2) && $uid != USERUID && $action == "editbio") $output .= write_error(_NOTAUTHORIZED); if(isMEMBER) $output .= "

"._EDITPERSONAL."

"; else $output .= "

"._NEWACCOUNT."

"; if(!empty($_POST['submit'])) { $penname = isset($_POST['newpenname']) ? escapestring($_POST['newpenname']) : false; $email = escapestring($_POST['email']); if(!isset($email) && !isADMIN) $output .= "

"._EMAILREQUIRED."

"; else if($penname && !preg_match("!^[a-z0-9-_ ]{3,30}$!i", $penname)) $output .= "

"._BADUSERNAME."

"; else if(!validEmail($email)) $output .= "

"._INVALIDEMAIL." "._TRYAGAIN."

"; else if($action == "register") { if(!$penname || !preg_match("!^[a-z0-9-_ ]{3,30}$!i", $penname)) $output .= write_error(_PENEMAILREQUIRED); else if($pwdsetting && empty($_POST['password'])) $output .= write_error(_PWDREQUIRED." "._TRYAGAIN); else { $result = dbquery("SELECT "._PENNAMEFIELD." FROM "._AUTHORTABLE." WHERE "._PENNAMEFIELD." = '".escapestring($penname)."'"); $result2 = dbquery("SELECT "._EMAILFIELD." as email FROM "._AUTHORTABLE." WHERE "._EMAILFIELD." = '$email'"); if($captcha && !captcha_confirm()) $output .= write_error(_CAPTCHAFAIL); else if(dbnumrows($result) > 0) $output .= write_error(_PENNAMEINUSE." "._TRYAGAIN); else if(dbnumrows($result2) > 0) $output .= write_error(_EMAILINUSE." "._TRYAGAIN); else if(preg_match("!^[a-z0-9-_ ]{3,30}$!i", $penname)) { if(!$pwdsetting) { $charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ'; $pass = random_string($charset, 10); $encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]); } else { if($_POST['password'] != $_POST['password2']) { $output .= write_error(_PASSWORDTWICE); $tpl->assign("output", $output); $tpl->printToScreen( ); dbclose( ); exit( ); } $pass = $_POST['password2']; $encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]); } dbquery("INSERT INTO ".substr(_AUTHORTABLE, 0, strpos(_AUTHORTABLE, "as author"))." (penname, realname, bio, email, date, password) VALUES ('".escapestring($penname)."', '".escapestring(strip_tags($_POST['realname']))."', '".strip_tags(escapestring($_POST['bio']), $allowed_tags)."', '$email'," . time() . ", '$encryppass')"); $useruid = dbinsertid(); if($logging) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`, `log_timestamp`) VALUES('".escapestring(sprintf(_LOG_REGISTER, $penname, $useruid, $_SERVER['REMOTE_ADDR']))."', '".$useruid. "', INET6_ATON('".$_SERVER['REMOTE_ADDR']."'), 'RG', " . time() . ")"); if(empty($siteskin)) { $skinquery = dbquery("SELECT skin FROM ".$settingsprefix."fanfiction_settings WHERE sitekey = '".SITEKEY."'"); list($skin) = dbrow($skinquery); } else $skin = $siteskin; dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorprefs(uid, userskin, storyindex, sortby, tinyMCE) VALUES('".$useruid."', '$skin', '$displayindex', '$defaultsort', '$tinyMCE')"); /* The section adds fields from the authorfields table to the authorinfo table allowing dynamic additions to the bio/registration page */ $fields = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_on = '1'"); while($field = dbassoc($fields)) { if(!$uid) continue; $oldfield = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE field='".$field['field_id']."' AND uid = '".$useruid."'"); if(dbnumrows($oldfield) > 0) { $newinfo = isset($_POST["af_".$field['field_name']]) ? escapestring($_POST["af_".$field['field_name']]) : false; if(!empty($newinfo)) dbquery("UPDATE ".TABLEPREFIX."fanfiction_authorinfo SET info='$newinfo' WHERE uid = '$useruid' AND field = '".$field['field_id']."'"); else dbquery("DELETE FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$useruid' AND field = '".$field['field_id']."'"); } else if(!empty($_POST["af_".$field['field_name']])) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorinfo(`uid`, `info`, `field`) VALUES('$useruid', '".escapestring($_POST["af_".$field['field_name']])."', '".$field['field_id']."');"); } /* End dynamic fields */ $subject = _SIGNUPSUBJECT; $mailtext = _SIGNUPMESSAGE._LOGIN.": $penname\n"._PASSWORD.": $pass \n\n"; if(!$pwdsetting) $mailtext .= _SIGNUPWARNING; include("includes/emailer.php"); sendemail($penname, $email, $sitename, $siteemail, $subject, $mailtext, "html"); /* registration notice */ if (isset($notifications)) { $notifications = unserialize($notifications); } if(isset($notifications['registration_notify']) && $notifications['registration_notify']) { if (isset($notifications['registration_toemail']) && $notifications['registration_toemail']) { $RegSubject = "Registration Notice"; $RegIP = $_SERVER['REMOTE_ADDR']; $RegHost = gethostbyaddr($RegIP); $RegNoticeTo = $notifications['registration_toemail']; $RegMessage = "Username: $penname" . "\r\n" . "Email: $email" . "\r\n" . "IP: $RegIP" . "\r\n" . "Host: $RegHost"; $RegMessage .= " registered on your site"; $RegMessage .= "
Profile link: " . "" . $penname . ""; $RegNoticeTo_array=explode(',', $RegNoticeTo); foreach ($RegNoticeTo_array AS $RegNoticeTo_email) { if(validEmail($RegNoticeTo_email)) { sendemail($sitename, $RegNoticeTo_email, $siteemail, $siteemail, $RegSubject, $RegMessage); } } } } /* registration notice end */ dbquery("UPDATE ".TABLEPREFIX."fanfiction_stats SET newestmember = '".$useruid."', members = members + 1"); if(defined("AUTHORPREFIX")) dbquery("UPDATE ".AUTHORPREFIX."fanfiction_stats SET newestmember = '".$useruid."', members = members + 1"); unset($_POST['submit']); $output = write_message(_ACTIONSUCCESSFUL); define("_LOGINCHECK", true); include("user/login.php"); } else $output .= _BADUSERNAME; } } else{ if(($_POST['password']) && ($_POST['password2'])) { if($_POST['password'] == $_POST['password2']) { $encryppassword = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]); dbquery("UPDATE "._AUTHORTABLE." SET password='$encryppassword' WHERE uid = '$uid'"); } else $output .= write_error(_PASSWORDTWICE); } if(isset($_POST['oldpenname']) && $penname != $_POST['oldpenname']) { $checkresult = dbquery("SELECT * FROM "._AUTHORTABLE." WHERE penname = '".escapestring($penname)."'"); if(dbnumrows($checkresult)) { $output .= write_message(_PENNAMEINUSE." "._TRYAGAIN); } else { dbquery("UPDATE "._AUTHORTABLE." SET penname = '".escapestring($penname)."' WHERE uid = '$_POST[uid]'"); if($logging) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`, `log_timestamp`) VALUES('".escapestring(sprintf(_NEWPEN, USERPENNAME, USERUID, $_POST['oldpenname'], $uid, $penname))."', '".USERUID."', INET6_ATON('".$_SERVER['REMOTE_ADDR']."'), 'EB', " . time() . ")"); } } /* The section adds fields from the authorfields table to the authorinfo table allowing dynamic additions to the bio/registration page */ $fields = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_on = '1'"); while($field = dbassoc($fields)) { $uid = isset($_POST['uid']) && isNumber($_POST['uid']) ? $_POST['uid'] : false; if(!$uid) continue; $oldfield = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE field='".$field['field_id']."' AND uid = '".$uid."'"); if(dbnumrows($oldfield) > 0) { $newinfo = isset($_POST["af_".$field['field_name']]) ? escapestring(descript($_POST["af_".$field['field_name']])) : false; if(!empty($newinfo)) dbquery("UPDATE ".TABLEPREFIX."fanfiction_authorinfo SET info='".$newinfo."' WHERE uid = '$uid' AND field = '".descript($field['field_id'])."'"); else dbquery("DELETE FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$uid' AND field = '".$field['field_id']."'"); } else if(!empty($_POST["af_".$field['field_name']])) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorinfo(`uid`, `info`, `field`) VALUES('$uid', '".escapestring($_POST["af_".$field['field_name']])."', '".$field['field_id']."');"); } /* End dynamic fields */ dbquery("UPDATE "._AUTHORTABLE." SET realname='".descript(strip_tags(escapestring($_POST['realname'])), $allowed_tags)."', email='$email', bio='".descript(strip_tags(escapestring($_POST['bio']), $allowed_tags))."', image='".($imageupload && !empty($_POST['image']) ? escapestring($_POST['image']) : "")."' WHERE uid = '$uid'"); $output .= write_message(_ACTIONSUCCESSFUL." ".(isset($_GET['uid']) ? _BACK2ADMIN : _BACK2ACCT." "._LOGINAGAIN)); } } else { if($action != "register") { $result = dbquery("SELECT * FROM "._AUTHORTABLE." WHERE "._UIDFIELD." = '$uid' LIMIT 1"); $user = dbassoc($result); $result2 = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$uid'"); while($field = dbassoc($result2)) { $user["af_".$field['field']] = $field['info']; } } if($action == "register") { $query = dbquery("SELECT message_text FROM ".TABLEPREFIX."fanfiction_messages WHERE message_name = 'tos'"); list($tos) = dbrow($query); $output .= "

$tos

"; } $output .= "

"._PENNAME.":"; if((isADMIN && uLEVEL == 1) || $action == "register") $output .= "* "; else if(isset($user)) $output .= " ".$user['penname']; $output .= "

"._REALNAME.":

"._EMAIL.":*

"._BIO.":

"; /* The section adds fields to the form from the authorfields table to the authorinfo table allowing dynamic additions to the bio/registration page */ $authorfields = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_on = '1'"); while($field = dbassoc($authorfields)) { if($field['field_type'] == 1 || $field['field_type'] == 4 || $field['field_type'] == 6) $output .= "

".$field['field_title'].":\n\n

\n"; if($field['field_type'] == 2) { $output .= "

".$field['field_title'].":\n \n

\n"; } if($field['field_type'] == 5) eval(stripslashes($field['field_code_in'])); if($field['field_type'] == 3) { $output .= "

".$field['field_title'].":\n"; $output .= " "._YES."\n "._NO."

\n"; } } /* End dynamic fields */ if($imageupload == "1") $output .= "

"._IMAGE.":

"; if($action != "register" || $pwdsetting) $output .= "

"._PASSWORD.": ".($action == "register" ? "*" : "")."

"._PASSWORD2.": ".($action == "register" ? "*" : "")."

"; if(!empty($captcha) && $action == "register") $output .= "

"._CAPTCHANOTE."

"; $output .= "

"; if(!isADMIN && $action != "register") { $output .= " ["._DELETE."]"; } $output .= "

".write_message("* "._REQUIREDFIELDS); } ?>