Mahor rewrite:

[mailer.git] / inc / modules / guest / what-login.php

diff --git a/inc/modules/guest/what-login.php b/inc/modules/guest/what-login.php
index 6dddc59702f3de78384c9c01f84c3ba95a42f5cd..6035504fb80e6f0470f99f945b1965d267384e95 100644 (file)
--- a/inc/modules/guest/what-login.php
+++ b/inc/modules/guest/what-login.php
@@ -91,19 +91,19 @@ if (IS_MEMBER()) {
        $password = ""; $uid2 = ""; $dmy = "";
        if ($probe_nickname === true) {
                // Nickname entered
-               $result = SQL_QUERY_ESC("SELECT userid, password, last_online".$LAST." FROM "._MYSQL_PREFIX."_user_data WHERE nickname='%s' AND status='CONFIRMED' LIMIT 1",
-                array($uid), __FILE__, __LINE__);
+               $result = SQL_QUERY_ESC("SELECT userid, password, last_online".$LAST." FROM `"._MYSQL_PREFIX."_user_data` WHERE nickname='%s' AND status='CONFIRMED' LIMIT 1",
+                       array($uid), __FILE__, __LINE__);
                list($uid2, $password, $online, $login) = SQL_FETCHROW($result);
                if (!empty($uid2)) $uid = bigintval($uid2);
        } else {
                // Direct userid entered
-               $result = SQL_QUERY_ESC("SELECT userid, password, last_online".$LAST." FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s AND status='CONFIRMED' LIMIT 1",
-                array($uid, $hash), __FILE__, __LINE__);
-               list($dmy, $password, $online, $login) = SQL_FETCHROW($result);
+               $result = SQL_QUERY_ESC("SELECT userid, password, last_online".$LAST." FROM `"._MYSQL_PREFIX."_user_data` WHERE userid=%s AND status='CONFIRMED' LIMIT 1",
+                       array($uid, $hash), __FILE__, __LINE__);
+               list($uid2, $password, $online, $login) = SQL_FETCHROW($result);
        }
 
        // Is there an entry?
-       if ((SQL_NUMROWS($result) == 1) && ((($probe_nickname) && (!empty($uid2))) || ($dmy == $uid))) {
+       if ((SQL_NUMROWS($result) == 1) && ((($probe_nickname) && (!empty($uid2))) || ($uid2 == $uid))) {
                // Free result
                SQL_FREERESULT($result);
 
@@ -115,7 +115,7 @@ if (IS_MEMBER()) {
                        // Just set the hash to the password from DB... :)
                        $hash = $password;
                } else {
-                       // Encrypt hash for comparsion
+                       // Hash password with improved way for comparsion
                        $hash = generateHash($_POST['password'], substr($password, 0, -40));
                }
 
@@ -124,8 +124,8 @@ if (IS_MEMBER()) {
                        $hash = generateHash($_POST['password']);
 
                        // ... and update database
-                       $result_update = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_user_data SET password='%s' WHERE userid=%s AND status='CONFIRMED' LIMIT 1",
-                        array($hash, $uid), __FILE__, __LINE__);
+                       SQL_QUERY_ESC("UPDATE `"._MYSQL_PREFIX."_user_data` SET password='%s' WHERE userid=%s AND status='CONFIRMED' LIMIT 1",
+                               array($hash, $uid), __FILE__, __LINE__);
 
                        // No login bonus by default
                        $BONUS = false;
@@ -133,19 +133,24 @@ if (IS_MEMBER()) {
                        // Probe for last online timemark
                        $probe = time() -  $online;
                        if (!empty($login)) $probe = time() - $login;
-                       if ((GET_EXT_VERSION("bonus") >= "0.2.2") && ($probe >= $_CONFIG['login_timeout'])) {
+                       if ((GET_EXT_VERSION("bonus") >= "0.2.2") && ($probe >= getConfig('login_timeout'))) {
                                // Add login bonus to user's account
-                               $ADD = ", login_bonus=login_bonus+'".$_CONFIG['login_bonus']."'";
+                               $ADD = sprintf(", login_bonus=login_bonus+%s",
+                                       (float)getConfig('login_bonus')
+                               );
                                $BONUS = true;
 
                                // Subtract login bonus from userid's account or jackpot
-                               if ((GET_EXT_VERSION("bonus") >= "0.3.5") && ($_CONFIG['bonus_mode'] != "ADD")) BONUS_POINTS_HANDLER('login_bonus');
+                               if ((GET_EXT_VERSION("bonus") >= "0.3.5") && (getConfig('bonus_mode') != "ADD")) BONUS_POINTS_HANDLER('login_bonus');
                        } // END - if
 
+                       // Init variables
+                       $life = "-1"; $login = false;
 
                        // Secure lifetime from input form
                        $l = bigintval($_POST['lifetime']);
-                       $life = "-1";
+
+                       // Is the lifetime set?
                        if ($l > 0) {
                                // Calculate lifetime of cookies
                                $life = time() + $l;
@@ -156,7 +161,8 @@ if (IS_MEMBER()) {
                                // Update cookies
                                $login = (set_session("userid"  , $uid , $life, COOKIE_PATH)
                                       && set_session("u_hash"  , $hash, $life, COOKIE_PATH)
-                                      && set_session("lifetime", $l   , $life, COOKIE_PATH));
+                                      && set_session("lifetime", $l   , $life, COOKIE_PATH)
+                               );
 
                                // Update global array
                                $GLOBALS['userid'] = $uid;
@@ -167,8 +173,8 @@ if (IS_MEMBER()) {
 
                        if ($login) {
                                // Update database records
-                               $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_user_data SET total_logins=total_logins+1".$ADD." WHERE userid=%s LIMIT 1",
-                                array($uid), __FILE__, __LINE__);
+                               $result = SQL_QUERY_ESC("UPDATE `"._MYSQL_PREFIX."_user_data` SET total_logins=total_logins+1".$ADD." WHERE userid=%s LIMIT 1",
+                                       array($uid), __FILE__, __LINE__);
                                if (SQL_AFFECTEDROWS() == 1) {
                                        // Procedure to checking for login data
                                        if (($BONUS) && (EXT_IS_ACTIVE("bonus"))) {
@@ -186,18 +192,18 @@ if (IS_MEMBER()) {
                                // Cookies not setable!
                                $URL = URL."/modules.php?module=index&what=login&login=".CODE_NO_COOKIES;
                        }
-               } else {
+               } elseif (GET_EXT_VERSION("sql_patches") >= "0.4.7") {
                        // Update failture counter
-                       SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_user_data SET login_failtures=login_failtures+1,last_failture=NOW() WHERE userid=%s LIMIT 1",
+                       SQL_QUERY_ESC("UPDATE `"._MYSQL_PREFIX."_user_data` SET login_failtures=login_failtures+1,last_failture=NOW() WHERE userid=%s LIMIT 1",
                                array($uid), __FILE__, __LINE__);
 
                        // Wrong password!
                        $ERROR = CODE_WRONG_PASS;
                }
-       } elseif ((($probe_nickname) && (!empty($uid2))) || ($dmy == $uid)) {
+       } elseif ((($probe_nickname) && (!empty($uid2))) || ($uid2 == $uid)) {
                // Other account status?
-               $result = SQL_QUERY_ESC("SELECT status FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s LIMIT 1",
-                array($uid), __FILE__, __LINE__);
+               $result = SQL_QUERY_ESC("SELECT status FROM `"._MYSQL_PREFIX."_user_data` WHERE userid=%s LIMIT 1",
+                       array($uid), __FILE__, __LINE__);
 
                // Entry found?
                if (SQL_NUMROWS($result) == 1) {
@@ -239,11 +245,11 @@ if (IS_MEMBER()) {
        $probe_nickname = ((EXT_IS_ACTIVE("nickname")) && (("".round($_POST['id'])."") != $_POST['id']));
        if ($probe_nickname) {
                // Nickname entered
-               $result = SQL_QUERY_ESC("SELECT userid, status FROM "._MYSQL_PREFIX."_user_data WHERE nickname='%s' OR email='%s' LIMIT 1",
+               $result = SQL_QUERY_ESC("SELECT userid, status FROM `"._MYSQL_PREFIX."_user_data` WHERE nickname='%s' OR email='%s' LIMIT 1",
                        array($uid, $_POST['email']), __FILE__, __LINE__);
        } else {
                // Direct userid entered
-               $result = SQL_QUERY_ESC("SELECT userid, status FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s OR email='%s' LIMIT 1",
+               $result = SQL_QUERY_ESC("SELECT userid, status FROM `"._MYSQL_PREFIX."_user_data` WHERE userid=%s OR email='%s' LIMIT 1",
                        array(bigintval($uid), $_POST['email']), __FILE__, __LINE__);
        }
 
@@ -255,8 +261,8 @@ if (IS_MEMBER()) {
                if ($status == "CONFIRMED") {
                        // Ooppps, this was missing! ;-) We should update the database...
                        $NEW_PASS = GEN_PASS();
-                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_user_data SET password='%s' WHERE userid=%s LIMIT 1",
-                        array(generateHash($NEW_PASS), $uid), __FILE__, __LINE__);
+                       $result = SQL_QUERY_ESC("UPDATE `"._MYSQL_PREFIX."_user_data` SET password='%s' WHERE userid=%s LIMIT 1",
+                               array(generateHash($NEW_PASS), $uid), __FILE__, __LINE__);
 
                        // Prepare data and message for email
                        $msg = LOAD_EMAIL_TEMPLATE("new-pass", array('new_pass' => $NEW_PASS), $uid);