<?php

/***********************************************************************

  Copyright (C) 2002-2008  PunBB.org

  This file is part of PunBB.

  PunBB is free software; you can redistribute it and/or modify it

  under the terms of the GNU General Public License as published

  by the Free Software Foundation; either version 2 of the License,

  or (at your option) any later version.

  PunBB is distributed in the hope that it will be useful, but

  WITHOUT ANY WARRANTY; without even the implied warranty of

  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

  GNU General Public License for more details.

  You should have received a copy of the GNU General Public License

  along with this program; if not, write to the Free Software

  Foundation, Inc., 59 Temple Place, Suite 330, Boston,

  MA  02111-1307  USA

************************************************************************/

// if (!defined('PUN_ROOT'))

// 	define('PUN_ROOT', './');

// require PUN_ROOT.'include/common.php';

// import globals (I really hope this isn't dangerous)

foreach ( $GLOBALS as $key => $_ )

{

  $$key =& $GLOBALS[$key];

}

($hook = get_hook('pf_start')) ? eval($hook) : null;

$action = isset($_GET['action']) ? $_GET['action'] : null;

$section = isset($_GET['section']) ? $_GET['section'] : 'about';	// Default to section "about"

$id = isset($_GET['id']) ? intval($_GET['id']) : 0;

if ($id < 2)

	message($lang_common['Bad request']);

if ($action != 'change_pass' || !isset($_GET['key']))

{

	if ($pun_user['g_read_board'] == '0')

		message($lang_common['No view']);

	else if ($pun_user['g_view_users'] == '0' && ($pun_user['is_guest'] || $pun_user['id'] != $id))

		message($lang_common['No permission']);

}

// Load the profile.php language file

require PUN_ROOT.'lang/'.$pun_user['language'].'/profile.php';

$GLOBALS['lang_profile'] = $lang_profile;

// Fetch info about the user whose profile we're viewing

$query = array(

	'SELECT'	=> 'u.*, eu.username, g.g_id, g.g_user_title, g.g_moderator',

	'FROM'		=> $pun_db->prefix . 'users AS u',

	'JOINS'		=> array(

		array(

			'LEFT JOIN'	=> $pun_db->prefix . 'groups AS g',

			'ON'		=> 'g.g_id=u.group_id'

		),

    array(

       'LEFT JOIN' => table_prefix . 'users AS eu',

       'ON'        => 'eu.user_id = u.id'

    )

	),

	'WHERE'		=> 'u.id='.$id,

  'PARAMS' => array(

    'NO_PREFIX' => ''

  )

);

($hook = get_hook('pf_qr_get_user_info')) ? eval($hook) : null;

$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

if (!$pun_db->num_rows($result))

	message($lang_common['Bad request']);

$user = $pun_db->fetch_assoc($result);

if ($action == 'change_pass')

{

	($hook = get_hook('pf_change_pass_selected')) ? eval($hook) : null;

	// User pressed the cancel button

	if (isset($_POST['cancel']))

		pun_redirect(pun_link($pun_url['profile_about'], $id), $lang_common['Cancel redirect']);

	if (isset($_GET['key']))

	{

		// If the user is already logged in we shouldn't be here :)

		if (!$pun_user['is_guest'])

			message($lang_profile['Pass logout']);

		($hook = get_hook('pf_change_pass_key_supplied')) ? eval($hook) : null;

		$key = $_GET['key'];

		if ($key == '' || $key != $user['activate_key'])

			message(sprintf($lang_profile['Pass key bad'], '<a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>'));

		else

		{

			if (isset($_POST['form_sent']))

			{

				($hook = get_hook('pf_change_pass_key_form_submitted')) ? eval($hook) : null;

				$new_password1 = trim($_POST['req_new_password1']);

				$new_password2 = trim($_POST['req_new_password2']);

				if ($new_password1 != $new_password2)

					message($lang_profile['Pass not match']);

				if (pun_strlen($new_password1) < 4)

					message($lang_profile['Pass too short']);

				$new_password_hash = sha1($user['salt'].sha1($new_password1));

				$query = array(

					'UPDATE'	=> 'users',

					'SET'		=> 'password=\''.$new_password_hash.'\', activate_key=NULL',

					'WHERE'		=> 'id='.$id

				);

				($hook = get_hook('pf_qr_update_password')) ? eval($hook) : null;

				$pun_db->query_build($query) or error(__FILE__, __LINE__);

				pun_redirect(pun_link($pun_url['index']), $lang_profile['Pass updated']);

			}

			// Setup form

			$pun_page['set_count'] = $pun_page['fld_count'] = 0;

			$pun_page['form_action'] = pun_link($pun_url['change_password_key'], array($id, $key));

			// Setup breadcrumbs

			$pun_page['crumbs'] = array(

				array($pun_config['o_board_title'], pun_link($pun_url['index'])),

				array(sprintf($lang_profile['Users profile'], htmlspecialchars($user['username']), $lang_profile['Section about']), pun_link($pun_url['profile_about'], $id)),

				$lang_profile['Change password']

			);

			($hook = get_hook('pf_change_pass_key_pre_header_load')) ? eval($hook) : null;

			define('PUN_PAGE', 'profile-changepass');

			require PUN_ROOT.'header.php';

?>

<div id="pun-main" class="main">

	<h1><span><?php printf($lang_profile['Users profile'], htmlspecialchars($user['username'])) ?></span></h1>

	<div class="main-head">

		<h2><span><?php echo $lang_profile['Change password'] ?></span></h2>

	</div>

	<div class="main-content frm">

		<div id="req-msg" class="frm-warn">

			<p class="important"><?php printf($lang_common['Required warn'], '<em class="req-text">'.$lang_common['Required'].'</em>') ?></p>

		</div>

		<form id="afocus" class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $pun_page['form_action'] ?>">

			<div class="hidden">

				<input type="hidden" name="form_sent" value="1" />

			</div>

<?php ($hook = get_hook('pf_change_pass_key_pre_fieldset')) ? eval($hook) : null; ?>

			<fieldset class="frm-set set<?php echo ++$pun_page['set_count'] ?>">

				<legend class="frm-legend"><strong><?php echo $lang_common['Required information'] ?></strong></legend>

				<div class="frm-fld text required">

					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

						<span class="fld-label"><?php echo $lang_profile['New password'] ?></span><br />

						<span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_new_password1" size="35" /></span><br />

						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

						<span class="fld-help"><?php echo $lang_profile['Password help'] ?></span>

					</label>

				</div>

				<div class="frm-fld text required">

					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

						<span class="fld-label"><?php echo $lang_profile['Confirm new password'] ?></span><br />

						<span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_new_password2" size="35" /></span><br />

						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

						<span class="fld-help"><?php echo $lang_profile['Confirm password help'] ?></span>

					</label>

				</div>

			</fieldset>

<?php ($hook = get_hook('pf_change_pass_key_post_fieldset')) ? eval($hook) : null; ?>

			<div class="frm-buttons">

				<span class="submit"><input type="submit" name="update" value="<?php echo $lang_common['Submit'] ?>" /></span>

				<span class="cancel"><input type="submit" name="cancel" value="<?php echo $lang_common['Cancel'] ?>" /></span>

			</div>

		</form>

	</div>

</div>

<?php

			require PUN_ROOT.'footer.php';

		}

	}

	// Make sure we are allowed to change this user's password

	if ($pun_user['id'] != $id &&

		$pun_user['g_id'] != PUN_ADMIN &&

		($pun_user['g_moderator'] != '1' || $pun_user['g_mod_edit_users'] == '0' || $pun_user['g_mod_change_passwords'] == '0' || $user['g_id'] == PUN_ADMIN || $user['g_moderator'] == '1'))

		message($lang_common['No permission']);

	if (isset($_POST['form_sent']))

	{

		($hook = get_hook('pf_change_pass_normal_form_submitted')) ? eval($hook) : null;

		$old_password = isset($_POST['req_old_password']) ? trim($_POST['req_old_password']) : '';

		$new_password1 = trim($_POST['req_new_password1']);

		$new_password2 = trim($_POST['req_new_password2']);

		if ($new_password1 != $new_password2)

			message($lang_profile['Pass not match']);

		if (pun_strlen($new_password1) < 4)

			message($lang_profile['Pass too short']);

		$pun_page['authorized'] = false;

		if (!empty($user['password']))

		{

			$old_password_hash = sha1($user['salt'].sha1($old_password));

			if (($user['password'] == $old_password_hash) || $pun_user['is_admmod'])

				$authorized = true;

		}

		if (!$authorized)

			message($lang_profile['Wrong old password']);

		$new_password_hash = sha1($user['salt'].sha1($new_password1));

		$query = array(

			'UPDATE'	=> 'users',

			'SET'		=> 'password=\''.$new_password_hash.'\'',

			'WHERE'		=> 'id='.$id

		);

		($hook = get_hook('pf_qr_update_password2')) ? eval($hook) : null;

		$pun_db->query_build($query) or error(__FILE__, __LINE__);

		if ($pun_user['id'] == $id)

		{

			$expire = ($user['save_pass'] == '1') ? time() + 31536000 : 0;

			pun_setcookie($cookie_name, base64_encode($pun_user['id'].'|'.$new_password_hash), $expire);

		}

		pun_redirect(pun_link($pun_url['profile_about'], $id), $lang_profile['Pass updated redirect']);

	}

	// Setup form

	$pun_page['set_count'] = $pun_page['fld_count'] = 0;

	$pun_page['form_action'] = pun_link($pun_url['change_password'], $id);

	$pun_page['hidden_fields'][] = '<input type="hidden" name="form_sent" value="1" />';

	if ($pun_user['is_admmod'])

		$pun_page['hidden_fields'][] = '<input type="hidden" name="csrf_token" value="'.generate_form_token($pun_page['form_action']).'" />';

	// Setup breadcrumbs

	$pun_page['crumbs'] = array(

		array($pun_config['o_board_title'], pun_link($pun_url['index'])),

		array(sprintf($lang_profile['Users profile'], htmlspecialchars($user['username']), $lang_profile['Section about']), pun_link($pun_url['profile_about'], $id)),

		$lang_profile['Change password']

	);

	($hook = get_hook('pf_change_pass_normal_pre_header_load')) ? eval($hook) : null;

	define('PUN_PAGE', 'profile-changepass');

	require PUN_ROOT.'header.php';

?>

<div id="pun-main" class="main sectioned">

	<h1><span><?php printf($lang_profile['Users profile'], htmlspecialchars($user['username'])) ?></span></h1>

	<div class="main-head">

		<h2><span><?php echo $lang_profile['Change password'] ?></span></h2>

	</div>

	<div class="main-content frm">

		<div id="req-msg" class="frm-warn">

			<p class="important"><?php printf($lang_common['Required warn'], '<em class="req-text">'.$lang_common['Required'].'</em>') ?></p>

		</div>

		<form id="afocus" class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $pun_page['form_action']  ?>">

			<div class="hidden">

				<?php echo implode("\n\t\t\t\t", $pun_page['hidden_fields'])."\n" ?>

			</div>

<?php ($hook = get_hook('pf_change_pass_normal_pre_fieldset')) ? eval($hook) : null; ?>

			<fieldset class="frm-set set<?php echo ++$pun_page['set_count'] ?>">

				<legend class="frm-legend"><strong><?php echo $lang_common['Required information'] ?></strong></legend>

<?php if (!$pun_user['is_admmod']): ?>					<div class="frm-fld text required">

					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

						<span class="fld-label"><?php echo $lang_profile['Old password'] ?></span><br />

						<span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_old_password" size="35" /></span><br />

						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

						<span class="fld-help"><?php echo $lang_profile['Old password help'] ?></span>

					</label>

				</div>

<?php endif; ?>				<div class="frm-fld text required">

					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

						<span class="fld-label"><?php echo $lang_profile['New password'] ?></span><br />

						<span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_new_password1" size="35" /></span><br />

						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

						<span class="fld-help"><?php echo $lang_profile['Password help'] ?></span>

					</label>

				</div>

				<div class="frm-fld text required">

					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

						<span class="fld-label"><?php echo $lang_profile['Confirm new password'] ?></span><br />

						<span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_new_password2" size="35" /></span><br />

						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

						<span class="fld-help"><?php echo $lang_profile['Confirm password help'] ?></span>

					</label>

				</div>

			</fieldset>

<?php ($hook = get_hook('pf_change_pass_normal_post_fieldset')) ? eval($hook) : null; ?>

			<div class="frm-buttons">

				<span class="submit"><input type="submit" name="update" value="<?php echo $lang_common['Submit'] ?>" /></span>

				<span class="cancel"><input type="submit" name="cancel" value="<?php echo $lang_common['Cancel'] ?>" /></span>

			</div>

		</form>

	</div>

</div>

<?php

	require PUN_ROOT.'footer.php';

}

else if ($action == 'change_email')

{

	// Make sure we are allowed to change this user's e-mail

	if ($pun_user['id'] != $id &&

		$pun_user['g_id'] != PUN_ADMIN &&

		($pun_user['g_moderator'] != '1' || $pun_user['g_mod_edit_users'] == '0' || $user['g_id'] == PUN_ADMIN || $user['g_moderator'] == '1'))

		message($lang_common['No permission']);

	($hook = get_hook('pf_change_email_selected')) ? eval($hook) : null;

	// User pressed the cancel button

	if (isset($_POST['cancel']))

		pun_redirect(pun_link($pun_url['profile_about'], $id), $lang_common['Cancel redirect']);

	if (isset($_GET['key']))

	{

		$key = $_GET['key'];

		($hook = get_hook('pf_change_email_key_supplied')) ? eval($hook) : null;

		if ($key == '' || $key != $user['activate_key'])

			message(sprintf($lang_profile['E-mail key bad'], '<a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>'));

		else

		{

			$query = array(

				'UPDATE'	=> 'users',

				'SET'		=> 'email=activate_string, activate_string=NULL, activate_key=NULL',

				'WHERE'		=> 'id='.$id

			);

			($hook = get_hook('pf_qr_update_email')) ? eval($hook) : null;

			$pun_db->query_build($query) or error(__FILE__, __LINE__);

			message($lang_profile['E-mail updated']);

		}

	}

	else if (isset($_POST['form_sent']))

	{

		($hook = get_hook('pf_change_email_normal_form_submitted')) ? eval($hook) : null;

		if (sha1($_POST['req_password']) !== $pun_user['password'])

			message($lang_profile['Wrong password']);

		require PUN_ROOT.'include/email.php';

		// Validate the email-address

		$new_email = strtolower(trim($_POST['req_new_email']));

		if (!is_valid_email($new_email))

			message($lang_common['Invalid e-mail']);

		// Check it it's a banned e-mail address

		if (is_banned_email($new_email))

		{

			($hook = get_hook('pf_change_email_normal_banned_email')) ? eval($hook) : null;

			if ($pun_config['p_allow_banned_email'] == '0')

				message($lang_profile['Banned e-mail']);

			else if ($pun_config['o_mailing_list'] != '')

			{

				$mail_subject = 'Alert - Banned e-mail detected';

				$mail_message = 'User \''.$pun_user['username'].'\' changed to banned e-mail address: '.$new_email."\n\n".'User profile: '.pun_link($pun_url['user'], $id)."\n\n".'-- '."\n".'Forum Mailer'."\n".'(Do not reply to this message)';

				pun_mail($pun_config['o_mailing_list'], $mail_subject, $mail_message);

			}

		}

		// Check if someone else already has registered with that e-mail address

		$query = array(

			'SELECT'	=> 'u.id, u.username',

			'FROM'		=> 'users AS u',

			'WHERE'		=> 'u.email=\''.$pun_db->escape($new_email).'\''

		);

		($hook = get_hook('pf_qr_check_email_dupe')) ? eval($hook) : null;

		$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

		if ($pun_db->num_rows($result))

		{

			($hook = get_hook('pf_change_email_normal_dupe_email')) ? eval($hook) : null;

			if ($pun_config['p_allow_dupe_email'] == '0')

				message($lang_profile['Dupe e-mail']);

			else if ($pun_config['o_mailing_list'] != '')

			{

				while ($cur_dupe = $pun_db->fetch_assoc($result))

					$dupe_list[] = $cur_dupe['username'];

				$mail_subject = 'Alert - Duplicate e-mail detected';

				$mail_message = 'User \''.$pun_user['username'].'\' changed to an e-mail address that also belongs to: '.implode(', ', $dupe_list)."\n\n".'User profile: '.pun_link($pun_url['user'], $id)."\n\n".'-- '."\n".'Forum Mailer'."\n".'(Do not reply to this message)';

				pun_mail($pun_config['o_mailing_list'], $mail_subject, $mail_message);

			}

		}

		$new_email_key = random_key(8, true);

		// Save new e-mail and activation key

		$query = array(

			'UPDATE'	=> 'users',

			'SET'		=> 'activate_string=\''.$pun_db->escape($new_email).'\', activate_key=\''.$new_email_key.'\'',

			'WHERE'		=> 'id='.$id

		);

		($hook = get_hook('pf_qr_update_email_activation')) ? eval($hook) : null;

		$pun_db->query_build($query) or error(__FILE__, __LINE__);

		// Load the "activate e-mail" template

		$mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$pun_user['language'].'/mail_templates/activate_email.tpl'));

		// The first row contains the subject

		$first_crlf = strpos($mail_tpl, "\n");

		$mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8));

		$mail_message = trim(substr($mail_tpl, $first_crlf));

		$mail_message = str_replace('<username>', $pun_user['username'], $mail_message);

		$mail_message = str_replace('<base_url>', $base_url.'/', $mail_message);

		$mail_message = str_replace('<activation_url>', str_replace('&amp;', '&', pun_link($pun_url['change_email_key'], array($id, $new_email_key))), $mail_message);

		$mail_message = str_replace('<board_mailer>', sprintf($lang_common['Forum mailer'], $pun_config['o_board_title']), $mail_message);

		($hook = get_hook('pf_change_email_normal_pre_activation_email_sent')) ? eval($hook) : null;

		pun_mail($new_email, $mail_subject, $mail_message);

		message(sprintf($lang_profile['Activate e-mail sent'], '<a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>'));

	}

	// Setup form

	$pun_page['set_count'] = $pun_page['fld_count'] = 0;

	$pun_page['form_action'] = pun_link($pun_url['change_email'], $id);

	$pun_page['hidden_fields'][] = '<input type="hidden" name="form_sent" value="1" />';

	if ($pun_user['is_admmod'])

		$pun_page['hidden_fields'][] = '<input type="hidden" name="csrf_token" value="'.generate_form_token($pun_page['form_action']).'" />';

	// Setup form information

	$pun_page['frm_info'] = '<p class="important"><span>'.$lang_profile['E-mail info'].'</span></p>';

	// Setup breadcrumbs

	$pun_page['crumbs'] = array(

		array($pun_config['o_board_title'], pun_link($pun_url['index'])),

		array(sprintf($lang_profile['Users profile'], htmlspecialchars($user['username']), $lang_profile['Section about']), pun_link($pun_url['profile_about'], $id)),

		$lang_profile['Change e-mail']

	);

	($hook = get_hook('pf_change_email_normal_pre_header_load')) ? eval($hook) : null;

	define('PUN_PAGE', 'profile-changemail');

	require PUN_ROOT.'header.php';

?>

<div id="pun-main" class="main">

	<h1><span><?php printf($lang_profile['Users profile'], htmlspecialchars($user['username'])) ?></span></h1>

	<div class="main-head">

		<h2><span><?php echo $lang_profile['Change e-mail'] ?></span></h2>

	</div>

	<div class="main-content frm">

		<div class="frm-info">

			<?php echo $pun_page['frm_info']."\n" ?>

		</div>

		<div id="req-msg" class="frm-warn">

			<p class="important"><?php printf($lang_common['Required warn'], '<em class="req-text">'.$lang_common['Required'].'</em>') ?></p>

		</div>

		<form id="afocus" class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $pun_page['form_action'] ?>">

			<div class="hidden">

				<?php echo implode("\n\t\t\t\t", $pun_page['hidden_fields'])."\n" ?>

			</div>

<?php ($hook = get_hook('pf_change_email_normal_pre_fieldset')) ? eval($hook) : null; ?>

			<fieldset class="frm-set set<?php echo ++$pun_page['set_count'] ?>">

				<legend class="frm-legend"><strong><?php echo $lang_common['Required information'] ?></strong></legend>

				<div class="frm-fld text required">

					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

						<span class="fld-label"><?php echo $lang_profile['New e-mail'] ?></span><br />

						<span class="fld-input"><input type="text" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_new_email" size="50" maxlength="80" /></span>

						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

					</label>

				</div>

				<div class="frm-fld text required">

					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

						<span class="fld-label"><?php echo $lang_profile['Password'] ?></span><br />

						<span class="fld-input"><input type="text" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_password" size="25" /></span>

						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

					</label>

				</div>

			</fieldset>

<?php ($hook = get_hook('pf_change_email_normal_post_fieldset')) ? eval($hook) : null; ?>

			<div class="frm-buttons">

				<span class="submit"><input type="submit" name="update" value="<?php echo $lang_common['Submit'] ?>" /></span>

				<span class="cancel"><input type="submit" name="cancel" value="<?php echo $lang_common['Cancel'] ?>" /></span>

			</div>

		</form>

	</div>

</div>

<?php

	require PUN_ROOT.'footer.php';

}