Chris@76: <?php
Chris@76: 
Chris@76: /**
Chris@76:  * Simple Machines Forum (SMF)
Chris@76:  *
Chris@76:  * @package SMF
Chris@76:  * @author Simple Machines http://www.simplemachines.org
Chris@76:  * @copyright 2011 Simple Machines
Chris@76:  * @license http://www.simplemachines.org/about/smf/license.php BSD
Chris@76:  *
Chris@76:  * @version 2.0
Chris@76:  */
Chris@76: 
Chris@76: if (!defined('SMF'))
Chris@76: 	die('Hacking attempt...');
Chris@76: 
Chris@76: /*	This file has the primary job of showing and editing people's profiles.
Chris@76: 	It also allows the user to change some of their or another's preferences,
Chris@76: 	and such things.  It uses the following functions:
Chris@76: 
Chris@76: 	void ModifyProfile(array errors = none)
Chris@76: 		// !!!
Chris@76: 
Chris@76: 	void loadCustomFields(int id_member, string area)
Chris@76: 		// !!!
Chris@76: 
Chris@76: */
Chris@76: 
Chris@76: // Allow the change or view of profiles...
Chris@76: function ModifyProfile($post_errors = array())
Chris@76: {
Chris@76: 	global $txt, $scripturl, $user_info, $context, $sourcedir, $user_profile, $cur_profile;
Chris@76: 	global $modSettings, $memberContext, $profile_vars, $smcFunc, $post_errors, $options, $user_settings;
Chris@76: 
Chris@76: 	// Don't reload this as we may have processed error strings.
Chris@76: 	if (empty($post_errors))
Chris@76: 		loadLanguage('Profile');
Chris@76: 	loadTemplate('Profile');
Chris@76: 
Chris@76: 	require_once($sourcedir . '/Subs-Menu.php');
Chris@76: 
Chris@76: 	// Did we get the user by name...
Chris@76: 	if (isset($_REQUEST['user']))
Chris@76: 		$memberResult = loadMemberData($_REQUEST['user'], true, 'profile');
Chris@76: 	// ... or by id_member?
Chris@76: 	elseif (!empty($_REQUEST['u']))
Chris@76: 		$memberResult = loadMemberData((int) $_REQUEST['u'], false, 'profile');
Chris@76: 	// If it was just ?action=profile, edit your own profile.
Chris@76: 	else
Chris@76: 		$memberResult = loadMemberData($user_info['id'], false, 'profile');
Chris@76: 
Chris@76: 	// Check if loadMemberData() has returned a valid result.
Chris@76: 	if (!is_array($memberResult))
Chris@76: 		fatal_lang_error('not_a_user', false);
Chris@76: 
Chris@76: 	// If all went well, we have a valid member ID!
Chris@76: 	list ($memID) = $memberResult;
Chris@76: 	$context['id_member'] = $memID;
Chris@76: 	$cur_profile = $user_profile[$memID];
Chris@76: 
Chris@76: 	// Let's have some information about this member ready, too.
Chris@76: 	loadMemberContext($memID);
Chris@76: 	$context['member'] = $memberContext[$memID];
Chris@76: 
Chris@76: 	// Is this the profile of the user himself or herself?
Chris@76: 	$context['user']['is_owner'] = $memID == $user_info['id'];
Chris@76: 
Chris@76: 	/* Define all the sections within the profile area!
Chris@76: 		We start by defining the permission required - then SMF takes this and turns it into the relevant context ;)
Chris@76: 		Possible fields:
Chris@76: 			For Section:
Chris@76: 				string $title:		Section title.
Chris@76: 				array $areas:		Array of areas within this section.
Chris@76: 
Chris@76: 			For Areas:
Chris@76: 				string $label:		Text string that will be used to show the area in the menu.
Chris@76: 				string $file:		Optional text string that may contain a file name that's needed for inclusion in order to display the area properly.
Chris@76: 				string $custom_url:	Optional href for area.
Chris@76: 				string $function:	Function to execute for this section.
Chris@76: 				bool $enabled:		Should area be shown?
Chris@76: 				string $sc:		Session check validation to do on save - note without this save will get unset - if set.
Chris@76: 				bool $hidden:		Does this not actually appear on the menu?
Chris@76: 				bool $password:		Whether to require the user's password in order to save the data in the area.
Chris@76: 				array $subsections:	Array of subsections, in order of appearance.
Chris@76: 				array $permission:	Array of permissions to determine who can access this area. Should contain arrays $own and $any.
Chris@76: 	*/
Chris@76: 	$profile_areas = array(
Chris@76: 		'info' => array(
Chris@76: 			'title' => $txt['profileInfo'],
Chris@76: 			'areas' => array(
Chris@76: 				'summary' => array(
Chris@76: 					'label' => $txt['summary'],
Chris@76: 					'file' => 'Profile-View.php',
Chris@76: 					'function' => 'summary',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => 'profile_view_own',
Chris@76: 						'any' => 'profile_view_any',
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'statistics' => array(
Chris@76: 					'label' => $txt['statPanel'],
Chris@76: 					'file' => 'Profile-View.php',
Chris@76: 					'function' => 'statPanel',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => 'profile_view_own',
Chris@76: 						'any' => 'profile_view_any',
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'showposts' => array(
Chris@76: 					'label' => $txt['showPosts'],
Chris@76: 					'file' => 'Profile-View.php',
Chris@76: 					'function' => 'showPosts',
Chris@76: 					'subsections' => array(
Chris@76: 						'messages' => array($txt['showMessages'], array('profile_view_own', 'profile_view_any')),
Chris@76: 						'topics' => array($txt['showTopics'], array('profile_view_own', 'profile_view_any')),
Chris@76: 						'attach' => array($txt['showAttachments'], array('profile_view_own', 'profile_view_any')),
Chris@76: 					),
Chris@76: 					'permission' => array(
Chris@76: 						'own' => 'profile_view_own',
Chris@76: 						'any' => 'profile_view_any',
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'permissions' => array(
Chris@76: 					'label' => $txt['showPermissions'],
Chris@76: 					'file' => 'Profile-View.php',
Chris@76: 					'function' => 'showPermissions',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => 'manage_permissions',
Chris@76: 						'any' => 'manage_permissions',
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'tracking' => array(
Chris@76: 					'label' => $txt['trackUser'],
Chris@76: 					'file' => 'Profile-View.php',
Chris@76: 					'function' => 'tracking',
Chris@76: 					'subsections' => array(
Chris@76: 						'activity' => array($txt['trackActivity'], 'moderate_forum'),
Chris@76: 						'ip' => array($txt['trackIP'], 'moderate_forum'),
Chris@76: 						'edits' => array($txt['trackEdits'], 'moderate_forum'),
Chris@76: 					),
Chris@76: 					'permission' => array(
Chris@76: 						'own' => 'moderate_forum',
Chris@76: 						'any' => 'moderate_forum',
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'viewwarning' => array(
Chris@76: 					'label' => $txt['profile_view_warnings'],
Chris@76: 					'enabled' => in_array('w', $context['admin_features']) && $modSettings['warning_settings'][0] == 1 && $cur_profile['warning'] && $context['user']['is_owner'] && !empty($modSettings['warning_show']),
Chris@76: 					'file' => 'Profile-View.php',
Chris@76: 					'function' => 'viewWarning',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => 'profile_view_own',
Chris@76: 						'any' => 'issue_warning',
Chris@76: 					),
Chris@76: 				),
Chris@76: 			),
Chris@76: 		),
Chris@76: 		'edit_profile' => array(
Chris@76: 			'title' => $txt['profileEdit'],
Chris@76: 			'areas' => array(
Chris@76: 				'account' => array(
Chris@76: 					'label' => $txt['account'],
Chris@76: 					'file' => 'Profile-Modify.php',
Chris@76: 					'function' => 'account',
Chris@76: 					'enabled' => $context['user']['is_admin'] || ($cur_profile['id_group'] != 1 && !in_array(1, explode(',', $cur_profile['additional_groups']))),
Chris@76: 					'sc' => 'post',
Chris@76: 					'password' => true,
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('profile_identity_any', 'profile_identity_own', 'manage_membergroups'),
Chris@76: 						'any' => array('profile_identity_any', 'manage_membergroups'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'forumprofile' => array(
Chris@76: 					'label' => $txt['forumprofile'],
Chris@76: 					'file' => 'Profile-Modify.php',
Chris@76: 					'function' => 'forumProfile',
Chris@76: 					'sc' => 'post',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('profile_extra_any', 'profile_extra_own', 'profile_title_own', 'profile_title_any'),
Chris@76: 						'any' => array('profile_extra_any', 'profile_title_any'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'theme' => array(
Chris@76: 					'label' => $txt['theme'],
Chris@76: 					'file' => 'Profile-Modify.php',
Chris@76: 					'function' => 'theme',
Chris@76: 					'sc' => 'post',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('profile_extra_any', 'profile_extra_own'),
Chris@76: 						'any' => array('profile_extra_any'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'authentication' => array(
Chris@76: 					'label' => $txt['authentication'],
Chris@76: 					'file' => 'Profile-Modify.php',
Chris@76: 					'function' => 'authentication',
Chris@76: 					'enabled' => !empty($modSettings['enableOpenID']) || !empty($cur_profile['openid_uri']),
Chris@76: 					'sc' => 'post',
Chris@76: 					'hidden' => empty($modSettings['enableOpenID']) && empty($cur_profile['openid_uri']),
Chris@76: 					'password' => true,
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('profile_identity_any', 'profile_identity_own'),
Chris@76: 						'any' => array('profile_identity_any'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'notification' => array(
Chris@76: 					'label' => $txt['notification'],
Chris@76: 					'file' => 'Profile-Modify.php',
Chris@76: 					'function' => 'notification',
Chris@76: 					'sc' => 'post',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('profile_extra_any', 'profile_extra_own'),
Chris@76: 						'any' => array('profile_extra_any'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				// Without profile_extra_own, settings are accessible from the PM section.
Chris@76: 				'pmprefs' => array(
Chris@76: 					'label' => $txt['pmprefs'],
Chris@76: 					'file' => 'Profile-Modify.php',
Chris@76: 					'function' => 'pmprefs',
Chris@76: 					'enabled' => allowedTo(array('profile_extra_own', 'profile_extra_any')),
Chris@76: 					'sc' => 'post',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('pm_read'),
Chris@76: 						'any' => array('profile_extra_any'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'ignoreboards' => array(
Chris@76: 					'label' => $txt['ignoreboards'],
Chris@76: 					'file' => 'Profile-Modify.php',
Chris@76: 					'function' => 'ignoreboards',
Chris@76: 					'enabled' => !empty($modSettings['allow_ignore_boards']),
Chris@76: 					'sc' => 'post',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('profile_extra_any', 'profile_extra_own'),
Chris@76: 						'any' => array('profile_extra_any'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'lists' => array(
Chris@76: 					'label' => $txt['editBuddyIgnoreLists'],
Chris@76: 					'file' => 'Profile-Modify.php',
Chris@76: 					'function' => 'editBuddyIgnoreLists',
Chris@76: 					'enabled' => !empty($modSettings['enable_buddylist']) && $context['user']['is_owner'],
Chris@76: 					'sc' => 'post',
Chris@76: 					'subsections' => array(
Chris@76: 						'buddies' => array($txt['editBuddies']),
Chris@76: 						'ignore' => array($txt['editIgnoreList']),
Chris@76: 					),
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('profile_extra_any', 'profile_extra_own'),
Chris@76: 						'any' => array(),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'groupmembership' => array(
Chris@76: 					'label' => $txt['groupmembership'],
Chris@76: 					'file' => 'Profile-Modify.php',
Chris@76: 					'function' => 'groupMembership',
Chris@76: 					'enabled' => !empty($modSettings['show_group_membership']) && $context['user']['is_owner'],
Chris@76: 					'sc' => 'request',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('profile_view_own'),
Chris@76: 						'any' => array('manage_membergroups'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 			),
Chris@76: 		),
Chris@76: 		'profile_action' => array(
Chris@76: 			'title' => $txt['profileAction'],
Chris@76: 			'areas' => array(
Chris@76: 				'sendpm' => array(
Chris@76: 					'label' => $txt['profileSendIm'],
Chris@76: 					'custom_url' => $scripturl . '?action=pm;sa=send',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array(),
Chris@76: 						'any' => array('pm_send'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'issuewarning' => array(
Chris@76: 					'label' => $txt['profile_issue_warning'],
Chris@76: 					'enabled' => in_array('w', $context['admin_features']) && $modSettings['warning_settings'][0] == 1 && (!$context['user']['is_owner'] || $context['user']['is_admin']),
Chris@76: 					'file' => 'Profile-Actions.php',
Chris@76: 					'function' => 'issueWarning',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('issue_warning'),
Chris@76: 						'any' => array('issue_warning'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'banuser' => array(
Chris@76: 					'label' => $txt['profileBanUser'],
Chris@76: 					'custom_url' => $scripturl . '?action=admin;area=ban;sa=add',
Chris@76: 					'enabled' => $cur_profile['id_group'] != 1 && !in_array(1, explode(',', $cur_profile['additional_groups'])),
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array(),
Chris@76: 						'any' => array('manage_bans'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'subscriptions' => array(
Chris@76: 					'label' => $txt['subscriptions'],
Chris@76: 					'file' => 'Profile-Actions.php',
Chris@76: 					'function' => 'subscriptions',
Chris@76: 					'enabled' => !empty($modSettings['paid_enabled']),
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('profile_view_own'),
Chris@76: 						'any' => array('moderate_forum'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'deleteaccount' => array(
Chris@76: 					'label' => $txt['deleteAccount'],
Chris@76: 					'file' => 'Profile-Actions.php',
Chris@76: 					'function' => 'deleteAccount',
Chris@76: 					'sc' => 'post',
Chris@76: 					'password' => true,
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array('profile_remove_any', 'profile_remove_own'),
Chris@76: 						'any' => array('profile_remove_any'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 				'activateaccount' => array(
Chris@76: 					'file' => 'Profile-Actions.php',
Chris@76: 					'function' => 'activateAccount',
Chris@76: 					'sc' => 'get',
Chris@76: 					'select' => 'summary',
Chris@76: 					'permission' => array(
Chris@76: 						'own' => array(),
Chris@76: 						'any' => array('moderate_forum'),
Chris@76: 					),
Chris@76: 				),
Chris@76: 			),
Chris@76: 		),
Chris@76: 	);
Chris@76: 
Chris@76: 	// Let them modify profile areas easily.
Chris@76: 	call_integration_hook('integrate_profile_areas', array(&$profile_areas));
Chris@76: 
Chris@76: 	// Do some cleaning ready for the menu function.
Chris@76: 	$context['password_areas'] = array();
Chris@76: 	$current_area = isset($_REQUEST['area']) ? $_REQUEST['area'] : '';
Chris@76: 
Chris@76: 	foreach ($profile_areas as $section_id => $section)
Chris@76: 	{
Chris@76: 		// Do a bit of spring cleaning so to speak.
Chris@76: 		foreach ($section['areas'] as $area_id => $area)
Chris@76: 		{
Chris@76: 			// If it said no permissions that meant it wasn't valid!
Chris@76: 			if (empty($area['permission'][$context['user']['is_owner'] ? 'own' : 'any']))
Chris@76: 				$profile_areas[$section_id]['areas'][$area_id]['enabled'] = false;
Chris@76: 			// Otherwise pick the right set.
Chris@76: 			else
Chris@76: 				$profile_areas[$section_id]['areas'][$area_id]['permission'] = $area['permission'][$context['user']['is_owner'] ? 'own' : 'any'];
Chris@76: 
Chris@76: 			// Password required - only if not on OpenID.
Chris@76: 			if (!empty($area['password']))
Chris@76: 				$context['password_areas'][] = $area_id;
Chris@76: 		}
Chris@76: 	}
Chris@76: 
Chris@76: 	// Is there an updated message to show?
Chris@76: 	if (isset($_GET['updated']))
Chris@76: 		$context['profile_updated'] = $txt['profile_updated_own'];
Chris@76: 
Chris@76: 	// Set a few options for the menu.
Chris@76: 	$menuOptions = array(
Chris@76: 		'disable_url_session_check' => true,
Chris@76: 		'current_area' => $current_area,
Chris@76: 		'extra_url_parameters' => array(
Chris@76: 			'u' => $context['id_member'],
Chris@76: 		),
Chris@76: 	);
Chris@76: 
Chris@76: 	// Actually create the menu!
Chris@76: 	$profile_include_data = createMenu($profile_areas, $menuOptions);
Chris@76: 
Chris@76: 	// No menu means no access.
Chris@76: 	if (!$profile_include_data && (!$user_info['is_guest'] || validateSession()))
Chris@76: 		fatal_lang_error('no_access', false);
Chris@76: 
Chris@76: 	// Make a note of the Unique ID for this menu.
Chris@76: 	$context['profile_menu_id'] = $context['max_menu_id'];
Chris@76: 	$context['profile_menu_name'] = 'menu_data_' . $context['profile_menu_id'];
Chris@76: 
Chris@76: 	// Set the selected item - now it's been validated.
Chris@76: 	$current_area = $profile_include_data['current_area'];
Chris@76: 	$context['menu_item_selected'] = $current_area;
Chris@76: 
Chris@76: 	// Before we go any further, let's work on the area we've said is valid. Note this is done here just in case we every compromise the menu function in error!
Chris@76: 	$context['completed_save'] = false;
Chris@76: 	$security_checks = array();
Chris@76: 	$found_area = false;
Chris@76: 	foreach ($profile_areas as $section_id => $section)
Chris@76: 	{
Chris@76: 		// Do a bit of spring cleaning so to speak.
Chris@76: 		foreach ($section['areas'] as $area_id => $area)
Chris@76: 		{
Chris@76: 			// Is this our area?
Chris@76: 			if ($current_area == $area_id)
Chris@76: 			{
Chris@76: 				// This can't happen - but is a security check.
Chris@76: 				if ((isset($section['enabled']) && $section['enabled'] == false) || (isset($area['enabled']) && $area['enabled'] == false))
Chris@76: 					fatal_lang_error('no_access', false);
Chris@76: 
Chris@76: 				// Are we saving data in a valid area?
Chris@76: 				if (isset($area['sc']) && isset($_REQUEST['save']))
Chris@76: 				{
Chris@76: 					$security_checks['session'] = $area['sc'];
Chris@76: 					$context['completed_save'] = true;
Chris@76: 				}
Chris@76: 
Chris@76: 				// Does this require session validating?
Chris@76: 				if (!empty($area['validate']))
Chris@76: 					$security_checks['validate'] = true;
Chris@76: 
Chris@76: 				// Permissions for good measure.
Chris@76: 				if (!empty($profile_include_data['permission']))
Chris@76: 					$security_checks['permission'] = $profile_include_data['permission'];
Chris@76: 
Chris@76: 				// Either way got something.
Chris@76: 				$found_area = true;
Chris@76: 			}
Chris@76: 		}
Chris@76: 	}
Chris@76: 
Chris@76: 	// Oh dear, some serious security lapse is going on here... we'll put a stop to that!
Chris@76: 	if (!$found_area)
Chris@76: 		fatal_lang_error('no_access', false);
Chris@76: 
Chris@76: 	// Release this now.
Chris@76: 	unset($profile_areas);
Chris@76: 
Chris@76: 	// Now the context is setup have we got any security checks to carry out additional to that above?
Chris@76: 	if (isset($security_checks['session']))
Chris@76: 		checkSession($security_checks['session']);
Chris@76: 	if (isset($security_checks['validate']))
Chris@76: 		validateSession();
Chris@76: 	if (isset($security_checks['permission']))
Chris@76: 		isAllowedTo($security_checks['permission']);
Chris@76: 
Chris@76: 	// File to include?
Chris@76: 	if (isset($profile_include_data['file']))
Chris@76: 		require_once($sourcedir . '/' . $profile_include_data['file']);
Chris@76: 
Chris@76: 	// Make sure that the area function does exist!
Chris@76: 	if (!isset($profile_include_data['function']) || !function_exists($profile_include_data['function']))
Chris@76: 	{
Chris@76: 		destroyMenu();
Chris@76: 		fatal_lang_error('no_access', false);
Chris@76: 	}
Chris@76: 
Chris@76: 	// Build the link tree.
Chris@76: 	$context['linktree'][] = array(
Chris@76: 		'url' => $scripturl . '?action=profile' . ($memID != $user_info['id'] ? ';u=' . $memID : ''),
Chris@76: 		'name' => sprintf($txt['profile_of_username'], $context['member']['name']),
Chris@76: 	);
Chris@76: 
Chris@76: 	if (!empty($profile_include_data['label']))
Chris@76: 		$context['linktree'][] = array(
Chris@76: 			'url' => $scripturl . '?action=profile' . ($memID != $user_info['id'] ? ';u=' . $memID : '') . ';area=' . $profile_include_data['current_area'],
Chris@76: 			'name' => $profile_include_data['label'],
Chris@76: 		);
Chris@76: 
Chris@76: 	if (!empty($profile_include_data['current_subsection']) && $profile_include_data['subsections'][$profile_include_data['current_subsection']][0] != $profile_include_data['label'])
Chris@76: 		$context['linktree'][] = array(
Chris@76: 			'url' => $scripturl . '?action=profile' . ($memID != $user_info['id'] ? ';u=' . $memID : '') . ';area=' . $profile_include_data['current_area'] . ';sa=' . $profile_include_data['current_subsection'],
Chris@76: 			'name' => $profile_include_data['subsections'][$profile_include_data['current_subsection']][0],
Chris@76: 		);
Chris@76: 
Chris@76: 	// Set the template for this area and add the profile layer.
Chris@76: 	$context['sub_template'] = $profile_include_data['function'];
Chris@76: 	$context['template_layers'][] = 'profile';
Chris@76: 
Chris@76: 	// All the subactions that require a user password in order to validate.
Chris@76: 	$check_password = $context['user']['is_owner'] && in_array($profile_include_data['current_area'], $context['password_areas']);
Chris@76: 	$context['require_password'] = $check_password && empty($user_settings['openid_uri']);
Chris@76: 
Chris@76: 	// If we're in wireless then we have a cut down template...
Chris@76: 	if (WIRELESS && $context['sub_template'] == 'summary' && WIRELESS_PROTOCOL != 'wap')
Chris@76: 		$context['sub_template'] = WIRELESS_PROTOCOL . '_profile';
Chris@76: 
Chris@76: 	// These will get populated soon!
Chris@76: 	$post_errors = array();
Chris@76: 	$profile_vars = array();
Chris@76: 
Chris@76: 	// Right - are we saving - if so let's save the old data first.
Chris@76: 	if ($context['completed_save'])
Chris@76: 	{
Chris@76: 		// If it's someone elses profile then validate the session.
Chris@76: 		if (!$context['user']['is_owner'])
Chris@76: 			validateSession();
Chris@76: 
Chris@76: 		// Clean up the POST variables.
Chris@76: 		$_POST = htmltrim__recursive($_POST);
Chris@76: 		$_POST = htmlspecialchars__recursive($_POST);
Chris@76: 
Chris@76: 		if ($check_password)
Chris@76: 		{
Chris@76: 			// If we're using OpenID try to revalidate.
Chris@76: 			if (!empty($user_settings['openid_uri']))
Chris@76: 			{
Chris@76: 				require_once($sourcedir . '/Subs-OpenID.php');
Chris@76: 				smf_openID_revalidate();
Chris@76: 			}
Chris@76: 			else
Chris@76: 			{
Chris@76: 				// You didn't even enter a password!
Chris@76: 				if (trim($_POST['oldpasswrd']) == '')
Chris@76: 					$post_errors[] = 'no_password';
Chris@76: 
Chris@76: 				// Since the password got modified due to all the $_POST cleaning, lets undo it so we can get the correct password
Chris@76: 				$_POST['oldpasswrd'] = un_htmlspecialchars($_POST['oldpasswrd']);
Chris@76: 
Chris@76: 				// Does the integration want to check passwords?
Chris@76: 				$good_password = in_array(true, call_integration_hook('integrate_verify_password', array($cur_profile['member_name'], $_POST['oldpasswrd'], false)), true);
Chris@76: 
Chris@76: 				// Bad password!!!
Chris@76: 				if (!$good_password && $user_info['passwd'] != sha1(strtolower($cur_profile['member_name']) . $_POST['oldpasswrd']))
Chris@76: 					$post_errors[] = 'bad_password';
Chris@76: 
Chris@76: 				// Warn other elements not to jump the gun and do custom changes!
Chris@76: 				if (in_array('bad_password', $post_errors))
Chris@76: 					$context['password_auth_failed'] = true;
Chris@76: 			}
Chris@76: 		}
Chris@76: 
Chris@76: 		// Change the IP address in the database.
Chris@76: 		if ($context['user']['is_owner'])
Chris@76: 			$profile_vars['member_ip'] = $user_info['ip'];
Chris@76: 
Chris@76: 		// Now call the sub-action function...
Chris@76: 		if ($current_area == 'activateaccount')
Chris@76: 		{
Chris@76: 			if (empty($post_errors))
Chris@76: 				activateAccount($memID);
Chris@76: 		}
Chris@76: 		elseif ($current_area == 'deleteaccount')
Chris@76: 		{
Chris@76: 			if (empty($post_errors))
Chris@76: 			{
Chris@76: 				deleteAccount2($profile_vars, $post_errors, $memID);
Chris@76: 				redirectexit();
Chris@76: 			}
Chris@76: 		}
Chris@76: 		elseif ($current_area == 'groupmembership' && empty($post_errors))
Chris@76: 		{
Chris@76: 			$msg = groupMembership2($profile_vars, $post_errors, $memID);
Chris@76: 
Chris@76: 			// Whatever we've done, we have nothing else to do here...
Chris@76: 			redirectexit('action=profile' . ($context['user']['is_owner'] ? '' : ';u=' . $memID) . ';area=groupmembership' . (!empty($msg) ? ';msg=' . $msg : ''));
Chris@76: 		}
Chris@76: 		// Authentication changes?
Chris@76: 		elseif ($current_area == 'authentication')
Chris@76: 		{
Chris@76: 			authentication($memID, true);
Chris@76: 		}
Chris@76: 		elseif (in_array($current_area, array('account', 'forumprofile', 'theme', 'pmprefs')))
Chris@76: 			saveProfileFields();
Chris@76: 		else
Chris@76: 		{
Chris@76: 			$force_redirect = true;
Chris@76: 			// Ensure we include this.
Chris@76: 			require_once($sourcedir . '/Profile-Modify.php');
Chris@76: 			saveProfileChanges($profile_vars, $post_errors, $memID);
Chris@76: 		}
Chris@76: 
Chris@76: 		// There was a problem, let them try to re-enter.
Chris@76: 		if (!empty($post_errors))
Chris@76: 		{
Chris@76: 			// Load the language file so we can give a nice explanation of the errors.
Chris@76: 			loadLanguage('Errors');
Chris@76: 			$context['post_errors'] = $post_errors;
Chris@76: 		}
Chris@76: 		elseif (!empty($profile_vars))
Chris@76: 		{
Chris@76: 			// If we've changed the password, notify any integration that may be listening in.
Chris@76: 			if (isset($profile_vars['passwd']))
Chris@76: 				call_integration_hook('integrate_reset_pass', array($cur_profile['member_name'], $cur_profile['member_name'], $_POST['passwrd2']));
Chris@76: 
Chris@76: 			updateMemberData($memID, $profile_vars);
Chris@76: 
Chris@76: 			// What if this is the newest member?
Chris@76: 			if ($modSettings['latestMember'] == $memID)
Chris@76: 				updateStats('member');
Chris@76: 			elseif (isset($profile_vars['real_name']))
Chris@76: 				updateSettings(array('memberlist_updated' => time()));
Chris@76: 
Chris@76: 			// If the member changed his/her birthdate, update calendar statistics.
Chris@76: 			if (isset($profile_vars['birthdate']) || isset($profile_vars['real_name']))
Chris@76: 				updateSettings(array(
Chris@76: 					'calendar_updated' => time(),
Chris@76: 				));
Chris@76: 
Chris@76: 			// Anything worth logging?
Chris@76: 			if (!empty($context['log_changes']) && !empty($modSettings['modlog_enabled']))
Chris@76: 			{
Chris@76: 				$log_changes = array();
Chris@76: 				foreach ($context['log_changes'] as $k => $v)
Chris@76: 					$log_changes[] = array(
Chris@76: 						'action' => $k,
Chris@76: 						'id_log' => 2,
Chris@76: 						'log_time' => time(),
Chris@76: 						'id_member' => $memID,
Chris@76: 						'ip' => $user_info['ip'],
Chris@76: 						'extra' => serialize(array_merge($v, array('applicator' => $user_info['id']))),
Chris@76: 					);
Chris@76: 				$smcFunc['db_insert']('',
Chris@76: 					'{db_prefix}log_actions',
Chris@76: 					array(
Chris@76: 						'action' => 'string', 'id_log' => 'int', 'log_time' => 'int', 'id_member' => 'int', 'ip' => 'string-16',
Chris@76: 						'extra' => 'string-65534',
Chris@76: 					),
Chris@76: 					$log_changes,
Chris@76: 					array('id_action')
Chris@76: 				);
Chris@76: 			}
Chris@76: 
Chris@76: 			// Have we got any post save functions to execute?
Chris@76: 			if (!empty($context['profile_execute_on_save']))
Chris@76: 				foreach ($context['profile_execute_on_save'] as $saveFunc)
Chris@76: 					$saveFunc();
Chris@76: 
Chris@76: 			// Let them know it worked!
Chris@76: 			$context['profile_updated'] = $context['user']['is_owner'] ? $txt['profile_updated_own'] : sprintf($txt['profile_updated_else'], $cur_profile['member_name']);
Chris@76: 
Chris@76: 			// Invalidate any cached data.
Chris@76: 			cache_put_data('member_data-profile-' . $memID, null, 0);
Chris@76: 		}
Chris@76: 	}
Chris@76: 
Chris@76: 	// Have some errors for some reason?
Chris@76: 	if (!empty($post_errors))
Chris@76: 	{
Chris@76: 		// Set all the errors so the template knows what went wrong.
Chris@76: 		foreach ($post_errors as $error_type)
Chris@76: 			$context['modify_error'][$error_type] = true;
Chris@76: 	}
Chris@76: 	// If it's you then we should redirect upon save.
Chris@76: 	elseif (!empty($profile_vars) && $context['user']['is_owner'])
Chris@76: 		redirectexit('action=profile;area=' . $current_area . ';updated');
Chris@76: 	elseif (!empty($force_redirect))
Chris@76: 		redirectexit('action=profile' . ($context['user']['is_owner'] ? '' : ';u=' . $memID) . ';area=' . $current_area);
Chris@76: 
Chris@76: 	// Call the appropriate subaction function.
Chris@76: 	$profile_include_data['function']($memID);
Chris@76: 
Chris@76: 	// Set the page title if it's not already set...
Chris@76: 	if (!isset($context['page_title']))
Chris@76: 		$context['page_title'] = $txt['profile'] . (isset($txt[$current_area]) ? ' - ' . $txt[$current_area] : '');
Chris@76: }
Chris@76: 
Chris@76: // Load any custom fields for this area... no area means load all, 'summary' loads all public ones.
Chris@76: function loadCustomFields($memID, $area = 'summary')
Chris@76: {
Chris@76: 	global $context, $txt, $user_profile, $smcFunc, $user_info, $settings, $scripturl;
Chris@76: 
Chris@76: 	// Get the right restrictions in place...
Chris@76: 	$where = 'active = 1';
Chris@76: 	if (!allowedTo('admin_forum') && $area != 'register')
Chris@76: 	{
Chris@76: 		// If it's the owner they can see two types of private fields, regardless.
Chris@76: 		if ($memID == $user_info['id'])
Chris@76: 			$where .= $area == 'summary' ? ' AND private < 3' : ' AND (private = 0 OR private = 2)';
Chris@76: 		else
Chris@76: 			$where .= $area == 'summary' ? ' AND private < 2' : ' AND private = 0';
Chris@76: 	}
Chris@76: 
Chris@76: 	if ($area == 'register')
Chris@76: 		$where .= ' AND show_reg != 0';
Chris@76: 	elseif ($area != 'summary')
Chris@76: 		$where .= ' AND show_profile = {string:area}';
Chris@76: 
Chris@76: 	// Load all the relevant fields - and data.
Chris@76: 	$request = $smcFunc['db_query']('', '
Chris@76: 		SELECT
Chris@76: 			col_name, field_name, field_desc, field_type, field_length, field_options,
Chris@76: 			default_value, bbc, enclose, placement
Chris@76: 		FROM {db_prefix}custom_fields
Chris@76: 		WHERE ' . $where,
Chris@76: 		array(
Chris@76: 			'area' => $area,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$context['custom_fields'] = array();
Chris@76: 	while ($row = $smcFunc['db_fetch_assoc']($request))
Chris@76: 	{
Chris@76: 		// Shortcut.
Chris@76: 		$exists = $memID && isset($user_profile[$memID], $user_profile[$memID]['options'][$row['col_name']]);
Chris@76: 		$value = $exists ? $user_profile[$memID]['options'][$row['col_name']] : '';
Chris@76: 
Chris@76: 		// If this was submitted already then make the value the posted version.
Chris@76: 		if (isset($_POST['customfield']) && isset($_POST['customfield'][$row['col_name']]))
Chris@76: 		{
Chris@76: 			$value = $smcFunc['htmlspecialchars']($_POST['customfield'][$row['col_name']]);
Chris@76: 			if (in_array($row['field_type'], array('select', 'radio')))
Chris@76: 					$value = ($options = explode(',', $row['field_options'])) && isset($options[$value]) ? $options[$value] : '';
Chris@76: 		}
Chris@76: 
Chris@76: 		// HTML for the input form.
Chris@76: 		$output_html = $value;
Chris@76: 		if ($row['field_type'] == 'check')
Chris@76: 		{
Chris@76: 			$true = (!$exists && $row['default_value']) || $value;
Chris@76: 			$input_html = '<input type="checkbox" name="customfield[' . $row['col_name'] . ']" ' . ($true ? 'checked="checked"' : '') . ' class="input_check" />';
Chris@76: 			$output_html = $true ? $txt['yes'] : $txt['no'];
Chris@76: 		}
Chris@76: 		elseif ($row['field_type'] == 'select')
Chris@76: 		{
Chris@76: 			$input_html = '<select name="customfield[' . $row['col_name'] . ']"><option value="-1"></option>';
Chris@76: 			$options = explode(',', $row['field_options']);
Chris@76: 			foreach ($options as $k => $v)
Chris@76: 			{
Chris@76: 				$true = (!$exists && $row['default_value'] == $v) || $value == $v;
Chris@76: 				$input_html .= '<option value="' . $k . '"' . ($true ? ' selected="selected"' : '') . '>' . $v . '</option>';
Chris@76: 				if ($true)
Chris@76: 					$output_html = $v;
Chris@76: 			}
Chris@76: 
Chris@76: 			$input_html .= '</select>';
Chris@76: 		}
Chris@76: 		elseif ($row['field_type'] == 'radio')
Chris@76: 		{
Chris@76: 			$input_html = '<fieldset>';
Chris@76: 			$options = explode(',', $row['field_options']);
Chris@76: 			foreach ($options as $k => $v)
Chris@76: 			{
Chris@76: 				$true = (!$exists && $row['default_value'] == $v) || $value == $v;
Chris@76: 				$input_html .= '<label for="customfield_' . $row['col_name'] . '_' . $k . '"><input type="radio" name="customfield[' . $row['col_name'] . ']" class="input_radio" id="customfield_' . $row['col_name'] . '_' . $k . '" value="' . $k . '" ' . ($true ? 'checked="checked"' : '') . '>' . $v . '</label><br />';
Chris@76: 				if ($true)
Chris@76: 					$output_html = $v;
Chris@76: 			}
Chris@76: 			$input_html .= '</fieldset>';
Chris@76: 		}
Chris@76: 		elseif ($row['field_type'] == 'text')
Chris@76: 		{
Chris@76: 			$input_html = '<input type="text" name="customfield[' . $row['col_name'] . ']" ' . ($row['field_length'] != 0 ? 'maxlength="' . $row['field_length'] . '"' : '') . ' size="' . ($row['field_length'] == 0 || $row['field_length'] >= 50 ? 50 : ($row['field_length'] > 30 ? 30 : ($row['field_length'] > 10 ? 20 : 10))) . '" value="' . $value . '" class="input_text" />';
Chris@76: 		}
Chris@76: 		else
Chris@76: 		{
Chris@76: 			@list ($rows, $cols) = @explode(',', $row['default_value']);
Chris@76: 			$input_html = '<textarea name="customfield[' . $row['col_name'] . ']" ' . (!empty($rows) ? 'rows="' . $rows . '"' : '') . ' ' . (!empty($cols) ? 'cols="' . $cols . '"' : '') . '>' . $value . '</textarea>';
Chris@76: 		}
Chris@76: 
Chris@76: 		// Parse BBCode
Chris@76: 		if ($row['bbc'])
Chris@76: 			$output_html = parse_bbc($output_html);
Chris@76: 		elseif($row['field_type'] == 'textarea')
Chris@76: 			// Allow for newlines at least
Chris@76: 			$output_html = strtr($output_html, array("\n" => '<br />'));
Chris@76: 
Chris@76: 		// Enclosing the user input within some other text?
Chris@76: 		if (!empty($row['enclose']) && !empty($output_html))
Chris@76: 			$output_html = strtr($row['enclose'], array(
Chris@76: 				'{SCRIPTURL}' => $scripturl,
Chris@76: 				'{IMAGES_URL}' => $settings['images_url'],
Chris@76: 				'{DEFAULT_IMAGES_URL}' => $settings['default_images_url'],
Chris@76: 				'{INPUT}' => $output_html,
Chris@76: 			));
Chris@76: 
Chris@76: 		$context['custom_fields'][] = array(
Chris@76: 			'name' => $row['field_name'],
Chris@76: 			'desc' => $row['field_desc'],
Chris@76: 			'type' => $row['field_type'],
Chris@76: 			'input_html' => $input_html,
Chris@76: 			'output_html' => $output_html,
Chris@76: 			'placement' => $row['placement'],
Chris@76: 			'colname' => $row['col_name'],
Chris@76: 			'value' => $value,
Chris@76: 		);
Chris@76: 	}
Chris@76: 	$smcFunc['db_free_result']($request);
Chris@76: }
Chris@76: 
Chris@76: ?>