db_Delete("user", "user_ban = 2 AND user_join < '{$threshold}' ");
}
include_once(e_HANDLER."user_extended_class.php");
$usere = new e107_user_extended;
require_once(e_HANDLER."calendar/calendar_class.php");
$cal = new DHTML_Calendar(true);
require_once(e_HANDLER.'user_handler.php');
$user_info = new UserHandler;
if (is_readable(THEME."signup_template.php"))
{
require_once(THEME."signup_template.php");
}
else
{
require_once(e_THEME."templates/signup_template.php");
}
include_once(e_FILE."shortcode/batch/signup_shortcodes.php");
$signup_imagecode = ($pref['signcode'] && extension_loaded("gd"));
$text = '';
//-------------------------------
// Resend Activation Email
//-------------------------------
if(e_QUERY == "resend" && !USER && ($pref['user_reg_veri'] == 1))
{
e107_include_once(e_LANGUAGEDIR.e_LANGUAGE."/lan_".e_PAGE);
e107_include_once(e_LANGUAGEDIR."English/lan_".e_PAGE);
require_once(HEADERF);
if(!$clean_email = check_email($tp -> toDB($_POST['resend_email'])))
{
$clean_email = "xxx";
}
if(!$new_email = check_email($tp -> toDB($_POST['resend_newemail'])))
{
$new_email = FALSE;
}
if($_POST['submit_resend'])
{ // Action user's submitted information
// 'resend_email' - user name or email address actually used to sign up
// 'resend_newemail' - corrected email address
// 'resend_password' - password (required if changing email address)
if($_POST['resend_email'] && !$new_email && $sql->db_Select_gen("SELECT * FROM #user WHERE user_ban=0 AND user_sess='' AND (user_loginname= \"".$tp->toDB($_POST['resend_email'])."\" OR user_name = \"".$tp->toDB($_POST['resend_email'])."\" OR user_email = \"".$clean_email."\" ) "))
{ // Account already activated
$ns -> tablerender(LAN_SIGNUP_40,LAN_SIGNUP_41." ");
require_once(FOOTERF);
exit;
}
// Start by looking up the user
if(!$sql->db_Select("user", "*", "(user_loginname = \"".$tp->toDB($_POST['resend_email'])."\" OR user_name = \"".$tp->toDB($_POST['resend_email'])."\" OR user_email = \"".$clean_email."\" ) AND user_ban=".USER_REGISTERED_NOT_VALIDATED." AND user_sess !='' LIMIT 1"))
{
require_once(e_HANDLER."message_handler.php");
message_handler("ALERT",LAN_SIGNUP_64); // email (or other info) not valid.
exit;
}
$row = $sql -> db_Fetch();
// We should have a user record here
if(trim($_POST['resend_password']) !="" && $new_email)
{ // Need to change the email address - check password to make sure
if ($user_info->CheckPassword($_POST['resend_password'], $row['user_loginname'], $row['user_password']) === TRUE)
{
if($sql->db_Update("user", "user_email='".$new_email."' WHERE user_id = '".$row['user_id']."' LIMIT 1 "))
{
$row['user_email'] = $new_email;
}
}
else
{
require_once(e_HANDLER."message_handler.php");
message_handler("ALERT",LAN_SIGNUP_52); // Incorrect Password.
exit;
}
}
// Now send the email - got some valid info
$_POST['password1'] = "xxxxxxxxx";
$_POST['loginname'] = $row['user_loginname'];
$_POST['name'] = $row['user_name'];
$nid = $row['user_id'];
$u_key = $row['user_sess'];
$eml = render_email();
$mailheader_e107id = $nid;
require_once(e_HANDLER."mail.php");
$do_log['signup_action'] = LAN_SIGNUP_63;
if(!sendemail($row['user_email'], $eml['subject'], $eml['message'], $row['user_name'], "", "", $eml['attachments'], $eml['cc'], $eml['bcc'], $returnpath, $returnreceipt,$eml['inline-images']))
{
$ns -> tablerender(LAN_ERROR,LAN_SIGNUP_42);
$do_log['signup_result'] = LAN_SIGNUP_62;
}
else
{
$ns -> tablerender(LAN_SIGNUP_43,LAN_SIGNUP_44." ".$row['user_email']." - ".LAN_SIGNUP_45."
");
$do_log['signup_result'] = LAN_SIGNUP_61;
}
// Now log this (log will ignore if its disabled)
$admin_log->user_audit(USER_AUDIT_PW_RES,$do_log,$row['user_id'],$row['user_name']);
require_once(FOOTERF);
exit;
}
elseif(!$_POST['submit_resend'])
{ // Display form to get info from user
$text .= "
";
}
if($signup_imagecode)
{
require_once(e_HANDLER."secure_img_handler.php");
$sec_img = new secure_image;
}
if($pref['user_reg'] == 0)
{
header("location: ".e_HTTP."index.php");
exit;
}
if(USER)
{
header("location: ".e_HTTP."index.php");
exit;
}
//----------------------------------------
// After clicking the activation link
//----------------------------------------
if (e_QUERY)
{
$qs = explode(".", e_QUERY);
if ($qs[0] == "activate" && (count($qs) == 3 || count($qs) == 4) && $qs[2])
{
// return the message in the correct language.
if(isset($qs[3]) && strlen($qs[3]) == 2 )
{
require_once(e_HANDLER."language_class.php");
$lng = new language;
$the_language = $lng->convert($qs[3]);
if(is_readable(e_LANGUAGEDIR.$the_language."/lan_signup.php"))
{
include(e_LANGUAGEDIR.$the_language."/lan_signup.php");
}
else
{
require_once(e_LANGUAGEDIR.e_LANGUAGE."/lan_signup.php");
}
}
else
{
include_lan(e_LANGUAGEDIR.e_LANGUAGE."/lan_signup.php");
}
$e107cache->clear("online_menu_totals");
if ($sql->db_Select("user", "*", "user_sess='".$tp -> toDB($qs[2], true)."' "))
{
if ($row = $sql->db_Fetch())
{
// Set initial classes, and any which the user can opt to join
$init_classes = '';
if ($pref['init_class_stage'] == '2')
{
$init_classes = explode(',',varset($pref['initial_user_classes'],''));
if ($init_classes)
{ // Update the user classes
$row['user_class'] = $tp->toDB(implode(',',array_unique(array_merge($init_classes, explode(',',$row['user_class'])))));
$init_classes = ", user_class='".$row['user_class']."' ";
}
}
$sql->db_Update("user", "user_ban='0', user_sess=''{$init_classes} WHERE user_sess='".$tp -> toDB($qs[2], true)."' ");
// Log to user audit log if enabled
$admin_log->user_audit(USER_AUDIT_EMAILACK,$row);
$e_event->trigger("userveri", $row);
require_once(HEADERF);
$text = LAN_401." ".LAN_SIGNUP_22." ".LAN_SIGNUP_23." ".LAN_SIGNUP_24." ".SITENAME;
$ns->tablerender(LAN_402, $text);
require_once(FOOTERF);
exit;
}
}
else
{ // Invalid activation code
header("location: ".e_BASE."index.php");
exit;
}
}
}
//----------------------------------------
// Initial signup (registration)
//----------------------------------------
if (isset($_POST['register']))
{
$_POST['xupexist'] = trim(varset($_POST['xupexist'],''));
$e107cache->clear("online_menu_totals");
$error_message = "";
require_once(e_HANDLER."message_handler.php");
if (isset($_POST['rand_num']) && $signup_imagecode && !$_POST['xupexist'] )
{
if (!$sec_img->verify_code($_POST['rand_num'], $_POST['code_verify']))
{
$error_message .= LAN_SIGNUP_3."\\n";
$error = TRUE;
}
}
if($invalid = $e_event->trigger("usersup_veri", $_POST))
{
$error_message .= $invalid."\\n";
$error = TRUE;
}
if($_POST['xupexist'])
{
require_once(e_HANDLER."xml_class.php");
$xml = new parseXml;
if(!$rawData = $xml -> getRemoteXmlFile($_POST['xupexist']))
{
echo "Error: Unable to open remote XUP file";
}
preg_match_all("#\#si", $rawData, $match);
$count = 0;
foreach($match[1] as $value)
{
$xup[$value] = $match[2][$count];
$count++;
}
$_POST['name'] = $xup['NICKNAME'];
$_POST['email'] = $xup['EMAIL'];
$_POST['signature'] = $xup['SIG'];
$_POST['hideemail'] = $xup['EMAILHIDE'];
$_POST['realname'] = $xup['FN'];
$_POST['image'] = $xup['AV'];
$_POST['ue']['user_timezone'] = $xup['TZ'];
$_POST['ue']['user_homepage'] = $xup['URL'];
$_POST['ue']['user_icq'] = $xup['ICQ'];
$_POST['ue']['user_aim'] = $xup['AIM'];
$_POST['ue']['user_msn'] = $xup['MSN'];
$_POST['ue']['user_yahoo'] = $xup['YAHOO'];
$_POST['ue']['user_location'] = $xup['GEO'];
$_POST['ue']['user_birthday'] = $xup['BDAY'];
unset($xup);
}
if($_POST['loginnamexup']) $_POST['loginname'] = $_POST['loginnamexup'];
if($_POST['password1xup']) $_POST['password1'] = $_POST['password1xup'];
if($_POST['password2xup']) $_POST['password2'] = $_POST['password2xup'];
if (varsettrue($pref['predefinedLoginName']))
{
$_POST['loginname'] = $user_info->generateUserLogin($pref['predefinedLoginName']);
// if (empty($username)) $username = $loginname;
}
// Strip most invalid characters now
$temp_name = trim(preg_replace('/ |\#|\=|\$/', "", strip_tags($_POST['loginname'])));
if ($temp_name != $_POST['loginname'])
{
$error_message .= LAN_409."\\n";
$error = TRUE;
}
if (strcasecmp($_POST['loginname'],"Anonymous") == 0)
{
$error_message .= LAN_103."\\n";
$error = TRUE;
}
// Use LoginName for DisplayName if restricted
if (!check_class($pref['displayname_class'],e_UC_PUBLIC.','.e_UC_MEMBER))
{
$_POST['name'] = $_POST['loginname'];
}
// Impose a minimum length on display name
$_POST['name'] = trim($_POST['name']);
if (strlen($_POST['name']) < 2)
{
$error_message .= LAN_SIGNUP_56."\\n";
$error = TRUE;
}
global $db_debug;
// Check for disallowed names.
if(varsettrue($pref['signup_disallow_text']))
{
$tmp = explode(",", $pref['signup_disallow_text']);
if (E107_DEBUG_LEVEL) $db_debug->log('disallowed ('.count($tmp).'), like "'.$tmp[0].'"');
foreach($tmp as $disallow)
{
if( strstr($_POST['name'], $disallow) || strstr($_POST['loginname'], $disallow) ){
$error_message .= LAN_103."\\n";
$error = TRUE;
}
}
}
// Check if form maxlength has been bypassed
if ( strlen($_POST['name']) > 30 || strlen($_POST['loginname']) > 100)
{
exit;
}
// Check if display name exceeds maximum allowed length
if (strlen($_POST['name']) > varset($pref['displayname_maxlength'],15))
{
$error_message .= LAN_SIGNUP_55."\\n";
$error = TRUE;
}
// Check if login name exceeds maximum allowed length
if (strlen($_POST['loginname']) > varset($pref['loginname_maxlength'],30))
{
$error_message .= LAN_SIGNUP_57."\\n";
$error = TRUE;
}
// Display Name exists.
if ($sql->db_Select("user", "*", "user_name='".$tp -> toDB($_POST['name'])."'"))
{
$error_message .= LAN_411.": ".$tp -> toDB($_POST['name'])."\\n";
$error = TRUE;
}
// Login Name exists
if ($sql->db_Select("user", "*", "user_loginname='".$tp -> toDB($_POST['loginname'])."' "))
{
$error_message .= LAN_104.": ".$tp -> toDB($_POST['loginname'])."\\n";
$error = TRUE;
}
// check for multiple signups from the same IP address.
if($ipcount = $sql->db_Select("user", "*", "user_ip='".$e107->getip()."' and user_ban !='2' "))
{
if($ipcount >= $pref['signup_maxip'] && trim($pref['signup_maxip']) != "")
{
$error_message .= LAN_202."\\n";
$error = TRUE;
}
}
// Check password fields are matching.
if ($_POST['password1'] != $_POST['password2'])
{
$error_message .= LAN_105."\\n";
$error = TRUE;
$password1 = "";
$password2 = "";
}
// Email address confirmation.
$email_address_OK = TRUE;
if ($_POST['email'] != $_POST['email_confirm'])
{
$error_message .= LAN_SIGNUP_38."\\n";
$error = TRUE;
$email = "";
$email_confirm = "";
$email_address_OK = FALSE;
}
// Always validate an email address if entered. If its blank, that's OK if checking disabled
$_POST['email'] = $tp->toDB(trim(varset($_POST['email'],'')));
$do_email_validate = !varset($pref['disable_emailcheck'],FALSE) || ($_POST['email'] !='');
// Password length check.
if (strlen(trim($_POST['password1'])) < $pref['signup_pass_len'])
{
$error_message .= LAN_SIGNUP_4.$pref['signup_pass_len'].LAN_SIGNUP_5."\\n";
$error = TRUE;
$password1 = "";
$password2 = "";
}
// Check for emtpy fields
if (trim($_POST['name']) == "" || trim($_POST['loginname']) == "" || trim($_POST['password1']) == "" || trim($_POST['password2']) == "")
{
$error_message .= LAN_185."\\n";
$error = TRUE;
}
// ========== Verify Custom Signup options if selected ========================
$signup_option_title = array(LAN_308, LAN_120, LAN_121, LAN_SIGNUP_28);
$signup_option_names = array("realname", "signature", "image", "class");
foreach($signup_option_names as $key => $value)
{
if ($pref['signup_option_'.$value] == 2 && !$_POST[$value])
{
$error_message .= LAN_SIGNUP_6.$signup_option_title[$key].LAN_SIGNUP_7."\\n";
$error = TRUE;
}
}
//--------------------------------------
// Email address checks
//--------------------------------------
// Email syntax validation.
if ($do_email_validate && (!$_POST['email'] || !check_email($_POST['email'])))
{
$error_message .= LAN_106."\\n";
$error = TRUE;
$email_address_OK = FALSE;
}
else
{
// Check Email against banlist.
$wc = $tp -> toDB("*".trim(substr($_POST['email'], strpos($_POST['email'], "@"))));
// if ($do_email_validate && $sql->db_Select("banlist", "*", "banlist_ip='".$_POST['email']."' OR banlist_ip='{$wc}'"))
if ($do_email_validate && !$e107->check_ban("banlist_ip='".$_POST['email']."' OR banlist_ip='{$wc}'",FALSE,TRUE))
{
$email_address_OK = FALSE;
$brow = $sql -> db_Fetch();
$error = TRUE;
$error_message = varsettrue($pref['ban_messages'][$row['banlist_bantype']]);
if (!$error_message) exit;
/* if($brow['banlist_reason'])
{
$repl = array("\n","\r"," ");
$error_message = str_replace($repl,"\\n",$tp->toHTML($brow['banlist_reason'],"","nobreak, defs"))."\\n";
$email = "";
}
else
{
exit;
}
*/ }
}
// Check email address on remote server (if enabled) - but only if previous checks passed.
if ($do_email_validate && $email_address_OK && varsettrue($pref['signup_remote_emailcheck']) && $error != TRUE)
{
require_once(e_HANDLER."mail_validation_class.php");
list($adminuser,$adminhost) = split ("@", SITEADMINEMAIL);
$validator = new email_validation_class;
$validator->localuser= $adminuser;
$validator->localhost= $adminhost;
$validator->timeout=3;
// $validator->debug=1;
// $validator->html_debug=1;
if($validator->ValidateEmailBox(trim($_POST['email'])) != 1)
{
$email_address_OK = FALSE;
$error_message .= LAN_106."\\n";
$error = TRUE;
$email = "";
$email_confirm = "";
}
}
// Check for Duplicate Email address - but only if previous checks passed.
if ($do_email_validate && $email_address_OK && $sql->db_Select("user", "user_email, user_ban, user_sess", "user_email='".$_POST['email']."' "))
{
$chk = $sql -> db_Fetch();
if($chk['user_ban']== 2 && $chk['user_sess'])
{ // duplicate because unactivated
$error = TRUE;
header("Location: ".e_BASE."signup.php?resend");
exit;
}
else
{
$email_address_OK = FALSE;
$error_message .= LAN_408."\\n";
$error = TRUE;
}
}
// Extended Field validation
$extList = $usere->user_extended_get_fieldList();
foreach($extList as $ext)
{
if(isset($_POST['ue']['user_'.$ext['user_extended_struct_name']]))
{
$newval = trim($_POST['ue']['user_'.$ext['user_extended_struct_name']]);
if($ext['user_extended_struct_required'] == 1 && (($newval == "") || (($ext['user_extended_struct_type'] == 7) && ($newval == '0000-00-00')) ))
{
$_ftext = (defined($ext['user_extended_struct_text']) ? constant($ext['user_extended_struct_text']) : $ext['user_extended_struct_text']);
$error_message .= LAN_SIGNUP_6.$_ftext.LAN_SIGNUP_7."\\n";
$error = TRUE;
}
$parms = explode("^,^", $ext['user_extended_struct_parms']);
$regex = (isset($parms[1]) ? $tp->toText($parms[1]) : "");
$regexfail = (isset($parms[2]) ? trim($tp->toText($parms[2])) : "");
if($regexfail == "")
{
$regexfail = $ext['user_extended_struct_name']." ".LAN_SIGNUP_53;
}
if(defined($regexfail)) {$regexfail = constant($regexfail);}
if($regex != "" && $newval != "")
{
if(!preg_match($regex, $newval))
{
$error_message .= $regexfail."\\n";
$error = TRUE;
}
}
}
}
if($error_message)
{
message_handler("P_ALERT", $error_message);
$error_message = '';
}
// ========== End of verification.. ==============
// If no errors, we can enter the new member in the DB
if (!$error)
{
$fp = new floodprotect;
if ($fp->flood("user", "user_join") == FALSE)
{
header("location:".e_BASE."index.php");
exit;
}
if ($_POST['email'] && $sql->db_Select("user", "*", "user_email='".$_POST['email']."' AND user_ban='".USER_BANNED."'"))
{
exit;
}
$username = $tp -> toDB(strip_tags($_POST['name']));
$loginname = $tp -> toDB(strip_tags($_POST['loginname']));
$time = time();
$ip = $e107->getip();
$ue_fields = "";
foreach($_POST['ue'] as $key => $val)
{
$key = $tp->toDB($key);
$val = $tp->toDB($val);
$ue_fields .= ($ue_fields) ? ", " : "";
$ue_fields .= $key."='".$val."'";
}
$u_key = md5(uniqid(rand(), 1)); // Key for signup completion
// ************* Possible class insert
// Following array will be logged to both admin log and user's entry
$signup_data = array(
'user_name' => $username,
'user_loginname' => $loginname,
'user_email' => $tp -> toDB($_POST['email']),
'user_ip' => $ip);
// Following array is logged to user's entry only
$new_data = array(
'user_password' => $sql->escape($user_info->HashPassword($_POST['password1'], $loginname), FALSE),
'user_sess' => $u_key,
'user_signature' => $tp -> toDB($_POST['signature']),
'user_image' => $tp -> toDB($_POST['image']),
'user_hideemail' => $tp -> toDB($_POST['hideemail']),
'user_join' => time(),
'user_currentvisit' => time(),
'user_ban' => USER_REGISTERED_NOT_VALIDATED,
'user_login' => $tp -> toDB($_POST['realname']),
'user_xup' => $tp -> toDB($_POST['xupexist'])
);
if (varsettrue($pref['allowEmailLogin']))
{ // Need to create separate password for email login
$new_data['user_prefs'] = serialize(array('email_password' => $user_info->HashPassword($_POST['password1'], $new_data['user_email'])));
}
$nid = $sql->db_Insert("user", array_merge($signup_data,$new_data));
// Log to user audit log if enabled
$signup_data['user_id'] = $nid;
$signup_data['signup_key'] = $u_key;
$signup_data['user_realname'] = $tp -> toDB($_POST['realname']);
$admin_log->user_audit(USER_AUDIT_SIGNUP,$signup_data);
if(!$nid)
{
require_once(HEADERF);
$ns->tablerender("", LAN_SIGNUP_36);
require_once(FOOTERF);
}
$adviseLoginName = '';
if (varsettrue($pref['predefinedLoginName']))
{
$adviseLoginName = LAN_SIGNUP_65.': '.$loginname.' '.LAN_SIGNUP_66.' ';
}
if ($pref['user_reg_veri'])
{ // Verification required (may be by email or by admin)
// Set initial classes, and any which the user can opt to join
$init_classes = array();
if ($pref['init_class_stage'] == '1') $init_classes = explode(',',varset($pref['initial_user_classes'],''));
if (isset($_POST['class'])) $init_classes = array_unique(array_merge($init_classes, $_POST['class']));
if (count($init_classes))
{
$sql->db_Update("user", "user_class='".$tp -> toDB(implode(',',$init_classes))."' WHERE user_id='".$nid."' ");
}
// ========= save extended fields into db table. =====
if($ue_fields)
{
$sql->db_Select_gen("INSERT INTO #user_extended (user_extended_id) values ('{$nid}')");
$sql->db_Update("user_extended", $ue_fields." WHERE user_extended_id = '{$nid}'");
}
// ========== Send Email =========>
if (($pref['user_reg_veri'] != 2) && $_POST['email']) // Don't send if email address blank - means that its not compulsory
{
$eml = render_email();
$mailheader_e107id = $eml['userid'];
require_once(e_HANDLER."mail.php");
if(!sendemail($_POST['email'], $eml['subject'], $eml['message'], "", "", "", $eml['attachments'], $eml['cc'], $eml['bcc'], "", "", $eml['inline-images']))
{
$error_message = LAN_SIGNUP_42; // There was a problem, the registration mail was not sent, please contact the website administrator.
}
}
$_POST['ip'] = $ip;
$_POST['user_id'] = $nid;
$e_event->trigger("usersup", $_POST); // send everything in the template, including extended fields.
require_once(HEADERF);
if (isset($pref['signup_text_after']) && (strlen($pref['signup_text_after']) > 2))
{
$text = $tp->toHTML(str_replace('{NEWLOGINNAME}', $loginname, $pref['signup_text_after']), TRUE, 'parse_sc,defs')." ";
}
else
{
if ($pref['user_reg_veri'] == 2)
{
$text = LAN_SIGNUP_37.'
'.$adviseLoginName;
}
else
{
$text = LAN_405.'
'.$adviseLoginName;
}
}
if ($error_message)
{
$text = " ".$error_message." "; // Just display error message
}
$ns->tablerender(LAN_406, $text);
require_once(FOOTERF);
exit;
}
else
{ // User can be signed up immediately
require_once(HEADERF);
if(!$sql -> db_Select("user", "user_id", "user_name='{$username}' AND user_password='".$new_data['user_password']."'"))
{ // Error looking up newly created user
$ns->tablerender("", LAN_SIGNUP_36);
require_once(FOOTERF);
exit;
}
// Set initial classes, and any which the user can opt to join
$init_classes = explode(',',varset($pref['initial_user_classes'],''));
if (isset($_POST['class'])) $init_classes = array_unique(array_merge($init_classes, $_POST['class']));
// Set member as registered, update classes
$sql->db_Update("user", "user_ban = '".USER_VALIDATED."', user_class='".$tp -> toDB(implode(',',$init_classes))."' WHERE user_id = '{$nid}'");
// ======== save extended fields to DB table.
if($ue_fields)
{
$sql->db_Select_gen("INSERT INTO #user_extended (user_extended_id) values ('{$nid}')");
$sql->db_Update("user_extended", $ue_fields." WHERE user_extended_id = '{$nid}'");
}
$_POST['ip'] = $ip;
$_POST['user_id'] = $nid; // ID for the user
$e_event->trigger("usersup", $_POST); // send everything in the template, including extended fields.
if (isset($pref['signup_text_after']) && (strlen($pref['signup_text_after']) > 2))
{
$text = $tp->toHTML(str_replace('{NEWLOGINNAME}', $loginname, $pref['signup_text_after']), TRUE, 'parse_sc,defs')." ";
}
else
{
$text = LAN_107." ".SITENAME.", ".LAN_SIGNUP_12."
![](".THEME."images/login_logo.png){kind=logo}
\n";
}
else
{
$HEADER .= "![](".e_IMAGE."logo.png)
\n";
}
$HEADER .= "