X-Git-Url: https://git.mxchange.org/?p=mailer.git;a=blobdiff_plain;f=inc%2Flibs%2Fuser_functions.php;h=fd534b8128a0d334ecba765c7842bee976f9669e;hp=cf44c26d78d3253107dbc67cbbc5be088769f77e;hb=56156f6c4392510cdbe0eb4f2ccefc23b43e2672;hpb=8a9324b2d931f54f54f4319fd7234910af77012c;ds=sidebyside diff --git a/inc/libs/user_functions.php b/inc/libs/user_functions.php index cf44c26d78..fd534b8128 100644 --- a/inc/libs/user_functions.php +++ b/inc/libs/user_functions.php @@ -32,68 +32,65 @@ ************************************************************************/ // Some security stuff... -if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) -{ +if (!defined('__SECURITY')) { $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php"; require($INC); } -function alpha($sortby, $colspan, $return=false) -{ - global $CONFIG; - if (empty($_GET['offset'])) $_GET['offset'] = "0"; - $ADD = "&page=".$_GET['page']."&offset=".$_GET['offset']; +// Add links for selecting some users +function alpha($sortby, $colspan, $return=false) { + global $_CONFIG; + if (empty($_GET['offset'])) $_GET['offset'] = 0; + $ADD = "&page=".SQL_ESCAPE($_GET['page'])."&offset=".SQL_ESCAPE($_GET['offset']); if (!empty($_GET['mode'])) $ADD .= "&mode=".SQL_ESCAPE($_GET['mode']); /* Creates the list of letters and makes them a link. */ - $alphabet = array(_ALL2, "A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", 'N', "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", 'Y', "Z", _OTHERS); + $alphabet = array(_ALL2,"A","B","C","D","E","F","G","H","I","J","K","L","M","N","O","P","Q","R","S","T","U","V","W","X","Y","Z",_OTHERS); $num = count($alphabet) - 1; $OUT = ""; - while (list($counter, $ltr) = each($alphabet)) - { - if ($_GET['letter'] == $ltr) - { + while (list($counter, $ltr) = each($alphabet)) { + if ($_GET['letter'] == $ltr) { // Current letter is letter from URL - $OUT .= "".$ltr.""; - } - else - { + $OUT .= "".$ltr.""; + } else { // Output link to letter - $OUT .= "".$ltr.""; + $OUT .= "&letter=".$ltr."&sortby=".$sortby.$ADD."\">".$ltr.""; } - if ((($counter / $CONFIG['user_alpha']) == round($counter / $CONFIG['user_alpha'])) && ($counter > 0)) - { + + if ((($counter / getConfig('user_alpha')) == round($counter / getConfig('user_alpha'))) && ($counter > 0)) { $OUT .= " ]
[ "; - } - elseif ( $counter != $num ) - { + } elseif ( $counter != $num ) { $OUT .= " | "; } - } + } // END - while + define('__ALPHA_LIST', $OUT); // Load template $OUT = LOAD_TEMPLATE("admin_list_user_alpha", true); - if ($return) - { + if ($return) { // Return generated code return $OUT; - } - else - { + } else { // Output generated code OUTPUT_HTML($OUT); } } -// -function SortLinks($letter, $sortby, $colspan, $return=false) -{ + +// Add links for sorting +function SortLinks($letter, $sortby, $colspan, $return=false) { $OUT = ""; - if (empty($_GET['offset'])) $_GET['offset'] = "0"; - $ADD = "&page=".$_GET['page']."&offset=".$_GET['offset']; - if (!empty($_GET['mode'])) $ADD .= "&mode=".SQL_ESCAPE($_GET['mode']); + if (empty($_GET['offset'])) $_GET['offset'] = 0; + if (empty($_GET['page'])) $_GET['page'] = 0; + + // Add page and offset + $ADD = "&page=".SQL_ESCAPE($_GET['page'])."&offset=".SQL_ESCAPE($_GET['offset']); + + // Add status or mode + if (!empty($_GET['status'])) $ADD .= "&mode=".SQL_ESCAPE($_GET['status']); + elseif (!empty($_GET['mode'])) $ADD .= "&mode=".SQL_ESCAPE($_GET['mode']); // Makes order by links.. if ($letter == "front") $letter = _ALL2; @@ -111,110 +108,107 @@ function SortLinks($letter, $sortby, $colspan, $return=false) $list['nickname'] = NICKNAME; } - foreach ($list as $sort=>$title) { + foreach ($list as $sort => $title) { if ($sortby == $sort) { - $OUT .= "".$title." | "; + $OUT .= "".$title." | "; } else { - $OUT .= "".$title." | "; + $OUT .= "".$title." | "; } - } + } // END - foreach + define('__SORT_LIST', substr($OUT, 0, -13)); // Load template $OUT = LOAD_TEMPLATE("admin_list_user_sort", true); - if ($return) - { + if ($return) { // Return code return $OUT; - } - else - { + } else { // Output code OUTPUT_HTML($OUT); } } -// -function ADD_PAGENAV($PAGES, $offset, $show_form, $colspan,$return=false) -{ - if (!$show_form) - { + +// Add page navigation +function ADD_PAGENAV($PAGES, $offset, $show_form, $colspan,$return=false) { + if (!$show_form) { // Empty row define('__FORM_HEADER', " "); - } - else - { + } else { // Load form for changing number of lines define('__FORM_HEADER', LOAD_TEMPLATE("admin_list_user_sort_form", true)); } - if (!$show_form) - { + + if (!$show_form) { // Add line with bottom border define('__FORM_FOOTER', " "); - } - else - { + } else { // Add line without bottom border define('__FORM_FOOTER', " "); } $OUT = ""; - for ($page = 1; $page <= $PAGES; $page++) - { - if (($page == $_GET['page']) || ((empty($_GET['page'])) && ($page == "1"))) - { - $OUT .= "-"; - } - else - { + for ($page = 1; $page <= $PAGES; $page++) { + if (($page == $_GET['page']) || ((empty($_GET['page'])) && ($page == "1"))) { + $OUT .= "-"; + } else { if (empty($_GET['letter'])) $_GET['letter'] = _ALL2; if (empty($_GET['sortby'])) $_GET['sortby'] = "userid"; - $OUT .= ""; + + // Base link + $OUT .= ""; } + $OUT .= $page; - if (($page == $_GET['page']) || ((empty($_GET['page'])) && ($page == "1"))) - { - $OUT .= "-"; - } - else - { - $OUT .= ""; + + if (($page == $_GET['page']) || ((empty($_GET['page'])) && ($page == "1"))) { + $OUT .= "-"; + } else { + $OUT .= ""; } + if ($page < $PAGES) $OUT .= " | "; - } + } // END - for + define('__PAGENAV_LIST', $OUT); // Load template $OUT = LOAD_TEMPLATE("admin_list_user_pagenav", true); - if ($return) - { + if ($return) { // Return code return $OUT; - } - else - { + } else { // Output code OUTPUT_HTML($OUT); } } + // Create email link to user's account -function USER_CREATE_EMAIL_LINK($email, $mod="admin") -{ +function USER_CREATE_EMAIL_LINK($email, $mod="admin") { + // Show contact link only if user is confirmed by default $locked = " AND status='CONFIRMED'"; + + // But admins shall always see it if (IS_ADMIN()) $locked = ""; + $result = SQL_QUERY_ESC("SELECT userid FROM "._MYSQL_PREFIX."_user_data WHERE email='%s'".$locked." LIMIT 1", array($email), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + if (SQL_NUMROWS($result) == 1) { // Load userid list($uid) = SQL_FETCHROW($result); // Rewrite email address to contact link $email = URL."/modules.php?module=".$mod."&what=user_contct&u_id=".bigintval($uid); - } + } // END - if // Free memory SQL_FREERESULT($result); @@ -222,5 +216,244 @@ WHERE email='%s'".$locked." LIMIT 1", // Return rewritten (?) email address return $email; } -// + +// Selects a random user id as the new referal id if they have at least X confirmed mails in this run +function SELECT_RANDOM_REFID () { + global $_CONFIG; + + // Default is zero refid + $refid = 0; + + // Is the extension version fine? + if (GET_EXT_VERSION("user") >= "0.3.4") { + // Get all user ids + $totalUsers = GET_TOTAL_DATA("CONFIRMED", "user_data", "userid", "status", true, " AND `rand_confirmed` >= ".getConfig('user_min_confirmed').""); + + // Do we have at least one? + if ($totalUsers > 0) { + // Then choose random number + $randNum = mt_rand(0, ($totalUsers - 1)); + + // Look for random user + $result = SQL_QUERY_ESC("SELECT `userid` FROM `"._MYSQL_PREFIX."_user_data` WHERE `status`='CONFIRMED' AND `rand_confirmed` >= %s ORDER BY `rand_confirmed` DESC LIMIT %s, 1", + array(getConfig('user_min_confirmed'), $randNum), __FILE__, __LINE__); + + // Do we have one entry there? + if (SQL_NUMROWS($result) == 1) { + // Use that userid as new referal id + list($refid) = SQL_FETCHROW($result); + + // Reset this user's counter + SQL_QUERY_ESC("UPDATE `"._MYSQL_PREFIX."_user_data` SET `rand_confirmed`=0 WHERE userid=%s LIMIT 1", + array($refid), __FILE__, __LINE__); + } // END - if + + // Free result + SQL_FREERESULT($result); + } // END - if + } // END - if + + // Return result + return $refid; +} + +// Do the user login +function USER_DO_LOGIN ($uid, $passwd) { + // Add last_login if available + $LAST = ""; + if (GET_EXT_VERSION("sql_patches") >= "0.2.8") { + $LAST = ", last_login"; + } // END - if + + // Check login data + $password = ""; $uid2 = ""; $dmy = ""; $online = 0; $login = 0; + if ((EXT_IS_ACTIVE("nickname")) && (NICKNAME_PROBE_ON_USERID($uid))) { + // Nickname entered + $result = SQL_QUERY_ESC("SELECT userid, password, last_online".$LAST." FROM `"._MYSQL_PREFIX."_user_data` WHERE nickname='%s' AND status='CONFIRMED' LIMIT 1", + array($uid), __FILE__, __LINE__); + list($uid2, $password, $online, $login) = SQL_FETCHROW($result); + if (!empty($uid2)) $uid = bigintval($uid2); + } else { + // Direct userid entered + $result = SQL_QUERY_ESC("SELECT userid, password, last_online".$LAST." FROM `"._MYSQL_PREFIX."_user_data` WHERE userid=%s AND status='CONFIRMED' LIMIT 1", + array($uid, $hash), __FILE__, __LINE__); + list($uid2, $password, $online, $login) = SQL_FETCHROW($result); + } + + // Is there an entry? + if ((SQL_NUMROWS($result) == 1) && ((($probe_nickname) && (!empty($uid2))) || ($uid2 == $uid))) { + // Free result + SQL_FREERESULT($result); + + // By default the hash is empty + $hash = ""; + + // Check for old MD5 passwords + if ((strlen($password) == 32) && (md5($passwd) == $password)) { + // Just set the hash to the password from DB... :) + $hash = $password; + } else { + // Hash password with improved way for comparsion + $hash = generateHash($passwd, substr($password, 0, -40)); + } + + if ($hash == $password) { + // New hashed password found so let's generate a new one + $hash = generateHash($passwd); + + // ... and update database + SQL_QUERY_ESC("UPDATE `"._MYSQL_PREFIX."_user_data` SET password='%s' WHERE userid=%s AND status='CONFIRMED' LIMIT 1", + array($hash, $uid), __FILE__, __LINE__); + + // No login bonus by default + // @TODO Make this filter working: $ADDON = RUN_FILTER('post_login_update', array('login' => $login, 'online' => $online)); + $BONUS = false; + + // Probe for last online timemark + $probe = time() - $online; + if (!empty($login)) $probe = time() - $login; + if ((GET_EXT_VERSION("bonus") >= "0.2.2") && ($probe >= getConfig('login_timeout'))) { + // Add login bonus to user's account + $ADD = sprintf(", login_bonus=login_bonus+%s", + (float)getConfig('login_bonus') + ); + $BONUS = true; + + // Subtract login bonus from userid's account or jackpot + if ((GET_EXT_VERSION("bonus") >= "0.3.5") && (getConfig('bonus_mode') != "ADD")) BONUS_POINTS_HANDLER('login_bonus'); + } // END - if + + // Init variables + $login = false; + + // Calculate new hash with the secret key and master salt together + $hash = generatePassString($hash); + + // Update global array + // @TODO Make this filter working: $URL = RUN_FILTER('do_login', array('uid' => $uid, 'hash' => $hash, 'addon' => $ADDON)); + $GLOBALS['userid'] = $uid; + + // Try to set session data (which shall normally always work!) + if ((set_session('userid', $uid )) && (set_session('u_hash', $hash))) { + // Update database records + SQL_QUERY_ESC("UPDATE `"._MYSQL_PREFIX."_user_data` SET total_logins=total_logins+1".$ADD." WHERE userid=%s LIMIT 1", + array($uid), __FILE__, __LINE__); + if (SQL_AFFECTEDROWS() == 1) { + // Procedure to checking for login data + if (($BONUS) && (EXT_IS_ACTIVE("bonus"))) { + // Bonus added (just displaying!) + $URL = "modules.php?module=chk_login&mode=bonus"; + } else { + // Bonus not added + $URL = "modules.php?module=chk_login&mode=login"; + } + } else { + // Cannot update counter! + $URL = "modules.php?module=index&what=login&login=".CODE_CNTR_FAILED; + } + } else { + // Cookies not setable! + $URL = "modules.php?module=index&what=login&login=".CODE_NO_COOKIES; + } + } elseif (GET_EXT_VERSION("sql_patches") >= "0.4.7") { + // Update failture counter + SQL_QUERY_ESC("UPDATE `"._MYSQL_PREFIX."_user_data` SET login_failtures=login_failtures+1,last_failture=NOW() WHERE userid=%s LIMIT 1", + array($uid), __FILE__, __LINE__); + + // Wrong password! + $URL = "modules.php?module=index&what=login&login=".CODE_WRONG_PASS; + } + } elseif ((($probe_nickname) && (!empty($uid2))) || ($uid2 == $uid)) { + // Other account status? + // @TODO Can this query be saved??? + $result = SQL_QUERY_ESC("SELECT status FROM `"._MYSQL_PREFIX."_user_data` WHERE userid=%s LIMIT 1", + array($uid), __FILE__, __LINE__); + + // Entry found? + if (SQL_NUMROWS($result) == 1) { + // Load status + list($status) = SQL_FETCHROW($result); + + // Create an error code from given status + $ERROR = GEN_ERROR_CODE_FROM_ACCOUNT_STATUS($status); + } else { + // ID not found! + $ERROR = CODE_WRONG_ID; + } + + // Construct URL + $URL = "modules.php?module=index&what=login&login=".$ERROR; + } else { + // ID not found! + $URL = "modules.php?module=index&what=login&login=".CODE_WRONG_ID; + } + + // Return URL + return $URL; +} + +// Try to send a new password for the given user account +function USER_DO_NEW_PASSWORD ($email, $uid) { + // Compile email when found in address (only secure chars!) + if (!empty($email)) $email = str_replace("{DOT}", '.', $email); + + // Init result and error + $ERROR = ""; + $result = false; + + // Probe userid/nickname + if ((EXT_IS_ACTIVE("nickname")) && (NICKNAME_PROBE_ON_USERID($uid))) { + // Nickname entered + $result = SQL_QUERY_ESC("SELECT userid, status FROM `"._MYSQL_PREFIX."_user_data` WHERE nickname='%s' OR email='%s' LIMIT 1", + array($uid, $email), __FILE__, __LINE__); + } elseif (($uid > 0) && (empty($email))) { + // Direct userid entered + $result = SQL_QUERY_ESC("SELECT userid, status FROM `"._MYSQL_PREFIX."_user_data` WHERE userid=%s LIMIT 1", + array(bigintval($uid)), __FILE__, __LINE__); + } elseif (!empty($email)) { + // Email entered + $result = SQL_QUERY_ESC("SELECT userid, status FROM `"._MYSQL_PREFIX."_user_data` WHERE email='%s' LIMIT 1", + array($email), __FILE__, __LINE__); + } else { + // Userid not set! + DEBUG_LOG(__FUNCTION__, __LINE__, "Userid is not set! BUG!"); + $ERROR = CODE_WRONG_ID; + } + + // Any entry found? + if (SQL_NUMROWS($result) == 1) { + // This data is valid, so we create a new pass... :-) + list($uid, $status) = SQL_FETCHROW($result); + + if ($status == "CONFIRMED") { + // Ooppps, this was missing! ;-) We should update the database... + $NEW_PASS = GEN_PASS(); + SQL_QUERY_ESC("UPDATE `"._MYSQL_PREFIX."_user_data` SET password='%s' WHERE userid=%s LIMIT 1", + array(generateHash($NEW_PASS), $uid), __FILE__, __LINE__); + + // Prepare data and message for email + $msg = LOAD_EMAIL_TEMPLATE("new-pass", array('new_pass' => $NEW_PASS), $uid); + + // ... and send it away + SEND_EMAIL($uid, GUEST_NEW_PASSWORD, $msg); + + // Output note to user + LOAD_TEMPLATE("admin_settings_saved", false, GUEST_NEW_PASSWORD_SEND); + } else { + // Account is locked or unconfirmed + $ERROR = GEN_ERROR_CODE_FROM_ACCOUNT_STATUS($status); + + // Load URL + LOAD_URL("modules.php?module=index&what=login&login=".$ERROR); + } + } else { + // ID or email is wrong + LOAD_TEMPLATE("admin_settings_saved", false, "".GUEST_WRONG_ID_EMAIL.""); + } + + // Return the error code + return $ERROR; +} + +// [EOF] ?>