includes/usercp_register.php

   1 <?php
   2 /***************************************************************************
   3  *                            usercp_register.php
   4  *                            -------------------
   5  *   begin                : Saturday, Feb 13, 2001
   6  *   copyright            : (C) 2001 The phpBB Group
   7  *   email                : support@phpbb.com
   8  *
   9  *   $Id: usercp_register.php,v 1.20.2.70 2005/12/29 11:51:11 acydburn Exp $
  10  *
  11  *
  12  ***************************************************************************/
  13
  14 /***************************************************************************
  15  *
  16  *   This program is free software; you can redistribute it and/or modify
  17  *   it under the terms of the GNU General Public License as published by
  18  *   the Free Software Foundation; either version 2 of the License, or
  19  *   (at your option) any later version.
  20  *
  21  *
  22  ***************************************************************************/
  23
  24 /*
  25
  26         This code has been modified from its original form by psoTFX @ phpbb.com
  27         Changes introduce the back-ported phpBB 2.2 visual confirmation code.
  28
  29         NOTE: Anyone using the modified code contained within this script MUST include
  30         a relevant message such as this in usercp_register.php ... failure to do so
  31         will affect a breach of Section 2a of the GPL and our copyright
  32
  33         png visual confirmation system : (c) phpBB Group, 2003 : All Rights Reserved
  34
  35 */
  36
  37 if ( !defined('IN_PHPBB') )
  38 {
  39         die("Hacking attempt");
  40         exit;
  41 }
  42
  43 $unhtml_specialchars_match = array('#&gt;#', '#&lt;#', '#&quot;#', '#&amp;#');
  44 $unhtml_specialchars_replace = array('>', '<', '"', '&');
  45
  46 // ---------------------------------------
  47 // Load agreement template since user has not yet
  48 // agreed to registration conditions/coppa
  49 //
  50 function show_coppa()
  51 {
  52         global $userdata, $template, $lang, $phpbb_root_path, $phpEx;
  53
  54         $template->set_filenames(array(
  55                 'body' => 'agreement.tpl')
  56         );
  57
  58         $template->assign_vars(array(
  59                 'REGISTRATION' => $lang['Registration'],
  60                 'AGREEMENT' => $lang['Reg_agreement'],
  61                 "AGREE_OVER_13" => $lang['Agree_over_13'],
  62                 "AGREE_UNDER_13" => $lang['Agree_under_13'],
  63                 'DO_NOT_AGREE' => $lang['Agree_not'],
  64
  65                 "U_AGREE_OVER13" => append_sid("profile.$phpEx?mode=register&amp;agreed=true"),
  66                 "U_AGREE_UNDER13" => append_sid("profile.$phpEx?mode=register&amp;agreed=true&amp;coppa=true"))
  67         );
  68
  69         $template->pparse('body');
  70
  71 }
  72 //
  73 // ---------------------------------------
  74
  75 $error = FALSE;
  76 $error_msg = '';
  77 $page_title = ( $mode == 'editprofile' ) ? $lang['Edit_profile'] : $lang['Register'];
  78
  79 if ( $mode == 'register' && !isset($HTTP_POST_VARS['agreed']) && !isset($HTTP_GET_VARS['agreed']) )
  80 {
  81         include($phpbb_root_path . 'includes/page_header.'.$phpEx);
  82
  83         show_coppa();
  84
  85         include($phpbb_root_path . 'includes/page_tail.'.$phpEx);
  86 }
  87
  88 $coppa = ( empty($HTTP_POST_VARS['coppa']) && empty($HTTP_GET_VARS['coppa']) ) ? 0 : TRUE;
  89
  90 //
  91 // Check and initialize some variables if needed
  92 //
  93 if (
  94         isset($HTTP_POST_VARS['submit']) ||
  95         isset($HTTP_POST_VARS['avatargallery']) ||
  96         isset($HTTP_POST_VARS['submitavatar']) ||
  97         isset($HTTP_POST_VARS['cancelavatar']) ||
  98         $mode == 'register' )
  99 {
 100         include($phpbb_root_path . 'includes/functions_validate.'.$phpEx);
 101         include($phpbb_root_path . 'includes/bbcode.'.$phpEx);
 102         include($phpbb_root_path . 'includes/functions_post.'.$phpEx);
 103
 104         if ( $mode == 'editprofile' )
 105         {
 106                 $user_id = intval($HTTP_POST_VARS['user_id']);
 107                 $current_email = trim(htmlspecialchars($HTTP_POST_VARS['current_email']));
 108         }
 109
 110         $strip_var_list = array('email' => 'email', 'icq' => 'icq', 'aim' => 'aim', 'msn' => 'msn', 'yim' => 'yim', 'website' => 'website', 'location' => 'location', 'occupation' => 'occupation', 'interests' => 'interests', 'confirm_code' => 'confirm_code');
 111
 112         // Strip all tags from data ... may p**s some people off, bah, strip_tags is
 113         // doing the job but can still break HTML output ... have no choice, have
 114         // to use htmlspecialchars ... be prepared to be moaned at.
 115         while( list($var, $param) = @each($strip_var_list) )
 116         {
 117                 if ( !empty($HTTP_POST_VARS[$param]) )
 118                 {
 119                         $$var = trim(htmlspecialchars($HTTP_POST_VARS[$param]));
 120                 }
 121         }
 122
 123         $username = ( !empty($HTTP_POST_VARS['username']) ) ? phpbb_clean_username($HTTP_POST_VARS['username']) : '';
 124
 125         $trim_var_list = array('cur_password' => 'cur_password', 'new_password' => 'new_password', 'password_confirm' => 'password_confirm', 'signature' => 'signature');
 126
 127         while( list($var, $param) = @each($trim_var_list) )
 128         {
 129                 if ( !empty($HTTP_POST_VARS[$param]) )
 130                 {
 131                         $$var = trim($HTTP_POST_VARS[$param]);
 132                 }
 133         }
 134
 135         $signature = str_replace('<br />', "\n", $signature);
 136
 137         // Run some validation on the optional fields. These are pass-by-ref, so they'll be changed to
 138         // empty strings if they fail.
 139         validate_optional_fields($icq, $aim, $msn, $yim, $website, $location, $occupation, $interests, $signature);
 140
 141         $viewemail = ( isset($HTTP_POST_VARS['viewemail']) ) ? ( ($HTTP_POST_VARS['viewemail']) ? TRUE : 0 ) : 0;
 142         $allowviewonline = ( isset($HTTP_POST_VARS['hideonline']) ) ? ( ($HTTP_POST_VARS['hideonline']) ? 0 : TRUE ) : TRUE;
 143         $notifyreply = ( isset($HTTP_POST_VARS['notifyreply']) ) ? ( ($HTTP_POST_VARS['notifyreply']) ? TRUE : 0 ) : 0;
 144         $notifypm = ( isset($HTTP_POST_VARS['notifypm']) ) ? ( ($HTTP_POST_VARS['notifypm']) ? TRUE : 0 ) : TRUE;
 145         $popup_pm = ( isset($HTTP_POST_VARS['popup_pm']) ) ? ( ($HTTP_POST_VARS['popup_pm']) ? TRUE : 0 ) : TRUE;
 146
 147         if ( $mode == 'register' )
 148         {
 149                 $attachsig = ( isset($HTTP_POST_VARS['attachsig']) ) ? ( ($HTTP_POST_VARS['attachsig']) ? TRUE : 0 ) : $board_config['allow_sig'];
 150
 151                 $allowhtml = ( isset($HTTP_POST_VARS['allowhtml']) ) ? ( ($HTTP_POST_VARS['allowhtml']) ? TRUE : 0 ) : $board_config['allow_html'];
 152                 $allowbbcode = ( isset($HTTP_POST_VARS['allowbbcode']) ) ? ( ($HTTP_POST_VARS['allowbbcode']) ? TRUE : 0 ) : $board_config['allow_bbcode'];
 153                 $allowsmilies = ( isset($HTTP_POST_VARS['allowsmilies']) ) ? ( ($HTTP_POST_VARS['allowsmilies']) ? TRUE : 0 ) : $board_config['allow_smilies'];
 154         }
 155         else
 156         {
 157                 $attachsig = ( isset($HTTP_POST_VARS['attachsig']) ) ? ( ($HTTP_POST_VARS['attachsig']) ? TRUE : 0 ) : $userdata['user_attachsig'];
 158
 159                 $allowhtml = ( isset($HTTP_POST_VARS['allowhtml']) ) ? ( ($HTTP_POST_VARS['allowhtml']) ? TRUE : 0 ) : $userdata['user_allowhtml'];
 160                 $allowbbcode = ( isset($HTTP_POST_VARS['allowbbcode']) ) ? ( ($HTTP_POST_VARS['allowbbcode']) ? TRUE : 0 ) : $userdata['user_allowbbcode'];
 161                 $allowsmilies = ( isset($HTTP_POST_VARS['allowsmilies']) ) ? ( ($HTTP_POST_VARS['allowsmilies']) ? TRUE : 0 ) : $userdata['user_allowsmile'];
 162         }
 163
 164         $user_style = ( isset($HTTP_POST_VARS['style']) ) ? intval($HTTP_POST_VARS['style']) : $board_config['default_style'];
 165
 166         if ( !empty($HTTP_POST_VARS['language']) )
 167         {
 168                 if ( preg_match('/^[a-z_]+$/i', $HTTP_POST_VARS['language']) )
 169                 {
 170                         $user_lang = htmlspecialchars($HTTP_POST_VARS['language']);
 171                 }
 172                 else
 173                 {
 174                         $error = true;
 175                         $error_msg = $lang['Fields_empty'];
 176                 }
 177         }
 178         else
 179         {
 180                 $user_lang = $board_config['default_lang'];
 181         }
 182
 183         $user_timezone = ( isset($HTTP_POST_VARS['timezone']) ) ? doubleval($HTTP_POST_VARS['timezone']) : $board_config['board_timezone'];
 184
 185         $sql = "SELECT config_value
 186                 FROM " . CONFIG_TABLE . "
 187                 WHERE config_name = 'default_dateformat'";
 188         if ( !($result = $db->sql_query($sql)) )
 189         {
 190                 message_die(GENERAL_ERROR, 'Could not select default dateformat', '', __LINE__, __FILE__, $sql);
 191         }
 192         $row = $db->sql_fetchrow($result);
 193         $board_config['default_dateformat'] = $row['config_value'];
 194         $user_dateformat = ( !empty($HTTP_POST_VARS['dateformat']) ) ? trim(htmlspecialchars($HTTP_POST_VARS['dateformat'])) : $board_config['default_dateformat'];
 195
 196         $user_avatar_local = ( isset($HTTP_POST_VARS['avatarselect']) && !empty($HTTP_POST_VARS['submitavatar']) && $board_config['allow_avatar_local'] ) ? htmlspecialchars($HTTP_POST_VARS['avatarselect']) : ( ( isset($HTTP_POST_VARS['avatarlocal'])  ) ? htmlspecialchars($HTTP_POST_VARS['avatarlocal']) : '' );
 197         $user_avatar_category = ( isset($HTTP_POST_VARS['avatarcatname']) && $board_config['allow_avatar_local'] ) ? htmlspecialchars($HTTP_POST_VARS['avatarcatname']) : '' ;
 198
 199         $user_avatar_remoteurl = ( !empty($HTTP_POST_VARS['avatarremoteurl']) ) ? trim(htmlspecialchars($HTTP_POST_VARS['avatarremoteurl'])) : '';
 200         $user_avatar_upload = ( !empty($HTTP_POST_VARS['avatarurl']) ) ? trim($HTTP_POST_VARS['avatarurl']) : ( ( $HTTP_POST_FILES['avatar']['tmp_name'] != "none") ? $HTTP_POST_FILES['avatar']['tmp_name'] : '' );
 201         $user_avatar_name = ( !empty($HTTP_POST_FILES['avatar']['name']) ) ? $HTTP_POST_FILES['avatar']['name'] : '';
 202         $user_avatar_size = ( !empty($HTTP_POST_FILES['avatar']['size']) ) ? $HTTP_POST_FILES['avatar']['size'] : 0;
 203         $user_avatar_filetype = ( !empty($HTTP_POST_FILES['avatar']['type']) ) ? $HTTP_POST_FILES['avatar']['type'] : '';
 204
 205         $user_avatar = ( empty($user_avatar_local) && $mode == 'editprofile' ) ? $userdata['user_avatar'] : '';
 206         $user_avatar_type = ( empty($user_avatar_local) && $mode == 'editprofile' ) ? $userdata['user_avatar_type'] : '';
 207
 208         if ( (isset($HTTP_POST_VARS['avatargallery']) || isset($HTTP_POST_VARS['submitavatar']) || isset($HTTP_POST_VARS['cancelavatar'])) && (!isset($HTTP_POST_VARS['submit'])) )
 209         {
 210                 $username = stripslashes($username);
 211                 $email = stripslashes($email);
 212                 $cur_password = htmlspecialchars(stripslashes($cur_password));
 213                 $new_password = htmlspecialchars(stripslashes($new_password));
 214                 $password_confirm = htmlspecialchars(stripslashes($password_confirm));
 215
 216                 $icq = stripslashes($icq);
 217                 $aim = stripslashes($aim);
 218                 $msn = stripslashes($msn);
 219                 $yim = stripslashes($yim);
 220
 221                 $website = stripslashes($website);
 222                 $location = stripslashes($location);
 223                 $occupation = stripslashes($occupation);
 224                 $interests = stripslashes($interests);
 225                 $signature = htmlspecialchars(stripslashes($signature));
 226
 227                 $user_lang = stripslashes($user_lang);
 228                 $user_dateformat = stripslashes($user_dateformat);
 229
 230                 if ( !isset($HTTP_POST_VARS['cancelavatar']))
 231                 {
 232                         $user_avatar = $user_avatar_category . '/' . $user_avatar_local;
 233                         $user_avatar_type = USER_AVATAR_GALLERY;
 234                 }
 235         }
 236 }
 237
 238 //
 239 // Let's make sure the user isn't logged in while registering,
 240 // and ensure that they were trying to register a second time
 241 // (Prevents double registrations)
 242 //
 243 if ($mode == 'register' && ($userdata['session_logged_in'] || $username == $userdata['username']))
 244 {
 245         message_die(GENERAL_MESSAGE, $lang['Username_taken'], '', __LINE__, __FILE__);
 246 }
 247
 248 //
 249 // Did the user submit? In this case build a query to update the users profile in the DB
 250 //
 251 if ( isset($HTTP_POST_VARS['submit']) )
 252 {
 253         include($phpbb_root_path . 'includes/usercp_avatar.'.$phpEx);
 254
 255         $passwd_sql = '';
 256         if ( $mode == 'editprofile' )
 257         {
 258                 if ( $user_id != $userdata['user_id'] )
 259                 {
 260                         $error = TRUE;
 261                         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Wrong_Profile'];
 262                 }
 263         }
 264         else if ( $mode == 'register' )
 265         {
 266                 if ( empty($username) || empty($new_password) || empty($password_confirm) || empty($email) )
 267                 {
 268                         $error = TRUE;
 269                         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Fields_empty'];
 270                 }
 271         }
 272
 273         if ($board_config['enable_confirm'] && $mode == 'register')
 274         {
 275                 if (empty($HTTP_POST_VARS['confirm_id']))
 276                 {
 277                         $error = TRUE;
 278                         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Confirm_code_wrong'];
 279                 }
 280                 else
 281                 {
 282                         $confirm_id = htmlspecialchars($HTTP_POST_VARS['confirm_id']);
 283                         if (!preg_match('/^[A-Za-z0-9]+$/', $confirm_id))
 284                         {
 285                                 $confirm_id = '';
 286                         }
 287
 288                         $sql = 'SELECT code
 289                                 FROM ' . CONFIRM_TABLE . "
 290                                 WHERE confirm_id = '$confirm_id'
 291                                         AND session_id = '" . $userdata['session_id'] . "'";
 292                         if (!($result = $db->sql_query($sql)))
 293                         {
 294                                 message_die(GENERAL_ERROR, 'Could not obtain confirmation code', __LINE__, __FILE__, $sql);
 295                         }
 296
 297                         if ($row = $db->sql_fetchrow($result))
 298                         {
 299                                 // Only compare one char if the zlib-extension is not loaded
 300                                 if (!@extension_loaded('zlib'))
 301                                 {
 302                                         $row['code'] = substr($row['code'], -1);
 303                                 }
 304
 305                                 if ($row['code'] != $confirm_code)
 306                                 {
 307                                         $error = TRUE;
 308                                         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Confirm_code_wrong'];
 309                                 }
 310                                 else
 311                                 {
 312                                         $sql = 'DELETE FROM ' . CONFIRM_TABLE . "
 313                                                 WHERE confirm_id = '$confirm_id'
 314                                                         AND session_id = '" . $userdata['session_id'] . "'";
 315                                         if (!$db->sql_query($sql))
 316                                         {
 317                                                 message_die(GENERAL_ERROR, 'Could not delete confirmation code', __LINE__, __FILE__, $sql);
 318                                         }
 319                                 }
 320                         }
 321                         else
 322                         {
 323                                 $error = TRUE;
 324                                 $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Confirm_code_wrong'];
 325                         }
 326                         $db->sql_freeresult($result);
 327                 }
 328         }
 329
 330         $passwd_sql = '';
 331         if ( !empty($new_password) && !empty($password_confirm) )
 332         {
 333                 if ( $new_password != $password_confirm )
 334                 {
 335                         $error = TRUE;
 336                         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Password_mismatch'];
 337                 }
 338                 else if ( strlen($new_password) > 32 )
 339                 {
 340                         $error = TRUE;
 341                         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Password_long'];
 342                 }
 343                 else
 344                 {
 345                         if ( $mode == 'editprofile' )
 346                         {
 347                                 $sql = "SELECT user_password
 348                                         FROM " . USERS_TABLE . "
 349                                         WHERE user_id = $user_id";
 350                                 if ( !($result = $db->sql_query($sql)) )
 351                                 {
 352                                         message_die(GENERAL_ERROR, 'Could not obtain user_password information', '', __LINE__, __FILE__, $sql);
 353                                 }
 354
 355                                 $row = $db->sql_fetchrow($result);
 356
 357                                 if ( $row['user_password'] != md5($cur_password) )
 358                                 {
 359                                         $error = TRUE;
 360                                         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Current_password_mismatch'];
 361                                 }
 362                         }
 363
 364                         if ( !$error )
 365                         {
 366                                 $new_password = md5($new_password);
 367                                 $passwd_sql = "user_password = '$new_password', ";
 368                         }
 369                 }
 370         }
 371         else if ( ( empty($new_password) && !empty($password_confirm) ) || ( !empty($new_password) && empty($password_confirm) ) )
 372         {
 373                 $error = TRUE;
 374                 $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Password_mismatch'];
 375         }
 376
 377         //
 378         // Do a ban check on this email address
 379         //
 380         if ( $email != $userdata['user_email'] || $mode == 'register' )
 381         {
 382                 $result = validate_email($email);
 383                 if ( $result['error'] )
 384                 {
 385                         $email = $userdata['user_email'];
 386
 387                         $error = TRUE;
 388                         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $result['error_msg'];
 389                 }
 390
 391                 if ( $mode == 'editprofile' )
 392                 {
 393                         $sql = "SELECT user_password
 394                                 FROM " . USERS_TABLE . "
 395                                 WHERE user_id = $user_id";
 396                         if ( !($result = $db->sql_query($sql)) )
 397                         {
 398                                 message_die(GENERAL_ERROR, 'Could not obtain user_password information', '', __LINE__, __FILE__, $sql);
 399                         }
 400
 401                         $row = $db->sql_fetchrow($result);
 402
 403                         if ( $row['user_password'] != md5($cur_password) )
 404                         {
 405                                 $email = $userdata['user_email'];
 406
 407                                 $error = TRUE;
 408                                 $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Current_password_mismatch'];
 409                         }
 410                 }
 411         }
 412
 413         $username_sql = '';
 414         if ( $board_config['allow_namechange'] || $mode == 'register' )
 415         {
 416                 if ( empty($username) )
 417                 {
 418                         // Error is already triggered, since one field is empty.
 419                         $error = TRUE;
 420                 }
 421                 else if ( $username != $userdata['username'] || $mode == 'register')
 422                 {
 423                         if (strtolower($username) != strtolower($userdata['username']) || $mode == 'register')
 424                         {
 425                                 $result = validate_username($username);
 426                                 if ( $result['error'] )
 427                                 {
 428                                         $error = TRUE;
 429                                         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $result['error_msg'];
 430                                 }
 431                         }
 432
 433                         if (!$error)
 434                         {
 435                                 $username_sql = "username = '" . str_replace("\'", "''", $username) . "', ";
 436                         }
 437                 }
 438         }
 439
 440         if ( $signature != '' )
 441         {
 442                 if ( strlen($signature) > $board_config['max_sig_chars'] )
 443                 {
 444                         $error = TRUE;
 445                         $error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Signature_too_long'];
 446                 }
 447
 448                 if ( !isset($signature_bbcode_uid) || $signature_bbcode_uid == '' )
 449                 {
 450                         $signature_bbcode_uid = ( $allowbbcode ) ? make_bbcode_uid() : '';
 451                 }
 452                 $signature = prepare_message($signature, $allowhtml, $allowbbcode, $allowsmilies, $signature_bbcode_uid);
 453         }
 454
 455         if ( $website != '' )
 456         {
 457                 rawurlencode($website);
 458         }
 459
 460         $avatar_sql = '';
 461
 462         if ( isset($HTTP_POST_VARS['avatardel']) && $mode == 'editprofile' )
 463         {
 464                 $avatar_sql = user_avatar_delete($userdata['user_avatar_type'], $userdata['user_avatar']);
 465         }
 466         else
 467         if ( ( !empty($user_avatar_upload) || !empty($user_avatar_name) ) && $board_config['allow_avatar_upload'] )
 468         {
 469                 if ( !empty($user_avatar_upload) )
 470                 {
 471                         $avatar_mode = (empty($user_avatar_name)) ? 'remote' : 'local';
 472                         $avatar_sql = user_avatar_upload($mode, $avatar_mode, $userdata['user_avatar'], $userdata['user_avatar_type'], $error, $error_msg, $user_avatar_upload, $user_avatar_name, $user_avatar_size, $user_avatar_filetype);
 473                 }
 474                 else if ( !empty($user_avatar_name) )
 475                 {
 476                         $l_avatar_size = sprintf($lang['Avatar_filesize'], round($board_config['avatar_filesize'] / 1024));
 477
 478                         $error = true;
 479                         $error_msg .= ( ( !empty($error_msg) ) ? '<br />' : '' ) . $l_avatar_size;
 480                 }
 481         }
 482         else if ( $user_avatar_remoteurl != '' && $board_config['allow_avatar_remote'] )
 483         {
 484                 user_avatar_delete($userdata['user_avatar_type'], $userdata['user_avatar']);
 485                 $avatar_sql = user_avatar_url($mode, $error, $error_msg, $user_avatar_remoteurl);
 486         }
 487         else if ( $user_avatar_local != '' && $board_config['allow_avatar_local'] )
 488         {
 489                 user_avatar_delete($userdata['user_avatar_type'], $userdata['user_avatar']);
 490                 $avatar_sql = user_avatar_gallery($mode, $error, $error_msg, $user_avatar_local, $user_avatar_category);
 491         }
 492
 493         if ( !$error )
 494         {
 495                 if ( $avatar_sql == '' )
 496                 {
 497                         $avatar_sql = ( $mode == 'editprofile' ) ? '' : "'', " . USER_AVATAR_NONE;
 498                 }
 499
 500                 if ( $mode == 'editprofile' )
 501                 {
 502                         if ( $email != $userdata['user_email'] && $board_config['require_activation'] != USER_ACTIVATION_NONE && $userdata['user_level'] != ADMIN )
 503                         {
 504                                 $user_active = 0;
 505
 506                                 $user_actkey = gen_rand_string(true);
 507                                 $key_len = 54 - ( strlen($server_url) );
 508                                 $key_len = ( $key_len > 6 ) ? $key_len : 6;
 509                                 $user_actkey = substr($user_actkey, 0, $key_len);
 510
 511                                 if ( $userdata['session_logged_in'] )
 512                                 {
 513                                         session_end($userdata['session_id'], $userdata['user_id']);
 514                                 }
 515                         }
 516                         else
 517                         {
 518                                 $user_active = 1;
 519                                 $user_actkey = '';
 520                         }
 521
 522                         $sql = "UPDATE " . USERS_TABLE . "
 523                                 SET " . $username_sql . $passwd_sql . "user_email = '" . str_replace("\'", "''", $email) ."', user_icq = '" . str_replace("\'", "''", $icq) . "', user_website = '" . str_replace("\'", "''", $website) . "', user_occ = '" . str_replace("\'", "''", $occupation) . "', user_from = '" . str_replace("\'", "''", $location) . "', user_interests = '" . str_replace("\'", "''", $interests) . "', user_sig = '" . str_replace("\'", "''", $signature) . "', user_sig_bbcode_uid = '$signature_bbcode_uid', user_viewemail = $viewemail, user_aim = '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', user_yim = '" . str_replace("\'", "''", $yim) . "', user_msnm = '" . str_replace("\'", "''", $msn) . "', user_attachsig = $attachsig, user_allowsmile = $allowsmilies, user_allowhtml = $allowhtml, user_allowbbcode = $allowbbcode, user_allow_viewonline = $allowviewonline, user_notify = $notifyreply, user_notify_pm = $notifypm, user_popup_pm = $popup_pm, user_timezone = $user_timezone, user_dateformat = '" . str_replace("\'", "''", $user_dateformat) . "', user_lang = '" . str_replace("\'", "''", $user_lang) . "', user_style = $user_style, user_active = $user_active, user_actkey = '" . str_replace("\'", "''", $user_actkey) . "'" . $avatar_sql . "
 524                                 WHERE user_id = $user_id";
 525                         if ( !($result = $db->sql_query($sql)) )
 526                         {
 527                                 message_die(GENERAL_ERROR, 'Could not update users table', '', __LINE__, __FILE__, $sql);
 528                         }
 529
 530                         if ( !$user_active )
 531                         {
 532                                 //
 533                                 // The users account has been deactivated, send them an email with a new activation key
 534                                 //
 535                                 include($phpbb_root_path . 'includes/emailer.'.$phpEx);
 536                                 $emailer = new emailer($board_config['smtp_delivery']);
 537
 538                                 if ( $board_config['require_activation'] != USER_ACTIVATION_ADMIN )
 539                                 {
 540                                         $emailer->from($board_config['board_email']);
 541                                         $emailer->replyto($board_config['board_email']);
 542
 543                                         $emailer->use_template('user_activate', stripslashes($user_lang));
 544                                         $emailer->email_address($email);
 545                                         $emailer->set_subject($lang['Reactivate']);
 546
 547                                         $emailer->assign_vars(array(
 548                                                 'SITENAME' => $board_config['sitename'],
 549                                                 'USERNAME' => preg_replace($unhtml_specialchars_match, $unhtml_specialchars_replace, substr(str_replace("\'", "'", $username), 0, 25)),
 550                                                 'EMAIL_SIG' => (!empty($board_config['board_email_sig'])) ? str_replace('<br />', "\n", "-- \n" . $board_config['board_email_sig']) : '',
 551
 552                                                 'U_ACTIVATE' => $server_url . '?mode=activate&' . POST_USERS_URL . '=' . $user_id . '&act_key=' . $user_actkey)
 553                                         );
 554                                         $emailer->send();
 555                                         $emailer->reset();
 556                                 }
 557                                 else if ( $board_config['require_activation'] == USER_ACTIVATION_ADMIN )
 558                                 {
 559                                         $sql = 'SELECT user_email, user_lang
 560                                                 FROM ' . USERS_TABLE . '
 561                                                 WHERE user_level = ' . ADMIN;
 562
 563                                         if ( !($result = $db->sql_query($sql)) )
 564                                         {
 565                                                 message_die(GENERAL_ERROR, 'Could not select Administrators', '', __LINE__, __FILE__, $sql);
 566                                         }
 567
 568                                         while ($row = $db->sql_fetchrow($result))
 569                                         {
 570                                                 $emailer->from($board_config['board_email']);
 571                                                 $emailer->replyto($board_config['board_email']);
 572
 573                                                 $emailer->email_address(trim($row['user_email']));
 574                                                 $emailer->use_template("admin_activate", $row['user_lang']);
 575                                                 $emailer->set_subject($lang['Reactivate']);
 576
 577                                                 $emailer->assign_vars(array(
 578                                                         'USERNAME' => preg_replace($unhtml_specialchars_match, $unhtml_specialchars_replace, substr(str_replace("\'", "'", $username), 0, 25)),
 579                                                         'EMAIL_SIG' => str_replace('<br />', "\n", "-- \n" . $board_config['board_email_sig']),
 580
 581                                                         'U_ACTIVATE' => $server_url . '?mode=activate&' . POST_USERS_URL . '=' . $user_id . '&act_key=' . $user_actkey)
 582                                                 );
 583                                                 $emailer->send();
 584                                                 $emailer->reset();
 585                                         }
 586                                         $db->sql_freeresult($result);
 587                                 }
 588
 589                                 $message = $lang['Profile_updated_inactive'] . '<br /><br />' . sprintf($lang['Click_return_index'],  '<a href="' . append_sid("index.$phpEx") . '">', '</a>');
 590                         }
 591                         else
 592                         {
 593                                 $message = $lang['Profile_updated'] . '<br /><br />' . sprintf($lang['Click_return_index'],  '<a href="' . append_sid("index.$phpEx") . '">', '</a>');
 594                         }
 595
 596                         $template->assign_vars(array(
 597                                 "META" => '<meta http-equiv="refresh" content="5;url=' . append_sid("index.$phpEx") . '">')
 598                         );
 599
 600                         message_die(GENERAL_MESSAGE, $message);
 601                 }
 602                 else
 603                 {
 604                         $sql = "SELECT MAX(user_id) AS total
 605                                 FROM " . USERS_TABLE;
 606                         if ( !($result = $db->sql_query($sql)) )
 607                         {
 608                                 message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql);
 609                         }
 610
 611                         if ( !($row = $db->sql_fetchrow($result)) )
 612                         {
 613                                 message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql);
 614                         }
 615                         $user_id = $row['total'] + 1;
 616
 617                         //
 618                         // Get current date
 619                         //
 620                         $sql = "INSERT INTO " . USERS_TABLE . " (user_id, username, user_regdate, user_password, user_email, user_icq, user_website, user_occ, user_from, user_interests, user_sig, user_sig_bbcode_uid, user_avatar, user_avatar_type, user_viewemail, user_aim, user_yim, user_msnm, user_attachsig, user_allowsmile, user_allowhtml, user_allowbbcode, user_allow_viewonline, user_notify, user_notify_pm, user_popup_pm, user_timezone, user_dateformat, user_lang, user_style, user_level, user_allow_pm, user_active, user_actkey)
 621                                 VALUES ($user_id, '" . str_replace("\'", "''", $username) . "', " . time() . ", '" . str_replace("\'", "''", $new_password) . "', '" . str_replace("\'", "''", $email) . "', '" . str_replace("\'", "''", $icq) . "', '" . str_replace("\'", "''", $website) . "', '" . str_replace("\'", "''", $occupation) . "', '" . str_replace("\'", "''", $location) . "', '" . str_replace("\'", "''", $interests) . "', '" . str_replace("\'", "''", $signature) . "', '$signature_bbcode_uid', $avatar_sql, $viewemail, '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', '" . str_replace("\'", "''", $yim) . "', '" . str_replace("\'", "''", $msn) . "', $attachsig, $allowsmilies, $allowhtml, $allowbbcode, $allowviewonline, $notifyreply, $notifypm, $popup_pm, $user_timezone, '" . str_replace("\'", "''", $user_dateformat) . "', '" . str_replace("\'", "''", $user_lang) . "', $user_style, 0, 1, ";
 622                         if ( $board_config['require_activation'] == USER_ACTIVATION_SELF || $board_config['require_activation'] == USER_ACTIVATION_ADMIN || $coppa )
 623                         {
 624                                 $user_actkey = gen_rand_string(true);
 625                                 $key_len = 54 - (strlen($server_url));
 626                                 $key_len = ( $key_len > 6 ) ? $key_len : 6;
 627                                 $user_actkey = substr($user_actkey, 0, $key_len);
 628                                 $sql .= "0, '" . str_replace("\'", "''", $user_actkey) . "')";
 629                         }
 630                         else
 631                         {
 632                                 $sql .= "1, '')";
 633                         }
 634
 635                         if ( !($result = $db->sql_query($sql, BEGIN_TRANSACTION)) )
 636                         {
 637                                 message_die(GENERAL_ERROR, 'Could not insert data into users table', '', __LINE__, __FILE__, $sql);
 638                         }
 639
 640                         $sql = "INSERT INTO " . GROUPS_TABLE . " (group_name, group_description, group_single_user, group_moderator)
 641                                 VALUES ('', 'Personal User', 1, 0)";
 642                         if ( !($result = $db->sql_query($sql)) )
 643                         {
 644                                 message_die(GENERAL_ERROR, 'Could not insert data into groups table', '', __LINE__, __FILE__, $sql);
 645                         }
 646
 647                         $group_id = $db->sql_nextid();
 648
 649                         $sql = "INSERT INTO " . USER_GROUP_TABLE . " (user_id, group_id, user_pending)
 650                                 VALUES ($user_id, $group_id, 0)";
 651                         if( !($result = $db->sql_query($sql, END_TRANSACTION)) )
 652                         {
 653                                 message_die(GENERAL_ERROR, 'Could not insert data into user_group table', '', __LINE__, __FILE__, $sql);
 654                         }
 655
 656                         if ( $coppa )
 657                         {
 658                                 $message = $lang['COPPA'];
 659                                 $email_template = 'coppa_welcome_inactive';
 660                         }
 661                         else if ( $board_config['require_activation'] == USER_ACTIVATION_SELF )
 662                         {
 663                                 $message = $lang['Account_inactive'];
 664                                 $email_template = 'user_welcome_inactive';
 665                         }
 666                         else if ( $board_config['require_activation'] == USER_ACTIVATION_ADMIN )
 667                         {
 668                                 $message = $lang['Account_inactive_admin'];
 669                                 $email_template = 'admin_welcome_inactive';
 670                         }
 671                         else
 672                         {
 673                                 $message = $lang['Account_added'];
 674                                 $email_template = 'user_welcome';
 675                         }
 676
 677                         include($phpbb_root_path . 'includes/emailer.'.$phpEx);
 678                         $emailer = new emailer($board_config['smtp_delivery']);
 679
 680                         $emailer->from($board_config['board_email']);
 681                         $emailer->replyto($board_config['board_email']);
 682
 683                         $emailer->use_template($email_template, stripslashes($user_lang));
 684                         $emailer->email_address($email);
 685                         $emailer->set_subject(sprintf($lang['Welcome_subject'], $board_config['sitename']));
 686
 687                         if( $coppa )
 688                         {
 689                                 $emailer->assign_vars(array(
 690                                         'SITENAME' => $board_config['sitename'],
 691                                         'WELCOME_MSG' => sprintf($lang['Welcome_subject'], $board_config['sitename']),
 692                                         'USERNAME' => preg_replace($unhtml_specialchars_match, $unhtml_specialchars_replace, substr(str_replace("\'", "'", $username), 0, 25)),
 693                                         'PASSWORD' => $password_confirm,
 694                                         'EMAIL_SIG' => str_replace('<br />', "\n", "-- \n" . $board_config['board_email_sig']),
 695
 696                                         'FAX_INFO' => $board_config['coppa_fax'],
 697                                         'MAIL_INFO' => $board_config['coppa_mail'],
 698                                         'EMAIL_ADDRESS' => $email,
 699                                         'ICQ' => $icq,
 700                                         'AIM' => $aim,
 701                                         'YIM' => $yim,
 702                                         'MSN' => $msn,
 703                                         'WEB_SITE' => $website,
 704                                         'FROM' => $location,
 705                                         'OCC' => $occupation,
 706                                         'INTERESTS' => $interests,
 707                                         'SITENAME' => $board_config['sitename']));
 708                         }
 709                         else
 710                         {
 711                                 $emailer->assign_vars(array(
 712                                         'SITENAME' => $board_config['sitename'],
 713                                         'WELCOME_MSG' => sprintf($lang['Welcome_subject'], $board_config['sitename']),
 714                                         'USERNAME' => preg_replace($unhtml_specialchars_match, $unhtml_specialchars_replace, substr(str_replace("\'", "'", $username), 0, 25)),
 715                                         'PASSWORD' => $password_confirm,
 716                                         'EMAIL_SIG' => str_replace('<br />', "\n", "-- \n" . $board_config['board_email_sig']),
 717
 718                                         'U_ACTIVATE' => $server_url . '?mode=activate&' . POST_USERS_URL . '=' . $user_id . '&act_key=' . $user_actkey)
 719                                 );
 720                         }
 721
 722                         $emailer->send();
 723                         $emailer->reset();
 724
 725                         if ( $board_config['require_activation'] == USER_ACTIVATION_ADMIN )
 726                         {
 727                                 $sql = "SELECT user_email, user_lang
 728                                         FROM " . USERS_TABLE . "
 729                                         WHERE user_level = " . ADMIN;
 730
 731                                 if ( !($result = $db->sql_query($sql)) )
 732                                 {
 733                                         message_die(GENERAL_ERROR, 'Could not select Administrators', '', __LINE__, __FILE__, $sql);
 734                                 }
 735
 736                                 while ($row = $db->sql_fetchrow($result))
 737                                 {
 738                                         $emailer->from($board_config['board_email']);
 739                                         $emailer->replyto($board_config['board_email']);
 740
 741                                         $emailer->email_address(trim($row['user_email']));
 742                                         $emailer->use_template("admin_activate", $row['user_lang']);
 743                                         $emailer->set_subject($lang['New_account_subject']);
 744
 745                                         $emailer->assign_vars(array(
 746                                                 'USERNAME' => preg_replace($unhtml_specialchars_match, $unhtml_specialchars_replace, substr(str_replace("\'", "'", $username), 0, 25)),
 747                                                 'EMAIL_SIG' => str_replace('<br />', "\n", "-- \n" . $board_config['board_email_sig']),
 748
 749                                                 'U_ACTIVATE' => $server_url . '?mode=activate&' . POST_USERS_URL . '=' . $user_id . '&act_key=' . $user_actkey)
 750                                         );
 751                                         $emailer->send();
 752                                         $emailer->reset();
 753                                 }
 754                                 $db->sql_freeresult($result);
 755                         }
 756
 757                         $message = $message . '<br /><br />' . sprintf($lang['Click_return_index'],  '<a href="' . append_sid("index.$phpEx") . '">', '</a>');
 758
 759                         message_die(GENERAL_MESSAGE, $message);
 760                 } // if mode == register
 761         }
 762 } // End of submit
 763
 764
 765 if ( $error )
 766 {
 767         //
 768         // If an error occured we need to stripslashes on returned data
 769         //
 770         $username = stripslashes($username);
 771         $email = stripslashes($email);
 772         $new_password = '';
 773         $password_confirm = '';
 774
 775         $icq = stripslashes($icq);
 776         $aim = str_replace('+', ' ', stripslashes($aim));
 777         $msn = stripslashes($msn);
 778         $yim = stripslashes($yim);
 779
 780         $website = stripslashes($website);
 781         $location = stripslashes($location);
 782         $occupation = stripslashes($occupation);
 783         $interests = stripslashes($interests);
 784         $signature = stripslashes($signature);
 785         $signature = ($signature_bbcode_uid != '') ? preg_replace("/:(([a-z0-9]+:)?)$signature_bbcode_uid(=|\])/si", '\\3', $signature) : $signature;
 786
 787         $user_lang = stripslashes($user_lang);
 788         $user_dateformat = stripslashes($user_dateformat);
 789
 790 }
 791 else if ( $mode == 'editprofile' && !isset($HTTP_POST_VARS['avatargallery']) && !isset($HTTP_POST_VARS['submitavatar']) && !isset($HTTP_POST_VARS['cancelavatar']) )
 792 {
 793         $user_id = $userdata['user_id'];
 794         $username = $userdata['username'];
 795         $email = $userdata['user_email'];
 796         $new_password = '';
 797         $password_confirm = '';
 798
 799         $icq = $userdata['user_icq'];
 800         $aim = str_replace('+', ' ', $userdata['user_aim']);
 801         $msn = $userdata['user_msnm'];
 802         $yim = $userdata['user_yim'];
 803
 804         $website = $userdata['user_website'];
 805         $location = $userdata['user_from'];
 806         $occupation = $userdata['user_occ'];
 807         $interests = $userdata['user_interests'];
 808         $signature_bbcode_uid = $userdata['user_sig_bbcode_uid'];
 809         $signature = ($signature_bbcode_uid != '') ? preg_replace("/:(([a-z0-9]+:)?)$signature_bbcode_uid(=|\])/si", '\\3', $userdata['user_sig']) : $userdata['user_sig'];
 810
 811         $viewemail = $userdata['user_viewemail'];
 812         $notifypm = $userdata['user_notify_pm'];
 813         $popup_pm = $userdata['user_popup_pm'];
 814         $notifyreply = $userdata['user_notify'];
 815         $attachsig = $userdata['user_attachsig'];
 816         $allowhtml = $userdata['user_allowhtml'];
 817         $allowbbcode = $userdata['user_allowbbcode'];
 818         $allowsmilies = $userdata['user_allowsmile'];
 819         $allowviewonline = $userdata['user_allow_viewonline'];
 820
 821         $user_avatar = ( $userdata['user_allowavatar'] ) ? $userdata['user_avatar'] : '';
 822         $user_avatar_type = ( $userdata['user_allowavatar'] ) ? $userdata['user_avatar_type'] : USER_AVATAR_NONE;
 823
 824         $user_style = $userdata['user_style'];
 825         $user_lang = $userdata['user_lang'];
 826         $user_timezone = $userdata['user_timezone'];
 827         $user_dateformat = $userdata['user_dateformat'];
 828 }
 829
 830 //
 831 // Default pages
 832 //
 833 include($phpbb_root_path . 'includes/page_header.'.$phpEx);
 834
 835 make_jumpbox('viewforum.'.$phpEx);
 836
 837 if ( $mode == 'editprofile' )
 838 {
 839         if ( $user_id != $userdata['user_id'] )
 840         {
 841                 $error = TRUE;
 842                 $error_msg = $lang['Wrong_Profile'];
 843         }
 844 }
 845
 846 if( isset($HTTP_POST_VARS['avatargallery']) && !$error )
 847 {
 848         include($phpbb_root_path . 'includes/usercp_avatar.'.$phpEx);
 849
 850         $avatar_category = ( !empty($HTTP_POST_VARS['avatarcategory']) ) ? htmlspecialchars($HTTP_POST_VARS['avatarcategory']) : '';
 851
 852         $template->set_filenames(array(
 853                 'body' => 'profile_avatar_gallery.tpl')
 854         );
 855
 856         $allowviewonline = !$allowviewonline;
 857
 858         display_avatar_gallery($mode, $avatar_category, $user_id, $email, $current_email, $coppa, $username, $email, $new_password, $cur_password, $password_confirm, $icq, $aim, $msn, $yim, $website, $location, $occupation, $interests, $signature, $viewemail, $notifypm, $popup_pm, $notifyreply, $attachsig, $allowhtml, $allowbbcode, $allowsmilies, $allowviewonline, $user_style, $user_lang, $user_timezone, $user_dateformat, $userdata['session_id']);
 859 }
 860 else
 861 {
 862         include($phpbb_root_path . 'includes/functions_selects.'.$phpEx);
 863
 864         if ( !isset($coppa) )
 865         {
 866                 $coppa = FALSE;
 867         }
 868
 869         if ( !isset($user_style) )
 870         {
 871                 $user_style = $board_config['default_style'];
 872         }
 873
 874         $avatar_img = '';
 875         if ( $user_avatar_type )
 876         {
 877                 switch( $user_avatar_type )
 878                 {
 879                         case USER_AVATAR_UPLOAD:
 880                                 $avatar_img = ( $board_config['allow_avatar_upload'] ) ? '<img src="' . $board_config['avatar_path'] . '/' . $user_avatar . '" alt="" />' : '';
 881                                 break;
 882                         case USER_AVATAR_REMOTE:
 883                                 $avatar_img = ( $board_config['allow_avatar_remote'] ) ? '<img src="' . $user_avatar . '" alt="" />' : '';
 884                                 break;
 885                         case USER_AVATAR_GALLERY:
 886                                 $avatar_img = ( $board_config['allow_avatar_local'] ) ? '<img src="' . $board_config['avatar_gallery_path'] . '/' . $user_avatar . '" alt="" />' : '';
 887                                 break;
 888                 }
 889         }
 890
 891         $s_hidden_fields = '<input type="hidden" name="mode" value="' . $mode . '" /><input type="hidden" name="agreed" value="true" /><input type="hidden" name="coppa" value="' . $coppa . '" />';
 892         if( $mode == 'editprofile' )
 893         {
 894                 $s_hidden_fields .= '<input type="hidden" name="user_id" value="' . $userdata['user_id'] . '" />';
 895                 //
 896                 // Send the users current email address. If they change it, and account activation is turned on
 897                 // the user account will be disabled and the user will have to reactivate their account.
 898                 //
 899                 $s_hidden_fields .= '<input type="hidden" name="current_email" value="' . $userdata['user_email'] . '" />';
 900         }
 901
 902         if ( !empty($user_avatar_local) )
 903         {
 904                 $s_hidden_fields .= '<input type="hidden" name="avatarlocal" value="' . $user_avatar_local . '" /><input type="hidden" name="avatarcatname" value="' . $user_avatar_category . '" />';
 905         }
 906
 907         $html_status =  ( $userdata['user_allowhtml'] && $board_config['allow_html'] ) ? $lang['HTML_is_ON'] : $lang['HTML_is_OFF'];
 908         $bbcode_status = ( $userdata['user_allowbbcode'] && $board_config['allow_bbcode']  ) ? $lang['BBCode_is_ON'] : $lang['BBCode_is_OFF'];
 909         $smilies_status = ( $userdata['user_allowsmile'] && $board_config['allow_smilies']  ) ? $lang['Smilies_are_ON'] : $lang['Smilies_are_OFF'];
 910
 911         if ( $error )
 912         {
 913                 $template->set_filenames(array(
 914                         'reg_header' => 'error_body.tpl')
 915                 );
 916                 $template->assign_vars(array(
 917                         'ERROR_MESSAGE' => $error_msg)
 918                 );
 919                 $template->assign_var_from_handle('ERROR_BOX', 'reg_header');
 920         }
 921
 922         $template->set_filenames(array(
 923                 'body' => 'profile_add_body.tpl')
 924         );
 925
 926         if ( $mode == 'editprofile' )
 927         {
 928                 $template->assign_block_vars('switch_edit_profile', array());
 929         }
 930
 931         if ( ($mode == 'register') || ($board_config['allow_namechange']) )
 932         {
 933                 $template->assign_block_vars('switch_namechange_allowed', array());
 934         }
 935         else
 936         {
 937                 $template->assign_block_vars('switch_namechange_disallowed', array());
 938         }
 939
 940
 941         // Visual Confirmation
 942         $confirm_image = '';
 943         if (!empty($board_config['enable_confirm']) && $mode == 'register')
 944         {
 945                 $sql = 'SELECT session_id
 946                         FROM ' . SESSIONS_TABLE;
 947                 if (!($result = $db->sql_query($sql)))
 948                 {
 949                         message_die(GENERAL_ERROR, 'Could not select session data', '', __LINE__, __FILE__, $sql);
 950                 }
 951
 952                 if ($row = $db->sql_fetchrow($result))
 953                 {
 954                         $confirm_sql = '';
 955                         do
 956                         {
 957                                 $confirm_sql .= (($confirm_sql != '') ? ', ' : '') . "'" . $row['session_id'] . "'";
 958                         }
 959                         while ($row = $db->sql_fetchrow($result));
 960
 961                         $sql = 'DELETE FROM ' .  CONFIRM_TABLE . "
 962                                 WHERE session_id NOT IN ($confirm_sql)";
 963                         if (!$db->sql_query($sql))
 964                         {
 965                                 message_die(GENERAL_ERROR, 'Could not delete stale confirm data', '', __LINE__, __FILE__, $sql);
 966                         }
 967                 }
 968                 $db->sql_freeresult($result);
 969
 970                 $sql = 'SELECT COUNT(session_id) AS attempts
 971                         FROM ' . CONFIRM_TABLE . "
 972                         WHERE session_id = '" . $userdata['session_id'] . "'";
 973                 if (!($result = $db->sql_query($sql)))
 974                 {
 975                         message_die(GENERAL_ERROR, 'Could not obtain confirm code count', '', __LINE__, __FILE__, $sql);
 976                 }
 977
 978                 if ($row = $db->sql_fetchrow($result))
 979                 {
 980                         if ($row['attempts'] > 3)
 981                         {
 982                                 message_die(GENERAL_MESSAGE, $lang['Too_many_registers']);
 983                         }
 984                 }
 985                 $db->sql_freeresult($result);
 986
 987                 $confirm_chars = array('A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J',  'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T',  'U', 'V', 'W', 'X', 'Y', 'Z', '1', '2', '3', '4', '5', '6', '7', '8', '9');
 988
 989                 list($usec, $sec) = explode(' ', microtime());
 990                 mt_srand($sec * $usec);
 991
 992                 $max_chars = count($confirm_chars) - 1;
 993                 $code = '';
 994                 for ($i = 0; $i < 6; $i++)
 995                 {
 996                         $code .= $confirm_chars[mt_rand(0, $max_chars)];
 997                 }
 998
 999                 $confirm_id = md5(uniqid($user_ip));
1000
1001                 $sql = 'INSERT INTO ' . CONFIRM_TABLE . " (confirm_id, session_id, code)
1002                         VALUES ('$confirm_id', '". $userdata['session_id'] . "', '$code')";
1003                 if (!$db->sql_query($sql))
1004                 {
1005                         message_die(GENERAL_ERROR, 'Could not insert new confirm code information', '', __LINE__, __FILE__, $sql);
1006                 }
1007
1008                 unset($code);
1009
1010                 $confirm_image = (@extension_loaded('zlib')) ? '<img src="' . append_sid("profile.$phpEx?mode=confirm&amp;id=$confirm_id") . '" alt="" title="" />' : '<img src="' . append_sid("profile.$phpEx?mode=confirm&amp;id=$confirm_id&amp;c=1") . '" alt="" title="" /><img src="' . append_sid("profile.$phpEx?mode=confirm&amp;id=$confirm_id&amp;c=2") . '" alt="" title="" /><img src="' . append_sid("profile.$phpEx?mode=confirm&amp;id=$confirm_id&amp;c=3") . '" alt="" title="" /><img src="' . append_sid("profile.$phpEx?mode=confirm&amp;id=$confirm_id&amp;c=4") . '" alt="" title="" /><img src="' . append_sid("profile.$phpEx?mode=confirm&amp;id=$confirm_id&amp;c=5") . '" alt="" title="" /><img src="' . append_sid("profile.$phpEx?mode=confirm&amp;id=$confirm_id&amp;c=6") . '" alt="" title="" />';
1011                 $s_hidden_fields .= '<input type="hidden" name="confirm_id" value="' . $confirm_id . '" />';
1012
1013                 $template->assign_block_vars('switch_confirm', array());
1014         }
1015
1016
1017         //
1018         // Let's do an overall check for settings/versions which would prevent
1019         // us from doing file uploads....
1020         //
1021         $ini_val = ( phpversion() >= '4.0.0' ) ? 'ini_get' : 'get_cfg_var';
1022         $form_enctype = ( @$ini_val('file_uploads') == '0' || strtolower(@$ini_val('file_uploads') == 'off') || phpversion() == '4.0.4pl1' || !$board_config['allow_avatar_upload'] || ( phpversion() < '4.0.3' && @$ini_val('open_basedir') != '' ) ) ? '' : 'enctype="multipart/form-data"';
1023
1024         $template->assign_vars(array(
1025                 'USERNAME' => $username,
1026                 'CUR_PASSWORD' => $cur_password,
1027                 'NEW_PASSWORD' => $new_password,
1028                 'PASSWORD_CONFIRM' => $password_confirm,
1029                 'EMAIL' => $email,
1030                 'CONFIRM_IMG' => $confirm_image,
1031                 'YIM' => $yim,
1032                 'ICQ' => $icq,
1033                 'MSN' => $msn,
1034                 'AIM' => $aim,
1035                 'OCCUPATION' => $occupation,
1036                 'INTERESTS' => $interests,
1037                 'LOCATION' => $location,
1038                 'WEBSITE' => $website,
1039                 'SIGNATURE' => str_replace('<br />', "\n", $signature),
1040                 'VIEW_EMAIL_YES' => ( $viewemail ) ? 'checked="checked"' : '',
1041                 'VIEW_EMAIL_NO' => ( !$viewemail ) ? 'checked="checked"' : '',
1042                 'HIDE_USER_YES' => ( !$allowviewonline ) ? 'checked="checked"' : '',
1043                 'HIDE_USER_NO' => ( $allowviewonline ) ? 'checked="checked"' : '',
1044                 'NOTIFY_PM_YES' => ( $notifypm ) ? 'checked="checked"' : '',
1045                 'NOTIFY_PM_NO' => ( !$notifypm ) ? 'checked="checked"' : '',
1046                 'POPUP_PM_YES' => ( $popup_pm ) ? 'checked="checked"' : '',
1047                 'POPUP_PM_NO' => ( !$popup_pm ) ? 'checked="checked"' : '',
1048                 'ALWAYS_ADD_SIGNATURE_YES' => ( $attachsig ) ? 'checked="checked"' : '',
1049                 'ALWAYS_ADD_SIGNATURE_NO' => ( !$attachsig ) ? 'checked="checked"' : '',
1050                 'NOTIFY_REPLY_YES' => ( $notifyreply ) ? 'checked="checked"' : '',
1051                 'NOTIFY_REPLY_NO' => ( !$notifyreply ) ? 'checked="checked"' : '',
1052                 'ALWAYS_ALLOW_BBCODE_YES' => ( $allowbbcode ) ? 'checked="checked"' : '',
1053                 'ALWAYS_ALLOW_BBCODE_NO' => ( !$allowbbcode ) ? 'checked="checked"' : '',
1054                 'ALWAYS_ALLOW_HTML_YES' => ( $allowhtml ) ? 'checked="checked"' : '',
1055                 'ALWAYS_ALLOW_HTML_NO' => ( !$allowhtml ) ? 'checked="checked"' : '',
1056                 'ALWAYS_ALLOW_SMILIES_YES' => ( $allowsmilies ) ? 'checked="checked"' : '',
1057                 'ALWAYS_ALLOW_SMILIES_NO' => ( !$allowsmilies ) ? 'checked="checked"' : '',
1058                 'ALLOW_AVATAR' => $board_config['allow_avatar_upload'],
1059                 'AVATAR' => $avatar_img,
1060                 'AVATAR_SIZE' => $board_config['avatar_filesize'],
1061                 'LANGUAGE_SELECT' => language_select($user_lang, 'language'),
1062                 'STYLE_SELECT' => style_select($user_style, 'style'),
1063                 'TIMEZONE_SELECT' => tz_select($user_timezone, 'timezone'),
1064                 'DATE_FORMAT' => $user_dateformat,
1065                 'HTML_STATUS' => $html_status,
1066                 'BBCODE_STATUS' => sprintf($bbcode_status, '<a href="' . append_sid("faq.$phpEx?mode=bbcode") . '" target="_phpbbcode">', '</a>'),
1067                 'SMILIES_STATUS' => $smilies_status,
1068
1069                 'L_CURRENT_PASSWORD' => $lang['Current_password'],
1070                 'L_NEW_PASSWORD' => ( $mode == 'register' ) ? $lang['Password'] : $lang['New_password'],
1071                 'L_CONFIRM_PASSWORD' => $lang['Confirm_password'],
1072                 'L_CONFIRM_PASSWORD_EXPLAIN' => ( $mode == 'editprofile' ) ? $lang['Confirm_password_explain'] : '',
1073                 'L_PASSWORD_IF_CHANGED' => ( $mode == 'editprofile' ) ? $lang['password_if_changed'] : '',
1074                 'L_PASSWORD_CONFIRM_IF_CHANGED' => ( $mode == 'editprofile' ) ? $lang['password_confirm_if_changed'] : '',
1075                 'L_SUBMIT' => $lang['Submit'],
1076                 'L_RESET' => $lang['Reset'],
1077                 'L_ICQ_NUMBER' => $lang['ICQ'],
1078                 'L_MESSENGER' => $lang['MSNM'],
1079                 'L_YAHOO' => $lang['YIM'],
1080                 'L_WEBSITE' => $lang['Website'],
1081                 'L_AIM' => $lang['AIM'],
1082                 'L_LOCATION' => $lang['Location'],
1083                 'L_OCCUPATION' => $lang['Occupation'],
1084                 'L_BOARD_LANGUAGE' => $lang['Board_lang'],
1085                 'L_BOARD_STYLE' => $lang['Board_style'],
1086                 'L_TIMEZONE' => $lang['Timezone'],
1087                 'L_DATE_FORMAT' => $lang['Date_format'],
1088                 'L_DATE_FORMAT_EXPLAIN' => $lang['Date_format_explain'],
1089                 'L_YES' => $lang['Yes'],
1090                 'L_NO' => $lang['No'],
1091                 'L_INTERESTS' => $lang['Interests'],
1092                 'L_ALWAYS_ALLOW_SMILIES' => $lang['Always_smile'],
1093                 'L_ALWAYS_ALLOW_BBCODE' => $lang['Always_bbcode'],
1094                 'L_ALWAYS_ALLOW_HTML' => $lang['Always_html'],
1095                 'L_HIDE_USER' => $lang['Hide_user'],
1096                 'L_ALWAYS_ADD_SIGNATURE' => $lang['Always_add_sig'],
1097
1098                 'L_AVATAR_PANEL' => $lang['Avatar_panel'],
1099                 'L_AVATAR_EXPLAIN' => sprintf($lang['Avatar_explain'], $board_config['avatar_max_width'], $board_config['avatar_max_height'], (round($board_config['avatar_filesize'] / 1024))),
1100                 'L_UPLOAD_AVATAR_FILE' => $lang['Upload_Avatar_file'],
1101                 'L_UPLOAD_AVATAR_URL' => $lang['Upload_Avatar_URL'],
1102                 'L_UPLOAD_AVATAR_URL_EXPLAIN' => $lang['Upload_Avatar_URL_explain'],
1103                 'L_AVATAR_GALLERY' => $lang['Select_from_gallery'],
1104                 'L_SHOW_GALLERY' => $lang['View_avatar_gallery'],
1105                 'L_LINK_REMOTE_AVATAR' => $lang['Link_remote_Avatar'],
1106                 'L_LINK_REMOTE_AVATAR_EXPLAIN' => $lang['Link_remote_Avatar_explain'],
1107                 'L_DELETE_AVATAR' => $lang['Delete_Image'],
1108                 'L_CURRENT_IMAGE' => $lang['Current_Image'],
1109
1110                 'L_SIGNATURE' => $lang['Signature'],
1111                 'L_SIGNATURE_EXPLAIN' => sprintf($lang['Signature_explain'], $board_config['max_sig_chars']),
1112                 'L_NOTIFY_ON_REPLY' => $lang['Always_notify'],
1113                 'L_NOTIFY_ON_REPLY_EXPLAIN' => $lang['Always_notify_explain'],
1114                 'L_NOTIFY_ON_PRIVMSG' => $lang['Notify_on_privmsg'],
1115                 'L_POPUP_ON_PRIVMSG' => $lang['Popup_on_privmsg'],
1116                 'L_POPUP_ON_PRIVMSG_EXPLAIN' => $lang['Popup_on_privmsg_explain'],
1117                 'L_PREFERENCES' => $lang['Preferences'],
1118                 'L_PUBLIC_VIEW_EMAIL' => $lang['Public_view_email'],
1119                 'L_ITEMS_REQUIRED' => $lang['Items_required'],
1120                 'L_REGISTRATION_INFO' => $lang['Registration_info'],
1121                 'L_PROFILE_INFO' => $lang['Profile_info'],
1122                 'L_PROFILE_INFO_NOTICE' => $lang['Profile_info_warn'],
1123                 'L_EMAIL_ADDRESS' => $lang['Email_address'],
1124
1125                 'L_CONFIRM_CODE_IMPAIRED'       => sprintf($lang['Confirm_code_impaired'], '<a href="mailto:' . $board_config['board_email'] . '">', '</a>'),
1126                 'L_CONFIRM_CODE'                        => $lang['Confirm_code'],
1127                 'L_CONFIRM_CODE_EXPLAIN'        => $lang['Confirm_code_explain'],
1128
1129                 'S_ALLOW_AVATAR_UPLOAD' => $board_config['allow_avatar_upload'],
1130                 'S_ALLOW_AVATAR_LOCAL' => $board_config['allow_avatar_local'],
1131                 'S_ALLOW_AVATAR_REMOTE' => $board_config['allow_avatar_remote'],
1132                 'S_HIDDEN_FIELDS' => $s_hidden_fields,
1133                 'S_FORM_ENCTYPE' => $form_enctype,
1134                 'S_PROFILE_ACTION' => append_sid("profile.$phpEx"))
1135         );
1136
1137         //
1138         // This is another cheat using the block_var capability
1139         // of the templates to 'fake' an IF...ELSE...ENDIF solution
1140         // it works well :)
1141         //
1142         if ( $mode != 'register' )
1143         {
1144                 if ( $userdata['user_allowavatar'] && ( $board_config['allow_avatar_upload'] || $board_config['allow_avatar_local'] || $board_config['allow_avatar_remote'] ) )
1145                 {
1146                         $template->assign_block_vars('switch_avatar_block', array() );
1147
1148                         if ( $board_config['allow_avatar_upload'] && file_exists(@phpbb_realpath('./' . $board_config['avatar_path'])) )
1149                         {
1150                                 if ( $form_enctype != '' )
1151                                 {
1152                                         $template->assign_block_vars('switch_avatar_block.switch_avatar_local_upload', array() );
1153                                 }
1154                                 $template->assign_block_vars('switch_avatar_block.switch_avatar_remote_upload', array() );
1155                         }
1156
1157                         if ( $board_config['allow_avatar_remote'] )
1158                         {
1159                                 $template->assign_block_vars('switch_avatar_block.switch_avatar_remote_link', array() );
1160                         }
1161
1162                         if ( $board_config['allow_avatar_local'] && file_exists(@phpbb_realpath('./' . $board_config['avatar_gallery_path'])) )
1163                         {
1164                                 $template->assign_block_vars('switch_avatar_block.switch_avatar_local_gallery', array() );
1165                         }
1166                 }
1167         }
1168 }
1169
1170 $template->pparse('body');
1171
1172 include($phpbb_root_path . 'includes/page_tail.'.$phpEx);
1173
1174 ?>