<?php
/**
* MyBB 1.2
* Copyright © 2006 MyBB Group, All Rights Reserved
*
* Website: http://www.mybboard.com
* License: http://www.mybboard.com/eula.html
*
* $Id: user.php 2663 2007-01-21 18:30:14Z Tikitiki $
*/
/**
* User handling class, provides common structure to handle user data.
*
*/
class UserDataHandler extends DataHandler
{
/**
* The language file used in the data handler.
*
* @var string
*/
var $language_file = 'datahandler_user';
/**
* The prefix for the language variables used in the data handler.
*
* @var string
*/
var $language_prefix = 'userdata';
/**
* Array of data inserted in to a user.
*
* @var array
*/
var $user_insert_data = array();
/**
* Array of data used to update a user.
*
* @var array
*/
var $user_update_data = array();
/**
* User ID currently being manipulated by the datahandlers.
*
* @var int
*/
var $uid = 0;
/**
* Verifies if a username is valid or invalid.
*
* @param boolean True when valid, false when invalid.
*/
function verify_username()
{
global $mybb;
$username = &$this->data['username'];
require_once MYBB_ROOT.'inc/functions_user.php';
// Fix bad characters
//$username = str_replace(array(chr(160), chr(173)), array(" ", "-"), $username);
// Remove multiple spaces from the username
$username = preg_replace("#\s{2,}#", " ", $username);
// Check if the username is not empty.
if(trim($username) == '')
{
$this->set_error('missing_username');
return false;
}
// Check if the username belongs to the list of banned usernames.
if(is_banned_username($username))
{
$this->set_error('banned_username');
return false;
}
// Check for certain characters in username (<, >, &, and slashes)
if(eregi("<", $username) || eregi(">", $username)|| eregi("?", $username)||eregi("-", $username)|| eregi("&", $username) || strpos($username, "\\") !== false || eregi(";", $username))
{
$this->set_error("bad_characters_username");
return false;
}
// Check if the username is of the correct length.
if(($mybb->settings['maxnamelength'] != 0 && my_strlen($username) > $mybb->settings['maxnamelength']) || ($mybb->settings['minnamelength'] != 0 && my_strlen($username) < $mybb->settings['minnamelength']) && !$bannedusername && !$missingname)
{
$this->set_error('invalid_username_length', array($mybb->settings['minnamelength'], $mybb->settings['maxnamelength']));
return false;
}
return true;
}
/**
* Verifies if a username is already in use or not.
*
* @return boolean False when the username is not in use, true when it is.
*/
function verify_username_exists()
{
global $db;
$username = &$this->data['username'];
$query = $db->simple_select(TABLE_PREFIX."users", "COUNT(uid) AS count", "LOWER(username)='".$db->escape_string(strtolower($username))."'");
$user_count = $db->fetch_field($query, "count");
if($user_count > 0)
{
$this->set_error("username_exists", array($username));
return true;
}
else
{
return false;
}
}
/**
* Verifies if a new password is valid or not.
*
* @return boolean True when valid, false when invalid.
*/
function verify_password()
{
global $mybb;
$user = &$this->data;
// Always check for the length of the password.
if(my_strlen($user['password']) < $mybb->settings['minpasswordlength'])
{
$this->set_error('invalid_password_length', array($mybb->settings['minpasswordlength'], $mybb->settings['maxpasswordlength']));
return false;
}
// See if the board has "require complex passwords" enabled.
if($mybb->settings['requirecomplexpasswords'] == "yes")
{
// Complex passwords required, do some extra checks.
// First, see if there is one or more complex character(s) in the password.
if(!preg_match('#[\W]+#', $user['password']))
{
$this->set_error('no_complex_characters');
return false;
}
}
// If we have a "password2" check if they both match
if(isset($user['password2']) && $user['password'] != $user['password2'])
{
$this->set_error("passwords_dont_match");
return false;
}
// MD5 the password
$user['md5password'] = md5($user['password']);
// Generate our salt
if(!$user['salt'])
{
$user['salt'] = generate_salt();
}
// Combine the password and salt
$user['saltedpw'] = salt_password($user['md5password'], $user['salt']);
// Generate the user login key
$user['loginkey'] = generate_loginkey();
return true;
}
/**
* Verifies usergroup selections and other group details.
*
* @return boolean True when valid, false when invalid.
*/
function verify_usergroup()
{
$user = &$this->data;
return true;
}
/**
* Verifies if an email address is valid or not.
*
* @return boolean True when valid, false when invalid.
*/
function verify_email()
{
global $mybb;
$user = &$this->data;
// Check if an email address has actually been entered.
if(trim($user['email']) == '')
{
$this->set_error('missing_email');
return false;
}
// Check if this is a proper email address.
if(validate_email_format($user['email']) === false)
{
$this->set_error('invalid_email_format');
return false;
}
// Check banned emails
if(is_banned_email($user['email']))
{
$this->set_error('banned_email');
return false;
}
// If we have an "email2", verify it matches the existing email
if(isset($user['email2']) && $user['email'] != $user['email2'])
{
$this->set_error("emails_dont_match");
return false;
}
}
/**
* Verifies if a website is valid or not.
*
* @return boolean True when valid, false when invalid.
*/
function verify_website()
{
$website = &$this->data['website'];
if($website == '' || $website == 'http://')
{
$website = '';
return true;
}
// Does the website start with http://?
if(substr_count($website, 'http://') == 0)
{
// Website does not start with http://, let's see if the user forgot.
$website = 'http://'.$website;
if(substr_count($website, 'http://') == 0)
{
$this->set_error('invalid_website');
return false;
}
}
return true;
}
/**
* Verifies if an ICQ number is valid or not.
*
* @return boolean True when valid, false when invalid.
*/
function verify_icq()
{
$icq = &$this->data['icq'];
if($icq != '' && !is_numeric($icq))
{
$this->set_error("invalid_icq_number");
return false;
}
$icq = intval($icq);
return true;
}
/**
* Verifies if an MSN Messenger address is valid or not.
*
* @return boolean True when valid, false when invalid.
*/
function verify_msn()
{
$msn = &$this->data['msn'];
if($msn != '' && validate_email_format($msn) == false)
{
$this->set_error("invalid_msn_address");
return false;
}
return true;
}
/**
* Verifies if a birthday is valid or not.
*
* @return boolean True when valid, false when invalid.
*/
function verify_birthday()
{
$user = &$this->data;
$birthday = &$user['birthday'];
if(!is_array($birthday))
{
return true;
}
// Sanitize any input we have
$birthday['day'] = intval($birthday['day']);
$birthday['month'] = intval($birthday['month']);
$birthday['year'] = intval($birthday['year']);
// Error if a day and month exists, and the birthday day and range is not in range
if($birthday['day'] && $birthday['month'])
{
if($birthday['day'] < 1 || $birthday['day'] > 31 || $birthday['month'] < 1 || $birthday['month'] > 12 || ($birthday['month'] == 2 && $birthday['day'] > 29))
{
$this->set_error("invalid_birthday");
return false;
}
// Check if the day actually exists.
$months = get_bdays($birthday['year']);
if($birthday['day'] > $months[$birthday['month']-1])
{
$this->set_error("invalid_birthday");
return false;
}
}
// Error if a year exists and the year is out of range
if($birthday['year'] != 0 && ($birthday['year'] < (date("Y")-100)) || $birthday['year'] > date("Y"))
{
$this->set_error("invalid_birthday");
return false;
}
// Make the user's birthday field
if($birthday['year'] != 0)
{
// If the year is specified, put together a d-m-y string
$user['bday'] = $birthday['day']."-".$birthday['month']."-".$birthday['year'];
}
elseif($birthday['day'] && $birthday['month'])
{
// If only a day and month are specified, put together a d-m string
$user['bday'] = $birthday['day']."-".$birthday['month']."-";
}
else
{
// No field is specified, so return an empty string for an unknown birthday
$user['bday'] = '';
}
return true;
}
/**
* Verifies if a profile fields are filled in correctly.
*
* @return boolean True when valid, false when invalid.
*/
function verify_profile_fields()
{
global $db;
$user = &$this->data;
$profile_fields = &$this->data['profile_fields'];
// Loop through profile fields checking if they exist or not and are filled in.
$userfields = array();
$comma = '';
$editable = '';
if(!$this->data['profile_fields_editable'])
{
$editable = "editable='yes'";
}
// Fetch all profile fields first.
$options = array(
'order_by' => 'disporder'
);
$query = $db->simple_select(TABLE_PREFIX.'profilefields', 'name, type, fid, required', $editable, $options);
// Then loop through the profile fields.
while($profilefield = $db->fetch_array($query))
{
$profilefield['type'] = htmlspecialchars_uni($profilefield['type']);
$thing = explode("\n", $profilefield['type'], "2");
$type = trim($thing[0]);
$field = "fid{$profilefield['fid']}";
// If the profile field is required, but not filled in, present error.
if(trim($profile_fields[$field]) == "" && $profilefield['required'] == "yes" && !$proferror && !defined('IN_ADMINCP'))
{
$this->set_error('missing_required_profile_field', array($profilefield['name']));
}
// Sort out multiselect/checkbox profile fields.
$options = '';
if(($type == "multiselect" || $type == "checkbox") && is_array($profile_fields[$field]))
{
$expoptions = explode("\n", $thing[1]);
$expoptions = array_map('trim', $expoptions);
foreach($profile_fields[$field] as $value)
{
if(!in_array($value, $expoptions))
{
$this->set_error('bad_profile_field_values', array($profilefield['name']));
}
if($options)
{
$options .= "\n";
}
$options .= $db->escape_string($value);
}
}
else if($type == "select" || $type == "radio")
{
$expoptions = explode("\n", $thing[1]);
$expoptions = array_map('trim', $expoptions);
if(!in_array(htmlspecialchars_uni($profile_fields[$field]), $expoptions) && $profile_fields[$field] != "")
{
$this->set_error('bad_profile_field_values', array($profilefield['name']));
}
$options = $db->escape_string($profile_fields[$field]);
}
else
{
$options = $db->escape_string($profile_fields[$field]);
}
$user['user_fields'][$field] = $options;
}
return true;
}
/**
* Verifies if an optionally entered referrer exists or not.
*
* @return boolean True when valid, false when invalid.
*/
function verify_referrer()
{
global $db, $mybb;
$user = &$this->data;
// Does the referrer exist or not?
if($mybb->settings['usereferrals'] == "yes" && $user['referrer'] != '')
{
$options = array(
'limit' => 1
);
$query = $db->simple_select(TABLE_PREFIX.'users', 'uid', "username='".$db->escape_string($user['referrer'])."'", $options);
$referrer = $db->fetch_array($query);
if(!$referrer['uid'])
{
$this->set_error('invalid_referrer', array($user['referrer']));
return false;
}
}
$user['referrer_uid'] = $referrer['uid'];
return true;
}
/**
* Verifies user options.
*
* @return boolean True when valid, false when invalid.
*/
function verify_options()
{
$options = &$this->data['options'];
// Verify yes/no options.
$this->verify_yesno_option($options, 'allownotices', 'yes');
$this->verify_yesno_option($options, 'hideemail', 'no');
$this->verify_yesno_option($options, 'emailnotify', 'no');
$this->verify_yesno_option($options, 'receivepms', 'yes');
$this->verify_yesno_option($options, 'pmpopup', 'yes');
$this->verify_yesno_option($options, 'pmnotify', 'yes');
$this->verify_yesno_option($options, 'invisible', 'no');
$this->verify_yesno_option($options, 'remember', 'yes');
$this->verify_yesno_option($options, 'dst', 'no');
$this->verify_yesno_option($options, 'showsigs', 'yes');
$this->verify_yesno_option($options, 'showavatars', 'yes');
$this->verify_yesno_option($options, 'showquickreply', 'yes');
$this->verify_yesno_option($options, 'showredirect', 'yes');
if(isset($options['showcodebuttons']))
{
$options['showcodebuttons'] = intval($options['showcodebuttons']);
if($options['showcodebuttons'] != 0)
{
$options['showcodebuttons'] = 1;
}
}
else if($this->method == "insert")
{
$options['showcodebuttons'] = 1;
}
if($this->method == "insert" || (isset($options['threadmode']) && $options['threadmode'] != "threaded"))
{
$options['threadmode'] = 'linear';
}
// Verify the "threads per page" option.
if($this->method == "insert" || (array_key_exists('tpp', $options) && $mybb->settings['usetppoptions']))
{
$explodedtpp = explode(",", $mybb->settings['usertppoptions']);
if(is_array($explodedtpp))
{
@asort($explodedtpp);
$biggest = $explodedtpp[count($explodedtpp)-1];
// Is the selected option greater than the allowed options?
if($options['tpp'] > $biggest)
{
$options['tpp'] = $biggest;
}
}
$options['tpp'] = intval($options['tpp']);
}
// Verify the "posts per page" option.
if($this->method == "insert" || (array_key_exists('ppp', $options) && $mybb->settings['userpppoptions']))
{
$explodedppp = explode(",", $mybb->settings['userpppoptions']);
if(is_array($explodedppp))
{
@asort($explodedppp);
$biggest = $explodedppp[count($explodedppp)-1];
// Is the selected option greater than the allowed options?
if($options['ppp'] > $biggest)
{
$options['ppp'] = $biggest;
}
}
$options['ppp'] = intval($options['ppp']);
}
// Is our selected "days prune" option valid or not?
if($this->method == "insert" || array_key_exists('daysprune', $options))
{
$options['daysprune'] = intval($options['daysprune']);
if($options['daysprune'] < 0)
{
$options['daysprune'] = 0;
}
}
$this->data['options'] = $options;
}
/**
* Verifies if a registration date is valid or not.
*
* @return boolean True when valid, false when invalid.
*/
function
