stdfoot();
exit;
}
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if ($iv == "yes") {
check_code($_POST['imagehash'], $_POST['imagestring'], "cardrecover.php", true);
}
$stuid = unesc(htmlspecialchars(trim($_POST["stuid"])));
$cardpass = unesc(htmlspecialchars(trim($_POST["password"])));
if (!$stuid) {
failedlogins($lang_recover['std_missing_stuid'], true);
}
if (!$cardpass) {
failedlogins($lang_recover['std_missing_password'], true);
}
if (!getOneCard($stuid, $cardpass)) {
failedlogins($lang_recover['std_stuid_failed'], true);
}
$res = sql_query("SELECT * FROM users WHERE cardnum=" . sqlesc($stuid) . " LIMIT 1") or sqlerr(__FILE__, __LINE__);
$arr = mysql_fetch_assoc($res);
if (!$arr) {
failedlogins($lang_recover['std_stuid_not_in_database'], true);
}
if ($arr['status'] == "pending") {
failedlogins($lang_recover['std_user_account_unconfirmed'], true);
}
$recover_username = $arr['username'];
$email = $arr['email'];
$sec = mksecret();
sql_query("UPDATE users SET editsecret=" . sqlesc($sec) . " WHERE id=" . sqlesc($arr["id"])) or sqlerr(__FILE__, __LINE__);
if (!mysql_affected_rows()) {
if (strlen($wantpassword) > 40) {
bark($lang_takesignup['std_password_too_long']);
}
if ($wantpassword == $wantusername) {
bark($lang_takesignup['std_password_equals_username']);
}
if (!validemail($email)) {
bark($lang_takesignup['std_wrong_email_address_format']);
}
if (!validusername($wantusername)) {
bark($lang_takesignup['std_invalid_username']);
}
$stuid = mysql_real_escape_string($_POST['stuid']);
//在此加入一卡通验证代码
$cardpass = $_POST['cardpass'];
$cardinfo = getOneCard($stuid, $cardpass);
if (!$cardinfo) {
bark($lang_takesignup['std_invalid_onecard']);
} else {
$a = @mysql_fetch_row(@sql_query("select count(*) from users where cardnum='" . $stuid . "'")) or sqlerr(__FILE__, __LINE__);
if ($a[0] != 0) {
bark($stuid . $lang_takesignup['std_in_use']);
}
}
// make sure user agrees to everything...
if ($_POST["rulesverify"] != "yes" || $_POST["faqverify"] != "yes" || $_POST["ageverify"] != "yes") {
stderr($lang_takesignup['std_signup_failed'], $lang_takesignup['std_unqualified']);
}
// check if email addy is already in use
$a = @mysql_fetch_row(@sql_query("select count(*) from users where email='" . mysql_real_escape_string($email) . "'")) or sqlerr(__FILE__, __LINE__);
if ($a[0] != 0) {
