PageRenderTime 26ms CodeModel.GetById 20ms RepoModel.GetById 0ms app.codeStats 0ms

/marsl/out/modules/userdata.php

https://bitbucket.org/marsl/marsl
PHP | 397 lines | 337 code | 36 blank | 24 comment | 63 complexity | 463efcc9bb6bc2b76f03db4fa19a680c MD5 | raw file
    

  1. <?php
    2. 

  2. include_once(dirname(__FILE__)."/../includes/errorHandler.php");
    3. 

  3. include_once(dirname(__FILE__)."/../user/user.php");
    4. 

  4. include_once(dirname(__FILE__)."/../user/role.php");
    5. 

  5. include_once(dirname(__FILE__)."/../user/auth.php");
    6. 

  6. include_once(dirname(__FILE__)."/../includes/dbsocket.php");
    7. 

  7. include_once(dirname(__FILE__)."/../includes/basic.php");
    8. 

  8. include_once(dirname(__FILE__)."/../includes/mailer.php");
    9. 

  9. include_once(dirname(__FILE__)."/module.php");
    10. 

  10. 

  11. class UserData implements Module {
    12. 

  12. 	
    13. 

  13. 	/*
    14. 

  14. 	 * Displays the user administration.
    15. 

  15. 	 */
    16. 

  16. 	public function admin() {
    17. 

  17. 		$user = new User();
    18. 

  18. 		$db = new DB();
    19. 

  19. 		$auth = new Authentication();
    20. 

  20. 		$role = new Role();
    21. 

  21. 		$mailer = new Mailer();
    22. 

  22. 		$basic = new Basic();
    23. 

  23. 		if ($auth->moduleAdminAllowed("userdata", $role->getRole())||$auth->moduleExtendedAllowed("userdata", $role->getRole())) {
    24. 

  24. 			if ($auth->moduleAdminAllowed("userdata", $role->getRole())) {
    25. 

  25. 				require_once("template/userdata.alphabet.tpl.php");
    26. 

  26. 			}
    27. 

  27. 			if (isset($_GET['action'])) {
    28. 

  28. 				if (($_GET['action']=="list")&&$auth->moduleAdminAllowed("userdata", $role->getRole())) {
    29. 

  29. 					$userdata = array();
    30. 

  30. 					$search = mysql_real_escape_string($_GET['search']);
    31. 

  31. 					$ownRole = $role->getRole();
    32. 

  32. 					$possibleRoles = $role->getPossibleRoles($ownRole);
    33. 

  33. 					$result = $db->query("SELECT `user`, `user`.`role` AS `roleid`, `nickname`, `prename`, `acronym`, `regdate`, `email`, `postcount`, `user`.`name` AS `username`, `role`.`name` AS `rolename` FROM `user` JOIN `role` USING(`role`) LEFT OUTER JOIN `email` USING(`user`) WHERE `nickname` LIKE '$search%' ORDER BY `nickname`");
    34. 

  34. 					while ($row = mysql_fetch_array($result)) {
    35. 

  35. 						$userid = htmlentities($row['user'], null, "ISO-8859-1");
    36. 

  36. 						$nickname = htmlentities($row['nickname'], null, "ISO-8859-1");
    37. 

  37. 						$prename = htmlentities($row['prename'], null, "ISO-8859-1");
    38. 

  38. 						$acronym = htmlentities($row['acronym'], null, "ISO-8859-1");
    39. 

  39. 						$regdate = date("d\. M Y\; H\:i\:s", $row['regdate']);
    40. 

  40. 						$email = htmlentities($row['email'], null, "ISO-8859-1");
    41. 

  41. 						$postcount = htmlentities($row['postcount'], null, "ISO-8859-1");
    42. 

  42. 						$name = htmlentities($row['username'], null, "ISO-8859-1");
    43. 

  43. 						$rolename = htmlentities($row['rolename'], null, "ISO-8859-1");
    44. 

  44. 						$roleid = htmlentities($row['roleid'], null, "ISO-8859-1");
    45. 

  45. 						$isMaster = $role->isMaster($ownRole, $roleid, $possibleRoles);
    46. 

  46. 						if ($user->getID()==$userid) {
    47. 

  47. 							$isMaster = true;
    48. 

  48. 						}
    49. 

  49. 						array_push($userdata, array('user'=>$userid, 'nickname'=>$nickname, 'prename'=>$prename, 'acronym'=>$acronym, 'regdate'=>$regdate, 'email'=>$email, 'postcount'=>$postcount, 'name'=>$name, 'rolename'=>$rolename, 'isMaster'=>$isMaster));
    50. 

  50. 					}
    51. 

  51. 					require_once("template/userdata.list.tpl.php");
    52. 

  52. 				}
    53. 

  53. 				if ($_GET['action']=="details") {
    54. 

  54. 					if ($auth->moduleAdminAllowed("userdata", $role->getRole())||($auth->moduleExtendedAllowed("userdata", $role->getRole())&&($_GET['user']==$user->getID()))) {
    55. 

  55. 						$userID = mysql_real_escape_string($_GET['user']);
    56. 

  56. 						$ownID = $user->getID();
    57. 

  57. 						$ownRole = $role->getRole();
    58. 

  58. 						$possibleRoles = $role->getPossibleRoles($ownRole);
    59. 

  59. 						
    60. 

  60. 						if (isset($_POST['entermail'])) {
    61. 

  61. 							if ($auth->checkToken($_POST['authTime'], $_POST['authToken'])) {
    62. 

  62. 								$email = mysql_real_escape_string($_POST['email']);
    63. 

  63. 								if ($basic->checkMail($email)) {
    64. 

  64. 									$curTime = time();
    65. 

  65. 									$confirmID = $basic->confirmID();
    66. 

  66. 									$db->query("INSERT INTO `email`(`email`,`user`, `confirmed`, `time`, `confirm_id`) VALUES('$email', '$userID', '1', '$curTime', '$confirmID')");
    67. 

  67. 								}
    68. 

  68. 							}
    69. 

  69. 						}
    70. 

  70. 						
    71. 

  71. 						if (isset($_GET['delmail'])) {
    72. 

  72. 							if ($auth->checkToken($_GET['time'], $_GET['token'])) {
    73. 

  73. 								$email = mysql_real_escape_string(urldecode($_GET['delmail']));
    74. 

  74. 								$db->query("DELETE FROM `email` WHERE `user`='$userID' AND `primary`='0' AND `email`='$email'");
    75. 

  75. 							}
    76. 

  76. 						}
    77. 

  77. 						if (isset($_GET['primemail'])) {
    78. 

  78. 							if ($auth->checkToken($_GET['time'], $_GET['token'])) {
    79. 

  79. 								$email = mysql_real_escape_string(urldecode($_GET['primemail']));
    80. 

  80. 								if (!$db->isExisting("SELECT `email` FROM `email` WHERE `email`='$email' AND `user`='$userID' AND `confirmed`='0'")) {
    81. 

  81. 									$db->query("UPDATE `email` SET `primary`='0' WHERE `user`='$userID'");
    82. 

  82. 									$db->query("UPDATE `email` SET `primary`='1' WHERE `user`='$userID' AND `email`='$email'");
    83. 

  83. 								}
    84. 

  84. 							}
    85. 

  85. 						}
    86. 

  86. 						if (isset($_GET['confmail'])) {
    87. 

  87. 							if ($auth->checkToken($_GET['time'], $_GET['token'])) {
    88. 

  88. 								$email = mysql_real_escape_string(urldecode($_GET['confmail']));
    89. 

  89. 								$mailer->sendConfirmationMail($userID, $email);
    90. 

  90. 							}
    91. 

  91. 						}
    92. 

  92. 							
    93. 

  93. 						$result = $db->query("SELECT `user`, `regdate`, `role`, `nickname`, `prename`, `acronym`, `name` FROM `user` WHERE `user`='$userID'");
    94. 

  94. 						while ($row = mysql_fetch_array($result)) {
    95. 

  95. 							$userRole = htmlentities($row['role'], null, "ISO-8859-1");
    96. 

  96. 							$isMaster = $role->isMaster($ownRole, $userRole, $possibleRoles);
    97. 

  97. 							if ($isMaster||($user->getID()==$userID)) {
    98. 

  98. 								$userID = htmlentities($row['user'], null, "ISO-8859-1");
    99. 

  99. 								$nickname = htmlentities($row['nickname'], null, "ISO-8859-1");
    100. 

  100. 								$prename = htmlentities($row['prename'], null, "ISO-8859-1");
    101. 

  101. 								$acronym = htmlentities($row['acronym'], null, "ISO-8859-1");
    102. 

  102. 								$emails = array();
    103. 

  103. 								$result2 = $db->query("SELECT * FROM `email` WHERE `user`='$userID' ORDER BY `confirmed` DESC, `primary` DESC");
    104. 

  104. 								while ($row2 = mysql_fetch_array($result2)) {
    105. 

  105. 									$email = htmlentities($row2['email'], null, "ISO-8859-1");
    106. 

  106. 									$confirmed = $row2['confirmed'];
    107. 

  107. 									$primary = $row2['primary'];
    108. 

  108. 									array_push($emails, array('email'=>$email, 'confirmed'=>$confirmed, 'primary'=>$primary));
    109. 

  109. 								}
    110. 

  110. 								$name = htmlentities($row['name'], null, "ISO-8859-1");
    111. 

  111. 								$regdate = $row['regdate'];
    112. 

  112. 								$updateNickname = true;
    113. 

  113. 								$updateAcronym = true;
    114. 

  114. 								$samePasswords = true;
    115. 

  115. 								$rightPassword = true;
    116. 

  116. 								$safePassword = true;
    117. 

  117. 								if (isset($_POST['change'])||isset($_POST['passwordChange'])) {
    118. 

  118. 									if ($auth->checkToken($_POST['authTime'], $_POST['authToken'])) {
    119. 

  119. 										if (isset($_POST['change'])) {
    120. 

  120. 											$updateNickname = $user->updateNickname($userID, $_POST['nickname']);
    121. 

  121. 											if ($updateNickname) {
    122. 

  122. 												$nickname = htmlentities($_POST['nickname'], null, "ISO-8859-1");
    123. 

  123. 											}
    124. 

  124. 											$user->updatePrename($userID, $_POST['prename']);
    125. 

  125. 											$prename = htmlentities($_POST['prename'], null, "ISO-8859-1");
    126. 

  126. 											$user->updateName($userID, $_POST['name']);
    127. 

  127. 											$name = htmlentities($_POST['name'], null, "ISO-8859-1");
    128. 

  128. 

  129. 											if ($isMaster) {
    130. 

  130. 												$updateAcronym = $user->updateAcronym($userID, $_POST['acronym']);
    131. 

  131. 												if ($updateAcronym) {
    132. 

  132. 													$acronym = htmlentities($_POST['acronym'], null, "ISO-8859-1");
    133. 

  133. 												}
    134. 

  134. 												$user->updateRole($userID, $_POST['role']);
    135. 

  135. 												$userRole = htmlentities($_POST['role'], null, "ISO-8859-1");
    136. 

  136. 											}
    137. 

  137. 										}
    138. 

  138. 										if (isset($_POST['passwordChange'])) {
    139. 

  139. 											if ($userID==$user->getID()) {
    140. 

  140. 												$hash = $user->hashPassword($regdate, $_POST['oldPassword']);
    141. 

  141. 												$proofPass = $user->getPassbyID($user->getID());
    142. 

  142. 												if ($hash == $proofPass) {
    143. 

  143. 													if ($_POST['newPassword']==$_POST['proofPassword']) {
    144. 

  144. 														$safePassword = $user->setPassword($user->getID(), $_POST['newPassword']);
    145. 

  145. 													}
    146. 

  146. 													else {
    147. 

  147. 														$samePasswords = false;
    148. 

  148. 													}
    149. 

  149. 												}
    150. 

  150. 												else {
    151. 

  151. 													$rightPassword = false;
    152. 

  152. 												}
    153. 

  153. 											}
    154. 

  154. 										}
    155. 

  155. 									}
    156. 

  156. 								}
    157. 

  157. 								$roles = array();
    158. 

  158. 								foreach ($possibleRoles as $possibleRole) {
    159. 

  159. 									if ($possibleRole!=$ownRole) {
    160. 

  160. 										array_push($roles, array('role'=>$possibleRole, 'name'=>$role->getNamebyID($possibleRole)));
    161. 

  161. 									}
    162. 

  162. 								}
    163. 

  163. 								$authTime = time();
    164. 

  164. 								$authToken = $auth->getToken($authTime);
    165. 

  165. 								require_once("template/userdata.edit.tpl.php");
    166. 

  166. 							}
    167. 

  167. 						}
    168. 

  168. 					}
    169. 

  169. 				}
    170. 

  170. 			}
    171. 

  171. 		}
    172. 

  172. 	}
    173. 

  173. 	
    174. 

  174. 	public function display() {
    175. 

  175. 		$db = new DB();
    176. 

  176. 		$user = new User();
    177. 

  177. 		$userID = $user->getID();
    178. 

  178. 		$basic = new Basic();
    179. 

  179. 		
    180. 

  180. 		$location = "";
    181. 

  181. 		if (isset($_GET['id'])) {
    182. 

  182. 			$location = $_GET['id'];
    183. 

  183. 		}
    184. 

  184. 		else {
    185. 

  185. 			$location = $basic->getHomeLocation();
    186. 

  186. 		}
    187. 

  187. 		
    188. 

  188. 		$auth = new Authentication();
    189. 

  189. 		$role = new Role();
    190. 

  190. 		$samePasswords = true;
    191. 

  191. 		$rightPassword = true;
    192. 

  192. 		$passwordChange = false;
    193. 

  193. 		
    194. 

  194. 		if ($auth->locationReadAllowed($location, $role->getRole())&&$auth->moduleReadAllowed("userdata", $role->getRole())&&$auth->moduleWriteAllowed("userdata", $role->getRole())) {
    195. 

  195. 			
    196. 

  196. 			$mailer = new Mailer();
    197. 

  197. 			if (isset($_POST['entermail'])) {
    198. 

  198. 				if ($auth->checkToken($_POST['authTime'], $_POST['authToken'])) {
    199. 

  199. 					$email = mysql_real_escape_string($_POST['email']);
    200. 

  200. 					if ($basic->checkMail($email)) {
    201. 

  201. 						$curTime = time();
    202. 

  202. 						$confirmID = $basic->confirmID();
    203. 

  203. 						$db->query("INSERT INTO `email`(`email`,`user`, `confirmed`, `time`, `confirm_id`) VALUES('$email', '$userID', '0', '$curTime', '$confirmID')");
    204. 

  204. 						$mailer->sendConfirmationMail($userID, $email);
    205. 

  205. 					}
    206. 

  206. 				}
    207. 

  207. 			}
    208. 

  208. 			
    209. 

  209. 			if (isset($_GET['delmail'])) {
    210. 

  210. 				if ($auth->checkToken($_GET['time'], $_GET['token'])) {
    211. 

  211. 					$email = mysql_real_escape_string(urldecode($_GET['delmail']));
    212. 

  212. 					$db->query("DELETE FROM `email` WHERE `user`='$userID' AND `primary`='0' AND `email`='$email'");
    213. 

  213. 				}
    214. 

  214. 			}
    215. 

  215. 			if (isset($_GET['primemail'])) {
    216. 

  216. 				if ($auth->checkToken($_GET['time'], $_GET['token'])) {
    217. 

  217. 					$email = mysql_real_escape_string(urldecode($_GET['primemail']));
    218. 

  218. 					if (!$db->isExisting("SELECT `email` FROM `email` WHERE `email`='$email' AND `user`='$userID' AND `confirmed`='0'")) {
    219. 

  219. 						$db->query("UPDATE `email` SET `primary`='0' WHERE `user`='$userID'");
    220. 

  220. 						$db->query("UPDATE `email` SET `primary`='1' WHERE `user`='$userID' AND `email`='$email'");
    221. 

  221. 					}
    222. 

  222. 				}
    223. 

  223. 			}
    224. 

  224. 			if (isset($_GET['confmail'])) {
    225. 

  225. 				if ($auth->checkToken($_GET['time'], $_GET['token'])) {
    226. 

  226. 					$email = mysql_real_escape_string(urldecode($_GET['confmail']));
    227. 

  227. 					$mailer->sendConfirmationMail($userID, $email);
    228. 

  228. 				}
    229. 

  229. 			}
    230. 

  230. 			
    231. 

  231. 			
    232. 

  232. 			if (isset($_POST['action'])) {
    233. 

  233. 				if (($userID == $_POST['userID'])&&($auth->checkToken($_POST['authTime'], $_POST['authToken']))) {
    234. 

  234. 					
    235. 

  235. 					if ($_POST['action']=="password") {
    236. 

  236. 						$passwordChange = true;
    237. 

  237. 						$regdate = $user->getRegisterDate($userID);
    238. 

  238. 						$hash = $user->hashPassword($regdate, $_POST['oldPassword']);
    239. 

  239. 						$proofPass = $user->getPassbyID($user->getID());
    240. 

  240. 						if ($hash == $proofPass) {
    241. 

  241. 							if ($_POST['newPassword']==$_POST['proofPassword']) {
    242. 

  242. 								$safePassword = $user->setPassword($user->getID(), $_POST['newPassword']);
    243. 

  243. 							}
    244. 

  244. 							else {
    245. 

  245. 								$samePasswords = false;
    246. 

  246. 							}
    247. 

  247. 						}
    248. 

  248. 						else {
    249. 

  249. 							$rightPassword = false;
    250. 

  250. 						}
    251. 

  251. 					}
    252. 

  252. 					
    253. 

  253. 					if ($_POST['action']=="edit") {
    254. 

  254. 						$prename = mysql_real_escape_string($_POST['prename']);
    255. 

  255. 						$name = mysql_real_escape_string($_POST['name']);
    256. 

  256. 						$info = mysql_real_escape_string($basic->cleanStrict($_POST['info']));
    257. 

  257. 						$signature = mysql_real_escape_string($basic->cleanStrict($_POST['signature']));
    258. 

  258. 						$birthdate = 0;
    259. 

  259. 						if (checkdate($_POST['month'], $_POST['day'], $_POST['year'])) {
    260. 

  260. 							$birthdate = mktime(0,0,0,$_POST['month'],$_POST['day'],$_POST['year']);
    261. 

  261. 						}
    262. 

  262. 						$gender = "";
    263. 

  263. 						if ($_POST['gender']=="female") {
    264. 

  264. 							$gender = "female";
    265. 

  265. 						}
    266. 

  266. 						if ($_POST['gender']=="male") {
    267. 

  267. 							$gender = "male";
    268. 

  268. 						}
    269. 

  269. 						$interests = mysql_real_escape_string($_POST['interests']);
    270. 

  270. 						$job = mysql_real_escape_string($_POST['job']);
    271. 

  271. 						$zip = mysql_real_escape_string($_POST['zip']);
    272. 

  272. 						$street = mysql_real_escape_string($_POST['street']);
    273. 

  273. 						$house = mysql_real_escape_string($_POST['house']);
    274. 

  274. 						$city = mysql_real_escape_string($_POST['city']);
    275. 

  275. 						$db->query("UPDATE `user` SET `prename`='$prename', `name`='$name', `info`='$info', `signature`='$signature', `birthdate`='$birthdate', `gender`='$gender', `interests`='$interests', `job`='$job', `zip`='$zip', `street`='$street', `house`='$house', `city`='$city' WHERE `user`='$userID'");
    276. 

  276. 					}
    277. 

  277. 				}
    278. 

  278. 			}
    279. 

  279. 			
    280. 

  280. 			$authTime = time();
    281. 

  281. 			$authToken = $auth->getToken($authTime);
    282. 

  282. 			$nickname = "";
    283. 

  283. 			$prename = "";
    284. 

  284. 			$name = "";
    285. 

  285. 			$info = "";
    286. 

  286. 			$signature = "";
    287. 

  287. 			$day = "DD";
    288. 

  288. 			$month = "MM";
    289. 

  289. 			$year = "YYYY";
    290. 

  290. 			$gender = "";
    291. 

  291. 			$interests = "";
    292. 

  292. 			$job = "";
    293. 

  293. 			$zip = "";
    294. 

  294. 			$street = "";
    295. 

  295. 			$house = "";
    296. 

  296. 			$city = "";
    297. 

  297. 			
    298. 

  298. 			$result = $db->query("SELECT * FROM `user` WHERE `user`='$userID'");
    299. 

  299. 			while ($row = mysql_fetch_array($result)) {
    300. 

  300. 				
    301. 

  301. 				$userID = $row['user'];
    302. 

  302. 				$prename = htmlentities($row['prename'], null, "ISO-8859-1");
    303. 

  303. 				$name = htmlentities($row['name'], null, "ISO-8859-1");
    304. 

  304. 				$info = $row['info'];
    305. 

  305. 				$signature = $row['signature'];
    306. 

  306. 				$day = date("d", $row['birthdate']);
    307. 

  307. 				$month = date("m", $row['birthdate']);
    308. 

  308. 				$year = date("Y", $row['birthdate']);
    309. 

  309. 				$gender = $row['gender'];
    310. 

  310. 				$interests = htmlentities($row['interests'], null, "ISO-8859-1");
    311. 

  311. 				$job = htmlentities($row['job'], null, "ISO-8859-1");
    312. 

  312. 				$zip = htmlentities($row['zip'], null, "ISO-8859-1");
    313. 

  313. 				$street = htmlentities($row['street'], null, "ISO-8859-1");
    314. 

  314. 				$house = htmlentities($row['house'], null, "ISO-8859-1");
    315. 

  315. 				$city = htmlentities($row['city'], null, "ISO-8859-1");
    316. 

  316. 			
    317. 

  317. 			}
    318. 

  318. 			
    319. 

  319. 			$emails = array();
    320. 

  320. 			
    321. 

  321. 			$result = $db->query("SELECT * FROM `email` WHERE `user` = '$userID' ORDER BY `confirmed` DESC, `primary` DESC");
    322. 

  322. 			while ($row = mysql_fetch_array($result)) {
    323. 

  323. 				
    324. 

  324. 				$email = htmlentities($row['email'], null, "ISO-8859-1");
    325. 

  325. 				$confirmed = $row['confirmed'];
    326. 

  326. 				$primary = $row['primary'];
    327. 

  327. 				array_push($emails, array('email'=>$email, 'confirmed'=>$confirmed, 'primary'=>$primary));
    328. 

  328. 			}
    329. 

  329. 			
    330. 

  330. 			require_once("template/userdata.tpl.php");
    331. 

  331. 		}
    332. 

  332. 		
    333. 

  333. 	}
    334. 

  334. 	
    335. 

  335. 	/*
    336. 

  336. 	 * Interface method stub.
    337. 

  337. 	*/
    338. 

  338. 	public function isSearchable() {
    339. 

  339. 		return false;
    340. 

  340. 	}
    341. 

  341. 	
    342. 

  342. 	/*
    343. 

  343. 	 * Interface method stub.
    344. 

  344. 	*/
    345. 

  345. 	public function getSearchList() {
    346. 

  346. 		return array();
    347. 

  347. 	}
    348. 

  348. 	
    349. 

  349. 	/*
    350. 

  350. 	 * Interface method stub.
    351. 

  351. 	*/
    352. 

  352. 	public function search($query, $type) {
    353. 

  353. 		return null;
    354. 

  354. 	}
    355. 

  355. 	
    356. 

  356. 	/*
    357. 

  357. 	 * Interface method stub.
    358. 

  358. 	*/
    359. 

  359. 	public function isTaggable() {
    360. 

  360. 		return false;
    361. 

  361. 	}
    362. 

  362. 	
    363. 

  363. 	/*
    364. 

  364. 	 * Interface method stub.
    365. 

  365. 	*/
    366. 

  366. 	public function getTagList() {
    367. 

  367. 		return null;
    368. 

  368. 	}
    369. 

  369. 	
    370. 

  370. 	/*
    371. 

  371. 	 * Interface method stub.
    372. 

  372. 	*/
    373. 

  373. 	public function addTags($tagString, $type, $news) {
    374. 

  374. 	}
    375. 

  375. 	
    376. 

  376. 	/*
    377. 

  377. 	 * Interface method stub.
    378. 

  378. 	*/
    379. 

  379. 	public function getTagString($type, $news) {
    380. 

  380. 	}
    381. 

  381. 	
    382. 

  382. 	public function getTags($type, $news) {
    383. 

  383. 		return null;
    384. 

  384. 	}
    385. 

  385. 	
    386. 

  386. 	public function displayTag($tagID, $type) {
    387. 

  387. 	}
    388. 

  388. 	
    389. 

  389. 	public function getImage() {
    390. 

  390. 		return null;
    391. 

  391. 	}
    392. 

  392. 	
    393. 

  393. 	public function getTitle() {
    394. 

  394. 		return null;
    395. 

  395. 	}
    396. 

  396. }
    397. 

  397. ?>
    398.