Chris@76: <?php
Chris@76: 
Chris@76: /**
Chris@76:  * Simple Machines Forum (SMF)
Chris@76:  *
Chris@76:  * @package SMF
Chris@76:  * @author Simple Machines http://www.simplemachines.org
Chris@76:  * @copyright 2011 Simple Machines
Chris@76:  * @license http://www.simplemachines.org/about/smf/license.php BSD
Chris@76:  *
Chris@76:  * @version 2.0.1
Chris@76:  */
Chris@76: 
Chris@76: if (!defined('SMF'))
Chris@76: 	die('Hacking attempt...');
Chris@76: 
Chris@76: /* This file contains some useful functions for members and membergroups.
Chris@76: 
Chris@76: 	void deleteMembers(array $users, bool check_not_admin = false)
Chris@76: 		- delete of one or more members.
Chris@76: 		- requires profile_remove_own or profile_remove_any permission for
Chris@76: 		  respectively removing your own account or any account.
Chris@76: 		- non-admins cannot delete admins.
Chris@76: 		- changes author of messages, topics and polls to guest authors.
Chris@76: 		- removes all log entries concerning the deleted members, except the
Chris@76: 		  error logs, ban logs and moderation logs.
Chris@76: 		- removes these members' personal messages (only the inbox), avatars,
Chris@76: 		  ban entries, theme settings, moderator positions, poll votes, and
Chris@76: 		  karma votes.
Chris@76: 		- updates member statistics afterwards.
Chris@76: 
Chris@76: 	int registerMember(array options, bool return_errors)
Chris@76: 		- registers a member to the forum.
Chris@76: 		- returns the ID of the newly created member.
Chris@76: 		- allows two types of interface: 'guest' and 'admin'. The first
Chris@76: 		  includes hammering protection, the latter can perform the
Chris@76: 		  registration silently.
Chris@76: 		- the strings used in the options array are assumed to be escaped.
Chris@76: 		- allows to perform several checks on the input, e.g. reserved names.
Chris@76: 		- adjusts member statistics.
Chris@76: 		- if an error is detected will fatal error on all errors unless return_errors is true.
Chris@76: 
Chris@76: 	bool isReservedName(string name, int id_member = 0, bool is_name = true, bool fatal = true)
Chris@76: 		- checks if name is a reserved name or username.
Chris@76: 		- if is_name is false, the name is assumed to be a username.
Chris@76: 		- the id_member variable is used to ignore duplicate matches with the
Chris@76: 		  current member.
Chris@76: 
Chris@76: 	array groupsAllowedTo(string permission, int board_id = null)
Chris@76: 		- retrieves a list of membergroups that are allowed to do the given
Chris@76: 		  permission.
Chris@76: 		- if board_id is not null, a board permission is assumed.
Chris@76: 		- takes different permission settings into account.
Chris@76: 		- returns an array containing an array for the allowed membergroup ID's
Chris@76: 		  and an array for the denied membergroup ID's.
Chris@76: 
Chris@76: 	array membersAllowedTo(string permission, int board_id = null)
Chris@76: 		- retrieves a list of members that are allowed to do the given
Chris@76: 		  permission.
Chris@76: 		- if board_id is not null, a board permission is assumed.
Chris@76: 		- takes different permission settings into account.
Chris@76: 		- takes possible moderators (on board 'board_id') into account.
Chris@76: 		- returns an array containing member ID's.
Chris@76: 
Chris@76: 	int reattributePosts(int id_member, string email = false, string membername = false, bool add_to_post_count = false)
Chris@76: 		- reattribute guest posts to a specified member.
Chris@76: 		- does not check for any permissions.
Chris@76: 		- returns the number of successful reattributed posts.
Chris@76: 		- if add_to_post_count is set, the member's post count is increased.
Chris@76: 
Chris@76: 	void BuddyListToggle()
Chris@76: 		- add a member to your buddy list or remove it.
Chris@76: 		- requires profile_identity_own permission.
Chris@76: 		- called by ?action=buddy;u=x;session_id=y.
Chris@76: 		- redirects to ?action=profile;u=x.
Chris@76: 
Chris@76: 	void populateDuplicateMembers(&array members)
Chris@76: 		// !!!
Chris@76: 
Chris@76: */
Chris@76: 
Chris@76: // Delete a group of/single member.
Chris@76: function deleteMembers($users, $check_not_admin = false)
Chris@76: {
Chris@76: 	global $sourcedir, $modSettings, $user_info, $smcFunc;
Chris@76: 
Chris@76: 	// Try give us a while to sort this out...
Chris@76: 	@set_time_limit(600);
Chris@76: 	// Try to get some more memory.
Chris@76: 	if (@ini_get('memory_limit') < 128)
Chris@76: 		@ini_set('memory_limit', '128M');
Chris@76: 
Chris@76: 	// If it's not an array, make it so!
Chris@76: 	if (!is_array($users))
Chris@76: 		$users = array($users);
Chris@76: 	else
Chris@76: 		$users = array_unique($users);
Chris@76: 
Chris@76: 	// Make sure there's no void user in here.
Chris@76: 	$users = array_diff($users, array(0));
Chris@76: 
Chris@76: 	// How many are they deleting?
Chris@76: 	if (empty($users))
Chris@76: 		return;
Chris@76: 	elseif (count($users) == 1)
Chris@76: 	{
Chris@76: 		list ($user) = $users;
Chris@76: 
Chris@76: 		if ($user == $user_info['id'])
Chris@76: 			isAllowedTo('profile_remove_own');
Chris@76: 		else
Chris@76: 			isAllowedTo('profile_remove_any');
Chris@76: 	}
Chris@76: 	else
Chris@76: 	{
Chris@76: 		foreach ($users as $k => $v)
Chris@76: 			$users[$k] = (int) $v;
Chris@76: 
Chris@76: 		// Deleting more than one?  You can't have more than one account...
Chris@76: 		isAllowedTo('profile_remove_any');
Chris@76: 	}
Chris@76: 
Chris@76: 	// Get their names for logging purposes.
Chris@76: 	$request = $smcFunc['db_query']('', '
Chris@76: 		SELECT id_member, member_name, CASE WHEN id_group = {int:admin_group} OR FIND_IN_SET({int:admin_group}, additional_groups) != 0 THEN 1 ELSE 0 END AS is_admin
Chris@76: 		FROM {db_prefix}members
Chris@76: 		WHERE id_member IN ({array_int:user_list})
Chris@76: 		LIMIT ' . count($users),
Chris@76: 		array(
Chris@76: 			'user_list' => $users,
Chris@76: 			'admin_group' => 1,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$admins = array();
Chris@76: 	$user_log_details = array();
Chris@76: 	while ($row = $smcFunc['db_fetch_assoc']($request))
Chris@76: 	{
Chris@76: 		if ($row['is_admin'])
Chris@76: 			$admins[] = $row['id_member'];
Chris@76: 		$user_log_details[$row['id_member']] = array($row['id_member'], $row['member_name']);
Chris@76: 	}
Chris@76: 	$smcFunc['db_free_result']($request);
Chris@76: 
Chris@76: 	if (empty($user_log_details))
Chris@76: 		return;
Chris@76: 
Chris@76: 	// Make sure they aren't trying to delete administrators if they aren't one.  But don't bother checking if it's just themself.
Chris@76: 	if (!empty($admins) && ($check_not_admin || (!allowedTo('admin_forum') && (count($users) != 1 || $users[0] != $user_info['id']))))
Chris@76: 	{
Chris@76: 		$users = array_diff($users, $admins);
Chris@76: 		foreach ($admins as $id)
Chris@76: 			unset($user_log_details[$id]);
Chris@76: 	}
Chris@76: 
Chris@76: 	// No one left?
Chris@76: 	if (empty($users))
Chris@76: 		return;
Chris@76: 
Chris@76: 	// Log the action - regardless of who is deleting it.
Chris@76: 	$log_inserts = array();
Chris@76: 	foreach ($user_log_details as $user)
Chris@76: 	{
Chris@76: 		// Integration rocks!
Chris@76: 		call_integration_hook('integrate_delete_member', array($user[0]));
Chris@76: 
Chris@76: 		// Add it to the administration log for future reference.
Chris@76: 		$log_inserts[] = array(
Chris@76: 			time(), 3, $user_info['id'], $user_info['ip'], 'delete_member',
Chris@76: 			0, 0, 0, serialize(array('member' => $user[0], 'name' => $user[1], 'member_acted' => $user_info['name'])),
Chris@76: 		);
Chris@76: 
Chris@76: 		// Remove any cached data if enabled.
Chris@76: 		if (!empty($modSettings['cache_enable']) && $modSettings['cache_enable'] >= 2)
Chris@76: 			cache_put_data('user_settings-' . $user[0], null, 60);
Chris@76: 	}
Chris@76: 
Chris@76: 	// Do the actual logging...
Chris@76: 	if (!empty($log_inserts) && !empty($modSettings['modlog_enabled']))
Chris@76: 		$smcFunc['db_insert']('',
Chris@76: 			'{db_prefix}log_actions',
Chris@76: 			array(
Chris@76: 				'log_time' => 'int', 'id_log' => 'int', 'id_member' => 'int', 'ip' => 'string-16', 'action' => 'string',
Chris@76: 				'id_board' => 'int', 'id_topic' => 'int', 'id_msg' => 'int', 'extra' => 'string-65534',
Chris@76: 			),
Chris@76: 			$log_inserts,
Chris@76: 			array('id_action')
Chris@76: 		);
Chris@76: 
Chris@76: 	// Make these peoples' posts guest posts.
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		UPDATE {db_prefix}messages
Chris@76: 		SET id_member = {int:guest_id}, poster_email = {string:blank_email}
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'guest_id' => 0,
Chris@76: 			'blank_email' => '',
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		UPDATE {db_prefix}polls
Chris@76: 		SET id_member = {int:guest_id}
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'guest_id' => 0,
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	// Make these peoples' posts guest first posts and last posts.
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		UPDATE {db_prefix}topics
Chris@76: 		SET id_member_started = {int:guest_id}
Chris@76: 		WHERE id_member_started IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'guest_id' => 0,
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		UPDATE {db_prefix}topics
Chris@76: 		SET id_member_updated = {int:guest_id}
Chris@76: 		WHERE id_member_updated IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'guest_id' => 0,
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		UPDATE {db_prefix}log_actions
Chris@76: 		SET id_member = {int:guest_id}
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'guest_id' => 0,
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		UPDATE {db_prefix}log_banned
Chris@76: 		SET id_member = {int:guest_id}
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'guest_id' => 0,
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		UPDATE {db_prefix}log_errors
Chris@76: 		SET id_member = {int:guest_id}
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'guest_id' => 0,
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	// Delete the member.
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}members
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	// Delete the logs...
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}log_actions
Chris@76: 		WHERE id_log = {int:log_type}
Chris@76: 			AND id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'log_type' => 2,
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}log_boards
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}log_comments
Chris@76: 		WHERE id_recipient IN ({array_int:users})
Chris@76: 			AND comment_type = {string:warntpl}',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 			'warntpl' => 'warntpl',
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}log_group_requests
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}log_karma
Chris@76: 		WHERE id_target IN ({array_int:users})
Chris@76: 			OR id_executor IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}log_mark_read
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}log_notify
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}log_online
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}log_subscribed
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}log_topics
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}collapsed_categories
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	// Make their votes appear as guest votes - at least it keeps the totals right.
Chris@76: 	//!!! Consider adding back in cookie protection.
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		UPDATE {db_prefix}log_polls
Chris@76: 		SET id_member = {int:guest_id}
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'guest_id' => 0,
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	// Delete personal messages.
Chris@76: 	require_once($sourcedir . '/PersonalMessage.php');
Chris@76: 	deleteMessages(null, null, $users);
Chris@76: 
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		UPDATE {db_prefix}personal_messages
Chris@76: 		SET id_member_from = {int:guest_id}
Chris@76: 		WHERE id_member_from IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'guest_id' => 0,
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	// They no longer exist, so we don't know who it was sent to.
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}pm_recipients
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	// Delete avatar.
Chris@76: 	require_once($sourcedir . '/ManageAttachments.php');
Chris@76: 	removeAttachments(array('id_member' => $users));
Chris@76: 
Chris@76: 	// It's over, no more moderation for you.
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}moderators
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}group_moderators
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	// If you don't exist we can't ban you.
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}ban_items
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	// Remove individual theme settings.
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		DELETE FROM {db_prefix}themes
Chris@76: 		WHERE id_member IN ({array_int:users})',
Chris@76: 		array(
Chris@76: 			'users' => $users,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	// These users are nobody's buddy nomore.
Chris@76: 	$request = $smcFunc['db_query']('', '
Chris@76: 		SELECT id_member, pm_ignore_list, buddy_list
Chris@76: 		FROM {db_prefix}members
Chris@76: 		WHERE FIND_IN_SET({raw:pm_ignore_list}, pm_ignore_list) != 0 OR FIND_IN_SET({raw:buddy_list}, buddy_list) != 0',
Chris@76: 		array(
Chris@76: 			'pm_ignore_list' => implode(', pm_ignore_list) != 0 OR FIND_IN_SET(', $users),
Chris@76: 			'buddy_list' => implode(', buddy_list) != 0 OR FIND_IN_SET(', $users),
Chris@76: 		)
Chris@76: 	);
Chris@76: 	while ($row = $smcFunc['db_fetch_assoc']($request))
Chris@76: 		$smcFunc['db_query']('', '
Chris@76: 			UPDATE {db_prefix}members
Chris@76: 			SET
Chris@76: 				pm_ignore_list = {string:pm_ignore_list},
Chris@76: 				buddy_list = {string:buddy_list}
Chris@76: 			WHERE id_member = {int:id_member}',
Chris@76: 			array(
Chris@76: 				'id_member' => $row['id_member'],
Chris@76: 				'pm_ignore_list' => implode(',', array_diff(explode(',', $row['pm_ignore_list']), $users)),
Chris@76: 				'buddy_list' => implode(',', array_diff(explode(',', $row['buddy_list']), $users)),
Chris@76: 			)
Chris@76: 		);
Chris@76: 	$smcFunc['db_free_result']($request);
Chris@76: 
Chris@76: 	// Make sure no member's birthday is still sticking in the calendar...
Chris@76: 	updateSettings(array(
Chris@76: 		'calendar_updated' => time(),
Chris@76: 	));
Chris@76: 
Chris@76: 	updateStats('member');
Chris@76: }
Chris@76: 
Chris@76: function registerMember(&$regOptions, $return_errors = false)
Chris@76: {
Chris@76: 	global $scripturl, $txt, $modSettings, $context, $sourcedir;
Chris@76: 	global $user_info, $options, $settings, $smcFunc;
Chris@76: 
Chris@76: 	loadLanguage('Login');
Chris@76: 
Chris@76: 	// We'll need some external functions.
Chris@76: 	require_once($sourcedir . '/Subs-Auth.php');
Chris@76: 	require_once($sourcedir . '/Subs-Post.php');
Chris@76: 
Chris@76: 	// Put any errors in here.
Chris@76: 	$reg_errors = array();
Chris@76: 
Chris@76: 	// Registration from the admin center, let them sweat a little more.
Chris@76: 	if ($regOptions['interface'] == 'admin')
Chris@76: 	{
Chris@76: 		is_not_guest();
Chris@76: 		isAllowedTo('moderate_forum');
Chris@76: 	}
Chris@76: 	// If you're an admin, you're special ;).
Chris@76: 	elseif ($regOptions['interface'] == 'guest')
Chris@76: 	{
Chris@76: 		// You cannot register twice...
Chris@76: 		if (empty($user_info['is_guest']))
Chris@76: 			redirectexit();
Chris@76: 
Chris@76: 		// Make sure they didn't just register with this session.
Chris@76: 		if (!empty($_SESSION['just_registered']) && empty($modSettings['disableRegisterCheck']))
Chris@76: 			fatal_lang_error('register_only_once', false);
Chris@76: 	}
Chris@76: 
Chris@76: 	// What method of authorization are we going to use?
Chris@76: 	if (empty($regOptions['auth_method']) || !in_array($regOptions['auth_method'], array('password', 'openid')))
Chris@76: 	{
Chris@76: 		if (!empty($regOptions['openid']))
Chris@76: 			$regOptions['auth_method'] = 'openid';
Chris@76: 		else
Chris@76: 			$regOptions['auth_method'] = 'password';
Chris@76: 	}
Chris@76: 
Chris@76: 	// No name?!  How can you register with no name?
Chris@76: 	if (empty($regOptions['username']))
Chris@76: 		$reg_errors[] = array('lang', 'need_username');
Chris@76: 
Chris@76: 	// Spaces and other odd characters are evil...
Chris@76: 	$regOptions['username'] = preg_replace('~[\t\n\r\x0B\0' . ($context['utf8'] ? ($context['server']['complex_preg_chars'] ? '\x{A0}' : "\xC2\xA0") : '\xA0') . ']+~' . ($context['utf8'] ? 'u' : ''), ' ', $regOptions['username']);
Chris@76: 
Chris@76: 	// Don't use too long a name.
Chris@76: 	if ($smcFunc['strlen']($regOptions['username']) > 25)
Chris@76: 		$reg_errors[] = array('lang', 'error_long_name');
Chris@76: 
Chris@76: 	// Only these characters are permitted.
Chris@76: 	if (preg_match('~[<>&"\'=\\\\]~', preg_replace('~&#(?:\\d{1,7}|x[0-9a-fA-F]{1,6});~', '', $regOptions['username'])) != 0 || $regOptions['username'] == '_' || $regOptions['username'] == '|' || strpos($regOptions['username'], '[code') !== false || strpos($regOptions['username'], '[/code') !== false)
Chris@76: 		$reg_errors[] = array('lang', 'error_invalid_characters_username');
Chris@76: 
Chris@76: 	if ($smcFunc['strtolower']($regOptions['username']) === $smcFunc['strtolower']($txt['guest_title']))
Chris@76: 		$reg_errors[] = array('lang', 'username_reserved', 'general', array($txt['guest_title']));
Chris@76: 
Chris@76: 	// !!! Separate the sprintf?
Chris@76: 	if (empty($regOptions['email']) || preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', $regOptions['email']) === 0 || strlen($regOptions['email']) > 255)
Chris@76: 		$reg_errors[] = array('done', sprintf($txt['valid_email_needed'], $smcFunc['htmlspecialchars']($regOptions['username'])));
Chris@76: 
Chris@76: 	if (!empty($regOptions['check_reserved_name']) && isReservedName($regOptions['username'], 0, false))
Chris@76: 	{
Chris@76: 		if ($regOptions['password'] == 'chocolate cake')
Chris@76: 			$reg_errors[] = array('done', 'Sorry, I don\'t take bribes... you\'ll need to come up with a different name.');
Chris@76: 		$reg_errors[] = array('done', '(' . htmlspecialchars($regOptions['username']) . ') ' . $txt['name_in_use']);
Chris@76: 	}
Chris@76: 
Chris@76: 	// Generate a validation code if it's supposed to be emailed.
Chris@76: 	$validation_code = '';
Chris@76: 	if ($regOptions['require'] == 'activation')
Chris@76: 		$validation_code = generateValidationCode();
Chris@76: 
Chris@76: 	// If you haven't put in a password generate one.
Chris@76: 	if ($regOptions['interface'] == 'admin' && $regOptions['password'] == '' && $regOptions['auth_method'] == 'password')
Chris@76: 	{
Chris@76: 		mt_srand(time() + 1277);
Chris@76: 		$regOptions['password'] = generateValidationCode();
Chris@76: 		$regOptions['password_check'] = $regOptions['password'];
Chris@76: 	}
Chris@76: 	// Does the first password match the second?
Chris@76: 	elseif ($regOptions['password'] != $regOptions['password_check'] && $regOptions['auth_method'] == 'password')
Chris@76: 		$reg_errors[] = array('lang', 'passwords_dont_match');
Chris@76: 
Chris@76: 	// That's kind of easy to guess...
Chris@76: 	if ($regOptions['password'] == '')
Chris@76: 	{
Chris@76: 		if ($regOptions['auth_method'] == 'password')
Chris@76: 			$reg_errors[] = array('lang', 'no_password');
Chris@76: 		else
Chris@76: 			$regOptions['password'] = sha1(mt_rand());
Chris@76: 	}
Chris@76: 
Chris@76: 	// Now perform hard password validation as required.
Chris@76: 	if (!empty($regOptions['check_password_strength']))
Chris@76: 	{
Chris@76: 		$passwordError = validatePassword($regOptions['password'], $regOptions['username'], array($regOptions['email']));
Chris@76: 
Chris@76: 		// Password isn't legal?
Chris@76: 		if ($passwordError != null)
Chris@76: 			$reg_errors[] = array('lang', 'profile_error_password_' . $passwordError);
Chris@76: 	}
Chris@76: 
Chris@76: 	// If they are using an OpenID that hasn't been verified yet error out.
Chris@76: 	// !!! Change this so they can register without having to attempt a login first
Chris@76: 	if ($regOptions['auth_method'] == 'openid' && (empty($_SESSION['openid']['verified']) || $_SESSION['openid']['openid_uri'] != $regOptions['openid']))
Chris@76: 		$reg_errors[] = array('lang', 'openid_not_verified');
Chris@76: 
Chris@76: 	// You may not be allowed to register this email.
Chris@76: 	if (!empty($regOptions['check_email_ban']))
Chris@76: 		isBannedEmail($regOptions['email'], 'cannot_register', $txt['ban_register_prohibited']);
Chris@76: 
Chris@76: 	// Check if the email address is in use.
Chris@76: 	$request = $smcFunc['db_query']('', '
Chris@76: 		SELECT id_member
Chris@76: 		FROM {db_prefix}members
Chris@76: 		WHERE email_address = {string:email_address}
Chris@76: 			OR email_address = {string:username}
Chris@76: 		LIMIT 1',
Chris@76: 		array(
Chris@76: 			'email_address' => $regOptions['email'],
Chris@76: 			'username' => $regOptions['username'],
Chris@76: 		)
Chris@76: 	);
Chris@76: 	// !!! Separate the sprintf?
Chris@76: 	if ($smcFunc['db_num_rows']($request) != 0)
Chris@76: 		$reg_errors[] = array('lang', 'email_in_use', false, array(htmlspecialchars($regOptions['email'])));
Chris@76: 	$smcFunc['db_free_result']($request);
Chris@76: 
Chris@76: 	// If we found any errors we need to do something about it right away!
Chris@76: 	foreach ($reg_errors as $key => $error)
Chris@76: 	{
Chris@76: 		/* Note for each error:
Chris@76: 			0 = 'lang' if it's an index, 'done' if it's clear text.
Chris@76: 			1 = The text/index.
Chris@76: 			2 = Whether to log.
Chris@76: 			3 = sprintf data if necessary. */
Chris@76: 		if ($error[0] == 'lang')
Chris@76: 			loadLanguage('Errors');
Chris@76: 		$message = $error[0] == 'lang' ? (empty($error[3]) ? $txt[$error[1]] : vsprintf($txt[$error[1]], $error[3])) : $error[1];
Chris@76: 
Chris@76: 		// What to do, what to do, what to do.
Chris@76: 		if ($return_errors)
Chris@76: 		{
Chris@76: 			if (!empty($error[2]))
Chris@76: 				log_error($message, $error[2]);
Chris@76: 			$reg_errors[$key] = $message;
Chris@76: 		}
Chris@76: 		else
Chris@76: 			fatal_error($message, empty($error[2]) ? false : $error[2]);
Chris@76: 	}
Chris@76: 
Chris@76: 	// If there's any errors left return them at once!
Chris@76: 	if (!empty($reg_errors))
Chris@76: 		return $reg_errors;
Chris@76: 
Chris@76: 	$reservedVars = array(
Chris@76: 		'actual_theme_url',
Chris@76: 		'actual_images_url',
Chris@76: 		'base_theme_dir',
Chris@76: 		'base_theme_url',
Chris@76: 		'default_images_url',
Chris@76: 		'default_theme_dir',
Chris@76: 		'default_theme_url',
Chris@76: 		'default_template',
Chris@76: 		'images_url',
Chris@76: 		'number_recent_posts',
Chris@76: 		'smiley_sets_default',
Chris@76: 		'theme_dir',
Chris@76: 		'theme_id',
Chris@76: 		'theme_layers',
Chris@76: 		'theme_templates',
Chris@76: 		'theme_url',
Chris@76: 	);
Chris@76: 
Chris@76: 	// Can't change reserved vars.
Chris@76: 	if (isset($regOptions['theme_vars']) && array_intersect($regOptions['theme_vars'], $reservedVars) != array())
Chris@76: 		fatal_lang_error('no_theme');
Chris@76: 
Chris@76: 	// Some of these might be overwritten. (the lower ones that are in the arrays below.)
Chris@76: 	$regOptions['register_vars'] = array(
Chris@76: 		'member_name' => $regOptions['username'],
Chris@76: 		'email_address' => $regOptions['email'],
Chris@76: 		'passwd' => sha1(strtolower($regOptions['username']) . $regOptions['password']),
Chris@76: 		'password_salt' => substr(md5(mt_rand()), 0, 4) ,
Chris@76: 		'posts' => 0,
Chris@76: 		'date_registered' => time(),
Chris@76: 		'member_ip' => $regOptions['interface'] == 'admin' ? '127.0.0.1' : $user_info['ip'],
Chris@76: 		'member_ip2' => $regOptions['interface'] == 'admin' ? '127.0.0.1' : $_SERVER['BAN_CHECK_IP'],
Chris@76: 		'validation_code' => $validation_code,
Chris@76: 		'real_name' => $regOptions['username'],
Chris@76: 		'personal_text' => $modSettings['default_personal_text'],
Chris@76: 		'pm_email_notify' => 1,
Chris@76: 		'id_theme' => 0,
Chris@76: 		'id_post_group' => 4,
Chris@76: 		'lngfile' => '',
Chris@76: 		'buddy_list' => '',
Chris@76: 		'pm_ignore_list' => '',
Chris@76: 		'message_labels' => '',
Chris@76: 		'website_title' => '',
Chris@76: 		'website_url' => '',
Chris@76: 		'location' => '',
Chris@76: 		'icq' => '',
Chris@76: 		'aim' => '',
Chris@76: 		'yim' => '',
Chris@76: 		'msn' => '',
Chris@76: 		'time_format' => '',
Chris@76: 		'signature' => '',
Chris@76: 		'avatar' => '',
Chris@76: 		'usertitle' => '',
Chris@76: 		'secret_question' => '',
Chris@76: 		'secret_answer' => '',
Chris@76: 		'additional_groups' => '',
Chris@76: 		'ignore_boards' => '',
Chris@76: 		'smiley_set' => '',
Chris@76: 		'openid_uri' => (!empty($regOptions['openid']) ? $regOptions['openid'] : ''),
Chris@76: 	);
Chris@76: 
Chris@76: 	// Setup the activation status on this new account so it is correct - firstly is it an under age account?
Chris@76: 	if ($regOptions['require'] == 'coppa')
Chris@76: 	{
Chris@76: 		$regOptions['register_vars']['is_activated'] = 5;
Chris@76: 		// !!! This should be changed.  To what should be it be changed??
Chris@76: 		$regOptions['register_vars']['validation_code'] = '';
Chris@76: 	}
Chris@76: 	// Maybe it can be activated right away?
Chris@76: 	elseif ($regOptions['require'] == 'nothing')
Chris@76: 		$regOptions['register_vars']['is_activated'] = 1;
Chris@76: 	// Maybe it must be activated by email?
Chris@76: 	elseif ($regOptions['require'] == 'activation')
Chris@76: 		$regOptions['register_vars']['is_activated'] = 0;
Chris@76: 	// Otherwise it must be awaiting approval!
Chris@76: 	else
Chris@76: 		$regOptions['register_vars']['is_activated'] = 3;
Chris@76: 
Chris@76: 	if (isset($regOptions['memberGroup']))
Chris@76: 	{
Chris@76: 		// Make sure the id_group will be valid, if this is an administator.
Chris@76: 		$regOptions['register_vars']['id_group'] = $regOptions['memberGroup'] == 1 && !allowedTo('admin_forum') ? 0 : $regOptions['memberGroup'];
Chris@76: 
Chris@76: 		// Check if this group is assignable.
Chris@76: 		$unassignableGroups = array(-1, 3);
Chris@76: 		$request = $smcFunc['db_query']('', '
Chris@76: 			SELECT id_group
Chris@76: 			FROM {db_prefix}membergroups
Chris@76: 			WHERE min_posts != {int:min_posts}' . (allowedTo('admin_forum') ? '' : '
Chris@76: 				OR group_type = {int:is_protected}'),
Chris@76: 			array(
Chris@76: 				'min_posts' => -1,
Chris@76: 				'is_protected' => 1,
Chris@76: 			)
Chris@76: 		);
Chris@76: 		while ($row = $smcFunc['db_fetch_assoc']($request))
Chris@76: 			$unassignableGroups[] = $row['id_group'];
Chris@76: 		$smcFunc['db_free_result']($request);
Chris@76: 
Chris@76: 		if (in_array($regOptions['register_vars']['id_group'], $unassignableGroups))
Chris@76: 			$regOptions['register_vars']['id_group'] = 0;
Chris@76: 	}
Chris@76: 
Chris@76: 	// ICQ cannot be zero.
Chris@76: 	if (isset($regOptions['extra_register_vars']['icq']) && empty($regOptions['extra_register_vars']['icq']))
Chris@76: 		$regOptions['extra_register_vars']['icq'] = '';
Chris@76: 
Chris@76: 	// Integrate optional member settings to be set.
Chris@76: 	if (!empty($regOptions['extra_register_vars']))
Chris@76: 		foreach ($regOptions['extra_register_vars'] as $var => $value)
Chris@76: 			$regOptions['register_vars'][$var] = $value;
Chris@76: 
Chris@76: 	// Integrate optional user theme options to be set.
Chris@76: 	$theme_vars = array();
Chris@76: 	if (!empty($regOptions['theme_vars']))
Chris@76: 		foreach ($regOptions['theme_vars'] as $var => $value)
Chris@76: 			$theme_vars[$var] = $value;
Chris@76: 
Chris@76: 	// Call an optional function to validate the users' input.
Chris@76: 	call_integration_hook('integrate_register', array(&$regOptions, &$theme_vars));
Chris@76: 
Chris@76: 	// Right, now let's prepare for insertion.
Chris@76: 	$knownInts = array(
Chris@76: 		'date_registered', 'posts', 'id_group', 'last_login', 'instant_messages', 'unread_messages',
Chris@76: 		'new_pm', 'pm_prefs', 'gender', 'hide_email', 'show_online', 'pm_email_notify', 'karma_good', 'karma_bad',
Chris@76: 		'notify_announcements', 'notify_send_body', 'notify_regularity', 'notify_types',
Chris@76: 		'id_theme', 'is_activated', 'id_msg_last_visit', 'id_post_group', 'total_time_logged_in', 'warning',
Chris@76: 	);
Chris@76: 	$knownFloats = array(
Chris@76: 		'time_offset',
Chris@76: 	);
Chris@76: 
Chris@76: 	$column_names = array();
Chris@76: 	$values = array();
Chris@76: 	foreach ($regOptions['register_vars'] as $var => $val)
Chris@76: 	{
Chris@76: 		$type = 'string';
Chris@76: 		if (in_array($var, $knownInts))
Chris@76: 			$type = 'int';
Chris@76: 		elseif (in_array($var, $knownFloats))
Chris@76: 			$type = 'float';
Chris@76: 		elseif ($var == 'birthdate')
Chris@76: 			$type = 'date';
Chris@76: 
Chris@76: 		$column_names[$var] = $type;
Chris@76: 		$values[$var] = $val;
Chris@76: 	}
Chris@76: 
Chris@76: 	// Register them into the database.
Chris@76: 	$smcFunc['db_insert']('',
Chris@76: 		'{db_prefix}members',
Chris@76: 		$column_names,
Chris@76: 		$values,
Chris@76: 		array('id_member')
Chris@76: 	);
Chris@76: 	$memberID = $smcFunc['db_insert_id']('{db_prefix}members', 'id_member');
Chris@76: 
Chris@76: 	// Update the number of members and latest member's info - and pass the name, but remove the 's.
Chris@76: 	if ($regOptions['register_vars']['is_activated'] == 1)
Chris@76: 		updateStats('member', $memberID, $regOptions['register_vars']['real_name']);
Chris@76: 	else
Chris@76: 		updateStats('member');
Chris@76: 
Chris@76: 	// Theme variables too?
Chris@76: 	if (!empty($theme_vars))
Chris@76: 	{
Chris@76: 		$inserts = array();
Chris@76: 		foreach ($theme_vars as $var => $val)
Chris@76: 			$inserts[] = array($memberID, $var, $val);
Chris@76: 		$smcFunc['db_insert']('insert',
Chris@76: 			'{db_prefix}themes',
Chris@76: 			array('id_member' => 'int', 'variable' => 'string-255', 'value' => 'string-65534'),
Chris@76: 			$inserts,
Chris@76: 			array('id_member', 'variable')
Chris@76: 		);
Chris@76: 	}
Chris@76: 
Chris@76: 	// If it's enabled, increase the registrations for today.
Chris@76: 	trackStats(array('registers' => '+'));
Chris@76: 
Chris@76: 	// Administrative registrations are a bit different...
Chris@76: 	if ($regOptions['interface'] == 'admin')
Chris@76: 	{
Chris@76: 		if ($regOptions['require'] == 'activation')
Chris@76: 			$email_message = 'admin_register_activate';
Chris@76: 		elseif (!empty($regOptions['send_welcome_email']))
Chris@76: 			$email_message = 'admin_register_immediate';
Chris@76: 
Chris@76: 		if (isset($email_message))
Chris@76: 		{
Chris@76: 			$replacements = array(
Chris@76: 				'REALNAME' => $regOptions['register_vars']['real_name'],
Chris@76: 				'USERNAME' => $regOptions['username'],
Chris@76: 				'PASSWORD' => $regOptions['password'],
Chris@76: 				'FORGOTPASSWORDLINK' => $scripturl . '?action=reminder',
Chris@76: 				'ACTIVATIONLINK' => $scripturl . '?action=activate;u=' . $memberID . ';code=' . $validation_code,
Chris@76: 				'ACTIVATIONLINKWITHOUTCODE' => $scripturl . '?action=activate;u=' . $memberID,
Chris@76: 				'ACTIVATIONCODE' => $validation_code,
Chris@76: 			);
Chris@76: 
Chris@76: 			$emaildata = loadEmailTemplate($email_message, $replacements);
Chris@76: 
Chris@76: 			sendmail($regOptions['email'], $emaildata['subject'], $emaildata['body'], null, null, false, 0);
Chris@76: 		}
Chris@76: 
Chris@76: 		// All admins are finished here.
Chris@76: 		return $memberID;
Chris@76: 	}
Chris@76: 
Chris@76: 	// Can post straight away - welcome them to your fantastic community...
Chris@76: 	if ($regOptions['require'] == 'nothing')
Chris@76: 	{
Chris@76: 		if (!empty($regOptions['send_welcome_email']))
Chris@76: 		{
Chris@76: 			$replacements = array(
Chris@76: 				'REALNAME' => $regOptions['register_vars']['real_name'],
Chris@76: 				'USERNAME' => $regOptions['username'],
Chris@76: 				'PASSWORD' => $regOptions['password'],
Chris@76: 				'FORGOTPASSWORDLINK' => $scripturl . '?action=reminder',
Chris@76: 				'OPENID' => !empty($regOptions['openid']) ? $regOptions['openid'] : '',
Chris@76: 			);
Chris@76: 			$emaildata = loadEmailTemplate('register_' . ($regOptions['auth_method'] == 'openid' ? 'openid_' : '') . 'immediate', $replacements);
Chris@76: 			sendmail($regOptions['email'], $emaildata['subject'], $emaildata['body'], null, null, false, 0);
Chris@76: 		}
Chris@76: 
Chris@76: 		// Send admin their notification.
Chris@76: 		adminNotify('standard', $memberID, $regOptions['username']);
Chris@76: 	}
Chris@76: 	// Need to activate their account - or fall under COPPA.
Chris@76: 	elseif ($regOptions['require'] == 'activation' || $regOptions['require'] == 'coppa')
Chris@76: 	{
Chris@76: 		$replacements = array(
Chris@76: 			'REALNAME' => $regOptions['register_vars']['real_name'],
Chris@76: 			'USERNAME' => $regOptions['username'],
Chris@76: 			'PASSWORD' => $regOptions['password'],
Chris@76: 			'FORGOTPASSWORDLINK' => $scripturl . '?action=reminder',
Chris@76: 			'OPENID' => !empty($regOptions['openid']) ? $regOptions['openid'] : '',
Chris@76: 		);
Chris@76: 
Chris@76: 		if ($regOptions['require'] == 'activation')
Chris@76: 			$replacements += array(
Chris@76: 				'ACTIVATIONLINK' => $scripturl . '?action=activate;u=' . $memberID . ';code=' . $validation_code,
Chris@76: 				'ACTIVATIONLINKWITHOUTCODE' => $scripturl . '?action=activate;u=' . $memberID,
Chris@76: 				'ACTIVATIONCODE' => $validation_code,
Chris@76: 			);
Chris@76: 		else
Chris@76: 			$replacements += array(
Chris@76: 				'COPPALINK' => $scripturl . '?action=coppa;u=' . $memberID,
Chris@76: 			);
Chris@76: 
Chris@76: 		$emaildata = loadEmailTemplate('register_' . ($regOptions['auth_method'] == 'openid' ? 'openid_' : '') . ($regOptions['require'] == 'activation' ? 'activate' : 'coppa'), $replacements);
Chris@76: 
Chris@76: 		sendmail($regOptions['email'], $emaildata['subject'], $emaildata['body'], null, null, false, 0);
Chris@76: 	}
Chris@76: 	// Must be awaiting approval.
Chris@76: 	else
Chris@76: 	{
Chris@76: 		$replacements = array(
Chris@76: 			'REALNAME' => $regOptions['register_vars']['real_name'],
Chris@76: 			'USERNAME' => $regOptions['username'],
Chris@76: 			'PASSWORD' => $regOptions['password'],
Chris@76: 			'FORGOTPASSWORDLINK' => $scripturl . '?action=reminder',
Chris@76: 			'OPENID' => !empty($regOptions['openid']) ? $regOptions['openid'] : '',
Chris@76: 		);
Chris@76: 
Chris@76: 		$emaildata = loadEmailTemplate('register_' . ($regOptions['auth_method'] == 'openid' ? 'openid_' : '') . 'pending', $replacements);
Chris@76: 
Chris@76: 		sendmail($regOptions['email'], $emaildata['subject'], $emaildata['body'], null, null, false, 0);
Chris@76: 
Chris@76: 		// Admin gets informed here...
Chris@77: 		adminNotify('approval', $memberID, $regOptions['username'], $regOptions['justify']);
Chris@76: 	}
Chris@76: 
Chris@76: 	// Okay, they're for sure registered... make sure the session is aware of this for security. (Just married :P!)
Chris@76: 	$_SESSION['just_registered'] = 1;
Chris@76: 
Chris@76: 	return $memberID;
Chris@76: }
Chris@76: 
Chris@76: // Check if a name is in the reserved words list. (name, current member id, name/username?.)
Chris@76: function isReservedName($name, $current_ID_MEMBER = 0, $is_name = true, $fatal = true)
Chris@76: {
Chris@76: 	global $user_info, $modSettings, $smcFunc, $context;
Chris@76: 
Chris@76: 	// No cheating with entities please.
Chris@76: 	$replaceEntities = create_function('$string', '
Chris@76: 		$num = substr($string, 0, 1) === \'x\' ? hexdec(substr($string, 1)) : (int) $string;
Chris@76: 		if ($num === 0x202E || $num === 0x202D) return \'\'; if (in_array($num, array(0x22, 0x26, 0x27, 0x3C, 0x3E))) return \'&#\' . $num . \';\';' .
Chris@76: 		(empty($context['utf8']) ? 'return $num < 0x20 ? \'\' : ($num < 0x80 ? chr($num) : \'&#\' . $string . \';\');' : '
Chris@76: 		return $num < 0x20 || $num > 0x10FFFF || ($num >= 0xD800 && $num <= 0xDFFF) ? \'\' : ($num < 0x80 ? chr($num) : ($num < 0x800 ? chr(192 | $num >> 6) . chr(128 | $num & 63) : ($num < 0x10000 ? chr(224 | $num >> 12) . chr(128 | $num >> 6 & 63) . chr(128 | $num & 63) : chr(240 | $num >> 18) . chr(128 | $num >> 12 & 63) . chr(128 | $num >> 6 & 63) . chr(128 | $num & 63))));')
Chris@76: 	);
Chris@76: 
Chris@76: 	$name = preg_replace('~(&#(\d{1,7}|x[0-9a-fA-F]{1,6});)~e', '$replaceEntities(\'\\2\')', $name);
Chris@76: 	$checkName = $smcFunc['strtolower']($name);
Chris@76: 
Chris@76: 	// Administrators are never restricted ;).
Chris@76: 	if (!allowedTo('moderate_forum') && ((!empty($modSettings['reserveName']) && $is_name) || !empty($modSettings['reserveUser']) && !$is_name))
Chris@76: 	{
Chris@76: 		$reservedNames = explode("\n", $modSettings['reserveNames']);
Chris@76: 		// Case sensitive check?
Chris@76: 		$checkMe = empty($modSettings['reserveCase']) ? $checkName : $name;
Chris@76: 
Chris@76: 		// Check each name in the list...
Chris@76: 		foreach ($reservedNames as $reserved)
Chris@76: 		{
Chris@76: 			if ($reserved == '')
Chris@76: 				continue;
Chris@76: 
Chris@76: 			// The admin might've used entities too, level the playing field.
Chris@76: 			$reservedCheck = preg_replace('~(&#(\d{1,7}|x[0-9a-fA-F]{1,6});)~e', '$replaceEntities(\'\\2\')', $reserved);
Chris@76: 
Chris@76: 			// Case sensitive name?
Chris@76: 			if (empty($modSettings['reserveCase']))
Chris@76: 				$reservedCheck = $smcFunc['strtolower']($reservedCheck);
Chris@76: 
Chris@76: 			// If it's not just entire word, check for it in there somewhere...
Chris@76: 			if ($checkMe == $reservedCheck || ($smcFunc['strpos']($checkMe, $reservedCheck) !== false && empty($modSettings['reserveWord'])))
Chris@76: 				if ($fatal)
Chris@76: 					fatal_lang_error('username_reserved', 'password', array($reserved));
Chris@76: 				else
Chris@76: 					return true;
Chris@76: 		}
Chris@76: 
Chris@76: 		$censor_name = $name;
Chris@76: 		if (censorText($censor_name) != $name)
Chris@76: 			if ($fatal)
Chris@76: 				fatal_lang_error('name_censored', 'password', array($name));
Chris@76: 			else
Chris@76: 				return true;
Chris@76: 	}
Chris@76: 
Chris@76: 	// Characters we just shouldn't allow, regardless.
Chris@76: 	foreach (array('*') as $char)
Chris@76: 		if (strpos($checkName, $char) !== false)
Chris@76: 			if ($fatal)
Chris@76: 				fatal_lang_error('username_reserved', 'password', array($char));
Chris@76: 			else
Chris@76: 				return true;
Chris@76: 
Chris@76: 	// Get rid of any SQL parts of the reserved name...
Chris@76: 	$checkName = strtr($name, array('_' => '\\_', '%' => '\\%'));
Chris@76: 
Chris@76: 	// Make sure they don't want someone else's name.
Chris@76: 	$request = $smcFunc['db_query']('', '
Chris@76: 		SELECT id_member
Chris@76: 		FROM {db_prefix}members
Chris@76: 		WHERE ' . (empty($current_ID_MEMBER) ? '' : 'id_member != {int:current_member}
Chris@76: 			AND ') . '(real_name LIKE {string:check_name} OR member_name LIKE {string:check_name})
Chris@76: 		LIMIT 1',
Chris@76: 		array(
Chris@76: 			'current_member' => $current_ID_MEMBER,
Chris@76: 			'check_name' => $checkName,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	if ($smcFunc['db_num_rows']($request) > 0)
Chris@76: 	{
Chris@76: 		$smcFunc['db_free_result']($request);
Chris@76: 		return true;
Chris@76: 	}
Chris@76: 
Chris@76: 	// Does name case insensitive match a member group name?
Chris@76: 	$request = $smcFunc['db_query']('', '
Chris@76: 		SELECT id_group
Chris@76: 		FROM {db_prefix}membergroups
Chris@76: 		WHERE group_name LIKE {string:check_name}
Chris@76: 		LIMIT 1',
Chris@76: 		array(
Chris@76: 			'check_name' => $checkName,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	if ($smcFunc['db_num_rows']($request) > 0)
Chris@76: 	{
Chris@76: 		$smcFunc['db_free_result']($request);
Chris@76: 		return true;
Chris@76: 	}
Chris@76: 
Chris@76: 	// Okay, they passed.
Chris@76: 	return false;
Chris@76: }
Chris@76: 
Chris@76: // Get a list of groups that have a given permission (on a given board).
Chris@76: function groupsAllowedTo($permission, $board_id = null)
Chris@76: {
Chris@76: 	global $modSettings, $board_info, $smcFunc;
Chris@76: 
Chris@76: 	// Admins are allowed to do anything.
Chris@76: 	$member_groups = array(
Chris@76: 		'allowed' => array(1),
Chris@76: 		'denied' => array(),
Chris@76: 	);
Chris@76: 
Chris@76: 	// Assume we're dealing with regular permissions (like profile_view_own).
Chris@76: 	if ($board_id === null)
Chris@76: 	{
Chris@76: 		$request = $smcFunc['db_query']('', '
Chris@76: 			SELECT id_group, add_deny
Chris@76: 			FROM {db_prefix}permissions
Chris@76: 			WHERE permission = {string:permission}',
Chris@76: 			array(
Chris@76: 				'permission' => $permission,
Chris@76: 			)
Chris@76: 		);
Chris@76: 		while ($row = $smcFunc['db_fetch_assoc']($request))
Chris@76: 			$member_groups[$row['add_deny'] === '1' ? 'allowed' : 'denied'][] = $row['id_group'];
Chris@76: 		$smcFunc['db_free_result']($request);
Chris@76: 	}
Chris@76: 
Chris@76: 	// Otherwise it's time to look at the board.
Chris@76: 	else
Chris@76: 	{
Chris@76: 		// First get the profile of the given board.
Chris@76: 		if (isset($board_info['id']) && $board_info['id'] == $board_id)
Chris@76: 			$profile_id = $board_info['profile'];
Chris@76: 		elseif ($board_id !== 0)
Chris@76: 		{
Chris@76: 			$request = $smcFunc['db_query']('', '
Chris@76: 				SELECT id_profile
Chris@76: 				FROM {db_prefix}boards
Chris@76: 				WHERE id_board = {int:id_board}
Chris@76: 				LIMIT 1',
Chris@76: 				array(
Chris@76: 					'id_board' => $board_id,
Chris@76: 				)
Chris@76: 			);
Chris@76: 			if ($smcFunc['db_num_rows']($request) == 0)
Chris@76: 				fatal_lang_error('no_board');
Chris@76: 			list ($profile_id) = $smcFunc['db_fetch_row']($request);
Chris@76: 			$smcFunc['db_free_result']($request);
Chris@76: 		}
Chris@76: 		else
Chris@76: 			$profile_id = 1;
Chris@76: 
Chris@76: 		$request = $smcFunc['db_query']('', '
Chris@76: 			SELECT bp.id_group, bp.add_deny
Chris@76: 			FROM {db_prefix}board_permissions AS bp
Chris@76: 			WHERE bp.permission = {string:permission}
Chris@76: 				AND bp.id_profile = {int:profile_id}',
Chris@76: 			array(
Chris@76: 				'profile_id' => $profile_id,
Chris@76: 				'permission' => $permission,
Chris@76: 			)
Chris@76: 		);
Chris@76: 		while ($row = $smcFunc['db_fetch_assoc']($request))
Chris@76: 			$member_groups[$row['add_deny'] === '1' ? 'allowed' : 'denied'][] = $row['id_group'];
Chris@76: 		$smcFunc['db_free_result']($request);
Chris@76: 	}
Chris@76: 
Chris@76: 	// Denied is never allowed.
Chris@76: 	$member_groups['allowed'] = array_diff($member_groups['allowed'], $member_groups['denied']);
Chris@76: 
Chris@76: 	return $member_groups;
Chris@76: }
Chris@76: 
Chris@76: // Get a list of members that have a given permission (on a given board).
Chris@76: function membersAllowedTo($permission, $board_id = null)
Chris@76: {
Chris@76: 	global $smcFunc;
Chris@76: 
Chris@76: 	$member_groups = groupsAllowedTo($permission, $board_id);
Chris@76: 
Chris@76: 	$include_moderators = in_array(3, $member_groups['allowed']) && $board_id !== null;
Chris@76: 	$member_groups['allowed'] = array_diff($member_groups['allowed'], array(3));
Chris@76: 
Chris@76: 	$exclude_moderators = in_array(3, $member_groups['denied']) && $board_id !== null;
Chris@76: 	$member_groups['denied'] = array_diff($member_groups['denied'], array(3));
Chris@76: 
Chris@76: 	$request = $smcFunc['db_query']('', '
Chris@76: 		SELECT mem.id_member
Chris@76: 		FROM {db_prefix}members AS mem' . ($include_moderators || $exclude_moderators ? '
Chris@76: 			LEFT JOIN {db_prefix}moderators AS mods ON (mods.id_member = mem.id_member AND mods.id_board = {int:board_id})' : '') . '
Chris@76: 		WHERE (' . ($include_moderators ? 'mods.id_member IS NOT NULL OR ' : '') . 'mem.id_group IN ({array_int:member_groups_allowed}) OR FIND_IN_SET({raw:member_group_allowed_implode}, mem.additional_groups) != 0)' . (empty($member_groups['denied']) ? '' : '
Chris@76: 			AND NOT (' . ($exclude_moderators ? 'mods.id_member IS NOT NULL OR ' : '') . 'mem.id_group IN ({array_int:member_groups_denied}) OR FIND_IN_SET({raw:member_group_denied_implode}, mem.additional_groups) != 0)'),
Chris@76: 		array(
Chris@76: 			'member_groups_allowed' => $member_groups['allowed'],
Chris@76: 			'member_groups_denied' => $member_groups['denied'],
Chris@76: 			'board_id' => $board_id,
Chris@76: 			'member_group_allowed_implode' => implode(', mem.additional_groups) != 0 OR FIND_IN_SET(', $member_groups['allowed']),
Chris@76: 			'member_group_denied_implode' => implode(', mem.additional_groups) != 0 OR FIND_IN_SET(', $member_groups['denied']),
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$members = array();
Chris@76: 	while ($row = $smcFunc['db_fetch_assoc']($request))
Chris@76: 		$members[] = $row['id_member'];
Chris@76: 	$smcFunc['db_free_result']($request);
Chris@76: 
Chris@76: 	return $members;
Chris@76: }
Chris@76: 
Chris@76: // This function is used to reassociate members with relevant posts.
Chris@76: function reattributePosts($memID, $email = false, $membername = false, $post_count = false)
Chris@76: {
Chris@76: 	global $smcFunc;
Chris@76: 
Chris@76: 	// Firstly, if email and username aren't passed find out the members email address and name.
Chris@76: 	if ($email === false && $membername === false)
Chris@76: 	{
Chris@76: 		$request = $smcFunc['db_query']('', '
Chris@76: 			SELECT email_address, member_name
Chris@76: 			FROM {db_prefix}members
Chris@76: 			WHERE id_member = {int:memID}
Chris@76: 			LIMIT 1',
Chris@76: 			array(
Chris@76: 				'memID' => $memID,
Chris@76: 			)
Chris@76: 		);
Chris@76: 		list ($email, $membername) = $smcFunc['db_fetch_row']($request);
Chris@76: 		$smcFunc['db_free_result']($request);
Chris@76: 	}
Chris@76: 
Chris@76: 	// If they want the post count restored then we need to do some research.
Chris@76: 	if ($post_count)
Chris@76: 	{
Chris@76: 		$request = $smcFunc['db_query']('', '
Chris@76: 			SELECT COUNT(*)
Chris@76: 			FROM {db_prefix}messages AS m
Chris@76: 				INNER JOIN {db_prefix}boards AS b ON (b.id_board = m.id_board AND b.count_posts = {int:count_posts})
Chris@76: 			WHERE m.id_member = {int:guest_id}
Chris@76: 				AND m.approved = {int:is_approved}
Chris@76: 				AND m.icon != {string:recycled_icon}' . (empty($email) ? '' : '
Chris@76: 				AND m.poster_email = {string:email_address}') . (empty($membername) ? '' : '
Chris@76: 				AND m.poster_name = {string:member_name}'),
Chris@76: 			array(
Chris@76: 				'count_posts' => 0,
Chris@76: 				'guest_id' => 0,
Chris@76: 				'email_address' => $email,
Chris@76: 				'member_name' => $membername,
Chris@76: 				'is_approved' => 1,
Chris@76: 				'recycled_icon' => 'recycled',
Chris@76: 			)
Chris@76: 		);
Chris@76: 		list ($messageCount) = $smcFunc['db_fetch_row']($request);
Chris@76: 		$smcFunc['db_free_result']($request);
Chris@76: 
Chris@76: 		updateMemberData($memID, array('posts' => 'posts + ' . $messageCount));
Chris@76: 	}
Chris@76: 
Chris@76: 	$query_parts = array();
Chris@76: 	if (!empty($email))
Chris@76: 		$query_parts[] = 'poster_email = {string:email_address}';
Chris@76: 	if (!empty($membername))
Chris@76: 		$query_parts[] = 'poster_name = {string:member_name}';
Chris@76: 	$query = implode(' AND ', $query_parts);
Chris@76: 
Chris@76: 	// Finally, update the posts themselves!
Chris@76: 	$smcFunc['db_query']('', '
Chris@76: 		UPDATE {db_prefix}messages
Chris@76: 		SET id_member = {int:memID}
Chris@76: 		WHERE ' . $query,
Chris@76: 		array(
Chris@76: 			'memID' => $memID,
Chris@76: 			'email_address' => $email,
Chris@76: 			'member_name' => $membername,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	return $smcFunc['db_affected_rows']();
Chris@76: }
Chris@76: 
Chris@76: // This simple function adds/removes the passed user from the current users buddy list.
Chris@76: function BuddyListToggle()
Chris@76: {
Chris@76: 	global $user_info;
Chris@76: 
Chris@76: 	checkSession('get');
Chris@76: 
Chris@76: 	isAllowedTo('profile_identity_own');
Chris@76: 	is_not_guest();
Chris@76: 
Chris@76: 	if (empty($_REQUEST['u']))
Chris@76: 		fatal_lang_error('no_access', false);
Chris@76: 	$_REQUEST['u'] = (int) $_REQUEST['u'];
Chris@76: 
Chris@76: 	// Remove if it's already there...
Chris@76: 	if (in_array($_REQUEST['u'], $user_info['buddies']))
Chris@76: 		$user_info['buddies'] = array_diff($user_info['buddies'], array($_REQUEST['u']));
Chris@76: 	// ...or add if it's not and if it's not you.
Chris@76: 	elseif ($user_info['id'] != $_REQUEST['u'])
Chris@76: 		$user_info['buddies'][] = (int) $_REQUEST['u'];
Chris@76: 
Chris@76: 	// Update the settings.
Chris@76: 	updateMemberData($user_info['id'], array('buddy_list' => implode(',', $user_info['buddies'])));
Chris@76: 
Chris@76: 	// Redirect back to the profile
Chris@76: 	redirectexit('action=profile;u=' . $_REQUEST['u']);
Chris@76: }
Chris@76: 
Chris@76: function list_getMembers($start, $items_per_page, $sort, $where, $where_params = array(), $get_duplicates = false)
Chris@76: {
Chris@76: 	global $smcFunc;
Chris@76: 
Chris@76: 	$request = $smcFunc['db_query']('', '
Chris@76: 		SELECT
Chris@76: 			mem.id_member, mem.member_name, mem.real_name, mem.email_address, mem.icq, mem.aim, mem.yim, mem.msn, mem.member_ip, mem.member_ip2, mem.last_login,
Chris@76: 			mem.posts, mem.is_activated, mem.date_registered, mem.id_group, mem.additional_groups, mg.group_name
Chris@76: 		FROM {db_prefix}members AS mem
Chris@76: 			LEFT JOIN {db_prefix}membergroups AS mg ON (mg.id_group = mem.id_group)
Chris@76: 		WHERE ' . $where . '
Chris@76: 		ORDER BY {raw:sort}
Chris@76: 		LIMIT {int:start}, {int:per_page}',
Chris@76: 		array_merge($where_params, array(
Chris@76: 			'sort' => $sort,
Chris@76: 			'start' => $start,
Chris@76: 			'per_page' => $items_per_page,
Chris@76: 		))
Chris@76: 	);
Chris@76: 
Chris@76: 	$members = array();
Chris@76: 	while ($row = $smcFunc['db_fetch_assoc']($request))
Chris@76: 		$members[] = $row;
Chris@76: 	$smcFunc['db_free_result']($request);
Chris@76: 
Chris@76: 	// If we want duplicates pass the members array off.
Chris@76: 	if ($get_duplicates)
Chris@76: 		populateDuplicateMembers($members);
Chris@76: 
Chris@76: 	return $members;
Chris@76: }
Chris@76: 
Chris@76: function list_getNumMembers($where, $where_params = array())
Chris@76: {
Chris@76: 	global $smcFunc, $modSettings;
Chris@76: 
Chris@76: 	// We know how many members there are in total.
Chris@76: 	if (empty($where) || $where == '1')
Chris@76: 		$num_members = $modSettings['totalMembers'];
Chris@76: 
Chris@76: 	// The database knows the amount when there are extra conditions.
Chris@76: 	else
Chris@76: 	{
Chris@76: 		$request = $smcFunc['db_query']('', '
Chris@76: 			SELECT COUNT(*)
Chris@76: 			FROM {db_prefix}members AS mem
Chris@76: 			WHERE ' . $where,
Chris@76: 			array_merge($where_params, array(
Chris@76: 			))
Chris@76: 		);
Chris@76: 		list ($num_members) = $smcFunc['db_fetch_row']($request);
Chris@76: 		$smcFunc['db_free_result']($request);
Chris@76: 	}
Chris@76: 
Chris@76: 	return $num_members;
Chris@76: }
Chris@76: 
Chris@76: function populateDuplicateMembers(&$members)
Chris@76: {
Chris@76: 	global $smcFunc;
Chris@76: 
Chris@76: 	// This will hold all the ip addresses.
Chris@76: 	$ips = array();
Chris@76: 	foreach ($members as $key => $member)
Chris@76: 	{
Chris@76: 		// Create the duplicate_members element.
Chris@76: 		$members[$key]['duplicate_members'] = array();
Chris@76: 
Chris@76: 		// Store the IPs.
Chris@76: 		if (!empty($member['member_ip']))
Chris@76: 			$ips[] = $member['member_ip'];
Chris@76: 		if (!empty($member['member_ip2']))
Chris@76: 			$ips[] = $member['member_ip2'];
Chris@76: 	}
Chris@76: 
Chris@76: 	$ips = array_unique($ips);
Chris@76: 
Chris@76: 	if (empty($ips))
Chris@76: 		return false;
Chris@76: 
Chris@76: 	// Fetch all members with this IP address, we'll filter out the current ones in a sec.
Chris@76: 	$request = $smcFunc['db_query']('', '
Chris@76: 		SELECT
Chris@76: 			id_member, member_name, email_address, member_ip, member_ip2, is_activated
Chris@76: 		FROM {db_prefix}members
Chris@76: 		WHERE member_ip IN ({array_string:ips})
Chris@76: 			OR member_ip2 IN ({array_string:ips})',
Chris@76: 		array(
Chris@76: 			'ips' => $ips,
Chris@76: 		)
Chris@76: 	);
Chris@76: 	$duplicate_members = array();
Chris@76: 	$duplicate_ids = array();
Chris@76: 	while ($row = $smcFunc['db_fetch_assoc']($request))
Chris@76: 	{
Chris@76: 		//$duplicate_ids[] = $row['id_member'];
Chris@76: 
Chris@76: 		$member_context = array(
Chris@76: 			'id' => $row['id_member'],
Chris@76: 			'name' => $row['member_name'],
Chris@76: 			'email' => $row['email_address'],
Chris@76: 			'is_banned' => $row['is_activated'] > 10,
Chris@76: 			'ip' => $row['member_ip'],
Chris@76: 			'ip2' => $row['member_ip2'],
Chris@76: 		);
Chris@76: 
Chris@76: 		if (in_array($row['member_ip'], $ips))
Chris@76: 			$duplicate_members[$row['member_ip']][] = $member_context;
Chris@76: 		if ($row['member_ip'] != $row['member_ip2'] && in_array($row['member_ip2'], $ips))
Chris@76: 			$duplicate_members[$row['member_ip2']][] = $member_context;
Chris@76: 	}
Chris@76: 	$smcFunc['db_free_result']($request);
Chris@76: 
Chris@76: 	// Also try to get a list of messages using these ips.
Chris@76: 	$request = $smcFunc['db_query']('', '
Chris@76: 		SELECT
Chris@76: 			m.poster_ip, mem.id_member, mem.member_name, mem.email_address, mem.is_activated
Chris@76: 		FROM {db_prefix}messages AS m
Chris@76: 			INNER JOIN {db_prefix}members AS mem ON (mem.id_member = m.id_member)
Chris@76: 		WHERE m.id_member != 0
Chris@76: 			' . (!empty($duplicate_ids) ? 'AND m.id_member NOT IN ({array_int:duplicate_ids})' : '') . '
Chris@76: 			AND m.poster_ip IN ({array_string:ips})',
Chris@76: 		array(
Chris@76: 			'duplicate_ids' => $duplicate_ids,
Chris@76: 			'ips' => $ips,
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	$had_ips = array();
Chris@76: 	while ($row = $smcFunc['db_fetch_assoc']($request))
Chris@76: 	{
Chris@76: 		// Don't collect lots of the same.
Chris@76: 		if (isset($had_ips[$row['poster_ip']]) && in_array($row['id_member'], $had_ips[$row['poster_ip']]))
Chris@76: 			continue;
Chris@76: 		$had_ips[$row['poster_ip']][] = $row['id_member'];
Chris@76: 
Chris@76: 		$duplicate_members[$row['poster_ip']][] = array(
Chris@76: 			'id' => $row['id_member'],
Chris@76: 			'name' => $row['member_name'],
Chris@76: 			'email' => $row['email_address'],
Chris@76: 			'is_banned' => $row['is_activated'] > 10,
Chris@76: 			'ip' => $row['poster_ip'],
Chris@76: 			'ip2' => $row['poster_ip'],
Chris@76: 		);
Chris@76: 	}
Chris@76: 	$smcFunc['db_free_result']($request);
Chris@76: 
Chris@76: 	// Now we have all the duplicate members, stick them with their respective member in the list.
Chris@76: 	if (!empty($duplicate_members))
Chris@76: 		foreach ($members as $key => $member)
Chris@76: 		{
Chris@76: 			if (isset($duplicate_members[$member['member_ip']]))
Chris@76: 				$members[$key]['duplicate_members'] = $duplicate_members[$member['member_ip']];
Chris@76: 			if ($member['member_ip'] != $member['member_ip2'] && isset($duplicate_members[$member['member_ip2']]))
Chris@76: 				$members[$key]['duplicate_members'] = array_merge($member['duplicate_members'], $duplicate_members[$member['member_ip2']]);
Chris@76: 
Chris@76: 			// Check we don't have lots of the same member.
Chris@76: 			$member_track = array($member['id_member']);
Chris@76: 			foreach ($members[$key]['duplicate_members'] as $duplicate_id_member => $duplicate_member)
Chris@76: 			{
Chris@76: 				if (in_array($duplicate_member['id'], $member_track))
Chris@76: 				{
Chris@76: 					unset($members[$key]['duplicate_members'][$duplicate_id_member]);
Chris@76: 					continue;
Chris@76: 				}
Chris@76: 
Chris@76: 				$member_track[] = $duplicate_member['id'];
Chris@76: 			}
Chris@76: 		}
Chris@76: }
Chris@76: 
Chris@76: // Generate a random validation code.
Chris@76: function generateValidationCode()
Chris@76: {
Chris@76: 	global $smcFunc, $modSettings;
Chris@76: 
Chris@76: 	$request = $smcFunc['db_query']('get_random_number', '
Chris@76: 		SELECT RAND()',
Chris@76: 		array(
Chris@76: 		)
Chris@76: 	);
Chris@76: 
Chris@76: 	list ($dbRand) = $smcFunc['db_fetch_row']($request);
Chris@76: 	$smcFunc['db_free_result']($request);
Chris@76: 
Chris@76: 	return substr(preg_replace('/\W/', '', sha1(microtime() . mt_rand() . $dbRand . $modSettings['rand_seed'])), 0, 10);
Chris@76: }
Chris@76: 
Chris@77: ?>