[ Index ]

PHP Cross Reference of MyBB 1.8.15

title

Body

[close]

/ -> member.php (source)

   1  <?php
   2  /**
   3   * MyBB 1.8
   4   * Copyright 2014 MyBB Group, All Rights Reserved
   5   *
   6   * Website: http://www.mybb.com
   7   * License: http://www.mybb.com/about/license
   8   *
   9   */
  10  
  11  define("IN_MYBB", 1);
  12  define("IGNORE_CLEAN_VARS", "sid");
  13  define('THIS_SCRIPT', 'member.php');
  14  define("ALLOWABLE_PAGE", "register,do_register,login,do_login,logout,lostpw,do_lostpw,activate,resendactivation,do_resendactivation,resetpassword,viewnotes");
  15  
  16  $nosession['avatar'] = 1;
  17  
  18  $templatelist = "member_register,member_register_hiddencaptcha,member_register_coppa,member_register_agreement_coppa,member_register_agreement,member_register_customfield,member_register_requiredfields,member_profile_findthreads";
  19  $templatelist .= ",member_loggedin_notice,member_profile_away,member_register_regimage,member_register_regimage_recaptcha,member_register_regimage_recaptcha_invisible,member_register_regimage_nocaptcha,post_captcha_hidden,post_captcha,post_captcha_recaptcha,member_register_referrer";
  20  $templatelist .= ",member_profile_email,member_profile_offline,member_profile_reputation,member_profile_warn,member_profile_warninglevel,member_profile_customfields_field,member_profile_customfields,member_profile_adminoptions,member_profile";
  21  $templatelist .= ",member_profile_signature,member_profile_avatar,member_profile_groupimage,member_profile_referrals,member_profile_website,member_profile_reputation_vote,member_activate,member_lostpw,member_register_additionalfields";
  22  $templatelist .= ",member_profile_modoptions_manageuser,member_profile_modoptions_editprofile,member_profile_modoptions_banuser,member_profile_modoptions_viewnotes,member_profile_modoptions_editnotes,member_profile_modoptions_purgespammer";
  23  $templatelist .= ",usercp_profile_profilefields_select_option,usercp_profile_profilefields_multiselect,usercp_profile_profilefields_select,usercp_profile_profilefields_textarea,usercp_profile_profilefields_radio,member_viewnotes";
  24  $templatelist .= ",member_register_question,member_register_question_refresh,usercp_options_timezone,usercp_options_timezone_option,usercp_options_language_option,member_profile_customfields_field_multi_item,member_profile_customfields_field_multi";
  25  $templatelist .= ",member_profile_contact_fields_aim,member_profile_contact_fields_google,member_profile_contact_fields_icq,member_profile_contact_fields_skype,member_profile_contact_fields_yahoo,member_profile_pm,member_profile_contact_details";
  26  $templatelist .= ",member_profile_banned_remaining,member_profile_addremove,member_emailuser_guest,member_register_day,usercp_options_tppselect_option,postbit_warninglevel_formatted,member_profile_userstar,member_profile_findposts";
  27  $templatelist .= ",usercp_options_tppselect,usercp_options_pppselect,member_resetpassword,member_login,member_profile_online,usercp_options_pppselect_option,postbit_reputation_formatted,member_emailuser,usercp_profile_profilefields_text";
  28  $templatelist .= ",member_profile_modoptions_ipaddress,member_profile_modoptions,member_profile_banned,member_register_language,member_resendactivation,usercp_profile_profilefields_checkbox,member_register_password,member_coppa_form";
  29  
  30  require_once  "./global.php";
  31  require_once  MYBB_ROOT."inc/functions_post.php";
  32  require_once  MYBB_ROOT."inc/functions_user.php";
  33  require_once  MYBB_ROOT."inc/class_parser.php";
  34  $parser = new postParser;
  35  
  36  // Load global language phrases
  37  $lang->load("member");
  38  
  39  $mybb->input['action'] = $mybb->get_input('action');
  40  
  41  // Make navigation
  42  switch($mybb->input['action'])
  43  {
  44      case "register":
  45      case "do_register":
  46          add_breadcrumb($lang->nav_register);
  47          break;
  48      case "activate":
  49          add_breadcrumb($lang->nav_activate);
  50          break;
  51      case "resendactivation":
  52          add_breadcrumb($lang->nav_resendactivation);
  53          break;
  54      case "lostpw":
  55          add_breadcrumb($lang->nav_lostpw);
  56          break;
  57      case "resetpassword":
  58          add_breadcrumb($lang->nav_resetpassword);
  59          break;
  60      case "login":
  61          add_breadcrumb($lang->nav_login);
  62          break;
  63      case "emailuser":
  64          add_breadcrumb($lang->nav_emailuser);
  65          break;
  66  }
  67  
  68  if(($mybb->input['action'] == "register" || $mybb->input['action'] == "do_register") && $mybb->usergroup['cancp'] != 1)
  69  {
  70      if($mybb->settings['disableregs'] == 1)
  71      {
  72          error($lang->registrations_disabled);
  73      }
  74      if($mybb->user['uid'] != 0)
  75      {
  76          error($lang->error_alreadyregistered);
  77      }
  78      if($mybb->settings['betweenregstime'] && $mybb->settings['maxregsbetweentime'])
  79      {
  80          $time = TIME_NOW;
  81          $datecut = $time-(60*60*$mybb->settings['betweenregstime']);
  82          $query = $db->simple_select("users", "*", "regip=".$db->escape_binary($session->packedip)." AND regdate > '$datecut'");
  83          $regcount = $db->num_rows($query);
  84          if($regcount >= $mybb->settings['maxregsbetweentime'])
  85          {
  86              $lang->error_alreadyregisteredtime = $lang->sprintf($lang->error_alreadyregisteredtime, $regcount, $mybb->settings['betweenregstime']);
  87              error($lang->error_alreadyregisteredtime);
  88          }
  89      }
  90  }
  91  
  92  if($mybb->input['action'] == "do_register" && $mybb->request_method == "post")
  93  {
  94      $plugins->run_hooks("member_do_register_start");
  95  
  96      // Are checking how long it takes for users to register?
  97      if($mybb->settings['regtime'] > 0)
  98      {
  99          // Is the field actually set?
 100          if(isset($mybb->input['regtime']))
 101          {
 102              // Check how long it took for this person to register
 103              $timetook = TIME_NOW - $mybb->get_input('regtime', MyBB::INPUT_INT);
 104  
 105              // See if they registered faster than normal
 106              if($timetook < $mybb->settings['regtime'])
 107              {
 108                  // This user registered pretty quickly, bot detected!
 109                  $lang->error_spam_deny_time = $lang->sprintf($lang->error_spam_deny_time, $mybb->settings['regtime'], $timetook);
 110                  error($lang->error_spam_deny_time);
 111              }
 112          }
 113          else
 114          {
 115              error($lang->error_spam_deny);
 116          }
 117      }
 118  
 119      // If we have hidden CATPCHA enabled and it's filled, deny registration
 120      if($mybb->settings['hiddencaptchaimage'])
 121      {
 122          $string = $mybb->settings['hiddencaptchaimagefield'];
 123  
 124          if(!empty($mybb->input[$string]))
 125          {
 126              error($lang->error_spam_deny);
 127          }
 128      }
 129  
 130      if($mybb->settings['regtype'] == "randompass")
 131      {
 132  
 133          $password_length = (int)$mybb->settings['minpasswordlength'];
 134          if($password_length < 8)
 135          {
 136              $password_length = min(8, (int)$mybb->settings['maxpasswordlength']);
 137          }
 138  
 139          $mybb->input['password'] = random_str($password_length, $mybb->settings['requirecomplexpasswords']);
 140          $mybb->input['password2'] = $mybb->input['password'];
 141      }
 142  
 143      if($mybb->settings['regtype'] == "verify" || $mybb->settings['regtype'] == "admin" || $mybb->settings['regtype'] == "both" || $mybb->get_input('coppa', MyBB::INPUT_INT) == 1)
 144      {
 145          $usergroup = 5;
 146      }
 147      else
 148      {
 149          $usergroup = 2;
 150      }
 151  
 152      // Set up user handler.
 153      require_once  MYBB_ROOT."inc/datahandlers/user.php";
 154      $userhandler = new UserDataHandler("insert");
 155  
 156      $coppauser = 0;
 157      if(isset($mybb->cookies['coppauser']))
 158      {
 159          $coppauser = (int)$mybb->cookies['coppauser'];
 160      }
 161  
 162      // Set the data for the new user.
 163      $user = array(
 164          "username" => $mybb->get_input('username'),
 165          "password" => $mybb->get_input('password'),
 166          "password2" => $mybb->get_input('password2'),
 167          "email" => $mybb->get_input('email'),
 168          "email2" => $mybb->get_input('email2'),
 169          "usergroup" => $usergroup,
 170          "referrer" => $mybb->get_input('referrername'),
 171          "timezone" => $mybb->get_input('timezoneoffset'),
 172          "language" => $mybb->get_input('language'),
 173          "profile_fields" => $mybb->get_input('profile_fields', MyBB::INPUT_ARRAY),
 174          "regip" => $session->packedip,
 175          "coppa_user" => $coppauser,
 176          "regcheck1" => $mybb->get_input('regcheck1'),
 177          "regcheck2" => $mybb->get_input('regcheck2'),
 178          "registration" => true
 179      );
 180  
 181      // Do we have a saved COPPA DOB?
 182      if(isset($mybb->cookies['coppadob']))
 183      {
 184          list($dob_day, $dob_month, $dob_year) = explode("-", $mybb->cookies['coppadob']);
 185          $user['birthday'] = array(
 186              "day" => $dob_day,
 187              "month" => $dob_month,
 188              "year" => $dob_year
 189          );
 190      }
 191  
 192      $user['options'] = array(
 193          "allownotices" => $mybb->get_input('allownotices', MyBB::INPUT_INT),
 194          "hideemail" => $mybb->get_input('hideemail', MyBB::INPUT_INT),
 195          "subscriptionmethod" => $mybb->get_input('subscriptionmethod', MyBB::INPUT_INT),
 196          "receivepms" => $mybb->get_input('receivepms', MyBB::INPUT_INT),
 197          "pmnotice" => $mybb->get_input('pmnotice', MyBB::INPUT_INT),
 198          "pmnotify" => $mybb->get_input('pmnotify', MyBB::INPUT_INT),
 199          "invisible" => $mybb->get_input('invisible', MyBB::INPUT_INT),
 200          "dstcorrection" => $mybb->get_input('dstcorrection')
 201      );
 202  
 203      $userhandler->set_data($user);
 204  
 205      $errors = array();
 206  
 207      if(!$userhandler->validate_user())
 208      {
 209          $errors = $userhandler->get_friendly_errors();
 210      }
 211  
 212      if($mybb->settings['enablestopforumspam_on_register'])
 213      {
 214          require_once  MYBB_ROOT . '/inc/class_stopforumspamchecker.php';
 215  
 216          $stop_forum_spam_checker = new StopForumSpamChecker(
 217              $plugins,
 218              $mybb->settings['stopforumspam_min_weighting_before_spam'],
 219              $mybb->settings['stopforumspam_check_usernames'],
 220              $mybb->settings['stopforumspam_check_emails'],
 221              $mybb->settings['stopforumspam_check_ips'],
 222              $mybb->settings['stopforumspam_log_blocks']
 223          );
 224  
 225          try {
 226              if($stop_forum_spam_checker->is_user_a_spammer($user['username'], $user['email'], get_ip()))
 227              {
 228                  error($lang->sprintf($lang->error_stop_forum_spam_spammer,
 229                          $stop_forum_spam_checker->getErrorText(array(
 230                              'stopforumspam_check_usernames',
 231                              'stopforumspam_check_emails',
 232                              'stopforumspam_check_ips'
 233                              ))));
 234              }
 235          }
 236          catch (Exception $e)
 237          {
 238              if($mybb->settings['stopforumspam_block_on_error'])
 239              {
 240                  error($lang->error_stop_forum_spam_fetching);
 241              }
 242          }
 243      }
 244  
 245      if($mybb->settings['captchaimage'])
 246      {
 247          require_once  MYBB_ROOT.'inc/class_captcha.php';
 248          $captcha = new captcha;
 249  
 250          if($captcha->validate_captcha() == false)
 251          {
 252              // CAPTCHA validation failed
 253              foreach($captcha->get_errors() as $error)
 254              {
 255                  $errors[] = $error;
 256              }
 257          }
 258      }
 259  
 260      // If we have a security question, check to see if answer is correct
 261      if($mybb->settings['securityquestion'])
 262      {
 263          $question_id = $db->escape_string($mybb->get_input('question_id'));
 264          $answer = $db->escape_string($mybb->get_input('answer'));
 265  
 266          $query = $db->query("
 267              SELECT q.*, s.sid
 268              FROM ".TABLE_PREFIX."questionsessions s
 269              LEFT JOIN ".TABLE_PREFIX."questions q ON (q.qid=s.qid)
 270              WHERE q.active='1' AND s.sid='{$question_id}'
 271          ");
 272          if($db->num_rows($query) > 0)
 273          {
 274              $question = $db->fetch_array($query);
 275              $valid_answers = explode("\n", $question['answer']);
 276              $validated = 0;
 277  
 278              foreach($valid_answers as $answers)
 279              {
 280                  if(my_strtolower($answers) == my_strtolower($answer))
 281                  {
 282                      $validated = 1;
 283                  }
 284              }
 285  
 286              if($validated != 1)
 287              {
 288                  $update_question = array(
 289                      "incorrect" => $question['incorrect'] + 1
 290                  );
 291                  $db->update_query("questions", $update_question, "qid='{$question['qid']}'");
 292  
 293                  $errors[] = $lang->error_question_wrong;
 294              }
 295              else
 296              {
 297                  $update_question = array(
 298                      "correct" => $question['correct'] + 1
 299                  );
 300                  $db->update_query("questions", $update_question, "qid='{$question['qid']}'");
 301              }
 302  
 303              $db->delete_query("questionsessions", "sid='{$sid}'");
 304          }
 305      }
 306  
 307      if(!empty($errors))
 308      {
 309          $username = htmlspecialchars_uni($mybb->get_input('username'));
 310          $email = htmlspecialchars_uni($mybb->get_input('email'));
 311          $email2 = htmlspecialchars_uni($mybb->get_input('email2'));
 312          $referrername = htmlspecialchars_uni($mybb->get_input('referrername'));
 313  
 314          $allownoticescheck = $hideemailcheck = $no_auto_subscribe_selected = $instant_email_subscribe_selected = $instant_pm_subscribe_selected = $no_subscribe_selected = '';
 315          $receivepmscheck = $pmnoticecheck = $pmnotifycheck = $invisiblecheck = $dst_auto_selected = $dst_enabled_selected = $dst_disabled_selected = '';
 316  
 317          if($mybb->get_input('allownotices', MyBB::INPUT_INT) == 1)
 318          {
 319              $allownoticescheck = "checked=\"checked\"";
 320          }
 321  
 322          if($mybb->get_input('hideemail', MyBB::INPUT_INT) == 1)
 323          {
 324              $hideemailcheck = "checked=\"checked\"";
 325          }
 326  
 327          if($mybb->get_input('subscriptionmethod', MyBB::INPUT_INT) == 1)
 328          {
 329              $no_subscribe_selected = "selected=\"selected\"";
 330          }
 331          else if($mybb->get_input('subscriptionmethod', MyBB::INPUT_INT) == 2)
 332          {
 333              $instant_email_subscribe_selected = "selected=\"selected\"";
 334          }
 335          else if($mybb->get_input('subscriptionmethod', MyBB::INPUT_INT) == 3)
 336          {
 337              $instant_pm_subscribe_selected = "selected=\"selected\"";
 338          }
 339          else
 340          {
 341              $no_auto_subscribe_selected = "selected=\"selected\"";
 342          }
 343  
 344          if($mybb->get_input('receivepms', MyBB::INPUT_INT) == 1)
 345          {
 346              $receivepmscheck = "checked=\"checked\"";
 347          }
 348  
 349          if($mybb->get_input('pmnotice', MyBB::INPUT_INT) == 1)
 350          {
 351              $pmnoticecheck = " checked=\"checked\"";
 352          }
 353  
 354          if($mybb->get_input('pmnotify', MyBB::INPUT_INT) == 1)
 355          {
 356              $pmnotifycheck = "checked=\"checked\"";
 357          }
 358  
 359          if($mybb->get_input('invisible', MyBB::INPUT_INT) == 1)
 360          {
 361              $invisiblecheck = "checked=\"checked\"";
 362          }
 363  
 364          if($mybb->get_input('dstcorrection', MyBB::INPUT_INT) == 2)
 365          {
 366              $dst_auto_selected = "selected=\"selected\"";
 367          }
 368          else if($mybb->get_input('dstcorrection', MyBB::INPUT_INT) == 1)
 369          {
 370              $dst_enabled_selected = "selected=\"selected\"";
 371          }
 372          else
 373          {
 374              $dst_disabled_selected = "selected=\"selected\"";
 375          }
 376  
 377          $regerrors = inline_error($errors);
 378          $mybb->input['action'] = "register";
 379          $fromreg = 1;
 380      }
 381      else
 382      {
 383          $user_info = $userhandler->insert_user();
 384  
 385          // Invalidate solved captcha
 386          if($mybb->settings['captchaimage'])
 387          {
 388              $captcha->invalidate_captcha();
 389          }
 390  
 391          if($mybb->settings['regtype'] != "randompass" && !isset($mybb->cookies['coppauser']))
 392          {
 393              // Log them in
 394              my_setcookie("mybbuser", $user_info['uid']."_".$user_info['loginkey'], null, true);
 395          }
 396  
 397          if(isset($mybb->cookies['coppauser']))
 398          {
 399              $lang->redirect_registered_coppa_activate = $lang->sprintf($lang->redirect_registered_coppa_activate, $mybb->settings['bbname'], htmlspecialchars_uni($user_info['username']));
 400              my_unsetcookie("coppauser");
 401              my_unsetcookie("coppadob");
 402              $plugins->run_hooks("member_do_register_end");
 403              error($lang->redirect_registered_coppa_activate);
 404          }
 405          else if($mybb->settings['regtype'] == "verify")
 406          {
 407              $activationcode = random_str();
 408              $now = TIME_NOW;
 409              $activationarray = array(
 410                  "uid" => $user_info['uid'],
 411                  "dateline" => TIME_NOW,
 412                  "code" => $activationcode,
 413                  "type" => "r"
 414              );
 415              $db->insert_query("awaitingactivation", $activationarray);
 416              $emailsubject = $lang->sprintf($lang->emailsubject_activateaccount, $mybb->settings['bbname']);
 417              switch($mybb->settings['username_method'])
 418              {
 419                  case 0:
 420                      $emailmessage = $lang->sprintf($lang->email_activateaccount, $user_info['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user_info['uid'], $activationcode);
 421                      break;
 422                  case 1:
 423                      $emailmessage = $lang->sprintf($lang->email_activateaccount1, $user_info['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user_info['uid'], $activationcode);
 424                      break;
 425                  case 2:
 426                      $emailmessage = $lang->sprintf($lang->email_activateaccount2, $user_info['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user_info['uid'], $activationcode);
 427                      break;
 428                  default:
 429                      $emailmessage = $lang->sprintf($lang->email_activateaccount, $user_info['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user_info['uid'], $activationcode);
 430                      break;
 431              }
 432              my_mail($user_info['email'], $emailsubject, $emailmessage);
 433  
 434              $lang->redirect_registered_activation = $lang->sprintf($lang->redirect_registered_activation, $mybb->settings['bbname'], htmlspecialchars_uni($user_info['username']));
 435  
 436              $plugins->run_hooks("member_do_register_end");
 437  
 438              error($lang->redirect_registered_activation);
 439          }
 440          else if($mybb->settings['regtype'] == "randompass")
 441          {
 442              $emailsubject = $lang->sprintf($lang->emailsubject_randompassword, $mybb->settings['bbname']);
 443              switch($mybb->settings['username_method'])
 444              {
 445                  case 0:
 446                      $emailmessage = $lang->sprintf($lang->email_randompassword, $user['username'], $mybb->settings['bbname'], $user_info['username'], $mybb->get_input('password'));
 447                      break;
 448                  case 1:
 449                      $emailmessage = $lang->sprintf($lang->email_randompassword1, $user['username'], $mybb->settings['bbname'], $user_info['username'], $mybb->get_input('password'));
 450                      break;
 451                  case 2:
 452                      $emailmessage = $lang->sprintf($lang->email_randompassword2, $user['username'], $mybb->settings['bbname'], $user_info['username'], $mybb->get_input('password'));
 453                      break;
 454                  default:
 455                      $emailmessage = $lang->sprintf($lang->email_randompassword, $user['username'], $mybb->settings['bbname'], $user_info['username'], $mybb->get_input('password'));
 456                      break;
 457              }
 458              my_mail($user_info['email'], $emailsubject, $emailmessage);
 459  
 460              $plugins->run_hooks("member_do_register_end");
 461  
 462              error($lang->redirect_registered_passwordsent);
 463          }
 464          else if($mybb->settings['regtype'] == "admin")
 465          {
 466              $groups = $cache->read("usergroups");
 467              $admingroups = array();
 468              if(!empty($groups)) // Shouldn't be...
 469              {
 470                  foreach($groups as $group)
 471                  {
 472                      if($group['cancp'] == 1)
 473                      {
 474                          $admingroups[] = (int)$group['gid'];
 475                      }
 476                  }
 477              }
 478  
 479              if(!empty($admingroups))
 480              {
 481                  $sqlwhere = 'usergroup IN ('.implode(',', $admingroups).')';
 482                  foreach($admingroups as $admingroup)
 483                  {
 484                      switch($db->type)
 485                      {
 486                          case 'pgsql':
 487                          case 'sqlite':
 488                              $sqlwhere .= " OR ','||additionalgroups||',' LIKE '%,{$admingroup},%'";
 489                              break;
 490                          default:
 491                              $sqlwhere .= " OR CONCAT(',',additionalgroups,',') LIKE '%,{$admingroup},%'";
 492                              break;
 493                      }
 494                  }
 495                  $q = $db->simple_select('users', 'uid,username,email,language', $sqlwhere);
 496                  while($recipient = $db->fetch_array($q))
 497                  {
 498                      // First we check if the user's a super admin: if yes, we don't care about permissions
 499                      $is_super_admin = is_super_admin($recipient['uid']);
 500                      if(!$is_super_admin)
 501                      {
 502                          // Include admin functions
 503                          if(!file_exists(MYBB_ROOT.$mybb->config['admin_dir']."/inc/functions.php"))
 504                          {
 505                              continue;
 506                          }
 507  
 508                          require_once MYBB_ROOT.$mybb->config['admin_dir']."/inc/functions.php";
 509  
 510                          // Verify if we have permissions to access user-users
 511                          require_once MYBB_ROOT.$mybb->config['admin_dir']."/modules/user/module_meta.php";
 512                          if(function_exists("user_admin_permissions"))
 513                          {
 514                              // Get admin permissions
 515                              $adminperms = get_admin_permissions($recipient['uid']);
 516  
 517                              $permissions = user_admin_permissions();
 518                              if(array_key_exists('users', $permissions['permissions']) && $adminperms['user']['users'] != 1)
 519                              {
 520                                  continue; // No permissions
 521                              }
 522                          }
 523                      }
 524  
 525                      // Load language
 526                      if($recipient['language'] != $lang->language && $lang->language_exists($recipient['language']))
 527                      {
 528                          $reset_lang = true;
 529                          $lang->set_language($recipient['language']);
 530                          $lang->load("member");
 531                      }
 532  
 533                      $subject = $lang->sprintf($lang->newregistration_subject, $mybb->settings['bbname']);
 534                      $message = $lang->sprintf($lang->newregistration_message, $recipient['username'], $mybb->settings['bbname'], $user['username']);
 535                      my_mail($recipient['email'], $subject, $message);
 536                  }
 537  
 538                  // Reset language
 539                  if(isset($reset_lang))
 540                  {
 541                      $lang->set_language($mybb->settings['bblanguage']);
 542                      $lang->load("member");
 543                  }
 544              }
 545  
 546              $lang->redirect_registered_admin_activate = $lang->sprintf($lang->redirect_registered_admin_activate, $mybb->settings['bbname'], htmlspecialchars_uni($user_info['username']));
 547  
 548              $plugins->run_hooks("member_do_register_end");
 549  
 550              error($lang->redirect_registered_admin_activate);
 551          }
 552          else if($mybb->settings['regtype'] == "both")
 553          {
 554              $groups = $cache->read("usergroups");
 555              $admingroups = array();
 556              if(!empty($groups)) // Shouldn't be...
 557              {
 558                  foreach($groups as $group)
 559                  {
 560                      if($group['cancp'] == 1)
 561                      {
 562                          $admingroups[] = (int)$group['gid'];
 563                      }
 564                  }
 565              }
 566  
 567              if(!empty($admingroups))
 568              {
 569                  $sqlwhere = 'usergroup IN ('.implode(',', $admingroups).')';
 570                  foreach($admingroups as $admingroup)
 571                  {
 572                      switch($db->type)
 573                      {
 574                          case 'pgsql':
 575                          case 'sqlite':
 576                              $sqlwhere .= " OR ','||additionalgroups||',' LIKE '%,{$admingroup},%'";
 577                              break;
 578                          default:
 579                              $sqlwhere .= " OR CONCAT(',',additionalgroups,',') LIKE '%,{$admingroup},%'";
 580                              break;
 581                      }
 582                  }
 583                  $q = $db->simple_select('users', 'uid,username,email,language', $sqlwhere);
 584                  while($recipient = $db->fetch_array($q))
 585                  {
 586                      // First we check if the user's a super admin: if yes, we don't care about permissions
 587                      $is_super_admin = is_super_admin($recipient['uid']);
 588                      if(!$is_super_admin)
 589                      {
 590                          // Include admin functions
 591                          if(!file_exists(MYBB_ROOT.$mybb->config['admin_dir']."/inc/functions.php"))
 592                          {
 593                              continue;
 594                          }
 595  
 596                          require_once MYBB_ROOT.$mybb->config['admin_dir']."/inc/functions.php";
 597  
 598                          // Verify if we have permissions to access user-users
 599                          require_once MYBB_ROOT.$mybb->config['admin_dir']."/modules/user/module_meta.php";
 600                          if(function_exists("user_admin_permissions"))
 601                          {
 602                              // Get admin permissions
 603                              $adminperms = get_admin_permissions($recipient['uid']);
 604  
 605                              $permissions = user_admin_permissions();
 606                              if(array_key_exists('users', $permissions['permissions']) && $adminperms['user']['users'] != 1)
 607                              {
 608                                  continue; // No permissions
 609                              }
 610                          }
 611                      }
 612  
 613                      // Load language
 614                      if($recipient['language'] != $lang->language && $lang->language_exists($recipient['language']))
 615                      {
 616                          $reset_lang = true;
 617                          $lang->set_language($recipient['language']);
 618                          $lang->load("member");
 619                      }
 620  
 621                      $subject = $lang->sprintf($lang->newregistration_subject, $mybb->settings['bbname']);
 622                      $message = $lang->sprintf($lang->newregistration_message, $recipient['username'], $mybb->settings['bbname'], $user['username']);
 623                      my_mail($recipient['email'], $subject, $message);
 624                  }
 625  
 626                  // Reset language
 627                  if(isset($reset_lang))
 628                  {
 629                      $lang->set_language($mybb->settings['bblanguage']);
 630                      $lang->load("member");
 631                  }
 632              }
 633  
 634              $activationcode = random_str();
 635              $activationarray = array(
 636                  "uid" => $user_info['uid'],
 637                  "dateline" => TIME_NOW,
 638                  "code" => $activationcode,
 639                  "type" => "b"
 640              );
 641              $db->insert_query("awaitingactivation", $activationarray);
 642              $emailsubject = $lang->sprintf($lang->emailsubject_activateaccount, $mybb->settings['bbname']);
 643              switch($mybb->settings['username_method'])
 644              {
 645                  case 0:
 646                      $emailmessage = $lang->sprintf($lang->email_activateaccount, $user_info['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user_info['uid'], $activationcode);
 647                      break;
 648                  case 1:
 649                      $emailmessage = $lang->sprintf($lang->email_activateaccount1, $user_info['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user_info['uid'], $activationcode);
 650                      break;
 651                  case 2:
 652                      $emailmessage = $lang->sprintf($lang->email_activateaccount2, $user_info['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user_info['uid'], $activationcode);
 653                      break;
 654                  default:
 655                      $emailmessage = $lang->sprintf($lang->email_activateaccount, $user_info['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user_info['uid'], $activationcode);
 656                      break;
 657              }
 658              my_mail($user_info['email'], $emailsubject, $emailmessage);
 659  
 660              $lang->redirect_registered_activation = $lang->sprintf($lang->redirect_registered_activation, $mybb->settings['bbname'], htmlspecialchars_uni($user_info['username']));
 661  
 662              $plugins->run_hooks("member_do_register_end");
 663  
 664              error($lang->redirect_registered_activation);
 665          }
 666          else
 667          {
 668              $lang->redirect_registered = $lang->sprintf($lang->redirect_registered, $mybb->settings['bbname'], htmlspecialchars_uni($user_info['username']));
 669  
 670              $plugins->run_hooks("member_do_register_end");
 671  
 672              redirect("index.php", $lang->redirect_registered);
 673          }
 674      }
 675  }
 676  
 677  if($mybb->input['action'] == "coppa_form")
 678  {
 679      if(!$mybb->settings['faxno'])
 680      {
 681          $mybb->settings['faxno'] = "&nbsp;";
 682      }
 683  
 684      $plugins->run_hooks("member_coppa_form");
 685  
 686      eval("\$coppa_form = \"".$templates->get("member_coppa_form")."\";");
 687      output_page($coppa_form);
 688  }
 689  
 690  if($mybb->input['action'] == "register")
 691  {
 692      $bdaysel = '';
 693      if($mybb->settings['coppa'] == "disabled")
 694      {
 695          $bdaysel = $bday2blank = '';
 696      }
 697      $mybb->input['bday1'] = $mybb->get_input('bday1', MyBB::INPUT_INT);
 698      for($day = 1; $day <= 31; ++$day)
 699      {
 700          $selected = '';
 701          if($mybb->input['bday1'] == $day)
 702          {
 703              $selected = " selected=\"selected\"";
 704          }
 705  
 706          eval("\$bdaysel .= \"".$templates->get("member_register_day")."\";");
 707      }
 708  
 709      $mybb->input['bday2'] = $mybb->get_input('bday2', MyBB::INPUT_INT);
 710      $bdaymonthsel = array();
 711      foreach(range(1, 12) as $number)
 712      {
 713          $bdaymonthsel[$number] = '';
 714      }
 715      $bdaymonthsel[$mybb->input['bday2']] = "selected=\"selected\"";
 716      $mybb->input['bday3'] = $mybb->get_input('bday3', MyBB::INPUT_INT);
 717  
 718      if($mybb->input['bday3'] == 0)
 719      {
 720          $mybb->input['bday3'] = '';
 721      }
 722  
 723      // Is COPPA checking enabled?
 724      if($mybb->settings['coppa'] != "disabled" && !isset($mybb->input['step']))
 725      {
 726          // Just selected DOB, we check
 727          if($mybb->input['bday1'] && $mybb->input['bday2'] && $mybb->input['bday3'])
 728          {
 729              my_unsetcookie("coppauser");
 730  
 731              $months = get_bdays($mybb->input['bday3']);
 732              if($mybb->input['bday2'] < 1 || $mybb->input['bday2'] > 12 || $mybb->input['bday3'] < (date("Y")-100) || $mybb->input['bday3'] > date("Y") || $mybb->input['bday1'] > $months[$mybb->input['bday2']-1])
 733              {
 734                  error($lang->error_invalid_birthday);
 735              }
 736  
 737              $bdaytime = @mktime(0, 0, 0, $mybb->input['bday2'], $mybb->input['bday1'], $mybb->input['bday3']);
 738  
 739              // Store DOB in cookie so we can save it with the registration
 740              my_setcookie("coppadob", "{$mybb->input['bday1']}-{$mybb->input['bday2']}-{$mybb->input['bday3']}", -1);
 741  
 742              // User is <= 13, we mark as a coppa user
 743              if($bdaytime >= mktime(0, 0, 0, my_date('n'), my_date('d'), my_date('Y')-13))
 744              {
 745                  my_setcookie("coppauser", 1, -0);
 746                  $under_thirteen = true;
 747              }
 748              $mybb->request_method = "";
 749          }
 750          // Show DOB select form
 751          else
 752          {
 753              $plugins->run_hooks("member_register_coppa");
 754  
 755              my_unsetcookie("coppauser");
 756  
 757              eval("\$coppa = \"".$templates->get("member_register_coppa")."\";");
 758              output_page($coppa);
 759              exit;
 760          }
 761      }
 762  
 763      if((!isset($mybb->input['agree']) && !isset($mybb->input['regsubmit'])) && $fromreg == 0 || $mybb->request_method != "post")
 764      {
 765          $coppa_agreement = '';
 766          // Is this user a COPPA user? We need to show the COPPA agreement too
 767          if($mybb->settings['coppa'] != "disabled" && ($mybb->cookies['coppauser'] == 1 || $under_thirteen))
 768          {
 769              if($mybb->settings['coppa'] == "deny")
 770              {
 771                  error($lang->error_need_to_be_thirteen);
 772              }
 773              $lang->coppa_agreement_1 = $lang->sprintf($lang->coppa_agreement_1, $mybb->settings['bbname']);
 774              eval("\$coppa_agreement = \"".$templates->get("member_register_agreement_coppa")."\";");
 775          }
 776  
 777          $plugins->run_hooks("member_register_agreement");
 778  
 779          eval("\$agreement = \"".$templates->get("member_register_agreement")."\";");
 780          output_page($agreement);
 781      }
 782      else
 783      {
 784          $plugins->run_hooks("member_register_start");
 785  
 786          // JS validator extra
 787          if($mybb->settings['maxnamelength'] > 0 && $mybb->settings['minnamelength'] > 0)
 788          {
 789              $lang->js_validator_username_length = $lang->sprintf($lang->js_validator_username_length, $mybb->settings['minnamelength'], $mybb->settings['maxnamelength']);
 790          }
 791  
 792          $validator_javascript = "<script type=\"text/javascript\">
 793  $(document).ready(function() {
 794      $('#registration_form').validate({
 795          rules: {
 796              username: {
 797                  required: true,
 798                  minlength: {$mybb->settings['minnamelength']},
 799                  maxlength: {$mybb->settings['maxnamelength']},
 800                  remote: {
 801                      url: 'xmlhttp.php?action=username_availability',
 802                      type: 'post',
 803                      dataType: 'json',
 804                      data:
 805                      {
 806                          my_post_key: my_post_key
 807                      },
 808                  },
 809              },
 810              email: {
 811                  required: true,
 812                  email: true,
 813                  remote: {
 814                      url: 'xmlhttp.php?action=email_availability',
 815                      type: 'post',
 816                      dataType: 'json',
 817                      data:
 818                      {
 819                          my_post_key: my_post_key
 820                      },
 821                  },
 822              },
 823              email2: {
 824                  required: true,
 825                  email: true,
 826                  equalTo: '#email'
 827              },
 828          },
 829          messages: {
 830              username: {
 831                  minlength: '{$lang->js_validator_username_length}',
 832                  maxlength: '{$lang->js_validator_username_length}',
 833              },
 834              email: '{$lang->js_validator_invalid_email}',
 835              email2: '{$lang->js_validator_email_match}',
 836          },
 837          errorPlacement: function(error, element) {
 838              if(element.is(':checkbox') || element.is(':radio'))
 839                  error.insertAfter($('input[name=\"' + element.attr('name') + '\"]').last().next('span'));
 840              else
 841                  error.insertAfter(element);
 842          }
 843      });\n";
 844  
 845          if(isset($mybb->input['timezoneoffset']))
 846          {
 847              $timezoneoffset = $mybb->get_input('timezoneoffset');
 848          }
 849          else
 850          {
 851              $timezoneoffset = $mybb->settings['timezoneoffset'];
 852          }
 853          $tzselect = build_timezone_select("timezoneoffset", $timezoneoffset, true);
 854  
 855          $stylelist = build_theme_select("style");
 856  
 857          if($mybb->settings['usertppoptions'])
 858          {
 859              $tppoptions = '';
 860              $explodedtpp = explode(",", $mybb->settings['usertppoptions']);
 861              if(is_array($explodedtpp))
 862              {
 863                  foreach($explodedtpp as $val)
 864                  {
 865                      $val = trim($val);
 866                      $tpp_option = $lang->sprintf($lang->tpp_option, $val);
 867                      eval("\$tppoptions .= \"".$templates->get("usercp_options_tppselect_option")."\";");
 868                  }
 869              }
 870              eval("\$tppselect = \"".$templates->get("usercp_options_tppselect")."\";");
 871          }
 872          if($mybb->settings['userpppoptions'])
 873          {
 874              $pppoptions = '';
 875              $explodedppp = explode(",", $mybb->settings['userpppoptions']);
 876              if(is_array($explodedppp))
 877              {
 878                  foreach($explodedppp as $val)
 879                  {
 880                      $val = trim($val);
 881                      $ppp_option = $lang->sprintf($lang->ppp_option, $val);
 882                      eval("\$pppoptions .= \"".$templates->get("usercp_options_pppselect_option")."\";");
 883                  }
 884              }
 885              eval("\$pppselect = \"".$templates->get("usercp_options_pppselect")."\";");
 886          }
 887          if($mybb->settings['usereferrals'] == 1 && !$mybb->user['uid'])
 888          {
 889              if(isset($mybb->cookies['mybb']['referrer']))
 890              {
 891                  $query = $db->simple_select("users", "uid,username", "uid='".(int)$mybb->cookies['mybb']['referrer']."'");
 892                  $ref = $db->fetch_array($query);
 893                  $ref['username'] = htmlspecialchars_uni($ref['username']);
 894                  $referrername = $ref['username'];
 895              }
 896              elseif(isset($referrer))
 897              {
 898                  $query = $db->simple_select("users", "username", "uid='".(int)$referrer['uid']."'");
 899                  $ref = $db->fetch_array($query);
 900                  $ref['username'] = htmlspecialchars_uni($ref['username']);
 901                  $referrername = $ref['username'];
 902              }
 903              elseif(!empty($referrername))
 904              {
 905                  $ref = get_user_by_username($referrername);
 906                  if(!$ref['uid'])
 907                  {
 908                      $errors[] = $lang->error_badreferrer;
 909                  }
 910              }
 911              else
 912              {
 913                  $referrername = '';
 914              }
 915              if(isset($quickreg))
 916              {
 917                  $refbg = "trow1";
 918              }
 919              else
 920              {
 921                  $refbg = "trow2";
 922              }
 923              eval("\$referrer = \"".$templates->get("member_register_referrer")."\";");
 924          }
 925          else
 926          {
 927              $referrer = '';
 928          }
 929          $mybb->input['profile_fields'] = $mybb->get_input('profile_fields', MyBB::INPUT_ARRAY);
 930          // Custom profile fields baby!
 931          $altbg = "trow1";
 932          $requiredfields = $customfields = '';
 933  
 934          if($mybb->settings['regtype'] == "verify" || $mybb->settings['regtype'] == "admin" || $mybb->settings['regtype'] == "both" || $mybb->get_input('coppa', MyBB::INPUT_INT) == 1)
 935          {
 936              $usergroup = 5;
 937          }
 938          else
 939          {
 940              $usergroup = 2;
 941          }
 942  
 943          $pfcache = $cache->read('profilefields');
 944  
 945          if(is_array($pfcache))
 946          {
 947              foreach($pfcache as $profilefield)
 948              {
 949                  if($profilefield['required'] != 1 && $profilefield['registration'] != 1 || !is_member($profilefield['editableby'], array('usergroup' => $mybb->user['usergroup'], 'additionalgroups' => $usergroup)))
 950                  {
 951                      continue;
 952                  }
 953  
 954                  $code = $select = $val = $options = $expoptions = $useropts = '';
 955                  $seloptions = array();
 956                  $profilefield['type'] = htmlspecialchars_uni($profilefield['type']);
 957                  $thing = explode("\n", $profilefield['type'], "2");
 958                  $type = trim($thing[0]);
 959                  $options = $thing[1];
 960                  $select = '';
 961                  $field = "fid{$profilefield['fid']}";
 962                  $profilefield['description'] = htmlspecialchars_uni($profilefield['description']);
 963                  $profilefield['name'] = htmlspecialchars_uni($profilefield['name']);
 964                  if($errors && isset($mybb->input['profile_fields'][$field]))
 965                  {
 966                      $userfield = $mybb->input['profile_fields'][$field];
 967                  }
 968                  else
 969                  {
 970                      $userfield = '';
 971                  }
 972                  if($type == "multiselect")
 973                  {
 974                      if($errors)
 975                      {
 976                          $useropts = $userfield;
 977                      }
 978                      else
 979                      {
 980                          $useropts = explode("\n", $userfield);
 981                      }
 982                      if(is_array($useropts))
 983                      {
 984                          foreach($useropts as $key => $val)
 985                          {
 986                              $seloptions[$val] = $val;
 987                          }
 988                      }
 989                      $expoptions = explode("\n", $options);
 990                      if(is_array($expoptions))
 991                      {
 992                          foreach($expoptions as $key => $val)
 993                          {
 994                              $val = trim($val);
 995                              $val = str_replace("\n", "\\n", $val);
 996  
 997                              $sel = "";
 998                              if(isset($seloptions[$val]) && $val == $seloptions[$val])
 999                              {
1000                                  $sel = ' selected="selected"';
1001                              }
1002  
1003                              eval("\$select .= \"".$templates->get("usercp_profile_profilefields_select_option")."\";");
1004                          }
1005                          if(!$profilefield['length'])
1006                          {
1007                              $profilefield['length'] = 3;
1008                          }
1009  
1010                          eval("\$code = \"".$templates->get("usercp_profile_profilefields_multiselect")."\";");
1011                      }
1012                  }
1013                  elseif($type == "select")
1014                  {
1015                      $expoptions = explode("\n", $options);
1016                      if(is_array($expoptions))
1017                      {
1018                          foreach($expoptions as $key => $val)
1019                          {
1020                              $val = trim($val);
1021                              $val = str_replace("\n", "\\n", $val);
1022                              $sel = "";
1023                              if($val == $userfield)
1024                              {
1025                                  $sel = ' selected="selected"';
1026                              }
1027  
1028                              eval("\$select .= \"".$templates->get("usercp_profile_profilefields_select_option")."\";");
1029                          }
1030                          if(!$profilefield['length'])
1031                          {
1032                              $profilefield['length'] = 1;
1033                          }
1034  
1035                          eval("\$code = \"".$templates->get("usercp_profile_profilefields_select")."\";");
1036                      }
1037                  }
1038                  elseif($type == "radio")
1039                  {
1040                      $expoptions = explode("\n", $options);
1041                      if(is_array($expoptions))
1042                      {
1043                          foreach($expoptions as $key => $val)
1044                          {
1045                              $checked = "";
1046                              if($val == $userfield)
1047                              {
1048                                  $checked = 'checked="checked"';
1049                              }
1050  
1051                              eval("\$code .= \"".$templates->get("usercp_profile_profilefields_radio")."\";");
1052                          }
1053                      }
1054                  }
1055                  elseif($type == "checkbox")
1056                  {
1057                      if($errors)
1058                      {
1059                          $useropts = $userfield;
1060                      }
1061                      else
1062                      {
1063                          $useropts = explode("\n", $userfield);
1064                      }
1065                      if(is_array($useropts))
1066                      {
1067                          foreach($useropts as $key => $val)
1068                          {
1069                              $seloptions[$val] = $val;
1070                          }
1071                      }
1072                      $expoptions = explode("\n", $options);
1073                      if(is_array($expoptions))
1074                      {
1075                          foreach($expoptions as $key => $val)
1076                          {
1077                              $checked = "";
1078                              if(isset($seloptions[$val]) && $val == $seloptions[$val])
1079                              {
1080                                  $checked = 'checked="checked"';
1081                              }
1082  
1083                              eval("\$code .= \"".$templates->get("usercp_profile_profilefields_checkbox")."\";");
1084                          }
1085                      }
1086                  }
1087                  elseif($type == "textarea")
1088                  {
1089                      $value = htmlspecialchars_uni($userfield);
1090                      eval("\$code = \"".$templates->get("usercp_profile_profilefields_textarea")."\";");
1091                  }
1092                  else
1093                  {
1094                      $value = htmlspecialchars_uni($userfield);
1095                      $maxlength = "";
1096                      if($profilefield['maxlength'] > 0)
1097                      {
1098                          $maxlength = " maxlength=\"{$profilefield['maxlength']}\"";
1099                      }
1100  
1101                      eval("\$code = \"".$templates->get("usercp_profile_profilefields_text")."\";");
1102                  }
1103  
1104                  if($profilefield['required'] == 1)
1105                  {
1106                      // JS validator extra, choose correct selectors for everything except single select which always has value
1107                      if($type != 'select')
1108                      {
1109                          if($type == "textarea")
1110                          {
1111                              $inp_selector = "$('textarea[name=\"profile_fields[{$field}]\"]')";
1112                          }
1113                          elseif($type == "multiselect")
1114                          {
1115                              $inp_selector = "$('select[name=\"profile_fields[{$field}][]\"]')";
1116                          }
1117                          elseif($type == "checkbox")
1118                          {
1119                              $inp_selector = "$('input[name=\"profile_fields[{$field}][]\"]')";
1120                          }
1121                          else
1122                          {
1123                              $inp_selector = "$('input[name=\"profile_fields[{$field}]\"]')";
1124                          }
1125  
1126                          $validator_javascript .= "
1127      {$inp_selector}.rules('add', {
1128          required: true,
1129          messages: {
1130              required: '{$lang->js_validator_not_empty}'
1131          }
1132      });\n";
1133                      }
1134  
1135                      eval("\$requiredfields .= \"".$templates->get("member_register_customfield")."\";");
1136                  }
1137                  else
1138                  {
1139                      eval("\$customfields .= \"".$templates->get("member_register_customfield")."\";");
1140                  }
1141              }
1142  
1143              if($requiredfields)
1144              {
1145                  eval("\$requiredfields = \"".$templates->get("member_register_requiredfields")."\";");
1146              }
1147  
1148              if($customfields)
1149              {
1150                  eval("\$customfields = \"".$templates->get("member_register_additionalfields")."\";");
1151              }
1152          }
1153  
1154          if(!isset($fromreg))
1155          {
1156              $allownoticescheck = "checked=\"checked\"";
1157              $hideemailcheck = '';
1158              $receivepmscheck = "checked=\"checked\"";
1159              $pmnoticecheck = " checked=\"checked\"";
1160              $pmnotifycheck = '';
1161              $invisiblecheck = '';
1162              if($mybb->settings['dstcorrection'] == 1)
1163              {
1164                  $enabledstcheck = "checked=\"checked\"";
1165              }
1166              $no_auto_subscribe_selected = $instant_email_subscribe_selected = $instant_pm_subscribe_selected = $no_subscribe_selected = '';
1167              $dst_auto_selected = $dst_enabled_selected = $dst_disabled_selected = '';
1168              $username = $email = $email2 = '';
1169              $regerrors = '';
1170          }
1171          // Spambot registration image thingy
1172          if($mybb->settings['captchaimage'])
1173          {
1174              require_once  MYBB_ROOT.'inc/class_captcha.php';
1175              $captcha = new captcha(true, "member_register_regimage");
1176  
1177              if($captcha->html)
1178              {
1179                  $regimage = $captcha->html;
1180  
1181                  if($mybb->settings['captchaimage'] == 1)
1182                  {
1183                      // JS validator extra for our default CAPTCHA
1184                      $validator_javascript .= "
1185      $('#imagestring').rules('add', {
1186          required: true,
1187          remote:{
1188              url: 'xmlhttp.php?action=validate_captcha',
1189              type: 'post',
1190              dataType: 'json',
1191              data:
1192              {
1193                  imagehash: function () {
1194                      return $('#imagehash').val();
1195                  },
1196                  my_post_key: my_post_key
1197              },
1198          },
1199          messages: {
1200              remote: '{$lang->js_validator_no_image_text}'
1201          }
1202      });\n";
1203                  }
1204              }
1205          }
1206  
1207          // Security Question
1208          $questionbox = '';
1209          if($mybb->settings['securityquestion'])
1210          {
1211              $sid = generate_question();
1212              $query = $db->query("
1213                  SELECT q.question, s.sid
1214                  FROM ".TABLE_PREFIX."questionsessions s
1215                  LEFT JOIN ".TABLE_PREFIX."questions q ON (q.qid=s.qid)
1216                  WHERE q.active='1' AND s.sid='{$sid}'
1217              ");
1218              if($db->num_rows($query) > 0)
1219              {
1220                  $question = $db->fetch_array($query);
1221  
1222                  $question['question'] = htmlspecialchars_uni($question['question']);
1223                  $question['sid'] = htmlspecialchars_uni($question['sid']);
1224  
1225                  $refresh = '';
1226                  // Total questions
1227                  $q = $db->simple_select('questions', 'COUNT(qid) as num', 'active=1');
1228                  $num = $db->fetch_field($q, 'num');
1229                  if($num > 1)
1230                  {
1231                      eval("\$refresh = \"".$templates->get("member_register_question_refresh")."\";");
1232                  }
1233  
1234                  eval("\$questionbox = \"".$templates->get("member_register_question")."\";");
1235  
1236                  $validator_javascript .= "
1237      $('#answer').rules('add', {
1238          required: true,
1239          remote:{
1240              url: 'xmlhttp.php?action=validate_question',
1241              type: 'post',
1242              dataType: 'json',
1243              data:
1244              {
1245                  question: function () {
1246                      return $('#question_id').val();
1247                  },
1248                  my_post_key: my_post_key
1249              },
1250          },
1251          messages: {
1252              remote: '{$lang->js_validator_no_security_question}'
1253          }
1254      });\n";
1255              }
1256          }
1257  
1258          $hiddencaptcha = '';
1259          // Hidden CAPTCHA for Spambots
1260          if($mybb->settings['hiddencaptchaimage'])
1261          {
1262              $captcha_field = $mybb->settings['hiddencaptchaimagefield'];
1263  
1264              eval("\$hiddencaptcha = \"".$templates->get("member_register_hiddencaptcha")."\";");
1265          }
1266          if($mybb->settings['regtype'] != "randompass")
1267          {
1268              // JS validator extra
1269              $lang->js_validator_password_length = $lang->sprintf($lang->js_validator_password_length, $mybb->settings['minpasswordlength']);
1270  
1271              $validator_javascript .= "
1272      $.validator.addMethod('passwordSecurity', function(value, element, param) {
1273          return !(
1274                  ($('#email').val() != '' && value == $('#email').val()) ||
1275                  ($('#username').val() != '' && value == $('#username').val()) ||
1276                  ($('#email').val() != '' && value.indexOf($('#email').val()) > -1) ||
1277                  ($('#username').val() != '' && value.indexOf($('#username').val()) > -1) ||
1278                  ($('#email').val() != '' && $('#email').val().indexOf(value) > -1) ||
1279                  ($('#username').val() != '' && $('#username').val().indexOf(value) > -1)
1280          );
1281      }, '{$lang->js_validator_bad_password_security}');\n";
1282  
1283              // See if the board has "require complex passwords" enabled.
1284              if($mybb->settings['requirecomplexpasswords'] == 1)
1285              {
1286                  $lang->password = $lang->complex_password = $lang->sprintf($lang->complex_password, $mybb->settings['minpasswordlength']);
1287  
1288                  $validator_javascript .= "
1289      $('#password').rules('add', {
1290          required: true,
1291          minlength: {$mybb->settings['minpasswordlength']},
1292          remote:{
1293              url: 'xmlhttp.php?action=complex_password',
1294              type: 'post',
1295              dataType: 'json',
1296              data:
1297              {
1298                  my_post_key: my_post_key
1299              },
1300          },
1301          passwordSecurity: '',
1302          messages: {
1303              minlength: '{$lang->js_validator_password_length}',
1304              required: '{$lang->js_validator_password_length}',
1305              remote: '{$lang->js_validator_no_image_text}'
1306          }
1307      });\n";
1308              }
1309              else
1310              {
1311                  $validator_javascript .= "
1312      $('#password').rules('add', {
1313          required: true,
1314          minlength: {$mybb->settings['minpasswordlength']},
1315          passwordSecurity: '',
1316          messages: {
1317              minlength: '{$lang->js_validator_password_length}',
1318              required: '{$lang->js_validator_password_length}'
1319          }
1320      });\n";
1321              }
1322  
1323              $validator_javascript .= "
1324      $('#password2').rules('add', {
1325          required: true,
1326          minlength: {$mybb->settings['minpasswordlength']},
1327          equalTo: '#password',
1328          messages: {
1329              minlength: '{$lang->js_validator_password_length}',
1330              required: '{$lang->js_validator_password_length}',
1331              equalTo: '{$lang->js_validator_password_matches}'
1332          }
1333      });\n";
1334  
1335              eval("\$passboxes = \"".$templates->get("member_register_password")."\";");
1336          }
1337  
1338          $languages = $lang->get_languages();
1339          $langoptions = $boardlanguage = '';
1340          if(count($languages) > 1)
1341          {
1342              foreach($languages as $name => $language)
1343              {
1344                  $language = htmlspecialchars_uni($language);
1345  
1346                  $sel = '';
1347                  if($mybb->get_input('language') == $name)
1348                  {
1349                      $sel = " selected=\"selected\"";
1350                  }
1351  
1352                  eval('$langoptions .= "'.$templates->get('usercp_options_language_option').'";');
1353              }
1354  
1355              eval('$boardlanguage = "'.$templates->get('member_register_language').'";');
1356          }
1357  
1358          // Set the time so we can find automated signups
1359          $time = TIME_NOW;
1360  
1361          $plugins->run_hooks("member_register_end");
1362  
1363          $validator_javascript .= "
1364  });
1365  </script>\n";
1366  
1367          eval("\$registration = \"".$templates->get("member_register")."\";");
1368          output_page($registration);
1369      }
1370  }
1371  
1372  if($mybb->input['action'] == "activate")
1373  {
1374      $plugins->run_hooks("member_activate_start");
1375  
1376      if(isset($mybb->input['username']))
1377      {
1378          $mybb->input['username'] = $mybb->get_input('username');
1379          $options = array(
1380              'username_method' => $mybb->settings['username_method'],
1381              'fields' => '*',
1382          );
1383          $user = get_user_by_username($mybb->input['username'], $options);
1384          if(!$user)
1385          {
1386              switch($mybb->settings['username_method'])
1387              {
1388                  case 0:
1389                      error($lang->error_invalidpworusername);
1390                      break;
1391                  case 1:
1392                      error($lang->error_invalidpworusername1);
1393                      break;
1394                  case 2:
1395                      error($lang->error_invalidpworusername2);
1396                      break;
1397                  default:
1398                      error($lang->error_invalidpworusername);
1399                      break;
1400              }
1401          }
1402          $uid = $user['uid'];
1403      }
1404      else
1405      {
1406          $user = get_user($mybb->get_input('uid', MyBB::INPUT_INT));
1407      }
1408      if(isset($mybb->input['code']) && $user)
1409      {
1410          $query = $db->simple_select("awaitingactivation", "*", "uid='".$user['uid']."' AND (type='r' OR type='e' OR type='b')");
1411          $activation = $db->fetch_array($query);
1412          if(!$activation['uid'])
1413          {
1414              error($lang->error_alreadyactivated);
1415          }
1416          if($activation['code'] !== $mybb->get_input('code'))
1417          {
1418              error($lang->error_badactivationcode);
1419          }
1420  
1421          if($activation['type'] == "b" && $activation['validated'] == 1)
1422          {
1423              error($lang->error_alreadyvalidated);
1424          }
1425  
1426          $db->delete_query("awaitingactivation", "uid='".$user['uid']."' AND (type='r' OR type='e')");
1427  
1428          if($user['usergroup'] == 5 && $activation['type'] != "e" && $activation['type'] != "b")
1429          {
1430              $db->update_query("users", array("usergroup" => 2), "uid='".$user['uid']."'");
1431  
1432              $cache->update_awaitingactivation();
1433          }
1434          if($activation['type'] == "e")
1435          {
1436              $newemail = array(
1437                  "email" => $db->escape_string($activation['misc']),
1438              );
1439              $db->update_query("users", $newemail, "uid='".$user['uid']."'");
1440              $plugins->run_hooks("member_activate_emailupdated");
1441  
1442              redirect("usercp.php", $lang->redirect_emailupdated);
1443          }
1444          elseif($activation['type'] == "b")
1445          {
1446              $update = array(
1447                  "validated" => 1,
1448              );
1449              $db->update_query("awaitingactivation", $update, "uid='".$user['uid']."' AND type='b'");
1450              $plugins->run_hooks("member_activate_emailactivated");
1451  
1452              redirect("index.php", $lang->redirect_accountactivated_admin, "", true);
1453          }
1454          else
1455          {
1456              $plugins->run_hooks("member_activate_accountactivated");
1457  
1458              redirect("index.php", $lang->redirect_accountactivated);
1459          }
1460      }
1461      else
1462      {
1463          $plugins->run_hooks("member_activate_form");
1464  
1465          $code = htmlspecialchars_uni($mybb->get_input('code'));
1466  
1467          if(!isset($user['username']))
1468          {
1469              $user['username'] = '';
1470          }
1471          $user['username'] = htmlspecialchars_uni($user['username']);
1472  
1473          eval("\$activate = \"".$templates->get("member_activate")."\";");
1474          output_page($activate);
1475      }
1476  }
1477  
1478  if($mybb->input['action'] == "resendactivation")
1479  {
1480      $plugins->run_hooks("member_resendactivation");
1481  
1482      if($mybb->settings['regtype'] == "admin")
1483      {
1484          error($lang->error_activated_by_admin);
1485      }
1486      if($mybb->user['uid'] && $mybb->user['usergroup'] != 5)
1487      {
1488          error($lang->error_alreadyactivated);
1489      }
1490  
1491      $query = $db->simple_select("awaitingactivation", "*", "uid='".$user['uid']."' AND type='b'");
1492      $activation = $db->fetch_array($query);
1493  
1494      if($activation['validated'] == 1)
1495      {
1496          error($lang->error_activated_by_admin);
1497      }
1498  
1499      $plugins->run_hooks("member_resendactivation_end");
1500  
1501      eval("\$activate = \"".$templates->get("member_resendactivation")."\";");
1502      output_page($activate);
1503  }
1504  
1505  if($mybb->input['action'] == "do_resendactivation" && $mybb->request_method == "post")
1506  {
1507      $plugins->run_hooks("member_do_resendactivation_start");
1508  
1509      if($mybb->settings['regtype'] == "admin")
1510      {
1511          error($lang->error_activated_by_admin);
1512      }
1513  
1514      $query = $db->query("
1515          SELECT u.uid, u.username, u.usergroup, u.email, a.code, a.type, a.validated
1516          FROM ".TABLE_PREFIX."users u
1517          LEFT JOIN ".TABLE_PREFIX."awaitingactivation a ON (a.uid=u.uid AND a.type='r' OR a.type='b')
1518          WHERE u.email='".$db->escape_string($mybb->get_input('email'))."'
1519      ");
1520      $numusers = $db->num_rows($query);
1521      if($numusers < 1)
1522      {
1523          error($lang->error_invalidemail);
1524      }
1525      else
1526      {
1527          while($user = $db->fetch_array($query))
1528          {
1529              if($user['type'] == "b" && $user['validated'] == 1)
1530              {
1531                  error($lang->error_activated_by_admin);
1532              }
1533  
1534              if($user['usergroup'] == 5)
1535              {
1536                  if(!$user['code'])
1537                  {
1538                      $user['code'] = random_str();
1539                      $uid = $user['uid'];
1540                      $awaitingarray = array(
1541                          "uid" => $uid,
1542                          "dateline" => TIME_NOW,
1543                          "code" => $user['code'],
1544                          "type" => $user['type']
1545                      );
1546                      $db->insert_query("awaitingactivation", $awaitingarray);
1547                  }
1548                  $username = $user['username'];
1549                  $email = $user['email'];
1550                  $activationcode = $user['code'];
1551                  $emailsubject = $lang->sprintf($lang->emailsubject_activateaccount, $mybb->settings['bbname']);
1552                  switch($mybb->settings['username_method'])
1553                  {
1554                      case 0:
1555                          $emailmessage = $lang->sprintf($lang->email_activateaccount, $user['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user['uid'], $activationcode);
1556                          break;
1557                      case 1:
1558                          $emailmessage = $lang->sprintf($lang->email_activateaccount1, $user['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user['uid'], $activationcode);
1559                          break;
1560                      case 2:
1561                          $emailmessage = $lang->sprintf($lang->email_activateaccount2, $user['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user['uid'], $activationcode);
1562                          break;
1563                      default:
1564                          $emailmessage = $lang->sprintf($lang->email_activateaccount, $user['username'], $mybb->settings['bbname'], $mybb->settings['bburl'], $user['uid'], $activationcode);
1565                          break;
1566                  }
1567                  my_mail($email, $emailsubject, $emailmessage);
1568              }
1569          }
1570          $plugins->run_hooks("member_do_resendactivation_end");
1571  
1572          redirect("index.php", $lang->redirect_activationresent);
1573      }
1574  }
1575  
1576  if($mybb->input['action'] == "lostpw")
1577  {
1578      $plugins->run_hooks("member_lostpw");
1579  
1580      eval("\$lostpw = \"".$templates->get("member_lostpw")."\";");
1581      output_page($lostpw);
1582  }
1583  
1584  if($mybb->input['action'] == "do_lostpw" && $mybb->request_method == "post")
1585  {
1586      $plugins->run_hooks("member_do_lostpw_start");
1587  
1588      $email = $db->escape_string($email);
1589      $query = $db->simple_select("users", "*", "email='".$db->escape_string($mybb->get_input('email'))."'");
1590      $numusers = $db->num_rows($query);
1591      if($numusers < 1)
1592      {
1593          error($lang->error_invalidemail);
1594      }
1595      else
1596      {
1597          while($user = $db->fetch_array($query))
1598          {
1599              $db->delete_query("awaitingactivation", "uid='{$user['uid']}' AND type='p'");
1600              $user['activationcode'] = random_str(30);
1601              $now = TIME_NOW;
1602              $uid = $user['uid'];
1603              $awaitingarray = array(
1604                  "uid" => $user['uid'],
1605                  "dateline" => TIME_NOW,
1606                  "code" => $user['activationcode'],
1607                  "type" => "p"
1608              );
1609              $db->insert_query("awaitingactivation", $awaitingarray);
1610              $username = $user['username'];
1611              $email = $user['email'];
1612              $activationcode = $user['activationcode'];
1613              $emailsubject = $lang->sprintf($lang->emailsubject_lostpw, $mybb->settings['bbname']);
1614              switch($mybb->settings['username_method'])
1615              {
1616                  case 0:
1617                      $emailmessage = $lang->sprintf($lang->email_lostpw, $username, $mybb->settings['bbname'], $mybb->settings['bburl'], $uid, $activationcode);
1618                      break;
1619                  case 1:
1620                      $emailmessage = $lang->sprintf($lang->email_lostpw1, $username, $mybb->settings['bbname'], $mybb->settings['bburl'], $uid, $activationcode);
1621                      break;
1622                  case 2:
1623                      $emailmessage = $lang->sprintf($lang->email_lostpw2, $username, $mybb->settings['bbname'], $mybb->settings['bburl'], $uid, $activationcode);
1624                      break;
1625                  default:
1626                      $emailmessage = $lang->sprintf($lang->email_lostpw, $username, $mybb->settings['bbname'], $mybb->settings['bburl'], $uid, $activationcode);
1627                      break;
1628              }
1629              my_mail($email, $emailsubject, $emailmessage);
1630          }
1631      }
1632      $plugins->run_hooks("member_do_lostpw_end");
1633  
1634      redirect("index.php", $lang->redirect_lostpwsent, "", true);
1635  }
1636  
1637  if($mybb->input['action'] == "resetpassword")
1638  {
1639      $plugins->run_hooks("member_resetpassword_start");
1640  
1641      if(isset($mybb->input['username']))
1642      {
1643          $mybb->input['username'] = $mybb->get_input('username');
1644          $options = array(
1645              'username_method' => $mybb->settings['username_method'],
1646              'fields' => '*',
1647          );
1648          $user = get_user_by_username($mybb->input['username'], $options);
1649          if(!$user)
1650          {
1651              switch($mybb->settings['username_method'])
1652              {
1653                  case 0:
1654                      error($lang->error_invalidpworusername);
1655                      break;
1656                  case 1:
1657                      error($lang->error_invalidpworusername1);
1658                      break;
1659                  case 2:
1660                      error($lang->error_invalidpworusername2);
1661                      break;
1662                  default:
1663                      error($lang->error_invalidpworusername);
1664                      break;
1665              }
1666          }
1667      }
1668      else
1669      {
1670          $user = get_user($mybb->get_input('uid', MyBB::INPUT_INT));
1671      }
1672  
1673      if(isset($mybb->input['code']) && $user)
1674      {
1675          $query = $db->simple_select("awaitingactivation", "code", "uid='".$user['uid']."' AND type='p'");
1676          $activationcode = $db->fetch_field($query, 'code');
1677          $now = TIME_NOW;
1678          if(!$activationcode || $activationcode !== $mybb->get_input('code'))
1679          {
1680              error($lang->error_badlostpwcode);
1681          }
1682          $db->delete_query("awaitingactivation", "uid='".$user['uid']."' AND type='p'");
1683          $username = $user['username'];
1684  
1685          // Generate a new password, then update it
1686          $password_length = (int)$mybb->settings['minpasswordlength'];
1687  
1688          if($password_length < 8)
1689          {
1690              $password_length = min(8, (int)$mybb->settings['maxpasswordlength']);
1691          }
1692  
1693          // Set up user handler.
1694          require_once  MYBB_ROOT.'inc/datahandlers/user.php';
1695          $userhandler = new UserDataHandler('update');
1696  
1697          while(!$userhandler->verify_password())
1698          {
1699              $password = random_str($password_length, $mybb->settings['requirecomplexpasswords']);
1700  
1701              $userhandler->set_data(array(
1702                  'uid'        => $user['uid'],
1703                  'username'    => $user['username'],
1704                  'email'        => $user['email'],
1705                  'password'    => $password
1706              ));
1707  
1708              $userhandler->set_validated(true);
1709              $userhandler->errors = array();
1710          }
1711  
1712          $userhandler->update_user();
1713  
1714          $logindetails = array(
1715              'salt'        => $userhandler->data['salt'],
1716              'password'    => $userhandler->data['saltedpw'],
1717              'loginkey'    => $userhandler->data['loginkey'],
1718          );
1719  
1720          $email = $user['email'];
1721  
1722          $plugins->run_hooks("member_resetpassword_process");
1723  
1724          $emailsubject = $lang->sprintf($lang->emailsubject_passwordreset, $mybb->settings['bbname']);
1725          $emailmessage = $lang->sprintf($lang->email_passwordreset, $username, $mybb->settings['bbname'], $password);
1726          my_mail($email, $emailsubject, $emailmessage);
1727  
1728          $plugins->run_hooks("member_resetpassword_reset");
1729  
1730          error($lang->redirect_passwordreset);
1731      }
1732      else
1733      {
1734          $plugins->run_hooks("member_resetpassword_form");
1735  
1736          switch($mybb->settings['username_method'])
1737          {
1738              case 0:
1739                  $lang_username = $lang->username;
1740                  break;
1741              case 1:
1742                  $lang_username = $lang->username1;
1743                  break;
1744              case 2:
1745                  $lang_username = $lang->username2;
1746                  break;
1747              default:
1748                  $lang_username = $lang->username;
1749                  break;
1750          }
1751  
1752          $code = $mybb->get_input('code');
1753  
1754          if(!isset($user['username']))
1755          {
1756              $user['username'] = '';
1757          }
1758          $user['username'] = htmlspecialchars_uni($user['username']);
1759  
1760          eval("\$activate = \"".$templates->get("member_resetpassword")."\";");
1761          output_page($activate);
1762      }
1763  }
1764  
1765  $do_captcha = $correct = false;
1766  $inline_errors = "";
1767  if($mybb->input['action'] == "do_login" && $mybb->request_method == "post")
1768  {
1769      $plugins->run_hooks("member_do_login_start");
1770  
1771      // Is a fatal call if user has had too many tries
1772      $errors = array();
1773      $logins = login_attempt_check();
1774  
1775      require_once  MYBB_ROOT."inc/datahandlers/login.php";
1776      $loginhandler = new LoginDataHandler("get");
1777  
1778      if($mybb->get_input('quick_password') && $mybb->get_input('quick_username'))
1779      {
1780          $mybb->input['password'] = $mybb->get_input('quick_password');
1781          $mybb->input['username'] = $mybb->get_input('quick_username');
1782          $mybb->input['remember'] = $mybb->get_input('quick_remember');
1783      }
1784  
1785      $user = array(
1786          'username' => $mybb->get_input('username'),
1787          'password' => $mybb->get_input('password'),
1788          'remember' => $mybb->get_input('remember'),
1789          'imagestring' => $mybb->get_input('imagestring')
1790      );
1791  
1792      $options = array(
1793          'fields' => 'loginattempts',
1794          'username_method' => (int)$mybb->settings['username_method'],
1795      );
1796  
1797      $user_loginattempts = get_user_by_username($user['username'], $options);
1798      $user['loginattempts'] = (int)$user_loginattempts['loginattempts'];
1799  
1800      $loginhandler->set_data($user);
1801      $validated = $loginhandler->validate_login();
1802  
1803      if(!$validated)
1804      {
1805          $mybb->input['action'] = "login";
1806          $mybb->request_method = "get";
1807  
1808          my_setcookie('loginattempts', $logins + 1);
1809          $db->update_query("users", array('loginattempts' => 'loginattempts+1'), "uid='".(int)$loginhandler->login_data['uid']."'", 1, true);
1810  
1811          $errors = $loginhandler->get_friendly_errors();
1812  
1813          $user['loginattempts'] = (int)$loginhandler->login_data['loginattempts'];
1814  
1815          // If we need a captcha set it here
1816          if($mybb->settings['failedcaptchalogincount'] > 0 && ($user['loginattempts'] > $mybb->settings['failedcaptchalogincount'] || (int)$mybb->cookies['loginattempts'] > $mybb->settings['failedcaptchalogincount']))
1817          {
1818              $do_captcha = true;
1819              $correct = $loginhandler->captcha_verified;
1820          }
1821      }
1822      else if($validated && $loginhandler->captcha_verified == true)
1823      {
1824          // Successful login
1825          if($loginhandler->login_data['coppauser'])
1826          {
1827              error($lang->error_awaitingcoppa);
1828          }
1829  
1830          $loginhandler->complete_login();
1831  
1832          $plugins->run_hooks("member_do_login_end");
1833  
1834          $mybb->input['url'] = $mybb->get_input('url');
1835  
1836          if(!empty($mybb->input['url']) && my_strpos(basename($mybb->input['url']), 'member.php') === false && !preg_match('#^javascript:#i', $mybb->input['url']))
1837          {
1838              if((my_strpos(basename($mybb->input['url']), 'newthread.php') !== false || my_strpos(basename($mybb->input['url']), 'newreply.php') !== false) && my_strpos($mybb->input['url'], '&processed=1') !== false)
1839              {
1840                  $mybb->input['url'] = str_replace('&processed=1', '', $mybb->input['url']);
1841              }
1842  
1843              $mybb->input['url'] = str_replace('&amp;', '&', $mybb->input['url']);
1844  
1845              // Redirect to the URL if it is not member.php
1846              redirect($mybb->input['url'], $lang->redirect_loggedin);
1847          }
1848          else
1849          {
1850  
1851              redirect("index.php", $lang->redirect_loggedin);
1852          }
1853      }
1854  
1855      $plugins->run_hooks("member_do_login_end");
1856  }
1857  
1858  if($mybb->input['action'] == "login")
1859  {
1860      $plugins->run_hooks("member_login");
1861  
1862      $member_loggedin_notice = "";
1863      if($mybb->user['uid'] != 0)
1864      {
1865          $mybb->user['username'] = htmlspecialchars_uni($mybb->user['username']);
1866          $lang->already_logged_in = $lang->sprintf($lang->already_logged_in, build_profile_link($mybb->user['username'], $mybb->user['uid']));
1867          eval("\$member_loggedin_notice = \"".$templates->get("member_loggedin_notice")."\";");
1868      }
1869  
1870      // Checks to make sure the user can login; they haven't had too many tries at logging in.
1871      // Is a fatal call if user has had too many tries
1872      login_attempt_check();
1873  
1874      // Redirect to the page where the user came from, but not if that was the login page.
1875      if(isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], "action=login") === false)
1876      {
1877          $redirect_url = htmlentities($_SERVER['HTTP_REFERER']);
1878      }
1879      else
1880      {
1881          $redirect_url = '';
1882      }
1883  
1884      $captcha = '';
1885      // Show captcha image for guests if enabled and only if we have to do
1886      if($mybb->settings['captchaimage'] && $do_captcha == true)
1887      {
1888          require_once  MYBB_ROOT.'inc/class_captcha.php';
1889          $login_captcha = new captcha(false, "post_captcha");
1890  
1891          if($login_captcha->type == 1)
1892          {
1893              if(!$correct)
1894              {
1895                  $login_captcha->build_captcha();
1896              }
1897              else
1898              {
1899                  $captcha = $login_captcha->build_hidden_captcha();
1900              }
1901          }
1902          elseif(in_array($login_captcha->type, array(2, 4, 5)))
1903          {
1904              $login_captcha->build_recaptcha();
1905          }
1906  
1907          if($login_captcha->html)
1908          {
1909              $captcha = $login_captcha->html;
1910          }
1911      }
1912  
1913      $username = "";
1914      $password = "";
1915      if(isset($mybb->input['username']) && $mybb->request_method == "post")
1916      {
1917          $username = htmlspecialchars_uni($mybb->get_input('username'));
1918      }
1919  
1920      if(isset($mybb->input['password']) && $mybb->request_method == "post")
1921      {
1922          $password = htmlspecialchars_uni($mybb->get_input('password'));
1923      }
1924  
1925      if(!empty($errors))
1926      {
1927          $mybb->input['action'] = "login";
1928          $mybb->request_method = "get";
1929  
1930          $inline_errors = inline_error($errors);
1931      }
1932  
1933      switch($mybb->settings['username_method'])
1934      {
1935          case 1:
1936              $lang->username = $lang->username1;
1937              break;
1938          case 2:
1939              $lang->username = $lang->username2;
1940              break;
1941          default:
1942              break;
1943      }
1944  
1945      $plugins->run_hooks("member_login_end");
1946  
1947      eval("\$login = \"".$templates->get("member_login")."\";");
1948      output_page($login);
1949  }
1950  
1951  if($mybb->input['action'] == "logout")
1952  {
1953      $plugins->run_hooks("member_logout_start");
1954  
1955      if(!$mybb->user['uid'])
1956      {
1957          redirect("index.php", $lang->redirect_alreadyloggedout);
1958      }
1959  
1960      // Check session ID if we have one
1961      if(isset($mybb->input['sid']) && $mybb->get_input('sid') !== $session->sid)
1962      {
1963          error($lang->error_notloggedout);
1964      }
1965      // Otherwise, check logoutkey
1966      else if(!isset($mybb->input['sid']) && $mybb->get_input('logoutkey') !== $mybb->user['logoutkey'])
1967      {
1968          error($lang->error_notloggedout);
1969      }
1970  
1971      my_unsetcookie("mybbuser");
1972      my_unsetcookie("sid");
1973  
1974      if($mybb->user['uid'])
1975      {
1976          $time = TIME_NOW;
1977          // Run this after the shutdown query from session system
1978          $db->shutdown_query("UPDATE ".TABLE_PREFIX."users SET lastvisit='{$time}', lastactive='{$time}' WHERE uid='{$mybb->user['uid']}'");
1979          $db->delete_query("sessions", "sid = '{$session->sid}'");
1980      }
1981  
1982      $plugins->run_hooks("member_logout_end");
1983  
1984      redirect("index.php", $lang->redirect_loggedout);
1985  }
1986  
1987  if($mybb->input['action'] == "viewnotes")
1988  {
1989      $uid = $mybb->get_input('uid', MyBB::INPUT_INT);
1990      $user = get_user($uid);
1991  
1992      // Make sure we are looking at a real user here.
1993      if(!$user)
1994      {
1995          error($lang->error_nomember);
1996      }
1997  
1998      if($mybb->user['uid'] == 0 || $mybb->usergroup['canmodcp'] != 1)
1999      {
2000          error_no_permission();
2001      }
2002  
2003      $user['username'] = htmlspecialchars_uni($user['username']);
2004      $lang->view_notes_for = $lang->sprintf($lang->view_notes_for, $user['username']);
2005  
2006      $user['usernotes'] = nl2br(htmlspecialchars_uni($user['usernotes']));
2007  
2008      $plugins->run_hooks('member_viewnotes');
2009  
2010      eval("\$viewnotes = \"".$templates->get("member_viewnotes", 1, 0)."\";");
2011      echo $viewnotes;
2012      exit;
2013  }
2014  
2015  if($mybb->input['action'] == "profile")
2016  {
2017      $plugins->run_hooks("member_profile_start");
2018  
2019      if($mybb->usergroup['canviewprofiles'] == 0)
2020      {
2021          error_no_permission();
2022      }
2023  
2024      $uid = $mybb->get_input('uid', MyBB::INPUT_INT);
2025      if($uid)
2026      {
2027          $memprofile = get_user($uid);
2028      }
2029      elseif($mybb->user['uid'])
2030      {
2031          $memprofile = $mybb->user;
2032      }
2033      else
2034      {
2035          $memprofile = false;
2036      }
2037  
2038      if(!$memprofile)
2039      {
2040          error($lang->error_nomember);
2041      }
2042  
2043      $uid = $memprofile['uid'];
2044  
2045      $me_username = $memprofile['username'];
2046      $memprofile['username'] = htmlspecialchars_uni($memprofile['username']);
2047      $lang->profile = $lang->sprintf($lang->profile, $memprofile['username']);
2048  
2049      // Get member's permissions
2050      $memperms = user_permissions($memprofile['uid']);
2051  
2052      $lang->nav_profile = $lang->sprintf($lang->nav_profile, $memprofile['username']);
2053      add_breadcrumb($lang->nav_profile);
2054  
2055      $lang->users_forum_info = $lang->sprintf($lang->users_forum_info, $memprofile['username']);
2056      $lang->users_contact_details = $lang->sprintf($lang->users_contact_details, $memprofile['username']);
2057      $lang->send_pm = $lang->sprintf($lang->send_pm, $memprofile['username']);
2058      $lang->away_note = $lang->sprintf($lang->away_note, $memprofile['username']);
2059      $lang->users_additional_info = $lang->sprintf($lang->users_additional_info, $memprofile['username']);
2060      $lang->users_signature = $lang->sprintf($lang->users_signature, $memprofile['username']);
2061      $lang->send_user_email = $lang->sprintf($lang->send_user_email, $memprofile['username']);
2062  
2063      $useravatar = format_avatar($memprofile['avatar'], $memprofile['avatardimensions']);
2064      eval("\$avatar = \"".$templates->get("member_profile_avatar")."\";");
2065  
2066      $website = $sendemail = $sendpm = $contact_details = '';
2067  
2068      if(my_validate_url($memprofile['website']) && !is_member($mybb->settings['hidewebsite']) && $memperms['canchangewebsite'] == 1)
2069      {
2070          $memprofile['website'] = htmlspecialchars_uni($memprofile['website']);
2071          $bgcolor = alt_trow();
2072          eval("\$website = \"".$templates->get("member_profile_website")."\";");
2073      }
2074  
2075      if($memprofile['hideemail'] != 1 && (my_strpos(",".$memprofile['ignorelist'].",", ",".$mybb->user['uid'].",") === false || $mybb->usergroup['cansendemailoverride'] != 0))
2076      {
2077          $bgcolor = alt_trow();
2078          eval("\$sendemail = \"".$templates->get("member_profile_email")."\";");
2079      }
2080  
2081      if($mybb->settings['enablepms'] != 0 && (($memprofile['receivepms'] != 0 && $memperms['canusepms'] != 0 && my_strpos(",".$memprofile['ignorelist'].",", ",".$mybb->user['uid'].",") === false) || $mybb->usergroup['canoverridepm'] == 1))
2082      {
2083          $bgcolor = alt_trow();
2084          eval('$sendpm = "'.$templates->get("member_profile_pm").'";');
2085      }
2086  
2087      $contact_fields = array();
2088      $any_contact_field = false;
2089      foreach(array('icq', 'aim', 'yahoo', 'skype', 'google') as $field)
2090      {
2091          $contact_fields[$field] = '';
2092          $settingkey = 'allow'.$field.'field';
2093  
2094          if(!empty($memprofile[$field]) && is_member($mybb->settings[$settingkey], array('usergroup' => $memprofile['usergroup'], 'additionalgroups' => $memprofile['additionalgroups'])))
2095          {
2096              $any_contact_field = true;
2097  
2098              if($field == 'icq')
2099              {
2100                  $memprofile[$field] = (int)$memprofile[$field];
2101              }
2102              else
2103              {
2104                  $memprofile[$field] = htmlspecialchars_uni($memprofile[$field]);
2105              }
2106              $tmpl = 'member_profile_contact_fields_'.$field;
2107  
2108              $bgcolors[$field] = alt_trow();
2109              eval('$contact_fields[\''.$field.'\'] = "'.$templates->get($tmpl).'";');
2110          }
2111      }
2112  
2113      if($any_contact_field || $sendemail || $sendpm || $website)
2114      {
2115          eval('$contact_details = "'.$templates->get("member_profile_contact_details").'";');
2116      }
2117  
2118      $signature = '';
2119      if($memprofile['signature'] && ($memprofile['suspendsignature'] == 0 || $memprofile['suspendsigtime'] < TIME_NOW) && !is_member($mybb->settings['hidesignatures']) && $memperms['canusesig'] && $memperms['canusesigxposts'] <= $memprofile['postnum'])
2120      {
2121          $sig_parser = array(
2122              "allow_html" => $mybb->settings['sightml'],
2123              "allow_mycode" => $mybb->settings['sigmycode'],
2124              "allow_smilies" => $mybb->settings['sigsmilies'],
2125              "allow_imgcode" => $mybb->settings['sigimgcode'],
2126              "me_username" => $me_username,
2127              "filter_badwords" => 1
2128          );
2129  
2130          if($memperms['signofollow'])
2131          {
2132              $sig_parser['nofollow_on'] = 1;
2133          }
2134  
2135          if($mybb->user['showimages'] != 1 && $mybb->user['uid'] != 0 || $mybb->settings['guestimages'] != 1 && $mybb->user['uid'] == 0)
2136          {
2137              $sig_parser['allow_imgcode'] = 0;
2138          }
2139  
2140          $memprofile['signature'] = $parser->parse_message($memprofile['signature'], $sig_parser);
2141          eval("\$signature = \"".$templates->get("member_profile_signature")."\";");
2142      }
2143  
2144      $daysreg = (TIME_NOW - $memprofile['regdate']) / (24*3600);
2145  
2146      if($daysreg < 1)
2147      {
2148          $daysreg = 1;
2149      }
2150  
2151      $stats = $cache->read("stats");
2152  
2153      // Format post count, per day count and percent of total
2154      $ppd = $memprofile['postnum'] / $daysreg;
2155      $ppd = round($ppd, 2);
2156      if($ppd > $memprofile['postnum'])
2157      {
2158          $ppd = $memprofile['postnum'];
2159      }
2160  
2161      $numposts = $stats['numposts'];
2162      if($numposts == 0)
2163      {
2164          $post_percent = "0";
2165      }
2166      else
2167      {
2168          $post_percent = $memprofile['postnum']*100/$numposts;
2169          $post_percent = round($post_percent, 2);
2170      }
2171  
2172      if($post_percent > 100)
2173      {
2174          $post_percent = 100;
2175      }
2176  
2177      // Format thread count, per day count and percent of total
2178      $tpd = $memprofile['threadnum'] / $daysreg;
2179      $tpd = round($tpd, 2);
2180      if($tpd > $memprofile['threadnum'])
2181      {
2182          $tpd = $memprofile['threadnum'];
2183      }
2184  
2185      $numthreads = $stats['numthreads'];
2186      if($numthreads == 0)
2187      {
2188          $thread_percent = "0";
2189      }
2190      else
2191      {
2192          $thread_percent = $memprofile['threadnum']*100/$numthreads;
2193          $thread_percent = round($thread_percent, 2);
2194      }
2195  
2196      if($thread_percent > 100)
2197      {
2198          $thread_percent = 100;
2199      }
2200  
2201      $findposts = $findthreads = '';
2202      if($mybb->usergroup['cansearch'] == 1)
2203      {
2204          eval("\$findposts = \"".$templates->get("member_profile_findposts")."\";");
2205          eval("\$findthreads = \"".$templates->get("member_profile_findthreads")."\";");
2206      }
2207  
2208      $awaybit = '';
2209      if($memprofile['away'] == 1 && $mybb->settings['allowaway'] != 0)
2210      {
2211          $lang->away_note = $lang->sprintf($lang->away_note, $memprofile['username']);
2212          $awaydate = my_date($mybb->settings['dateformat'], $memprofile['awaydate']);
2213          if(!empty($memprofile['awayreason']))
2214          {
2215              $reason = $parser->parse_badwords($memprofile['awayreason']);
2216              $awayreason = htmlspecialchars_uni($reason);
2217          }
2218          else
2219          {
2220              $awayreason = $lang->away_no_reason;
2221          }
2222          if($memprofile['returndate'] == '')
2223          {
2224              $returndate = "$lang->unknown";
2225          }
2226          else
2227          {
2228              $returnhome = explode("-", $memprofile['returndate']);
2229  
2230              // PHP native date functions use integers so timestamps for years after 2038 will not work
2231              // Thus we use adodb_mktime
2232              if($returnhome[2] >= 2038)
2233              {
2234                  require_once  MYBB_ROOT."inc/functions_time.php";
2235                  $returnmkdate = adodb_mktime(0, 0, 0, $returnhome[1], $returnhome[0], $returnhome[2]);
2236                  $returndate = my_date($mybb->settings['dateformat'], $returnmkdate, "", 1, true);
2237              }
2238              else
2239              {
2240                  $returnmkdate = mktime(0, 0, 0, $returnhome[1], $returnhome[0], $returnhome[2]);
2241                  $returndate = my_date($mybb->settings['dateformat'], $returnmkdate);
2242              }
2243  
2244              // If our away time has expired already, we should be back, right?
2245              if($returnmkdate < TIME_NOW)
2246              {
2247                  $db->update_query('users', array('away' => '0', 'awaydate' => '0', 'returndate' => '', 'awayreason' => ''), 'uid=\''.(int)$memprofile['uid'].'\'');
2248  
2249                  // Update our status to "not away"
2250                  $memprofile['away'] = 0;
2251              }
2252          }
2253  
2254          // Check if our away status is set to 1, it may have been updated already (see a few lines above)
2255          if($memprofile['away'] == 1)
2256          {
2257              eval("\$awaybit = \"".$templates->get("member_profile_away")."\";");
2258          }
2259      }
2260  
2261      $memprofile['timezone'] = (float)$memprofile['timezone'];
2262  
2263      if($memprofile['dst'] == 1)
2264      {
2265          $memprofile['timezone']++;
2266          if(my_substr($memprofile['timezone'], 0, 1) != "-")
2267          {
2268              $memprofile['timezone'] = "+{$memprofile['timezone']}";
2269          }
2270      }
2271  
2272      $memregdate = my_date($mybb->settings['dateformat'], $memprofile['regdate']);
2273      $memlocaldate = gmdate($mybb->settings['dateformat'], TIME_NOW + ($memprofile['timezone'] * 3600));
2274      $memlocaltime = gmdate($mybb->settings['timeformat'], TIME_NOW + ($memprofile['timezone'] * 3600));
2275  
2276      $localtime = $lang->sprintf($lang->local_time_format, $memlocaldate, $memlocaltime);
2277  
2278      if($memprofile['lastactive'])
2279      {
2280          $memlastvisitdate = my_date($mybb->settings['dateformat'], $memprofile['lastactive']);
2281          $memlastvisitsep = $lang->comma;
2282          $memlastvisittime = my_date($mybb->settings['timeformat'], $memprofile['lastactive']);
2283      }
2284      else
2285      {
2286          $memlastvisitdate = $lang->lastvisit_never;
2287          $memlastvisitsep = '';
2288          $memlastvisittime = '';
2289      }
2290  
2291      if($memprofile['birthday'])
2292      {
2293          $membday = explode("-", $memprofile['birthday']);
2294  
2295          if($memprofile['birthdayprivacy'] != 'none')
2296          {
2297              if($membday[0] && $membday[1] && $membday[2])
2298              {
2299                  $lang->membdayage = $lang->sprintf($lang->membdayage, get_age($memprofile['birthday']));
2300  
2301                  $bdayformat = fix_mktime($mybb->settings['dateformat'], $membday[2]);
2302                  $membday = mktime(0, 0, 0, $membday[1], $membday[0], $membday[2]);
2303                  $membday = date($bdayformat, $membday);
2304  
2305                  $membdayage = $lang->membdayage;
2306              }
2307              elseif($membday[2])
2308              {
2309                  $membday = mktime(0, 0, 0, 1, 1, $membday[2]);
2310                  $membday = date("Y", $membday);
2311                  $membdayage = '';
2312              }
2313              else
2314              {
2315                  $membday = mktime(0, 0, 0, $membday[1], $membday[0], 0);
2316                  $membday = date("F j", $membday);
2317                  $membdayage = '';
2318              }
2319          }
2320  
2321          if($memprofile['birthdayprivacy'] == 'age')
2322          {
2323              $membday = $lang->birthdayhidden;
2324          }
2325          else if($memprofile['birthdayprivacy'] == 'none')
2326          {
2327              $membday = $lang->birthdayhidden;
2328              $membdayage = '';
2329          }
2330      }
2331      else
2332      {
2333          $membday = $lang->not_specified;
2334          $membdayage = '';
2335      }
2336  
2337      if(!$memprofile['displaygroup'])
2338      {
2339          $memprofile['displaygroup'] = $memprofile['usergroup'];
2340      }
2341  
2342      // Grab the following fields from the user's displaygroup
2343      $displaygroupfields = array(
2344          "title",
2345          "usertitle",
2346          "stars",
2347          "starimage",
2348          "image",
2349          "usereputationsystem"
2350      );
2351      $displaygroup = usergroup_displaygroup($memprofile['displaygroup']);
2352  
2353      // Get the user title for this user
2354      unset($usertitle);
2355      unset($stars);
2356      $starimage = '';
2357      if(trim($memprofile['usertitle']) != '')
2358      {
2359          // User has custom user title
2360          $usertitle = $memprofile['usertitle'];
2361      }
2362      elseif(trim($displaygroup['usertitle']) != '')
2363      {
2364          // User has group title
2365          $usertitle = $displaygroup['usertitle'];
2366      }
2367      else
2368      {
2369          // No usergroup title so get a default one
2370          $usertitles = $cache->read('usertitles');
2371  
2372          if(is_array($usertitles))
2373          {
2374              foreach($usertitles as $title)
2375              {
2376                  if($memprofile['postnum'] >= $title['posts'])
2377                  {
2378                      $usertitle = $title['title'];
2379                      $stars = $title['stars'];
2380                      $starimage = $title['starimage'];
2381  
2382                      break;
2383                  }
2384              }
2385          }
2386      }
2387  
2388      $usertitle = htmlspecialchars_uni($usertitle);
2389  
2390      if($displaygroup['stars'] || $displaygroup['usertitle'])
2391      {
2392          // Set the number of stars if display group has constant number of stars
2393          $stars = $displaygroup['stars'];
2394      }
2395      elseif(!$stars)
2396      {
2397          if(!is_array($usertitles))
2398          {
2399              $usertitles = $cache->read('usertitles');
2400          }
2401  
2402          // This is for cases where the user has a title, but the group has no defined number of stars (use number of stars as per default usergroups)
2403          if(is_array($usertitles))
2404          {
2405              foreach($usertitles as $title)
2406              {
2407                  if($memprofile['postnum'] >= $title['posts'])
2408                  {
2409                      $stars = $title['stars'];
2410                      $starimage = $title['starimage'];
2411                      break;
2412                  }
2413              }
2414          }
2415      }
2416  
2417      $groupimage = '';
2418      if(!empty($displaygroup['image']))
2419      {
2420          if(!empty($mybb->user['language']))
2421          {
2422              $language = $mybb->user['language'];
2423          }
2424          else
2425          {
2426              $language = $mybb->settings['bblanguage'];
2427          }
2428          $displaygroup['image'] = str_replace("{lang}", $language, $displaygroup['image']);
2429          $displaygroup['image'] = str_replace("{theme}", $theme['imgdir'], $displaygroup['image']);
2430          eval("\$groupimage = \"".$templates->get("member_profile_groupimage")."\";");
2431      }
2432  
2433      if(empty($starimage))
2434      {
2435          $starimage = $displaygroup['starimage'];
2436      }
2437  
2438      if(!empty($starimage))
2439      {
2440          // Only display stars if we have an image to use...
2441          $starimage = str_replace("{theme}", $theme['imgdir'], $starimage);
2442          $userstars = '';
2443          for($i = 0; $i < $stars; ++$i)
2444          {
2445              eval("\$userstars .= \"".$templates->get("member_profile_userstar", 1, 0)."\";");
2446          }
2447      }
2448  
2449      // User is currently online and this user has permissions to view the user on the WOL
2450      $timesearch = TIME_NOW - $mybb->settings['wolcutoffmins']*60;
2451      $query = $db->simple_select("sessions", "location,nopermission", "uid='$uid' AND time>'{$timesearch}'", array('order_by' => 'time', 'order_dir' => 'DESC', 'limit' => 1));
2452      $session = $db->fetch_array($query);
2453  
2454      $online_status = '';
2455      if($memprofile['invisible'] != 1 || $mybb->usergroup['canviewwolinvis'] == 1 || $memprofile['uid'] == $mybb->user['uid'])
2456      {
2457          // Lastvisit
2458          if($memprofile['lastactive'])
2459          {
2460              $memlastvisitsep = $lang->comma;
2461              $memlastvisitdate = my_date('relative', $memprofile['lastactive']);
2462          }
2463  
2464          // Time Online
2465          $timeonline = $lang->none_registered;
2466          if($memprofile['timeonline'] > 0)
2467          {
2468              $timeonline = nice_time($memprofile['timeonline']);
2469          }
2470  
2471          // Online?
2472          if(!empty($session))
2473          {
2474              // Fetch their current location
2475              $lang->load("online");
2476              require_once  MYBB_ROOT."inc/functions_online.php";
2477              $activity = fetch_wol_activity($session['location'], $session['nopermission']);
2478              $location = build_friendly_wol_location($activity);
2479              $location_time = my_date($mybb->settings['timeformat'], $memprofile['lastactive']);
2480  
2481              eval("\$online_status = \"".$templates->get("member_profile_online")."\";");
2482          }
2483          // User is offline
2484          else
2485          {
2486              eval("\$online_status = \"".$templates->get("member_profile_offline")."\";");
2487          }
2488      }
2489  
2490      if($memprofile['invisible'] == 1 && $mybb->usergroup['canviewwolinvis'] != 1 && $memprofile['uid'] != $mybb->user['uid'])
2491      {
2492          $memlastvisitsep = '';
2493          $memlastvisittime = '';
2494          $memlastvisitdate = $lang->lastvisit_never;
2495  
2496          if($memprofile['lastactive'])
2497          {
2498              // We have had at least some active time, hide it instead
2499              $memlastvisitdate = $lang->lastvisit_hidden;
2500          }
2501  
2502          $timeonline = $lang->timeonline_hidden;
2503      }
2504  
2505      // Reset the background colours to keep it inline
2506      $alttrow = 'trow1';
2507  
2508      // Build Referral
2509      $referrals = '';
2510      if($mybb->settings['usereferrals'] == 1)
2511      {
2512          $bg_color = alt_trow();
2513  
2514          eval("\$referrals = \"".$templates->get("member_profile_referrals")."\";");
2515      }
2516  
2517      // Fetch the reputation for this user
2518      $reputation = '';
2519      if($memperms['usereputationsystem'] == 1 && $displaygroup['usereputationsystem'] == 1 && $mybb->settings['enablereputation'] == 1)
2520      {
2521          $bg_color = alt_trow();
2522          $reputation = get_reputation($memprofile['reputation']);
2523  
2524          // If this user has permission to give reputations show the vote link
2525          $vote_link = '';
2526          if($mybb->usergroup['cangivereputations'] == 1 && $memprofile['uid'] != $mybb->user['uid'] && ($mybb->settings['posrep'] || $mybb->settings['neurep'] || $mybb->settings['negrep']))
2527          {
2528              eval("\$vote_link = \"".$templates->get("member_profile_reputation_vote")."\";");
2529          }
2530  
2531          eval("\$reputation = \"".$templates->get("member_profile_reputation")."\";");
2532      }
2533  
2534      $warning_level = '';
2535      if($mybb->settings['enablewarningsystem'] != 0 && $memperms['canreceivewarnings'] != 0 && ($mybb->usergroup['canwarnusers'] != 0 || ($mybb->user['uid'] == $memprofile['uid'] && $mybb->settings['canviewownwarning'] != 0)))
2536      {
2537          $bg_color = alt_trow();
2538  
2539          if($mybb->settings['maxwarningpoints'] < 1)
2540          {
2541              $mybb->settings['maxwarningpoints'] = 10;
2542          }
2543  
2544          $warning_level = round($memprofile['warningpoints']/$mybb->settings['maxwarningpoints']*100);
2545  
2546          if($warning_level > 100)
2547          {
2548              $warning_level = 100;
2549          }
2550  
2551          $warn_user = '';
2552          $warning_link = 'usercp.php';
2553          $warning_level = get_colored_warning_level($warning_level);
2554          if($mybb->usergroup['canwarnusers'] != 0 && $memprofile['uid'] != $mybb->user['uid'])
2555          {
2556              eval("\$warn_user = \"".$templates->get("member_profile_warn")."\";");
2557              $warning_link = "warnings.php?uid={$memprofile['uid']}";
2558          }
2559  
2560          eval("\$warning_level = \"".$templates->get("member_profile_warninglevel")."\";");
2561      }
2562  
2563      $bgcolor = $alttrow = 'trow1';
2564      $customfields = $profilefields = '';
2565  
2566      $query = $db->simple_select("userfields", "*", "ufid = '{$uid}'");
2567      $userfields = $db->fetch_array($query);
2568  
2569      // If this user is an Administrator or a Moderator then we wish to show all profile fields
2570      $pfcache = $cache->read('profilefields');
2571  
2572      if(is_array($pfcache))
2573      {
2574          foreach($pfcache as $customfield)
2575          {
2576              if($mybb->usergroup['cancp'] != 1 && $mybb->usergroup['issupermod'] != 1 && $mybb->usergroup['canmodcp'] != 1 && (!is_member($customfield['viewableby']) || !$customfield['profile']))
2577              {
2578                  continue;
2579              }
2580  
2581              $thing = explode("\n", $customfield['type'], "2");
2582              $type = trim($thing[0]);
2583  
2584              $customfieldval = $customfield_val = '';
2585              $field = "fid{$customfield['fid']}";
2586  
2587              if(isset($userfields[$field]))
2588              {
2589                  $useropts = explode("\n", $userfields[$field]);
2590                  $customfieldval = $comma = '';
2591                  if(is_array($useropts) && ($type == "multiselect" || $type == "checkbox"))
2592                  {
2593                      foreach($useropts as $val)
2594                      {
2595                          if($val != '')
2596                          {
2597                              eval("\$customfield_val .= \"".$templates->get("member_profile_customfields_field_multi_item")."\";");
2598                          }
2599                      }
2600                      if($customfield_val != '')
2601                      {
2602                          eval("\$customfieldval = \"".$templates->get("member_profile_customfields_field_multi")."\";");
2603                      }
2604                  }
2605                  else
2606                  {
2607                      $parser_options = array(
2608                          "allow_html" => $customfield['allowhtml'],
2609                          "allow_mycode" => $customfield['allowmycode'],
2610                          "allow_smilies" => $customfield['allowsmilies'],
2611                          "allow_imgcode" => $customfield['allowimgcode'],
2612                          "allow_videocode" => $customfield['allowvideocode'],
2613                          #"nofollow_on" => 1,
2614                          "filter_badwords" => 1
2615                      );
2616  
2617                      if($customfield['type'] == "textarea")
2618                      {
2619                          $parser_options['me_username'] = $memprofile['username'];
2620                      }
2621                      else
2622                      {
2623                          $parser_options['nl2br'] = 0;
2624                      }
2625  
2626                      if($mybb->user['showimages'] != 1 && $mybb->user['uid'] != 0 || $mybb->settings['guestimages'] != 1 && $mybb->user['uid'] == 0)
2627                      {
2628                          $parser_options['allow_imgcode'] = 0;
2629                      }
2630  
2631                      $customfieldval = $parser->parse_message($userfields[$field], $parser_options);
2632                  }
2633              }
2634  
2635              if($customfieldval)
2636              {
2637                  $customfield['name'] = htmlspecialchars_uni($customfield['name']);
2638                  eval("\$customfields .= \"".$templates->get("member_profile_customfields_field")."\";");
2639                  $bgcolor = alt_trow();
2640              }
2641          }
2642      }
2643  
2644      if($customfields)
2645      {
2646          eval("\$profilefields = \"".$templates->get("member_profile_customfields")."\";");
2647      }
2648  
2649      $memprofile['postnum'] = my_number_format($memprofile['postnum']);
2650      $lang->ppd_percent_total = $lang->sprintf($lang->ppd_percent_total, my_number_format($ppd), $post_percent);
2651  
2652      $memprofile['threadnum'] = my_number_format($memprofile['threadnum']);
2653      $lang->tpd_percent_total = $lang->sprintf($lang->tpd_percent_total, my_number_format($tpd), $thread_percent);
2654  
2655      $formattedname = format_name($memprofile['username'], $memprofile['usergroup'], $memprofile['displaygroup']);
2656  
2657      $bannedbit = '';
2658      if($memperms['isbannedgroup'] == 1 && $mybb->usergroup['canbanusers'] == 1)
2659      {
2660          // Fetch details on their ban
2661          $query = $db->simple_select('banned b LEFT JOIN '.TABLE_PREFIX.'users a ON (b.admin=a.uid)', 'b.*, a.username AS adminuser', "b.uid='{$uid}'", array('limit' => 1));
2662          $memban = $db->fetch_array($query);
2663  
2664          if($memban['reason'])
2665          {
2666              $memban['reason'] = htmlspecialchars_uni($parser->parse_badwords($memban['reason']));
2667          }
2668          else
2669          {
2670              $memban['reason'] = $lang->na;
2671          }
2672  
2673          if($memban['lifted'] == 'perm' || $memban['lifted'] == '' || $memban['bantime'] == 'perm' || $memban['bantime'] == '---')
2674          {
2675              $banlength = $lang->permanent;
2676              $timeremaining = $lang->na;
2677          }
2678          else
2679          {
2680              // Set up the array of ban times.
2681              $bantimes = fetch_ban_times();
2682  
2683              $banlength = $bantimes[$memban['bantime']];
2684              $remaining = $memban['lifted']-TIME_NOW;
2685  
2686              $timeremaining = nice_time($remaining, array('short' => 1, 'seconds' => false))."";
2687  
2688              $banned_class = '';
2689              if($remaining < 3600)
2690              {
2691                  $banned_class = "high_banned";
2692              }
2693              else if($remaining < 86400)
2694              {
2695                  $banned_class = "moderate_banned";
2696              }
2697              else if($remaining < 604800)
2698              {
2699                  $banned_class = "low_banned";
2700              }
2701              else
2702              {
2703                  $banned_class = "normal_banned";
2704              }
2705  
2706              eval('$timeremaining = "'.$templates->get('member_profile_banned_remaining').'";');
2707          }
2708  
2709          $memban['adminuser'] = build_profile_link(htmlspecialchars_uni($memban['adminuser']), $memban['admin']);
2710  
2711          // Display a nice warning to the user
2712          eval('$bannedbit = "'.$templates->get('member_profile_banned').'";');
2713      }
2714  
2715      $adminoptions = '';
2716      if($mybb->usergroup['cancp'] == 1 && $mybb->config['hide_admin_links'] != 1)
2717      {
2718          eval("\$adminoptions = \"".$templates->get("member_profile_adminoptions")."\";");
2719      }
2720  
2721      $modoptions = $viewnotes = $editnotes = $editprofile = $banuser = $manageuser = '';
2722      $can_purge_spammer = purgespammer_show($memprofile['postnum'], $memprofile['usergroup'], $memprofile['uid']);
2723      if($mybb->usergroup['canmodcp'] == 1 || $can_purge_spammer)
2724      {
2725          if($mybb->usergroup['canuseipsearch'] == 1)
2726          {
2727              $memprofile['regip'] = my_inet_ntop($db->unescape_binary($memprofile['regip']));
2728              $memprofile['lastip'] = my_inet_ntop($db->unescape_binary($memprofile['lastip']));
2729  
2730              eval("\$ipaddress = \"".$templates->get("member_profile_modoptions_ipaddress")."\";");
2731          }
2732  
2733          $memprofile['usernotes'] = nl2br(htmlspecialchars_uni($memprofile['usernotes']));
2734  
2735          if(!empty($memprofile['usernotes']))
2736          {
2737              if(strlen($memprofile['usernotes']) > 100)
2738              {
2739                  eval("\$viewnotes = \"".$templates->get("member_profile_modoptions_viewnotes")."\";");
2740                  $memprofile['usernotes'] = my_substr($memprofile['usernotes'], 0, 100)."... {$viewnotes}";
2741              }
2742          }
2743          else
2744          {
2745              $memprofile['usernotes'] = $lang->no_usernotes;
2746          }
2747  
2748          if($mybb->usergroup['caneditprofiles'] == 1)
2749          {
2750              eval("\$editprofile = \"".$templates->get("member_profile_modoptions_editprofile")."\";");
2751              eval("\$editnotes = \"".$templates->get("member_profile_modoptions_editnotes")."\";");
2752          }
2753  
2754          if($mybb->usergroup['canbanusers'] == 1 && (!$memban['uid'] || $memban['uid'] && ($mybb->user['uid'] == $memban['admin']) || $mybb->usergroup['issupermod'] == 1 || $mybb->usergroup['cancp'] == 1))
2755          {
2756              eval("\$banuser = \"".$templates->get("member_profile_modoptions_banuser")."\";");
2757          }
2758  
2759          if($can_purge_spammer)
2760          {
2761              eval("\$purgespammer = \"".$templates->get('member_profile_modoptions_purgespammer')."\";");
2762          }
2763  
2764          if(!empty($editprofile) || !empty($banuser) || !empty($purgespammer))
2765          {
2766              eval("\$manageuser = \"".$templates->get("member_profile_modoptions_manageuser")."\";");
2767          }
2768  
2769          eval("\$modoptions = \"".$templates->get("member_profile_modoptions")."\";");
2770      }
2771  
2772      $add_remove_options = array();
2773      $buddy_options = $ignore_options = $report_options = '';
2774      if($mybb->user['uid'] != $memprofile['uid'] && $mybb->user['uid'] != 0)
2775      {
2776          $buddy_list = explode(',', $mybb->user['buddylist']);
2777          $ignore_list = explode(',', $mybb->user['ignorelist']);
2778  
2779          if(in_array($uid, $buddy_list))
2780          {
2781              $add_remove_options = array('url' => "usercp.php?action=do_editlists&amp;delete={$uid}&amp;my_post_key={$mybb->post_code}", 'class' => 'remove_buddy_button', 'lang' => $lang->remove_from_buddy_list);
2782          }
2783          else
2784          {
2785              $add_remove_options = array('url' => "usercp.php?action=do_editlists&amp;add_username=".urlencode($memprofile['username'])."&amp;my_post_key={$mybb->post_code}", 'class' => 'add_buddy_button', 'lang' => $lang->add_to_buddy_list);
2786          }
2787  
2788          if(!in_array($uid, $ignore_list))
2789          {
2790              eval("\$buddy_options = \"".$templates->get("member_profile_addremove")."\";"); // Add/Remove Buddy
2791          }
2792  
2793          if(in_array($uid, $ignore_list))
2794          {
2795              $add_remove_options = array('url' => "usercp.php?action=do_editlists&amp;manage=ignored&amp;delete={$uid}&amp;my_post_key={$mybb->post_code}", 'class' => 'remove_ignore_button', 'lang' => $lang->remove_from_ignore_list);
2796          }
2797          else
2798          {
2799              $add_remove_options = array('url' => "usercp.php?action=do_editlists&amp;manage=ignored&amp;add_username=".urlencode($memprofile['username'])."&amp;my_post_key={$mybb->post_code}", 'class' => 'add_ignore_button', 'lang' => $lang->add_to_ignore_list);
2800          }
2801  
2802          if(!in_array($uid, $buddy_list))
2803          {
2804              eval("\$ignore_options = \"".$templates->get("member_profile_addremove")."\";"); // Add/Remove Ignore
2805          }
2806  
2807          if(isset($memperms['canbereported']) && $memperms['canbereported'] == 1)
2808          {
2809              $add_remove_options = array('url' => "javascript:Report.reportUser({$memprofile['uid']});", 'class' => 'report_user_button', 'lang' => $lang->report_user);
2810              eval("\$report_options = \"".$templates->get("member_profile_addremove")."\";"); // Report User
2811          }
2812      }
2813  
2814      $plugins->run_hooks("member_profile_end");
2815  
2816      eval("\$profile = \"".$templates->get("member_profile")."\";");
2817      output_page($profile);
2818  }
2819  
2820  if($mybb->input['action'] == "do_emailuser" && $mybb->request_method == "post")
2821  {
2822      // Verify incoming POST request
2823      verify_post_check($mybb->get_input('my_post_key'));
2824  
2825      $plugins->run_hooks("member_do_emailuser_start");
2826  
2827      // Guests or those without permission can't email other users
2828      if($mybb->usergroup['cansendemail'] == 0)
2829      {
2830          error_no_permission();
2831      }
2832  
2833      // Check group limits
2834      if($mybb->usergroup['maxemails'] > 0)
2835      {
2836          if($mybb->user['uid'] > 0)
2837          {
2838              $user_check = "fromuid='{$mybb->user['uid']}'";
2839          }
2840          else
2841          {
2842              $user_check = "ipaddress=".$db->escape_binary($session->packedip);
2843          }
2844  
2845          $query = $db->simple_select("maillogs", "COUNT(*) AS sent_count", "{$user_check} AND dateline >= '".(TIME_NOW - (60*60*24))."'");
2846          $sent_count = $db->fetch_field($query, "sent_count");
2847          if($sent_count >= $mybb->usergroup['maxemails'])
2848          {
2849              $lang->error_max_emails_day = $lang->sprintf($lang->error_max_emails_day, $mybb->usergroup['maxemails']);
2850              error($lang->error_max_emails_day);
2851          }
2852      }
2853  
2854      // Check email flood control
2855      if($mybb->usergroup['emailfloodtime'] > 0)
2856      {
2857          if($mybb->user['uid'] > 0)
2858          {
2859              $user_check = "fromuid='{$mybb->user['uid']}'";
2860          }
2861          else
2862          {
2863              $user_check = "ipaddress=".$db->escape_binary($session->packedip);
2864          }
2865  
2866          $timecut = TIME_NOW-$mybb->usergroup['emailfloodtime']*60;
2867  
2868          $query = $db->simple_select("maillogs", "mid, dateline", "{$user_check} AND dateline > '{$timecut}'", array('order_by' => "dateline", 'order_dir' => "DESC"));
2869          $last_email = $db->fetch_array($query);
2870  
2871          // Users last email was within the flood time, show the error
2872          if($last_email['mid'])
2873          {
2874              $remaining_time = ($mybb->usergroup['emailfloodtime']*60)-(TIME_NOW-$last_email['dateline']);
2875  
2876              if($remaining_time == 1)
2877              {
2878                  $lang->error_emailflooding = $lang->sprintf($lang->error_emailflooding_1_second, $mybb->usergroup['emailfloodtime']);
2879              }
2880              elseif($remaining_time < 60)
2881              {
2882                  $lang->error_emailflooding = $lang->sprintf($lang->error_emailflooding_seconds, $mybb->usergroup['emailfloodtime'], $remaining_time);
2883              }
2884              elseif($remaining_time > 60 && $remaining_time < 120)
2885              {
2886                  $lang->error_emailflooding = $lang->sprintf($lang->error_emailflooding_1_minute, $mybb->usergroup['emailfloodtime']);
2887              }
2888              else
2889              {
2890                  $remaining_time_minutes = ceil($remaining_time/60);
2891                  $lang->error_emailflooding = $lang->sprintf($lang->error_emailflooding_minutes, $mybb->usergroup['emailfloodtime'], $remaining_time_minutes);
2892              }
2893  
2894              error($lang->error_emailflooding);
2895          }
2896      }
2897  
2898      $query = $db->simple_select("users", "uid, username, email, hideemail", "uid='".$mybb->get_input('uid', MyBB::INPUT_INT)."'");
2899      $to_user = $db->fetch_array($query);
2900  
2901      if(!$to_user['username'])
2902      {
2903          error($lang->error_invalidusername);
2904      }
2905  
2906      if($to_user['hideemail'] != 0)
2907      {
2908          error($lang->error_hideemail);
2909      }
2910  
2911      $errors = array();
2912  
2913      if($mybb->user['uid'])
2914      {
2915          $mybb->input['fromemail'] = $mybb->user['email'];
2916          $mybb->input['fromname'] = $mybb->user['username'];
2917      }
2918  
2919      if(!validate_email_format($mybb->input['fromemail']))
2920      {
2921          $errors[] = $lang->error_invalidfromemail;
2922      }
2923  
2924      if(empty($mybb->input['fromname']))
2925      {
2926          $errors[] = $lang->error_noname;
2927      }
2928  
2929      if(empty($mybb->input['subject']))
2930      {
2931          $errors[] = $lang->error_no_email_subject;
2932      }
2933  
2934      if(empty($mybb->input['message']))
2935      {
2936          $errors[] = $lang->error_no_email_message;
2937      }
2938  
2939      if($mybb->settings['captchaimage'] && $mybb->user['uid'] == 0)
2940      {
2941          require_once  MYBB_ROOT.'inc/class_captcha.php';
2942          $captcha = new captcha;
2943  
2944          if($captcha->validate_captcha() == false)
2945          {
2946              // CAPTCHA validation failed
2947              foreach($captcha->get_errors() as $error)
2948              {
2949                  $errors[] = $error;
2950              }
2951          }
2952      }
2953  
2954      if(count($errors) == 0)
2955      {
2956          if($mybb->settings['mail_handler'] == 'smtp')
2957          {
2958              $from = $mybb->input['fromemail'];
2959          }
2960          else
2961          {
2962              $from = "{$mybb->input['fromname']} <{$mybb->input['fromemail']}>";
2963          }
2964  
2965          $message = $lang->sprintf($lang->email_emailuser, $to_user['username'], $mybb->input['fromname'], $mybb->settings['bbname'], $mybb->settings['bburl'], $mybb->get_input('message'));
2966          my_mail($to_user['email'], $mybb->get_input('subject'), $message, '', '', '', false, 'text', '', $from);
2967  
2968          if($mybb->settings['mail_logging'] > 0)
2969          {
2970              // Log the message
2971              $log_entry = array(
2972                  "subject" => $db->escape_string($mybb->get_input('subject')),
2973                  "message" => $db->escape_string($mybb->get_input('message')),
2974                  "dateline" => TIME_NOW,
2975                  "fromuid" => $mybb->user['uid'],
2976                  "fromemail" => $db->escape_string($mybb->input['fromemail']),
2977                  "touid" => $to_user['uid'],
2978                  "toemail" => $db->escape_string($to_user['email']),
2979                  "tid" => 0,
2980                  "ipaddress" => $db->escape_binary($session->packedip),
2981                  "type" => 1
2982              );
2983              $db->insert_query("maillogs", $log_entry);
2984          }
2985  
2986          $plugins->run_hooks("member_do_emailuser_end");
2987  
2988          redirect(get_profile_link($to_user['uid']), $lang->redirect_emailsent);
2989      }
2990      else
2991      {
2992          $mybb->input['action'] = "emailuser";
2993      }
2994  }
2995  
2996  if($mybb->input['action'] == "emailuser")
2997  {
2998      $plugins->run_hooks("member_emailuser_start");
2999  
3000      // Guests or those without permission can't email other users
3001      if($mybb->usergroup['cansendemail'] == 0)
3002      {
3003          error_no_permission();
3004      }
3005  
3006      // Check group limits
3007      if($mybb->usergroup['maxemails'] > 0)
3008      {
3009          if($mybb->user['uid'] > 0)
3010          {
3011              $user_check = "fromuid='{$mybb->user['uid']}'";
3012          }
3013          else
3014          {
3015              $user_check = "ipaddress=".$db->escape_binary($session->packedip);
3016          }
3017  
3018          $query = $db->simple_select("maillogs", "COUNT(*) AS sent_count", "{$user_check} AND dateline >= '".(TIME_NOW - (60*60*24))."'");
3019          $sent_count = $db->fetch_field($query, "sent_count");
3020          if($sent_count >= $mybb->usergroup['maxemails'])
3021          {
3022              $lang->error_max_emails_day = $lang->sprintf($lang->error_max_emails_day, $mybb->usergroup['maxemails']);
3023              error($lang->error_max_emails_day);
3024          }
3025      }
3026  
3027      // Check email flood control
3028      if($mybb->usergroup['emailfloodtime'] > 0)
3029      {
3030          if($mybb->user['uid'] > 0)
3031          {
3032              $user_check = "fromuid='{$mybb->user['uid']}'";
3033          }
3034          else
3035          {
3036              $user_check = "ipaddress=".$db->escape_binary($session->packedip);
3037          }
3038  
3039          $timecut = TIME_NOW-$mybb->usergroup['emailfloodtime']*60;
3040  
3041          $query = $db->simple_select("maillogs", "mid, dateline", "{$user_check} AND dateline > '{$timecut}'", array('order_by' => "dateline", 'order_dir' => "DESC"));
3042          $last_email = $db->fetch_array($query);
3043  
3044          // Users last email was within the flood time, show the error
3045          if($last_email['mid'])
3046          {
3047              $remaining_time = ($mybb->usergroup['emailfloodtime']*60)-(TIME_NOW-$last_email['dateline']);
3048  
3049              if($remaining_time == 1)
3050              {
3051                  $lang->error_emailflooding = $lang->sprintf($lang->error_emailflooding_1_second, $mybb->usergroup['emailfloodtime']);
3052              }
3053              elseif($remaining_time < 60)
3054              {
3055                  $lang->error_emailflooding = $lang->sprintf($lang->error_emailflooding_seconds, $mybb->usergroup['emailfloodtime'], $remaining_time);
3056              }
3057              elseif($remaining_time > 60 && $remaining_time < 120)
3058              {
3059                  $lang->error_emailflooding = $lang->sprintf($lang->error_emailflooding_1_minute, $mybb->usergroup['emailfloodtime']);
3060              }
3061              else
3062              {
3063                  $remaining_time_minutes = ceil($remaining_time/60);
3064                  $lang->error_emailflooding = $lang->sprintf($lang->error_emailflooding_minutes, $mybb->usergroup['emailfloodtime'], $remaining_time_minutes);
3065              }
3066  
3067              error($lang->error_emailflooding);
3068          }
3069      }
3070  
3071      $query = $db->simple_select("users", "uid, username, email, hideemail, ignorelist", "uid='".$mybb->get_input('uid', MyBB::INPUT_INT)."'");
3072      $to_user = $db->fetch_array($query);
3073  
3074      $to_user['username'] = htmlspecialchars_uni($to_user['username']);
3075      $lang->email_user = $lang->sprintf($lang->email_user, $to_user['username']);
3076  
3077      if(!$to_user['uid'])
3078      {
3079          error($lang->error_invaliduser);
3080      }
3081  
3082      if($to_user['hideemail'] != 0)
3083      {
3084          error($lang->error_hideemail);
3085      }
3086  
3087      if($to_user['ignorelist'] && (my_strpos(",".$to_user['ignorelist'].",", ",".$mybb->user['uid'].",") !== false && $mybb->usergroup['cansendemailoverride'] != 1))
3088      {
3089          error_no_permission();
3090      }
3091  
3092      if(isset($errors) && count($errors) > 0)
3093      {
3094          $errors = inline_error($errors);
3095          $fromname = htmlspecialchars_uni($mybb->get_input('fromname'));
3096          $fromemail = htmlspecialchars_uni($mybb->get_input('fromemail'));
3097          $subject = htmlspecialchars_uni($mybb->get_input('subject'));
3098          $message = htmlspecialchars_uni($mybb->get_input('message'));
3099      }
3100      else
3101      {
3102          $errors = '';
3103          $fromname = '';
3104          $fromemail = '';
3105          $subject = '';
3106          $message = '';
3107      }
3108  
3109      // Generate CAPTCHA?
3110      if($mybb->settings['captchaimage'] && $mybb->user['uid'] == 0)
3111      {
3112          require_once  MYBB_ROOT.'inc/class_captcha.php';
3113          $post_captcha = new captcha(true, "post_captcha");
3114  
3115          if($post_captcha->html)
3116          {
3117              $captcha = $post_captcha->html;
3118          }
3119      }
3120      else
3121      {
3122          $captcha = '';
3123      }
3124  
3125      $from_email = '';
3126      if($mybb->user['uid'] == 0)
3127      {
3128          eval("\$from_email = \"".$templates->get("member_emailuser_guest")."\";");
3129      }
3130  
3131      $plugins->run_hooks("member_emailuser_end");
3132  
3133      eval("\$emailuser = \"".$templates->get("member_emailuser")."\";");
3134      output_page($emailuser);
3135  }
3136  
3137  if(!$mybb->input['action'])
3138  {
3139      header("Location: index.php");
3140  }


2005 - 2016 © MyBB.de | Alle Rechte vorbehalten! | Sponsor: netcup Cross-referenced by PHPXref 0.7.1