1 <?php

     2 /***********************************************************************

     3 

     4   Copyright (C) 2002-2008  PunBB.org

     5 

     6   This file is part of PunBB.

     7 

     8   PunBB is free software; you can redistribute it and/or modify it

     9   under the terms of the GNU General Public License as published

    10   by the Free Software Foundation; either version 2 of the License,

    11   or (at your option) any later version.

    12 

    13   PunBB is distributed in the hope that it will be useful, but

    14   WITHOUT ANY WARRANTY; without even the implied warranty of

    15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

    16   GNU General Public License for more details.

    17 

    18   You should have received a copy of the GNU General Public License

    19   along with this program; if not, write to the Free Software

    20   Foundation, Inc., 59 Temple Place, Suite 330, Boston,

    21   MA  02111-1307  USA

    22 

    23 ************************************************************************/

    24 

    25 

    26 // if (!defined('PUN_ROOT'))

    27 // 	define('PUN_ROOT', './');

    28 // require PUN_ROOT.'include/common.php';

    29 

    30 // import globals (I really hope this isn't dangerous)

    31 foreach ( $GLOBALS as $key => $_ )

    32 {

    33   $$key =& $GLOBALS[$key];

    34 }

    35 

    36 ($hook = get_hook('pf_start')) ? eval($hook) : null;

    37 

    38 $action = isset($_GET['action']) ? $_GET['action'] : null;

    39 $section = isset($_GET['section']) ? $_GET['section'] : 'about';	// Default to section "about"

    40 $id = isset($_GET['id']) ? intval($_GET['id']) : 0;

    41 if ($id < 2)

    42 	message($lang_common['Bad request']);

    43 

    44 if ($action != 'change_pass' || !isset($_GET['key']))

    45 {

    46 	if ($pun_user['g_read_board'] == '0')

    47 		message($lang_common['No view']);

    48 	else if ($pun_user['g_view_users'] == '0' && ($pun_user['is_guest'] || $pun_user['id'] != $id))

    49 		message($lang_common['No permission']);

    50 }

    51 

    52 // Load the profile.php language file

    53 require PUN_ROOT.'lang/'.$pun_user['language'].'/profile.php';

    54 $GLOBALS['lang_profile'] = $lang_profile;

    55 

    56 // Fetch info about the user whose profile we're viewing

    57 $query = array(

    58 	'SELECT'	=> 'u.*, eu.username, g.g_id, g.g_user_title, g.g_moderator',

    59 	'FROM'		=> $pun_db->prefix . 'users AS u',

    60 	'JOINS'		=> array(

    61 		array(

    62 			'LEFT JOIN'	=> $pun_db->prefix . 'groups AS g',

    63 			'ON'		=> 'g.g_id=u.group_id'

    64 		),

    65     array(

    66        'LEFT JOIN' => table_prefix . 'users AS eu',

    67        'ON'        => 'eu.user_id = u.id'

    68     )

    69 	),

    70 	'WHERE'		=> 'u.id='.$id,

    71   'PARAMS' => array(

    72     'NO_PREFIX' => ''

    73   )

    74 );

    75 

    76 ($hook = get_hook('pf_qr_get_user_info')) ? eval($hook) : null;

    77 $result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

    78 if (!$pun_db->num_rows($result))

    79 	message($lang_common['Bad request']);

    80 

    81 $user = $pun_db->fetch_assoc($result);

    82 

    83 

    84 if ($action == 'change_pass')

    85 {

    86 	($hook = get_hook('pf_change_pass_selected')) ? eval($hook) : null;

    87 

    88 	// User pressed the cancel button

    89 	if (isset($_POST['cancel']))

    90 		pun_redirect(pun_link($pun_url['profile_about'], $id), $lang_common['Cancel redirect']);

    91 

    92 	if (isset($_GET['key']))

    93 	{

    94 		// If the user is already logged in we shouldn't be here :)

    95 		if (!$pun_user['is_guest'])

    96 			message($lang_profile['Pass logout']);

    97 

    98 		($hook = get_hook('pf_change_pass_key_supplied')) ? eval($hook) : null;

    99 

   100 		$key = $_GET['key'];

   101 

   102 		if ($key == '' || $key != $user['activate_key'])

   103 			message(sprintf($lang_profile['Pass key bad'], '<a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>'));

   104 		else

   105 		{

   106 			if (isset($_POST['form_sent']))

   107 			{

   108 				($hook = get_hook('pf_change_pass_key_form_submitted')) ? eval($hook) : null;

   109 

   110 				$new_password1 = trim($_POST['req_new_password1']);

   111 				$new_password2 = trim($_POST['req_new_password2']);

   112 

   113 				if ($new_password1 != $new_password2)

   114 					message($lang_profile['Pass not match']);

   115 				if (pun_strlen($new_password1) < 4)

   116 					message($lang_profile['Pass too short']);

   117 

   118 				$new_password_hash = sha1($user['salt'].sha1($new_password1));

   119 

   120 				$query = array(

   121 					'UPDATE'	=> 'users',

   122 					'SET'		=> 'password=\''.$new_password_hash.'\', activate_key=NULL',

   123 					'WHERE'		=> 'id='.$id

   124 				);

   125 

   126 				($hook = get_hook('pf_qr_update_password')) ? eval($hook) : null;

   127 				$pun_db->query_build($query) or error(__FILE__, __LINE__);

   128 

   129 				pun_redirect(pun_link($pun_url['index']), $lang_profile['Pass updated']);

   130 			}

   131 

   132 			// Setup form

   133 			$pun_page['set_count'] = $pun_page['fld_count'] = 0;

   134 			$pun_page['form_action'] = pun_link($pun_url['change_password_key'], array($id, $key));

   135 

   136 			// Setup breadcrumbs

   137 			$pun_page['crumbs'] = array(

   138 				array($pun_config['o_board_title'], pun_link($pun_url['index'])),

   139 				array(sprintf($lang_profile['Users profile'], htmlspecialchars($user['username']), $lang_profile['Section about']), pun_link($pun_url['profile_about'], $id)),

   140 				$lang_profile['Change password']

   141 			);

   142 

   143 			($hook = get_hook('pf_change_pass_key_pre_header_load')) ? eval($hook) : null;

   144 

   145 			define('PUN_PAGE', 'profile-changepass');

   146 			require PUN_ROOT.'header.php';

   147 

   148 ?>

   149 <div id="pun-main" class="main">

   150 

   151 	<h1><span><?php printf($lang_profile['Users profile'], htmlspecialchars($user['username'])) ?></span></h1>

   152 

   153 	<div class="main-head">

   154 		<h2><span><?php echo $lang_profile['Change password'] ?></span></h2>

   155 	</div>

   156 

   157 	<div class="main-content frm">

   158 		<div id="req-msg" class="frm-warn">

   159 			<p class="important"><?php printf($lang_common['Required warn'], '<em class="req-text">'.$lang_common['Required'].'</em>') ?></p>

   160 		</div>

   161 		<form id="afocus" class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $pun_page['form_action'] ?>">

   162 			<div class="hidden">

   163 				<input type="hidden" name="form_sent" value="1" />

   164 			</div>

   165 <?php ($hook = get_hook('pf_change_pass_key_pre_fieldset')) ? eval($hook) : null; ?>

   166 			<fieldset class="frm-set set<?php echo ++$pun_page['set_count'] ?>">

   167 				<legend class="frm-legend"><strong><?php echo $lang_common['Required information'] ?></strong></legend>

   168 				<div class="frm-fld text required">

   169 					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

   170 						<span class="fld-label"><?php echo $lang_profile['New password'] ?></span><br />

   171 						<span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_new_password1" size="35" /></span><br />

   172 						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

   173 						<span class="fld-help"><?php echo $lang_profile['Password help'] ?></span>

   174 					</label>

   175 				</div>

   176 				<div class="frm-fld text required">

   177 					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

   178 						<span class="fld-label"><?php echo $lang_profile['Confirm new password'] ?></span><br />

   179 						<span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_new_password2" size="35" /></span><br />

   180 						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

   181 						<span class="fld-help"><?php echo $lang_profile['Confirm password help'] ?></span>

   182 					</label>

   183 				</div>

   184 			</fieldset>

   185 <?php ($hook = get_hook('pf_change_pass_key_post_fieldset')) ? eval($hook) : null; ?>

   186 			<div class="frm-buttons">

   187 				<span class="submit"><input type="submit" name="update" value="<?php echo $lang_common['Submit'] ?>" /></span>

   188 				<span class="cancel"><input type="submit" name="cancel" value="<?php echo $lang_common['Cancel'] ?>" /></span>

   189 			</div>

   190 		</form>

   191 	</div>

   192 

   193 </div>

   194 <?php

   195 

   196 			require PUN_ROOT.'footer.php';

   197 		}

   198 	}

   199 

   200 	// Make sure we are allowed to change this user's password

   201 	if ($pun_user['id'] != $id &&

   202 		$pun_user['g_id'] != PUN_ADMIN &&

   203 		($pun_user['g_moderator'] != '1' || $pun_user['g_mod_edit_users'] == '0' || $pun_user['g_mod_change_passwords'] == '0' || $user['g_id'] == PUN_ADMIN || $user['g_moderator'] == '1'))

   204 		message($lang_common['No permission']);

   205 

   206 	if (isset($_POST['form_sent']))

   207 	{

   208 		($hook = get_hook('pf_change_pass_normal_form_submitted')) ? eval($hook) : null;

   209 

   210 		$old_password = isset($_POST['req_old_password']) ? trim($_POST['req_old_password']) : '';

   211 		$new_password1 = trim($_POST['req_new_password1']);

   212 		$new_password2 = trim($_POST['req_new_password2']);

   213 

   214 		if ($new_password1 != $new_password2)

   215 			message($lang_profile['Pass not match']);

   216 		if (pun_strlen($new_password1) < 4)

   217 			message($lang_profile['Pass too short']);

   218 

   219 		$pun_page['authorized'] = false;

   220 		if (!empty($user['password']))

   221 		{

   222 			$old_password_hash = sha1($user['salt'].sha1($old_password));

   223 

   224 			if (($user['password'] == $old_password_hash) || $pun_user['is_admmod'])

   225 				$authorized = true;

   226 		}

   227 

   228 		if (!$authorized)

   229 			message($lang_profile['Wrong old password']);

   230 

   231 		$new_password_hash = sha1($user['salt'].sha1($new_password1));

   232 

   233 		$query = array(

   234 			'UPDATE'	=> 'users',

   235 			'SET'		=> 'password=\''.$new_password_hash.'\'',

   236 			'WHERE'		=> 'id='.$id

   237 		);

   238 

   239 		($hook = get_hook('pf_qr_update_password2')) ? eval($hook) : null;

   240 		$pun_db->query_build($query) or error(__FILE__, __LINE__);

   241 

   242 		if ($pun_user['id'] == $id)

   243 		{

   244 			$expire = ($user['save_pass'] == '1') ? time() + 31536000 : 0;

   245 			pun_setcookie($cookie_name, base64_encode($pun_user['id'].'|'.$new_password_hash), $expire);

   246 		}

   247 

   248 		pun_redirect(pun_link($pun_url['profile_about'], $id), $lang_profile['Pass updated redirect']);

   249 	}

   250 

   251 	// Setup form

   252 	$pun_page['set_count'] = $pun_page['fld_count'] = 0;

   253 	$pun_page['form_action'] = pun_link($pun_url['change_password'], $id);

   254 

   255 	$pun_page['hidden_fields'][] = '<input type="hidden" name="form_sent" value="1" />';

   256 	if ($pun_user['is_admmod'])

   257 		$pun_page['hidden_fields'][] = '<input type="hidden" name="csrf_token" value="'.generate_form_token($pun_page['form_action']).'" />';

   258 

   259 	// Setup breadcrumbs

   260 	$pun_page['crumbs'] = array(

   261 		array($pun_config['o_board_title'], pun_link($pun_url['index'])),

   262 		array(sprintf($lang_profile['Users profile'], htmlspecialchars($user['username']), $lang_profile['Section about']), pun_link($pun_url['profile_about'], $id)),

   263 		$lang_profile['Change password']

   264 	);

   265 

   266 	($hook = get_hook('pf_change_pass_normal_pre_header_load')) ? eval($hook) : null;

   267 

   268 	define('PUN_PAGE', 'profile-changepass');

   269 	require PUN_ROOT.'header.php';

   270 

   271 ?>

   272 <div id="pun-main" class="main sectioned">

   273 

   274 	<h1><span><?php printf($lang_profile['Users profile'], htmlspecialchars($user['username'])) ?></span></h1>

   275 

   276 	<div class="main-head">

   277 		<h2><span><?php echo $lang_profile['Change password'] ?></span></h2>

   278 	</div>

   279 

   280 	<div class="main-content frm">

   281 		<div id="req-msg" class="frm-warn">

   282 			<p class="important"><?php printf($lang_common['Required warn'], '<em class="req-text">'.$lang_common['Required'].'</em>') ?></p>

   283 		</div>

   284 		<form id="afocus" class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $pun_page['form_action']  ?>">

   285 			<div class="hidden">

   286 				<?php echo implode("\n\t\t\t\t", $pun_page['hidden_fields'])."\n" ?>

   287 			</div>

   288 <?php ($hook = get_hook('pf_change_pass_normal_pre_fieldset')) ? eval($hook) : null; ?>

   289 			<fieldset class="frm-set set<?php echo ++$pun_page['set_count'] ?>">

   290 				<legend class="frm-legend"><strong><?php echo $lang_common['Required information'] ?></strong></legend>

   291 <?php if (!$pun_user['is_admmod']): ?>					<div class="frm-fld text required">

   292 					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

   293 						<span class="fld-label"><?php echo $lang_profile['Old password'] ?></span><br />

   294 						<span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_old_password" size="35" /></span><br />

   295 						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

   296 						<span class="fld-help"><?php echo $lang_profile['Old password help'] ?></span>

   297 					</label>

   298 				</div>

   299 <?php endif; ?>				<div class="frm-fld text required">

   300 					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

   301 						<span class="fld-label"><?php echo $lang_profile['New password'] ?></span><br />

   302 						<span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_new_password1" size="35" /></span><br />

   303 						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

   304 						<span class="fld-help"><?php echo $lang_profile['Password help'] ?></span>

   305 					</label>

   306 				</div>

   307 				<div class="frm-fld text required">

   308 					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

   309 						<span class="fld-label"><?php echo $lang_profile['Confirm new password'] ?></span><br />

   310 						<span class="fld-input"><input type="password" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_new_password2" size="35" /></span><br />

   311 						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

   312 						<span class="fld-help"><?php echo $lang_profile['Confirm password help'] ?></span>

   313 					</label>

   314 				</div>

   315 			</fieldset>

   316 <?php ($hook = get_hook('pf_change_pass_normal_post_fieldset')) ? eval($hook) : null; ?>

   317 			<div class="frm-buttons">

   318 				<span class="submit"><input type="submit" name="update" value="<?php echo $lang_common['Submit'] ?>" /></span>

   319 				<span class="cancel"><input type="submit" name="cancel" value="<?php echo $lang_common['Cancel'] ?>" /></span>

   320 			</div>

   321 		</form>

   322 	</div>

   323 

   324 </div>

   325 <?php

   326 

   327 	require PUN_ROOT.'footer.php';

   328 }

   329 

   330 

   331 else if ($action == 'change_email')

   332 {

   333 	// Make sure we are allowed to change this user's e-mail

   334 	if ($pun_user['id'] != $id &&

   335 		$pun_user['g_id'] != PUN_ADMIN &&

   336 		($pun_user['g_moderator'] != '1' || $pun_user['g_mod_edit_users'] == '0' || $user['g_id'] == PUN_ADMIN || $user['g_moderator'] == '1'))

   337 		message($lang_common['No permission']);

   338 

   339 	($hook = get_hook('pf_change_email_selected')) ? eval($hook) : null;

   340 

   341 	// User pressed the cancel button

   342 	if (isset($_POST['cancel']))

   343 		pun_redirect(pun_link($pun_url['profile_about'], $id), $lang_common['Cancel redirect']);

   344 

   345 	if (isset($_GET['key']))

   346 	{

   347 		$key = $_GET['key'];

   348 

   349 		($hook = get_hook('pf_change_email_key_supplied')) ? eval($hook) : null;

   350 

   351 		if ($key == '' || $key != $user['activate_key'])

   352 			message(sprintf($lang_profile['E-mail key bad'], '<a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>'));

   353 		else

   354 		{

   355 			$query = array(

   356 				'UPDATE'	=> 'users',

   357 				'SET'		=> 'email=activate_string, activate_string=NULL, activate_key=NULL',

   358 				'WHERE'		=> 'id='.$id

   359 			);

   360 

   361 			($hook = get_hook('pf_qr_update_email')) ? eval($hook) : null;

   362 			$pun_db->query_build($query) or error(__FILE__, __LINE__);

   363 

   364 			message($lang_profile['E-mail updated']);

   365 		}

   366 	}

   367 	else if (isset($_POST['form_sent']))

   368 	{

   369 		($hook = get_hook('pf_change_email_normal_form_submitted')) ? eval($hook) : null;

   370 

   371 		if (sha1($_POST['req_password']) !== $pun_user['password'])

   372 			message($lang_profile['Wrong password']);

   373 

   374 		require PUN_ROOT.'include/email.php';

   375 

   376 		// Validate the email-address

   377 		$new_email = strtolower(trim($_POST['req_new_email']));

   378 		if (!is_valid_email($new_email))

   379 			message($lang_common['Invalid e-mail']);

   380 

   381 		// Check it it's a banned e-mail address

   382 		if (is_banned_email($new_email))

   383 		{

   384 			($hook = get_hook('pf_change_email_normal_banned_email')) ? eval($hook) : null;

   385 

   386 			if ($pun_config['p_allow_banned_email'] == '0')

   387 				message($lang_profile['Banned e-mail']);

   388 			else if ($pun_config['o_mailing_list'] != '')

   389 			{

   390 				$mail_subject = 'Alert - Banned e-mail detected';

   391 				$mail_message = 'User \''.$pun_user['username'].'\' changed to banned e-mail address: '.$new_email."\n\n".'User profile: '.pun_link($pun_url['user'], $id)."\n\n".'-- '."\n".'Forum Mailer'."\n".'(Do not reply to this message)';

   392 

   393 				pun_mail($pun_config['o_mailing_list'], $mail_subject, $mail_message);

   394 			}

   395 		}

   396 

   397 		// Check if someone else already has registered with that e-mail address

   398 		$query = array(

   399 			'SELECT'	=> 'u.id, u.username',

   400 			'FROM'		=> 'users AS u',

   401 			'WHERE'		=> 'u.email=\''.$pun_db->escape($new_email).'\''

   402 		);

   403 

   404 		($hook = get_hook('pf_qr_check_email_dupe')) ? eval($hook) : null;

   405 		$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

   406 		if ($pun_db->num_rows($result))

   407 		{

   408 			($hook = get_hook('pf_change_email_normal_dupe_email')) ? eval($hook) : null;

   409 

   410 			if ($pun_config['p_allow_dupe_email'] == '0')

   411 				message($lang_profile['Dupe e-mail']);

   412 			else if ($pun_config['o_mailing_list'] != '')

   413 			{

   414 				while ($cur_dupe = $pun_db->fetch_assoc($result))

   415 					$dupe_list[] = $cur_dupe['username'];

   416 

   417 				$mail_subject = 'Alert - Duplicate e-mail detected';

   418 				$mail_message = 'User \''.$pun_user['username'].'\' changed to an e-mail address that also belongs to: '.implode(', ', $dupe_list)."\n\n".'User profile: '.pun_link($pun_url['user'], $id)."\n\n".'-- '."\n".'Forum Mailer'."\n".'(Do not reply to this message)';

   419 

   420 				pun_mail($pun_config['o_mailing_list'], $mail_subject, $mail_message);

   421 			}

   422 		}

   423 

   424 		$new_email_key = random_key(8, true);

   425 

   426 		// Save new e-mail and activation key

   427 		$query = array(

   428 			'UPDATE'	=> 'users',

   429 			'SET'		=> 'activate_string=\''.$pun_db->escape($new_email).'\', activate_key=\''.$new_email_key.'\'',

   430 			'WHERE'		=> 'id='.$id

   431 		);

   432 

   433 		($hook = get_hook('pf_qr_update_email_activation')) ? eval($hook) : null;

   434 		$pun_db->query_build($query) or error(__FILE__, __LINE__);

   435 

   436 		// Load the "activate e-mail" template

   437 		$mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$pun_user['language'].'/mail_templates/activate_email.tpl'));

   438 

   439 		// The first row contains the subject

   440 		$first_crlf = strpos($mail_tpl, "\n");

   441 		$mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8));

   442 		$mail_message = trim(substr($mail_tpl, $first_crlf));

   443 

   444 		$mail_message = str_replace('<username>', $pun_user['username'], $mail_message);

   445 		$mail_message = str_replace('<base_url>', $base_url.'/', $mail_message);

   446 		$mail_message = str_replace('<activation_url>', str_replace('&amp;', '&', pun_link($pun_url['change_email_key'], array($id, $new_email_key))), $mail_message);

   447 		$mail_message = str_replace('<board_mailer>', sprintf($lang_common['Forum mailer'], $pun_config['o_board_title']), $mail_message);

   448 

   449 		($hook = get_hook('pf_change_email_normal_pre_activation_email_sent')) ? eval($hook) : null;

   450 

   451 		pun_mail($new_email, $mail_subject, $mail_message);

   452 

   453 		message(sprintf($lang_profile['Activate e-mail sent'], '<a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>'));

   454 	}

   455 

   456 	// Setup form

   457 	$pun_page['set_count'] = $pun_page['fld_count'] = 0;

   458 	$pun_page['form_action'] = pun_link($pun_url['change_email'], $id);

   459 

   460 	$pun_page['hidden_fields'][] = '<input type="hidden" name="form_sent" value="1" />';

   461 	if ($pun_user['is_admmod'])

   462 		$pun_page['hidden_fields'][] = '<input type="hidden" name="csrf_token" value="'.generate_form_token($pun_page['form_action']).'" />';

   463 

   464 	// Setup form information

   465 	$pun_page['frm_info'] = '<p class="important"><span>'.$lang_profile['E-mail info'].'</span></p>';

   466 

   467 	// Setup breadcrumbs

   468 	$pun_page['crumbs'] = array(

   469 		array($pun_config['o_board_title'], pun_link($pun_url['index'])),

   470 		array(sprintf($lang_profile['Users profile'], htmlspecialchars($user['username']), $lang_profile['Section about']), pun_link($pun_url['profile_about'], $id)),

   471 		$lang_profile['Change e-mail']

   472 	);

   473 

   474 	($hook = get_hook('pf_change_email_normal_pre_header_load')) ? eval($hook) : null;

   475 

   476 	define('PUN_PAGE', 'profile-changemail');

   477 	require PUN_ROOT.'header.php';

   478 

   479 ?>

   480 <div id="pun-main" class="main">

   481 

   482 	<h1><span><?php printf($lang_profile['Users profile'], htmlspecialchars($user['username'])) ?></span></h1>

   483 

   484 	<div class="main-head">

   485 		<h2><span><?php echo $lang_profile['Change e-mail'] ?></span></h2>

   486 	</div>

   487 

   488 	<div class="main-content frm">

   489 		<div class="frm-info">

   490 			<?php echo $pun_page['frm_info']."\n" ?>

   491 		</div>

   492 		<div id="req-msg" class="frm-warn">

   493 			<p class="important"><?php printf($lang_common['Required warn'], '<em class="req-text">'.$lang_common['Required'].'</em>') ?></p>

   494 		</div>

   495 		<form id="afocus" class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $pun_page['form_action'] ?>">

   496 			<div class="hidden">

   497 				<?php echo implode("\n\t\t\t\t", $pun_page['hidden_fields'])."\n" ?>

   498 			</div>

   499 <?php ($hook = get_hook('pf_change_email_normal_pre_fieldset')) ? eval($hook) : null; ?>

   500 			<fieldset class="frm-set set<?php echo ++$pun_page['set_count'] ?>">

   501 				<legend class="frm-legend"><strong><?php echo $lang_common['Required information'] ?></strong></legend>

   502 				<div class="frm-fld text required">

   503 					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

   504 						<span class="fld-label"><?php echo $lang_profile['New e-mail'] ?></span><br />

   505 						<span class="fld-input"><input type="text" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_new_email" size="50" maxlength="80" /></span>

   506 						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

   507 					</label>

   508 				</div>

   509 				<div class="frm-fld text required">

   510 					<label for="fld<?php echo ++$pun_page['fld_count'] ?>">

   511 						<span class="fld-label"><?php echo $lang_profile['Password'] ?></span><br />

   512 						<span class="fld-input"><input type="text" id="fld<?php echo $pun_page['fld_count'] ?>" name="req_password" size="25" /></span>

   513 						<em class="req-text"><?php echo $lang_common['Required'] ?></em>

   514 					</label>

   515 				</div>

   516 			</fieldset>

   517 <?php ($hook = get_hook('pf_change_email_normal_post_fieldset')) ? eval($hook) : null; ?>

   518 			<div class="frm-buttons">

   519 				<span class="submit"><input type="submit" name="update" value="<?php echo $lang_common['Submit'] ?>" /></span>

   520 				<span class="cancel"><input type="submit" name="cancel" value="<?php echo $lang_common['Cancel'] ?>" /></span>

   521 			</div>

   522 		</form>

   523 	</div>

   524 

   525 </div>

   526 <?php

   527 

   528 	require PUN_ROOT.'footer.php';

   529 }

   530 

   531 else if ($action == 'delete_user' || isset($_POST['delete_user_comply']) || isset($_POST['cancel']))

   532 {

   533 	// User pressed the cancel button

   534 	if (isset($_POST['cancel']))

   535 		pun_redirect(pun_link($pun_url['profile_admin'], $id), $lang_common['Cancel redirect']);

   536 

   537 	($hook = get_hook('pf_delete_user_selected')) ? eval($hook) : null;

   538 

   539 	if ($pun_user['g_id'] != PUN_ADMIN)

   540 		message($lang_common['No permission']);

   541 

   542 	if ($user['g_id'] == PUN_ADMIN)

   543 		message('Administrators cannot be deleted. In order to delete this user, you must first move him/her to a different user group.');

   544 

   545 	if (isset($_POST['delete_user_comply']))

   546 	{

   547 		($hook = get_hook('pf_delete_user_form_submitted')) ? eval($hook) : null;

   548 

   549 		delete_user($id);

   550 

   551 		pun_redirect(pun_link($pun_url['index']), $lang_profile['User delete redirect']);

   552 	}

   553 

   554 	// Setup form

   555 	$pun_page['set_count'] = $pun_page['fld_count'] = 0;

   556 	$pun_page['form_action'] = pun_link($pun_url['delete_user'], $id);

   557 

   558 	// Setup form information

   559 	$pun_page['frm_info'] = array(

   560 		'<li class="warn"><span>'.$lang_profile['Delete warning'].'</span></li>',

   561 		'<li class="warn"><span>'.$lang_profile['Delete posts info'].'</span></li>'

   562 	);

   563 

   564 	// Setup breadcrumbs

   565 	$pun_page['crumbs'] = array(

   566 		array($pun_config['o_board_title'], pun_link($pun_url['index'])),

   567 		array(sprintf($lang_profile['Users profile'], htmlspecialchars($user['username']), $lang_profile['Section admin']), pun_link($pun_url['profile_admin'], $id)),

   568 		$lang_profile['Delete user']

   569 	);

   570 

   571 	($hook = get_hook('pf_delete_user_pre_header_load')) ? eval($hook) : null;

   572 

   573 	define('PUN_PAGE', 'dialogue');

   574 	require PUN_ROOT.'header.php';

   575 

   576 ?>

   577 <div id="pun-main" class="main">

   578 

   579 	<h1><span><?php printf($lang_profile['Users profile'], htmlspecialchars($user['username'])) ?></span></h1>

   580 

   581 	<div class="main-head">

   582 		<h2><span><?php echo $lang_common['Delete'].' '.htmlspecialchars($user['username']) ?></span></h2>

   583 	</div>

   584 

   585 	<div class="main-content frm">

   586 		<div class="frm-info">

   587 			<ul>

   588 				<?php echo implode("\n\t\t\t\t\t", $pun_page['frm_info'])."\n" ?>

   589 			</ul>

   590 		</div>

   591 		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $pun_page['form_action'] ?>">

   592 			<div class="hidden">

   593 				<input type="hidden" name="csrf_token" value="<?php echo generate_form_token($pun_page['form_action']) ?>" />

   594 			</div>

   595 			<fieldset class="frm-set set<?php echo ++$pun_page['set_count'] ?>">

   596 				<legend class="frm-legend"><strong><?php echo $lang_common['Required information'] ?></strong></legend>

   597 				<div class="checkbox radbox">

   598 					<label for="fld<?php echo ++$pun_page['fld_count'] ?>"><span class="fld-label"><?php echo $lang_profile['Delete posts'] ?></span><br /><input type="checkbox" id="fld<?php echo $pun_page['fld_count'] ?>" name="delete_posts" value="1" checked="checked" /> <?php printf($lang_profile['Delete posts label'], htmlspecialchars($user['username'])) ?></label>

   599 				</div>

   600 			</fieldset>

   601 			<div class="frm-buttons">

   602 				<span class="submit"><input type="submit" name="delete_user_comply" value="<?php echo $lang_common['Submit'] ?>" /></span>

   603 				<span class="cancel"><input type="submit" name="cancel" value="<?php echo $lang_common['Cancel'] ?>" /></span>

   604 			</div>

   605 		</form>

   606 	</div>

   607 

   608 </div>

   609 <?php

   610 

   611 	require PUN_ROOT.'footer.php';

   612 }

   613 

   614 

   615 else if ($action == 'delete_avatar')

   616 {

   617 	// Make sure we are allowed to delete this user's avatar

   618 	if ($pun_user['id'] != $id &&

   619 		$pun_user['g_id'] != PUN_ADMIN &&

   620 		($pun_user['g_moderator'] != '1' || $pun_user['g_mod_edit_users'] == '0' || $user['g_id'] == PUN_ADMIN || $user['g_moderator'] == '1'))

   621 		message($lang_common['No permission']);

   622 

   623 	($hook = get_hook('pf_delete_avatar_selected')) ? eval($hook) : null;

   624 

   625 	if (file_exists($pun_config['o_avatars_dir'].'/'.$id.'.jpg'))

   626 		@unlink($pun_config['o_avatars_dir'].'/'.$id.'.jpg');

   627 	if (file_exists($pun_config['o_avatars_dir'].'/'.$id.'.png'))

   628 		@unlink($pun_config['o_avatars_dir'].'/'.$id.'.png');

   629 	if (file_exists($pun_config['o_avatars_dir'].'/'.$id.'.gif'))

   630 		@unlink($pun_config['o_avatars_dir'].'/'.$id.'.gif');

   631 

   632 	pun_redirect(pun_link($pun_url['profile_avatar'], $id), $lang_profile['Avatar deleted redirect']);

   633 }

   634 

   635 

   636 else if (isset($_POST['update_group_membership']))

   637 {

   638 	if ($pun_user['g_id'] != PUN_ADMIN)

   639 		message($lang_common['No permission']);

   640 

   641 	($hook = get_hook('pf_change_group_form_submitted')) ? eval($hook) : null;

   642 

   643 	$new_group_id = intval($_POST['group_id']);

   644 

   645 	$query = array(

   646 		'UPDATE'	=> 'users',

   647 		'SET'		=> 'group_id='.$new_group_id,

   648 		'WHERE'		=> 'id='.$id

   649 	);

   650 

   651 	($hook = get_hook('pf_qr_update_group')) ? eval($hook) : null;

   652 	$pun_db->query_build($query) or error(__FILE__, __LINE__);

   653 

   654 	$query = array(

   655 		'SELECT'	=> 'g.g_moderator',

   656 		'FROM'		=> 'groups AS g',

   657 		'WHERE'		=> 'g.g_id='.$new_group_id

   658 	);

   659 

   660 	($hook = get_hook('pf_qr_check_new_group_mod')) ? eval($hook) : null;

   661 	$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

   662 	$new_group_mod = $pun_db->result($result);

   663 

   664 	// If the user was a moderator or an administrator (and no longer is), we remove him/her from the moderator list in all forums

   665 	if (($user['g_id'] == PUN_ADMIN || $user['g_moderator'] == '1') && $new_group_id != PUN_ADMIN && $new_group_mod != '1')

   666 		clean_forum_moderators();

   667 

   668 	pun_redirect(pun_link($pun_url['profile_admin'], $id), $lang_profile['Group membership redirect']);

   669 }

   670 

   671 

   672 else if (isset($_POST['update_forums']))

   673 {

   674 	if ($pun_user['g_id'] != PUN_ADMIN)

   675 		message($lang_common['No permission']);

   676 

   677 	($hook = get_hook('pf_forum_moderators_form_submitted')) ? eval($hook) : null;

   678 

   679 	$moderator_in = (isset($_POST['moderator_in'])) ? array_keys($_POST['moderator_in']) : array();

   680 

   681 	// Loop through all forums

   682 	$query = array(

   683 		'SELECT'	=> 'f.id, f.moderators',

   684 		'FROM'		=> 'forums AS f'

   685 	);

   686 

   687 	($hook = get_hook('pf_qr_get_all_forum_mods')) ? eval($hook) : null;

   688 	$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

   689 	while ($cur_forum = $pun_db->fetch_assoc($result))

   690 	{

   691 		$cur_moderators = ($cur_forum['moderators'] != '') ? unserialize($cur_forum['moderators']) : array();

   692 

   693 		// If the user should have moderator access (and he/she doesn't already have it)

   694 		if (in_array($cur_forum['id'], $moderator_in) && !in_array($id, $cur_moderators))

   695 		{

   696 			$cur_moderators[$user['username']] = $id;

   697 			ksort($cur_moderators);

   698 		}

   699 		// If the user shouldn't have moderator access (and he/she already has it)

   700 		else if (!in_array($cur_forum['id'], $moderator_in) && in_array($id, $cur_moderators))

   701 			unset($cur_moderators[$user['username']]);

   702 

   703 		$cur_moderators = (!empty($cur_moderators)) ? '\''.$pun_db->escape(serialize($cur_moderators)).'\'' : 'NULL';

   704 

   705 		$query = array(

   706 			'UPDATE'	=> 'forums',

   707 			'SET'		=> 'moderators='.$cur_moderators,

   708 			'WHERE'		=> 'id='.$cur_forum['id']

   709 		);

   710 

   711 		($hook = get_hook('pf_qr_update_forum_moderators')) ? eval($hook) : null;

   712 		$pun_db->query_build($query) or error(__FILE__, __LINE__);

   713 	}

   714 

   715 	pun_redirect(pun_link($pun_url['profile_admin'], $id), $lang_profile['Update forums redirect']);

   716 }

   717 

   718 

   719 else if (isset($_POST['ban']))

   720 {

   721 	if ($pun_user['g_id'] != PUN_ADMIN && ($pun_user['g_moderator'] != '1' || $pun_user['g_mod_ban_users'] == '0'))

   722 		message($lang_common['No permission']);

   723 

   724 	($hook = get_hook('pf_ban_user_selected')) ? eval($hook) : null;

   725 

   726 	pun_redirect(pun_link($pun_url['admin_bans']).'&add_ban='.$id, $lang_profile['Ban redirect']);

   727 }

   728 

   729 

   730 else if (isset($_POST['form_sent']))

   731 {

   732 	// Make sure we are allowed to edit this user's profile

   733 	if ($pun_user['id'] != $id &&

   734 		$pun_user['g_id'] != PUN_ADMIN &&

   735 		($pun_user['g_moderator'] != '1' || $pun_user['g_mod_edit_users'] == '0' || $user['g_id'] == PUN_ADMIN || $user['g_moderator'] == '1'))

   736 		message($lang_common['No permission']);

   737 

   738 	($hook = get_hook('pf_change_details_form_submitted')) ? eval($hook) : null;

   739 

   740 	// Extract allowed elements from $_POST['form']

   741 	function extract_elements($allowed_elements)

   742 	{

   743 		$form = array();

   744 

   745 		while (list($key, $value) = @each($_POST['form']))

   746 		{

   747 			if (in_array($key, $allowed_elements))

   748 				$form[$key] = $value;

   749 		}

   750 

   751 		return $form;

   752 	}

   753 

   754 	$username_updated = false;

   755 

   756 	// Validate input depending on section

   757 	switch ($section)

   758 	{

   759 		case 'identity':

   760 		{

   761 			$form = extract_elements(array('realname', 'url', 'location', 'jabber', 'icq', 'msn', 'aim', 'yahoo'));

   762 

   763 			($hook = get_hook('pf_change_details_identity_validation')) ? eval($hook) : null;

   764 

   765 			if ($pun_user['is_admmod'])

   766 			{

   767 				// Are we allowed to change usernames?

   768 				if ($session->user_level >= USER_LEVEL_ADMIN || ($pun_user['g_moderator'] == '1' && $pun_user['g_mod_rename_users'] == '1'))

   769 				{

   770 					$form['username'] = trim($_POST['req_username']);

   771 					$old_username = trim($_POST['old_username']);

   772 

   773 					// Validate the new username

   774 					$errors = validate_username($form['username'], $id);

   775 					if (!empty($errors))

   776 						message(current($errors));

   777 

   778 					if ($form['username'] != $old_username)

   779 						$username_updated = true;

   780 				}

   781 

   782 				// We only allow administrators to update the post count

   783 				if ($session->user_level >= USER_LEVEL_ADMIN)

   784 					$form['num_posts'] = intval($_POST['num_posts']);

   785 			}

   786 

   787 			if ($pun_config['o_regs_verify'] == '0' || $pun_user['is_admmod'])

   788 			{

   789 				require PUN_ROOT.'include/email.php';

   790 

   791 				// Validate the email-address

   792 				$form['email'] = strtolower(trim($_POST['req_email']));

   793 				if (!is_valid_email($form['email']))

   794 					message($lang_common['Invalid e-mail']);

   795 			}

   796 

   797 			if ($pun_user['is_admmod'])

   798 				$form['admin_note'] = trim($_POST['admin_note']);

   799 

   800 			if ($session->user_level >= USER_LEVEL_ADMIN)

   801 				$form['title'] = trim($_POST['title']);

   802 			else if ($pun_user['g_set_title'] == '1')

   803 			{

   804 				$form['title'] = trim($_POST['title']);

   805 

   806 				if ($form['title'] != '')

   807 				{

   808 					// A list of words that the title may not contain

   809 					// If the language is English, there will be some duplicates, but it's not the end of the world

   810 					$forbidden = array('Member', 'Moderator', 'Administrator', 'Banned', 'Guest', $lang_common['Member'], $lang_common['Moderator'], $lang_common['Administrator'], $lang_common['Banned'], $lang_common['Guest']);

   811 

   812 					if (in_array($form['title'], $forbidden))

   813 						message($lang_profile['Forbidden title']);

   814 				}

   815 			}

   816 

   817 			// Add http:// if the URL doesn't contain it already

   818 			if ($form['url'] != '' && strpos(strtolower($form['url']), 'http://') !== 0)

   819 				$form['url'] = 'http://'.$form['url'];

   820 

   821 			// If the ICQ UIN contains anything other than digits it's invalid

   822 			if ($form['icq'] != '' && !ctype_digit($form['icq']))

   823 				message($lang_profile['Bad ICQ']);

   824 

   825 			break;

   826 		}

   827 

   828 		case 'settings':

   829 		{

   830 			$form = extract_elements(array('dst', 'timezone', 'language', 'email_setting', 'save_pass', 'notify_with_post', 'auto_notify', 'time_format', 'date_format', 'disp_topics', 'disp_posts', 'show_smilies', 'show_img', 'show_img_sig', 'show_avatars', 'show_sig', 'style'));

   831 

   832 			($hook = get_hook('pf_change_details_settings_validation')) ? eval($hook) : null;

   833 

   834 			$form['dst'] = (isset($form['dst'])) ? 1 : 0;

   835 			$form['time_format'] = (isset($form['time_format'])) ? intval($form['time_format']) : 0;

   836 			$form['date_format'] = (isset($form['date_format'])) ? intval($form['date_format']) : 0;

   837 

   838 			$form['email_setting'] = intval($form['email_setting']);

   839 			if ($form['email_setting'] < 0 && $form['email_setting'] > 2) $form['email_setting'] = 1;

   840 

   841 			if (!isset($form['save_pass']) || $form['save_pass'] != '1') $form['save_pass'] = '0';

   842 			if (!isset($form['notify_with_post']) || $form['notify_with_post'] != '1') $form['notify_with_post'] = '0';

   843 			if (!isset($form['auto_notify']) || $form['auto_notify'] != '1') $form['auto_notify'] = '0';

   844 

   845 			// If the save_pass setting has changed, we need to set a new cookie with the appropriate expire date

   846 			if ($pun_user['id'] == $id && $form['save_pass'] != $pun_user['save_pass'])

   847 				pun_setcookie($cookie_name, base64_encode($id.'|'.$user['password']), ($form['save_pass'] == '1') ? time() + 31536000 : 0);

   848 

   849 			// Make sure we got a valid language string

   850 			if (isset($form['language']))

   851 			{

   852 				$form['language'] = preg_replace('#[\.\\\/]#', '', $form['language']);

   853 				if (!file_exists(PUN_ROOT.'lang/'.$form['language'].'/common.php'))

   854 					message($lang_common['Bad request']);

   855 			}

   856 

   857 			if ($form['disp_topics'] != '' && intval($form['disp_topics']) < 3) $form['disp_topics'] = 3;

   858 			if ($form['disp_topics'] != '' && intval($form['disp_topics']) > 75) $form['disp_topics'] = 75;

   859 			if ($form['disp_posts'] != '' && intval($form['disp_posts']) < 3) $form['disp_posts'] = 3;

   860 			if ($form['disp_posts'] != '' && intval($form['disp_posts']) > 75) $form['disp_posts'] = 75;

   861 

   862 			if (!isset($form['show_smilies']) || $form['show_smilies'] != '1') $form['show_smilies'] = '0';

   863 			if (!isset($form['show_img']) || $form['show_img'] != '1') $form['show_img'] = '0';

   864 			if (!isset($form['show_img_sig']) || $form['show_img_sig'] != '1') $form['show_img_sig'] = '0';

   865 			if (!isset($form['show_avatars']) || $form['show_avatars'] != '1') $form['show_avatars'] = '0';

   866 			if (!isset($form['show_sig']) || $form['show_sig'] != '1') $form['show_sig'] = '0';

   867 

   868 			// Make sure we got a valid style string

   869 			if (isset($form['style']))

   870 			{

   871 				$form['style'] = preg_replace('#[\.\\\/]#', '', $form['style']);

   872 				if (!file_exists(PUN_ROOT.'style/'.$form['style'].'/'.$form['style'].'.css'))

   873 					message($lang_common['Bad request']);

   874 			}

   875 			break;

   876 		}

   877 

   878 		case 'signature':

   879 		{

   880 			if ($pun_config['o_signatures'] == '0')

   881 				message($lang_profile['Signatures disabled']);

   882 

   883 			($hook = get_hook('pf_change_details_signature_validation')) ? eval($hook) : null;

   884 

   885 			// Clean up signature from POST

   886 			$form['signature'] = pun_linebreaks(trim($_POST['signature']));

   887 

   888 			// Validate signature

   889 			if (pun_strlen($form['signature']) > $pun_config['p_sig_length'])

   890 				message(sprintf($lang_profile['Sig too long'], $pun_config['p_sig_length']));

   891 			else if (substr_count($form['signature'], "\n") > ($pun_config['p_sig_lines'] - 1))

   892 				message(sprintf($lang_profile['Sig too many lines'], $pun_config['p_sig_lines']));

   893 			else if ($form['signature'] && $pun_config['p_sig_all_caps'] == '0' && strtoupper($form['signature']) == $form['signature'] && !$pun_user['is_admmod'])

   894 				$form['signature'] = ucwords(strtolower($form['signature']));

   895 

   896 			// Validate BBCode syntax

   897 			if ($pun_config['p_sig_bbcode'] == '1' && strpos($form['signature'], '[') !== false && strpos($form['signature'], ']') !== false)

   898 			{

   899 				require PUN_ROOT.'include/parser.php';

   900 				$form['signature'] = preparse_bbcode($form['signature'], $foo, true);

   901 			}

   902 

   903 			break;

   904 		}

   905 

   906 		case 'avatar':

   907 		{

   908 			if ($pun_config['o_avatars'] == '0')

   909 				message($lang_profile['Avatars disabled']);

   910 

   911 			($hook = get_hook('pf_change_details_avatar_validation')) ? eval($hook) : null;

   912 

   913 			if (!isset($_FILES['req_file']))

   914 				message($lang_profile['No file']);

   915 

   916 			$uploaded_file = $_FILES['req_file'];

   917 

   918 			// Make sure the upload went smooth

   919 			if (isset($uploaded_file['error']))

   920 			{

   921 				switch ($uploaded_file['error'])

   922 				{

   923 					case 1:	// UPLOAD_ERR_INI_SIZE

   924 					case 2:	// UPLOAD_ERR_FORM_SIZE

   925 						message($lang_profile['Too large ini']);

   926 						break;

   927 

   928 					case 3:	// UPLOAD_ERR_PARTIAL

   929 						message($lang_profile['Partial upload']);

   930 						break;

   931 

   932 					case 4:	// UPLOAD_ERR_NO_FILE

   933 						message($lang_profile['No file']);

   934 						break;

   935 

   936 					case 6:	// UPLOAD_ERR_NO_TMP_DIR

   937 						message($lang_profile['No tmp directory']);

   938 						break;

   939 

   940 					default:

   941 						// No error occured, but was something actually uploaded?

   942 						if ($uploaded_file['size'] == 0)

   943 							message($lang_profile['No file']);

   944 						break;

   945 				}

   946 			}

   947 

   948 			if (is_uploaded_file($uploaded_file['tmp_name']))

   949 			{

   950 				$allowed_types = array('image/gif', 'image/jpeg', 'image/pjpeg', 'image/png', 'image/x-png');

   951 				if (!in_array($uploaded_file['type'], $allowed_types))

   952 					message($lang_profile['Bad type']);

   953 

   954 				// Make sure the file isn't too big

   955 				if ($uploaded_file['size'] > $pun_config['o_avatars_size'])

   956 					message(sprintf($lang_profile['Too large'], $pun_config['o_avatars_size']));

   957 

   958 				// Determine type

   959 				$extensions = null;

   960 				if ($uploaded_file['type'] == 'image/gif')

   961 					$extensions = array('.gif', '.jpg', '.png');

   962 				else if ($uploaded_file['type'] == 'image/jpeg' || $uploaded_file['type'] == 'image/pjpeg')

   963 					$extensions = array('.jpg', '.gif', '.png');

   964 				else

   965 					$extensions = array('.png', '.gif', '.jpg');

   966 

   967 				// Move the file to the avatar directory. We do this before checking the width/height to circumvent open_basedir restrictions.

   968 				if (!@move_uploaded_file($uploaded_file['tmp_name'], $pun_config['o_avatars_dir'].'/'.$id.'.tmp'))

   969 					message(sprintf($lang_profile['Move failed'], '<a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>'));

   970 

   971 				// Now check the width/height

   972 				list($width, $height, $type,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp');

   973 				if (empty($width) || empty($height) || $width > $pun_config['o_avatars_width'] || $height > $pun_config['o_avatars_height'])

   974 				{

   975 					@unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp');

   976 					message(sprintf($lang_profile['Too wide or high'], $pun_config['o_avatars_width'], $pun_config['o_avatars_height']));

   977 				}

   978 				else if ($type == 1 && $uploaded_file['type'] != 'image/gif')	// Prevent dodgy uploads

   979 				{

   980 					@unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp');

   981 					message($lang_profile['Bad type']);

   982 				}

   983 

   984 				// Delete any old avatars

   985 				if (file_exists($pun_config['o_avatars_dir'].'/'.$id.$extensions[0]))

   986 					@unlink($pun_config['o_avatars_dir'].'/'.$id.$extensions[0]);

   987 				if (file_exists($pun_config['o_avatars_dir'].'/'.$id.$extensions[1]))

   988 					@unlink($pun_config['o_avatars_dir'].'/'.$id.$extensions[1]);

   989 				if (file_exists($pun_config['o_avatars_dir'].'/'.$id.$extensions[2]))

   990 					@unlink($pun_config['o_avatars_dir'].'/'.$id.$extensions[2]);

   991 

   992 				// Put the new avatar in its place

   993 				@rename($pun_config['o_avatars_dir'].'/'.$id.'.tmp', $pun_config['o_avatars_dir'].'/'.$id.$extensions[0]);

   994 				@chmod($pun_config['o_avatars_dir'].'/'.$id.$extensions[0], 0644);

   995 			}

   996 			else

   997 				message($lang_profile['Unknown failure']);

   998 

   999 			break;

  1000 		}

  1001 

  1002 		default:

  1003 		{

  1004 			($hook = get_hook('pf_change_details_new_section_validation')) ? eval($hook) : null;

  1005 			break;

  1006 		}

  1007 	}

  1008 

  1009 	// All sections apart from avatar potentially affect the database

  1010 	if ($section != 'avatar')

  1011 	{

  1012 		($hook = get_hook('pf_change_details_database_validation')) ? eval($hook) : null;

  1013 

  1014 		// Singlequotes around non-empty values and NULL for empty values

  1015 		$temp = array();

  1016 		while (list($key, $input) = @each($form))

  1017 		{

  1018 			$value = ($input !== '') ? '\''.$pun_db->escape($input).'\'' : 'NULL';

  1019 

  1020 			$temp[] = $key.'='.$value;

  1021 		}

  1022 

  1023 		// Make sure we have something to update

  1024 		if (empty($temp))

  1025 			message($lang_common['Bad request']);

  1026 

  1027 		// Run the update

  1028 		$query = array(

  1029 			'UPDATE'	=> 'users',

  1030 			'SET'		=> implode(',', $temp),

  1031 			'WHERE'		=> 'id='.$id

  1032 		);

  1033 

  1034 		($hook = get_hook('pf_qr_update_user')) ? eval($hook) : null;

  1035 		$pun_db->query_build($query) or error(__FILE__, __LINE__);

  1036 

  1037 		// If we changed the username we have to update some stuff

  1038 		if ($username_updated)

  1039 		{

  1040 			($hook = get_hook('pf_change_details_username_changed')) ? eval($hook) : null;

  1041 

  1042 			$query = array(

  1043 				'UPDATE'	=> 'posts',

  1044 				'SET'		=> 'poster=\''.$pun_db->escape($form['username']).'\'',

  1045 				'WHERE'		=> 'poster_id='.$id

  1046 			);

  1047 

  1048 			($hook = get_hook('pf_qr_update_username1')) ? eval($hook) : null;

  1049 			$pun_db->query_build($query) or error(__FILE__, __LINE__);

  1050 

  1051 			$query = array(

  1052 				'UPDATE'	=> 'topics',

  1053 				'SET'		=> 'poster=\''.$pun_db->escape($form['username']).'\'',

  1054 				'WHERE'		=> 'poster=\''.$pun_db->escape($old_username).'\''

  1055 			);

  1056 

  1057 			($hook = get_hook('pf_qr_update_username2')) ? eval($hook) : null;

  1058 			$pun_db->query_build($query) or error(__FILE__, __LINE__);

  1059 

  1060 			$query = array(

  1061 				'UPDATE'	=> 'topics',

  1062 				'SET'		=> 'last_poster=\''.$pun_db->escape($form['username']).'\'',

  1063 				'WHERE'		=> 'last_poster=\''.$pun_db->escape($old_username).'\''

  1064 			);

  1065 

  1066 			($hook = get_hook('pf_qr_update_username3')) ? eval($hook) : null;

  1067 			$pun_db->query_build($query) or error(__FILE__, __LINE__);

  1068 

  1069 			$query = array(

  1070 				'UPDATE'	=> 'forums',

  1071 				'SET'		=> 'last_poster=\''.$pun_db->escape($form['username']).'\'',

  1072 				'WHERE'		=> 'last_poster=\''.$pun_db->escape($old_username).'\''

  1073 			);

  1074 

  1075 			($hook = get_hook('pf_qr_update_username4')) ? eval($hook) : null;

  1076 			$pun_db->query_build($query) or error(__FILE__, __LINE__);

  1077 

  1078 			$query = array(

  1079 				'UPDATE'	=> 'online',

  1080 				'SET'		=> 'ident=\''.$pun_db->escape($form['username']).'\'',

  1081 				'WHERE'		=> 'ident=\''.$pun_db->escape($old_username).'\''

  1082 			);

  1083 

  1084 			($hook = get_hook('pf_qr_update_username5')) ? eval($hook) : null;

  1085 			$pun_db->query_build($query) or error(__FILE__, __LINE__);

  1086 

  1087 			// If the user is a moderator or an administrator we have to update the moderator lists and bans cache

  1088 			if ($user['g_id'] == PUN_ADMIN || $user['g_moderator'] == '1')

  1089 			{

  1090 				$query = array(

  1091 					'SELECT'	=> 'f.id, f.moderators',

  1092 					'FROM'		=> 'forums AS f'

  1093 				);

  1094 

  1095 				($hook = get_hook('pf_qr_get_all_forum_mods2')) ? eval($hook) : null;

  1096 				$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

  1097 				while ($cur_forum = $pun_db->fetch_assoc($result))

  1098 				{

  1099 					$cur_moderators = ($cur_forum['moderators'] != '') ? unserialize($cur_forum['moderators']) : array();

  1100 

  1101 					if (in_array($id, $cur_moderators))

  1102 					{

  1103 						unset($cur_moderators[$old_username]);

  1104 						$cur_moderators[$form['username']] = $id;

  1105 						ksort($cur_moderators);

  1106 

  1107 						$query = array(

  1108 							'UPDATE'	=> 'forums',

  1109 							'SET'		=> 'moderators=\''.$pun_db->escape(serialize($cur_moderators)).'\'',

  1110 							'WHERE'		=> 'id='.$cur_forum['id']

  1111 						);

  1112 

  1113 						($hook = get_hook('pf_qr_update_forum_moderators2')) ? eval($hook) : null;

  1114 						$pun_db->query_build($query) or error(__FILE__, __LINE__);

  1115 					}

  1116 				}

  1117 

  1118 				// Regenerate the bans cache

  1119 				require_once PUN_ROOT.'include/cache.php';

  1120 				generate_bans_cache();

  1121 			}

  1122 		}

  1123 	}

  1124 

  1125 	pun_redirect(pun_link($pun_url['profile_'.$section], $id), $lang_profile['Profile redirect']);

  1126 }

  1127 

  1128 

  1129 if ($user['signature'] != '')

  1130 {

  1131 	require PUN_ROOT.'include/parser.php';

  1132 	$parsed_signature = parse_signature($user['signature']);

  1133 }

  1134 

  1135