Register.php 32 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855
  1. <?php
  2. /**
  3. * This file has two main jobs, but they really are one. It registers new
  4. * members, and it helps the administrator moderate member registrations.
  5. * Similarly, it handles account activation as well.
  6. *
  7. * Simple Machines Forum (SMF)
  8. *
  9. * @package SMF
  10. * @author Simple Machines http://www.simplemachines.org
  11. * @copyright 2011 Simple Machines
  12. * @license http://www.simplemachines.org/about/smf/license.php BSD
  13. *
  14. * @version 2.1 Alpha 1
  15. */
  16. if (!defined('SMF'))
  17. die('Hacking attempt...');
  18. /**
  19. * Begin the registration process.
  20. *
  21. * @param array $reg_errors = array()
  22. */
  23. function Register($reg_errors = array())
  24. {
  25. global $txt, $boarddir, $context, $settings, $modSettings, $user_info;
  26. global $language, $scripturl, $smcFunc, $sourcedir, $smcFunc, $cur_profile;
  27. // Is this an incoming AJAX check?
  28. if (isset($_GET['sa']) && $_GET['sa'] === 'usernamecheck')
  29. return RegisterCheckUsername();
  30. // Check if the administrator has it disabled.
  31. if (!empty($modSettings['registration_method']) && $modSettings['registration_method'] == '3')
  32. fatal_lang_error('registration_disabled', false);
  33. // If this user is an admin - redirect them to the admin registration page.
  34. if (allowedTo('moderate_forum') && !$user_info['is_guest'])
  35. redirectexit('action=admin;area=regcenter;sa=register');
  36. // You are not a guest, so you are a member - and members don't get to register twice!
  37. elseif (empty($user_info['is_guest']))
  38. redirectexit();
  39. loadLanguage('Login');
  40. loadTemplate('Register');
  41. // Do we need them to agree to the registration agreement, first?
  42. $context['require_agreement'] = !empty($modSettings['requireAgreement']);
  43. $context['registration_passed_agreement'] = !empty($_SESSION['registration_agreed']);
  44. $context['show_coppa'] = !empty($modSettings['coppaAge']);
  45. // Under age restrictions?
  46. if ($context['show_coppa'])
  47. {
  48. $context['skip_coppa'] = false;
  49. $context['coppa_agree_above'] = sprintf($txt[($context['require_agreement'] ? 'agreement_' : '') . 'agree_coppa_above'], $modSettings['coppaAge']);
  50. $context['coppa_agree_below'] = sprintf($txt[($context['require_agreement'] ? 'agreement_' : '') . 'agree_coppa_below'], $modSettings['coppaAge']);
  51. }
  52. // What step are we at?
  53. $current_step = isset($_REQUEST['step']) ? (int) $_REQUEST['step'] : ($context['require_agreement'] ? 1 : 2);
  54. // Does this user agree to the registation agreement?
  55. if ($current_step == 1 && (isset($_POST['accept_agreement']) || isset($_POST['accept_agreement_coppa'])))
  56. {
  57. $context['registration_passed_agreement'] = $_SESSION['registration_agreed'] = true;
  58. $current_step = 2;
  59. // Skip the coppa procedure if the user says he's old enough.
  60. if ($context['show_coppa'])
  61. {
  62. $_SESSION['skip_coppa'] = !empty($_POST['accept_agreement']);
  63. // Are they saying they're under age, while under age registration is disabled?
  64. if (empty($modSettings['coppaType']) && empty($_SESSION['skip_coppa']))
  65. {
  66. loadLanguage('Login');
  67. fatal_lang_error('under_age_registration_prohibited', false, array($modSettings['coppaAge']));
  68. }
  69. }
  70. }
  71. // Make sure they don't squeeze through without agreeing.
  72. elseif ($current_step > 1 && $context['require_agreement'] && !$context['registration_passed_agreement'])
  73. $current_step = 1;
  74. // Show the user the right form.
  75. $context['sub_template'] = $current_step == 1 ? 'registration_agreement' : 'registration_form';
  76. $context['page_title'] = $current_step == 1 ? $txt['registration_agreement'] : $txt['registration_form'];
  77. // Add the register chain to the link tree.
  78. $context['linktree'][] = array(
  79. 'url' => $scripturl . '?action=register',
  80. 'name' => $txt['register'],
  81. );
  82. // If you have to agree to the agreement, it needs to be fetched from the file.
  83. if ($context['require_agreement'])
  84. {
  85. // Have we got a localized one?
  86. if (file_exists($boarddir . '/agreement.' . $user_info['language'] . '.txt'))
  87. $context['agreement'] = parse_bbc(file_get_contents($boarddir . '/agreement.' . $user_info['language'] . '.txt'), true, 'agreement_' . $user_info['language']);
  88. elseif (file_exists($boarddir . '/agreement.txt'))
  89. $context['agreement'] = parse_bbc(file_get_contents($boarddir . '/agreement.txt'), true, 'agreement');
  90. else
  91. $context['agreement'] = '';
  92. }
  93. if (!empty($modSettings['userLanguage']))
  94. {
  95. $selectedLanguage = empty($_SESSION['language']) ? $language : $_SESSION['language'];
  96. // Do we have any languages?
  97. if (empty($context['languages']))
  98. getLanguages();
  99. // Try to find our selected language.
  100. foreach ($context['languages'] as $key => $lang)
  101. {
  102. $context['languages'][$key]['name'] = strtr($lang['name'], array('-utf8' => ''));
  103. // Found it!
  104. if ($selectedLanguage == $lang['filename'])
  105. $context['languages'][$key]['selected'] = true;
  106. }
  107. }
  108. // Any custom fields we want filled in?
  109. require_once($sourcedir . '/Profile.php');
  110. loadCustomFields(0, 'register');
  111. // Or any standard ones?
  112. if (!empty($modSettings['registration_fields']))
  113. {
  114. require_once($sourcedir . '/Profile-Modify.php');
  115. // Setup some important context.
  116. loadLanguage('Profile');
  117. loadTemplate('Profile');
  118. $context['user']['is_owner'] = true;
  119. // Here, and here only, emulate the permissions the user would have to do this.
  120. $user_info['permissions'] = array_merge($user_info['permissions'], array('profile_account_own', 'profile_extra_own'));
  121. $reg_fields = explode(',', $modSettings['registration_fields']);
  122. // We might have had some submissions on this front - go check.
  123. foreach ($reg_fields as $field)
  124. if (isset($_POST[$field]))
  125. $cur_profile[$field] = $smcFunc['htmlspecialchars']($_POST[$field]);
  126. // Load all the fields in question.
  127. setupProfileContext($reg_fields);
  128. }
  129. // Generate a visual verification code to make sure the user is no bot.
  130. if (!empty($modSettings['reg_verification']))
  131. {
  132. require_once($sourcedir . '/Subs-Editor.php');
  133. $verificationOptions = array(
  134. 'id' => 'register',
  135. );
  136. $context['visual_verification'] = create_control_verification($verificationOptions);
  137. $context['visual_verification_id'] = $verificationOptions['id'];
  138. }
  139. // Otherwise we have nothing to show.
  140. else
  141. $context['visual_verification'] = false;
  142. // Are they coming from an OpenID login attempt?
  143. if (!empty($_SESSION['openid']['verified']) && !empty($_SESSION['openid']['openid_uri']))
  144. {
  145. $context['openid'] = $_SESSION['openid']['openid_uri'];
  146. $context['username'] = $smcFunc['htmlspecialchars'](!empty($_POST['user']) ? $_POST['user'] : $_SESSION['openid']['nickname']);
  147. $context['email'] = $smcFunc['htmlspecialchars'](!empty($_POST['email']) ? $_POST['email'] : $_SESSION['openid']['email']);
  148. }
  149. // See whether we have some prefiled values.
  150. else
  151. {
  152. $context += array(
  153. 'openid' => isset($_POST['openid_identifier']) ? $_POST['openid_identifier'] : '',
  154. 'username' => isset($_POST['user']) ? $smcFunc['htmlspecialchars']($_POST['user']) : '',
  155. 'email' => isset($_POST['email']) ? $smcFunc['htmlspecialchars']($_POST['email']) : '',
  156. );
  157. }
  158. // @todo Why isn't this a simple set operation?
  159. // Were there any errors?
  160. $context['registration_errors'] = array();
  161. if (!empty($reg_errors))
  162. foreach ($reg_errors as $error)
  163. $context['registration_errors'][] = $error;
  164. createToken('register');
  165. }
  166. /**
  167. * Actually register the member.
  168. *
  169. * @param bool $verifiedOpenID = false
  170. */
  171. function Register2($verifiedOpenID = false)
  172. {
  173. global $scripturl, $txt, $modSettings, $context, $sourcedir;
  174. global $user_info, $options, $settings, $smcFunc;
  175. checkSession();
  176. validateToken('register');
  177. // Start collecting together any errors.
  178. $reg_errors = array();
  179. // Did we save some open ID fields?
  180. if ($verifiedOpenID && !empty($context['openid_save_fields']))
  181. {
  182. foreach ($context['openid_save_fields'] as $id => $value)
  183. $_POST[$id] = $value;
  184. }
  185. // You can't register if it's disabled.
  186. if (!empty($modSettings['registration_method']) && $modSettings['registration_method'] == 3)
  187. fatal_lang_error('registration_disabled', false);
  188. // Things we don't do for people who have already confirmed their OpenID allegances via register.
  189. if (!$verifiedOpenID)
  190. {
  191. // Well, if you don't agree, you can't register.
  192. if (!empty($modSettings['requireAgreement']) && empty($_SESSION['registration_agreed']))
  193. redirectexit();
  194. // Make sure they came from *somewhere*, have a session.
  195. if (!isset($_SESSION['old_url']))
  196. redirectexit('action=register');
  197. // If we don't require an agreement, we need a extra check for coppa.
  198. if (empty($modSettings['requireAgreement']) && !empty($modSettings['coppaAge']))
  199. $_SESSION['skip_coppa'] = !empty($_POST['accept_agreement']);
  200. // Are they under age, and under age users are banned?
  201. if (!empty($modSettings['coppaAge']) && empty($modSettings['coppaType']) && empty($_SESSION['skip_coppa']))
  202. {
  203. // @todo This should be put in Errors, imho.
  204. loadLanguage('Login');
  205. fatal_lang_error('under_age_registration_prohibited', false, array($modSettings['coppaAge']));
  206. }
  207. // Check whether the visual verification code was entered correctly.
  208. if (!empty($modSettings['reg_verification']))
  209. {
  210. require_once($sourcedir . '/Subs-Editor.php');
  211. $verificationOptions = array(
  212. 'id' => 'register',
  213. );
  214. $context['visual_verification'] = create_control_verification($verificationOptions, true);
  215. if (is_array($context['visual_verification']))
  216. {
  217. loadLanguage('Errors');
  218. foreach ($context['visual_verification'] as $error)
  219. $reg_errors[] = $txt['error_' . $error];
  220. }
  221. }
  222. }
  223. foreach ($_POST as $key => $value)
  224. {
  225. if (!is_array($_POST[$key]))
  226. $_POST[$key] = htmltrim__recursive(str_replace(array("\n", "\r"), '', $_POST[$key]));
  227. }
  228. // Collect all extra registration fields someone might have filled in.
  229. $possible_strings = array(
  230. 'website_url', 'website_title',
  231. 'aim', 'yim',
  232. 'location', 'birthdate',
  233. 'time_format',
  234. 'buddy_list',
  235. 'pm_ignore_list',
  236. 'smiley_set',
  237. 'signature', 'personal_text', 'avatar',
  238. 'lngfile',
  239. 'secret_question', 'secret_answer',
  240. );
  241. $possible_ints = array(
  242. 'pm_email_notify',
  243. 'notify_types',
  244. 'icq',
  245. 'gender',
  246. 'id_theme',
  247. );
  248. $possible_floats = array(
  249. 'time_offset',
  250. );
  251. $possible_bools = array(
  252. 'notify_announcements', 'notify_regularity', 'notify_send_body',
  253. 'hide_email', 'show_online',
  254. );
  255. if (isset($_POST['secret_answer']) && $_POST['secret_answer'] != '')
  256. $_POST['secret_answer'] = md5($_POST['secret_answer']);
  257. // Needed for isReservedName() and registerMember().
  258. require_once($sourcedir . '/Subs-Members.php');
  259. // Validation... even if we're not a mall.
  260. if (isset($_POST['real_name']) && (!empty($modSettings['allow_editDisplayName']) || allowedTo('moderate_forum')))
  261. {
  262. $_POST['real_name'] = trim(preg_replace('~[\s]~' . ($context['utf8'] ? 'u' : ''), ' ', $_POST['real_name']));
  263. if (trim($_POST['real_name']) != '' && !isReservedName($_POST['real_name']) && $smcFunc['strlen']($_POST['real_name']) < 60)
  264. $possible_strings[] = 'real_name';
  265. }
  266. if (isset($_POST['msn']) && preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', $_POST['msn']) != 0)
  267. $profile_strings[] = 'msn';
  268. // Handle a string as a birthdate...
  269. if (isset($_POST['birthdate']) && $_POST['birthdate'] != '')
  270. $_POST['birthdate'] = strftime('%Y-%m-%d', strtotime($_POST['birthdate']));
  271. // Or birthdate parts...
  272. elseif (!empty($_POST['bday1']) && !empty($_POST['bday2']))
  273. $_POST['birthdate'] = sprintf('%04d-%02d-%02d', empty($_POST['bday3']) ? 0 : (int) $_POST['bday3'], (int) $_POST['bday1'], (int) $_POST['bday2']);
  274. // By default assume email is hidden, only show it if we tell it to.
  275. $_POST['hide_email'] = !empty($_POST['allow_email']) ? 0 : 1;
  276. // Validate the passed language file.
  277. if (isset($_POST['lngfile']) && !empty($modSettings['userLanguage']))
  278. {
  279. // Do we have any languages?
  280. if (empty($context['languages']))
  281. getLanguages();
  282. // Did we find it?
  283. if (isset($context['languages'][$_POST['lngfile']]))
  284. $_SESSION['language'] = $_POST['lngfile'];
  285. else
  286. unset($_POST['lngfile']);
  287. }
  288. else
  289. unset($_POST['lngfile']);
  290. // Set the options needed for registration.
  291. $regOptions = array(
  292. 'interface' => 'guest',
  293. 'username' => !empty($_POST['user']) ? $_POST['user'] : '',
  294. 'email' => !empty($_POST['email']) ? $_POST['email'] : '',
  295. 'password' => !empty($_POST['passwrd1']) ? $_POST['passwrd1'] : '',
  296. 'password_check' => !empty($_POST['passwrd2']) ? $_POST['passwrd2'] : '',
  297. 'openid' => !empty($_POST['openid_identifier']) ? $_POST['openid_identifier'] : '',
  298. 'auth_method' => !empty($_POST['authenticate']) ? $_POST['authenticate'] : '',
  299. 'check_reserved_name' => true,
  300. 'check_password_strength' => true,
  301. 'check_email_ban' => true,
  302. 'send_welcome_email' => !empty($modSettings['send_welcomeEmail']),
  303. 'require' => !empty($modSettings['coppaAge']) && !$verifiedOpenID && empty($_SESSION['skip_coppa']) ? 'coppa' : (empty($modSettings['registration_method']) ? 'nothing' : ($modSettings['registration_method'] == 1 ? 'activation' : 'approval')),
  304. 'extra_register_vars' => array(),
  305. 'theme_vars' => array(),
  306. );
  307. // Include the additional options that might have been filled in.
  308. foreach ($possible_strings as $var)
  309. if (isset($_POST[$var]))
  310. $regOptions['extra_register_vars'][$var] = $smcFunc['htmlspecialchars']($_POST[$var], ENT_QUOTES);
  311. foreach ($possible_ints as $var)
  312. if (isset($_POST[$var]))
  313. $regOptions['extra_register_vars'][$var] = (int) $_POST[$var];
  314. foreach ($possible_floats as $var)
  315. if (isset($_POST[$var]))
  316. $regOptions['extra_register_vars'][$var] = (float) $_POST[$var];
  317. foreach ($possible_bools as $var)
  318. if (isset($_POST[$var]))
  319. $regOptions['extra_register_vars'][$var] = empty($_POST[$var]) ? 0 : 1;
  320. // Registration options are always default options...
  321. if (isset($_POST['default_options']))
  322. $_POST['options'] = isset($_POST['options']) ? $_POST['options'] + $_POST['default_options'] : $_POST['default_options'];
  323. $regOptions['theme_vars'] = isset($_POST['options']) && is_array($_POST['options']) ? $_POST['options'] : array();
  324. // Make sure they are clean, dammit!
  325. $regOptions['theme_vars'] = htmlspecialchars__recursive($regOptions['theme_vars']);
  326. // If Quick Reply hasn't been set then set it to be shown but collapsed.
  327. if (!isset($regOptions['theme_vars']['display_quick_reply']))
  328. $regOptions['theme_vars']['display_quick_reply'] = 1;
  329. // Check whether we have fields that simply MUST be displayed?
  330. $request = $smcFunc['db_query']('', '
  331. SELECT col_name, field_name, field_type, field_length, mask, show_reg
  332. FROM {db_prefix}custom_fields
  333. WHERE active = {int:is_active}',
  334. array(
  335. 'is_active' => 1,
  336. )
  337. );
  338. $custom_field_errors = array();
  339. while ($row = $smcFunc['db_fetch_assoc']($request))
  340. {
  341. // Don't allow overriding of the theme variables.
  342. if (isset($regOptions['theme_vars'][$row['col_name']]))
  343. unset($regOptions['theme_vars'][$row['col_name']]);
  344. // Not actually showing it then?
  345. if (!$row['show_reg'])
  346. continue;
  347. // Prepare the value!
  348. $value = isset($_POST['customfield'][$row['col_name']]) ? trim($_POST['customfield'][$row['col_name']]) : '';
  349. // We only care for text fields as the others are valid to be empty.
  350. if (!in_array($row['field_type'], array('check', 'select', 'radio')))
  351. {
  352. // Is it too long?
  353. if ($row['field_length'] && $row['field_length'] < $smcFunc['strlen']($value))
  354. $custom_field_errors[] = array('custom_field_too_long', array($row['field_name'], $row['field_length']));
  355. // Any masks to apply?
  356. if ($row['field_type'] == 'text' && !empty($row['mask']) && $row['mask'] != 'none')
  357. {
  358. // @todo We never error on this - just ignore it at the moment...
  359. if ($row['mask'] == 'email' && (preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', $value) === 0 || strlen($value) > 255))
  360. $custom_field_errors[] = array('custom_field_invalid_email', array($row['field_name']));
  361. elseif ($row['mask'] == 'number' && preg_match('~[^\d]~', $value))
  362. $custom_field_errors[] = array('custom_field_not_number', array($row['field_name']));
  363. elseif (strpos($row['mask'], 'regex') === 0 && preg_match(substr($row['mask'], 5), $value) === 0)
  364. $custom_field_errors[] = array('custom_field_inproper_format', array($row['field_name']));
  365. }
  366. }
  367. // Is this required but not there?
  368. if (trim($value) == '' && $row['show_reg'] > 1)
  369. $custom_field_errors[] = array('custom_field_empty', array($row['field_name']));
  370. }
  371. $smcFunc['db_free_result']($request);
  372. // Process any errors.
  373. if (!empty($custom_field_errors))
  374. {
  375. loadLanguage('Errors');
  376. foreach ($custom_field_errors as $error)
  377. $reg_errors[] = vsprintf($txt['error_' . $error[0]], $error[1]);
  378. }
  379. // Lets check for other errors before trying to register the member.
  380. if (!empty($reg_errors))
  381. {
  382. $_REQUEST['step'] = 2;
  383. return Register($reg_errors);
  384. }
  385. // If they're wanting to use OpenID we need to validate them first.
  386. if (empty($_SESSION['openid']['verified']) && !empty($_POST['authenticate']) && $_POST['authenticate'] == 'openid')
  387. {
  388. // What do we need to save?
  389. $save_variables = array();
  390. foreach ($_POST as $k => $v)
  391. if (!in_array($k, array('sc', 'sesc', $context['session_var'], 'passwrd1', 'passwrd2', 'regSubmit')))
  392. $save_variables[$k] = $v;
  393. require_once($sourcedir . '/Subs-OpenID.php');
  394. smf_openID_validate($_POST['openid_identifier'], false, $save_variables);
  395. }
  396. // If we've come from OpenID set up some default stuff.
  397. elseif ($verifiedOpenID || (!empty($_POST['openid_identifier']) && $_POST['authenticate'] == 'openid'))
  398. {
  399. $regOptions['username'] = !empty($_POST['user']) && trim($_POST['user']) != '' ? $_POST['user'] : $_SESSION['openid']['nickname'];
  400. $regOptions['email'] = !empty($_POST['email']) && trim($_POST['email']) != '' ? $_POST['email'] : $_SESSION['openid']['email'];
  401. $regOptions['auth_method'] = 'openid';
  402. $regOptions['openid'] = !empty($_POST['openid_identifier']) ? $_POST['openid_identifier'] : $_SESSION['openid']['openid_uri'];
  403. }
  404. $memberID = registerMember($regOptions, true);
  405. // What there actually an error of some kind dear boy?
  406. if (is_array($memberID))
  407. {
  408. $reg_errors = array_merge($reg_errors, $memberID);
  409. $_REQUEST['step'] = 2;
  410. return Register($reg_errors);
  411. }
  412. // Do our spam protection now.
  413. spamProtection('register');
  414. // We'll do custom fields after as then we get to use the helper function!
  415. if (!empty($_POST['customfield']))
  416. {
  417. require_once($sourcedir . '/Profile.php');
  418. require_once($sourcedir . '/Profile-Modify.php');
  419. makeCustomFieldChanges($memberID, 'register');
  420. }
  421. // If COPPA has been selected then things get complicated, setup the template.
  422. if (!empty($modSettings['coppaAge']) && empty($_SESSION['skip_coppa']))
  423. redirectexit('action=coppa;member=' . $memberID);
  424. // Basic template variable setup.
  425. elseif (!empty($modSettings['registration_method']))
  426. {
  427. loadTemplate('Register');
  428. $context += array(
  429. 'page_title' => $txt['register'],
  430. 'title' => $txt['registration_successful'],
  431. 'sub_template' => 'after',
  432. 'description' => $modSettings['registration_method'] == 2 ? $txt['approval_after_registration'] : $txt['activate_after_registration']
  433. );
  434. }
  435. else
  436. {
  437. call_integration_hook('integrate_activate', array($row['member_name']));
  438. setLoginCookie(60 * $modSettings['cookieTime'], $memberID, sha1(sha1(strtolower($regOptions['username']) . $regOptions['password']) . $regOptions['register_vars']['password_salt']));
  439. redirectexit('action=login2;sa=check;member=' . $memberID, $context['server']['needs_login_fix']);
  440. }
  441. }
  442. /**
  443. * @todo needs description
  444. */
  445. function Activate()
  446. {
  447. global $context, $txt, $modSettings, $scripturl, $sourcedir, $smcFunc, $language;
  448. loadLanguage('Login');
  449. loadTemplate('Login');
  450. if (empty($_REQUEST['u']) && empty($_POST['user']))
  451. {
  452. if (empty($modSettings['registration_method']) || $modSettings['registration_method'] == '3')
  453. fatal_lang_error('no_access', false);
  454. $context['member_id'] = 0;
  455. $context['sub_template'] = 'resend';
  456. $context['page_title'] = $txt['invalid_activation_resend'];
  457. $context['can_activate'] = empty($modSettings['registration_method']) || $modSettings['registration_method'] == '1';
  458. $context['default_username'] = isset($_GET['user']) ? $_GET['user'] : '';
  459. return;
  460. }
  461. // Get the code from the database...
  462. $request = $smcFunc['db_query']('', '
  463. SELECT id_member, validation_code, member_name, real_name, email_address, is_activated, passwd, lngfile
  464. FROM {db_prefix}members' . (empty($_REQUEST['u']) ? '
  465. WHERE member_name = {string:email_address} OR email_address = {string:email_address}' : '
  466. WHERE id_member = {int:id_member}') . '
  467. LIMIT 1',
  468. array(
  469. 'id_member' => isset($_REQUEST['u']) ? (int) $_REQUEST['u'] : 0,
  470. 'email_address' => isset($_POST['user']) ? $_POST['user'] : '',
  471. )
  472. );
  473. // Does this user exist at all?
  474. if ($smcFunc['db_num_rows']($request) == 0)
  475. {
  476. $context['sub_template'] = 'retry_activate';
  477. $context['page_title'] = $txt['invalid_userid'];
  478. $context['member_id'] = 0;
  479. return;
  480. }
  481. $row = $smcFunc['db_fetch_assoc']($request);
  482. $smcFunc['db_free_result']($request);
  483. // Change their email address? (they probably tried a fake one first :P.)
  484. if (isset($_POST['new_email'], $_REQUEST['passwd']) && sha1(strtolower($row['member_name']) . $_REQUEST['passwd']) == $row['passwd'])
  485. {
  486. if (empty($modSettings['registration_method']) || $modSettings['registration_method'] == 3)
  487. fatal_lang_error('no_access', false);
  488. // @todo Separate the sprintf?
  489. if (preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', $_POST['new_email']) == 0)
  490. fatal_error(sprintf($txt['valid_email_needed'], htmlspecialchars($_POST['new_email'])), false);
  491. // Make sure their email isn't banned.
  492. isBannedEmail($_POST['new_email'], 'cannot_register', $txt['ban_register_prohibited']);
  493. // Ummm... don't even dare try to take someone else's email!!
  494. $request = $smcFunc['db_query']('', '
  495. SELECT id_member
  496. FROM {db_prefix}members
  497. WHERE email_address = {string:email_address}
  498. LIMIT 1',
  499. array(
  500. 'email_address' => $_POST['new_email'],
  501. )
  502. );
  503. // @todo Separate the sprintf?
  504. if ($smcFunc['db_num_rows']($request) != 0)
  505. fatal_lang_error('email_in_use', false, array(htmlspecialchars($_POST['new_email'])));
  506. $smcFunc['db_free_result']($request);
  507. updateMemberData($row['id_member'], array('email_address' => $_POST['new_email']));
  508. $row['email_address'] = $_POST['new_email'];
  509. $email_change = true;
  510. }
  511. // Resend the password, but only if the account wasn't activated yet.
  512. if (!empty($_REQUEST['sa']) && $_REQUEST['sa'] == 'resend' && ($row['is_activated'] == 0 || $row['is_activated'] == 2) && (!isset($_REQUEST['code']) || $_REQUEST['code'] == ''))
  513. {
  514. require_once($sourcedir . '/Subs-Post.php');
  515. $replacements = array(
  516. 'REALNAME' => $row['real_name'],
  517. 'USERNAME' => $row['member_name'],
  518. 'ACTIVATIONLINK' => $scripturl . '?action=activate;u=' . $row['id_member'] . ';code=' . $row['validation_code'],
  519. 'ACTIVATIONLINKWITHOUTCODE' => $scripturl . '?action=activate;u=' . $row['id_member'],
  520. 'ACTIVATIONCODE' => $row['validation_code'],
  521. 'FORGOTPASSWORDLINK' => $scripturl . '?action=reminder',
  522. );
  523. $emaildata = loadEmailTemplate('resend_activate_message', $replacements, empty($row['lngfile']) || empty($modSettings['userLanguage']) ? $language : $row['lngfile']);
  524. sendmail($row['email_address'], $emaildata['subject'], $emaildata['body'], null, null, false, 0);
  525. $context['page_title'] = $txt['invalid_activation_resend'];
  526. // This will ensure we don't actually get an error message if it works!
  527. $context['error_title'] = '';
  528. fatal_lang_error(!empty($email_change) ? 'change_email_success' : 'resend_email_success', false);
  529. }
  530. // Quit if this code is not right.
  531. if (empty($_REQUEST['code']) || $row['validation_code'] != $_REQUEST['code'])
  532. {
  533. if (!empty($row['is_activated']))
  534. fatal_lang_error('already_activated', false);
  535. elseif ($row['validation_code'] == '')
  536. {
  537. loadLanguage('Profile');
  538. fatal_error($txt['registration_not_approved'] . ' <a href="' . $scripturl . '?action=activate;user=' . $row['member_name'] . '">' . $txt['here'] . '</a>.', false);
  539. }
  540. $context['sub_template'] = 'retry_activate';
  541. $context['page_title'] = $txt['invalid_activation_code'];
  542. $context['member_id'] = $row['id_member'];
  543. return;
  544. }
  545. // Let the integration know that they've been activated!
  546. call_integration_hook('integrate_activate', array($row['member_name']));
  547. // Validation complete - update the database!
  548. updateMemberData($row['id_member'], array('is_activated' => 1, 'validation_code' => ''));
  549. // Also do a proper member stat re-evaluation.
  550. updateStats('member', false);
  551. if (!isset($_POST['new_email']))
  552. {
  553. require_once($sourcedir . '/Subs-Post.php');
  554. adminNotify('activation', $row['id_member'], $row['member_name']);
  555. }
  556. $context += array(
  557. 'page_title' => $txt['registration_successful'],
  558. 'sub_template' => 'login',
  559. 'default_username' => $row['member_name'],
  560. 'default_password' => '',
  561. 'never_expire' => false,
  562. 'description' => $txt['activate_success']
  563. );
  564. }
  565. /**
  566. * This function will display the contact information for the forum, as well a form to fill in.
  567. */
  568. function CoppaForm()
  569. {
  570. global $context, $modSettings, $txt, $smcFunc;
  571. loadLanguage('Login');
  572. loadTemplate('Register');
  573. // No User ID??
  574. if (!isset($_GET['member']))
  575. fatal_lang_error('no_access', false);
  576. // Get the user details...
  577. $request = $smcFunc['db_query']('', '
  578. SELECT member_name
  579. FROM {db_prefix}members
  580. WHERE id_member = {int:id_member}
  581. AND is_activated = {int:is_coppa}',
  582. array(
  583. 'id_member' => (int) $_GET['member'],
  584. 'is_coppa' => 5,
  585. )
  586. );
  587. if ($smcFunc['db_num_rows']($request) == 0)
  588. fatal_lang_error('no_access', false);
  589. list ($username) = $smcFunc['db_fetch_row']($request);
  590. $smcFunc['db_free_result']($request);
  591. if (isset($_GET['form']))
  592. {
  593. // Some simple contact stuff for the forum.
  594. $context['forum_contacts'] = (!empty($modSettings['coppaPost']) ? $modSettings['coppaPost'] . '<br /><br />' : '') . (!empty($modSettings['coppaFax']) ? $modSettings['coppaFax'] . '<br />' : '');
  595. $context['forum_contacts'] = !empty($context['forum_contacts']) ? $context['forum_name_html_safe'] . '<br />' . $context['forum_contacts'] : '';
  596. // Showing template?
  597. if (!isset($_GET['dl']))
  598. {
  599. // Shortcut for producing underlines.
  600. $context['ul'] = '<u>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</u>';
  601. $context['template_layers'] = array();
  602. $context['sub_template'] = 'coppa_form';
  603. $context['page_title'] = $txt['coppa_form_title'];
  604. $context['coppa_body'] = str_replace(array('{PARENT_NAME}', '{CHILD_NAME}', '{USER_NAME}'), array($context['ul'], $context['ul'], $username), $txt['coppa_form_body']);
  605. }
  606. // Downloading.
  607. else
  608. {
  609. // The data.
  610. $ul = ' ';
  611. $crlf = "\r\n";
  612. $data = $context['forum_contacts'] . $crlf . $txt['coppa_form_address'] . ':' . $crlf . $txt['coppa_form_date'] . ':' . $crlf . $crlf . $crlf . $txt['coppa_form_body'];
  613. $data = str_replace(array('{PARENT_NAME}', '{CHILD_NAME}', '{USER_NAME}', '<br>', '<br />'), array($ul, $ul, $username, $crlf, $crlf), $data);
  614. // Send the headers.
  615. header('Connection: close');
  616. header('Content-Disposition: attachment; filename="approval.txt"');
  617. header('Content-Type: ' . (isBrowser('ie') || isBrowser('opera') ? 'application/octetstream' : 'application/octet-stream'));
  618. header('Content-Length: ' . count($data));
  619. echo $data;
  620. obExit(false);
  621. }
  622. }
  623. else
  624. {
  625. $context += array(
  626. 'page_title' => $txt['coppa_title'],
  627. 'sub_template' => 'coppa',
  628. );
  629. $context['coppa'] = array(
  630. 'body' => str_replace('{MINIMUM_AGE}', $modSettings['coppaAge'], $txt['coppa_after_registration']),
  631. 'many_options' => !empty($modSettings['coppaPost']) && !empty($modSettings['coppaFax']),
  632. 'post' => empty($modSettings['coppaPost']) ? '' : $modSettings['coppaPost'],
  633. 'fax' => empty($modSettings['coppaFax']) ? '' : $modSettings['coppaFax'],
  634. 'phone' => empty($modSettings['coppaPhone']) ? '' : str_replace('{PHONE_NUMBER}', $modSettings['coppaPhone'], $txt['coppa_send_by_phone']),
  635. 'id' => $_GET['member'],
  636. );
  637. }
  638. }
  639. /**
  640. * Show the verification code or let it hear.
  641. */
  642. function VerificationCode()
  643. {
  644. global $sourcedir, $modSettings, $context, $scripturl;
  645. $verification_id = isset($_GET['vid']) ? $_GET['vid'] : '';
  646. $code = $verification_id && isset($_SESSION[$verification_id . '_vv']) ? $_SESSION[$verification_id . '_vv']['code'] : (isset($_SESSION['visual_verification_code']) ? $_SESSION['visual_verification_code'] : '');
  647. // Somehow no code was generated or the session was lost.
  648. if (empty($code))
  649. {
  650. header('Content-Type: image/gif');
  651. die("\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x21\xF9\x04\x01\x00\x00\x00\x00\x2C\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02\x44\x01\x00\x3B");
  652. }
  653. // Show a window that will play the verification code.
  654. elseif (isset($_REQUEST['sound']))
  655. {
  656. loadLanguage('Login');
  657. loadTemplate('Register');
  658. $context['verification_sound_href'] = $scripturl . '?action=verificationcode;rand=' . md5(mt_rand()) . ($verification_id ? ';vid=' . $verification_id : '') . ';format=.wav';
  659. $context['sub_template'] = 'verification_sound';
  660. $context['template_layers'] = array();
  661. obExit();
  662. }
  663. // If we have GD, try the nice code.
  664. elseif (empty($_REQUEST['format']))
  665. {
  666. require_once($sourcedir . '/Subs-Graphics.php');
  667. if (in_array('gd', get_loaded_extensions()) && !showCodeImage($code))
  668. header('HTTP/1.1 400 Bad Request');
  669. // Otherwise just show a pre-defined letter.
  670. elseif (isset($_REQUEST['letter']))
  671. {
  672. $_REQUEST['letter'] = (int) $_REQUEST['letter'];
  673. if ($_REQUEST['letter'] > 0 && $_REQUEST['letter'] <= strlen($code) && !showLetterImage(strtolower($code{$_REQUEST['letter'] - 1})))
  674. {
  675. header('Content-Type: image/gif');
  676. die("\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x21\xF9\x04\x01\x00\x00\x00\x00\x2C\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02\x44\x01\x00\x3B");
  677. }
  678. }
  679. // You must be up to no good.
  680. else
  681. {
  682. header('Content-Type: image/gif');
  683. die("\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x21\xF9\x04\x01\x00\x00\x00\x00\x2C\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02\x44\x01\x00\x3B");
  684. }
  685. }
  686. elseif ($_REQUEST['format'] === '.wav')
  687. {
  688. require_once($sourcedir . '/Subs-Sound.php');
  689. if (!createWaveFile($code))
  690. header('HTTP/1.1 400 Bad Request');
  691. }
  692. // We all die one day...
  693. die();
  694. }
  695. /**
  696. * See if a username already exists.
  697. */
  698. function RegisterCheckUsername()
  699. {
  700. global $sourcedir, $smcFunc, $context, $txt;
  701. // This is XML!
  702. loadTemplate('Xml');
  703. $context['sub_template'] = 'check_username';
  704. $context['checked_username'] = isset($_GET['username']) ? $_GET['username'] : '';
  705. $context['valid_username'] = true;
  706. // Clean it up like mother would.
  707. $context['checked_username'] = preg_replace('~[\t\n\r\x0B\0' . ($context['utf8'] ? '\x{A0}' : '\xA0') . ']+~' . ($context['utf8'] ? 'u' : ''), ' ', $context['checked_username']);
  708. if ($smcFunc['strlen']($context['checked_username']) > 25)
  709. $context['checked_username'] = $smcFunc['htmltrim']($smcFunc['substr']($context['checked_username'], 0, 25));
  710. // Only these characters are permitted.
  711. if (preg_match('~[<>&"\'=\\\]~', preg_replace('~&#(?:\\d{1,7}|x[0-9a-fA-F]{1,6});~', '', $context['checked_username'])) != 0 || $context['checked_username'] == '_' || $context['checked_username'] == '|' || strpos($context['checked_username'], '[code') !== false || strpos($context['checked_username'], '[/code') !== false)
  712. $context['valid_username'] = false;
  713. if (stristr($context['checked_username'], $txt['guest_title']) !== false)
  714. $context['valid_username'] = false;
  715. if (trim($context['checked_username']) == '')
  716. $context['valid_username'] = false;
  717. else
  718. {
  719. require_once($sourcedir . '/Subs-Members.php');
  720. $context['valid_username'] &= isReservedName($context['checked_username'], 0, false, false) ? 0 : 1;
  721. }
  722. }
  723. ?>