diff -r 000000000000 -r 902822492a68 plugins/SpecialUserPrefs.php
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/plugins/SpecialUserPrefs.php Wed Jun 13 16:03:00 2007 -0400
@@ -0,0 +1,462 @@
+ $text,
+ 'link' => $link
+ );
+ }
+ else
+ {
+ $userprefs_menu[$section] = Array(Array(
+ 'text' => $text,
+ 'link' => $link
+ ));
+ }
+}
+
+function userprefs_menu_html()
+{
+ global $userprefs_menu;
+ global $userprefs_menu_links;
+
+ $html = '';
+ $quot = '"';
+
+ foreach ( $userprefs_menu as $section => $buttons )
+ {
+ $html .= ( isset($userprefs_menu_links[$section]) ) ? "{$section}\n " : "{$section}\n ";
+ $html .= "\n ";
+ foreach ( $buttons as $button )
+ {
+ $html .= " - {$button['text']}
\n ";
+ }
+ $html .= "
\n ";
+ }
+
+ return $html;
+}
+
+function userprefs_show_menu()
+{
+ echo '
+
+ ';
+}
+
+function userprefs_menu_init()
+{
+ global $db, $session, $paths, $template, $plugins; // Common objects
+ global $userprefs_menu_links;
+
+ userprefs_menu_add('Profile/membership', 'Edit e-mail address and password', makeUrlNS('Special', 'Preferences/EmailPassword'));
+ userprefs_menu_add('Profile/membership', 'Edit signature', makeUrlNS('Special', 'Preferences/Signature'));
+ userprefs_menu_add('Profile/membership', 'Edit public profile', makeUrlNS('Special', 'Preferences/Profile'));
+ userprefs_menu_add('Private messages', 'Inbox', makeUrlNS('Special', 'PrivateMessages/Folder/Inbox'));
+ userprefs_menu_add('Private messages', 'Outbox', makeUrlNS('Special', 'PrivateMessages/Folder/Outbox'));
+ userprefs_menu_add('Private messages', 'Sent items', makeUrlNS('Special', 'PrivateMessages/Folder/Sent'));
+ userprefs_menu_add('Private messages', 'Drafts', makeUrlNS('Special', 'PrivateMessages/Folder/Drafts'));
+ userprefs_menu_add('Private messages', 'Archive', makeUrlNS('Special', 'PrivateMessages/Folder/Archive'));
+
+ $userprefs_menu_links['Profile/membership'] = makeUrlNS('Special', 'Preferences');
+ $userprefs_menu_links['Private messages'] = makeUrlNS('Special', 'PrivateMessages');
+
+ $code = $plugins->setHook('userprefs_jbox');
+ foreach ( $code as $cmd )
+ {
+ eval($cmd);
+ }
+}
+
+$plugins->attachHook('session_started', 'userprefs_menu_init();');
+
+function page_Special_Preferences()
+{
+ global $db, $session, $paths, $template, $plugins; // Common objects
+
+ // We need a login to continue
+ if ( !$session->user_logged_in )
+ redirect(makeUrlNS('Special', 'Login/' . $paths->page), 'Login required', 'You need to be logged in to access this page. Please wait while you are redirected to the login page.');
+
+ // User ID - later this will be specified on the URL, but hardcoded for now
+ $uid = intval($session->user_id);
+
+ // Instanciate the AES encryptor
+ $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+
+ // Basic user info
+ $q = $db->sql_query('SELECT username, password, email, real_name, signature, theme, style FROM '.table_prefix.'users WHERE user_id='.$uid.';');
+ if ( !$q )
+ $db->_die();
+
+ $row = $db->fetchrow();
+ $db->free_result();
+
+ $section = $paths->getParam(0);
+ if ( !$section )
+ {
+ $section = 'Home';
+ }
+
+ $errors = '';
+
+ switch ( $section )
+ {
+ case 'EmailPassword':
+ // Require elevated privileges (well sortof)
+ if ( $session->auth_level < USER_LEVEL_CHPREF )
+ {
+ redirect(makeUrlNS('Special', 'Login/' . $paths->fullpage, 'level=' . USER_LEVEL_CHPREF, true), 'Authentication required', 'You need to re-authenticate to access this page.', 0);
+ }
+
+ if ( isset($_POST['submit']) )
+ {
+ $email_changed = false;
+ // First do the e-mail address
+ if ( strlen($_POST['newemail']) > 0 )
+ {
+ switch('foo') // Same reason as in the password code...
+ {
+ case 'foo':
+ if ( $_POST['newemail'] != $_POST['newemail_conf'] )
+ {
+ $errors .= 'The e-mail addresses you entered did not match.
';
+ break;
+ }
+ }
+ $q = $db->sql_query('SELECT password FROM '.table_prefix.'users WHERE user_id='.$session->user_id.';');
+ if ( !$q )
+ $db->_die();
+ $row = $db->fetchrow();
+ $db->free_result();
+ $old_pass = $aes->decrypt($row['password'], $session->private_key, ENC_HEX);
+
+ $new_email = $_POST['newemail'];
+
+ $result = $session->update_user($session->user_id, false, $old_pass, false, $new_email);
+ if ( $result != 'success' )
+ {
+ die_friendly('Error updating e-mail address', 'Session API returned error: ' . $result . '
');
+ }
+ $email_changed = true;
+ }
+ // Obtain password
+ if ( $_POST['use_crypt'] == 'yes' && !empty($_POST['crypt_data']) )
+ {
+ $key = $session->fetch_public_key($_POST['crypt_key']);
+ if ( !$key )
+ die('Can\'t lookup key');
+ $key = hexdecode($key);
+ $newpass = $aes->decrypt($_POST['crypt_data'], $key, ENC_HEX);
+ // At this point we know if we _want_ to change the password...
+
+ // We can't check the password to see if it matches the confirmation
+ // because the confirmation was destroyed during the encryption. I figured
+ // this wasn't a big deal because if the encryption worked, then either
+ // the Javascript validated it or the user hacked the form. In the latter
+ // case, if he's smart enough to hack the encryption code, he's probably
+ // smart enough to remember his password.
+
+ if ( strlen($newpass) > 0 )
+ {
+ // Perform checks
+ if ( strlen($newpass) < 6 )
+ $errors .= 'Password must be at least 6 characters. You hacked my script, darn you!
';
+ // Encrypt new password
+ $newpass_enc = $aes->encrypt($newpass, $session->private_key, ENC_HEX);
+ // Perform the swap
+ $q = $db->sql_query('UPDATE '.table_prefix.'users SET password=\'' . $newpass_enc . '\' WHERE user_id=' . $session->user_id . ';');
+ if ( !$q )
+ $db->_die();
+ // Log out and back in
+ $username = $session->username;
+ $session->logout();
+ if ( $email_changed )
+ {
+ if ( getConfig('account_activation') == 'user' )
+ {
+ redirect(makeUrl(getConfig('main_page')), 'Profile changed', 'Your password and e-mail address have been changed. Since e-mail activation is required on this site, you will need to re-activate your account to continue. An e-mail has been sent to the new e-mail address with an activation link. You must click that link in order to log in again.', 19);
+ }
+ else if ( getConfig('account_activation') == 'admin' )
+ {
+ redirect(makeUrl(getConfig('main_page')), 'Profile changed', 'Your password and e-mail address have been changed. Since administrative activation is requires on this site, a request has been sent to the administrators to activate your account for you. You will not be able to use your account until it is activated by an administrator.', 19);
+ }
+ }
+ $session->login_without_crypto($session->username, $newpass);
+ redirect(makeUrlNS('Special', 'Preferences'), 'Password changed', 'Your password has been changed, and you will now be redirected back to the user control panel.', 4);
+ }
+ }
+ else
+ {
+ switch('foo') // allow breaking out of our section...i can't wait until PHP6 (goto support!)
+ {
+ case 'foo':
+ $pass = $_POST['newpass'];
+ if ( $pass != $_POST['newpass_conf'] )
+ {
+ $errors .= 'The passwords you entered did not match
';
+ break;
+ }
+
+ if ( $email_changed )
+ {
+ if ( getConfig('account_activation') == 'user' )
+ {
+ redirect(makeUrl(getConfig('main_page')), 'Profile changed', 'Your e-mail address has been changed. Since e-mail activation is required on this site, you will need to re-activate your account to continue. An e-mail has been sent to the new e-mail address with an activation link. You must click that link in order to log in again.', 19);
+ }
+ else if ( getConfig('account_activation') == 'admin' )
+ {
+ redirect(makeUrl(getConfig('main_page')), 'Profile changed', 'Your e-mail address has been changed. Since administrative activation is requires on this site, a request has been sent to the administrators to activate your account for you. You will not be able to use your account until it is activated by an administrator.', 19);
+ }
+ else
+ {
+ redirect(makeUrlNS('Special', 'Preferences'), 'Password changed', 'Your e-mail address has been changed, and you will now be redirected back to the user control panel.', 4);
+ }
+ }
+
+ return;
+ }
+ }
+ }
+ $template->tpl_strings['PAGE_NAME'] = 'Change E-mail Address or Password';
+ break;
+ case 'Signature':
+ $template->tpl_strings['PAGE_NAME'] = 'Editing signature';
+ break;
+ case 'Profile':
+ $template->tpl_strings['PAGE_NAME'] = 'Editing public profile';
+ break;
+ }
+
+ $template->header();
+
+ // Output the menu
+ // This is not templatized because it conforms to the jBox menu standard.
+
+ userprefs_show_menu();
+
+ switch ( $section )
+ {
+ case 'Home':
+ global $email;
+ $user_page = 'user page (comments)';
+ $site_admin = $email->encryptEmail(getConfig('contact_email'), '', '', 'administrator');
+ echo "$session->username, welcome to your control panel
";
+ echo "Here you can make changes to your profile, view statistics on yourself on this site, and set your preferences.
+ If you have not already done so, you are encouraged to make a $user_page and tell the other members of this site a little about yourself.
+ Use the menu at the top to navigate around. If you have any questions, you may contact the $site_admin.";
+ break;
+ case 'EmailPassword':
+
+ echo '
';
+
+ // ENCRYPTION CODE
+ ?>
+
+ escape($sig);
+ $q = $db->sql_query('UPDATE '.table_prefix.'users SET signature=\'' . $sql_sig . '\' WHERE user_id=' . $session->user_id . ';');
+ if ( !$q )
+ $db->_die();
+ $session->signature = $sig;
+ echo 'Your signature has been saved.
';
+ }
+ echo '';
+ break;
+ case "Profile":
+ if ( isset($_POST['submit']) )
+ {
+ $real_name = htmlspecialchars($_POST['real_name']);
+ $real_name = $db->escape($real_name);
+ $q = $db->sql_query('UPDATE '.table_prefix."users SET real_name='$real_name' WHERE user_id=$session->user_id;");
+ if ( !$q )
+ $db->_die();
+
+ echo 'Your profile has been updated.
';
+ }
+ echo '