Update eFic2eFic bridge and default file backups
--- a/bridges/default/editbio.php
+++ b/bridges/default/editbio.php
@@ -1,224 +1,251 @@
-<?php
-// ----------------------------------------------------------------------
-// eFiction 3.2
-// Copyright (c) 2007 by Tammy Keefer
-// Valid HTML 4.01 Transitional
-// Based on eFiction 1.1
-// Copyright (C) 2003 by Rebecca Smallwood.
-// http://efiction.sourceforge.net/
-// ----------------------------------------------------------------------
-// LICENSE
-//
-// This program is free software; you can redistribute it and/or
-// modify it under the terms of the GNU General Public License (GPL)
-// as published by the Free Software Foundation; either version 2
-// of the License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU General Public License for more details.
-//
-// To read the license please visit http://www.gnu.org/copyleft/gpl.html
-// ----------------------------------------------------------------------
-
-if(!defined("_CHARSET")) exit( );
-if(!function_exists("random_char")) {
-
-function random_char($string)
-{
- $length = strlen($string);
- $position = mt_rand(0, $length - 1);
- $output = ($string[$position]);
- return $output;
-}
-
-function random_string ($charset_string, $length)
-{
- $return_string = random_char($charset_string);
- for ($x = 1; $x < $length; $x++)
- $return_string .= random_char($charset_string);
- return $return_string;
-}
-
-}
- $uid = isset($_REQUEST['uid']) ? $_REQUEST['uid'] : false;
- if(!$uid) $uid = USERUID;
-
- if((!isADMIN || uLEVEL > 2) && $uid != USERUID && $action == "editbio") $output .= write_error(_NOTAUTHORIZED);
- if(isMEMBER) $output .= "<div id=\"pagetitle\">"._EDITPERSONAL."</div>";
- else $output .= "<div id=\"pagetitle\">"._NEWACCOUNT."</div>";
- if(!empty($_POST['submit'])) {
- $penname = isset($_POST['newpenname']) ? escapestring($_POST['newpenname']) : false;
- $email = escapestring($_POST[email]);
- if(!isset($email) && !isADMIN) $output .= "<div style='text-align: center;'>"._EMAILREQUIRED."</div>";
- else if($penname && !preg_match("!^[a-z0-9_ ]{3,30}$!i", $penname)) $output .= "<div style='text-align: center;'>"._BADUSERNAME."</div>";
- else if(!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $email)) $output .= "<div style='text-align: center;'>"._INVALIDEMAIL." "._TRYAGAIN."</div>";
- else if($action == "register") {
- if(!$penname || empty($email) || !eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $email) || !preg_match("/^[-0-9A-Z_-\s]+$/i", $penname)) $output .= write_error(_PENEMAILREQUIRED);
- else if($pwdsetting && empty($_POST['password'])) $output .= write_error(_PWDREQUIRED." "._TRYAGAIN);
- else {
- $result = dbquery("SELECT "._PENNAMEFIELD." FROM "._AUTHORTABLE." WHERE "._PENNAMEFIELD." = '".escapestring($penname)."'");
- $result2 = dbquery("SELECT "._EMAILFIELD." as email FROM "._AUTHORTABLE." WHERE "._EMAILFIELD." = ''");
- if($captcha && !captcha_confirm()) $output .= write_error(_CAPTCHAFAIL);
- else if(dbnumrows($result) > 0) $output .= write_error(_PENNAMEINUSE." "._TRYAGAIN);
- else if(dbnumrows($result2) > 0) $output .= write_error(_EMAILINUSE." "._TRYAGAIN);
- else if(preg_match("!^[a-z0-9_ ]{3,30}$!i", $penname)) {
- if(!$pwdsetting) {
- $charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';
- $pass = random_string($charset, 10);
- $encryppass = md5($pass);
- }
- else {
- if($_POST['password'] != $_POST['password2']) {
- $output .= write_error(_PASSWORDTWICE);
- $tpl->assign("output", $output);
- $tpl->printToScreen( );
- dbclose( );
- exit( );
- }
- $pass = $_POST['password2'];
- $encryppass = md5($pass);
- }
- dbquery("INSERT INTO ".substr(_AUTHORTABLE, 0, strpos(_AUTHORTABLE, "as author"))." (penname, realname, bio, email, date, password) VALUES ('".escapestring($penname)."', '".escapestring(strip_tags($_POST['realname']))."', '".strip_tags(escapestring($_POST['bio']), $allowed_tags)."', '$email', now(), '$encryppass')");
- $useruid = dbinsertid( );
- if($logging) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`) VALUES('".escapestring(sprintf(_LOG_REGISTER, $penname, USERUID, $_SERVER['REMOTE_ADDR']))."', '".$useruid."', INET_ATON('".$_SERVER['REMOTE_ADDR']."'), 'RG')");
- if(empty($siteskin)) {
- $skinquery = dbquery("SELECT skin FROM ".$settingsprefix."fanfiction_settings WHERE sitekey ='".SITEKEY."'");
- list($skin) = dbrow($skinquery);
- }
- else $skin = $siteskin;
- dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorprefs(uid, userskin, storyindex, sortby, tinyMCE) VALUES('".USERUID."', '$skin', '$displayindex', '$defaultsort', '$tinyMCE')");
-/* The section adds fields from the authorfields table to the authorinfo table allowing dynamic additions to the bio/registration page */
- $fields = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_on = '1'");
- while($field = dbassoc($fields)) {
- $uid = isset($_POST['uid']) && isNumber($_POST['uid']) ? $_POST['uid'] : false;
- if(!$uid) continue;
- $oldfield = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE field='".$field['field_id']."' AND uid = '".$uid."'");
- if(dbnumrows($oldfield) > 0) {
- $newinfo = isset($_POST["af_".$field['field_name']]) ? escapestring($_POST["af_".$field['field_name']]) : false;
- if(!empty($newinfo)) dbquery("UPDATE ".TABLEPREFIX."fanfiction_authorinfo SET info='$newinfo' WHERE uid = '$uid' AND field = '".$field['field_id']."'");
- else dbquery("DELETE FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$uid' AND field = '".$field['field_id']."'");
- }
- else if(!empty($_POST["af_".$field['field_name']])) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorinfo(`uid`, `info`, `field`) VALUES('$uid', '".escapestring($_POST["af_".$field['field_name']])."', '".$field['field_id']."');");
- }
-/* End dynamic fields */
- $subject = _SIGNUPSUBJECT;
- $mailtext = _SIGNUPMESSAGE._LOGIN.": $penname\n"._PASSWORD.": $pass \n\n";
- if(!$pwdsetting) $mailtext .= _SIGNUPWARNING;
- include("includes/emailer.php");
- sendemail($penname, $email, $sitename, $siteemail, $subject, $mailtext, "html");
- dbquery("UPDATE ".TABLEPREFIX."fanfiction_stats SET newestmember = '$penname', members = members + 1");
- unset($_POST['submit']);
- $output = write_message(_ACTIONSUCCESSFUL);
- include("user/login.php");
- }
- else $output .= _BADUSERNAME;
- }
- }
- else{
- $oldinfo = dbassoc(dbquery("SELECT * FROM "._AUTHORTABLE." WHERE uid = '".USERUID."' LIMIT 1"));
- // Update the password
- if(($_POST['password']) || ($_POST['password2'])) {
- if($_POST['password'] == $_POST['password2']) {
- $encryppassword = md5($_POST['password']);
- dbquery("UPDATE "._AUTHORTABLE." SET password='$encryppassword' WHERE uid = '$uid'");
- }
- else $output .= write_error(_PASSWORDTWICE);
- }
- // Update the penname.
- if(isset($_POST['oldpenname']) && $penname != $_POST['oldpenname']) {
- $checkresult = dbquery("SELECT * FROM "._AUTHORTABLE." WHERE penname = '".escapestring($penname)."'");
- if(dbnumrows($checkresult)) {
- $output .= write_message(_PENNAMEINUSE." "._TRYAGAIN);
- }
- else {
- dbquery("UPDATE "._AUTHORTABLE." SET penname = '".escapestring($penname)."' WHERE uid = '$_POST[uid]'");
- if($logging) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`) VALUES('".escapestring(sprintf(_NEWPEN, USERPENNAME, USERUID, $_POST[oldpenname], $uid, $penname))."', '".USERUID."', INET_ATON('".$_SERVER['REMOTE_ADDR']."'), 'EB')");
- }
- }
-/* This section adds fields from the authorfields table to the authorinfo table allowing dynamic additions to the bio/registration page */
- $fields = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_on = '1'");
- while($field = dbassoc($fields)) {
- $uid = isset($_POST['uid']) && isNumber($_POST['uid']) ? $_POST['uid'] : false;
- if(!$uid) continue;
- $oldfield = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE field='".$field['field_id']."' AND uid = '".$uid."'");
- if(dbnumrows($oldfield) > 0) {
- $newinfo = isset($_POST["af_".$field['field_name']]) ? escapestring(descript($_POST["af_".$field['field_name']])) : false;
- if(!empty($newinfo)) dbquery("UPDATE ".TABLEPREFIX."fanfiction_authorinfo SET info='".$newinfo."' WHERE uid = '$uid' AND field = '".descript($field['field_id'])."'");
- else dbquery("DELETE FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$uid' AND field = '".$field['field_id']."'");
- }
- else if(!empty($_POST["af_".$field['field_name']])) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorinfo(`uid`, `info`, `field`) VALUES('$uid', '".escapestring($_POST["af_".$field['field_name']])."', '".$field['field_id']."');");
- }
-/* End dynamic fields */
- // Now we'll update the rest.
- $result = dbquery("UPDATE "._AUTHORTABLE." SET realname='".descript(strip_tags(escapestring($_POST['realname'])), $allowed_tags)."', email='$email', bio='".descript(strip_tags(escapestring($_POST['bio']), $allowed_tags))."', image='".($imageupload && !empty($_POST['image']) ? escapestring($_POST['image']) : "")."' WHERE uid = '$uid'");
- if($result) { // only if the info actually got updated.
- if($oldinfo['email'] != $email) { // Need to reset the session and cookies in this case.
- $_SESSION[SITEKEY."_salt"] = md5($email+$encryptedpassword);
- if(isset($_COOKIE[SITEKEY."_salt"])) setcookie(SITEKEY."_salt", md5($email+$encryptedpassword), time()+60*60*24*30, "/");
- }
- }
- $output .= write_message(_ACTIONSUCCESSFUL." ".(isset($_GET['uid']) ? _BACK2ADMIN : _BACK2ACCT));
- }
- }
- else {
- if($action != "register") {
- $result = dbquery("SELECT * FROM "._AUTHORTABLE." WHERE "._UIDFIELD." = '$uid' LIMIT 1");
- $user = dbassoc($result);
- $result2 = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$uid'");
- while($field = dbassoc($result2)) {
- $user["af_".$field['field']] = $field['info'];
- }
- }
- if($action == "register") {
- $query = dbquery("SELECT message_text FROM ".TABLEPREFIX."fanfiction_messages WHERE message_name = 'tos'");
- list($tos) = dbrow($query);
- $output .= "<div class='tblborder' style='width: 90%; margin: 1em auto;'>$tos</div>";
- }
- $output .= "<div id='settingsform'><form method=\"POST\" enctype=\"multipart/form-data\" style='margin: 0 auto;' action=\"user.php?action=$action".($uid != USERUID ? "&uid=".$uid : "")."\">
- <div><label for='newpenname'>"._PENNAME.":</label>";
- if((isADMIN && uLEVEL == 1) || $action == "register")
- $output .= "<INPUT name=\"newpenname\" type=\"text\" class=\"textbox\" maxlength=\"200\" value=\"".(isset($user) ? $user['penname'] : "")."\"><INPUT name=\"oldpenname\" type=\"hidden\" value=\"".(isset($user) ? $user['penname'] : "")."\"><font color=\"red\">*</font> ";
- else if(isset($user)) $output .= " ".$user['penname'];
- $output .= "</div>
- <div><label for='realname'>"._REALNAME.": </label><INPUT type=\"text\" class=\"textbox=\" name=\"realname\" maxlength=\"200\" value=\"".(isset($user) ? $user['realname'] : "")."\"></div>
- <div><label for='email'>"._EMAIL.":</label><INPUT type=\"text\" class=\"textbox=\" name=\"email\" value=\"".(isset($user) ? $user['email'] : "")."\" maxlength=\"200\" size=\"35\"><font color=\"red\">*</font></div>
- <div><label for='bio'>"._BIO.":</label></div>
- <div style='width: 450px; margin: 0 auto;'><textarea class=\"textbox\" name=\"bio\" cols=\"50\" rows=\"6\">".(isset($user) ? stripslashes($user['bio']) : "")."</TEXTAREA></div>";
-/* The section adds fields to the form from the authorfields table to the authorinfo table allowing dynamic additions to the bio/registration page */
- $authorfields = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_on = '1'");
- while($field = dbassoc($authorfields)) {
- if($field['field_type'] == 1 || $field['field_type'] == 4 || $field['field_type'] == 6)
- $output .= "<div><label for='".$field['field_name']."'>".$field['field_title'].":</label>\n<input type='text' class='textbox' name='af_".$field['field_name']."'".(!empty($user["af_".$field['field_id']]) ? "value='".$user["af_".$field['field_id']]."'" : "").">\n</div>\n";
- if($field['field_type'] == 2) {
- $output .= "<div><label for='".$field['field_name']."'>".$field['field_title'].":</label>\n
- <select class='textbox' name='af_".$field['field_name']."'>\n";
- $opts = explode("|#|", $field['field_options']);
- foreach($opts as $opt) {
- $output .= "<option".(!empty($user["af_".$field['field_id']]) && $user["af_".$field['field_id']] == $opt ? " selected" : "").">$opt</option>\n";
- }
- $output .= "</select>\n</div>\n";
- }
- if($field['field_type'] == 5) eval(stripslashes($field['field_code_in']));
- if($field['field_type'] == 3) {
- $output .= "<div class='fieldset'><span class='label'>".$field['field_title'].":</span>\n";
- $output .= "<input type='radio' name='af_".$field['field_name']."' id='af_".$field['field_name']._YES."' value='"._YES."'".(!empty($user["af_".$field['field_id']]) && $user["af_".$field['field_id']] == _YES ? "checked='checked'" : "")."> <label for='".$field['field_name']._YES."'>"._YES."</label>\n
- <input type='radio' name='af_".$field['field_name']."' id='af_".$field['field_name']._NO."' value='"._NO."'".(!empty($user["af_".$field['field_id']]) && $user["af_".$field['field_id']] == _NO ? "checked='checked'" : "")."> <label for='".$field['field_name']._NO."'>"._NO."</label></div>\n";
- }
- }
-/* End dynamic fields */
- if($imageupload == "1")
- $output .= "<div><label for='image'>"._IMAGE.":</label> <INPUT type=\"text\" class=\"textbox=\" name=\"image\" maxlength=\"200\" value=\"".(!empty($user['image']) ? $user['image'] : "")."\"></div>";
- if($action != "register" || $pwdsetting)
- $output .= "<div><label for='password'>"._PASSWORD.":</label> <INPUT name=\"password\" class=\"textbox\" value=\"\" type=\"password\">".($action == "register" ? "<font color=\"red\">*</font>" : "")."</div>
- <div><label for='password2'>"._PASSWORD2.":</label> <INPUT name=\"password2\" class=\"textbox=\" value=\"\" type=\"password\">".($action == "register" ? "<font color=\"red\">*</font>" : "")."</div>";
- if(!empty($captcha) && $action == "register") $output .= "<div><label for='userdigit'>"._CAPTCHANOTE."</label><input MAXLENGTH=5 SIZE=5 name=\"userdigit\" type=\"text\" value=\"\"><div style='text-align: center;'><img width=120 height=40 src=\""._BASEDIR."includes/button.php\" style=\"border: 1px solid #111;\"></div></div>";
- $output .= "<div style='text-align: center; margin: 1em;'><INPUT type=\"hidden\" name=\"uid\" value=\"".(isset($user) ? $user['uid'] : "")."\"><INPUT type=\"submit\" class=\"button\" name=\"submit\" value=\""._SUBMIT."\">";
- if(!isADMIN)
- {
- $output .= " [<a href=\"admin.php?action=deleteuser&uid=$uid\">"._DELETE."</a>]";
- }
- $output .= "</div></form></div>".write_message("<font color=\"red\">*</font> "._REQUIREDFIELDS);
- }
+<?php
+// ----------------------------------------------------------------------
+// eFiction 3.2
+// Copyright (c) 2007 by Tammy Keefer
+// Valid HTML 4.01 Transitional
+// Based on eFiction 1.1
+// Copyright (C) 2003 by Rebecca Smallwood.
+// http://efiction.sourceforge.net/
+// ----------------------------------------------------------------------
+// LICENSE
+//
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the GNU General Public License (GPL)
+// as published by the Free Software Foundation; either version 2
+// of the License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// To read the license please visit http://www.gnu.org/copyleft/gpl.html
+// ----------------------------------------------------------------------
+
+if(!defined("_CHARSET")) exit( );
+if(!function_exists("random_char")) {
+
+function random_char($string)
+{
+ $length = strlen($string);
+ $position = mt_rand(0, $length - 1);
+ $output = ($string[$position]);
+ return $output;
+}
+
+function random_string ($charset_string, $length)
+{
+ $return_string = random_char($charset_string);
+ for ($x = 1; $x < $length; $x++)
+ $return_string .= random_char($charset_string);
+ return $return_string;
+}
+
+}
+
+ $uid = isset($_REQUEST['uid']) ? $_REQUEST['uid'] : false;
+ if(!$uid) $uid = USERUID;
+
+ if((!isADMIN || uLEVEL > 2) && $uid != USERUID && $action == "editbio") $output .= write_error(_NOTAUTHORIZED);
+ if(isMEMBER) $output .= "<div id=\"pagetitle\">"._EDITPERSONAL."</div>";
+ else $output .= "<div id=\"pagetitle\">"._NEWACCOUNT."</div>";
+ if(!empty($_POST['submit'])) {
+ $penname = isset($_POST['newpenname']) ? escapestring($_POST['newpenname']) : false;
+ $email = escapestring($_POST['email']);
+ if(!isset($email) && !isADMIN) $output .= "<div style='text-align: center;'>"._EMAILREQUIRED."</div>";
+ else if($penname && !preg_match("!^[a-z0-9-_ ]{3,30}$!i", $penname)) $output .= "<div style='text-align: center;'>"._BADUSERNAME."</div>";
+ else if(!validEmail($email)) $output .= "<div style='text-align: center;'>"._INVALIDEMAIL." "._TRYAGAIN."</div>";
+ else if($action == "register") {
+ if(!$penname || !preg_match("!^[a-z0-9-_ ]{3,30}$!i", $penname)) $output .= write_error(_PENEMAILREQUIRED);
+ else if($pwdsetting && empty($_POST['password'])) $output .= write_error(_PWDREQUIRED." "._TRYAGAIN);
+ else {
+ $result = dbquery("SELECT "._PENNAMEFIELD." FROM "._AUTHORTABLE." WHERE "._PENNAMEFIELD." = '".escapestring($penname)."'");
+ $result2 = dbquery("SELECT "._EMAILFIELD." as email FROM "._AUTHORTABLE." WHERE "._EMAILFIELD." = '$email'");
+ if($captcha && !captcha_confirm()) $output .= write_error(_CAPTCHAFAIL);
+ else if(dbnumrows($result) > 0) $output .= write_error(_PENNAMEINUSE." "._TRYAGAIN);
+ else if(dbnumrows($result2) > 0) $output .= write_error(_EMAILINUSE." "._TRYAGAIN);
+ else if(preg_match("!^[a-z0-9-_ ]{3,30}$!i", $penname)) {
+ if(!$pwdsetting) {
+ $charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';
+ $pass = random_string($charset, 10);
+ $encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]);
+ }
+ else {
+ if($_POST['password'] != $_POST['password2']) {
+ $output .= write_error(_PASSWORDTWICE);
+ $tpl->assign("output", $output);
+ $tpl->printToScreen( );
+ dbclose( );
+ exit( );
+ }
+ $pass = $_POST['password2'];
+ $encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]);
+ }
+ dbquery("INSERT INTO ".substr(_AUTHORTABLE, 0, strpos(_AUTHORTABLE, "as author"))." (penname, realname, bio, email, date, password) VALUES ('".escapestring($penname)."', '".escapestring(strip_tags($_POST['realname']))."', '".strip_tags(escapestring($_POST['bio']), $allowed_tags)."', '$email'," . time() . ", '$encryppass')");
+ $useruid = dbinsertid();
+ if($logging) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`, `log_timestamp`) VALUES('".escapestring(sprintf(_LOG_REGISTER, $penname, $useruid, $_SERVER['REMOTE_ADDR']))."', '".$useruid. "', INET6_ATON('".$_SERVER['REMOTE_ADDR']."'), 'RG', " . time() . ")");
+ if(empty($siteskin)) {
+ $skinquery = dbquery("SELECT skin FROM ".$settingsprefix."fanfiction_settings WHERE sitekey = '".SITEKEY."'");
+ list($skin) = dbrow($skinquery);
+ }
+ else $skin = $siteskin;
+
+
+
+ dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorprefs(uid, userskin, storyindex, sortby, tinyMCE) VALUES('".$useruid."', '$skin', '$displayindex', '$defaultsort', '$tinyMCE')");
+/* The section adds fields from the authorfields table to the authorinfo table allowing dynamic additions to the bio/registration page */
+ $fields = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_on = '1'");
+ while($field = dbassoc($fields)) {
+ if(!$uid) continue;
+ $oldfield = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE field='".$field['field_id']."' AND uid = '".$useruid."'");
+ if(dbnumrows($oldfield) > 0) {
+ $newinfo = isset($_POST["af_".$field['field_name']]) ? escapestring($_POST["af_".$field['field_name']]) : false;
+ if(!empty($newinfo)) dbquery("UPDATE ".TABLEPREFIX."fanfiction_authorinfo SET info='$newinfo' WHERE uid = '$useruid' AND field = '".$field['field_id']."'");
+ else dbquery("DELETE FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$useruid' AND field = '".$field['field_id']."'");
+ }
+ else if(!empty($_POST["af_".$field['field_name']])) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorinfo(`uid`, `info`, `field`) VALUES('$useruid', '".escapestring($_POST["af_".$field['field_name']])."', '".$field['field_id']."');");
+ }
+/* End dynamic fields */
+ $subject = _SIGNUPSUBJECT;
+ $mailtext = _SIGNUPMESSAGE._LOGIN.": $penname\n"._PASSWORD.": $pass \n\n";
+ if(!$pwdsetting) $mailtext .= _SIGNUPWARNING;
+ include("includes/emailer.php");
+ sendemail($penname, $email, $sitename, $siteemail, $subject, $mailtext, "html");
+
+ /* registration notice */
+ if (isset($notifications))
+ {
+ $notifications = unserialize($notifications);
+ }
+
+ if(isset($notifications['registration_notify']) && $notifications['registration_notify']) {
+ if (isset($notifications['registration_toemail']) && $notifications['registration_toemail'])
+ {
+ $RegSubject = "Registration Notice";
+ $RegIP = $_SERVER['REMOTE_ADDR'];
+ $RegHost = gethostbyaddr($RegIP);
+ $RegNoticeTo = $notifications['registration_toemail'];
+ $RegMessage = "Username: $penname" . "\r\n" . "Email: $email" . "\r\n" . "IP: $RegIP" . "\r\n" . "Host: $RegHost";
+ $RegMessage .= " registered on your site";
+ $RegMessage .= "<br>Profile link: " . "<a href='" . $url . "/viewuser.php?uid=" . $useruid . "'>" . $penname . "</a>";
+
+ $RegNoticeTo_array=explode(',', $RegNoticeTo);
+ foreach ($RegNoticeTo_array AS $RegNoticeTo_email) {
+ if(validEmail($RegNoticeTo_email)) {
+ sendemail($sitename, $RegNoticeTo_email, $siteemail, $siteemail, $RegSubject, $RegMessage);
+ }
+ }
+
+ }
+ }
+ /* registration notice end */
+
+ dbquery("UPDATE ".TABLEPREFIX."fanfiction_stats SET newestmember = '".$useruid."', members = members + 1");
+ if(defined("AUTHORPREFIX")) dbquery("UPDATE ".AUTHORPREFIX."fanfiction_stats SET newestmember = '".$useruid."', members = members + 1");
+ unset($_POST['submit']);
+ $output = write_message(_ACTIONSUCCESSFUL);
+ define("_LOGINCHECK", true);
+ include("user/login.php");
+ }
+ else $output .= _BADUSERNAME;
+ }
+ }
+ else{
+ if(($_POST['password']) && ($_POST['password2'])) {
+ if($_POST['password'] == $_POST['password2']) {
+ $encryppassword = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);
+ dbquery("UPDATE "._AUTHORTABLE." SET password='$encryppassword' WHERE uid = '$uid'");
+ }
+ else $output .= write_error(_PASSWORDTWICE);
+ }
+ if(isset($_POST['oldpenname']) && $penname != $_POST['oldpenname']) {
+ $checkresult = dbquery("SELECT * FROM "._AUTHORTABLE." WHERE penname = '".escapestring($penname)."'");
+ if(dbnumrows($checkresult)) {
+ $output .= write_message(_PENNAMEINUSE." "._TRYAGAIN);
+ }
+ else {
+ dbquery("UPDATE "._AUTHORTABLE." SET penname = '".escapestring($penname)."' WHERE uid = '$_POST[uid]'");
+ if($logging) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`, `log_timestamp`) VALUES('".escapestring(sprintf(_NEWPEN, USERPENNAME, USERUID, $_POST['oldpenname'], $uid, $penname))."', '".USERUID."', INET6_ATON('".$_SERVER['REMOTE_ADDR']."'), 'EB', " . time() . ")");
+ }
+ }
+/* The section adds fields from the authorfields table to the authorinfo table allowing dynamic additions to the bio/registration page */
+ $fields = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_on = '1'");
+ while($field = dbassoc($fields)) {
+ $uid = isset($_POST['uid']) && isNumber($_POST['uid']) ? $_POST['uid'] : false;
+ if(!$uid) continue;
+ $oldfield = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE field='".$field['field_id']."' AND uid = '".$uid."'");
+ if(dbnumrows($oldfield) > 0) {
+ $newinfo = isset($_POST["af_".$field['field_name']]) ? escapestring(descript($_POST["af_".$field['field_name']])) : false;
+ if(!empty($newinfo)) dbquery("UPDATE ".TABLEPREFIX."fanfiction_authorinfo SET info='".$newinfo."' WHERE uid = '$uid' AND field = '".descript($field['field_id'])."'");
+ else dbquery("DELETE FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$uid' AND field = '".$field['field_id']."'");
+ }
+ else if(!empty($_POST["af_".$field['field_name']])) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorinfo(`uid`, `info`, `field`) VALUES('$uid', '".escapestring($_POST["af_".$field['field_name']])."', '".$field['field_id']."');");
+ }
+/* End dynamic fields */
+ dbquery("UPDATE "._AUTHORTABLE." SET realname='".descript(strip_tags(escapestring($_POST['realname'])), $allowed_tags)."', email='$email', bio='".descript(strip_tags(escapestring($_POST['bio']), $allowed_tags))."', image='".($imageupload && !empty($_POST['image']) ? escapestring($_POST['image']) : "")."' WHERE uid = '$uid'");
+ $output .= write_message(_ACTIONSUCCESSFUL." ".(isset($_GET['uid']) ? _BACK2ADMIN : _BACK2ACCT." "._LOGINAGAIN));
+ }
+ }
+ else {
+ if($action != "register") {
+ $result = dbquery("SELECT * FROM "._AUTHORTABLE." WHERE "._UIDFIELD." = '$uid' LIMIT 1");
+ $user = dbassoc($result);
+ $result2 = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$uid'");
+ while($field = dbassoc($result2)) {
+ $user["af_".$field['field']] = $field['info'];
+ }
+ }
+ if($action == "register") {
+ $query = dbquery("SELECT message_text FROM ".TABLEPREFIX."fanfiction_messages WHERE message_name = 'tos'");
+ list($tos) = dbrow($query);
+ $output .= "<div class='tblborder' style='width: 90%; margin: 1em auto;'>$tos</div>";
+ }
+ $output .= "<div id='settingsform'><form method=\"POST\" id=\"editbio\" name=\"editbio\" enctype=\"multipart/form-data\" style='width: 260%; margin: 0 auto;' action=\"user.php?action=$action".($uid != USERUID ? "&uid=".$uid : "")."\">
+ <div><label for='newpenname'>"._PENNAME.":</label>";
+ if((isADMIN && uLEVEL == 1) || $action == "register")
+ $output .= "<INPUT name=\"newpenname\" type=\"text\" class=\"textbox\" maxlength=\"200\" value=\"".(isset($user) ? $user['penname'] : "")."\"><INPUT name=\"oldpenname\" type=\"hidden\" value=\"".(isset($user) ? $user['penname'] : "")."\"><font color=\"red\">*</font> ";
+ else if(isset($user)) $output .= " ".$user['penname'];
+
+ $output .= "</div>
+ <div><label for='realname'>"._REALNAME.": </label><INPUT type=\"text\" class=\"textbox=\" name=\"realname\" maxlength=\"200\" value=\"".(isset($user) ? $user['realname'] : "")."\"></div>
+ <div><label for='email'>"._EMAIL.":</label><INPUT type=\"text\" class=\"textbox=\" name=\"email\" value=\"".(isset($user) ? $user['email'] : "")."\" maxlength=\"200\" size=\"35\"><font color=\"red\">*</font></div>
+ <div><label for='bio'>"._BIO.":</label></div>
+ <div style='width: 450px; margin: 0 auto;'>
+ <textarea class=\"textbox\" name=\"bio\" cols=\"50\" rows=\"6\">".(isset($user['bio']) ? stripslashes($user['bio']) : "")."</TEXTAREA></div>";
+/* The section adds fields to the form from the authorfields table to the authorinfo table allowing dynamic additions to the bio/registration page */
+ $authorfields = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_on = '1'");
+ while($field = dbassoc($authorfields)) {
+ if($field['field_type'] == 1 || $field['field_type'] == 4 || $field['field_type'] == 6)
+ $output .= "<div><label for='".$field['field_name']."'>".$field['field_title'].":</label>\n<input type='text' class='textbox' name='af_".$field['field_name']."'".(!empty($user["af_".$field['field_id']]) ? "value='".$user["af_".$field['field_id']]."'" : "").">\n</div>\n";
+ if($field['field_type'] == 2) {
+ $output .= "<div><label for='".$field['field_name']."'>".$field['field_title'].":</label>\n
+ <select class='textbox' name='af_".$field['field_name']."'>\n";
+ $opts = explode("|#|", $field['field_options']);
+ foreach($opts as $opt) {
+ $output .= "<option".(!empty($user["af_".$field['field_id']]) && $user["af_".$field['field_id']] == $opt ? " selected" : "").">$opt</option>\n";
+ }
+ $output .= "</select>\n</div>\n";
+ }
+ if($field['field_type'] == 5) eval(stripslashes($field['field_code_in']));
+ if($field['field_type'] == 3) {
+ $output .= "<div class='fieldset'><span class='label'>".$field['field_title'].":</span>\n";
+ $output .= "<input type='radio' name='af_".$field['field_name']."' id='af_".$field['field_name']._YES."' value='"._YES."'".(!empty($user["af_".$field['field_id']]) && $user["af_".$field['field_id']] == _YES ? "checked='checked'" : "")."> <label for='".$field['field_name']._YES."'>"._YES."</label>\n
+ <input type='radio' name='af_".$field['field_name']."' id='af_".$field['field_name']._NO."' value='"._NO."'".(!empty($user["af_".$field['field_id']]) && $user["af_".$field['field_id']] == _NO ? "checked='checked'" : "")."> <label for='".$field['field_name']._NO."'>"._NO."</label></div>\n";
+ }
+ }
+/* End dynamic fields */
+ if($imageupload == "1")
+ $output .= "<div><label for='image'>"._IMAGE.":</label> <INPUT type=\"text\" class=\"textbox=\" name=\"image\" maxlength=\"200\" value=\"".(!empty($user['image']) ? $user['image'] : "")."\"></div>";
+ if($action != "register" || $pwdsetting)
+ $output .= "<div><label for='password'>"._PASSWORD.":</label> <INPUT name=\"password\" class=\"textbox\" value=\"\" type=\"password\">".($action == "register" ? "<font color=\"red\">*</font>" : "")."</div>
+ <div><label for='password2'>"._PASSWORD2.":</label> <INPUT name=\"password2\" class=\"textbox=\" value=\"\" type=\"password\">".($action == "register" ? "<font color=\"red\">*</font>" : "")."</div>";
+ if(!empty($captcha) && $action == "register") $output .= "<div><label for='userdigit'>"._CAPTCHANOTE."</label><input MAXLENGTH=5 SIZE=5 name=\"userdigit\" type=\"text\" value=\"\"><div style='text-align: center;'><img width=240 height=60 src=\""._BASEDIR."includes/button.php\" style=\"border: 1px solid #111;\"></div></div>";
+ $output .= "<div style='text-align: center; margin: 1em;'><INPUT type=\"hidden\" name=\"uid\" value=\"".(isset($user) ? $user['uid'] : "")."\"><INPUT type=\"submit\" class=\"button\" name=\"submit\" value=\""._SUBMIT."\">";
+ if(!isADMIN && $action != "register")
+ {
+ $output .= " [<a href=\"admin.php?action=members&delete=$uid\">"._DELETE."</a>]";
+ }
+ $output .= "</div></form></div>".write_message("<font color=\"red\">*</font> "._REQUIREDFIELDS);
+ }
?>
+
--- a/bridges/default/get_session_vars.php
+++ b/bridges/default/get_session_vars.php
@@ -1,65 +1,69 @@
-<?php
-// ----------------------------------------------------------------------
-// eFiction 3.2
-// Copyright (c) 2007 by Tammy Keefer
-// Valid HTML 4.01 Transitional
-// Based on eFiction 1.1
-// Copyright (C) 2003 by Rebecca Smallwood.
-// http://efiction.sourceforge.net/
-// ----------------------------------------------------------------------
-// LICENSE
-//
-// This program is free software; you can redistribute it and/or
-// modify it under the terms of the GNU General Public License (GPL)
-// as published by the Free Software Foundation; either version 2
-// of the License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU General Public License for more details.
-//
-// To read the license please visit http://www.gnu.org/copyleft/gpl.html
-// ----------------------------------------------------------------------
-
-if(!defined("_CHARSET")) exit( );
-// Get session variables from cookie data if not logged in.
-// To bridge to another program replace (or add to) this information with the bridge to your other script. See examples in the includes/bridges/ folder.
-if (!empty($_COOKIE[$sitekey."_useruid"])) {
- $userdata = dbassoc(dbquery("SELECT ap.*, "._UIDFIELD." as uid, "._PENNAMEFIELD." as penname, "._EMAILFIELD." as email, "._PASSWORDFIELD." as password FROM "._AUTHORTABLE." LEFT JOIN ".$tableprefix."fanfiction_authorprefs as ap ON ap.uid = "._UIDFIELD." WHERE "._UIDFIELD." = '".$_COOKIE[$sitekey."_useruid"]."'"));
- if($userdata && $userdata['level'] != -1 && $_COOKIE[$sitekey.'_salt'] == md5($userdata['email']+$userdata['password'])) {
- define("USERUID", $userdata['uid']);
- define("USERPENNAME", $userdata['penname']);
- if(!isset($_SESSION[$sitekey."_skin"]) && !empty($userdata['userskin'])) $siteskin = $userdata['userskin'];
- else if(isset($_SESSION[$sitekey."_skin"])) $siteskin = $_SESSION[$sitekey."_skin"];
- else $siteskin = $defaultskin;
- define("uLEVEL", $userdata['level']);
- define("isADMIN", uLEVEL > 0 ? true : false);
- define("isMEMBER", true);
- if(!isset($_SESSION[$sitekey."_agecontsent"])) $ageconsent = $userdata['ageconsent'];
- else $ageconsent = $_SESSION[$sitekey."_agecontsent"];
- }
-}
-if(!empty($_SESSION[$sitekey."_useruid"]) && !defined("USERUID")) {
- $userdata = dbassoc(dbquery("SELECT ap.*, "._UIDFIELD." as uid, "._PENNAMEFIELD." as penname, "._EMAILFIELD." as email, "._PASSWORDFIELD." as password FROM "._AUTHORTABLE." LEFT JOIN ".$tableprefix."fanfiction_authorprefs as ap ON ap.uid = "._UIDFIELD." WHERE "._UIDFIELD." = '".$_SESSION[$sitekey."_useruid"]."'"));
- if($userdata && $userdata['level'] != -1 && $_SESSION[$sitekey.'_salt'] == md5($userdata['email']+$userdata['password'])) {
- define("USERUID", $userdata['uid']);
- define("USERPENNAME", $userdata['penname']);
- if(!isset($_SESSION[$sitekey."_skin"]) && !empty($userdata['userskin'])) $siteskin = $userdata['userskin'];
- else if(isset($_SESSION[$sitekey."_skin"])) $siteskin = $_SESSION[$sitekey."_skin"];
- else $siteskin = $defaultskin;
- define("uLEVEL", $userdata['level']);
- define("isADMIN", uLEVEL > 0 ? true : false);
- define("isMEMBER", true);
- if(!isset($_SESSION[$sitekey."_agecontsent"])) $ageconsent = $userdata['ageconsent'];
- else $ageconsent = $_SESSION[$sitekey."_agecontsent"];
- }
-}
-if(!defined("USERUID")) define("USERUID", false);
-if(!defined("USERPENNAME")) define("USERPENNAME", false);
-if(!defined("uLEVEL")) define("uLEVEL", 0);
-if(!defined("isMEMBER")) define("isMEMBER", false);
-if(!defined("isADMIN")) define("isADMIN", false);
-if(empty($siteskin)) $siteskin = $defaultskin;
-
+<?php
+// ----------------------------------------------------------------------
+// eFiction 3.2
+// Copyright (c) 2007 by Tammy Keefer
+// Valid HTML 4.01 Transitional
+// Based on eFiction 1.1
+// Copyright (C) 2003 by Rebecca Smallwood.
+// http://efiction.sourceforge.net/
+// ----------------------------------------------------------------------
+// LICENSE
+//
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the GNU General Public License (GPL)
+// as published by the Free Software Foundation; either version 2
+// of the License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// To read the license please visit http://www.gnu.org/copyleft/gpl.html
+// ----------------------------------------------------------------------
+
+if(!defined("_CHARSET")) exit( );
+// Get session variables from cookie data if not logged in.
+// To bridge to another program replace (or add to) this information with the bridge to your other script. See examples in the includes/bridges/ folder.
+if (!empty($_COOKIE[$sitekey."_useruid"])) {
+ $userdata = dbassoc(dbquery("SELECT ap.*, "._UIDFIELD." as uid, "._PENNAMEFIELD." as penname, "._EMAILFIELD." as email, "._PASSWORDFIELD." as password FROM "._AUTHORTABLE." LEFT JOIN ".TABLEPREFIX."fanfiction_authorprefs as ap ON ap.uid = "._UIDFIELD." WHERE "._UIDFIELD." = '".$_COOKIE[$sitekey."_useruid"]."'"));
+ if($userdata && $userdata['level'] != -1 && $_COOKIE[$sitekey.'_salt'] == md5($userdata['email'] . $userdata['password'])) {
+ define("USERUID", $userdata['uid']);
+ define("USERPENNAME", $userdata['penname']);
+ // the following line fixes missing authorpref rows
+ if(empty($userdata['userskin'] )) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorprefs(uid, userskin, storyindex, sortby, tinyMCE) VALUES('".$userdata['uid']."', '$defaultskin', '$displayindex', '$defaultsort', '$tinyMCE')");
+ if(!isset($_SESSION[$sitekey."_skin"]) && !empty($userdata['userskin'])) $siteskin = $userdata['userskin'];
+ else if(isset($_SESSION[$sitekey."_skin"])) $siteskin = $_SESSION[$sitekey."_skin"];
+ else $siteskin = $defaultskin;
+ define("uLEVEL", $userdata['level']);
+ define("isADMIN", uLEVEL > 0 ? true : false);
+ define("isMEMBER", true);
+ if(EMPTY($_SESSION[$sitekey."_ageconsent"])) $ageconsent = $userdata['ageconsent'];
+ else $ageconsent = $_SESSION[$sitekey."_ageconsent"];
+ }
+}
+if(!empty($_SESSION[$sitekey."_useruid"]) && !defined("USERUID")) {
+ $userdata = dbassoc(dbquery("SELECT ap.*, "._UIDFIELD." as uid, "._PENNAMEFIELD." as penname, "._EMAILFIELD." as email, "._PASSWORDFIELD." as password FROM "._AUTHORTABLE." LEFT JOIN ".TABLEPREFIX."fanfiction_authorprefs as ap ON ap.uid = "._UIDFIELD." WHERE "._UIDFIELD." = '".$_SESSION[$sitekey."_useruid"]."'"));
+ if($userdata && $userdata['level'] != -1 && $_SESSION[$sitekey.'_salt'] == md5($userdata['email'] . $userdata['password'])) {
+ define("USERUID", $userdata['uid']);
+ define("USERPENNAME", $userdata['penname']);
+ // the following line fixes missing authorpref rows
+ if(empty($userdata['userskin'] )) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_authorprefs(uid, userskin, storyindex, sortby, tinyMCE) VALUES('".$userdata['uid']."', '$defaultskin', '$displayindex', '$defaultsort', '$tinyMCE')");
+ if(!isset($_SESSION[$sitekey."_skin"]) && !empty($userdata['userskin'])) $siteskin = $userdata['userskin'];
+ else if(isset($_SESSION[$sitekey."_skin"])) $siteskin = $_SESSION[$sitekey."_skin"];
+ else $siteskin = $defaultskin;
+ define("uLEVEL", $userdata['level']);
+ define("isADMIN", uLEVEL > 0 ? true : false);
+ define("isMEMBER", true);
+ if(!isset($_SESSION[$sitekey."_ageconsent"])) $ageconsent = $userdata['ageconsent'];
+ else $ageconsent = $_SESSION[$sitekey."_ageconsent"];
+ }
+}
+if(!defined("USERUID")) define("USERUID", 0);
+if(!defined("USERPENNAME")) define("USERPENNAME", false);
+if(!defined("uLEVEL")) define("uLEVEL", 0);
+if(!defined("isMEMBER")) define("isMEMBER", false);
+if(!defined("isADMIN")) define("isADMIN", false);
+if(empty($siteskin)) $siteskin = $defaultskin;
+
?>
--- a/bridges/default/login.php
+++ b/bridges/default/login.php
@@ -1,87 +1,137 @@
-<?php
-// ----------------------------------------------------------------------
-// eFiction 3.2
-// Copyright (c) 2007 by Tammy Keefer
-// Valid HTML 4.01 Transitional
-// Based on eFiction 1.1
-// Copyright (C) 2003 by Rebecca Smallwood.
-// http://efiction.sourceforge.net/
-// ----------------------------------------------------------------------
-// LICENSE
-//
-// This program is free software; you can redistribute it and/or
-// modify it under the terms of the GNU General Public License (GPL)
-// as published by the Free Software Foundation; either version 2
-// of the License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU General Public License for more details.
-//
-// To read the license please visit http://www.gnu.org/copyleft/gpl.html
-// ----------------------------------------------------------------------
-
-if(!defined("_LOGINCHECK")) exit( );
- if(isset($_POST['submit']) && preg_match("!^[a-z0-9_ ]{3,30}$!i", $_POST['penname'])) {
- define("_BASEDIR", "");
- include_once("config.php");
- $settings = dbquery("SELECT tableprefix, maintenance, sitekey, debug FROM ".$settingsprefix."fanfiction_settings WHERE sitekey = '".$sitekey."'");
- list($tableprefix, $maintenance, $sitekey, $debug) = dbrow($settings);
- include_once("includes/queries.php");
- $result = dbquery("SELECT *, "._UIDFIELD." as uid FROM "._AUTHORTABLE." LEFT JOIN ".$tableprefix."fanfiction_authorprefs AS ap ON ap.uid = "._UIDFIELD." WHERE "._PENNAMEFIELD." = '".$_POST['penname']."'");
- $passwd = dbassoc($result);
- if($maintenance && $passwd['level'] < 0) {
- header("Location: maintenance.php");
- exit( );
- }
- $encryptedpassword = md5($_POST['password']);
- if($passwd['level'] == -1) {
- require_once("header.php");
- //make a new TemplatePower object
- if(file_exists("$skindir/default.tpl")) $tpl = new TemplatePower( "$skindir/default.tpl" );
- else $tpl = new TemplatePower("default_tpls/default.tpl");
- include_once("includes/corefunctions.php");
- accessDenied( );
- }
- if(isset($_POST['cookiecheck'])) {
- setcookie($sitekey."_useruid",$passwd['uid'], time()+60*60*24*30, "/");
- setcookie($sitekey."_salt", md5($passwd['email']+$encryptedpassword), time()+60*60*24*30, "/");
- }
- if($passwd['password'] == $encryptedpassword) {
- if(!isset($_SESSION)) session_start( );
- $_SESSION[$sitekey."_useruid"] = $passwd['uid'];
- $_SESSION[$sitekey."_salt"] = md5($passwd['email']+$encryptedpassword);
- }
-
- else {
- require_once("header.php");
- //make a new TemplatePower object
- if(file_exists("$skindir/default.tpl")) $tpl = new TemplatePower( "$skindir/default.tpl" );
- else $tpl = new TemplatePower("default_tpls/default.tpl");
- include_once("includes/pagesetup.php");
- $output .= "<div id=\"pagetitle\">"._MEMBERLOGIN."</div>";
- $output .= "<div style='text-align: center;'>"._WRONGPASSWORD."</div>";
- $tpl->assign("output", $output);
- $tpl->printToScreen( );
- dbclose( );
- exit( );
- }
- }
- else if(!isMEMBER) {
- $output .= "<div id=\"pagetitle\">"._MEMBERLOGIN."</div>";
- $output .= "<div style=\"width: 250px; margin: 0 auto; text-align: center;\"><form method=\"POST\" enctype=\"multipart/form-data\" action=\"user.php?action=login".(isset($_GET['sid']) && isNumber($_GET['sid']) ? "&sid=".$_GET['sid'] : "")."\">
- <div class=\"label\" style=\"float: left; width: 30%; text-align: right;\"><label for=\"penname\">"._PENNAME.":</label></div><INPUT type=\"text\" class=\"textbox\" name=\"penname\" id=\"penname\"><br />
- <div class=\"label\" style=\"float: left; width: 30%; text-align: right;\"><label for=\"pswd\">"._PASSWORD.":</label></div><INPUT type=\"password\" class=\"textbox\" id=\"pswd\" name=\"password\"><br />
- <INPUT type=\"checkbox\" class=\"checkbox\" name=\"cookiecheck\" id=\"cookiecheck\" value=\"1\"><label for=\"cookiecheck\">"._REMEMBERME."</label><br />
- <INPUT type=\"submit\" class=\"button\" name=\"submit\" value=\""._SUBMIT."\">
- </form></div>";
- $linkquery = dbquery("SELECT * from ".TABLEPREFIX."fanfiction_pagelinks WHERE link_name = 'login' OR link_name = 'lostpassword'");
- while($link = dbassoc($linkquery)) {
- if($link['link_access'] && !isMEMBER) continue;
- if($link['link_access'] == 2 && !isADMIN) continue;
- $pagelinks[$link['link_name']] = array("id" => $link['link_id'], "text" => $link['link_text'], "url" => _BASEDIR.$link['link_url'], "link" => "<a href=\"".$link['link_url']."\" title=\"".$link['link_text']."\"".($link['link_target'] ? " target=\"_blank\"" : "").($current == $link['link_name'] ? " id=\"current\"" : "").">".$link['link_text']."</a>");
- }
- $output .= "<div style='text-align: center;'>".$pagelinks['register']['link']." | ".$pagelinks['lostpassword']['link']."</div>";
- }
+<?php
+// ----------------------------------------------------------------------
+// eFiction 3.2
+// Copyright (c) 2007 by Tammy Keefer
+// Valid HTML 4.01 Transitional
+// Based on eFiction 1.1
+// Copyright (C) 2003 by Rebecca Smallwood.
+// http://efiction.sourceforge.net/
+// ----------------------------------------------------------------------
+// LICENSE
+//
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the GNU General Public License (GPL)
+// as published by the Free Software Foundation; either version 2
+// of the License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// To read the license please visit http://www.gnu.org/copyleft/gpl.html
+// ----------------------------------------------------------------------
+
+ if(isset($_POST['submit']) && preg_match("!^[-a-z0-9_ ]{3,30}$!i", $_POST['penname'])) {
+ if(!defined("_LOGINCHECK")) exit( );
+ define("_BASEDIR", "");
+ include_once("config.php");
+ $settings = dbquery("SELECT tableprefix, maintenance, sitekey, debug FROM ".$settingsprefix."fanfiction_settings WHERE sitekey = '".$sitekey."'");
+ list($tableprefix, $maintenance, $sitekey, $debug) = dbrow($settings);
+ $tempdebug = $debug;
+ $debug = 0;
+ define("TABLEPREFIX", $tableprefix);
+ define("SITEKEY", $sitekey);
+ include_once("includes/queries.php");
+ $result = dbquery("SELECT *, "._UIDFIELD." as uid FROM "._AUTHORTABLE." LEFT JOIN ".$tableprefix."fanfiction_authorprefs AS ap ON ap.uid = "._UIDFIELD." WHERE "._PENNAMEFIELD." = '".$_POST['penname']."'");
+ $passwd = dbassoc($result);
+ if(!dbnumrows($result)) {
+ require_once("header.php");
+ //make a new TemplatePower object
+ if(file_exists("$skindir/default.tpl")) $tpl = new TemplatePower( "$skindir/default.tpl" );
+ else $tpl = new TemplatePower("default_tpls/default.tpl");
+ include_once("includes/pagesetup.php");
+ $output = write_error(_NOSUCHACCOUNT);
+ $tpl->assign("output", $output);
+ $tpl->printToScreen( );
+ dbclose( );
+ exit( );
+ }
+ if($maintenance && $passwd['level'] < 0) {
+ header("Location: maintenance.php");
+ exit( );
+ }
+ $encryptedpasswordb = $passwd['password'];
+ $encryptedpasswordm = md5($_POST['password']);
+ if($passwd['level'] == -1) {
+ require_once("header.php");
+ //make a new TemplatePower object
+ if(file_exists("$skindir/default.tpl")) $tpl = new TemplatePower( "$skindir/default.tpl" );
+ else $tpl = new TemplatePower("default_tpls/default.tpl");
+ include_once("includes/pagesetup.php");
+ $output = write_error(_ACCOUNTLOCKED);
+ $tpl->assign("output", $output);
+ $tpl->printToScreen( );
+ dbclose( );
+ exit( );
+ }
+ if(password_verify($_POST['password'], $encryptedpasswordb) == $encryptedpasswordb) {
+ if(isset($_POST['cookiecheck'])) {
+ setcookie($sitekey."_useruid",$passwd['uid'], time()+60*60*24*30, "/");
+ setcookie($sitekey."_salt", md5($passwd['email'] . $encryptedpasswordb), time()+60*60*24*30, "/");
+ }
+ if(!isset($_SESSION)) session_start( );
+ $_SESSION[$sitekey."_useruid"] = $passwd['uid'];
+ $_SESSION[$sitekey."_salt"] = md5($passwd['email'] . $encryptedpasswordb);
+ $logincode = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_codeblocks WHERE code_type = 'login'");
+ while($code = dbassoc($logincode)) {
+ eval($code['code_text']);
+ }
+ }
+
+ else if($passwd['password'] == $encryptedpasswordm) {
+ if(isset($_POST['cookiecheck'])) {
+ setcookie($sitekey."_useruid",$passwd['uid'], time()+60*60*24*30, "/");
+ setcookie($sitekey."_salt", md5($passwd['email'] . $encryptedpasswordm), time()+60*60*24*30, "/");
+ }
+ if(!isset($_SESSION)) session_start( );
+ $_SESSION[$sitekey."_useruid"] = $passwd['uid'];
+ $_SESSION[$sitekey."_salt"] = md5($passwd['email'] . $encryptedpasswordm);
+ $logincode = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_codeblocks WHERE code_type = 'login'");
+ while($code = dbassoc($logincode)) {
+ eval($code['code_text']);
+ }
+ }
+
+ else {
+ require_once("header.php");
+ //make a new TemplatePower object
+ if(file_exists("$skindir/default.tpl")) $tpl = new TemplatePower( "$skindir/default.tpl" );
+ else $tpl = new TemplatePower("default_tpls/default.tpl");
+ include_once("includes/pagesetup.php");
+ $output .= "<div id=\"pagetitle\">"._MEMBERLOGIN."</div>";
+ $output .= "<div style='text-align: center;'>"._WRONGPASSWORD."</div>";
+ $tpl->assign("output", $output);
+ $tpl->printToScreen( );
+ dbclose( );
+ exit( );
+ }
+ $debug = $tempdebug;
+ }
+ else {
+ require_once("header.php");
+ if(!isMEMBER) {
+
+ $output .= "<div id=\"pagetitle\">"._MEMBERLOGIN."</div>";
+ $output .= "<div style=\"width: 250px; margin: 0 auto; text-align: center;\"><form method=\"POST\" enctype=\"multipart/form-data\" action=\"user.php?action=login".(isset($_GET['sid']) && isNumber($_GET['sid']) ? "&sid=".$_GET['sid'] : "")."\">
+ <div class=\"label\" style=\"float: left; width: 30%; text-align: right;\"><label for=\"penname\">"._PENNAME.":</label></div><INPUT type=\"text\" class=\"textbox\" name=\"penname\" id=\"penname\"><br />
+ <div class=\"label\" style=\"float: left; width: 30%; text-align: right;\"><label for=\"pswd\">"._PASSWORD.":</label></div><INPUT type=\"password\" class=\"textbox\" id=\"pswd\" name=\"password\"><br />
+ <INPUT type=\"checkbox\" class=\"checkbox\" name=\"cookiecheck\" id=\"cookiecheck\" value=\"1\"><label for=\"cookiecheck\">"._REMEMBERME."</label><br />
+ <INPUT type=\"submit\" class=\"button\" name=\"submit\" value=\""._SUBMIT."\">
+ </form></div>";
+ $linkquery = dbquery("SELECT * from ".TABLEPREFIX."fanfiction_pagelinks WHERE link_name = 'login' OR link_name = 'lostpassword'");
+ while($link = dbassoc($linkquery)) {
+ if($link['link_access'] && !isMEMBER) continue;
+ if($link['link_access'] == 2 && !isADMIN) continue;
+ $pagelinks[$link['link_name']] = array("id" => $link['link_id'], "text" => $link['link_text'], "url" => _BASEDIR.$link['link_url'], "link" => "<a href=\"".$link['link_url']."\" title=\"".$link['link_text']."\"".($link['link_target'] ? " target=\"_blank\"" : "").($current == $link['link_name'] ? " id=\"current\"" : "").">".$link['link_text']."</a>");
+ }
+ $output .= "<div style='text-align: center;'>";
+ if(isset($pagelinks['register'])) {
+ $output .= $pagelinks['register']['link']." | ";
+ }
+ $output .= $pagelinks['lostpassword']['link']."</div>";
+
+ }
+}
?>
+
--- a/bridges/default/logout.php
+++ b/bridges/default/logout.php
@@ -1,33 +1,33 @@
-<?php
-if(!defined("_LOGOUTCHECK")) exit( );
- define("_BASEDIR", "");
- include("config.php");
- include("includes/queries.php");
- session_start( );
- foreach ($_SESSION as $VarName => $Value) {
- if(substr($VarName, 0, strlen($sitekey)) == $sitekey) {
- if(strpos($VarName, "skin")) continue;
- $_SESSION[$VarName] = "";
- unset($_SESSION[$VarName]);
- unset($_COOKIE[$VarName]);
- setcookie($VarName, '', time() - 1000, '/', '', '' );
- }
- }
- foreach ($_COOKIE as $VarName => $Value) {
- if(substr($VarName, 0, strlen($sitekey)) == $sitekey) {
- unset($_COOKIE[$VarName]);
- setcookie($VarName, "", time() - 1000, '/', '', '' );
- }
- }
-require_once("header.php");
-//make a new TemplatePower object
-if(file_exists("$skindir/default.tpl")) $tpl = new TemplatePower( "$skindir/default.tpl" );
-else $tpl = new TemplatePower("default_tpls/default.tpl");
-if(file_exists("$skindir/listings.tpl")) $tpl->assignInclude( "listings", "./$skindir/listings.tpl" );
-else $tpl->assignInclude( "listings", "./default_tpls/listings.tpl" );
-include("includes/pagesetup.php");
-
-$output .= write_message(_ACTIONSUCCESSFUL);
-$tpl->assign("output", $output);
-$tpl->printToScreen( );
+<?php
+if(!defined("_LOGOUTCHECK")) exit( );
+ define("_BASEDIR", "");
+ include("config.php");
+ session_start( );
+ foreach ($_SESSION as $VarName => $Value) {
+ if(substr($VarName, 0, strlen($sitekey)) == $sitekey) {
+ if(strpos($VarName, "skin")) continue;
+ $_SESSION[$VarName] = "";
+ unset($_SESSION[$VarName]);
+ unset($_COOKIE[$VarName]);
+ setcookie($VarName, '', time() - 1000, '/', '', '' );
+ }
+ }
+ foreach ($_COOKIE as $VarName => $Value) {
+ if(substr($VarName, 0, strlen($sitekey)) == $sitekey) {
+ unset($_COOKIE[$VarName]);
+ setcookie($VarName, "", time() - 1000, '/', '', '' );
+ }
+ }
+require_once("header.php");
+//make a new TemplatePower object
+if(file_exists("$skindir/default.tpl")) $tpl = new TemplatePower( "$skindir/default.tpl" );
+else $tpl = new TemplatePower("default_tpls/default.tpl");
+if(file_exists("$skindir/listings.tpl")) $tpl->assignInclude( "listings", "./$skindir/listings.tpl" );
+else $tpl->assignInclude( "listings", "./default_tpls/listings.tpl" );
+include("includes/pagesetup.php");
+
+$output .= write_message(_ACTIONSUCCESSFUL);
+$tpl->assign("output", $output);
+$tpl->printToScreen( );
+exit( );
?>
--- a/bridges/default/lostpassword.php
+++ b/bridges/default/lostpassword.php
@@ -1,80 +1,115 @@
-<?php
-// ----------------------------------------------------------------------
-// eFiction 3.2
-// Copyright (c) 2007 by Tammy Keefer
-// Valid HTML 4.01 Transitional
-// Based on eFiction 1.1
-// Copyright (C) 2003 by Rebecca Smallwood.
-// http://efiction.sourceforge.net/
-// ----------------------------------------------------------------------
-// LICENSE
-//
-// This program is free software; you can redistribute it and/or
-// modify it under the terms of the GNU General Public License (GPL)
-// as published by the Free Software Foundation; either version 2
-// of the License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU General Public License for more details.
-//
-// To read the license please visit http://www.gnu.org/copyleft/gpl.html
-// ----------------------------------------------------------------------
-
-if(!defined("_CHARSET")) exit( );
-if(!function_exists("random_char")) {
-
-function random_char($string)
-{
- $length = strlen($string);
- $position = mt_rand(0, $length - 1);
- return ($string[$position]);
-}
-
-function random_string ($charset_string, $length)
-{
- $return_string = random_char($charset_string);
- for ($x = 1; $x < $length; $x++)
- $return_string .= random_char($charset_string);
- return $return_string;
-}
-
-}
-if($loggedin) accessDenied( );
- $output = "<div id=\"pagetitle\">"._LOSTPASSWORD."</div>";
-
- if(isset($_POST['submit'])) {
- $result = dbquery("SELECT "._UIDFIELD." as uid, "._PENNAMEFIELD." as penname FROM "._AUTHORTABLE." WHERE email = '$_POST[email]'");
- list($uid, $penname) = dbrow($result);
- if(dbnumrows($result) == 0) $output .= write_message(_BADEMAIL);
- else {
- include("includes/emailer.php");
- mt_srand((double)microtime() * 1000000);
- $charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';
- $pass = random_string($charset, 10);
- $encryppass = md5($pass);
- $subject = _NEWPWDSUB;
- $mailtext = sprintf(_NEWPWDMSG, $pass);
-
-
- $result = sendemail($penname, $_POST['email'], $sitename, $siteemail, $subject, $mailtext, "html");
- if($result) {
- $output .= write_message(_PASSWORDSENT);
- dbquery("UPDATE "._AUTHORTABLE." SET password='$encryppass' WHERE uid = '".$uid."'");
- }
- else $output .= write_message(_EMAILFAILED);
- if($logging)
- dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`) VALUES('".escapestring(sprintf(_LOG_LOST_PASSWORD, $penname, $uid, ($result ? _YES : _NO)))."', '$uid', INET_ATON('".$_SERVER['REMOTE_ADDR']."'), 'LP')");
-
- }
- }
- else {
- $output .= "<form method=\"POST\" enctype=\"multipart/form-data\" action=\"user.php?action=lostpassword\">
- <table align=\"center\" width=\"300\">
- <tr><td>"._ENTEREMAIL."</td></tr>
- <tr><td><INPUT type=\"text\" class=\"textbox=\" name=\"email\"> <INPUT type=\"submit\" class=\"button\" name=\"submit\" value=\""._SUBMIT."\"></form>
- </td></tr></table>";
- }
-
+<?php
+// ----------------------------------------------------------------------
+// eFiction 3.2
+// Copyright (c) 2007 by Tammy Keefer
+// Valid HTML 4.01 Transitional
+// Based on eFiction 1.1
+// Copyright (C) 2003 by Rebecca Smallwood.
+// http://efiction.sourceforge.net/
+// ----------------------------------------------------------------------
+// LICENSE
+//
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the GNU General Public License (GPL)
+// as published by the Free Software Foundation; either version 2
+// of the License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// To read the license please visit http://www.gnu.org/copyleft/gpl.html
+// ----------------------------------------------------------------------
+
+if(!defined("_CHARSET")) exit( );
+if(!function_exists("random_char")) {
+
+function random_char($string)
+{
+ $length = strlen($string);
+ $position = mt_rand(0, $length - 1);
+ return ($string[$position]);
+}
+
+function random_string ($charset_string, $length)
+{
+ $return_string = random_char($charset_string);
+ for ($x = 1; $x < $length; $x++)
+ $return_string .= random_char($charset_string);
+ return $return_string;
+}
+
+}
+if(isMEMBER) accessDenied( );
+ $output = "<div id=\"pagetitle\">"._LOSTPASSWORD."</div>";
+
+ if(isset($_POST['submit'])) {
+ if(validEmail($_POST['email'])) {
+ $result = dbquery("SELECT "._UIDFIELD." as uid, "._PENNAMEFIELD." as penname, "._EMAILFIELD." AS email FROM "._AUTHORTABLE." WHERE email = '".strtolower(escapestring(descript($_POST['email'])))."'");
+ list($uid, $penname, $email) = dbrow($result);
+ if(dbnumrows($result) == 0) $output .= write_message(_BADEMAIL);
+ else {
+ include("includes/emailer.php");
+ mt_srand((double)microtime() * 1000000);
+ $charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';
+ $pass = random_string($charset, 10);
+ $encryppass = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);
+ $subject = _NEWPWDSUB;
+ $mailtext = sprintf(_NEWPWDMSG, $pass);
+
+
+ $result = sendemail($penname, $email, $sitename, $siteemail, $subject, $mailtext, "html");
+ if($result) {
+ $output .= write_message(_PASSWORDSENT);
+ dbquery("UPDATE ".substr(_AUTHORTABLE, 0, strpos(_AUTHORTABLE, "as author"))." SET password='$encryppass' WHERE uid = '".$uid."'");
+ }
+ else $output .= write_message(_EMAILFAILED);
+ if($logging)
+ dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`, `log_timestamp`) VALUES('".escapestring(sprintf(_LOG_LOST_PASSWORD, $penname, $uid, ($result ? _YES : _NO)))."', '$uid', INET6_ATON('".$_SERVER['REMOTE_ADDR']."'), 'LP', " . time() . ")");
+
+
+ /* lost password notice */
+ if (isset($notifications))
+ {
+ $notifications = unserialize($notifications);
+ }
+
+ if (isset($notifications['lostpassword_notify']) && $notifications['lostpassword_notify'])
+ {
+
+ if (isset($notifications['registration_toemail']) && $notifications['registration_toemail'])
+ {
+ $RegSubject = "Lost Password Notice";
+ $RegIP = $_SERVER['REMOTE_ADDR'];
+ $RegHost = gethostbyaddr($RegIP);
+ $RegNoticeTo = $notifications['registration_toemail'];
+ $RegMessage = "Username: $penname" . "\r\n" . "Email: $email" . "\r\n" . "IP: $RegIP" . "\r\n" . "Host: $RegHost";
+ $RegMessage .= " Asked for new password";
+ $RegMessage .= "<br>Profile link: " . "<a href='".$url."/viewuser.php?uid=" . $uid . "'>" . $penname . "</a>";
+
+ $RegNoticeTo_array = explode(',', $RegNoticeTo);
+ foreach ($RegNoticeTo_array as $RegNoticeTo_email)
+ {
+ if (validEmail($RegNoticeTo_email))
+ {
+ sendemail($sitename, $RegNoticeTo_email, $siteemail, $siteemail, $RegSubject, $RegMessage);
+ }
+ }
+ }
+ }
+ }
+
+ }
+ else $output .= write_message(_BADEMAIL);
+ }
+ else {
+ $output .= "<form method=\"POST\" enctype=\"multipart/form-data\" action=\"user.php?action=lostpassword\">
+ <table align=\"center\" width=\"300\">
+ <tr><td>"._ENTEREMAIL."</td></tr>
+ <tr><td><INPUT type=\"text\" class=\"textbox=\" name=\"email\"> <INPUT type=\"submit\" class=\"button\" name=\"submit\" value=\""._SUBMIT."\"></form>
+ </td></tr></table>";
+ }
+
?>
+
--- a/bridges/default/profile.php
+++ b/bridges/default/profile.php
@@ -1,86 +1,95 @@
-<?php
-// ----------------------------------------------------------------------
-// eFiction 3.2
-// Copyright (c) 2007 by Tammy Keefer
-// Valid HTML 4.01 Transitional
-// Based on eFiction 1.1
-// Copyright (C) 2003 by Rebecca Smallwood.
-// http://efiction.sourceforge.net/
-// ----------------------------------------------------------------------
-// LICENSE
-//
-// This program is free software; you can redistribute it and/or
-// modify it under the terms of the GNU General Public License (GPL)
-// as published by the Free Software Foundation; either version 2
-// of the License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU General Public License for more details.
-//
-// To read the license please visit http://www.gnu.org/copyleft/gpl.html
-// ----------------------------------------------------------------------
-
-if(!defined("_CHARSET")) exit( );
-
-// Build the user's profile information
-$tpl->newBlock("profile");
-$result2 = dbquery("SELECT *, UNIX_TIMESTAMP(date) as date FROM "._AUTHORTABLE." LEFT JOIN ".TABLEPREFIX."fanfiction_authorprefs as ap ON ap.uid = "._UIDFIELD." WHERE "._UIDFIELD." = '$uid' LIMIT 1");
-$userinfo = dbassoc($result2);
-$nameinfo = "";
-if($userinfo['email'])
- $nameinfo .= " [<a href=\"viewuser.php?action=contact&uid=".$userinfo['uid']."\">"._CONTACT."</a>]";
-if(!empty($favorites) && $loggedin && $userinfo['uid'] != USERUID) {
- $fav = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_favorites WHERE uid = '".USERUID."' AND type = 'AU' AND item = '".$userinfo['uid']."'");
- if(dbnumrows($fav) == 0) $nameinfo .= " [<a href=\"user.php?uid=USERUID&action=favau&author=".$userinfo['uid']."\">"._ADDAUTHOR2FAVES."</a>]";
-}
-$tpl->assign("userpenname", $userinfo['penname']." ".$nameinfo);
-$tpl->assign("membersince", date("$dateformat", $userinfo['date']));
-if($userinfo['realname'])
- $tpl->assign("realname", $userinfo['realname']);
-if($userinfo['bio']) {
- $bio = nl2br($userinfo['bio']);
- $tpl->assign("bio", stripslashes($bio));
-}
-if($userinfo['image'])
- $tpl->assign("image", "<img src=\"".$userinfo['image']."\">");
-$tpl->assign("userlevel", isset($userinfo['level']) && $userinfo['level'] > 0 && $userinfo['level'] < 4 ? _ADMINISTRATOR.(isADMIN ? " - ".$userinfo['level'] : "") : _MEMBER);
-/* Dynamic authorinfo fields */
-$result2 = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$uid'");
-$dynamicfields = "";
-while($field = dbassoc($result2)) {
- if($field['info'] == "") continue;
- $fieldinfo = dbassoc(dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_id = '".$field['field']."' LIMIT 1"));
- if($fieldinfo) {
- $thisfield = "";
- if($fieldinfo['field_on'] == 0) continue;
- if($fieldinfo['field_type'] == 1) { $thisfield = format_link($field['info']);
- }
- if($fieldinfo['field_type'] == 4) {
- $thisfield = preg_replace("@\{info\}@", $field['info'], $fieldinfo['field_options']);
- $thisfield = format_link($thisfield);
- }
- if($fieldinfo['field_type'] == 2 || $fieldinfo['field_type'] == 6) {
- $thisfield = stripslashes($field['info']);
- }
- if($fieldinfo['field_type'] == 3) {
- $thisfield = $field['info'];
- }
- else eval($fieldinfo['field_code_out']);
- $tpl->assign($fieldinfo['field_name'], $thisfield);
- $dynamicfields .= "<div class='authorfields'><span class='label'>".$fieldinfo['field_title'].":</span> ".$thisfield."</div>";
- }
-}
-if(!empty($dynamicfields)) $tpl->assign("authorfields", $dynamicfields);
-$tpl->assign("reportthis", "[<a href=\""._BASEDIR."contact.php?action=report&url=viewuser.php?uid=".$uid."\">"._REPORTTHIS."</a>]");
-/* End dynamic fields */
-$adminopts = "";
-if(isADMIN && uLEVEL < 3) {
- $adminopts .= "<div class=\"adminoptions\"><span class='label'>"._ADMINOPTIONS.":</span> ".(isset($userinfo['validated']) && $userinfo['validated'] ? "[<a href=\"admin.php?action=members&revoke=$uid\" class=\"vuadmin\">"._REVOKEVAL."</a>] " : "[<a href=\"admin.php?action=members&validate=$uid\" class=\"vuadmin\">"._VALIDATE."</a>] ")."[<a href=\"user.php?action=editbio&uid=$uid\" class=\"vuadmin\">"._EDIT."</a>] [<a href=\"admin.php?action=members&delete=$uid\" class=\"vuadmin\">"._DELETE."</a>]";
- $adminopts .= " [<a href=\"admin.php?action=members&".($userinfo['level'] < 0 ? "unlock=".$userinfo['uid']."\" class=\"vuadmin\">"._UNLOCKMEM : "lock=".$userinfo['uid']."\" class=\"vuadmin\">"._LOCKMEM)."</a>]";
- $adminopts .= " [<a href=\"admin.php?action=admins&".(isset($userinfo['level']) && $userinfo['level'] > 0 ? "revoke=$uid\" class=\"vuadmin\">"._REVOKEADMIN."</a>] [<a href=\"admin.php?action=admins&do=edit&uid=$uid\" class=\"vuadmin\">"._EDITADMIN : "do=new&uid=$uid\" class=\"vuadmin\">"._MAKEADMIN)."</a>]</div>";
- $tpl->assign("adminoptions", $adminopts);
-}
-$tpl->gotoBlock("_ROOT");
+<?php
+// ----------------------------------------------------------------------
+// eFiction 3.2
+// Copyright (c) 2007 by Tammy Keefer
+// Valid HTML 4.01 Transitional
+// Based on eFiction 1.1
+// Copyright (C) 2003 by Rebecca Smallwood.
+// http://efiction.sourceforge.net/
+// ----------------------------------------------------------------------
+// LICENSE
+//
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the GNU General Public License (GPL)
+// as published by the Free Software Foundation; either version 2
+// of the License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// To read the license please visit http://www.gnu.org/copyleft/gpl.html
+// ----------------------------------------------------------------------
+
+if(!defined("_CHARSET")) exit( );
+
+// Build the user's profile information
+$tpl->newBlock("profile");
+$result2 = dbquery("SELECT *, date as date FROM "._AUTHORTABLE." LEFT JOIN ".TABLEPREFIX."fanfiction_authorprefs as ap ON ap.uid = "._UIDFIELD." WHERE "._UIDFIELD." = '$uid' LIMIT 1");
+$userinfo = dbassoc($result2);
+$nameinfo = "";
+if($userinfo['email'])
+ $nameinfo .= " [<a href=\"viewuser.php?action=contact&uid=".$userinfo['uid']."\">"._CONTACT."</a>]";
+if(!empty($favorites) && isMEMBER && $userinfo['uid'] != USERUID) {
+ $fav = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_favorites WHERE uid = '".USERUID."' AND type = 'AU' AND item = '".$userinfo['uid']."'");
+ if(dbnumrows($fav) == 0) $nameinfo .= " [<a href=\"user.php?action=favau&uid=".USERUID."&add=".$userinfo['uid']."\">"._ADDAUTHOR2FAVES."</a>]";
+}
+
+$tpl->assign("userpenname", $userinfo['penname']." ".$nameinfo);
+$tpl->assign("membersince", date("$dateformat", $userinfo['date']));
+
+if($userinfo['realname'])
+ $tpl->assign("realname", $userinfo['realname']);
+if($userinfo['bio']) {
+ $bio = nl2br($userinfo['bio']);
+ $tpl->assign("bio", stripslashes($bio));
+}
+if($userinfo['image'])
+ $tpl->assign("image", "<img src=\"".$userinfo['image']."\">");
+
+$tpl->assign("userlevel", isset($userinfo['level']) && $userinfo['level'] > 0 && $userinfo['level'] < 4 ? _ADMINISTRATOR.(isADMIN ? " - ".$userinfo['level'] : "") : _MEMBER);
+
+/* Dynamic authorinfo fields */
+$result2 = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorinfo WHERE uid = '$uid'");
+$dynamicfields = "";
+while($field = dbassoc($result2)) {
+ if($field['info'] == "") continue;
+ $fieldinfo = dbassoc(dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_authorfields WHERE field_id = '".$field['field']."' LIMIT 1"));
+ if($fieldinfo) {
+ $thisfield = "";
+ if($fieldinfo['field_on'] == 0) continue;
+ if($fieldinfo['field_type'] == 1) { $thisfield = format_link($field['info']);
+ }
+ if($fieldinfo['field_type'] == 4) {
+ $thisfield = preg_replace("@\{info\}@", $field['info'], $fieldinfo['field_options']);
+ $thisfield = format_link($thisfield);
+ }
+ if($fieldinfo['field_type'] == 2 || $fieldinfo['field_type'] == 6) {
+ $thisfield = stripslashes($field['info']);
+ }
+ if($fieldinfo['field_type'] == 3) {
+ $thisfield = $field['info'];
+ }
+ else eval($fieldinfo['field_code_out']);
+ $tpl->assign($fieldinfo['field_name'], $thisfield);
+ $dynamicfields .= "<div class='authorfields'><span class='label'>".$fieldinfo['field_title'].":</span> ".$thisfield."</div>";
+ }
+}
+$codequery = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_codeblocks WHERE code_type = 'userprofile'");
+while($code = dbassoc($codequery)) {
+ eval($code['code_text']);
+}
+if(!empty($dynamicfields)) $tpl->assign("authorfields", $dynamicfields);
+/* End dynamic fields */
+$tpl->assign("reportthis", "[<a href=\""._BASEDIR."contact.php?action=report&url=viewuser.php?uid=".$uid."\">"._REPORTTHIS."</a>]");
+$adminopts = "";
+if(isADMIN && uLEVEL < 3) {
+ $adminopts .= "<div class=\"adminoptions\"><span class='label'>"._ADMINOPTIONS.":</span> ".(isset($userinfo['validated']) && $userinfo['validated'] ? "[<a href=\"admin.php?action=members&revoke=$uid\" class=\"vuadmin\">"._REVOKEVAL."</a>] " : "[<a href=\"admin.php?action=members&validate=$uid\" class=\"vuadmin\">"._VALIDATE."</a>] ")."[<a href=\"user.php?action=editbio&uid=$uid\" class=\"vuadmin\">"._EDIT."</a>] [<a href=\"admin.php?action=members&delete=$uid\" class=\"vuadmin\">"._DELETE."</a>]";
+ $adminopts .= " [<a href=\"admin.php?action=members&".($userinfo['level'] < 0 ? "unlock=".$userinfo['uid']."\" class=\"vuadmin\">"._UNLOCKMEM : "lock=".$userinfo['uid']."\" class=\"vuadmin\">"._LOCKMEM)."</a>]";
+ $adminopts .= " [<a href=\"admin.php?action=admins&".(isset($userinfo['level']) && $userinfo['level'] > 0 ? "revoke=$uid\" class=\"vuadmin\">"._REVOKEADMIN."</a>] [<a href=\"admin.php?action=admins&do=edit&uid=$uid\" class=\"vuadmin\">"._EDITADMIN : "do=new&uid=$uid\" class=\"vuadmin\">"._MAKEADMIN)."</a>]</div>";
+ $tpl->assign("adminoptions", $adminopts);
+}
+$tpl->gotoBlock("_ROOT");
?>
+
--- a/bridges/default/queries.php
+++ b/bridges/default/queries.php
@@ -1,17 +1,17 @@
-<?php
-
-// Default query strings used throughout the script. You may need to alter these to bridge to other scripts or databases.
-
-define ("_UIDFIELD", "author.uid"); // Do not change the aliasing (the "author." part)!
-define ("_PENNAMEFIELD", "author.penname"); // Do not change the aliasing (the "author." part)!
-define ("_EMAILFIELD", "author.email"); // Do not change the aliasing (the "author." part)!
-define ("_PASSWORDFIELD", "author.password"); // Do not change the aliasing (the "author." part)!
-define ("_AUTHORTABLE", $tableprefix."fanfiction_authors as author"); // Do not change the aliasing (the "as author" part)!
-
-define ("_STORYQUERY", "SELECT stories.*, "._PENNAMEFIELD." as penname, UNIX_TIMESTAMP(stories.date) as date, UNIX_TIMESTAMP(stories.updated) as updated FROM ("._AUTHORTABLE.", ".$tableprefix."fanfiction_stories as stories) WHERE "._UIDFIELD." = stories.uid AND stories.validated > 0 ");
-define ("_STORYCOUNT", "SELECT count(sid) FROM ".$tableprefix."fanfiction_stories as stories WHERE validated > 0");
-define ("_SERIESQUERY", "SELECT series.*, "._PENNAMEFIELD." as penname FROM "._AUTHORTABLE.", ".$tableprefix."fanfiction_series as series WHERE "._UIDFIELD." = series.uid ");
-define ("_SERIESCOUNT", "SELECT COUNT(seriesid) FROM ".$tableprefix."fanfiction_series as series ");
-define ("_MEMBERLIST", "SELECT count( stories.sid ) as stories, "._PENNAMEFIELD." as penname, "._UIDFIELD." as uid FROM "._AUTHORTABLE." LEFT JOIN ".$tableprefix."fanfiction_authorprefs AS ap ON "._UIDFIELD." = ap.uid LEFT JOIN ".$tableprefix."fanfiction_stories AS stories ON stories.validated > 0 AND (FIND_IN_SET("._UIDFIELD.", stories.coauthors) > 0 OR stories.uid = "._UIDFIELD.") ");
-define ("_MEMBERCOUNT", "SELECT COUNT(DISTINCT "._UIDFIELD.") FROM "._AUTHORTABLE." LEFT JOIN ".$tableprefix."fanfiction_stories as stories ON stories.validated > 0 AND (FIND_IN_SET("._UIDFIELD.", stories.coauthors) > 0 OR stories.uid = "._UIDFIELD.") LEFT JOIN ".$tableprefix."fanfiction_authorprefs as ap ON "._UIDFIELD." = ap.uid");
+<?php
+
+// Default query strings used throughout the script. You may need to alter these to bridge to other scripts or databases.
+
+define ("_UIDFIELD", "author.uid"); // Do not change the aliasing (the "author." part)!
+define ("_PENNAMEFIELD", "author.penname"); // Do not change the aliasing (the "author." part)!
+define ("_EMAILFIELD", "author.email"); // Do not change the aliasing (the "author." part)!
+define ("_PASSWORDFIELD", "author.password"); // Do not change the aliasing (the "author." part)!
+define ("_AUTHORTABLE", TABLEPREFIX."fanfiction_authors as author"); // Do not change the aliasing (the "as author" part)!
+
+define ("_STORYQUERY", "SELECT stories.*, "._PENNAMEFIELD." as penname, stories.date as date, stories.updated as updated FROM ("._AUTHORTABLE.", ".TABLEPREFIX."fanfiction_stories as stories) WHERE "._UIDFIELD." = stories.uid AND stories.validated > 0 ");
+define ("_STORYCOUNT", "SELECT count(sid) FROM ".TABLEPREFIX."fanfiction_stories as stories WHERE validated > 0");
+define ("_SERIESQUERY", "SELECT series.*, "._PENNAMEFIELD." as penname FROM "._AUTHORTABLE.", ".TABLEPREFIX."fanfiction_series as series WHERE "._UIDFIELD." = series.uid ");
+define ("_SERIESCOUNT", "SELECT COUNT(seriesid) FROM ".TABLEPREFIX."fanfiction_series as series ");
+define ("_MEMBERLIST", "SELECT count( stories.sid ) as stories, "._PENNAMEFIELD." as penname, "._UIDFIELD." as uid FROM "._AUTHORTABLE." LEFT JOIN ".TABLEPREFIX."fanfiction_authorprefs AS ap ON "._UIDFIELD." = ap.uid LEFT JOIN ".TABLEPREFIX."fanfiction_stories AS stories ON stories.validated > 0 AND (FIND_IN_SET("._UIDFIELD.", stories.coauthors) > 0 OR stories.uid = "._UIDFIELD.") ");
+define ("_MEMBERCOUNT", "SELECT COUNT(DISTINCT "._UIDFIELD.") FROM "._AUTHORTABLE." LEFT JOIN ".TABLEPREFIX."fanfiction_stories as stories ON stories.validated > 0 AND (FIND_IN_SET("._UIDFIELD.", stories.coauthors) > 0 OR stories.uid = "._UIDFIELD.") LEFT JOIN ".TABLEPREFIX."fanfiction_authorprefs as ap ON "._UIDFIELD." = ap.uid");
?>
--- a/bridges/default/register.php
+++ b/bridges/default/register.php
@@ -1,28 +1,40 @@
-<?php
-// ----------------------------------------------------------------------
-// eFiction 3.2
-// Copyright (c) 2007 by Tammy Keefer
-// Valid HTML 4.01 Transitional
-// Based on eFiction 1.1
-// Copyright (C) 2003 by Rebecca Smallwood.
-// http://efiction.sourceforge.net/
-// ----------------------------------------------------------------------
-// LICENSE
-//
-// This program is free software; you can redistribute it and/or
-// modify it under the terms of the GNU General Public License (GPL)
-// as published by the Free Software Foundation; either version 2
-// of the License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU General Public License for more details.
-//
-// To read the license please visit http://www.gnu.org/copyleft/gpl.html
-// ----------------------------------------------------------------------
-
-if(!defined("_CHARSET")) exit( );
-
-include("user/editbio.php");
+<?php
+// ----------------------------------------------------------------------
+// eFiction 3.2
+// Copyright (c) 2007 by Tammy Keefer
+// Valid HTML 4.01 Transitional
+// Based on eFiction 1.1
+// Copyright (C) 2003 by Rebecca Smallwood.
+// http://efiction.sourceforge.net/
+// ----------------------------------------------------------------------
+// LICENSE
+//
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the GNU General Public License (GPL)
+// as published by the Free Software Foundation; either version 2
+// of the License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// To read the license please visit http://www.gnu.org/copyleft/gpl.html
+// ----------------------------------------------------------------------
+
+if(!defined("_CHARSET")) exit( );
+
+// This is to show the registration page as admin regardless of the registration setting
+// for the Page Links section in the Admin Panel
+
+if((isADMIN && uLEVEL == 1) && (isset($setreg) && $setreg == 0)) {
+ include ("user/editbio.php");
+}
+
+else if ((!isADMIN && uLEVEL != 1) && (isset($setreg) && $setreg == 0)) {
+ $output .= "<div align='center' style='margin-top: 1em;'>"._REGDISABLED."</div>";
+}
+
+else include("user/editbio.php");
?>
+
--- a/bridges/eFic2eFic/editbio.php
+++ b/bridges/eFic2eFic/editbio.php
@@ -53,9 +53,9 @@
$email = escapestring($_POST['email']);
if(!isset($email) && !isADMIN) $output .= "<div style='text-align: center;'>"._EMAILREQUIRED."</div>";
else if($penname && !preg_match("!^[a-z0-9-_ ]{3,30}$!i", $penname)) $output .= "<div style='text-align: center;'>"._BADUSERNAME."</div>";
- else if(!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $email)) $output .= "<div style='text-align: center;'>"._INVALIDEMAIL." "._TRYAGAIN."</div>";
+ else if(!validEmail($email)) $output .= "<div style='text-align: center;'>"._INVALIDEMAIL." "._TRYAGAIN."</div>";
else if($action == "register") {
- if(!$penname || empty($email) || !eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $email) || !preg_match("!^[a-z0-9-_ ]{3,30}$!i", $penname)) $output .= write_error(_PENEMAILREQUIRED);
+ if(!$penname || !preg_match("!^[a-z0-9-_ ]{3,30}$!i", $penname)) $output .= write_error(_PENEMAILREQUIRED);
else if($pwdsetting && empty($_POST['password'])) $output .= write_error(_PWDREQUIRED." "._TRYAGAIN);
else {
$result = dbquery("SELECT "._PENNAMEFIELD." FROM "._AUTHORTABLE." WHERE "._PENNAMEFIELD." = '".escapestring($penname)."'");
@@ -67,7 +67,7 @@
if(!$pwdsetting) {
$charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';
$pass = random_string($charset, 10);
- $encryppass = md5($pass);
+ $encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]);
}
else {
if($_POST['password'] != $_POST['password2']) {
@@ -78,11 +78,11 @@
exit( );
}
$pass = $_POST['password2'];
- $encryppass = md5($pass);
- }
- dbquery("INSERT INTO ".substr(_AUTHORTABLE, 0, strpos(_AUTHORTABLE, "as author"))." (penname, realname, bio, email, date, password) VALUES ('".escapestring($penname)."', '".escapestring(strip_tags($_POST['realname']))."', '".strip_tags(escapestring($_POST['bio']), $allowed_tags)."', '$email', now(), '$encryppass')");
+ $encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]);
+ }
+ dbquery("INSERT INTO ".substr(_AUTHORTABLE, 0, strpos(_AUTHORTABLE, "as author"))." (penname, realname, bio, email, date, password) VALUES ('".escapestring($penname)."', '".escapestring(strip_tags($_POST['realname']))."', '".strip_tags(escapestring($_POST['bio']), $allowed_tags)."', '$email'," . time() . ", '$encryppass')");
$useruid = dbinsertid();
- if($logging) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`) VALUES('".escapestring(sprintf(_LOG_REGISTER, $penname, $useruid, $_SERVER['REMOTE_ADDR']))."', '".$useruid."', INET_ATON('".$_SERVER['REMOTE_ADDR']."'), 'RG')");
+ if($logging) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`, `log_timestamp`) VALUES('".escapestring(sprintf(_LOG_REGISTER, $penname, $useruid, $_SERVER['REMOTE_ADDR']))."', '".$useruid. "', INET6_ATON('".$_SERVER['REMOTE_ADDR']."'), 'RG', " . time() . ")");
if(empty($siteskin)) {
$skinquery = dbquery("SELECT skin FROM ".$settingsprefix."fanfiction_settings WHERE sitekey = '".SITEKEY."'");
list($skin) = dbrow($skinquery);
@@ -108,6 +108,35 @@
if(!$pwdsetting) $mailtext .= _SIGNUPWARNING;
include("includes/emailer.php");
sendemail($penname, $email, $sitename, $siteemail, $subject, $mailtext, "html");
+
+ /* registration notice */
+ if (isset($notifications))
+ {
+ $notifications = unserialize($notifications);
+ }
+
+ if(isset($notifications['registration_notify']) && $notifications['registration_notify']) {
+ if (isset($notifications['registration_toemail']) && $notifications['registration_toemail'])
+ {
+ $RegSubject = "Registration Notice";
+ $RegIP = $_SERVER['REMOTE_ADDR'];
+ $RegHost = gethostbyaddr($RegIP);
+ $RegNoticeTo = $notifications['registration_toemail'];
+ $RegMessage = "Username: $penname" . "\r\n" . "Email: $email" . "\r\n" . "IP: $RegIP" . "\r\n" . "Host: $RegHost";
+ $RegMessage .= " registered on your site";
+ $RegMessage .= "<br>Profile link: " . "<a href='" . $url . "/viewuser.php?uid=" . $useruid . "'>" . $penname . "</a>";
+
+ $RegNoticeTo_array=explode(',', $RegNoticeTo);
+ foreach ($RegNoticeTo_array AS $RegNoticeTo_email) {
+ if(validEmail($RegNoticeTo_email)) {
+ sendemail($sitename, $RegNoticeTo_email, $siteemail, $siteemail, $RegSubject, $RegMessage);
+ }
+ }
+
+ }
+ }
+ /* registration notice end */
+
dbquery("UPDATE ".TABLEPREFIX."fanfiction_stats SET newestmember = '".$useruid."', members = members + 1");
if(defined("AUTHORPREFIX")) dbquery("UPDATE ".AUTHORPREFIX."fanfiction_stats SET newestmember = '".$useruid."', members = members + 1");
unset($_POST['submit']);
@@ -121,7 +150,7 @@
else{
if(($_POST['password']) && ($_POST['password2'])) {
if($_POST['password'] == $_POST['password2']) {
- $encryppassword = md5($_POST['password']);
+ $encryppassword = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);
dbquery("UPDATE "._AUTHORTABLE." SET password='$encryppassword' WHERE uid = '$uid'");
}
else $output .= write_error(_PASSWORDTWICE);
@@ -133,7 +162,7 @@
}
else {
dbquery("UPDATE "._AUTHORTABLE." SET penname = '".escapestring($penname)."' WHERE uid = '$_POST[uid]'");
- if($logging) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`) VALUES('".escapestring(sprintf(_NEWPEN, USERPENNAME, USERUID, $_POST[oldpenname], $uid, $penname))."', '".USERUID."', INET_ATON('".$_SERVER['REMOTE_ADDR']."'), 'EB')");
+ if($logging) dbquery("INSERT INTO ".TABLEPREFIX."fanfiction_log (`log_action`, `log_uid`, `log_ip`, `log_type`, `log_timestamp`) VALUES('".escapestring(sprintf(_NEWPEN, USERPENNAME, USERUID, $_POST['oldpenname'], $uid, $penname))."', '".USERUID."', INET6_ATON('".$_SERVER['REMOTE_ADDR']."'), 'EB', " . time() . ")");
}
}
/* The section adds fields from the authorfields table to the authorinfo table allowing dynamic additions to the bio/registration page */
@@ -151,7 +180,7 @@
}
/* End dynamic fields */
dbquery("UPDATE "._AUTHORTABLE." SET realname='".descript(strip_tags(escapestring($_POST['realname'])), $allowed_tags)."', email='$email', bio='".descript(strip_tags(escapestring($_POST['bio']), $allowed_tags))."', image='".($imageupload && !empty($_POST['image']) ? escapestring($_POST['image']) : "")."' WHERE uid = '$uid'");
- $output .= write_message(_ACTIONSUCCESSFUL." ".(isset($_GET['uid']) ? _BACK2ADMIN : _BACK2ACCT));
+ $output .= write_message(_ACTIONSUCCESSFUL." ".(isset($_GET['uid']) ? _BACK2ADMIN : _BACK2ACCT." "._LOGINAGAIN));
}
}
else {
@@ -168,7 +197,7 @@
list($tos) = dbrow($query);
$output .= "<div class='tblborder' style='width: 90%; margin: 1em auto;'>$tos</div>";
}
- $output .= "<div id='settingsform'><form method=\"POST\" enctype=\"multipart/form-data\" style='margin: 0 auto;' action=\"user.php?action=$action".($uid != USERUID ? "&uid=".$uid : "")."\">
+ $output .= "<div id='settingsform'><form method=\"POST\" id=\"editbio\" name=\"editbio\" enctype=\"multipart/form-data\" style='width: 260%; margin: 0 auto;' action=\"user.php?action=$action".($uid != USERUID ? "&uid=".$uid : "")."\">
<div><label for='newpenname'>"._PENNAME.":</label>";
if((isADMIN && uLEVEL == 1) || $action == "register")
$output .= "<INPUT name=\"newpenname\" type=\"text\" class=\"textbox\" maxlength=\"200\" value=\"".(isset($user) ? $user['penname'] : "")."\"><INPUT name=\"oldpenname\" type=\"hidden\" value=\"".(isset($user) ? $user['penname'] : "")."\"><font color=\"red\">*</font> ";
@@ -213,4 +242,5 @@
}
$output .= "</div></form></div>".write_message("<font color=\"red\">*</font> "._REQUIREDFIELDS);
}
-?>
+?>
+