PageRenderTime 67ms CodeModel.GetById 29ms RepoModel.GetById 1ms app.codeStats 0ms

/lists/admin/commonlib/lib/userlib.php

https://bitbucket.org/bontiv/insomnia
PHP | 1203 lines | 982 code | 86 blank | 135 comment | 315 complexity | f576a7fc92196470773450120a136f8c MD5 | raw file
Possible License(s): Apache-2.0, LGPL-3.0, LGPL-2.1, GPL-3.0, BSD-3-Clause, GPL-2.0 
    

  1. <?php
    2. 

  2. /**
    3. 

  3.  * library with user functions
    4. 

  4.  * 
    5. 

  5.  * this file is shared between the webbler and PHPlist via commonlib
    6. 

  6.  * 
    7. 

  7.  * @package Common
    8. 

  8.  * @subpackage userlib 
    9. 

  9.  */
    10. 

  10. require_once dirname(__FILE__).'/accesscheck.php';
    11. 

  11. 

  12. function initialiseUserSession() {
    13. 

  13.   if (!is_array($_SESSION["userdata"])) {
    14. 

  14.     $_SESSION["userdata"] = array();
    15. 

  15.   }
    16. 

  16. //  $_SESSION["session"] = $GLOBALS["PHPSESSID"];
    17. 

  17.   // What should it be??
    18. 

  18.     $_SESSION["session"] = $_COOKIE["PHPSESSID"];
    19. 

  19. }
    20. 

  20. 

  21. function getEveryoneGroupID() {
    22. 

  22.   $ev_req = Sql_Fetch_Row_Query("select id from groups where name = \"Everyone\"");
    23. 

  23.   $everyone_groupid = $ev_req[0];
    24. 

  24.   if (!$everyone_groupid) {
    25. 

  25.     Sql_Query("insert into groups (name) values(\"Everyone\")");
    26. 

  26.     $everyone_groupid = Sql_Insert_Id();
    27. 

  27.   }
    28. 

  28.   return $everyone_groupid;
    29. 

  29. }
    30. 

  30. 

  31. function getUniqid($table = "") {
    32. 

  32.   global $tables;
    33. 

  33.   if (!$table) {
    34. 

  34.     if ($tables["user"])
    35. 

  35.       $table = $tables["user"];
    36. 

  36.     else
    37. 

  37.       $table = "user";
    38. 

  38.   }
    39. 

  39.   $id = md5(uniqid(mt_rand()));
    40. 

  40.   
    41. 

  41.   /* this doesn't scale very well, do this offline
    42. 

  42.   # make sure it is really unique
    43. 

  43.   $req = Sql_Query("select id from $table where uniqid = \"$id\"");
    44. 

  44.   while (Sql_Affected_rows()) {
    45. 

  45.     $id = md5(uniqid(mt_rand()));
    46. 

  46.     $req = Sql_Query("select id from $table where uniqid = \"$id\"");
    47. 

  47.   }
    48. 

  48.   */
    49. 

  49.   return $id;
    50. 

  50. }
    51. 

  51. 

  52. function userSelect($fieldname,$current = '') {
    53. 

  53.   $html = sprintf('<select name="%s">',$fieldname);
    54. 

  54.   $req = Sql_Query(sprintf('select id,email from user order by email'));
    55. 

  55.   while ($row = Sql_Fetch_Array($req)) {
    56. 

  56.     $html .= sprintf('<option value="%d" %s>%s</option>',$row['id'],$current == $row['id']? 'selected="selected"':'',$row['email']);
    57. 

  57.   }
    58. 

  58.   $html .= '</select>';
    59. 

  59.   return $html;
    60. 

  60. }
    61. 

  61. 

  62. function deleteUser($id) {
    63. 

  63.   global $tables;
    64. 

  64.   Sql_Query(sprintf('delete from %s where userid = %d',$tables["listuser"],$id));
    65. 

  65.   Sql_Query(sprintf('delete from %s where userid = %d',$tables["user_attribute"],$id));
    66. 

  66.   Sql_Query(sprintf('delete from %s where userid = %d',$tables["usermessage"],$id));
    67. 

  67.   Sql_Query(sprintf('delete from %s where user = %d',$tables["user_message_bounce"],$id));
    68. 

  68.   Sql_Query(sprintf('delete from %s where id = %d',$tables["user"],$id));
    69. 

  69.   Sql_Query(sprintf('delete from %s where userid = %d',$tables["user_history"],$id));
    70. 

  70. 	if (Sql_table_exists('user_group')) {
    71. 

  71. 		Sql_Query(sprintf('delete from user_group where userid = %d',$id));
    72. 

  72. 	}
    73. 

  73.   ### allow plugins to delete their data
    74. 

  74. 

  75.   if (is_array($GLOBALS['plugins'])) {
    76. 

  76.     foreach ($GLOBALS['plugins'] as $plugin) {
    77. 

  77.       //$plugin->deleteUser($id);
    78. 

  78. 

  79.       if (method_exists($plugin, "deleteUser")) {
    80. 

  80.          $plugin->deleteUser($id);
    81. 

  81.       }
    82. 

  82.     }
    83. 

  83.   }
    84. 

  84. }
    85. 

  85. 

  86. function addNewUser($email,$password = "") {
    87. 

  87.   if (empty($GLOBALS['tables']['user'])) {
    88. 

  88.     $GLOBALS['tables']['user'] = 'user';
    89. 

  89.   }
    90. 

  90. /*
    91. 

  91.     "id" => array("integer not null primary key auto_increment","sys:ID"),
    92. 

  92.     "email" => array("varchar(255) not null","Email"),
    93. 

  93.     "confirmed" => array("tinyint default 0","sys:Is the email of this user confirmed"),
    94. 

  94.     "entered" => array("datetime","sys:Time Created"),
    95. 

  95.     "modified" => array("timestamp","sys:Time modified"),
    96. 

  96.     "uniqid" => array("varchar(255)","sys:Unique ID for User"),
    97. 

  97.     "unique" => array("(email)","sys:unique"),
    98. 

  98.     "htmlemail" => array("tinyint default 0","Send this user HTML emails"),
    99. 

  99.     "subscribepage" => array("integer","sys:Which page was used to subscribe"),
    100. 

  100.     "rssfrequency" => array("varchar(100)","rss Frequency"), // Leftover from the preplugin era
    101. 

  101.     "password" => array("varchar(255)","Password"),
    102. 

  102.     "passwordchanged" => array("datetime","sys:Last time password was changed"),
    103. 

  103.     "disabled" => array("tinyint default 0","Is this account disabled?"),
    104. 

  104.     "extradata" => array("text","Additional data"),
    105. 

  105. */
    106. 

  106.   // insert into user db
    107. 

  107.   $exists = Sql_Fetch_Row_Query(sprintf('select id from %s where email = "%s"',
    108. 

  108.     $GLOBALS['tables']['user'],$email));
    109. 

  109.   if ($exists[0]) return $exists[0];
    110. 

  110.   
    111. 

  111.   Sql_Query(sprintf('insert into %s set email = "%s",
    112. 

  112.     entered = now(),modified = now(),password = "%s",
    113. 

  113.     passwordchanged = now(),disabled = 0,
    114. 

  114.     uniqid = "%s",htmlemail = 1
    115. 

  115.     ',$GLOBALS['tables']['user'],$email,$password,getUniqid()));
    116. 

  116.   $ar = Sql_Affected_Rows();
    117. 

  117.   if ($ar > 0) {
    118. 

  118.     $id = Sql_Insert_Id();
    119. 

  119.   } else {
    120. 

  120.     $id = 0;
    121. 

  121.   }
    122. 

  122.   return $id;
    123. 

  123. }
    124. 

  124. 

  125. function getAttributeIDbyName ($sName) {
    126. 

  126.   # Looks for an attribute named sName.
    127. 

  127.   # Returns table ID or 0 if not found.
    128. 

  128.   # Can also be used as 'isAttribute'
    129. 

  129.   
    130. 

  130.   if(empty($sName)) return 0;
    131. 

  131.   global $usertable_prefix;
    132. 

  132.   # workaround for integration webbler/phplist
    133. 

  133.   if (!isset($usertable_prefix)) {
    134. 

  134.     $usertable_prefix = '';
    135. 

  135.   }
    136. 

  136.   if ($tables["attribute"]) {
    137. 

  137.     $att_table = $tables["attribute"];
    138. 

  138.     $user_att_table = $tables["user_attribute"];
    139. 

  139.   } else {
    140. 

  140.     $att_table = "attribute";
    141. 

  141.     $user_att_table = "user_attribute";
    142. 

  142.   }
    143. 

  143.   $res = Sql_Query(sprintf('SELECT id FROM %s%s WHERE name = "%s"',
    144. 

  144.     $usertable_prefix,$att_table,$sName));
    145. 

  145.   $row = Sql_Fetch_row($res);
    146. 

  146.     
    147. 

  147.   return $row[0];
    148. 

  148. }
    149. 

  149. 

  150. function AttributeValue($table,$value) {
    151. 

  151.   global $table_prefix;
    152. 

  152.   # workaround for integration webbler/phplist
    153. 

  153.   if (!isset($table_prefix)) {
    154. 

  154.     $table_prefix = "phplist_";
    155. 

  155.   }
    156. 

  156. 

  157.   if (ereg(",",$value)) {
    158. 

  158.     $result = "";
    159. 

  159.     $res = Sql_Query(sprintf('select name from %slistattr_%s where id in (%s)',
    160. 

  160.     $table_prefix,$table,$value));
    161. 

  161.     while ($row = Sql_Fetch_row($res)) {
    162. 

  162.       $result .= $row[0]."; ";
    163. 

  163.     }
    164. 

  164.     return substr($result,0,-2);
    165. 

  165.   } elseif ($value) {
    166. 

  166.     $res = Sql_Query(sprintf('select name from %slistattr_%s where id = %d',
    167. 

  167.     $table_prefix,$table,$value));
    168. 

  168.     $row = Sql_Fetch_row($res);
    169. 

  169.   } else {
    170. 

  170. #    return "Invalid Attribute Index";
    171. 

  171.   }
    172. 

  172.   return $row[0];
    173. 

  173. }
    174. 

  174. 

  175. function existUserID($id = 0) {
    176. 

  176.   global $table_prefix,$tables;
    177. 

  177.   # workaround for integration webbler/phplist
    178. 

  178.   if (!isset($table_prefix))
    179. 

  179.     $table_prefix = "phplist_";
    180. 

  180. 

  181.   if (isset($tables["attribute"])) {
    182. 

  182.     $usertable = $tables["user"];
    183. 

  183.   } else {
    184. 

  184.     $usertable = "user";
    185. 

  185.   }
    186. 

  186. 

  187.   $userid = Sql_Fetch_Row_Query("select id from {$usertable} where id = \"$id\"");
    188. 

  188.   return $userid[0];
    189. 

  189. }
    190. 

  190. 

  191. function getUserAttributeValues($email = '', $id = 0, $bIndexWithShortnames = false) {
    192. 

  192.   global $table_prefix,$tables;
    193. 

  193.   if (!$email && !$id) return;
    194. 

  194.   # workaround for integration webbler/phplist
    195. 

  195.   if (!isset($table_prefix))
    196. 

  196.     $table_prefix = "phplist_";
    197. 

  197. 

  198.   if (isset($tables["attribute"])) {
    199. 

  199.     $att_table = $tables["attribute"];
    200. 

  200.     $user_att_table = $tables["user_attribute"];
    201. 

  201.     $usertable = $tables["user"];
    202. 

  202.   } else {
    203. 

  203.     $att_table = "attribute";
    204. 

  204.     $user_att_table = "user_attribute";
    205. 

  205.     $usertable = "user";
    206. 

  206.   }
    207. 

  207.   $result = array();
    208. 

  208.   if ($email && !$id) {
    209. 

  209.     $userid = Sql_Fetch_Row_Query("select id from {$usertable} where email = \"$email\"");
    210. 

  210.     $id = $userid[0];
    211. 

  211.   }
    212. 

  212.   if (!$id) return;
    213. 

  213.   $att_req = Sql_Query(sprintf('select
    214. 

  214.     %s.name,%s.id from %s,%s
    215. 

  215.     where %s.userid = %s and %s.id = %s.attributeid',
    216. 

  216.     $att_table,
    217. 

  217.     $att_table,
    218. 

  218.     $user_att_table,
    219. 

  219.     $att_table,
    220. 

  220.     $user_att_table,
    221. 

  221.     $id,
    222. 

  222.     $att_table,
    223. 

  223.     $user_att_table
    224. 

  224.   ));
    225. 

  225. 

  226.   while ($att = Sql_fetch_array($att_req)) {
    227. 

  227.     if ( $bIndexWithShortnames ) {
    228. 

  228.       $result['attribute' . $att['id']] = UserAttributeValue($id,$att["id"]);
    229. 

  229.     } else {
    230. 

  230.       $result[$att['name']] = UserAttributeValue($id,$att["id"]);
    231. 

  231.     }
    232. 

  232.   }
    233. 

  233.   return $result;
    234. 

  234. }
    235. 

  235. 

  236. function UserAttributeValue($user = 0,$attribute = 0) {
    237. 

  237.   # workaround for integration webbler/phplist
    238. 

  238.   global $table_prefix,$tables;
    239. 

  239.   if (!isset($table_prefix))
    240. 

  240.     $table_prefix = "phplist_";
    241. 

  241.   if (!$user || !$attribute) return;
    242. 

  242. 

  243.   if (isset($tables["attribute"])) {
    244. 

  244.     $att_table = $tables["attribute"];
    245. 

  245.     $user_att_table = $tables["user_attribute"];
    246. 

  246.   } else {
    247. 

  247.     $att_table = "attribute";
    248. 

  248.     $user_att_table = "user_attribute";
    249. 

  249.   }
    250. 

  250.   $att = Sql_Fetch_array_Query("select * from $att_table where id = $attribute");
    251. 

  251.   switch ($att["type"]) {
    252. 

  252.     case "checkboxgroup":
    253. 

  253.  #     print "select value from $user_att_table where userid = $user and attributeid = $attribute";
    254. 

  254.       $val_ids  = Sql_Fetch_Row_Query("select value from $user_att_table where userid = $user and attributeid = $attribute");
    255. 

  255.       if ($val_ids[0]) {
    256. 

  256.  #       print '<br/>1 <b>'.$val_ids[0].'</b>';
    257. 

  257.         if (function_exists('cleancommalist')) {
    258. 

  258.           $val_ids[0] = cleanCommaList($val_ids[0]);
    259. 

  259.         }
    260. 

  260.         ## make sure the val_ids as numbers
    261. 

  261.         $values = explode(',',$val_ids[0]);
    262. 

  262.         $ids = array();
    263. 

  263.         foreach ($values as $valueIndex) {
    264. 

  264.           $iValue = sprintf('%d',$valueIndex);
    265. 

  265.           if ($iValue) {
    266. 

  266.             $ids[] = $iValue;
    267. 

  267.           }
    268. 

  268.         }
    269. 

  269.         if (!sizeof($ids)) return '';
    270. 

  270.         $val_ids[0] = join(',',$ids);
    271. 

  271.  #       print '<br/>2 <b>'.$val_ids[0].'</b>';
    272. 

  272.         $value = '';
    273. 

  273.         $res = Sql_Query("select $table_prefix"."listattr_".$att["tablename"].".name
    274. 

  274.           from $user_att_table,$table_prefix"."listattr_".$att["tablename"]."
    275. 

  275.           where $user_att_table".".userid = ".$user." and
    276. 

  276.           $table_prefix"."listattr_".$att["tablename"].".id in ($val_ids[0]) and
    277. 

  277.           $user_att_table".".attributeid = ".$attribute);
    278. 

  278.         while ($row = Sql_Fetch_row($res)) {
    279. 

  279.           $value .= $row[0]."; ";
    280. 

  280.         }
    281. 

  281.         $value = substr($value,0,-2);
    282. 

  282.       } else {
    283. 

  283.         $value = "";
    284. 

  284.       }
    285. 

  285.       break;
    286. 

  286.     case "select":
    287. 

  287.     case "radio":
    288. 

  288.       $res = Sql_Query("select $table_prefix"."listattr_".$att["tablename"].".name
    289. 

  289.         from $user_att_table,$table_prefix"."listattr_".$att["tablename"]."
    290. 

  290.         where $user_att_table".".userid = ".$user." and
    291. 

  291.         $table_prefix"."listattr_".$att["tablename"].".id = $user_att_table".".value and
    292. 

  292.         $user_att_table".".attributeid = ".$attribute);
    293. 

  293.       $row = Sql_Fetch_row($res);
    294. 

  294.       $value = $row[0];
    295. 

  295.       break;
    296. 

  296.     default:
    297. 

  297.       $res = Sql_Query(sprintf('select value from %s where
    298. 

  298.         userid = %d and attributeid = %d',$user_att_table,$user,$attribute));
    299. 

  299.       $row = Sql_Fetch_row($res);
    300. 

  300.       $value = $row[0];
    301. 

  301.   }
    302. 

  302.   return stripslashes($value);
    303. 

  303. }
    304. 

  304. 

  305. function userName() {
    306. 

  306.   global $config;
    307. 

  307.   if (!is_array($config["nameattributes"])) return "";
    308. 

  308.   $res = "";
    309. 

  309.   foreach ($config["nameattributes"] as $att) {
    310. 

  310.     if (isset($_SESSION["userdata"][$att]["displayvalue"])) {
    311. 

  311.       $res .= $_SESSION["userdata"][$att]["displayvalue"].' ';
    312. 

  312.     }
    313. 

  313.   }
    314. 

  314.   return rtrim($res);
    315. 

  315. }
    316. 

  316. 

  317. function isBlackListed($email = "") {
    318. 

  318.   if (!$email) return 0;
    319. 

  319.   if (!Sql_Table_exists($GLOBALS["tables"]["user_blacklist"])) return 0;
    320. 

  320.   $gracetime = sprintf('%d',$GLOBALS["blacklist_gracetime"]);
    321. 

  321.   if (!$gracetime || $gracetime > 15 || $gracetime < 0) {
    322. 

  322.     $gracetime = 5;
    323. 

  323.   }
    324. 

  324.   # allow 5 minutes to send the last message acknowledging unsubscription
    325. 

  325.   $req = Sql_Query(sprintf('select * from %s where email = "%s" and date_add(added,interval %d minute) < now()',
    326. 

  326.     $GLOBALS["tables"]["user_blacklist"],sql_escape($email),$gracetime));
    327. 

  327.   return Sql_Affected_Rows();
    328. 

  328. }
    329. 

  329. 

  330. function isBlackListedID($userid = 0) {
    331. 

  331.   if (!$userid) return 0;
    332. 

  332.   $email = Sql_Fetch_Row_Query("select email from {$GLOBALS["tables"]["user"]} where id = $userid");
    333. 

  333.   return isBlackListed($email[0]);
    334. 

  334. }
    335. 

  335. 

  336. function unBlackList($userid = 0) {
    337. 

  337.   if (!$userid) return;
    338. 

  338.   $email = Sql_Fetch_Row_Query("select email from {$GLOBALS["tables"]["user"]} where id = $userid");
    339. 

  339.   Sql_Query(sprintf('delete from %s where email = "%s"',
    340. 

  340.     $GLOBALS["tables"]["user_blacklist"],$email[0]));
    341. 

  341.   Sql_Query(sprintf('delete from %s where email = "%s"',
    342. 

  342.     $GLOBALS["tables"]["user_blacklist_data"],$email[0]));
    343. 

  343.   Sql_Query(sprintf('update %s set blacklisted = 0 where id = %d',$GLOBALS["tables"]["user"],$userid));
    344. 

  344.   if (isset($_SESSION["logindetails"]["adminname"])) {
    345. 

  345.     $msg = "Removed from blacklist by ".$_SESSION["logindetails"]["adminname"];
    346. 

  346.     addUserHistory($email[0],$msg,"");
    347. 

  347.   }
    348. 

  348. }
    349. 

  349. 

  350. function addUserToBlackList($email,$reason = '') {
    351. 

  351.   Sql_Query(sprintf('update %s set blacklisted = 1 where email = "%s"',
    352. 

  352.     $GLOBALS['tables']["user"],addslashes($email)));
    353. 

  353.   #0012262: blacklist only email when email bounces. (not users): Function split so email can be blacklisted without blacklisting user
    354. 

  354.   addEmailToBlackList($email,$reason);
    355. 

  355. }
    356. 

  356. 

  357. function addEmailToBlackList($email,$reason = '') {
    358. 

  358.   #0012262: blacklist only email when email bounces. (not users): Function split so email can be blacklisted without blacklisting user
    359. 

  359.   Sql_Query(sprintf('insert ignore into %s (email,added) values("%s",now())',
    360. 

  360.     $GLOBALS['tables']["user_blacklist"],addslashes($email)));
    361. 

  361.   # save the reason, and other data
    362. 

  362.   Sql_Query(sprintf('insert ignore into %s (email,name,data) values("%s","%s","%s")',
    363. 

  363.     $GLOBALS['tables']["user_blacklist_data"],addslashes($email),
    364. 

  364.     "reason",addslashes($reason)));
    365. 

  365.   foreach (array("REMOTE_ADDR") as $item ) { # @@@do we want to know more?
    366. 

  366.     if (isset($_SERVER[$item])) {
    367. 

  367.       Sql_Query(sprintf('insert ignore into %s (email,name,data) values("%s","%s","%s")',
    368. 

  368.         $GLOBALS['tables']["user_blacklist_data"],addslashes($email),
    369. 

  369.         $item,addslashes($_SERVER[$item])));
    370. 

  370.     }
    371. 

  371.   }
    372. 

  372.   ## call plugins to tell them
    373. 

  373.   if (isset($GLOBALS['plugins']) && is_array($GLOBALS['plugins'])) {
    374. 

  374.     foreach ($GLOBALS['plugins'] as $pluginname => $plugin) {
    375. 

  375.       if (method_exists($plugin, "blacklistEmail")) {
    376. 

  376.          $plugin->blacklistEmail($email);
    377. 

  377.       }
    378. 

  378.     }
    379. 

  379.   }
    380. 

  380.   
    381. 

  381. }
    382. 

  382. 

  383. function UserAttributeValueSelect($user = 0,$attribute = 0) {
    384. 

  384. #  if (!$user || !$attribute) return;
    385. 

  385.   global $table_prefix,$tables;
    386. 

  386.   # workaround for integration webbler/phplist
    387. 

  387.   if (!isset($table_prefix))
    388. 

  388.     $table_prefix = "phplist_";
    389. 

  389. 

  390.   if ($tables["attribute"]) {
    391. 

  391.     $att_table = $tables["attribute"];
    392. 

  392.     $user_att_table = $tables["user_attribute"];
    393. 

  393.   } else {
    394. 

  394.     $att_table = "attribute";
    395. 

  395.     $user_att_table = "user_attribute";
    396. 

  396.   }
    397. 

  397.   if (!Sql_Table_exists($att_table)) {
    398. 

  398.     return "broken attribute $attribute";
    399. 

  399.   }
    400. 

  400.   $att = Sql_Fetch_array_Query("select * from $att_table where id = $attribute");
    401. 

  401.  # $value = UserAttributeValue($att["tablename"],$attribute);
    402. 

  402.   $value = UserAttributeValue($user,$attribute);
    403. 

  403. #  $html = 'Value: '.$value;
    404. 

  404.   $html = sprintf('<select name="attribute[%d]" style="attributeinput" >',$attribute);
    405. 

  405.   $res = Sql_Query("select id,name from $table_prefix"."listattr_".$att["tablename"]." order by name");
    406. 

  406.   if (!Sql_Affected_Rows())
    407. 

  407.     return "(No values available)";
    408. 

  408.   $html .= '<option value="0">-- no value</option>';
    409. 

  409.   while ($row = Sql_Fetch_Row($res))
    410. 

  410.     if ($row[1] != '')
    411. 

  411.       $html .= sprintf('<option value="%d" %s>%s </option>',$row[0],$row[1] == $value?'selected="selected"':"",$row[1]);
    412. 

  412.   return $html . '</select>';
    413. 

  413. }
    414. 

  414. 

  415. function UserAttributeValueCbGroup($user = 0,$attribute = 0) {
    416. 

  416. #  if (!$user || !$attribute) return;
    417. 

  417.   global $table_prefix,$tables;
    418. 

  418.   if ($tables["attribute"]) {
    419. 

  419.     $att_table = $tables["attribute"];
    420. 

  420.     $user_att_table = $tables["user_attribute"];
    421. 

  421.   } else {
    422. 

  422.     $att_table = "attribute";
    423. 

  423.     $user_att_table = "user_attribute";
    424. 

  424.   }
    425. 

  425.   # workaround for integration webbler/phplist
    426. 

  426.   if (!isset($table_prefix))
    427. 

  427.     $table_prefix = "phplist_";
    428. 

  428. 

  429.   $att = Sql_Fetch_array_Query("select * from $att_table where id = $attribute");
    430. 

  430.   $values_req = Sql_Fetch_Row_Query("select value from $user_att_table where userid = $user and attributeid = $attribute");
    431. 

  431.   $values = explode(",",$values_req[0]);
    432. 

  432.   $html = sprintf('<input type="hidden" name="cbgroup[]" value="%d" /><table>',$attribute);
    433. 

  433.  # $html = sprintf('<select name="attribute[%d]" style="attributeinput" >',$attribute);
    434. 

  434.   $res = Sql_Query("select id,name from $table_prefix"."listattr_".$att["tablename"]." order by listorder,name");
    435. 

  435.   if (!Sql_Affected_Rows())
    436. 

  436.     return "(No values available)";
    437. 

  437.   while ($row = Sql_Fetch_Row($res))
    438. 

  438.     $html .= sprintf('<tr><td><input type="checkbox" name="cbgroup%d[]" value="%d" %s /></td><td>%s</td></tr>',
    439. 

  439.       $attribute,$row[0],in_array($row[0],$values)?"checked":"",$row[1]);
    440. 

  440.   return $html . '</table>';
    441. 

  441. }
    442. 

  442. 

  443. function userGroups($loginname) {
    444. 

  444.   $result = array();
    445. 

  445.   if (Sql_Table_exists("user_group")) {
    446. 

  446.     $req = Sql_Query(sprintf('select groupid from user_group,user where user_group.userid = user.id and user.email = "%s"',addslashes($loginname)));
    447. 

  447.     while ($row = Sql_Fetch_Row($req)) {
    448. 

  448.       array_push($result,$row[0]);
    449. 

  449.     }
    450. 

  450.     $ev = getEveryoneGroupID();
    451. 

  451.     array_push($result,$ev);
    452. 

  452.   }
    453. 

  453.   return $result;
    454. 

  454. }
    455. 

  455. 

  456. function is_email($email) {
    457. 

  457. 

  458.   #@@ dont_require_validemail should be replaced by EMAIL_ADDRESS_VALIDATION_LEVEL
    459. 

  459.   if (isset($GLOBALS['config']) && isset($GLOBALS["config"]["dont_require_validemail"]) && $GLOBALS["config"]["dont_require_validemail"])
    460. 

  460.     return 1;
    461. 

  461. 

  462.   $email = trim($email);
    463. 

  463. 

  464.   switch (EMAIL_ADDRESS_VALIDATION_LEVEL) {
    465. 

  465.     case 0: # No email address validation.
    466. 

  466. 	    return 1;
    467. 

  467. 	    break;
    468. 

  468. 

  469.     case 2: # RFC821 email validation without escaping and quoting of local part
    470. 

  470.     case 3: # RFC821 email validation.
    471. 

  471.     # $email is a valid address as defined by RFC821
    472. 

  472.       # Except:
    473. 

  473.       #   Length of domainPart is not checked
    474. 

  474.       #   Not accepted are CR and LF even if escaped by \
    475. 

  475.       #   Not accepted is Folding
    476. 

  476.       #   Not accepted is literal domain-part (eg. [1.0.0.127])
    477. 

  477.       #   Not accepted is comments (eg. (this is a comment)@example.com)
    478. 

  478.       # Extra:
    479. 

  479.       #   topLevelDomain can only be one of the defined ones
    480. 

  480.       $escapedChar = "\\\\[\\x01-\\x09\\x0B-\\x0C\\x0E-\\x7F]";   # CR and LF excluded for safety reasons
    481. 

  481.       $unescapedChar = "[a-zA-Z0-9!#$%&'*\+\-\/=?^_`{|}~]";
    482. 

  482.       if(EMAIL_ADDRESS_VALIDATION_LEVEL == 2) {
    483. 

  483.         $char = "$unescapedChar";
    484. 

  484.       } else {
    485. 

  485.         $char = "($unescapedChar|$escapedChar)";
    486. 

  486.       };
    487. 

  487.       $dotString = "$char((\.)?$char){0,63}";
    488. 

  488. 

  489.       $qtext = "[\\x01-\\x09\\x0B-\\x0C\\x0E-\\x21\\x23-\\x5B\\x5D-\\x7F]"; # All but <LF> x0A, <CR> x0D, quote (") x22 and backslash (\) x5c
    490. 

  490.       $qchar = "$qtext|$escapedChar";
    491. 

  491.       $quotedString = "\"($qchar){1,62}\"";
    492. 

  492.       if(EMAIL_ADDRESS_VALIDATION_LEVEL == 2) {
    493. 

  493.         $localPart = "$dotString";  # without escaping and quoting of local part
    494. 

  494.       } else {
    495. 

  495.         $localPart = "($dotString|$quotedString)";
    496. 

  496.       };
    497. 

  497.       $topLevelDomain = "(ac|ad|ae|aero|af|ag|ai|al|am|an|ao|aq|ar|arpa|as|asia|at|au|aw|az|ba|bb|bd|be|bf|bg|bh|bi|biz|bj|bm|bn|bo|br|bs|bt|bv|bw|by|bz|ca|cat|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|com|coop|cr|cs|cu|cv|cx|cy|cz|de|dev|dj|dk|dm|do|dz|ec|edu|ee|eg|eh|er|es|et|eu|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gov|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|home|hr|ht|hu|id|ie|il|im|in|info|int|io|iq|ir|is|it|jm|je|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|loc|ls|lt|lu|lv|ly|ma|mc|md|mg|mh|mil|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|museum|mv|mw|mx|my|mz|na|name|nc|ne|net|nf|ng|ni|nl|no|np|nr|nt|nu|nz|om|org|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|pro|ps|pt|pw|py|qa|re|ro|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|st|su|sv|sy|sz|tc|td|tel|tf|tg|th|tj|tk|tm|tn|to|tp|tr|travel|tt|tv|tw|tz|ua|ug|uk|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|yu|za|zm|zw)";
    498. 

  498.       $domainLiteral = "((([0-9][0-9]?|[0-1][0-9][0-9]|[2][0-4][0-9]|[2][5][0-5])\.){3}([0-9][0-9]?|[0-1][0-9][0-9]|[2][0-4][0-9]|[2][5][0-5]))";
    499. 

  499. 

  500.       $domainPart = "([a-zA-Z0-9](-?[a-zA-Z0-9])*(\.[a-zA-Z](-?[a-zA-Z0-9])*)*\.$topLevelDomain|$domainLiteral)";
    501. 

  501.       $validEmailPattern = "/^$localPart@$domainPart$/i"; # result: /^(([a-zA-Z0-9!#$%&'*\+\-\/=?^_`{|}~]|\\[\x01-\x09\x0B-\x0C\x0E-\x7F])((\.)?([a-zA-Z0-9!#$%&'*\+\-\/=?^_`{|}~]|\\[\x01-\x09\x0B-\x0C\x0E-\x7F])){0,63}|"([\x01-\x09\x0B-\x0C\x0E-\x21\x23-\x5B\x5D-\x7F]|\\[\x01-\x09\x0B-\x0C\x0E-\x7F]){1,62}")@([a-zA-Z0-9](-?[a-zA-Z0-9])*(\.[a-zA-Z](-?[a-zA-Z0-9])*)*\.(ac|ad|ae|aero|af|ag|ai|al|am|an|ao|aq|ar|arpa|as|at|au|aw|az|ba|bb|bd|be|bf|bg|bh|bi|biz|bj|bm|bn|bo|br|bs|bt|bv|bw|by|bz|ca|cat|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|com|coop|cr|cs|cu|cv|cx|cy|cz|de|dev|dj|dk|dm|do|dz|ec|edu|ee|eg|eh|er|es|et|eu|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gov|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|home|hr|ht|hu|id|ie|il|im|in|info|int|io|iq|ir|is|it|jm|je|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|loc|ls|lt|lu|lv|ly|ma|mc|md|mg|mh|mil|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|museum|mv|mw|mx|my|mz|na|name|nc|ne|net|nf|ng|ni|nl|no|np|nr|nt|nu|nz|om|org|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|pro|ps|pt|pw|py|qa|quipu|re|ro|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|st|su|sv|sy|sz|tc|td|tf|tg|th|tj|tk|tm|tn|to|tp|tr|tt|tv|tw|tz|ua|ug|uk|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|yu|za|zm|zw)|((([0-9][0-9]?|[0-1][0-9][0-9]|[2][0-4][0-9]|[2][5][0-5])\.){3}([0-9][0-9]?|[0-1][0-9][0-9]|[2][0-4][0-9]|[2][5][0-5])))$/i
    502. 

    503. 

  503.       if(preg_match($validEmailPattern, $email)) {
    504. 

  504.         return(1);
    505. 

  505.       } else {
    506. 

  506.         return(0);
    507. 

  507.       }
    508. 

  508.       break;
    509. 

    510. 

  510.     default: # 10.4 style email validation
    511. 

  511. 		  # quite often emails have two @ signs
    512. 

  512. 		  $ats = substr_count($email,'@');
    513. 

  513. 		  if ($ats != 1) return 0;
    514. 

    515. 

  515. 		  # hmm, it seems people are starting to have emails with & and ' or ` chars in the name
    516. 

  516. 		  #'
    517. 

    518. 

  518. 			$pattern =
    519. 

  519. 			"/^[\&\'-_.[:alnum:]]+@((([[:alnum:]]|[[:alnum:]][[:alnum:]-]*[[:alnum:]])\.)+(ac|ad|ae|aero|af|ag|ai|al|am|an|ao|aq|ar|arpa|as|asia|at|au|aw|az|ba|bb|bd|be|bf|bg|bh|bi|biz|bj|bm|bn|bo|br|bs|bt|bv|bw|by|bz|ca|cat|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|com|coop|cr|cs|cu|cv|cx|cy|cz|de|dev|dj|dk|dm|do|dz|ec|edu|ee|eg|eh|er|es|et|eu|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gov|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|home|hr|ht|hu|id|ie|il|im|in|info|int|io|iq|ir|is|it|jm|je|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|loc|ls|lt|lu|lv|ly|ma|mc|md|mg|mh|mil|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|museum|mv|mw|mx|my|mz|na|name|nc|ne|net|nf|ng|ni|nl|no|np|nr|nt|nu|nz|om|org|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|pro|ps|pt|pw|py|qa|quipu|re|ro|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|st|su|sv|sy|sz|tc|td|tel|tf|tg|th|tj|tk|tm|tn|to|tp|tr|travel|tt|tv|tw|tz|ua|ug|uk|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|yu|za|zm|zw)|(([0-9][0-9]?|[0-1][0-9][0-9]|[2][0-4][0-9]|[2][5][0-5])\.){3}([0-9][0-9]?|[0-1][0-9][0-9]|[2][0-4][0-9]|[2][5][0-5]))$/i";
    520. 

  520. 

  521. 			  if(preg_match($pattern, $email)) {
    522. 

  522. 			    return 1;
    523. 

  523. 			  } else {
    524. 

  524. 			    return 0;
    525. 

  525. 			  }
    526. 

  526.       break;
    527. 

  527.   }
    528. 

  528. }
    529. 

  529. 

  530. function addUserHistory($email,$msg,$detail) {
    531. 

  531.   global $table_prefix,$tables;
    532. 

  532.   if (isset($tables["user"])) {
    533. 

  533.     $user_table = $tables["user"];
    534. 

  534.   } else {
    535. 

  535.     $user_table = "user";
    536. 

  536.   }
    537. 

  537.   if (isset($tables["user_history"])) {
    538. 

  538.     $user_his_table = $tables["user_history"];
    539. 

  539.   } else {
    540. 

  540.     $user_his_table = "user_history";
    541. 

  541.   }
    542. 

  542. 

  543.   $sysinfo = "";
    544. 

  544.   $sysarrays = array_merge($_ENV,$_SERVER);
    545. 

  545.   if ( isset($GLOBALS["userhistory_systeminfo"]) && is_array($GLOBALS["userhistory_systeminfo"]) ) {
    546. 

  546.     foreach ($GLOBALS["userhistory_systeminfo"] as $key) {
    547. 

  547.       if (isset($sysarrays[$key])) {
    548. 

  548.         $sysinfo .= "\n$key = $sysarrays[$key]";
    549. 

  549.       }
    550. 

  550.     }
    551. 

  551.   } elseif ( isset($GLOBALS["config"]["userhistory_systeminfo"]) && is_array($GLOBALS["config"]["userhistory_systeminfo"])) {
    552. 

  552.     foreach ($GLOBALS["config"]["userhistory_systeminfo"] as $key) {
    553. 

  553.       if ($sysarrays[$key]) {
    554. 

  554.         $sysinfo .= "\n$key = $sysarrays[$key]";
    555. 

  555.       }
    556. 

  556.     }
    557. 

  557.   } else {
    558. 

  558.     $default = array('HTTP_USER_AGENT','HTTP_REFERER','REMOTE_ADDR','REQUEST_URI');
    559. 

  559.     foreach ($sysarrays as $key => $val) {
    560. 

  560.       if (in_array($key,$default))
    561. 

  561.       $sysinfo .= "\n".strip_tags($key) . ' = '.htmlspecialchars($val);
    562. 

  562.     }
    563. 

  563.   }
    564. 

  564. 

  565.   $userid = Sql_Fetch_Row_Query("select id from $user_table where email = \"$email\"");
    566. 

  566.   if ($userid[0]) {
    567. 

  567.     if (isset($_SERVER["REMOTE_ADDR"])) {
    568. 

  568.       $ip = $_SERVER["REMOTE_ADDR"];
    569. 

  569.     } else {
    570. 

  570.       $ip = '';
    571. 

  571.     }
    572. 

  572.     Sql_Query(sprintf('insert into %s (ip,userid,date,summary,detail,systeminfo)
    573. 

  573.       values("%s",%d,now(),"%s","%s","%s")',$user_his_table,$ip,$userid[0],addslashes($msg),addslashes(htmlspecialchars($detail)),$sysinfo));
    574. 

  574.   }
    575. 

  575. }
    576. 

  576. 

  577. function validateEmail($email) {
    578. 

  578.   if ( !empty($GLOBALS["config"]["dont_require_validemail"]) )
    579. 

  579.     return 1;
    580. 

  580.   if (!isset($GLOBALS["check_for_host"])) {
    581. 

  581.     $GLOBALS["check_for_host"] = 0;
    582. 

  582.   }
    583. 

  583.   if (!empty($email) && $GLOBALS["check_for_host"]) {
    584. 

  584.     list($username,$domaincheck) = explode('@',$email);
    585. 

  585.     # checking for an MX is not sufficient
    586. 

  586. #    $mxhosts = array();
    587. 

  587. #    $validhost = getmxrr ($domaincheck,$mxhosts);
    588. 

  588.     $validhost = checkdnsrr($domaincheck, "MX") || checkdnsrr($domaincheck, "A");
    589. 

  589.   } else {
    590. 

  590.     $validhost = 1;
    591. 

  591.   }
    592. 

  592.   return $validhost && is_email($email);
    593. 

  593. }
    594. 

  594. 

  595. function validMod10($no) {
    596. 

  596.   $dups = array();
    597. 

  597.   $rev = strrev($no);
    598. 

  598.   for ($i=0;$i<strlen($rev);$i++) {
    599. 

  599.     if ($i % 2 == 1) {
    600. 

  600.       array_push($dups,substr($rev,$i,1) * 2);
    601. 

  601.     } else {
    602. 

  602.       array_push($dups,substr($rev,$i,1));
    603. 

  603.     }
    604. 

  604.   }
    605. 

  605.   $total = 0;
    606. 

  606.   foreach ($dups as $dig) {
    607. 

  607.     for ($i=0;$i<strlen($dig);$i++) {
    608. 

  608.       $total += substr($dig,$i,1);
    609. 

  609.     }
    610. 

  610.   # print "$dig - $total<br/>";
    611. 

  611.   }
    612. 

  612.   return ($total % 10 == 0);
    613. 

  613. 

  614. # print "$no";
    615. 

  615. }
    616. 

  616. 

  617. function validateCC($ccno) {
    618. 

  618.   # credit card validation routines here
    619. 

  619.   # major credit cards that you might want to validate.
    620. 

  620. 

  621.   #CARD TYPE Prefix Length Check digit algorithm
    622. 

  622.   #MASTERCARD 51-55 16 mod 10
    623. 

  623.   #VISA 4 13,16 mod 10
    624. 

  624.   #AMEX 34,37 15 mod 10
    625. 

  625.   #Diners Club/Carte Blanche 300-305,36,38 14 mod 10
    626. 

  626.   #Discover 6011 16 mod 10
    627. 

  627.   #enRoute 2014,2149 15 any
    628. 

  628.   #JCB 3 16 mod 10
    629. 

  629.   #JCB 2131,1800 15 mod 10
    630. 

  630.   $ccno = preg_replace("/\D/","",$ccno);
    631. 

  631.   $length = strlen($ccno);
    632. 

  632.   $firsttwo = substr($ccno,0,2);
    633. 

  633.   $firstthree = substr($ccno,0,3);
    634. 

  634.   $first = substr($ccno,0,1);
    635. 

  635.   $firstfour = substr($ccno,0,4);
    636. 

  636. 

  637.   if ($firsttwo >= 51 && $firsttwo <= 55) # Mastercard
    638. 

  638.     return $length == 16 && validMod10($ccno);
    639. 

  639.   elseif ($first == 4) # visa
    640. 

  640.     return ($length == 13 || $length == 16) && validMod10($ccno);
    641. 

  641.   elseif ($firsttwo == 34 || $firsttwo == 37) # Amex
    642. 

  642.     return $length == 15 && validMod10($ccno);
    643. 

  643.   elseif (($firstthree >= 300 && $firstthree <= 305) # Diners1
    644. 

  644.     || ($firsttwo == 36 || $firsttwo == 38)) # Diners2
    645. 

  645.     return  $length == 14 && validMod10($ccno);
    646. 

  646.   elseif ($firstfour == 6011) # discover
    647. 

  647.     return $length == 16 && validMod10($ccno);
    648. 

  648.   elseif ($firstfour == 2014 || $firstfour == 2149) # enRoute
    649. 

  649.     return $length == 15;
    650. 

  650.   else
    651. 

  651.     # if it is not any of the above, we do not know how to validate it
    652. 

  652. 

  653.   # reject 4 and 15 1s anyway 
    654. 

  654.   if ($ccno == "4111111111111111") {
    655. 

  655.     return 0;
    656. 

  656.   }
    657. 

  657. 

  658.   return 1;
    659. 

  659. }
    660. 

  660. 

  661. function loadCCvalidationFile($ccrangefile) {
    662. 

  662.   if (!is_file($ccrangefile))
    663. 

  663.     return array();
    664. 

  664.   $range = array();
    665. 

  665.   $fp = fopen($ccrangefile,"rb");
    666. 

  666.   $contents = fread($fp,filesize($ccrangefile));
    667. 

  667.   fclose($fp);
    668. 

  668.   $lines = explode("\n",$contents);
    669. 

  669.   foreach ($lines as $line) {
    670. 

  670.     if (!preg_match("/^\s*#/",$line) && !preg_match("/^\s+$/",$line)) {
    671. 

  671.       if (preg_match("#(\d+),(\d+),(\d+)#",$line,$regs)) {
    672. 

  672. #        print "RANGE".$line."<br/>";
    673. 

  673.         array_push($range,array(
    674. 

  674.           "start" => substr($regs[1],0,6),
    675. 

  675.           "end" => substr($regs[2],0,6),
    676. 

  676.           "company" => sprintf('%02d',$regs[3])
    677. 

  677.         ));
    678. 

  678.      #   dbg($regs[1]. " ". $regs[2]. " -> ".$regs[3]);
    679. 

  679.       } elseif (preg_match("#\((\d+)\)\s*=\s*'(.*)'#",$line,$regs)) {
    680. 

  680. #        print "COMPANY".$line."<br/>";
    681. 

  681.         $company[sprintf('%02d',$regs[1])] = $regs[2];
    682. 

  682.      #   dbg($regs[1]. " = " . $regs[2]);
    683. 

  683.       }
    684. 

  684.     }
    685. 

  685.   }
    686. 

  686.   return array($range,$company);
    687. 

  687. }
    688. 

  688. 

  689. function ccCompany($ccno) {
    690. 

  690.   global $config;
    691. 

  691.   $ccrangefile = $config["code_root"]."/".$config["uploader_dir"]."/codelib/ccvalidation.txt";
    692. 

  692.   list($ranges,$companies) = loadCCvalidationFile($ccrangefile);
    693. 

  693.   $first6 = substr($ccno,0,6);
    694. 

  694.   if (is_array($ranges))
    695. 

  695.   foreach ($ranges as $range) {
    696. 

  696.  #  dbg($range["start"]);
    697. 

  697. #    print "CHECKING ".$range["start"].' TO '.$range["end"].'<br/>';
    698. 

  698.     if ($range["start"] <= $first6 && $range["end"] >= $first6) {
    699. 

  699.       return array($range["company"],$companies[$range["company"]]);
    700. 

  700.     }
    701. 

  701.   }
    702. 

  702.   return -1;
    703. 

  703. }
    704. 

  704. 

  705. function checkCCrange($ccno) {
    706. 

  706.   global $config;
    707. 

  707.   $ccrangefile = $config["code_root"]."/".$config["uploader_dir"]."/codelib/ccvalidation.txt";
    708. 

  708.   if (!is_file($ccrangefile) || !is_array($config["cc_accept_company"]))
    709. 

  709.     return 1;
    710. 

  710.   list($companyid,$companyname) = ccCompany($ccno);
    711. 

  711.   if ($companyid > 0 && in_array($companyid,$config["cc_accept_company"])) {
    712. 

  712.  #  dbg($ccno . " is valid for company $companyid $companyname");
    713. 

  713.     return 1;
    714. 

  714.   } elseif ($companyid < 0) {
    715. 

  715.     return -1;
    716. 

  716.   } else {
    717. 

  717.     return 0;
    718. 

  718.   }
    719. 

  719. }
    720. 

  720. 

  721. function validateCCExpiry($ccexpiry) {
    722. 

  722.   # expiry date validation here
    723. 

  723.   $mon = substr($ccexpiry,0,2);
    724. 

  724.   if (strlen($ccexpiry) == 5) {
    725. 

  725.     # I presume it is with a separator
    726. 

  726.     $year = substr($ccexpiry,3,2);
    727. 

  727.   } elseif (strlen($ccexpiry) == 4) {
    728. 

  728.     $year = substr($ccexpiry,2,2);
    729. 

  729.   } else {
    730. 

  730.     return 0;
    731. 

  731.   }
    732. 

  732.   $yeardiff = $year - date("y");
    733. 

  733. 

  734.   return ($mon < 13 && $yeardiff < 9 && (($year > date("y")) || ($year == date("y") && $mon >= date("m"))));
    735. 

  735. }
    736. 

  736. 

  737. function obscureCreditCard($cardno) {
    738. 

  738.   if (strlen($cardno) < 5)
    739. 

  739.     return $cardno;
    740. 

  740. 

  741.   $res = substr($cardno,strlen($cardno)-4,4);
    742. 

  742.   for ($i=0;$i<strlen($cardno)-4;$i++) {
    743. 

  743.     $prefix .= '*';
    744. 

  744.   }
    745. 

  745.   $res = $prefix . $res;
    746. 

  746.   return $res;
    747. 

  747. }
    748. 

  748. 

  749. function loadUser($loginname = "") {
    750. 

  750.   if (!Sql_Table_exists("user")) return;
    751. 

  751.   initialiseUserSession();
    752. 

  752.   if (!$loginname) {
    753. 

  753.     if ($_SESSION["userloggedin"] != "" && $_SESSION["username"] != "") {
    754. 

  754.       $loginname = $_SESSION["username"];
    755. 

  755.     } else {
    756. 

  756.       return "";
    757. 

  757.     }
    758. 

  758.   }
    759. 

  759.   $att_req = Sql_Query(sprintf('select attribute.id,
    760. 

  760.     %s.name,%s.type,
    761. 

  761.     %s.value,%s.tablename from %s,%s,%s
    762. 

  762.     where %s.userid = %s.id and %s.email = "%s" and %s.id = %s.attributeid',
    763. 

  763.     "attribute",
    764. 

  764.     "attribute",
    765. 

  765.     "user_attribute",
    766. 

  766.     "attribute",
    767. 

  767.     "user",
    768. 

  768.     "user_attribute",
    769. 

  769.     "attribute",
    770. 

  770.     "user_attribute",
    771. 

  771.     "user",
    772. 

  772.     "user",
    773. 

  773.     addslashes($loginname),
    774. 

  774.     "attribute",
    775. 

  775.     "user_attribute"
    776. 

  776.   ));
    777. 

  777.   while ($att = Sql_fetch_array($att_req)) {
    778. 

  778. #   if (!defined($_SESSION["userdata"]["attribute".$att["id"]])) {
    779. 

  779.       $_SESSION["userdata"]["attribute".$att["id"]] = array(
    780. 

  780.         "name" => $att["name"],
    781. 

  781.         "value" => $att["value"],
    782. 

  782.         "type" => $att["type"],
    783. 

  783.         "attid" => $att["id"],
    784. 

  784.         "displayvalue" => $att['value'],
    785. 

  785.         );
    786. 

  786.       switch ($att["type"]) {
    787. 

  787.         case "textline":
    788. 

  788.         case "hidden":
    789. 

  789.           $_SESSION["userdata"]["attribute".$att["id"]]["displayvalue"] =
    790. 

  790.             $att["value"];
    791. 

  791.           break;
    792. 

  792.         case "creditcardno":
    793. 

  793.           $_SESSION["userdata"]["attribute".$att["id"]]["displayvalue"] =
    794. 

  794.             obscureCreditCard($att["value"]);
    795. 

  795.           break;
    796. 

  796.         case "select":
    797. 

  797.           $_SESSION["userdata"]["attribute".$att["id"]]["displayvalue"] =
    798. 

  798.             AttributeValue($att["tablename"],$att["value"]);
    799. 

  799.           break;
    800. 

  800.         case "date":
    801. 

  801.           $_SESSION["userdata"]["attribute".$att["id"]]["displayvalue"] =
    802. 

  802.             formatDate($att["value"]);
    803. 

  803.           break;
    804. 

  804.       }
    805. 

  805. #    }
    806. 

  806.   }
    807. 

  807.   $d_req = Sql_Fetch_Array_Query("select * from user where email = \"$loginname\"");
    808. 

  808.   $_SESSION["userid"] = $d_req["id"];
    809. 

  809.   foreach (array("email","disabled","confirmed","htmlemail","uniqid",'password','foreignkey') as $field) {
    810. 

  810. #   if (!defined($_SESSION["userdata"][$field])) {
    811. 

  811.       $_SESSION["userdata"][$field] = array(
    812. 

  812.         "name" => $field,
    813. 

  813.         "value" => $d_req[$field],
    814. 

  814.         "type" => "static",
    815. 

  815.         "displayvalue" => $d_req[$field]
    816. 

  816.       );
    817. 

  817. #     }
    818. 

  818.   }
    819. 

  819.   $_SESSION["usergroups"] = userGroups($loginname);
    820. 

  820.   if (is_array($GLOBALS['config']['usergreeting'])) {
    821. 

  821.     $_SESSION['usergreeting'] = '';
    822. 

  822.     foreach ($GLOBALS['config']['usergreeting'] as $att) {
    823. 

  823.       $_SESSION['usergreeting'] .= $_SESSION["userdata"][$att]["displayvalue"].' ';
    824. 

  824.     }
    825. 

  825.     $_SESSION['usergreeting'] = rtrim($_SESSION['usergreeting']);
    826. 

  826.   }
    827. 

  827.   dbg("done loading user");
    828. 

  828.   return 1;
    829. 

  829. }
    830. 

  830. 

  831. function addKeywordLibrary($name) {
    832. 

  832.   $req = Sql_Query(sprintf('select id from keywordlib where name = "%s"',$name));
    833. 

  833.   if (Sql_affected_Rows()) {
    834. 

  834.     $row = Sql_Fetch_Row($req);
    835. 

  835.     return $row[0];
    836. 

  836.   }
    837. 

  837.   Sql_Query(sprintf('insert into keywordlib (name) values("%s")',$name));
    838. 

  838.   return Sql_Insert_id();
    839. 

  839. }
    840. 

  840. 

  841. function getNewAttributeTablename($name) {
    842. 

  842.   global $table_prefix,$tables;
    843. 

  843.   if ($tables["attribute"]) {
    844. 

  844.     $table = $tables["attribute"];
    845. 

  845.   } else {
    846. 

  846.     $table = "attribute";
    847. 

  847.   }
    848. 

  848.   $lc_name = substr(preg_replace("/\W/","", strtolower($name)),0,10);
    849. 

  849. #  if ($lc_name == "") Fatal_Error("Name cannot be empty: $lc_name");
    850. 

  850.   if (!$lc_name) $lc_name = "attribute";
    851. 

  851.   Sql_Query("select * from $table where tablename = \"$lc_name\"");
    852. 

  852. #  if (Sql_Affected_Rows()) Fatal_Error("Name is not unique enough");
    853. 

  853.   $c = 1;
    854. 

  854.   $basename = $lc_name;
    855. 

  855.   while (Sql_Affected_Rows() && $c < 100) {
    856. 

  856.     $lc_name = $basename.$c;
    857. 

  857.     Sql_Query("select * from $table where tablename = \"$lc_name\"");
    858. 

  858.     $c++;
    859. 

  859.   }
    860. 

  860.   return $lc_name;
    861. 

  861. }
    862. 

  862. 

  863. function isGuestAccount() {
    864. 

  864.   if (!is_array($_SESSION["userdata"])) {
    865. 

  865.     return 1;
    866. 

  866.   }
    867. 

  867.   if ($GLOBALS["config"]["guestaccount_attribute"]) {
    868. 

  868.     return $_SESSION['userdata'][$GLOBALS["config"]["guestaccount_attribute"]]['value'];
    869. 

  869.   }
    870. 

  870.   if ($GLOBALS["config"]["guestaccount_email_match"]) {
    871. 

  871.     return preg_match($GLOBALS["config"]["guestaccount_email_match"],$_SESSION["userdata"]["email"]["value"]);
    872. 

  872.   }
    873. 

  873. }
    874. 

  874. 

  875. function saveUserAttribute($userid,$attid,$data) {
    876. 

  876.   global $usertable_prefix, $table_prefix, $tables;
    877. 

  877.   # workaround for integration webbler/phplist
    878. 

  878.   if (!isset($usertable_prefix)) {
    879. 

  879.     $usertable_prefix = '';
    880. 

  880.   }
    881. 

  881.   if (!isset($table_prefix)) {
    882. 

  882.     $table_prefix = 'phplist_';
    883. 

  883.   }
    884. 

  884.   if (!empty($tables["attribute"])) {
    885. 

  885.     $att_table = $usertable_prefix .$tables["attribute"];
    886. 

  886.     $user_att_table = $usertable_prefix .$tables["user_attribute"];
    887. 

  887.   } else {
    888. 

  888.     $att_table = $usertable_prefix ."attribute";
    889. 

  889.     $user_att_table = $usertable_prefix . "user_attribute";
    890. 

  890.   }
    891. 

  891. 

  892.   if (!is_array($data)) {
    893. 

  893.     $tmp = $data;
    894. 

  894.     $data = Sql_Fetch_Assoc_Query(sprintf('select * from %s where id = %d',$att_table,$attid));
    895. 

  895.     $data['value'] = $tmp;
    896. 

  896.     $data['displayvalue'] = $tmp;
    897. 

  897.   }
    898. 

  898.  # dbg($data,'$data to store for '.$userid.' '.$attid);
    899. 

  899. 

  900.   if ($data["nodbsave"]) {
    901. 

  901.  #   dbg($attid, "Not saving, nodbsave");
    902. 

  902.     return;
    903. 

  903.   }
    904. 

  904.   if ($attid == "emailcheck" || $attid == "passwordcheck") {
    905. 

  905.  #   dbg($attid, "Not saving, emailcheck/passwordcheck");
    906. 

  906.     return;
    907. 

  907.   }
    908. 

  908. 

  909.   if (!$data["type"])
    910. 

  910.     $data["type"] = "textline";
    911. 

  911. 

  912.   if ($data["type"] == "static" || $data["type"] == "password" || $data['type'] == 'htmlpref') {
    913. 

  913.     Sql_Query(sprintf('update user set %s = "%s" where id = %d',
    914. 

  914.       $attid,$data["value"],$userid));
    915. 

  915.       dbg('Saving','',DBG_TRACE);
    916. 

  916.     if ($data["type"] == "password") {
    917. 

  917.       Sql_Query(sprintf('update user set passwordchanged = now(),password="%s" where id = %d',
    918. 

  918.       hash('sha256',$data['value']),$userid));
    919. 

  919.     }
    920. 

  920.     return 1;
    921. 

  921.   }
    922. 

  922. 

  923.   $attributetype = $data['type'];
    924. 

  924.   $attid_req = Sql_Fetch_Row_Query(sprintf('
    925. 

  925.     select id,type,tablename from %s where id = %d', $att_table, $attid));
    926. 

  926.   if (!$attid_req[0]) {
    927. 

  927.     $attid_req = Sql_Fetch_Row_Query(sprintf('
    928. 

  928.       select id,type,tablename from %s where name = "%s"', $att_table, $data["name"]));
    929. 

  929.     if (!$attid_req[0]) {
    930. 

  930.       if (!empty($data["name"]) && $GLOBALS["config"]["autocreate_attributes"]) {
    931. 

  931.   #      Dbg("Creating new Attribute: ".$data["name"]);
    932. 

  932.         sendError("creating new attribute ".$data["name"]);
    933. 

  933.         $atttable= getNewAttributeTablename($data["name"]);
    934. 

  934.         Sql_Query(sprintf('insert into %s (name,type,tablename) values("%s","%s","%s")', $att_table, $data["name"],$data["type"],$atttable));
    935. 

  935.         $attid = Sql_Insert_Id();
    936. 

  936.       } else {
    937. 

  937.    #     dbg("Not creating new Attribute: ".$data["name"]);
    938. 

  938.        # sendError("Not creating new attribute ".$data["name"]);
    939. 

  939.       }
    940. 

  940.     } else {
    941. 

  941.       $attid = $attid_req[0];
    942. 

  942.       if (empty($attributetype)) {
    943. 

  943.         $attributetype = $attid_req[1];
    944. 

  944.       }
    945. 

  945.       $atttable = $attid_req[2];
    946. 

  946.     }
    947. 

  947.   } else {
    948. 

  948.     $attid = $attid_req[0];
    949. 

  949.     if (empty($attributetype)) {
    950. 

  950.       $attributetype = $attid_req[1];
    951. 

  951.     }
    952. 

  952.     $atttable = $attid_req[2];
    953. 

  953.   }
    954. 

  954. 

  955.   if (!$atttable && !empty($data['name'])) {
    956. 

  956.     $atttable = getNewAttributeTablename($data["name"]);
    957. 

  957.     # fix attribute without tablename
    958. 

  958.     Sql_Query(sprintf('update %s set tablename ="%s" where id = %d',
    959. 

  959.       $att_table, $atttable,$attid));
    960. 

  960. #   sendError("Attribute without Tablename $attid");
    961. 

  961.   }
    962. 

  962. 

  963.   switch ($attributetype) {
    964. 

  964.     case "static":
    965. 

  965.     case "password":
    966. 

  966.   #  dbg('SAVING STATIC OR  PASSWORD');
    967. 

  967.       if (!empty($GLOBALS['config']['dontsave_userpassword']) && $data['type'] == 'password') {
    968. 

  968.         $data["value"] = 'not authoritative';
    969. 

  969.       }
    970. 

  970.       Sql_Query(sprintf('update user set %s = "%s" where id = %d',
    971. 

  971.         $attid,$data["value"],$userid));
    972. 

  972.       break;
    973. 

  973.     case "select":
    974. 

  974.       $curval = Sql_Fetch_Row_Query(sprintf('select id from '.$table_prefix . 'listattr_%s
    975. 

  975.         where name = "%s"',$atttable,$data["displayvalue"]),1);
    976. 

  976.       if (!$curval[0] && $data['displayvalue'] && $data['displayvalue'] != '') {
    977. 

  977.         Sql_Query(sprintf('insert into '.$table_prefix . 'listattr_%s (name) values("%s")',$atttable,
    978. 

  978.           $data["displayvalue"]));
    979. 

  979.         sendError("Added ".$data["displayvalue"]." to $atttable");
    980. 

  980.         $valid = Sql_Insert_id();
    981. 

  981.       } else {
    982. 

  982.         $valid = $curval[0];
    983. 

  983.       }
    984. 

  984.       Sql_Query(sprintf('replace into %s (userid,attributeid,value)
    985. 

  985.         values(%d,%d,"%s")', $user_att_table, $userid,$attid,$valid));
    986. 

    987. 

  987.       break;
    988. 

  988.     default:
    989. 

  989.       Sql_Query(sprintf('replace into %s (userid,attributeid,value)
    990. 

  990.         values(%d,%d,"%s")', $user_att_table, $userid,$attid,$data["value"]));
    991. 

  991.       break;
    992. 

  992.   }
    993. 

  993.   return 1;
    994. 

  994. }
    995. 

  995. 

  996. function saveUserByID($userid,$data) {
    997. 

  997.   while (list($key,$val) = each($data)) {
    998. 

  998.     if (preg_match("/^attribute(\d+)/",$key,$regs)) {
    999. 

  999.       $attid = $regs[1];
    1000. 

  1000.     } else {
    1001. 

  1001.       $attid = $key;
    1002. 

  1002.     }
    1003. 

  1003.     dbg("Saving attribute $key, $attid, $val for $userid");
    1004. 

  1004.     if ($userid && $attid && $data[$key]["type"] != "userfield" && !$data[$key]["nodbsave"])
    1005. 

  1005.       saveUserAttribute($userid,$attid,$val);
    1006. 

  1006.   }
    1007. 

  1007. }
    1008. 

  1008. 

  1009. function saveUser($loginname,$data) {
    1010. 

  1010.   # saves user to database
    1011. 

  1011.   $id_req = Sql_Fetch_Row_Query("select id from user where email = \"$loginname\"");
    1012. 

  1012.   if ($id_req[0]) {
    1013. 

  1013.     $userid = $id_req[0];
    1014. 

  1014.     while (list($key,$val) = each($data)) {
    1015. 

  1015.       if (ereg("^attribute(\d+)",$key,$regs)) {
    1016. 

  1016.         $attid = $regs[1];
    1017. 

  1017.       }
    1018. 

  1018.  #     dbg("Saving attribute $key, $attid, $val for $loginname, $userid");
    1019. 

  1019.       if ($userid && $attid)
    1020. 

  1020.         saveUserAttribute($userid,$key,$val);
    1021. 

  1021.     }
    1022. 

  1022.   }
    1023. 

  1023.   return 1;
    1024. 

  1024. }
    1025. 

  1025. 

  1026. function saveUserData($username,$fields) {
    1027. 

  1027.   # saves data in session, not in database
    1028. 

  1028.   if (!is_array($_SESSION["userdata"])) {
    1029. 

  1029.     initialiseUserSession();
    1030. 

  1030.   }
    1031. 

  1031.   if (!$username) {
    1032. 

  1032.     $username = 'Unknown User';
    1033. 

  1033.   }
    1034. 

  1034.   dbg("Saving user in session $username",'',DBG_TRACE);
    1035. 

  1035.   
    1036. 

  1036.   $res = "";
    1037. 

  1037.   $required_fields = explode(",",$_POST["required"]);
    1038. 

  1038.   if ($_POST["unrequire"]) {
    1039. 

  1039.     $unrequired_fields = explode(",",$_POST["unrequire"]);
    1040. 

  1040.     $required_fields = array_diff($required_fields,$unrequired_fields);
    1041. 

  1041.   } else {
    1042. 

  1042.     $unrequired_fields = array();
    1043. 

  1043.   }
    1044. 

  1044.   $required_formats = explode(",",$_POST["required_formats"]);
    1045. 

  1045.   $description_fields = explode(",",$_POST["required_description"]);
    1046. 

  1046. 

  1047.   reset($fields);
    1048. 

  1048. #  dbg("Checking fields");
    1049. 

  1049.   foreach ($fields as $fname => $fielddetails) {
    1050. 

  1050.     dbg('Saving user Saving '.$fname.' to session '.$_POST[$fname]);
    1051. 

  1051.  #   dbg($fielddetails);
    1052. 

  1052.     $key = $fname;
    1053. 

  1053.     $val = $_POST[$fname];
    1054. 

  1054.     if (!ereg("required",$key) && $key != "unrequire" &&
    1055. 

  1055.       $fields[$key]["type"] != "separator" &&
    1056. 

  1056.       $fields[$key]["type"] != "emailcheck" &&
    1057. 

  1057.       $fields[$key]["type"] != "passwordcheck"
    1058. 

  1058.       ) {
    1059. 

  1059.   #   dbg($fname ." of type ".$fields[$key]["type"]);
    1060. 

  1060.        if (!is_array($_SESSION["userdata"][$key]))
    1061. 

  1061.          $_SESSION["userdata"][$key] = array();
    1062. 

  1062.        $_SESSION["userdata"][$key]["name"] = $fields[$key]["name"];
    1063. 

  1063.        $_SESSION["userdata"][$key]["type"] = $fields[$key]["type"];
    1064. 

  1064.        if ($fields[$key]["type"] == "date") {
    1065. 

  1065.          $_SESSION["userdata"][$key]["value"] = sprintf('%04d-%02d-%02d',
    1066. 

  1066.           $_POST['year'][$key],$_POST['month'][$key],$_POST['day'][$key]);
    1067. 

  1067.          $_SESSION["userdata"][$key]["displayvalue"] = $_SESSION["userdata"][$key]["value"];
    1068. 

  1068.        } elseif ($fields[$key]["type"] == "creditcardno") {
    1069. 

  1069.          # dont overwrite known CC with ***
    1070. 

  1070.          if (!preg_match("#^\*+#",$val)) {
    1071. 

  1071.            $_SESSION["userdata"][$key]["value"] = ltrim($val);
    1072. 

  1072.          }
    1073. 

  1073.        } else {
    1074. 

  1074.          $_SESSION["userdata"][$key]["value"] = ltrim($val);
    1075. 

  1075.        }
    1076. 

  1076.        if ($fields[$key]["type"] == "select") {
    1077. 

  1077.          if (!empty($val) && is_array($fields[$key]["values"])) {
    1078. 

  1078.            $_SESSION["userdata"][$key]["displayvalue"] = $fields[$key]["values"][$val];
    1079. 

  1079.          }
    1080. 

  1080.        } elseif ($fields[$key]["type"] == "checkboxgroup") {
    1081. 

  1081.          if (is_array($val)) { // if val is empty join crashes
    1082. 

  1082.            $_SESSION["userdata"][$key]["value"] = join(",",$val);
    1083. 

  1083.          }
    1084. 

  1084.        } elseif ($fields[$key]["type"] == "creditcardno") {
    1085. 

  1085.           # erase any non digits from the CC numbers
    1086. 

  1086.           $_SESSION["userdata"][$key]["value"] = preg_replace("/\D/","",$_SESSION["userdata"][$key]["value"]);
    1087. 

  1087.           $_SESSION["userdata"][$key]["displayvalue"] = obscureCreditCard($_SESSION["userdata"][$key]["value"]);
    1088. 

  1088.        } elseif ($fields[$key]["name"] == "Card Number") {
    1089. 

  1089.           $_SESSION["userdata"][$key]["value"] = preg_replace("/\D/","",$_SESSION["userdata"][$key]["value"]);
    1090. 

  1090.           $_SESSION["userdata"][$key]["displayvalue"] = obscureCreditCard($_SESSION["userdata"][$key]["value"]);
    1091. 

  1091. /*          $_SESSION["userdata"][$key]["displayvalue"] = substr($_SESSION["userdata"][$key]["displayvalue"],0,4);
    1092. 

  1092.           for ($i=0;$i<strlen($_SESSION["userdata"][$key]["value"]-4);$i++) {
    1093. 

  1093.             $_SESSION["userdata"][$key]["displayvalue"] .= '*';
    1094. 

  1094.           }
    1095. 

  1095. */
    1096. 

  1096.        } else {
    1097. 

  1097.           $_SESSION["userdata"][$key]["displayvalue"] = $val;
    1098. 

  1098.        }
    1099. 

  1099. 

  1100.        foreach ($fielddetails as $field_attr => $field_attr_value) {
    1101. 

  1101.          if (!isset($_SESSION["userdata"][$key][$field_attr]) && !preg_match("/^\d+$/",$key)
    1102. 

  1102.          && !preg_match("/^\d+$/",$field_attr)
    1103. 

  1103.          ) {
    1104. 

  1104.            $_SESSION["userdata"][$key][$field_attr] = $field_attr_value;
    1105. 

  1105.          }
    1106. 

  1106.        }
    1107. 

  1107.        # save it to the DB as well
    1108. 

  1108.     } else {
    1109. 

  1109. #       dbg("Not checking ".$fname ." of type ".$fields[$key]["type"]);
    1110. 

  1110.     }
    1111. 

  1111.   }
    1112. 

  1112. 

  1113.   # fix UK postcodes to correct format
    1114. 

  1114.   if ($_SESSION["userdata"][$GLOBALS["config"]["country_attribute"]]["displayvalue"] == "United Kingdom" && isset($_SESSION["userdata"][$GLOBALS["config"]["postcode_attribute"]]["value"])) {
    1115. 

  1115.     $postcode = $_SESSION["userdata"][$GLOBALS["config"]["postcode_attribute"]]["value"];
    1116. 

  1116.     $postcode = strtoupper(str_replace(" ","",$postcode));
    1117. 

  1117.     if (preg_match("/(.*)(\d\w\w)$/",$postcode,$regs)) {
    1118. 

  1118.       $_SESSION["userdata"][$GLOBALS["config"]["postcode_attribute"]]["value"] = trim($regs[1])." ".$regs[2];
    1119. 

  1119.       $_SESSION["userdata"][$GLOBALS["config"]["postcode_attribute"]]["displayvalue"] = trim($regs[1])." ".$regs[2];
    1120. 

  1120.     }
    1121. 

  1121.   }
    1122. 

  1122. 

  1123.   dbg("Checking required fields");
    1124. 

  1124.   reset($required_fields);
    1125. 

  1125.   while (list($index,$field) = each ($required_fields)) {
    1126. 

  1126.     $type = $fields[$field]["type"];
    1127. 

  1127.   # dbg("$field of type $type");
    1128. 

  1128.     if ($type != 'userfield' && $type != '') ### @@@ need to check why type is not set
    1129. 

  1129.     if ($field && !$_SESSION["userdata"][$field]["value"]) {
    1130. 

  1130.       $res = "Information missing: ".$description_fields[$index];
    1131. 

  1131.       break;
    1132. 

  1132.     } else if ($required_formats[$index] && !preg_match(stripslashes($required_formats[$index]),$_SESSION["userdata"][$field]["value"])) {
    1133. 

  1133.       $res = "Sorry, you entered an invalid ".$description_fields[$index].": ".$_SESSION["userdata"][$field]["value"];
    1134. 

  1134.       break;
    1135. 

  1135.     } else if ($field == "email" && !validateEmail($_SESSION["userdata"][$field]["value"])) {
    1136. 

  1136.       $res = "Sorry, the following field cannot be validated: ".$description_fields[$index].": ".$_SESSION["userdata"][$field]["value"];
    1137. 

  1137.       break;
    1138. 

  1138.     } elseif ($field == "emailcheck" && $_SESSION["userdata"]["email"]["value"] != $_SESSION["userdata"]["emailcheck"]["value"]) {
    1139. 

  1139.       $res = "Emails entered are not the same";
    1140. 

  1140.       break;
    1141. 

  1141.     } else if ($field == "cardtype" && $_SESSION["userdata"][$field]["value"] == "WSWITCH" && !preg_match("/\d/",$_SESSION["userdata"]["attribute82"]["value"])) {
    1142. 

  1142.       $res = "Sorry, a Switch Card requires a valid issue number. If you have a new Switch card without an issue number, please use 0 as the issue number.";
    1143. 

  1143.       break;
    1144. 

  1144.     } else if ($field == "cardtype" && isset($_SESSION["userdata"][$field]["value"]) && $_SESSION["userdata"][$field]["value"] != "WSWITCH" && $_SESSION["userdata"]["attribute82"]["value"]) {
    1145. 

  1145.       $res = "Sorry, an issue number is not valid when not using a Switch Card";
    1146. 

  1146.       break;
    1147. 

  1147.     } else if (($type == "creditcardno" || $field == "cardnumber") && isset($_SESSION["userdata"][$field]["value"]) &&  !checkCCrange($_SESSION["userdata"][$field]["value"])) {
    1148. 

  1148.       list($cid,$cname) = ccCompany($_SESSION["userdata"][$field]["value"]);
    1149. 

  1149.       if (!$cname)
    1150. 

  1150.         $cname = '(Unknown Credit card)';
    1151. 

  1151.       $res = "Sorry, we currently don't accept $cname cards";
    1152. 

  1152.       break;
    1153. 

  1153.     } else if (($type == "creditcardno" || $field == "cardnumber") && isset($_SESSION["userdata"][$field]["value"]) && !validateCC($_SESSION["userdata"][$field]["value"])) {
    1154. 

  1154.       $res = "Sorry, you entered an invalid ".$description_fields[$index];#.": ".$_SESSION["userdata"][$field]["value"];
    1155. 

  1155.       break;
    1156. 

  1156.     } else if (($type == "creditcardexpiry" ||$field == "cardexpiry") &&  isset($_SESSION["userdata"][$field]["value"]) && !validateCCExpiry($_SESSION["userdata"][$field]["value"])) {
    1157. 

  1157.       $res = "Sorry, you entered an invalid ".$description_fields[$index].": ".$_SESSION["userdata"][$field]["value"];
    1158. 

  1158.       break;
    1159. 

  1159.     }
    1160. 

  1160.   }
    1161. 

  1161.   if (0 && isset($_SESSION["userdata"][$GLOBALS["config"]["country_attribute"]]["displayvalue"]) && $_SESSION["userdata"][$GLOBALS["config"]["country_attribute"]]["displayvalue"] == "United Kingdom" && isset($_SESSION["userdata"][$GLOBALS["config"]["postcode_attribute"]]["value"])) {
    1162. 

  1162.     $postcode = $_SESSION["userdata"][$GLOBALS["config"]["postcode_attribute"]]["displayvalue"];
    1163. 

  1163.     if (!preg_match("/(.*)(\d\w\w)$/",$postcode,$regs)) {
    1164. 

  1164.       $res = "That does not seem to be a valid UK postcode";
    1165. 

  1165.     } elseif (!preg_match("/^[\s\w\d]+$/",$postcode,$regs)) {
    1166. 

  1166.       $res = "That does not seem to be a valid UK postcode";
    1167. 

  1167.     }
    1168. 

  1168.   }
    1169. 

  1169. /*  if (is_array($GLOBALS["config"]["bocs_dpa"])) {
    1170. 

  1170.     if (!is_array($_SESSION["DPA"]))
    1171. 

  1171.       $_SESSION["DPA"] = array();
    1172. 

  1172.     foreach ($GLOBALS["config"]["bocs_dpa"] as $dpaatt => $val) {
    1173. 

  1173.       if ($_SESSION["userdata"][$dpaatt]["displayvalue"]) {
    1174. 

  1174.         $_SESSION["DPA"][$val] = "Y";
    1175. 

  1175.       } else {
    1176. 

  1176.         $_SESSION["DPA"][$val] = "N";
    1177. 

  1177.       }
    1178. 

  1178.     }
    1179. 

  1179.   }*/
    1180. 

  1180.   # if no error in form check for subscriptions
    1181. 

  1181.   if (!$res && is_object($GLOBALS["config"]["plugins"]["phplist"])) {
    1182. 

  1182.     $phplist = $GLOBALS["config"]["plugins"]["phplist"];
    1183. 

  1183.     foreach ($_SESSION["userdata"] as $key => $field) {
    1184. 

  1184.       if (($field["formtype"] == "List Subscription" || $field["type"] == "List Subscription") && $field["listid"]) {
    1185. 

  1185.          $listid = $field["listid"];
    1186. 

  1186.          if ($field["value"] && isset($_SESSION["userdata"]["email"])) {
    1187. 

  1187.            if ($phplist->addEmailToList($_SESSION["userdata"]["email"]["value"],$listid)) {
    1188. 

  1188.              $phplist->confirmEmail($_SESSION["userdata"]["email"]["value"]);
    1189. 

  1189.              #  sendError("User added to list: $listid");
    1190. 

  1190.            } else {
    1191. 

  1191.              # sendError("Error adding user to list: $listid");
    1192. 

  1192.            }
    1193. 

  1193.          } #else {
    1194. 

  1194.            #$phplist->removeEmailFromList($_SESSION["userdata"]["email"]["value"],$listid);
    1195. 

  1195.          #}
    1196. 

  1196.        }
    1197. 

  1197.     }
    1198. 

  1198.   }
    1199. 

  1199. 

  1200.   return $res;
    1201. 

  1201. }
    1202. 

  1202. 

  1203. ?>
    1204. 

  1204.