コード例 #1
0
ファイル: user.php プロジェクト: milk54/geeklog-japan
/**
* Saves user to the database
*
* @param    int     $uid            user id
* @param    string  $usernmae       (short) username
* @param    string  $fullname       user's full name
* @param    string  $email          user's email address
* @param    string  $regdate        date the user registered with the site
* @param    string  $homepage       user's homepage URL
* @param    array   $groups         groups the user belongs to
* @param    string  $delete_photo   delete user's photo if == 'on'
* @return   string                  HTML redirect or error message
*
*/
function saveusers($uid, $username, $fullname, $passwd, $passwd_conf, $email, $regdate, $homepage, $groups, $delete_photo = '', $userstatus = 3, $oldstatus = 3)
{
    global $_CONF, $_TABLES, $_USER, $LANG28, $_USER_VERBOSE;
    $retval = '';
    $userChanged = false;
    if ($_USER_VERBOSE) {
        COM_errorLog("**** entering saveusers****", 1);
        COM_errorLog("group size at beginning = " . count($groups), 1);
    }
    $service = DB_getItem($_TABLES['users'], 'remoteservice', "uid = {$uid}");
    // If remote service then assume blank password
    if (!empty($service)) {
        $passwd = '';
        $passwd_conf = '';
    }
    $passwd_changed = true;
    if (empty($service) && SEC_encryptUserPassword($passwd, $uid) === 0 && $passwd_conf === '') {
        $passwd_changed = false;
    }
    if ($passwd_changed && $passwd != $passwd_conf) {
        // passwords don't match
        return edituser($uid, 67);
    }
    $nameAndEmailOkay = true;
    if (empty($username)) {
        $nameAndEmailOkay = false;
    } elseif (empty($email)) {
        if (empty($uid)) {
            $nameAndEmailOkay = false;
            // new users need an email address
        } else {
            if (empty($service)) {
                $nameAndEmailOkay = false;
                // not a remote user - needs email
            }
        }
    }
    if ($nameAndEmailOkay) {
        if (!empty($email) && !COM_isEmail($email)) {
            return edituser($uid, 52);
        }
        $uname = DB_escapeString($username);
        if (empty($uid)) {
            $ucount = DB_getItem($_TABLES['users'], 'COUNT(*)', "username = '******'");
        } else {
            if (!empty($service)) {
                $uservice = DB_escapeString($service);
                $ucount = DB_getItem($_TABLES['users'], 'COUNT(*)', "username = '******' AND uid <> {$uid} AND remoteservice = '{$uservice}'");
            } else {
                $ucount = DB_getItem($_TABLES['users'], 'COUNT(*)', "username = '******' AND uid <> {$uid} AND (remoteservice = '' OR remoteservice IS NULL)");
            }
        }
        if ($ucount > 0) {
            // Admin just changed a user's username to one that already exists
            return edituser($uid, 51);
        }
        $emailaddr = DB_escapeString($email);
        $exclude_remote = " AND (remoteservice IS NULL OR remoteservice = '')";
        if (empty($uid)) {
            $ucount = DB_getItem($_TABLES['users'], 'COUNT(*)', "email = '{$emailaddr}'" . $exclude_remote);
        } else {
            $old_email = DB_getItem($_TABLES['users'], 'email', "uid = '{$uid}'");
            if ($old_email == $email) {
                // email address didn't change so don't care
                $ucount = 0;
            } else {
                $ucount = DB_getItem($_TABLES['users'], 'COUNT(*)', "email = '{$emailaddr}' AND uid <> {$uid}" . $exclude_remote);
            }
        }
        if ($ucount > 0) {
            // Admin just changed a user's email to one that already exists
            return edituser($uid, 56);
        }
        if ($_CONF['custom_registration'] && function_exists('CUSTOM_userCheck')) {
            $ret = CUSTOM_userCheck($username, $email);
            if (!empty($ret)) {
                // need a numeric return value - otherwise use default message
                if (!is_numeric($ret['number'])) {
                    $ret['number'] = 400;
                }
                return edituser($uid, $ret['number']);
            }
        }
        if (empty($uid)) {
            if (empty($passwd)) {
                // no password? create one ...
                $passwd = SEC_generateRandomPassword();
            }
            $uid = USER_createAccount($username, $email, $passwd, $fullname, $homepage);
            if ($uid > 1) {
                DB_query("UPDATE {$_TABLES['users']} SET status = {$userstatus} WHERE uid = {$uid}");
            }
        } else {
            $fullname = DB_escapeString($fullname);
            $homepage = DB_escapeString($homepage);
            $curphoto = DB_getItem($_TABLES['users'], 'photo', "uid = {$uid}");
            if (!empty($curphoto) && $delete_photo == 'on') {
                USER_deletePhoto($curphoto);
                $curphoto = '';
            }
            if ($_CONF['allow_user_photo'] == 1 && !empty($curphoto)) {
                $curusername = DB_getItem($_TABLES['users'], 'username', "uid = {$uid}");
                if ($curusername != $username) {
                    // user has been renamed - rename the photo, too
                    $newphoto = preg_replace('/' . $curusername . '/', $username, $curphoto, 1);
                    $imgpath = $_CONF['path_images'] . 'userphotos/';
                    if (@rename($imgpath . $curphoto, $imgpath . $newphoto) === false) {
                        $retval .= COM_errorLog('Could not rename userphoto "' . $curphoto . '" to "' . $newphoto . '".');
                        return $retval;
                    }
                    $curphoto = $newphoto;
                }
            }
            $curphoto = DB_escapeString($curphoto);
            DB_query("UPDATE {$_TABLES['users']} SET username = '******', fullname = '{$fullname}', email = '{$email}', homepage = '{$homepage}', photo = '{$curphoto}', status='{$userstatus}' WHERE uid = {$uid}");
            if ($passwd_changed && !empty($passwd)) {
                SEC_updateUserPassword($passwd, $uid);
            }
            if ($_CONF['custom_registration'] and function_exists('CUSTOM_userSave')) {
                CUSTOM_userSave($uid);
            }
            if ($_CONF['usersubmission'] == 1 && $oldstatus == USER_ACCOUNT_AWAITING_APPROVAL && $userstatus == USER_ACCOUNT_ACTIVE) {
                USER_createAndSendPassword($username, $email, $uid);
            }
            if ($userstatus == USER_ACCOUNT_DISABLED) {
                SESS_endUserSession($uid);
            }
            $userChanged = true;
        }
        // check that the user is allowed to change group assignments
        if (is_array($groups) && SEC_hasRights('group.assign')) {
            if (!SEC_inGroup('Root')) {
                $rootgrp = DB_getItem($_TABLES['groups'], 'grp_id', "grp_name = 'Root'");
                if (in_array($rootgrp, $groups)) {
                    COM_accessLog("User {$_USER['username']} ({$_USER['uid']}) just tried to give Root permissions to user {$username}.");
                    echo COM_refresh($_CONF['site_admin_url'] . '/index.php');
                    exit;
                }
            }
            // make sure the Remote Users group is in $groups
            if (SEC_inGroup('Remote Users', $uid)) {
                $remUsers = DB_getItem($_TABLES['groups'], 'grp_id', "grp_name = 'Remote Users'");
                if (!in_array($remUsers, $groups)) {
                    $groups[] = $remUsers;
                }
            }
            if ($_USER_VERBOSE) {
                COM_errorLog("deleting all group_assignments for user {$uid}/{$username}", 1);
            }
            // remove user from all groups that the User Admin is a member of
            $UserAdminGroups = SEC_getUserGroups();
            $whereGroup = 'ug_main_grp_id IN (' . implode(',', $UserAdminGroups) . ')';
            DB_query("DELETE FROM {$_TABLES['group_assignments']} WHERE (ug_uid = {$uid}) AND " . $whereGroup);
            // make sure to add user to All Users and Logged-in Users groups
            $allUsers = DB_getItem($_TABLES['groups'], 'grp_id', "grp_name = 'All Users'");
            if (!in_array($allUsers, $groups)) {
                $groups[] = $allUsers;
            }
            $logUsers = DB_getItem($_TABLES['groups'], 'grp_id', "grp_name = 'Logged-in Users'");
            if (!in_array($logUsers, $groups)) {
                $groups[] = $logUsers;
            }
            foreach ($groups as $userGroup) {
                if (in_array($userGroup, $UserAdminGroups)) {
                    if ($_USER_VERBOSE) {
                        COM_errorLog("adding group_assignment " . $userGroup . " for {$username}", 1);
                    }
                    $sql = "INSERT INTO {$_TABLES['group_assignments']} (ug_main_grp_id, ug_uid) VALUES ({$userGroup}, {$uid})";
                    DB_query($sql);
                }
            }
        }
        if ($userChanged) {
            PLG_userInfoChanged($uid);
        }
        $errors = DB_error();
        if (empty($errors)) {
            echo PLG_afterSaveSwitch($_CONF['aftersave_user'], "{$_CONF['site_url']}/users.php?mode=profile&uid={$uid}", 'user', 21);
        } else {
            $retval .= COM_errorLog('Error in saveusers in ' . $_CONF['site_admin_url'] . '/user.php');
            $retval = COM_createHTMLDocument($retval, array('pagetitle' => $LANG28[22]));
            echo $retval;
            exit;
        }
    } else {
        $retval .= COM_showMessageText($LANG28[10]);
        if (!empty($uid) && $uid > 1 && DB_count($_TABLES['users'], 'uid', $uid) > 0) {
            $retval .= edituser($uid);
        } else {
            $retval .= edituser();
        }
        $retval = COM_createHTMLDocument($retval, array('pagetitle' => $LANG28[1]));
        COM_output($retval);
        exit;
    }
    if ($_USER_VERBOSE) {
        COM_errorLog("***************leaving saveusers*****************", 1);
    }
    return $retval;
}
コード例 #2
0
ファイル: user.php プロジェクト: spacequad/glfusion
/**
* Saves user to the database
*
* @param    int     $uid            user id
* @return   string                  HTML redirect or error message
*
*/
function USER_save($uid)
{
    global $_CONF, $_TABLES, $_USER, $LANG28, $_USER_VERBOSE;
    $retval = '';
    $userChanged = false;
    if ($_USER_VERBOSE) {
        COM_errorLog("**** entering USER_save()****", 1);
    }
    if ($_USER_VERBOSE) {
        COM_errorLog("group size at beginning = " . sizeof($groups), 1);
    }
    $uid = COM_applyFilter($_POST['uid'], true);
    if ($uid == 0) {
        $uid = '';
    }
    $regdate = COM_applyFilter($_POST['regdate'], true);
    $username = trim($_POST['new_username']);
    $fullname = COM_truncate(trim(USER_sanitizeName($_POST['fullname'])), 80);
    $userstatus = COM_applyFilter($_POST['userstatus'], true);
    $oldstatus = COM_applyFilter($_POST['oldstatus'], true);
    $passwd = isset($_POST['newp']) ? trim($_POST['newp']) : '';
    $passwd_conf = isset($_POST['newp_conf']) ? trim($_POST['newp_conf']) : '';
    $cooktime = COM_applyFilter($_POST['cooktime'], true);
    $email = trim($_POST['email']);
    $email_conf = trim($_POST['email_conf']);
    $groups = $_POST['groups'];
    $homepage = trim($_POST['homepage']);
    $location = strip_tags(trim($_POST['location']));
    $photo = isset($_POST['photo']) ? $_POST['photo'] : '';
    $delete_photo = isset($_POST['delete_photo']) && $_POST['delete_photo'] == 'on' ? 1 : 0;
    $sig = trim($_POST['sig']);
    $about = trim($_POST['about']);
    $pgpkey = trim($_POST['pgpkey']);
    $language = isset($_POST['language']) ? trim(COM_applyFilter($_POST['language'])) : '';
    $theme = isset($_POST['theme']) ? trim(COM_applyFilter($_POST['theme'])) : '';
    $maxstories = COM_applyFilter($_POST['maxstories'], true);
    $tzid = COM_applyFilter($_POST['tzid']);
    $dfid = COM_applyFilter($_POST['dfid'], true);
    $search_fmt = COM_applyFilter($_POST['search_result_format']);
    $commentmode = COM_applyFilter($_POST['commentmode']);
    $commentorder = isset($_POST['commentorder']) && $_POST['commentorder'] == 'DESC' ? 'DESC' : 'ASC';
    $commentlimit = COM_applyFilter($_POST['commentlimit'], true);
    $emailfromuser = isset($_POST['emailfromuser']) && $_POST['emailfromuser'] == 'on' ? 1 : 0;
    $emailfromadmin = isset($_POST['emailfromadmin']) && $_POST['emailfromadmin'] == 'on' ? 1 : 0;
    $noicons = isset($_POST['noicons']) && $_POST['noicons'] == 'on' ? 1 : 0;
    $noboxes = isset($_POST['noboxes']) && $_POST['noboxes'] == 'on' ? 1 : 0;
    $showonline = isset($_POST['showonline']) && $_POST['showonline'] == 'on' ? 1 : 0;
    $topic_order = isset($_POST['topic_order']) && $_POST['topic_order'] == 'ASC' ? 'ASC' : 'DESC';
    $maxstories = COM_applyFilter($_POST['maxstories'], true);
    $newuser = COM_applyFilter($_POST['newuser'], true);
    $remoteuser = isset($_POST['remoteuser']) && $_POST['remoteuser'] == 'on' ? 1 : 0;
    $remoteusername = isset($_POST['remoteusername']) ? strip_tags(trim($_POST['remoteusername'])) : '';
    $remoteservice = isset($_POST['remoteservice']) ? COM_applyFilter($_POST['remoteservice']) : '';
    $social_services = SOC_followMeProfile($uid);
    foreach ($social_services as $service) {
        $service_input = $service['service'] . '_username';
        $_POST[$service_input] = strip_tags($_POST[$service_input]);
    }
    if ($uid == 1) {
        return USER_list();
    }
    if ($uid == '' || $uid < 2 || $newuser == 1) {
        if (empty($passwd) && $remoteuser == 0) {
            return USER_edit($uid, 504);
        }
        if (empty($email)) {
            return USER_edit($uid, 505);
        }
    }
    if ($username == '') {
        return USER_edit($uid, 506);
    }
    if (!USER_validateUsername($username)) {
        return USER_edit($uid, 512);
    }
    if ($email == '') {
        return USER_edit($uid, 507);
    }
    if ($passwd != $passwd_conf && $remoteuser == 0) {
        // passwords don't match
        return USER_edit($uid, 67);
    }
    if ($email != $email_conf) {
        return USER_edit($uid, 508);
    }
    // remote user checks
    if ($remoteuser == 1) {
        if ($remoteusername == '') {
            return USER_edit($uid, 513);
        }
        if ($remoteservice == '') {
            return USER_edit($uid, 514);
        }
    }
    $validEmail = true;
    if (empty($username)) {
        $validEmail = false;
    } elseif (empty($email)) {
        if (empty($uid)) {
            $validEmail = false;
        } else {
            $ws_user = DB_getItem($_TABLES['users'], 'remoteservice', "uid = " . intval($uid));
            if (empty($ws_user)) {
                $validEmail = false;
            }
        }
    }
    if ($validEmail) {
        if (!empty($email) && !COM_isEmail($email)) {
            return USER_edit($uid, 52);
        }
        $uname = DB_escapeString($username);
        if (empty($uid)) {
            $ucount = DB_getItem($_TABLES['users'], 'COUNT(*)', "username = '******'");
        } else {
            $uservice = DB_getItem($_TABLES['users'], 'remoteservice', "uid = {$uid}");
            if ($uservice != '') {
                $uservice = DB_escapeString($uservice);
                $ucount = DB_getItem($_TABLES['users'], 'COUNT(*)', "username = '******' AND uid <> {$uid} AND remoteservice = '{$uservice}'");
            } else {
                $ucount = DB_getItem($_TABLES['users'], 'COUNT(*)', "username = '******' AND uid <> {$uid} AND (remoteservice = '' OR remoteservice IS NULL)");
            }
        }
        if ($ucount > 0) {
            // Admin just changed a user's username to one that already exists
            return USER_edit($uid, 51);
        }
        $emailaddr = DB_escapeString($email);
        $exclude_remote = " AND (remoteservice IS NULL OR remoteservice = '')";
        if (empty($uid)) {
            $ucount = DB_getItem($_TABLES['users'], 'COUNT(*)', "email = '{$emailaddr}'" . $exclude_remote);
        } else {
            $old_email = DB_getItem($_TABLES['users'], 'email', "uid = {$uid}");
            if ($old_email == $email) {
                // email address didn't change so don't care
                $ucount = 0;
            } else {
                $ucount = DB_getItem($_TABLES['users'], 'COUNT(*)', "email = '{$emailaddr}' AND uid <> {$uid}" . $exclude_remote);
            }
        }
        if ($ucount > 0) {
            // Admin just changed a user's email to one that already exists
            return USER_edit($uid, 56);
        }
        if ($_CONF['custom_registration'] && function_exists('CUSTOM_userCheck')) {
            $ret = CUSTOM_userCheck($username, $email);
            if (!empty($ret)) {
                // need a numeric return value - otherwise use default message
                if (!is_numeric($ret['number'])) {
                    $ret['number'] = 97;
                }
                return USER_edit($uid, $ret['number']);
            }
        }
        // Let plugins have a chance to decide what to do before saving the user, return errors.
        $msg = PLG_itemPreSave('useredit', $username);
        if (!empty($msg)) {
            // need a numeric return value - otherwise use default message
            if (!is_numeric($msg)) {
                $msg = 97;
            }
            return USER_edit($uid, $msg);
        }
        if (empty($uid) || !empty($passwd)) {
            $passwd2 = SEC_encryptPassword($passwd);
        } else {
            $passwd2 = DB_getItem($_TABLES['users'], 'passwd', "uid = {$uid}");
        }
        // do we need to create the user?
        if (empty($uid)) {
            if (empty($passwd)) {
                // no password? create one ...
                $passwd = USER_createPassword(8);
                $passwd2 = SEC_encryptPassword($passwd);
            }
            if ($remoteuser == 1) {
                $uid = USER_createAccount($username, $email, '', $fullname, '', $remoteusername, $remoteservice, 1);
            } else {
                $uid = USER_createAccount($username, $email, $passwd2, $fullname, $homepage, '', '', 1);
            }
            if ($uid > 1) {
                DB_query("UPDATE {$_TABLES['users']} SET status = {$userstatus} WHERE uid = {$uid}");
            }
            if (isset($_POST['emailuser'])) {
                USER_createAndSendPassword($username, $email, $uid, $passwd);
            }
            if ($uid < 2) {
                return USER_edit('', 509);
            }
            $newuser = 1;
        }
        // at this point, we have a valid user...
        // Filter some of the text entry fields to ensure they don't cause problems...
        $fullname = strip_tags($fullname);
        $about = strip_tags($about);
        $pgpkey = strip_tags($pgpkey);
        $curphoto = USER_handlePhotoUpload($uid, $delete_photo);
        if ($_CONF['allow_user_photo'] == 1 && !empty($curphoto)) {
            $curusername = DB_getItem($_TABLES['users'], 'username', "uid = {$uid}");
            if ($curusername != $username) {
                // user has been renamed - rename the photo, too
                $newphoto = preg_replace('/' . $curusername . '/', $username, $curphoto, 1);
                $imgpath = $_CONF['path_images'] . 'userphotos/';
                if (rename($imgpath . $curphoto, $imgpath . $newphoto) === false) {
                    $display = COM_siteHeader('menu', $LANG28[22]);
                    $display .= COM_errorLog('Could not rename userphoto "' . $curphoto . '" to "' . $newphoto . '".');
                    $display .= COM_siteFooter();
                    return $display;
                }
                $curphoto = $newphoto;
            }
        }
        // update users table
        $sql = "UPDATE {$_TABLES['users']} SET " . "username = '******'," . "fullname = '" . DB_escapeString($fullname) . "'," . "passwd   = '" . DB_escapeString($passwd2) . "'," . "email    = '" . DB_escapeString($email) . "'," . "homepage = '" . DB_escapeString($homepage) . "'," . "sig      = '" . DB_escapeString($sig) . "'," . "photo    = '" . DB_escapeString($curphoto) . "'," . "cookietimeout = {$cooktime}," . "theme    = '" . DB_escapeString($theme) . "'," . "language = '" . DB_escapeString($language) . "'," . "status   = {$userstatus} WHERE uid = {$uid};";
        DB_query($sql);
        // update userprefs
        $sql = "UPDATE {$_TABLES['userprefs']} SET " . "noicons = {$noicons}," . "dfid    = {$dfid}," . "tzid    = '" . DB_escapeString($tzid) . "'," . "emailstories = 0," . "emailfromadmin = {$emailfromadmin}," . "emailfromuser  = {$emailfromuser}," . "showonline = {$showonline}," . "search_result_format = '" . DB_escapeString($search_fmt) . "' WHERE uid={$uid};";
        DB_query($sql);
        // userinfo table
        $sql = "UPDATE {$_TABLES['userinfo']} SET " . "about      = '" . DB_escapeString($about) . "'," . "location   = '" . DB_escapeString($location) . "'," . "pgpkey     = '" . DB_escapeString($pgpkey) . "' WHERE uid={$uid};";
        DB_query($sql);
        // userindex table
        $TIDS = @array_values($_POST['topics']);
        $AIDS = @array_values($_POST['selauthors']);
        $BOXES = @array_values($_POST['blocks']);
        $ETIDS = @array_values($_POST['dgtopics']);
        $allowed_etids = USER_buildTopicList();
        $AETIDS = explode(' ', $allowed_etids);
        $tids = '';
        if (sizeof($TIDS) > 0) {
            $tids = DB_escapeString(implode(' ', array_intersect($AETIDS, $TIDS)));
        }
        $aids = '';
        if (sizeof($AIDS) > 0) {
            foreach ($AIDS as $key => $val) {
                $AIDS[$key] = intval($val);
            }
            $aids = DB_escapeString(implode(' ', $AIDS));
        }
        $selectedblocks = '';
        $selectedBoxes = array();
        if (count($BOXES) > 0) {
            foreach ($BOXES as $key => $val) {
                $BOXES[$key] = intval($val);
            }
            $boxes = DB_escapeString(implode(',', $BOXES));
            $blockresult = DB_query("SELECT bid,name FROM {$_TABLES['blocks']} WHERE bid NOT IN ({$boxes})");
            $numRows = DB_numRows($blockresult);
            for ($x = 1; $x <= $numRows; $x++) {
                $row = DB_fetchArray($blockresult);
                if ($row['name'] != 'user_block' and $row['name'] != 'admin_block' and $row['name'] != 'section_block') {
                    $selectedblocks .= $row['bid'];
                    if ($x != $numRows) {
                        $selectedblocks .= ' ';
                    }
                }
            }
        }
        $etids = '-';
        if (sizeof($ETIDS) > 0) {
            $etids = DB_escapeString(implode(' ', array_intersect($AETIDS, $ETIDS)));
        } else {
            $etids = '-';
        }
        DB_save($_TABLES['userindex'], "uid,tids,aids,boxes,noboxes,maxstories,etids", "{$uid},'{$tids}','{$aids}','{$selectedblocks}',{$noboxes},{$maxstories},'{$etids}'");
        // usercomment
        DB_save($_TABLES['usercomment'], 'uid,commentmode,commentorder,commentlimit', "{$uid},'{$commentmode}','{$commentorder}'," . intval($commentlimit));
        if ($_CONF['custom_registration'] and function_exists('CUSTOM_userSave')) {
            CUSTOM_userSave($uid);
        }
        if ($_CONF['usersubmission'] == 1 && $oldstatus == USER_ACCOUNT_AWAITING_APPROVAL && ($userstatus == USER_ACCOUNT_ACTIVE || $userstatus == USER_ACCOUNT_AWAITING_ACTIVATION || $userstatus == USER_ACCOUNT_AWAITING_VERIFICATION)) {
            USER_createAndSendPassword($username, $email, $uid);
        }
        if ($userstatus == USER_ACCOUNT_DISABLED) {
            SESS_endUserSession($uid);
        }
        $userChanged = true;
        // if groups is -1 then this user isn't allowed to change any groups so ignore
        if (is_array($groups) && SEC_hasRights('group.edit')) {
            if (!SEC_inGroup('Root')) {
                $rootgrp = DB_getItem($_TABLES['groups'], 'grp_id', "grp_name = 'Root'");
                if (in_array($rootgrp, $groups)) {
                    COM_accessLog("User {$_USER['username']} ({$_USER['uid']}) just tried to give Root permissions to user {$username}.");
                    echo COM_refresh($_CONF['site_admin_url'] . '/index.php');
                    exit;
                }
            }
            // make sure the Remote Users group is in $groups
            if (SEC_inGroup('Remote Users', $uid)) {
                $remUsers = DB_getItem($_TABLES['groups'], 'grp_id', "grp_name = 'Remote Users'");
                if (!in_array($remUsers, $groups)) {
                    $groups[] = $remUsers;
                }
            }
            if ($_USER_VERBOSE) {
                COM_errorLog("deleting all group_assignments for user {$uid}/{$username}", 1);
            }
            // remove user from all groups that the User Admin is a member of
            $UserAdminGroups = SEC_getUserGroups();
            $whereGroup = 'ug_main_grp_id IN (' . implode(',', $UserAdminGroups) . ')';
            DB_query("DELETE FROM {$_TABLES['group_assignments']} WHERE (ug_uid = {$uid}) AND " . $whereGroup);
            // make sure to add user to All Users and Logged-in Users groups
            $allUsers = DB_getItem($_TABLES['groups'], 'grp_id', "grp_name = 'All Users'");
            if (!in_array($allUsers, $groups)) {
                $groups[] = $allUsers;
            }
            $logUsers = DB_getItem($_TABLES['groups'], 'grp_id', "grp_name = 'Logged-in Users'");
            if (!in_array($logUsers, $groups)) {
                $groups[] = $logUsers;
            }
            foreach ($groups as $userGroup) {
                if (in_array($userGroup, $UserAdminGroups)) {
                    if ($_USER_VERBOSE) {
                        COM_errorLog("adding group_assignment " . $userGroup . " for {$username}", 1);
                    }
                    $sql = "INSERT INTO {$_TABLES['group_assignments']} (ug_main_grp_id, ug_uid) VALUES ({$userGroup}, {$uid})";
                    DB_query($sql);
                }
            }
        }
        // subscriptions
        $subscription_deletes = @array_values($_POST['subdelete']);
        if (is_array($subscription_deletes)) {
            foreach ($subscription_deletes as $subid) {
                DB_delete($_TABLES['subscriptions'], 'sub_id', (int) $subid);
            }
        }
        foreach ($social_services as $service) {
            $service_input = $service['service'] . '_username';
            $_POST[$service_input] = DB_escapeString($_POST[$service_input]);
            if ($_POST[$service_input] != '') {
                $sql = "REPLACE INTO {$_TABLES['social_follow_user']} (ssid,uid,ss_username) ";
                $sql .= " VALUES (" . (int) $service['service_id'] . "," . $uid . ",'" . $_POST[$service_input] . "');";
                DB_query($sql, 1);
            } else {
                $sql = "DELETE FROM {$_TABLES['social_follow_user']} WHERE ssid = " . (int) $service['service_id'] . " AND uid=" . (int) $uid;
                DB_query($sql, 1);
            }
        }
        if ($newuser == 0) {
            PLG_profileSave('', $uid);
        } else {
            PLG_createUser($uid);
        }
        if ($userChanged) {
            PLG_userInfoChanged($uid);
        }
        CACHE_remove_instance('mbmenu');
        $errors = DB_error();
        if (empty($errors)) {
            echo PLG_afterSaveSwitch($_CONF['aftersave_user'], "{$_CONF['site_url']}/users.php?mode=profile&uid={$uid}", 'user', 21);
        } else {
            $retval .= COM_siteHeader('menu', $LANG28[22]);
            $retval .= COM_errorLog('Error in USER_save() in ' . $_CONF['site_admin_url'] . '/user.php');
            $retval .= COM_siteFooter();
            echo $retval;
            exit;
        }
    } else {
        $retval = COM_siteHeader('menu', $LANG28[1]);
        $retval .= COM_errorLog($LANG28[10]);
        if (DB_count($_TABLES['users'], 'uid', $uid) > 0) {
            $retval .= USER_edit($uid);
        } else {
            $retval .= USER_edit();
        }
        $retval .= COM_siteFooter();
        echo $retval;
        exit;
    }
    if ($_USER_VERBOSE) {
        COM_errorLog("***************leaving USER_save()*****************", 1);
    }
    return $retval;
}
コード例 #3
0
ファイル: usersettings.php プロジェクト: hostellerie/nexpro
/**
* Saves user's preferences back to the database
*
* @param    array   $A  User's data to save
* @return   void
*
*/
function savepreferences($A)
{
    global $_CONF, $_TABLES, $_USER;
    if (isset($A['noicons']) && $A['noicons'] == 'on') {
        $A['noicons'] = 1;
    } else {
        $A['noicons'] = 0;
    }
    if (isset($A['willing']) && $A['willing'] == 'on') {
        $A['willing'] = 1;
    } else {
        $A['willing'] = 0;
    }
    if (isset($A['noboxes']) && $A['noboxes'] == 'on') {
        $A['noboxes'] = 1;
    } else {
        $A['noboxes'] = 0;
    }
    if (isset($A['emailfromadmin']) && $A['emailfromadmin'] == 'on') {
        $A['emailfromadmin'] = 1;
    } else {
        $A['emailfromadmin'] = 0;
    }
    if (isset($A['emailfromuser']) && $A['emailfromuser'] == 'on') {
        $A['emailfromuser'] = 1;
    } else {
        $A['emailfromuser'] = 0;
    }
    if (isset($A['showonline']) && $A['showonline'] == 'on') {
        $A['showonline'] = 1;
    } else {
        $A['showonline'] = 0;
    }
    $A['maxstories'] = COM_applyFilter($A['maxstories'], true);
    if (empty($A['maxstories'])) {
        $A['maxstories'] = 0;
    } else {
        if ($A['maxstories'] > 0) {
            if ($A['maxstories'] < $_CONF['minnews']) {
                $A['maxstories'] = $_CONF['minnews'];
            }
        }
    }
    $TIDS = @array_values($A['topics']);
    // array of strings
    $AIDS = @array_values($A['selauthors']);
    // array of integers
    $BOXES = @array_values($A['blocks']);
    // array of integers
    $ETIDS = @array_values($A['etids']);
    // array of strings
    $AETIDS = USER_getAllowedTopics();
    // array of strings (fetched, needed to "clean" $TIDS and $ETIDS)
    $tids = '';
    if (count($TIDS) > 0) {
        // the array_intersect mitigates the need to scrub the TIDS input
        $tids = addslashes(implode(' ', array_intersect($AETIDS, $TIDS)));
    }
    $aids = '';
    if (count($AIDS) > 0) {
        // Scrub the AIDS array to prevent SQL injection and bad values
        foreach ($AIDS as $key => $val) {
            $AIDS[$key] = COM_applyFilter($val, true);
        }
        $aids = addslashes(implode(' ', $AIDS));
    }
    $selectedblocks = '';
    if (count($BOXES) > 0) {
        // Scrub the BOXES array to prevent SQL injection and bad values
        foreach ($BOXES as $key => $val) {
            $BOXES[$key] = COM_applyFilter($val, true);
        }
        $boxes = addslashes(implode(',', $BOXES));
        $blockresult = DB_query("SELECT bid,name FROM {$_TABLES['blocks']} WHERE bid NOT IN ({$boxes})");
        $numRows = DB_numRows($blockresult);
        for ($x = 1; $x <= $numRows; $x++) {
            $row = DB_fetchArray($blockresult);
            if ($row['name'] != 'user_block' and $row['name'] != 'admin_block' and $row['name'] != 'section_block') {
                $selectedblocks .= $row['bid'];
                if ($x != $numRows) {
                    $selectedblocks .= ' ';
                }
            }
        }
    }
    $selectedblocks = trim($selectedblocks);
    $etids = '';
    if ($_CONF['emailstories'] == 1 && count($ETIDS) > 0) {
        // the array_intersect mitigates the need to scrub the ETIDS input
        $etids = addslashes(implode(' ', array_intersect($AETIDS, $ETIDS)));
    }
    if (isset($A['tzid'])) {
        $A['tzid'] = COM_applyFilter($A['tzid']);
    } else {
        $A['tzid'] = '';
    }
    if (isset($A['theme'])) {
        $A['theme'] = COM_applyFilter($A['theme']);
    }
    if (empty($A['theme'])) {
        $A['theme'] = $_CONF['theme'];
    }
    if (isset($A['language'])) {
        $A['language'] = COM_applyFilter($A['language']);
    }
    if (empty($A['language'])) {
        $A['language'] = $_CONF['language'];
    }
    // Save theme, when doing so, put in cookie so we can set the user's theme
    // even when they aren't logged in
    $theme = addslashes($A['theme']);
    $language = addslashes($A['language']);
    DB_query("UPDATE {$_TABLES['users']} SET theme='{$theme}',language='{$language}' WHERE uid = '{$_USER['uid']}'");
    setcookie($_CONF['cookie_theme'], $A['theme'], time() + 31536000, $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure']);
    setcookie($_CONF['cookie_language'], $A['language'], time() + 31536000, $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure']);
    setcookie($_CONF['cookie_tzid'], $A['tzid'], time() + 31536000, $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure']);
    $A['dfid'] = COM_applyFilter($A['dfid'], true);
    DB_query("UPDATE {$_TABLES['userprefs']} SET noicons='{$A['noicons']}', willing='{$A['willing']}', dfid='{$A['dfid']}', tzid='{$A['tzid']}', emailfromadmin='{$A['emailfromadmin']}', emailfromuser='******'emailfromuser']}', showonline='{$A['showonline']}' WHERE uid='{$_USER['uid']}'");
    if (empty($etids)) {
        $etids = '-';
    }
    DB_save($_TABLES['userindex'], "uid,tids,aids,boxes,noboxes,maxstories,etids", "'{$_USER['uid']}','{$tids}','{$aids}','{$selectedblocks}','{$A['noboxes']}',{$A['maxstories']},'{$etids}'");
    $A['commentmode'] = COM_applyFilter($A['commentmode']);
    if (empty($A['commentmode'])) {
        $A['commentmode'] = $_CONF['comment_mode'];
    }
    $A['commentmode'] = addslashes($A['commentmode']);
    $A['commentorder'] = COM_applyFilter($A['commentorder']);
    if (empty($A['commentorder'])) {
        $A['commentorder'] = 'ASC';
    }
    $A['commentorder'] = addslashes($A['commentorder']);
    $A['commentlimit'] = COM_applyFilter($A['commentlimit'], true);
    if ($A['commentlimit'] <= 0) {
        $A['commentlimit'] = $_CONF['comment_limit'];
    }
    DB_save($_TABLES['usercomment'], 'uid,commentmode,commentorder,commentlimit', "'{$_USER['uid']}','{$A['commentmode']}','{$A['commentorder']}','{$A['commentlimit']}'");
    PLG_userInfoChanged($_USER['uid']);
}
コード例 #4
0
ファイル: usersettings.php プロジェクト: NewRoute/glfusion
/**
* Saves user's preferences back to the database
*
* @A        array       User's data to save
*
*/
function savepreferences($A)
{
    global $_CONF, $_TABLES, $_USER;
    if (isset($A['noicons']) && $A['noicons'] == 'on') {
        $A['noicons'] = 1;
    } else {
        $A['noicons'] = 0;
    }
    if (isset($A['willing']) && $A['willing'] == 'on') {
        $A['willing'] = 1;
    } else {
        $A['willing'] = 0;
    }
    if (isset($A['noboxes']) && $A['noboxes'] == 'on') {
        $A['noboxes'] = 1;
    } else {
        $A['noboxes'] = 0;
    }
    if (isset($A['emailfromadmin']) && $A['emailfromadmin'] == 'on') {
        $A['emailfromadmin'] = 1;
    } else {
        $A['emailfromadmin'] = 0;
    }
    if (isset($A['emailfromuser']) && $A['emailfromuser'] == 'on') {
        $A['emailfromuser'] = 1;
    } else {
        $A['emailfromuser'] = 0;
    }
    if (isset($A['showonline']) && $A['showonline'] == 'on') {
        $A['showonline'] = 1;
    } else {
        $A['showonline'] = 0;
    }
    $A['maxstories'] = COM_applyFilter($A['maxstories'], true);
    if (empty($A['maxstories'])) {
        $A['maxstories'] = 0;
    } else {
        if ($A['maxstories'] > 0) {
            if ($A['maxstories'] < $_CONF['minnews']) {
                $A['maxstories'] = $_CONF['minnews'];
            }
        }
    }
    $TIDS = @array_values($A['topics']);
    $AIDS = @array_values($A['selauthors']);
    $BOXES = @array_values($A['blocks']);
    $ETIDS = @array_values($A['dgtopics']);
    $allowed_etids = USER_buildTopicList();
    $AETIDS = explode(' ', $allowed_etids);
    $tids = '';
    if (sizeof($TIDS) > 0) {
        $tids = DB_escapeString(implode(' ', array_intersect($AETIDS, $TIDS)));
    }
    $aids = '';
    if (sizeof($AIDS) > 0) {
        foreach ($AIDS as $key => $val) {
            $AIDS[$key] = intval($val);
        }
        $aids = DB_escapeString(implode(' ', $AIDS));
    }
    $selectedblocks = '';
    $selectedBoxes = array();
    if (count($BOXES) > 0) {
        foreach ($BOXES as $key => $val) {
            $BOXES[$key] = intval($val);
        }
        $boxes = DB_escapeString(implode(',', $BOXES));
        $blockresult = DB_query("SELECT bid,name FROM {$_TABLES['blocks']} WHERE bid NOT IN ({$boxes})");
        $numRows = DB_numRows($blockresult);
        for ($x = 1; $x <= $numRows; $x++) {
            $row = DB_fetchArray($blockresult);
            if ($row['name'] != 'user_block' and $row['name'] != 'admin_block' and $row['name'] != 'section_block') {
                $selectedblocks .= $row['bid'];
                if ($x != $numRows) {
                    $selectedblocks .= ' ';
                }
            }
        }
    }
    $etids = '';
    if (sizeof($ETIDS) > 0) {
        $etids = DB_escapeString(implode(' ', array_intersect($AETIDS, $ETIDS)));
    }
    if (isset($A['tzid'])) {
        $A['tzid'] = COM_applyFilter($A['tzid']);
    } else {
        $A['tzid'] = '';
    }
    if (isset($A['theme'])) {
        $A['theme'] = COM_applyFilter($A['theme']);
    }
    if (empty($A['theme'])) {
        $A['theme'] = $_CONF['theme'];
    }
    if (isset($A['language'])) {
        $A['language'] = COM_applyFilter($A['language']);
    }
    if (empty($A['language'])) {
        $A['language'] = $_CONF['language'];
    }
    if (isset($A['search_result_format'])) {
        $A['search_result_format'] = COM_applyFilter($A['search_result_format']);
    } else {
        $A['search_result_format'] = 'google';
    }
    // Save theme, when doing so, put in cookie so we can set the user's theme
    // even when they aren't logged in
    $theme = DB_escapeString($A['theme']);
    $language = DB_escapeString($A['language']);
    DB_query("UPDATE {$_TABLES['users']} SET theme='{$theme}',language='{$language}' WHERE uid = {$_USER['uid']}");
    SEC_setCookie($_CONF['cookie_theme'], $A['theme'], time() + 31536000, $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure'], false);
    SEC_setCookie($_CONF['cookie_language'], $A['language'], time() + 31536000, $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure'], false);
    SEC_setCookie($_CONF['cookie_tzid'], $A['tzid'], time() + 31536000, $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure'], false);
    $A['dfid'] = (int) COM_applyFilter($A['dfid'], true);
    DB_query("UPDATE {$_TABLES['userprefs']} SET search_result_format='" . DB_escapeString($A['search_result_format']) . "',noicons=" . (int) $A['noicons'] . ", willing=" . (int) $A['willing'] . ", dfid=" . (int) $A['dfid'] . ", tzid='" . DB_escapeString($A['tzid']) . "', emailfromadmin='" . DB_escapeString($A['emailfromadmin']) . "', emailfromuser="******", showonline=" . (int) $A['showonline'] . " WHERE uid=" . (int) $_USER['uid']);
    if (empty($etids)) {
        $etids = '-';
    }
    DB_save($_TABLES['userindex'], "uid,tids,aids,boxes,noboxes,maxstories,etids", "{$_USER['uid']},'{$tids}','{$aids}','{$selectedblocks}'," . (int) $A['noboxes'] . "," . (int) $A['maxstories'] . ",'{$etids}'");
    $A['commentmode'] = COM_applyFilter($A['commentmode']);
    if (empty($A['commentmode'])) {
        $A['commentmode'] = $_CONF['comment_mode'];
    }
    $A['commentmode'] = DB_escapeString($A['commentmode']);
    $A['commentorder'] = COM_applyFilter($A['commentorder']);
    $A['commentorder'] = strtoupper($A['commentorder']) == 'DESC' ? 'DESC' : 'ASC';
    $A['commentorder'] = DB_escapeString($A['commentorder']);
    $A['commentlimit'] = COM_applyFilter($A['commentlimit'], true);
    if ($A['commentlimit'] <= 0) {
        $A['commentlimit'] = $_CONF['comment_limit'];
    }
    DB_save($_TABLES['usercomment'], 'uid,commentmode,commentorder,commentlimit', "{$_USER['uid']},'{$A['commentmode']}','{$A['commentorder']}'," . (int) $A['commentlimit']);
    $subscription_deletes = @array_values($A['subdelete']);
    if (is_array($subscription_deletes)) {
        foreach ($subscription_deletes as $subid) {
            DB_delete($_TABLES['subscriptions'], 'sub_id', (int) $subid);
        }
    }
    PLG_userInfoChanged($_USER['uid']);
}