API tools faq
paste
Guest User

register

a guest
Dec 3rd, 2014
320
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.99 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. /*
  3. =====================================================
  4. DataLife Engine - by SoftNews Media Group
  5. -----------------------------------------------------
  6. http://dle-news.ru/
  7. -----------------------------------------------------
  8. Copyright (c) 2004,2014 SoftNews Media Group
  9. =====================================================
  10. Данный код защищен авторскими правами
  11. =====================================================
  12. Файл: register.php
  13. -----------------------------------------------------
  14. Назначение: регистрация посетителя
  15. =====================================================
  16.  
  17. */
  18.  
  19. if( ! defined( 'DATALIFEENGINE' ) ) {
  20. die( "Hacking attempt!" );
  21. }
  22.  
  23. require_once ENGINE_DIR . '/classes/parse.class.php';
  24.  
  25. $parse = new ParseFilter( );
  26. $parse->safe_mode = true;
  27. $parse->allow_url = false;
  28. $parse->allow_image = false;
  29. $stopregistration = FALSE;
  30. $_IP = get_ip();
  31.  
  32. if( isset( $_REQUEST['doaction'] ) ) $doaction = $_REQUEST['doaction']; else $doaction = "";
  33. $config['reg_group'] = intval( $config['reg_group'] ) ? intval( $config['reg_group'] ) : 4;
  34.  
  35. function check_reg($name, $email, $password1, $password2, $sec_code = 1, $sec_code_session = 1) {
  36. global $lang, $db, $banned_info, $relates_word, $config;
  37. $stop = "";
  38.  
  39. if( $sec_code != $sec_code_session OR !$sec_code_session ) $stop .= $lang['reg_err_19'];
  40. if( $password1 != $password2 ) $stop .= $lang['reg_err_1'];
  41. if( strlen( $password1 ) < 6 ) $stop .= $lang['reg_err_2'];
  42. if( dle_strlen( $name, $config['charset'] ) > 30 OR dle_strlen(trim($name), $config['charset']) < 3) $stop .= $lang['reg_err_3'];
  43. if( preg_match( "/[\||\'|\<|\>|\[|\]|\"|\!|\?|\$|\@|\/|\\\|\&\~\*\{\+]/", $name ) ) $stop .= $lang['reg_err_4'];
  44. if( empty( $email ) OR strlen( $email ) > 50 OR @count(explode("@", $email)) != 2) $stop .= $lang['reg_err_6'];
  45. if (strpos( strtolower ($name) , '.php' ) !== false) $stop .= $lang['reg_err_4'];
  46.  
  47. if( stripos(urlencode ($name), "%AD") !== false ) {
  48.  
  49. $stop .= $lang['reg_err_4'];
  50.  
  51. }
  52.  
  53. if( count( $banned_info['name'] ) ) foreach ( $banned_info['name'] as $banned ) {
  54.  
  55. $banned['name'] = str_replace( '\*', '.*', preg_quote( $banned['name'], "#" ) );
  56.  
  57. if( $banned['name'] and preg_match( "#^{$banned['name']}$#i", $name ) ) {
  58.  
  59. if( $banned['descr'] ) {
  60. $lang['reg_err_21'] = str_replace( "{descr}", $lang['reg_err_22'], $lang['reg_err_21'] );
  61. $lang['reg_err_21'] = str_replace( "{descr}", $banned['descr'], $lang['reg_err_21'] );
  62. } else
  63. $lang['reg_err_21'] = str_replace( "{descr}", "", $lang['reg_err_21'] );
  64.  
  65. $stop .= $lang['reg_err_21'];
  66. }
  67. }
  68.  
  69. if( count( $banned_info['email'] ) ) foreach ( $banned_info['email'] as $banned ) {
  70.  
  71. $banned['email'] = str_replace( '\*', '.*', preg_quote( $banned['email'], "#" ) );
  72.  
  73. if( $banned['email'] and preg_match( "#^{$banned['email']}$#i", $email ) ) {
  74.  
  75. if( $banned['descr'] ) {
  76. $lang['reg_err_23'] = str_replace( "{descr}", $lang['reg_err_22'], $lang['reg_err_23'] );
  77. $lang['reg_err_23'] = str_replace( "{descr}", $banned['descr'], $lang['reg_err_23'] );
  78. } else
  79. $lang['reg_err_23'] = str_replace( "{descr}", "", $lang['reg_err_23'] );
  80.  
  81. $stop .= $lang['reg_err_23'];
  82. }
  83. }
  84.  
  85. if( $stop == "" ) {
  86. if( function_exists('mb_strtolower') ) {
  87. $name = trim(mb_strtolower($name, $config['charset']));
  88. } else {
  89. $name = trim(strtolower( $name ));
  90. }
  91. $search_name = strtr( $name, $relates_word );
  92.  
  93. $row = $db->super_query( "SELECT COUNT(*) as count FROM " . USERPREFIX . "_users WHERE email = '$email' OR LOWER(name) REGEXP '[[:<:]]{$search_name}[[:>:]]' OR name = '$name'" );
  94.  
  95. if( $row['count'] ) $stop .= $lang['reg_err_8'];
  96. }
  97.  
  98. return $stop;
  99.  
  100. }
  101.  
  102. if( !$config['allow_registration'] ) {
  103.  
  104. msgbox( $lang['all_info'], $lang['reg_err_9'] );
  105. $stopregistration = TRUE;
  106.  
  107. }
  108.  
  109. if ( $config['sec_addnews'] ) {
  110.  
  111. $row = $db->super_query( "SELECT * FROM " . PREFIX . "_spam_log WHERE ip = '{$_IP}'" );
  112.  
  113. if ( !$row['id'] ) {
  114.  
  115. include_once ENGINE_DIR . '/classes/stopspam.class.php';
  116. $sfs = new StopSpam($config['spam_api_key'], $config['sec_addnews']);
  117. $args = array('ip' => $_IP);
  118.  
  119. if ($sfs->is_spammer( $args )) {
  120.  
  121. $db->query( "INSERT INTO " . PREFIX . "_spam_log (ip, is_spammer, date) VALUES ('{$_IP}','1', '{$_TIME}')" );
  122.  
  123. msgbox( $lang['all_info'], $lang['reg_err_28'] );
  124. $stopregistration = TRUE;
  125.  
  126. } else {
  127.  
  128. $db->query( "INSERT INTO " . PREFIX . "_spam_log (ip, is_spammer, date) VALUES ('{$_IP}','0', '{$_TIME}')" );
  129. }
  130.  
  131. } else {
  132.  
  133. if ($row['is_spammer']) {
  134.  
  135. msgbox( $lang['all_info'], $lang['reg_err_28'] );
  136. $stopregistration = TRUE;
  137.  
  138. }
  139.  
  140. }
  141.  
  142. }
  143.  
  144. if( $config['max_users'] > 0 ) {
  145.  
  146. $row = $db->super_query( "SELECT COUNT(*) as count FROM " . USERPREFIX . "_users" );
  147.  
  148. if ( $row['count'] >= $config['max_users'] ) {
  149. msgbox( $lang['all_info'], $lang['reg_err_10'] );
  150. $stopregistration = TRUE;
  151. }
  152.  
  153. }
  154.  
  155. if( !$config['reg_multi_ip'] AND !$is_logged ) {
  156.  
  157. $row = $db->super_query( "SELECT COUNT(*) as count FROM " . USERPREFIX . "_users WHERE logged_ip = '{$_IP}'" );
  158.  
  159. if ( $row['count'] ) {
  160. msgbox( $lang['all_info'], $lang['reg_err_26'] );
  161. $stopregistration = TRUE;
  162. }
  163.  
  164. }
  165.  
  166. if ( $is_logged AND !isset( $_POST['submit_val'] ) ) {
  167.  
  168. msgbox( $lang['all_info'], $lang['reg_err_27'] );
  169. $stopregistration = TRUE;
  170. }
  171.  
  172. if( isset( $_POST['submit_reg'] ) AND !$stopregistration ) {
  173.  
  174. if( $config['allow_sec_code'] ) {
  175.  
  176. if ($config['allow_recaptcha']) {
  177.  
  178. include_once ENGINE_DIR . '/classes/recaptcha.php';
  179. $sec_code = 1;
  180. $sec_code_session = false;
  181.  
  182. if ($_POST['recaptcha_response_field'] AND $_POST['recaptcha_challenge_field']) {
  183.  
  184. $resp = recaptcha_check_answer ($config['recaptcha_private_key'],
  185. $_SERVER["REMOTE_ADDR"],
  186. $_POST['recaptcha_challenge_field'],
  187. $_POST['recaptcha_response_field']);
  188.  
  189. if ($resp->is_valid) {
  190.  
  191. $sec_code = 1;
  192. $sec_code_session = 1;
  193.  
  194. }
  195. }
  196.  
  197. } else {
  198. $sec_code = $_POST['sec_code'];
  199. $sec_code_session = ($_SESSION['sec_code_session'] != '') ? $_SESSION['sec_code_session'] : false;
  200. }
  201.  
  202. } else {
  203. $sec_code = 1;
  204. $sec_code_session = 1;
  205. }
  206.  
  207. $password1 = $_POST['password1'];
  208. $password2 = $_POST['password2'];
  209. $name = $db->safesql( $parse->process( htmlspecialchars( trim( $_POST['name'] ), ENT_COMPAT, $config['charset'] ) ) );
  210. $name = preg_replace('#\s+#i', ' ', $name);
  211.  
  212. $not_allow_symbol = array ("\x22", "\x60", "\t", '\n', '\r', "\n", "\r", '\\', ",", "/", "¬", "#", ";", ":", "~", "[", "]", "{", "}", ")", "(", "*", "^", "%", "$", "<", ">", "?", "!", '"', "'", " ", "&" );
  213. $email = $db->safesql(trim( str_replace( $not_allow_symbol, '', strip_tags( stripslashes( $_POST['email'] ) ) ) ) );
  214.  
  215. $reg_error = check_reg( $name, $email, $password1, $password2, $sec_code, $sec_code_session );
  216.  
  217. if( $config['reg_question'] ) {
  218.  
  219. if ( intval($_SESSION['question']) ) {
  220.  
  221. $answer = $db->super_query("SELECT id, answer FROM " . PREFIX . "_question WHERE id='".intval($_SESSION['question'])."'");
  222.  
  223. $answers = explode( "\n", $answer['answer'] );
  224.  
  225. $pass_answer = false;
  226.  
  227. if( function_exists('mb_strtolower') ) {
  228. $question_answer = trim(mb_strtolower($_POST['question_answer'], $config['charset']));
  229. } else {
  230. $question_answer = trim(strtolower($_POST['question_answer']));
  231. }
  232.  
  233. if( count($answers) AND $question_answer ) {
  234. foreach( $answers as $answer ){
  235.  
  236. if( function_exists('mb_strtolower') ) {
  237. $answer = trim(mb_strtolower($answer, $config['charset']));
  238. } else {
  239. $answer = trim(strtolower($answer));
  240. }
  241.  
  242. if( $answer AND $answer == $question_answer ) {
  243. $pass_answer = true;
  244. break;
  245. }
  246. }
  247. }
  248.  
  249. if( !$pass_answer ) $reg_error .= $lang['reg_err_25'];
  250.  
  251. } else $reg_error .= $lang['reg_err_25'];
  252.  
  253. }
  254.  
  255. if ( $config['sec_addnews'] ) {
  256. include_once ENGINE_DIR . '/classes/stopspam.class.php';
  257. $sfs = new StopSpam($config['spam_api_key'], $config['sec_addnews']);
  258. $args = array('email' => $email);
  259.  
  260. if ($sfs->is_spammer( $args )) {
  261.  
  262. $db->query( "UPDATE " . PREFIX . "_spam_log SET is_spammer='1', email='{$email}' WHERE ip = '{$_IP}'" );
  263. $stopregistration = TRUE;
  264. $reg_error .= $lang['reg_err_35'];
  265.  
  266. } else {
  267.  
  268. $db->query( "UPDATE " . PREFIX . "_spam_log SET email='{$email}' WHERE ip = '{$_IP}'" );
  269.  
  270. }
  271.  
  272. }
  273.  
  274. if( !$reg_error AND !$stopregistration ) {
  275.  
  276. $stronghash = sha1(DBHOST . DBNAME . SECURE_AUTH_KEY);
  277.  
  278. if( $config['registration_type'] ) {
  279.  
  280. include_once ENGINE_DIR . '/classes/mail.class.php';
  281. $mail = new dle_mail( $config );
  282.  
  283. $row = $db->super_query( "SELECT template FROM " . PREFIX . "_email where name='reg_mail' LIMIT 0,1" );
  284.  
  285. $row['template'] = stripslashes( $row['template'] );
  286.  
  287. $idlink = rawurlencode( base64_encode( $name . "||" . $email . "||" . md5( $password1 ) . "||" . sha1( $name . $email . $stronghash . $config['key'] ) ) );
  288.  
  289. $row['template'] = str_replace( "{%username%}", $name, $row['template'] );
  290. $row['template'] = str_replace( "{%email%}", $email, $row['template'] );
  291. $row['template'] = str_replace( "{%validationlink%}", $config['http_home_url'] . "index.php?do=register&doaction=validating&id=" . $idlink, $row['template'] );
  292. $row['template'] = str_replace( "{%password%}", $password1, $row['template'] );
  293.  
  294. $mail->send( $email, $lang['reg_subj'], $row['template'] );
  295.  
  296. if( $mail->send_error ) msgbox( $lang['all_info'], $mail->smtp_msg );
  297. else msgbox( $lang['reg_vhead'], $lang['reg_vtext'] );
  298.  
  299. $_SESSION['sec_code_session'] = false;
  300. $_SESSION['question'] = false;
  301.  
  302. $stopregistration = TRUE;
  303.  
  304. } else {
  305.  
  306. $doaction = "validating";
  307. $_REQUEST['id'] = rawurlencode( base64_encode( $name . "||" . $email . "||" . md5( $password1 ) . "||" . sha1( $name . $email . $stronghash . $config['key'] ) ) );
  308. }
  309.  
  310. } else {
  311. msgbox( $lang['reg_err_11'], "<ul>" . $reg_error . "</ul>" );
  312. }
  313.  
  314. }
  315.  
  316. if( $doaction != "validating" AND !$stopregistration ) {
  317.  
  318. if( $_POST['dle_rules_accept'] == "yes" ) {
  319.  
  320. $_SESSION['dle_rules_accept'] = "1";
  321.  
  322. }
  323.  
  324. if( $config['registration_rules'] and ! $_SESSION['dle_rules_accept'] ) {
  325.  
  326. $_GET['page'] = "dle-rules-page";
  327. include ENGINE_DIR . '/modules/static.php';
  328.  
  329. } else {
  330.  
  331. $tpl->load_template( 'registration.tpl' );
  332.  
  333. $tpl->set( '[registration]', "" );
  334. $tpl->set( '[/registration]', "" );
  335. $tpl->set_block( "'\\[validation\\](.*?)\\[/validation\\]'si", "" );
  336. $path = parse_url( $config['http_home_url'] );
  337.  
  338. if( $config['reg_question'] ) {
  339.  
  340. $tpl->set( '[question]', "" );
  341. $tpl->set( '[/question]', "" );
  342.  
  343. $question = $db->super_query("SELECT id, question FROM " . PREFIX . "_question ORDER BY RAND() LIMIT 1");
  344. $tpl->set( '{question}', htmlspecialchars( stripslashes( $question['question'] ), ENT_QUOTES, $config['charset'] ) );
  345.  
  346. $_SESSION['question'] = $question['id'];
  347.  
  348. } else {
  349.  
  350. $tpl->set_block( "'\\[question\\](.*?)\\[/question\\]'si", "" );
  351. $tpl->set( '{question}', "" );
  352.  
  353. }
  354.  
  355. if( $config['allow_sec_code'] ) {
  356.  
  357. if ( $config['allow_recaptcha'] ) {
  358.  
  359. $tpl->set( '[recaptcha]', "" );
  360. $tpl->set( '[/recaptcha]', "" );
  361.  
  362. $tpl->set( '{recaptcha}', '
  363. <script type="text/javascript">
  364. <!--
  365. var RecaptchaOptions = {
  366. theme: \''.$config['recaptcha_theme'].'\',
  367. lang: \''.$lang['wysiwyg_language'].'\'
  368. };
  369.  
  370. //-->
  371. </script>
  372. <script type="text/javascript" src="//www.google.com/recaptcha/api/challenge?k='.$config['recaptcha_public_key'].'"></script>' );
  373.  
  374. $tpl->set_block( "'\\[sec_code\\](.*?)\\[/sec_code\\]'si", "" );
  375. $tpl->set( '{reg_code}', "" );
  376.  
  377. } else {
  378.  
  379. $tpl->set( '[sec_code]', "" );
  380. $tpl->set( '[/sec_code]', "" );
  381. $tpl->set( '{reg_code}', "<span id=\"dle-captcha\"><img src=\"" . $path['path'] . "engine/modules/antibot/antibot.php\" alt=\"{$lang['sec_image']}\" width=\"160\" height=\"80\" /><br /><a onclick=\"reload(); return false;\" href=\"#\">{$lang['reload_code']}</a></span>" );
  382. $tpl->set_block( "'\\[recaptcha\\](.*?)\\[/recaptcha\\]'si", "" );
  383. $tpl->set( '{recaptcha}', "" );
  384. }
  385.  
  386. } else {
  387.  
  388. $tpl->set( '{reg_code}', "" );
  389. $tpl->set( '{recaptcha}', "" );
  390. $tpl->set_block( "'\\[sec_code\\](.*?)\\[/sec_code\\]'si", "" );
  391. $tpl->set_block( "'\\[recaptcha\\](.*?)\\[/recaptcha\\]'si", "" );
  392. }
  393.  
  394. $tpl->copy_template = "<form method=\"post\" name=\"registration\" onsubmit=\"if (!check_reg_daten()) {return false;};\" id=\"registration\" action=\"\">\n" . $tpl->copy_template . "
  395. <input name=\"submit_reg\" type=\"hidden\" id=\"submit_reg\" value=\"submit_reg\" />
  396. <input name=\"do\" type=\"hidden\" id=\"do\" value=\"register\" />
  397. </form>";
  398.  
  399. $tpl->copy_template .= <<<HTML
  400. <script language='javascript' type="text/javascript">
  401. <!--
  402. function reload () {
  403.  
  404. var rndval = new Date().getTime();
  405.  
  406. document.getElementById('dle-captcha').innerHTML = '<img src="{$path['path']}engine/modules/antibot/antibot.php?rndval=' + rndval + '" width="160" height="80" alt="" /><br /><a onclick="reload(); return false;" href="#">{$lang['reload_code']}</a>';
  407.  
  408. };
  409. function check_reg_daten () {
  410.  
  411. if(document.forms.registration.name.value == '') {
  412.  
  413. DLEalert('{$lang['reg_err_30']}', dle_info);return false;
  414.  
  415. }
  416.  
  417. if(document.forms.registration.password1.value.length < 6) {
  418.  
  419. DLEalert('{$lang['reg_err_31']}', dle_info);return false;
  420.  
  421. }
  422.  
  423. if(document.forms.registration.password1.value != document.forms.registration.password2.value) {
  424.  
  425. DLEalert('{$lang['reg_err_32']}', dle_info);return false;
  426.  
  427. }
  428.  
  429. if(document.forms.registration.email.value == '') {
  430.  
  431. DLEalert('{$lang['reg_err_33']}', dle_info);return false;
  432.  
  433. }
  434.  
  435. return true;
  436.  
  437. };
  438. //-->
  439. </script>
  440. HTML;
  441. $tpl->compile( 'content' );
  442. $tpl->clear();
  443.  
  444. }
  445.  
  446. }
  447.  
  448. if( isset( $_POST['submit_val'] ) AND !$stopregistration ) {
  449.  
  450. $fullname = $db->safesql( $parse->process( $_POST['fullname'] ) );
  451. $land = $db->safesql( $parse->process( $_POST['land'] ) );
  452.  
  453. $info = $db->safesql( $parse->BB_Parse( $parse->process( $_POST['info'] ), false ) );
  454.  
  455. $image = $_FILES['image']['tmp_name'];
  456. $image_name = $_FILES['image']['name'];
  457. $image_size = $_FILES['image']['size'];
  458. $image_name = str_replace( " ", "_", $image_name );
  459. $img_name_arr = explode( ".", $image_name );
  460. $type = totranslit( end( $img_name_arr ) );
  461.  
  462. if( stripos ( $image_name, "php" ) !== false ) die("Hacking attempt!");
  463.  
  464. $user_arr = explode( "||", base64_decode( @rawurldecode( $_POST['id'] ) ) );
  465.  
  466. if( $user_arr[0] == "" OR $user_arr[2]== "" ) die("Hacking attempt!");
  467.  
  468. $user = $db->safesql( trim( $user_arr[0] ) );
  469. $email = $db->safesql( trim( $user_arr[1] ) );
  470. $pass = md5( $user_arr[2] );
  471. $stronghash = sha1(DBHOST . DBNAME . SECURE_AUTH_KEY);
  472.  
  473. if( sha1( $user . $email . $stronghash . $config['key'] ) != $user_arr[3] ) die( 'ID not valid!' );
  474.  
  475. if( preg_match( "/[\||\'|\<|\>|\[|\]|\"|\!|\?|\$|\@|\/|\\\|\&\~\*\{\+]/", $user ) ) die( 'USER not valid!' );
  476.  
  477. $row = $db->super_query( "SELECT * FROM " . USERPREFIX . "_users WHERE name = '$user' AND password='$pass'" );
  478.  
  479. if( !$row['user_id'] ) die("Access Denied!");
  480.  
  481. $db->free();
  482.  
  483. if( is_uploaded_file( $image ) and ! $stop ) {
  484.  
  485. if( intval( $user_group[$config['reg_group']]['max_foto'] ) > 0 ) {
  486.  
  487. if( !$config['avatar_size'] OR $image_size < ($config['avatar_size'] * 1024) ) {
  488.  
  489. $allowed_extensions = array ("jpg", "png", "gif" );
  490.  
  491. if( in_array( $type, $allowed_extensions ) AND $image_name ) {
  492.  
  493. include_once ENGINE_DIR . '/classes/thumb.class.php';
  494.  
  495. $res = @move_uploaded_file( $image, ROOT_DIR . "/uploads/fotos/" . $row['user_id'] . "." . $type );
  496.  
  497. if( $res ) {
  498.  
  499. @chmod( ROOT_DIR . "/uploads/fotos/" . $row['user_id'] . "." . $type, 0666 );
  500. $thumb = new thumbnail( ROOT_DIR . "/uploads/fotos/" . $row['user_id'] . "." . $type );
  501.  
  502. $thumb->size_auto( $user_group[$config['reg_group']]['max_foto'] );
  503. $thumb->jpeg_quality( $config['jpeg_quality'] );
  504. $thumb->save( ROOT_DIR . "/uploads/fotos/foto_" . $row['user_id'] . "." . $type );
  505.  
  506.  
  507. @unlink( ROOT_DIR . "/uploads/fotos/" . $row['user_id'] . "." . $type );
  508. $foto_name = "foto_" . $row['user_id'] . "." . $type;
  509.  
  510. $db->query( "UPDATE " . USERPREFIX . "_users SET foto='$foto_name' WHERE user_id='{$row['user_id']}'" );
  511.  
  512. } else
  513. $stop = $lang['reg_err_12'];
  514. } else
  515. $stop = $lang['reg_err_13'];
  516. } else
  517. $stop = str_replace("{size}", $config['avatar_size'], $lang['news_err_16']);
  518. } else
  519. $stop .= $lang['news_err_32'];
  520.  
  521. }
  522.  
  523. if( intval( $user_group[$member_id['user_group']]['max_info'] ) > 0 and dle_strlen( $info, $config['charset'] ) > $user_group[$member_id['user_group']]['max_info'] ) $stop .= $lang['reg_err_14'];
  524. if( dle_strlen( $fullname, $config['charset'] ) > 100 ) $stop .= $lang['reg_err_15'];
  525. if( dle_strlen( $land, $config['charset'] ) > 100 ) $stop .= $lang['reg_err_16'];
  526.  
  527. if( $parse->not_allowed_tags ) $stop .= $lang['news_err_34'];
  528. if( $parse->not_allowed_text ) $stop .= $lang['news_err_38'];
  529.  
  530. if ( preg_match( "/[\||\'|\<|\>|\"|\!|\]|\?|\$|\@|\/|\\\|\&\~\*\+]/", $fullname ) ) {
  531.  
  532. $stop .= $lang['news_err_35'];
  533. }
  534.  
  535. if ( preg_match( "/[\||\'|\<|\>|\"|\!|\]|\?|\$|\@|\/|\\\|\&\~\*\+]/", $land ) ) {
  536.  
  537. $stop .= $lang['news_err_36'];
  538. }
  539.  
  540. if( $stop ) {
  541. msgbox( $lang['reg_err_18'], $stop );
  542. } else {
  543.  
  544. $xfieldsaction = "init";
  545. $xfieldsadd = true;
  546. $xfieldsid = "";
  547. include (ENGINE_DIR . '/inc/userfields.php');
  548. $filecontents = array ();
  549. $not_allow_symbol = array ("\x22", "\x60", "\t", '\n', '\r', "\n", "\r", '\\', ",", "/", "¬", "#", ";", ":", "~", "[", "]", "{", "}", ")", "(", "*", "^", "%", "$", "<", ">", "?", "!", '"', "'", " ", "&" );
  550.  
  551. if( ! empty( $postedxfields ) ) {
  552. foreach ( $postedxfields as $xfielddataname => $xfielddatavalue ) {
  553. if( ! $xfielddatavalue ) {
  554. continue;
  555. }
  556.  
  557. $xfielddatavalue = $db->safesql( $parse->BB_Parse( $parse->process( $xfielddatavalue ), false ) );
  558.  
  559. $xfielddataname = $db->safesql( str_replace( $not_allow_symbol, '', $xfielddataname) );
  560.  
  561. $xfielddataname = str_replace( "|", "&#124;", $xfielddataname );
  562. $xfielddatavalue = str_replace( "|", "&#124;", $xfielddatavalue );
  563. $filecontents[] = "$xfielddataname|$xfielddatavalue";
  564. }
  565.  
  566. $filecontents = implode( "||", $filecontents );
  567. } else
  568. $filecontents = '';
  569.  
  570. $db->query( "UPDATE " . USERPREFIX . "_users SET fullname='$fullname', info='$info', land='$land', xfields='$filecontents' WHERE user_id='{$row['user_id']}'" );
  571.  
  572. msgbox( $lang['reg_ok'], $lang['reg_ok_1'] );
  573.  
  574. $stopregistration = TRUE;
  575. }
  576. }
  577.  
  578. if( $doaction == "validating" AND !$stopregistration AND !$_POST['submit_val'] ) {
  579.  
  580. $user_arr = explode( "||", base64_decode( @rawurldecode( trim($_REQUEST['id']) ) ) );
  581.  
  582. $regpassword = md5( $user_arr[2] );
  583. $name = trim( $db->safesql( htmlspecialchars( $parse->process( $user_arr[0] ), ENT_COMPAT, $config['charset'] ) ) );
  584.  
  585. $not_allow_symbol = array ("\x22", "\x60", "\t", '\n', '\r', "\n", "\r", '\\', ",", "/", "¬", "#", ";", ":", "~", "[", "]", "{", "}", ")", "(", "*", "^", "%", "$", "<", ">", "?", "!", '"', "'", " ", "&" );
  586. $email = $db->safesql(trim( str_replace( $not_allow_symbol, '', strip_tags( stripslashes( $user_arr[1] ) ) ) ) );
  587. $stronghash = sha1(DBHOST . DBNAME . SECURE_AUTH_KEY);
  588.  
  589. if( sha1( $name . $email . $stronghash . $config['key'] ) != $user_arr[3] ) die( 'ID not valid!' );
  590.  
  591. $name = preg_replace('#\s+#i', ' ', $name);
  592. $reg_error = check_reg( $name, $email, $regpassword, $regpassword );
  593.  
  594. if( $reg_error != "" ) {
  595. msgbox( $lang['reg_err_11'], $reg_error );
  596. $stopregistration = TRUE;
  597. } else {
  598.  
  599. if( ($_REQUEST['step'] != 2) and $config['registration_type'] ) {
  600. $stopregistration = true;
  601. $lang['confirm_ok'] = str_replace( '{email}', $email, $lang['confirm_ok'] );
  602. $lang['confirm_ok'] = str_replace( '{login}', $name, $lang['confirm_ok'] );
  603. msgbox( $lang['all_info'], $lang['confirm_ok'] . "<br /><br /><a href=\"" . $config['http_home_url'] . "index.php?do=register&doaction=validating&step=2&id=" . rawurlencode( $_REQUEST['id'] ) . "\">" . $lang['reg_next'] . "</a>" );
  604. } else {
  605.  
  606. $add_time = time();
  607. $_IP = get_ip();
  608. if( intval( $config['reg_group'] ) < 3 ) $config['reg_group'] = 4;
  609.  
  610. $db->query( "INSERT INTO " . USERPREFIX . "_users (name, password, email, reg_date, lastdate, user_group, info, signature, favorites, xfields, logged_ip) VALUES ('$name', '$regpassword', '$email', '$add_time', '$add_time', '" . $config['reg_group'] . "', '', '', '', '', '" . $_IP . "')" );
  611. $id = $db->insert_id();
  612.  
  613. set_cookie( "dle_user_id", $id, 365 );
  614. set_cookie( "dle_password", $user_arr[2], 365 );
  615.  
  616. $_SESSION['dle_user_id'] = $id;
  617. $_SESSION['dle_password'] = $user_arr[2];
  618.  
  619. }
  620.  
  621. }
  622.  
  623. }
  624.  
  625. if( $doaction == "validating" AND !$stopregistration ) {
  626.  
  627. $tpl->load_template( 'registration.tpl' );
  628.  
  629. $tpl->set( '[validation]', "" );
  630. $tpl->set( '[/validation]', "" );
  631. $tpl->set_block( "'\\[registration\\].*?\\[/registration\\]'si", "" );
  632.  
  633. $xfieldsaction = "list";
  634. $xfieldsadd = true;
  635. include (ENGINE_DIR . '/inc/userfields.php');
  636. $tpl->set( '{xfields}', $output );
  637.  
  638. $_REQUEST['id'] = htmlspecialchars( $_REQUEST['id'], ENT_QUOTES, $config['charset'] );
  639.  
  640. $tpl->copy_template = "<form method=\"post\" name=\"registration\" enctype=\"multipart/form-data\" action=\"\">\n" . $tpl->copy_template . "
  641. <input name=\"submit_val\" type=\"hidden\" id=\"submit_val\" value=\"submit_val\" />
  642. <input name=\"do\" type=\"hidden\" id=\"do\" value=\"register\" />
  643. <input name=\"doaction\" type=\"hidden\" id=\"doaction\" value=\"validating\" />
  644. <input name=\"id\" type=\"hidden\" id=\"id\" value=\"{$_REQUEST['id']}\" />
  645. </form>";
  646.  
  647. $tpl->compile( 'content' );
  648. $tpl->clear();
  649. }
  650.  
  651. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!