X-Git-Url: https://git.mxchange.org/?p=mailer.git;a=blobdiff_plain;f=inc%2Flibs%2Fsponsor_functions.php;h=1bc1c7ed7f589048c1932df62c4f9c763ae72ffc;hp=ac2324e567f05bb68cf33bf4a7f66003e5d37b96;hb=5bdeaf8b452206598b6c6cd4f941145b11a0eccc;hpb=9beb33ae0c3194b05d172508768a833b1b69af2f diff --git a/inc/libs/sponsor_functions.php b/inc/libs/sponsor_functions.php index ac2324e567..1bc1c7ed7f 100644 --- a/inc/libs/sponsor_functions.php +++ b/inc/libs/sponsor_functions.php @@ -31,16 +31,18 @@ ************************************************************************/ // Some security stuff... -if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) -{ +if (!defined('__SECURITY')) { $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4)."/security.php"; require($INC); } + // -function SPONSOR_HANDLE_SPONSOR(&$POST, $NO_UPDATE=false, $MSGs=array(), $RET_STATUS=false) -{ - global $HTTP_GET_VARS, $_SERVER, $_COOKIE; - $SAVE = true; $UPDATE = false; $skip = false; $ALREADY = false; +function SPONSOR_HANDLE_SPONSOR (&$POST, $NO_UPDATE=false, $MSGs=array(), $RET_STATUS=false) { + // Init a lot variables + $SAVE = true; + $UPDATE = false; + $skip = false; + $ALREADY = false; $ret = "unused"; // Skip these entries @@ -55,44 +57,35 @@ function SPONSOR_HANDLE_SPONSOR(&$POST, $NO_UPDATE=false, $MSGs=array(), $RET_ST ); // Check if sponsor already exists - foreach ($POST as $k=>$v) - { - if (!(array_search($k, $SKIPPED) > -1)) - { + foreach ($POST as $k => $v) { + if (!(array_search($k, $SKIPPED) > -1)) { // Check only posted input entries not the submit button switch ($k) { case "email": $ALREADY = false; - if (!VALIDATE_EMAIL($v)) - { + if (!VALIDATE_EMAIL($v)) { // Email address is not valid $SAVE = false; - } - else - { + } else { // Do we want to add a new sponsor or update his data? - $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_sponsor_data WHERE email='%s' LIMIT 1", - array($POST['email']), __FILE__, __LINE__); + $result = SQL_QUERY_ESC("SELECT id FROM `{!_MYSQL_PREFIX!}_sponsor_data` WHERE email='%s' LIMIT 1", + array($POST['email']), __FILE__, __LINE__); // Is a sponsor alread in the db? - if (SQL_NUMROWS($result) == 1) - { - // Free memory - SQL_FREERESULT($result); - + if (SQL_NUMROWS($result) == 1) { // Yes, he is! - if (($HTTP_GET_VARS['what'] == "add_sponsor") || ($NO_UPDATE)) - { + if (($GLOBALS['what'] == "add_sponsor") || ($NO_UPDATE)) { // Already found! $ALREADY = true; - } - else - { + } else { // Update his data $UPDATE = true; } } + + // Free memory + SQL_FREERESULT($result); } break; @@ -110,40 +103,11 @@ function SPONSOR_HANDLE_SPONSOR(&$POST, $NO_UPDATE=false, $MSGs=array(), $RET_ST default: // Test if there is are time selections - $TEST = substr($k, -3); - if ((($TEST == "_ye") || ($TEST == "_mo") || ($TEST == "_we") || ($TEST == "_da") || ($TEST == "_ho") || ($TEST == "_mi") || ($TEST == "_se")) && (!empty($v))) - { - // Found a multi-selection for timings? - $TEST = substr($k, 0, -3); - if ((!empty($POST[$TEST."_ye"])) && (!empty($POST[$TEST."_mo"])) && (!empty($POST[$TEST."_we"])) && (!empty($POST[$TEST."_da"])) && (!empty($POST[$TEST."_ho"])) && (!empty($POST[$TEST."_mi"])) && (!empty($POST[$TEST."_se"])) && ($TEST != $TEST2)) - { - // Generate timestamp - $POST[$TEST] = CREATE_TIMESTAMP_FROM_SELECTIONS($TEST, $POST); - $DATA['keys'][] = $TEST; - $DATA['values'][] = $POST[$TEST]; - - // Remove data from array - unset($POST[$TEST."_ye"]); - unset($POST[$TEST."_mo"]); - unset($POST[$TEST."_we"]); - unset($POST[$TEST."_da"]); - unset($POST[$TEST."_ho"]); - unset($POST[$TEST."_mi"]); - unset($POST[$TEST."_se"]); - - // Skip adding - $k = ""; $skip = true; $TEST2 = $TEST; - } - } - else - { - $skip = false; $TEST2 = ""; - } + CONVERT_SELECTIONS_TO_TIMESTAMP($POST, $DATA, $k, $skip); break; } - if ((!empty($k)) && ($skip == false)) - { + if ((!empty($k)) && ($skip == false)) { // Add data $DATA['keys'][] = $k; $DATA['values'][] = $v; } @@ -151,52 +115,44 @@ function SPONSOR_HANDLE_SPONSOR(&$POST, $NO_UPDATE=false, $MSGs=array(), $RET_ST } // Save sponsor? - if ($SAVE) - { + if ($SAVE) { // Default is no force even when a guest want to abuse this force switch - if ((empty($POST['force'])) || (!IS_ADMIN())) $POST['force'] = "0"; + if ((empty($POST['force'])) || (!IS_ADMIN())) $POST['force'] = 0; // SQL and message string is empty by default $SQL = ""; $MSG = ""; // Update? - if ($UPDATE) - { + if ($UPDATE) { // Update his data - $SQL = "UPDATE "._MYSQL_PREFIX."_sponsor_data SET "; - foreach ($DATA['keys'] as $k=>$v) - { + $SQL = "UPDATE `{!_MYSQL_PREFIX!}_sponsor_data` SET "; + foreach ($DATA['keys'] as $k => $v) { $SQL .= $v."='%s', "; } // Remove last ", " from SQL string $SQL = substr($SQL, 0, -2)." WHERE id='%s' LIMIT 1"; - $DATA['values'][] = bigintval($HTTP_GET_VARS['id']); + $DATA['values'][] = bigintval($_GET['id']); // Generate message - $MSG = SPONSOR_SET_MESSAGE(ADMIN_SPONSOR_UPDATED, "updated", $MSGs); + $MSG = SPONSOR_GET_MESSAGE(ADMIN_SPONSOR_UPDATED, "updated", $MSGs); $ret = "updated"; - } - elseif ((!$ALREADY) || (($POST['force'] == "1") && (IS_ADMIN()))) - { + } elseif ((!$ALREADY) || (($POST['force'] == "1") && (IS_ADMIN()))) { // Add new sponsor, first add more data $DATA['keys'][] = "sponsor_created"; $DATA['values'][] = time(); $DATA['keys'][] = "status"; - if ((!$NO_UPDATE) && (IS_ADMIN()) && ($HTTP_GET_VARS['what'] == "add_sponsor")) - { + if ((!$NO_UPDATE) && (IS_ADMIN()) && ($GLOBALS['what'] == "add_sponsor")) { // Only allowed for admin $DATA['values'][] = "PENDING"; - } - else - { + } elsen{ // Guest area $DATA['values'][] = "UNCONFIRMED"; // Generate hash code $DATA['keys'][] = "hash"; - $DATA['values'][] = md5($_COOKIE['PHPSESSID'].":".$POST['email'].":".$_SERVER['REMOTE_ADDR'].":".$_SERVER['HTTP_USER_AGENT'].":".time()); + $DATA['values'][] = md5(session_id().":".$POST['email'].":".GET_REMOTE_ADDR().":".GET_USER_AGENT().":".time()); $DATA['keys'][] = "remote_addr"; - $DATA['values'][] = $_SERVER['REMOTE_ADDR']; + $DATA['values'][] = GET_REMOTE_ADDR(); } // Implode all data into strings @@ -204,21 +160,17 @@ function SPONSOR_HANDLE_SPONSOR(&$POST, $NO_UPDATE=false, $MSGs=array(), $RET_ST $VALUES = str_repeat("%s', '", count($DATA['values']) - 1); // Generate string - $SQL = "INSERT INTO "._MYSQL_PREFIX."_sponsor_data (".$KEYS.") VALUES('".$VALUES."%s')"; + $SQL = "INSERT INTO `{!_MYSQL_PREFIX!}_sponsor_data` (".$KEYS.") VALUES ('".$VALUES."%s')"; // Generate message - $MSG = SPONSOR_SET_MESSAGE(ADMIN_SPONSOR_ADDED, "added", $MSGs); + $MSG = SPONSOR_GET_MESSAGE(ADMIN_SPONSOR_ADDED, "added", $MSGs); $ret = "added"; - } - elseif ((!$NO_UPDATE) && (IS_ADMIN())) - { + } elseif ((!$NO_UPDATE) && (IS_ADMIN())) { // Add all data as hidden data $OUT = ""; - foreach ($POST as $k=>$v) - { + foreach ($POST as $k => $v) { // Do not add 'force' ! - if ($k != "force") - { + if ($k != "force") { $OUT .= "\n"; } } @@ -228,30 +180,24 @@ function SPONSOR_HANDLE_SPONSOR(&$POST, $NO_UPDATE=false, $MSGs=array(), $RET_ST // Ask for adding a sponsor with same email address LOAD_TEMPLATE("admin_add_sponsor_already"); return; - } - else - { + } else { // Already added! $MSG = SPONSOR_ALREADY_FOUND_1.$POST['email'].SPONSOR_ALREADY_FOUND_2; $ret = "already"; } - if (!empty($SQL)) - { + if (!empty($SQL)) { // Run SQL command $result = SQL_QUERY_ESC($SQL, $DATA['values'], __FILE__, __LINE__); } // Output message - if ((!$NO_UPDATE) && (IS_ADMIN())) - { + if ((!$NO_UPDATE) && (IS_ADMIN())) { LOAD_TEMPLATE("admin_settings_saved", false, $MSG); } - } - else - { + } else { // Error found! - $MSG = SPONSOR_SET_MESSAGE(SPONSOR_DATA_NOT_SAVED, "failed", $MSGs); + $MSG = SPONSOR_GET_MESSAGE(SPONSOR_DATA_NOT_SAVED, "failed", $MSGs); LOAD_TEMPLATE("admin_settings_saved", false, $MSG); } @@ -259,8 +205,7 @@ function SPONSOR_HANDLE_SPONSOR(&$POST, $NO_UPDATE=false, $MSGs=array(), $RET_ST if ($RET_STATUS) return $ret; } // -function SPONSOR_TRANSLATE_STATUS($status) -{ +function SPONSOR_TRANSLATE_STATUS($status) { switch ($status) { case "UNCONFIRMED": @@ -284,38 +229,27 @@ function SPONSOR_TRANSLATE_STATUS($status) break; default: + DEBUG_LOG(__FUNCTION__, __LINE__, sprintf("Unknown status %s detected.", $status)); $ret = UNKNOWN_STATUS_1.$status.UNKNOWN_STATUS_2; break; } return $ret; } // Search for an email address in the database -function SPONSOR_FOUND_EMAIL_DB($email) -{ - // Default status is failed (as it is always be...) - $ret = false; - - // Check for email (and secure input) - $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_sponsor_data WHERE email='%s' LIMIT 1", - array($email), __FILE__, __LINE__); - +function SPONSOR_FOUND_EMAIL_DB ($email) { // Do we already have the provided email address in our DB? - if (SQL_NUMROWS($result) == 1) $ret = true; + $ret = (GET_TOTAL_DATA($email, "sponsor_data", "id", "email", true) == 1); // Return result return $ret; } // -function SPONSOR_SET_MESSAGE($msg, $pos, $array) -{ +function SPONSOR_GET_MESSAGE ($msg, $pos, $array) { // Check if the requested message was found in array - if (isset($array[$pos])) - { + if (isset($array[$pos])) { // ... if yes then use it! $ret = $array[$pos]; - } - else - { + } else { // ... else use default message $ret = $msg; } @@ -323,20 +257,17 @@ function SPONSOR_SET_MESSAGE($msg, $pos, $array) // Return result return $ret; } + // -function IS_SPONSOR() -{ - global $_COOKIE; +function IS_SPONSOR () { // Failed... $ret = false; - if ((!empty($_COOKIE['sponsorid'])) && (!empty($_COOKIE['sponsorpass']))) - { + if ((isSessionVariableSet('sponsorid'))) && (isSessionVariableSet('sponsorpass')))) { // Check cookies against database records... - $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_sponsor_data + $result = SQL_QUERY_ESC("SELECT id FROM `{!_MYSQL_PREFIX!}_sponsor_data` WHERE id='%s' AND password='%s' AND status='CONFIRMED' LIMIT 1", - array(bigintval($_COOKIE['sponsorid']), $_COOKIE['sponsorpass']), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + array(bigintval(get_session('sponsorid')), get_session('sponsorpass')), __FILE__, __LINE__); + if (SQL_NUMROWS($result) == 1) { // All is fine $ret = true; } @@ -356,26 +287,26 @@ function GENERATE_SPONSOR_MENU($current) if (IS_ADMIN()) $WHERE = ""; // Load main menu entries - $result_main = SQL_QUERY("SELECT action, title FROM "._MYSQL_PREFIX."_sponsor_menu -WHERE what='' ".$WHERE." -ORDER BY sort", __FILE__, __LINE__); + $result_main = SQL_QUERY("SELECT action, title FROM `{!_MYSQL_PREFIX!}_sponsor_menu` +WHERE (what='' OR `what` IS NULL) ".$WHERE." +ORDER BY `sort`", __FILE__, __LINE__); if (SQL_NUMROWS($result_main) > 0) { // Load every menu and it's sub menus - while(list($action, $title_main) = SQL_FETCHROW($result_main)) + while (list($action, $title_main) = SQL_FETCHROW($result_main)) { // Load sub menus - $result_sub = SQL_QUERY_ESC("SELECT what, title FROM "._MYSQL_PREFIX."_sponsor_menu -WHERE action='%s' AND what != '' ".$WHERE." -ORDER BY sort", array($action), __FILE__, __LINE__); + $result_sub = SQL_QUERY_ESC("SELECT what, title FROM `{!_MYSQL_PREFIX!}_sponsor_menu` +WHERE action='%s' AND `what` != '' AND `what` IS NOT NULL ".$WHERE." +ORDER BY `sort`", array($action), __FILE__, __LINE__); if (SQL_NUMROWS($result_sub) > 0) { // Load sub menus $SUB = ""; - while(list($what, $title_sub) = SQL_FETCHROW($result_sub)) + while (list($what, $title_sub) = SQL_FETCHROW($result_sub)) { // Check if current selected menu is matching the loaded one - if ($current == $what) $title_sub = "".$title_sub.""; + if ($current == $what) $title_sub = "".$title_sub.""; // Prepare data for the sub template $content = array( @@ -421,16 +352,13 @@ ORDER BY sort", array($action), __FILE__, __LINE__); // function GENERATE_SPONSOR_CONTENT($what) { - global $HTTP_POST_VARS, $HTTP_GET_VARS, $CONFIG; - $FILE = PATH."inc/modules/sponsor/".$what.".php"; + global $_CONFIG; $OUT = ""; - if (@file_exists($FILE)) - { + $FILE = sprintf("%sinc/modules/sponsor/%s.php", PATH, $what); + if (FILE_READABLE($FILE)) { // Every sponsor action will output nothing directly. It will be written into $OUT! require_once($FILE); - } - else - { + } else { // File not found! $OUT .= LOAD_TEMPLATE("admin_settings_saved", true, SPONSOR_CONTENT_404_1.$what.SPONSOR_CONTENT_404_2); } @@ -439,62 +367,48 @@ function GENERATE_SPONSOR_CONTENT($what) return $OUT; } // -function UPDATE_SPONSOR_LOGIN() -{ - global $_COOKIE, $CONFIG; - - // Check if cookies are set - if ((empty($_COOKIE['sponsorid'])) || (empty($_COOKIE['sponsorpass']))) return false; - - // Calculate cookie lifetime, maybe we have to change this so the admin can setup a - // seperate timeout for these two cookies? - $life = (time() + $CONFIG['online_timeout']); +function UPDATE_SPONSOR_LOGIN () { + // Failed by default + $login = false; - // Is confirmed so both is fine and we can continue with login procedure - $login = ((setcookie("sponsorid" , bigintval($_COOKIE['sponsorid']), $life, COOKIE_PATH)) && - (setcookie("sponsorpass", $_COOKIE['sponsorpass'] , $life, COOKIE_PATH))); - - // Update database? - if ($login) - { + // Is sponsor? + if (IS_SPONSOR()) { // Update last online timestamp - $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_sponsor_data -SET last_online='".time()."' + SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_sponsor_data` +SET last_online=UNIX_TIMESTAMP() WHERE id='%s' AND password='%s' LIMIT 1", - array(bigintval($_COOKIE['sponsorid']), $_COOKIE['sponsorpass']), __FILE__, __LINE__); + array(bigintval(get_session('sponsorid')), get_session('sponsorpass')), __FILE__, __LINE__); + + // This update went fine? + $login = (SQL_AFFECTEDROWS() == 1); } // Return status return $login; } // -function SPONSOR_SAVE_DATA($POST, $content) -{ - global $_COOKIE, $_SERVER, $HTTP_GET_VARS; +function SPONSOR_SAVE_DATA ($POST, $content) { $EMAIL = false; // Unsecure data which we don't want $UNSAFE = array('password', 'id', 'remote_addr', 'sponsor_created', 'last_online', 'status', 'ref_count', - 'points_amount', 'points_used', 'refid', 'hash' , 'last_pay', 'last_curr', 'pass_old', + 'points_amount', 'points_used', 'refid', 'hash', 'last_pay', 'last_curr', 'pass_old', 'ok', 'pass1', 'pass2'); // Set default message ("not saved") $MSG = SPONSOR_ACCOUNT_DATA_NOT_SAVED; // Check for submitted passwords - if ((!empty($HTTP_POST_VARS['pass1'])) && (!empty($HTTP_POST_VARS['pass2']))) - { + if ((!empty($POST['pass1'])) && (!empty($POST['pass2']))) { // Are both passwords the same? - if ($HTTP_POST_VARS['pass1'] == $HTTP_POST_VARS['pass2']) - { + if ($POST['pass1'] == $POST['pass2']) { // Okay, then set password and remove pass1 and pass2 - $HTTP_POST_VARS['password'] = md5($HTTP_POST_VARS['pass1']); + $POST['password'] = md5($POST['pass1']); } } // Remove all (maybe spoofed) unsafe data from array - foreach ($UNSAFE as $remove) - { + foreach ($UNSAFE as $remove) { unset($POST[$remove]); } @@ -503,9 +417,8 @@ function SPONSOR_SAVE_DATA($POST, $content) $DATA = array(); // Prepare SQL string - $SQL = "UPDATE "._MYSQL_PREFIX."_sponsor_data SET"; - foreach ($POST as $key=>$value) - { + $SQL = "UPDATE `{!_MYSQL_PREFIX!}_sponsor_data` SET"; + foreach ($POST as $key => $value) { // Mmmmm, too less security here??? $SQL .= " ".strip_tags($key)."='%s',"; @@ -517,10 +430,8 @@ function SPONSOR_SAVE_DATA($POST, $content) } // Check if email has changed - if ((!empty($content['email'])) && (!empty($POST['email']))) - { - if ($content['email'] != $POST['email']) - { + if ((!empty($content['email'])) && (!empty($POST['email']))) { + if ($content['email'] != $POST['email']) { // Change email address $EMAIL = true; @@ -528,7 +439,7 @@ function SPONSOR_SAVE_DATA($POST, $content) $SQL .= " status='EMAIL', hash='%s',"; // Generate hash code - $HASH = md5($_COOKIE['PHPSESSID'].":".$POST['email'].":".$_SERVER['REMOTE_ADDR'].":".$_SERVER['HTTP_USER_AGENT'].":".time()); + $HASH = md5(session_id().":".$POST['email'].":".GET_REMOTE_ADDR().":".GET_USER_AGENT().":".time()); $DATA[] = $HASH; } } @@ -538,15 +449,14 @@ function SPONSOR_SAVE_DATA($POST, $content) // Add SQL tail data $SQL .= " WHERE id='%s' AND password='%s' LIMIT 1"; - $DATA[] = bigintval($_COOKIE['sponsorid']); - $DATA[] = $_COOKIE['sponsorpass']; + $DATA[] = bigintval(get_session('sponsorid')); + $DATA[] = get_session('sponsorpass'); // Saving data was completed... ufff... - switch ($HTTP_GET_VARS['what']) + switch ($GLOBALS['what']) { case "account": // Change account data - if ($EMAIL) - { + if ($EMAIL) { $MSG = SPONSOR_ACCOUNT_EMAIL_CHANGED; $templ = "admin_sponsor_change_email"; $subj = ADMIN_SPONSOR_ACC_EMAIL_SUBJ; @@ -571,7 +481,8 @@ function SPONSOR_SAVE_DATA($POST, $content) break; default: // Unknown sponsor what value! - $MSG = SPONSOR_UNKNOWN_WHAT_1.$HTTP_GET_VARS['what'].SPONSOR_UNKNOWN_WHAT_2; + DEBUG_LOG(__FUNCTION__, __LINE__, sprintf("Unknown sponsor module (what) %s detected.", $GLOBALS['what'])); + $MSG = SPONSOR_UNKNOWN_WHAT_1.$GLOBALS['what'].SPONSOR_UNKNOWN_WHAT_2; $templ = ""; $subj = ""; break; } @@ -588,23 +499,13 @@ function SPONSOR_SAVE_DATA($POST, $content) $DATA = $POST; // Change some data - if (isset($content['salut'])) $content['salut'] = TRANSLATE_SEX($content['salut']); - if (isset($DATA['salut'])) $DATA['salut'] = TRANSLATE_SEX($DATA['salut']); + if (isset($content['gender'])) $content['gender'] = TRANSLATE_GENDER($content['gender']); + if (isset($DATA['gender'])) $DATA['gender'] = TRANSLATE_GENDER($DATA['gender']); if (isset($content['receive_warnings'])) $DATA['receive'] = TRANSLATE_YESNO($POST['receive_warnings']); if (isset($content['warning_interval'])) $DATA['interval'] = CREATE_FANCY_TIME($POST['warning_interval']); // Send email to admins - if (GET_EXT_VERSION("admins") < "0.4.1") - { - // Use old method to send out - $msg = LOAD_EMAIL_TEMPLATE($templ, $content); - SEND_ADMIN_EMAILS($subj, $msg); - } - else - { - // Use new system to send out - SEND_ADMIN_EMAILS_PRO($subj, $templ, $content); - } + SEND_ADMIN_NOTIFICATION($subj, $templ, $content); // Shall we send mail to the sponsor's new email address? if ($content['receive_warnings'] == "Y") @@ -613,7 +514,7 @@ function SPONSOR_SAVE_DATA($POST, $content) // to the old address // First to old address - switch ($HTTP_GET_VARS['what']) + switch ($GLOBALS['what']) { case "account": // Change account data $email_msg = LOAD_EMAIL_TEMPLATE("sponsor_change_data", $content);