$groups_id = FRONTEND_SIGNUP;
|
|
223
|
$email_to = $_SESSION['EMAIL'];
|
|
224
|
|
|
225
|
// Delete outdated confirmation IDs
|
|
226
|
deleteOutdatedConfirmations();
|
|
227
|
|
|
228
|
// Create confirmation ID and Timestamp
|
|
229
|
$sTimeOut = 0; // now + 24hours
|
|
230
|
$sConfirmationId = '';
|
|
231
|
|
|
232
|
if(CONFIRMED_REGISTRATION) {
|
|
233
|
$sTimeOut = (string)(time() + 86400); // now + 24hours
|
|
234
|
$sConfirmationId = md5(md5($sLoginName.$sTimeOut).$sTimeOut);
|
|
235
|
$sConfirmedLink = WB_URL.'/account/confirm.php?id='.$sConfirmationId;
|
|
236
|
$sConfirmedLink = '<a href="'.$sConfirmedLink.'">'.$sConfirmedLink.'</a>';
|
|
237
|
}
|
|
238
|
|
|
239
|
// Save new user
|
|
240
|
|
|
241
|
$sql = 'INSERT INTO `'.TABLE_PREFIX.'users` SET ';
|
|
242
|
$sql .= '`group_id` = \''.$groups_id.'\', ';
|
|
243
|
$sql .= '`groups_id` = \''.$groups_id.'\', ';
|
|
244
|
$sql .= '`active` = \''.(CONFIRMED_REGISTRATION ? '0' : '1').'\', ';
|
|
245
|
$sql .= '`username` = \''.$sLoginName.'\', ';
|
|
246
|
$sql .= '`password` = \''.$sPwHashNew.'\', ';
|
|
247
|
$sql .= '`confirm_code` = \''.$sConfirmationId.'\', ';
|
|
248
|
$sql .= '`confirm_timeout` = \''.$sTimeOut.'\', ';
|
|
249
|
$sql .= '`display_name` = \''.$sDisplayName.'\', ';
|
|
250
|
$sql .= '`email` = \''.$email_to.'\', ';
|
|
251
|
$sql .= '`language` = \''.$_SESSION['LANGUAGE'].'\', ';
|
|
252
|
$sql .= '`login_when` = \''.$get_ts.'\', ';
|
|
253
|
$sql .= '`login_ip` = \''.$get_ip.'\' ';
|
|
254
|
|
|
255
|
if(!$database->query($sql))
|
|
256
|
{
|
|
257
|
// cancel and break script
|
|
258
|
$bSaveRegistration = false;
|
|
259
|
$_SESSION['display_form'] = false;
|
|
260
|
unset($_SESSION['USERNAME']);
|
|
261
|
unset($_SESSION['DISPLAY_NAME']);
|
|
262
|
unset($_SESSION['EMAIL']);
|
|
263
|
unset($_SESSION['TIMEZONE']);
|
|
264
|
unset($_SESSION['LANGUAGE']);
|
|
265
|
unset($_POST);
|
|
266
|
if($database->set_error()){
|
|
267
|
msgQueue::add($database->get_error());
|
|
268
|
}
|
|
269
|
} else {
|
|
270
|
$bSaveRegistration = true;
|
|
271
|
msgQueue::add($MESSAGE['SIGNUP_NEW_USER'],true);
|
|
272
|
|
|
273
|
include(dirname(__FILE__).'/signup_mails.php');
|
|
274
|
|
|
275
|
if($bSaveRegistration && $bSendRegistrationMailtoUser) {
|
|
276
|
// send success message to screen, no signup form
|
|
277
|
$_SESSION['display_form'] = false;
|
|
278
|
}
|
|
279
|
|
|
280
|
} // end success $bSaveRegistration
|
|
281
|
}
|
|
282
|
} // end $_POST['action']
|