[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * MyBB 1.6
   4   * Copyright 2010 MyBB Group, All Rights Reserved
   5   *
   6   * Website: http://mybb.com
   7   * License: http://mybb.com/about/license
   8   *
   9   * $Id: user.php 5625 2011-10-02 19:16:35Z ralgith $
  10   */
  11  
  12  // Disallow direct access to this file for security reasons
  13  if(!defined("IN_MYBB"))
  14  {
  15      die("Direct initialization of this file is not allowed.<br /><br />Please make sure IN_MYBB is defined.");
  16  }
  17  
  18  /**
  19   * User handling class, provides common structure to handle user data.
  20   *
  21   */
  22  class UserDataHandler extends DataHandler
  23  {
  24      /**
  25      * The language file used in the data handler.
  26      *
  27      * @var string
  28      */
  29      public $language_file = 'datahandler_user';
  30  
  31      /**
  32      * The prefix for the language variables used in the data handler.
  33      *
  34      * @var string
  35      */
  36      public $language_prefix = 'userdata';
  37  
  38      /**
  39       * Array of data inserted in to a user.
  40       *
  41       * @var array
  42       */
  43      public $user_insert_data = array();
  44  
  45      /**
  46       * Array of data used to update a user.
  47       *
  48       * @var array
  49       */
  50      public $user_update_data = array();
  51  
  52      /**
  53       * User ID currently being manipulated by the datahandlers.
  54       *
  55       * @var int
  56       */
  57      public $uid = 0;
  58  
  59      /**
  60       * Verifies if a username is valid or invalid.
  61       *
  62       * @param boolean True when valid, false when invalid.
  63       */
  64  	function verify_username()
  65      {
  66          global $mybb;
  67  
  68          $username = &$this->data['username'];
  69          require_once  MYBB_ROOT.'inc/functions_user.php';
  70  
  71          // Fix bad characters
  72          $username = trim_blank_chrs($username);
  73          $username = str_replace(array(unichr(160), unichr(173), unichr(0xCA), dec_to_utf8(8238), dec_to_utf8(8237), dec_to_utf8(8203)), array(" ", "-", "", "", "", ""), $username);
  74  
  75          // Remove multiple spaces from the username
  76          $username = preg_replace("#\s{2,}#", " ", $username);
  77  
  78          // Check if the username is not empty.
  79          if($username == '')
  80          {
  81              $this->set_error('missing_username');
  82              return false;
  83          }
  84  
  85          // Check if the username belongs to the list of banned usernames.
  86          if(is_banned_username($username, true))
  87          {
  88              $this->set_error('banned_username');
  89              return false;
  90          }
  91  
  92          // Check for certain characters in username (<, >, &, commas and slashes)
  93          if(strpos($username, "<") !== false || strpos($username, ">") !== false || strpos($username, "&") !== false || my_strpos($username, "\\") !== false || strpos($username, ";") !== false || strpos($username, ",") !== false)
  94          {
  95              $this->set_error("bad_characters_username");
  96              return false;
  97          }
  98  
  99          // Check if the username is of the correct length.
 100          if(($mybb->settings['maxnamelength'] != 0 && my_strlen($username) > $mybb->settings['maxnamelength']) || ($mybb->settings['minnamelength'] != 0 && my_strlen($username) < $mybb->settings['minnamelength']))
 101          {
 102              $this->set_error('invalid_username_length', array($mybb->settings['minnamelength'], $mybb->settings['maxnamelength']));
 103              return false;
 104          }
 105  
 106          return true;
 107      }
 108  
 109      /**
 110       * Verifies if a usertitle is valid or invalid.
 111       *
 112       * @param boolean True when valid, false when invalid.
 113       */
 114  	function verify_usertitle()
 115      {
 116          global $mybb;
 117  
 118          $usertitle = &$this->data['usertitle'];
 119  
 120          // Check if the usertitle is of the correct length.
 121          if($mybb->settings['customtitlemaxlength'] != 0 && my_strlen($usertitle) > $mybb->settings['customtitlemaxlength'])
 122          {
 123              $this->set_error('invalid_usertitle_length', $mybb->settings['customtitlemaxlength']);
 124              return false;
 125          }
 126  
 127          return true;
 128      }
 129      
 130      /**
 131       * Verifies if a username is already in use or not.
 132       *
 133       * @return boolean False when the username is not in use, true when it is.
 134       */
 135  	function verify_username_exists()
 136      {
 137          global $db;
 138  
 139          $username = &$this->data['username'];
 140  
 141          $uid_check = "";        
 142          if($this->data['uid'])
 143          {
 144              $uid_check = " AND uid!='{$this->data['uid']}'";
 145          }
 146          
 147          $query = $db->simple_select("users", "COUNT(uid) AS count", "LOWER(username)='".$db->escape_string(strtolower(trim($username)))."'{$uid_check}");
 148          
 149          $user_count = $db->fetch_field($query, "count");
 150          if($user_count > 0)
 151          {
 152              $this->set_error("username_exists", array($username));
 153              return true;
 154          }
 155          else
 156          {
 157              return false;
 158          }
 159      }
 160  
 161      /**
 162      * Verifies if a new password is valid or not.
 163      *
 164      * @return boolean True when valid, false when invalid.
 165      */
 166  	function verify_password()
 167      {
 168          global $mybb;
 169  
 170          $user = &$this->data;
 171  
 172          // Always check for the length of the password.
 173          if(my_strlen($user['password']) < $mybb->settings['minpasswordlength'] || my_strlen($user['password']) > $mybb->settings['maxpasswordlength'])
 174          {
 175              $this->set_error('invalid_password_length', array($mybb->settings['minpasswordlength'], $mybb->settings['maxpasswordlength']));
 176              return false;
 177          }
 178  
 179          // See if the board has "require complex passwords" enabled.
 180          if($mybb->settings['requirecomplexpasswords'] == 1)
 181          {
 182              // Complex passwords required, do some extra checks.
 183              // First, see if there is one or more complex character(s) in the password.
 184              if(!preg_match("/^.*(?=.{".$mybb->settings['minpasswordlength'].",})(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).*$/", $user['password']))
 185              {
 186                  $this->set_error('no_complex_characters');
 187                  return false;
 188              }
 189          }
 190  
 191          // If we have a "password2" check if they both match
 192          if(isset($user['password2']) && $user['password'] != $user['password2'])
 193          {
 194              $this->set_error("passwords_dont_match");
 195              return false;
 196          }
 197  
 198          // MD5 the password
 199          $user['md5password'] = md5($user['password']);
 200  
 201          // Generate our salt
 202          $user['salt'] = generate_salt();
 203  
 204          // Combine the password and salt
 205          $user['saltedpw'] = salt_password($user['md5password'], $user['salt']);
 206  
 207          // Generate the user login key
 208          $user['loginkey'] = generate_loginkey();
 209  
 210          return true;
 211      }
 212  
 213      /**
 214      * Verifies usergroup selections and other group details.
 215      *
 216      * @return boolean True when valid, false when invalid.
 217      */
 218  	function verify_usergroup()
 219      {
 220          $user = &$this->data;
 221          return true;
 222      }
 223      /**
 224      * Verifies if an email address is valid or not.
 225      *
 226      * @return boolean True when valid, false when invalid.
 227      */
 228  	function verify_email()
 229      {
 230          global $mybb;
 231  
 232          $user = &$this->data;
 233  
 234          // Check if an email address has actually been entered.
 235          if(trim_blank_chrs($user['email']) == '')
 236          {
 237              $this->set_error('missing_email');
 238              return false;
 239          }
 240  
 241          // Check if this is a proper email address.
 242          if(!validate_email_format($user['email']))
 243          {
 244              $this->set_error('invalid_email_format');
 245              return false;
 246          }
 247  
 248          // Check banned emails
 249          if(is_banned_email($user['email'], true))
 250          {
 251              $this->set_error('banned_email');
 252              return false;
 253          }
 254          
 255          // Check signed up emails
 256          // Ignore the ACP because the Merge System sometimes produces users with duplicate email addresses (Not A Bug)
 257          if($mybb->settings['allowmultipleemails'] == 0 && !defined("IN_ADMINCP"))
 258          {
 259              if(email_already_in_use($user['email'], $user['uid']))
 260              {
 261                  $this->set_error('email_already_in_use');
 262                  return false;
 263              }
 264          }
 265  
 266          // If we have an "email2", verify it matches the existing email
 267          if(isset($user['email2']) && $user['email'] != $user['email2'])
 268          {
 269              $this->set_error("emails_dont_match");
 270              return false;
 271          }
 272  
 273          return true;
 274      }
 275  
 276      /**
 277      * Verifies if a website is valid or not.
 278      *
 279      * @return boolean True when valid, false when invalid.
 280      */
 281  	function verify_website()
 282      {
 283          $website = &$this->data['website'];
 284  
 285          if(empty($website) || my_strtolower($website) == 'http://' || my_strtolower($website) == 'https://')
 286          {
 287              $website = '';
 288              return true;
 289          }
 290  
 291          // Does the website start with http(s)://?
 292          if(my_strtolower(substr($website, 0, 4)) != "http")
 293          {
 294              // Website does not start with http://, let's see if the user forgot.
 295              $website = "http://".$website;
 296          }
 297  
 298          return true;
 299      }
 300  
 301      /**
 302       * Verifies if an ICQ number is valid or not.
 303       *
 304       * @return boolean True when valid, false when invalid.
 305       */
 306  	function verify_icq()
 307      {
 308          $icq = &$this->data['icq'];
 309  
 310          if($icq != '' && !is_numeric($icq))
 311          {
 312              $this->set_error("invalid_icq_number");
 313              return false;
 314          }
 315          $icq = intval($icq);
 316          return true;
 317      }
 318  
 319      /**
 320       * Verifies if an MSN Messenger address is valid or not.
 321       *
 322       * @return boolean True when valid, false when invalid.
 323       */
 324  	function verify_msn()
 325      {
 326          $msn = &$this->data['msn'];
 327  
 328          if($msn != '' && validate_email_format($msn) == false)
 329          {
 330              $this->set_error("invalid_msn_address");
 331              return false;
 332          }
 333          return true;
 334      }
 335  
 336      /**
 337      * Verifies if a birthday is valid or not.
 338      *
 339      * @return boolean True when valid, false when invalid.
 340      */
 341  	function verify_birthday()
 342      {
 343          global $mybb;
 344  
 345          $user = &$this->data;
 346          $birthday = &$user['birthday'];
 347  
 348          if(!is_array($birthday))
 349          {
 350              return true;
 351          }
 352  
 353          // Sanitize any input we have
 354          $birthday['day'] = intval($birthday['day']);
 355          $birthday['month'] = intval($birthday['month']);
 356          $birthday['year'] = intval($birthday['year']);
 357  
 358          // Error if a day and month exists, and the birthday day and range is not in range
 359          if($birthday['day'] != 0 || $birthday['month'] != 0)
 360          {
 361              if($birthday['day'] < 1 || $birthday['day'] > 31 || $birthday['month'] < 1 || $birthday['month'] > 12 || ($birthday['month'] == 2 && $birthday['day'] > 29))
 362              {
 363                  $this->set_error("invalid_birthday");
 364                  return false;
 365              }
 366          }
 367  
 368          // Check if the day actually exists.
 369          $months = get_bdays($birthday['year']);
 370          if($birthday['day'] > $months[$birthday['month']-1])
 371          {
 372              $this->set_error("invalid_birthday");
 373              return false;
 374          }
 375  
 376          // Error if a year exists and the year is out of range
 377          if($birthday['year'] != 0 && ($birthday['year'] < (date("Y")-100)) || $birthday['year'] > date("Y"))
 378          {
 379              $this->set_error("invalid_birthday");
 380              return false;
 381          }
 382          else if($birthday['year'] == date("Y"))
 383          {
 384              // Error if birth date is in future
 385              if($birthday['month'] > date("m") || ($birthday['month'] == date("m") && $birthday['day'] > date("d")))
 386              {
 387                  $this->set_error("invalid_birthday");
 388                  return false;
 389              }
 390          }
 391  
 392          // Error if COPPA is on, and the user hasn't verified their age / under 13
 393          if($mybb->settings['coppa'] == "enabled" && ($birthday['year'] == 0 || !$birthday['year']))
 394          {
 395              $this->set_error("invalid_birthday_coppa");
 396              return false;
 397          }
 398          elseif($mybb->settings['coppa'] == "deny" && $birthday['year'] > (date("Y")-13))
 399          {
 400              $this->set_error("invalid_birthday_coppa2");
 401              return false;
 402          }
 403  
 404          // Make the user's birthday field
 405          if($birthday['year'] != 0)
 406          {
 407              // If the year is specified, put together a d-m-y string
 408              $user['bday'] = $birthday['day']."-".$birthday['month']."-".$birthday['year'];
 409          }
 410          elseif($birthday['day'] && $birthday['month'])
 411          {
 412              // If only a day and month are specified, put together a d-m string
 413              $user['bday'] = $birthday['day']."-".$birthday['month']."-";
 414          }
 415          else
 416          {
 417              // No field is specified, so return an empty string for an unknown birthday
 418              $user['bday'] = '';
 419          }
 420          return true;
 421      }
 422      
 423      /**
 424      * Verifies if the post count field is filled in correctly.
 425      *
 426      * @return boolean True when valid, false when invalid.
 427      */
 428  	function verify_postnum()
 429      {
 430          $user = &$this->data;
 431          
 432          if($user['postnum'] < 0)
 433          {
 434              $this->set_error("invalid_postnum");
 435              return false;
 436          }
 437          
 438          return true;
 439      }
 440  
 441      /**
 442      * Verifies if a profile fields are filled in correctly.
 443      *
 444      * @return boolean True when valid, false when invalid.
 445      */
 446  	function verify_profile_fields()
 447      {
 448          global $db;
 449  
 450          $user = &$this->data;
 451          $profile_fields = &$this->data['profile_fields'];
 452  
 453          // Loop through profile fields checking if they exist or not and are filled in.
 454          $userfields = array();
 455          $comma = '';
 456          $editable = '';
 457          
 458          if(!$this->data['profile_fields_editable'])
 459          {
 460              $editable = "editable=1";
 461          }
 462  
 463          // Fetch all profile fields first.
 464          $options = array(
 465              'order_by' => 'disporder'
 466          );
 467          $query = $db->simple_select('profilefields', 'name, type, fid, required, maxlength', $editable, $options);
 468  
 469          // Then loop through the profile fields.
 470          while($profilefield = $db->fetch_array($query))
 471          {
 472              $profilefield['type'] = htmlspecialchars_uni($profilefield['type']);
 473              $thing = explode("\n", $profilefield['type'], "2");
 474              $type = trim($thing[0]);
 475              $field = "fid{$profilefield['fid']}";
 476  
 477              // If the profile field is required, but not filled in, present error.
 478              if($type != "multiselect" && $type != "checkbox")
 479              {
 480                  if(trim($profile_fields[$field]) == "" && $profilefield['required'] == 1 && !defined('IN_ADMINCP') && THIS_SCRIPT != "modcp.php")
 481                  {
 482                      $this->set_error('missing_required_profile_field', array($profilefield['name']));
 483                  }
 484              }
 485              elseif(($type == "multiselect" || $type == "checkbox") && $profile_fields[$field] == "" && $profilefield['required'] == 1 && !defined('IN_ADMINCP') && THIS_SCRIPT != "modcp.php")
 486              {
 487                  $this->set_error('missing_required_profile_field', array($profilefield['name']));
 488              }
 489  
 490              // Sort out multiselect/checkbox profile fields.
 491              $options = '';
 492              if(($type == "multiselect" || $type == "checkbox") && is_array($profile_fields[$field]))
 493              {
 494                  $expoptions = explode("\n", $thing[1]);
 495                  $expoptions = array_map('trim', $expoptions);
 496                  foreach($profile_fields[$field] as $value)
 497                  {
 498                      if(!in_array(htmlspecialchars_uni($value), $expoptions))
 499                      {
 500                          $this->set_error('bad_profile_field_values', array($profilefield['name']));
 501                      }
 502                      if($options)
 503                      {
 504                          $options .= "\n";
 505                      }
 506                      $options .= $db->escape_string($value);
 507                  }
 508              }
 509              elseif($type == "select" || $type == "radio")
 510              {
 511                  $expoptions = explode("\n", $thing[1]);
 512                  $expoptions = array_map('trim', $expoptions);
 513                  if(!in_array(htmlspecialchars_uni($profile_fields[$field]), $expoptions) && trim($profile_fields[$field]) != "")
 514                  {
 515                      $this->set_error('bad_profile_field_values', array($profilefield['name']));
 516                  }
 517                  $options = $db->escape_string($profile_fields[$field]);
 518              }
 519              elseif($type == "textarea")
 520              {
 521                  if($profilefield['maxlength'] > 0 && my_strlen($profile_fields[$field]) > $profilefield['maxlength'])
 522                  {
 523                      $this->set_error('max_limit_reached', array($profilefield['name'], $profilefield['maxlength']));
 524                  }
 525  
 526                  $options = $db->escape_string($profile_fields[$field]);
 527              }
 528              else
 529              {
 530                  $options = $db->escape_string($profile_fields[$field]);
 531              }
 532              $user['user_fields'][$field] = $options;
 533          }
 534  
 535          return true;
 536      }
 537  
 538      /**
 539      * Verifies if an optionally entered referrer exists or not.
 540      *
 541      * @return boolean True when valid, false when invalid.
 542      */
 543  	function verify_referrer()
 544      {
 545          global $db, $mybb;
 546  
 547          $user = &$this->data;
 548  
 549          // Does the referrer exist or not?
 550          if($mybb->settings['usereferrals'] == 1 && $user['referrer'] != '')
 551          {
 552              $query = $db->simple_select('users', 'uid', "username='".$db->escape_string($user['referrer'])."'", array('limit' => 1));
 553              $referrer = $db->fetch_array($query);
 554              if(!$referrer['uid'])
 555              {
 556                  $this->set_error('invalid_referrer', array($user['referrer']));
 557                  return false;
 558              }
 559          }
 560          $user['referrer_uid'] = $referrer['uid'];
 561  
 562          return true;
 563      }
 564  
 565      /**
 566      * Verifies user options.
 567      *
 568      * @return boolean True when valid, false when invalid.
 569      */
 570  	function verify_options()
 571      {
 572          global $mybb;
 573          
 574          $options = &$this->data['options'];
 575  
 576          // Verify yes/no options.
 577          $this->verify_yesno_option($options, 'allownotices', 1);
 578          $this->verify_yesno_option($options, 'hideemail', 0);
 579          $this->verify_yesno_option($options, 'emailpmnotify', 0);
 580          $this->verify_yesno_option($options, 'receivepms', 1);
 581          $this->verify_yesno_option($options, 'receivefrombuddy', 0);
 582          $this->verify_yesno_option($options, 'pmnotice', 1);
 583          $this->verify_yesno_option($options, 'pmnotify', 1);
 584          $this->verify_yesno_option($options, 'invisible', 0);
 585          $this->verify_yesno_option($options, 'showsigs', 1);
 586          $this->verify_yesno_option($options, 'showavatars', 1);
 587          $this->verify_yesno_option($options, 'showquickreply', 1);
 588          $this->verify_yesno_option($options, 'showredirect', 1);
 589          
 590          if($mybb->settings['postlayout'] == 'classic')
 591          {
 592              $this->verify_yesno_option($options, 'classicpostbit', 1);
 593          }
 594          else
 595          {
 596              $this->verify_yesno_option($options, 'classicpostbit', 0);
 597          }
 598          
 599          if(array_key_exists('subscriptionmethod', $options))
 600          {
 601              // Value out of range
 602              $options['subscriptionmethod'] = intval($options['subscriptionmethod']);
 603              if($options['subscriptionmethod'] < 0 || $options['subscriptionmethod'] > 2)
 604              {
 605                  $options['subscriptionmethod'] = 0;
 606              }
 607          }
 608  
 609          if(array_key_exists('dstcorrection', $options))
 610          {
 611              // Value out of range
 612              $options['dstcorrection'] = intval($options['dstcorrection']);
 613              if($options['dstcorrection'] < 0 || $options['dstcorrection'] > 2)
 614              {
 615                  $options['dstcorrection'] = 0;
 616              }
 617          }
 618          
 619          if($options['dstcorrection'] == 1)
 620          {
 621              $options['dst'] = 1;
 622          }
 623          else if($options['dstcorrection'] == 0)
 624          {
 625              $options['dst'] = 0;
 626          }
 627  
 628          if(isset($options['showcodebuttons']))
 629          {
 630              $options['showcodebuttons'] = intval($options['showcodebuttons']);
 631              if($options['showcodebuttons'] != 0)
 632              {
 633                  $options['showcodebuttons'] = 1;
 634              }
 635          }
 636          else if($this->method == "insert")
 637          {
 638              $options['showcodebuttons'] = 1;
 639          }
 640          
 641          if($this->method == "insert" || (isset($options['threadmode']) && $options['threadmode'] != "linear" && $options['threadmode'] != "threaded"))
 642          {
 643              if($mybb->settings['threadusenetstyle'])
 644              {
 645                  $options['threadmode'] = 'threaded';
 646              }
 647              else
 648              {
 649                  $options['threadmode'] = 'linear';
 650              }
 651          }
 652  
 653          // Verify the "threads per page" option.
 654          if($this->method == "insert" || (array_key_exists('tpp', $options) && $mybb->settings['usertppoptions']))
 655          {
 656              $explodedtpp = explode(",", $mybb->settings['usertppoptions']);
 657              if(is_array($explodedtpp))
 658              {
 659                  @asort($explodedtpp);
 660                  $biggest = $explodedtpp[count($explodedtpp)-1];
 661                  // Is the selected option greater than the allowed options?
 662                  if($options['tpp'] > $biggest)
 663                  {
 664                      $options['tpp'] = $biggest;
 665                  }
 666              }
 667              $options['tpp'] = intval($options['tpp']);
 668          }
 669          // Verify the "posts per page" option.
 670          if($this->method == "insert" || (array_key_exists('ppp', $options) && $mybb->settings['userpppoptions']))
 671          {
 672              $explodedppp = explode(",", $mybb->settings['userpppoptions']);
 673              if(is_array($explodedppp))
 674              {
 675                  @asort($explodedppp);
 676                  $biggest = $explodedppp[count($explodedppp)-1];
 677                  // Is the selected option greater than the allowed options?
 678                  if($options['ppp'] > $biggest)
 679                  {
 680                      $options['ppp'] = $biggest;
 681                  }
 682              }
 683              $options['ppp'] = intval($options['ppp']);
 684          }
 685          // Is our selected "days prune" option valid or not?
 686          if($this->method == "insert" || array_key_exists('daysprune', $options))
 687          {
 688              $options['daysprune'] = intval($options['daysprune']);
 689              if($options['daysprune'] < 0)
 690              {
 691                  $options['daysprune'] = 0;
 692              }
 693          }
 694          $this->data['options'] = $options;
 695      }
 696  
 697      /**
 698       * Verifies if a registration date is valid or not.
 699       *
 700       * @return boolean True when valid, false when invalid.
 701       */
 702  	function verify_regdate()
 703      {
 704          $regdate = &$this->data['regdate'];
 705  
 706          $regdate = intval($regdate);
 707          // If the timestamp is below 0, set it to the current time.
 708          if($regdate <= 0)
 709          {
 710              $regdate = TIME_NOW;
 711          }
 712          return true;
 713      }
 714  
 715      /**
 716       * Verifies if a last visit date is valid or not.
 717       *
 718       * @return boolean True when valid, false when invalid.
 719       */
 720  	function verify_lastvisit()
 721      {
 722          $lastvisit = &$this->data['lastvisit'];
 723  
 724          $lastvisit = intval($lastvisit);
 725          // If the timestamp is below 0, set it to the current time.
 726          if($lastvisit <= 0)
 727          {
 728              $lastvisit = TIME_NOW;
 729          }
 730          return true;
 731  
 732      }
 733  
 734      /**
 735       * Verifies if a last active date is valid or not.
 736       *
 737       * @return boolean True when valid, false when invalid.
 738       */
 739  	function verify_lastactive()
 740      {
 741          $lastactive = &$this->data['lastactive'];
 742  
 743          $lastactive = intval($lastactive);
 744          // If the timestamp is below 0, set it to the current time.
 745          if($lastactive <= 0)
 746          {
 747              $lastactive = TIME_NOW;
 748          }
 749          return true;
 750  
 751      }
 752  
 753      /**
 754       * Verifies if an away mode status is valid or not.
 755       *
 756       * @return boolean True when valid, false when invalid.
 757       */
 758  	function verify_away()
 759      {
 760          global $mybb;
 761  
 762          $user = &$this->data;
 763          // If the board does not allow "away mode" or the user is marking as not away, set defaults.
 764          if($mybb->settings['allowaway'] == 0 || $user['away']['away'] != 1)
 765          {
 766              $user['away']['away'] = 0;
 767              $user['away']['date'] = 0;
 768              $user['away']['returndate'] = 0;
 769              $user['away']['reason'] = '';
 770              return true;
 771          }
 772          else if($user['away']['returndate'])
 773          {
 774              list($returnday, $returnmonth, $returnyear) = explode('-', $user['away']['returndate']);
 775              if(!$returnday || !$returnmonth || !$returnyear)
 776              {
 777                  $this->set_error("missing_returndate");
 778                  return false;
 779              }
 780              
 781              // Validate the return date lengths
 782              $user['away']['returndate'] = substr($returnday, 0, 2).'-'.substr($returnmonth, 0, 2).'-'.substr($returnyear, 0, 4);
 783          }
 784          return true;
 785      }
 786  
 787      /**
 788       * Verifies if a langage is valid for this user or not.
 789       *
 790       * @return boolean True when valid, false when invalid.
 791       */
 792  	function verify_language()
 793      {
 794          global $lang;
 795  
 796          $language = &$this->data['language'];
 797  
 798          // An invalid language has been specified?
 799          if($language != '' && !$lang->language_exists($language))
 800          {
 801              $this->set_error("invalid_language");
 802              return false;
 803          }
 804          return true;
 805      }
 806      
 807      /**
 808       * Verifies if this is coming from a spam bot or not
 809       *
 810       * @return boolean True when valid, false when invalid.
 811       */
 812  	function verify_checkfields()
 813      {
 814          $user = &$this->data;
 815          
 816          // An invalid language has been specified?
 817          if($user['regcheck1'] !== "" || $user['regcheck2'] !== "true")
 818          {
 819              $this->set_error("invalid_checkfield");
 820              return false;
 821          }
 822          return true;
 823      }
 824  
 825      /**
 826      * Validate all user assets.
 827      *
 828      * @return boolean True when valid, false when invalid.
 829      */
 830  	function validate_user()
 831      {
 832          global $mybb, $plugins;
 833  
 834          $user = &$this->data;
 835  
 836          // First, grab the old user details if this user exists
 837          if($user['uid'])
 838          {
 839              $old_user = get_user($user['uid']);
 840          }
 841  
 842          if($this->method == "insert" || array_key_exists('username', $user))
 843          {
 844              // If the username is the same - no need to verify
 845              if(!$old_user['username'] || $user['username'] != $old_user['username'])
 846              {
 847                  $this->verify_username();
 848                  $this->verify_username_exists();
 849              }
 850              else
 851              {
 852                  unset($user['username']);
 853              }
 854          }
 855          if($this->method == "insert" || array_key_exists('usertitle', $user))
 856          {
 857              $this->verify_usertitle();
 858          }
 859          if($this->method == "insert" || array_key_exists('password', $user))
 860          {
 861              $this->verify_password();
 862          }
 863          if($this->method == "insert" || array_key_exists('usergroup', $user))
 864          {
 865              $this->verify_usergroup();
 866          }
 867          if($this->method == "insert" || array_key_exists('email', $user))
 868          {
 869              $this->verify_email();
 870          }
 871          if($this->method == "insert" || array_key_exists('website', $user))
 872          {
 873              $this->verify_website();
 874          }
 875          if($this->method == "insert" || array_key_exists('icq', $user))
 876          {
 877              $this->verify_icq();
 878          }
 879          if($this->method == "insert" || array_key_exists('msn', $user))
 880          {
 881              $this->verify_msn();
 882          }
 883          if($this->method == "insert" || is_array($user['birthday']))
 884          {
 885              $this->verify_birthday();
 886          }
 887          if($this->method == "insert" || array_key_exists('postnum', $user))
 888          {
 889              $this->verify_postnum();
 890          }
 891          if($this->method == "insert" || array_key_exists('profile_fields', $user))
 892          {
 893              $this->verify_profile_fields();
 894          }
 895          if($this->method == "insert" || array_key_exists('referrer', $user))
 896          {
 897              $this->verify_referrer();
 898          }
 899          if($this->method == "insert" || array_key_exists('options', $user))
 900          {
 901              $this->verify_options();
 902          }
 903          if($this->method == "insert" || array_key_exists('regdate', $user))
 904          {
 905              $this->verify_regdate();
 906          }
 907          if($this->method == "insert" || array_key_exists('lastvisit', $user))
 908          {
 909              $this->verify_lastvisit();
 910          }
 911          if($this->method == "insert" || array_key_exists('lastactive', $user))
 912          {
 913              $this->verify_lastactive();
 914          }
 915          if($this->method == "insert" || array_key_exists('away', $user))
 916          {
 917              $this->verify_away();
 918          }
 919          if($this->method == "insert" || array_key_exists('language', $user))
 920          {
 921              $this->verify_language();
 922          }
 923          if($this->method == "insert" && array_key_exists('regcheck1', $user) && array_key_exists('regcheck2', $user))
 924          {
 925              $this->verify_checkfields();
 926          }
 927          
 928          $plugins->run_hooks_by_ref("datahandler_user_validate", $this);
 929          
 930          // We are done validating, return.
 931          $this->set_validated(true);
 932          if(count($this->get_errors()) > 0)
 933          {
 934              return false;
 935          }
 936          else
 937          {
 938              return true;
 939          }
 940      }
 941  
 942      /**
 943      * Inserts a user into the database.
 944      */
 945  	function insert_user()
 946      {
 947          global $db, $cache, $plugins;
 948  
 949          // Yes, validating is required.
 950          if(!$this->get_validated())
 951          {
 952              die("The user needs to be validated before inserting it into the DB.");
 953          }
 954          if(count($this->get_errors()) > 0)
 955          {
 956              die("The user is not valid.");
 957          }
 958  
 959          $user = &$this->data;
 960  
 961          $this->user_insert_data = array(
 962              "username" => $db->escape_string($user['username']),
 963              "password" => $user['saltedpw'],
 964              "salt" => $user['salt'],
 965              "loginkey" => $user['loginkey'],
 966              "email" => $db->escape_string($user['email']),
 967              "postnum" => intval($user['postnum']),
 968              "avatar" => $db->escape_string($user['avatar']),
 969              "avatartype" => $db->escape_string($user['avatartype']),
 970              "usergroup" => intval($user['usergroup']),
 971              "additionalgroups" => $db->escape_string($user['additionalgroups']),
 972              "displaygroup" => intval($user['displaygroup']),
 973              "usertitle" => $db->escape_string(htmlspecialchars_uni($user['usertitle'])),
 974              "regdate" => intval($user['regdate']),
 975              "lastactive" => intval($user['lastactive']),
 976              "lastvisit" => intval($user['lastvisit']),
 977              "website" => $db->escape_string(htmlspecialchars($user['website'])),
 978              "icq" => intval($user['icq']),
 979              "aim" => $db->escape_string(htmlspecialchars($user['aim'])),
 980              "yahoo" => $db->escape_string(htmlspecialchars($user['yahoo'])),
 981              "msn" => $db->escape_string(htmlspecialchars($user['msn'])),
 982              "birthday" => $user['bday'],
 983              "signature" => $db->escape_string($user['signature']),
 984              "allownotices" => $user['options']['allownotices'],
 985              "hideemail" => $user['options']['hideemail'],
 986              "subscriptionmethod" => intval($user['options']['subscriptionmethod']),
 987              "receivepms" => $user['options']['receivepms'],
 988              "receivefrombuddy" => $user['options']['receivefrombuddy'],
 989              "pmnotice" => $user['options']['pmnotice'],
 990              "pmnotify" => $user['options']['emailpmnotify'],
 991              "showsigs" => $user['options']['showsigs'],
 992              "showavatars" => $user['options']['showavatars'],
 993              "showquickreply" => $user['options']['showquickreply'],
 994              "showredirect" => $user['options']['showredirect'],
 995              "tpp" => intval($user['options']['tpp']),
 996              "ppp" => intval($user['options']['ppp']),
 997              "invisible" => $user['options']['invisible'],
 998              "style" => intval($user['style']),
 999              "timezone" => $db->escape_string($user['timezone']),
1000              "dstcorrection" => intval($user['options']['dstcorrection']),
1001              "threadmode" => $user['options']['threadmode'],
1002              "daysprune" => intval($user['options']['daysprune']),
1003              "dateformat" => $db->escape_string($user['dateformat']),
1004              "timeformat" => $db->escape_string($user['timeformat']),
1005              "regip" => $db->escape_string($user['regip']),
1006              "longregip" => intval(my_ip2long($user['regip'])),
1007              "language" => $db->escape_string($user['language']),
1008              "showcodebuttons" => $user['options']['showcodebuttons'],
1009              "away" => $user['away']['away'],
1010              "awaydate" => $user['away']['date'],
1011              "returndate" => $user['away']['returndate'],
1012              "awayreason" => $db->escape_string($user['away']['awayreason']),
1013              "notepad" => $db->escape_string($user['notepad']),
1014              "referrer" => intval($user['referrer_uid']),
1015              "referrals" => 0,
1016              "buddylist" => '',
1017              "ignorelist" => '',
1018              "pmfolders" => '',
1019              "notepad" => '',
1020              "warningpoints" => 0,
1021              "moderateposts" => 0,
1022              "moderationtime" => 0,
1023              "suspendposting" => 0,
1024              "suspensiontime" => 0,
1025              "coppauser" => intval($user['coppa_user']),
1026              "classicpostbit" => $user['options']['classicpostbit'],
1027              "usernotes" => ''
1028          );
1029          
1030          if($user['options']['dstcorrection'] == 1)
1031          {
1032              $this->user_insert_data['dst'] = 1;
1033          }
1034          else if($user['options']['dstcorrection'] == 0)
1035          {
1036              $this->user_insert_data['dst'] = 0;
1037          }
1038  
1039          $plugins->run_hooks_by_ref("datahandler_user_insert", $this);
1040          
1041          $this->uid = $db->insert_query("users", $this->user_insert_data);
1042          
1043          $user['user_fields']['ufid'] = $this->uid;
1044          
1045          $query = $db->simple_select("profilefields", "fid");
1046          while($profile_field = $db->fetch_array($query))
1047          {
1048              if(array_key_exists("fid{$profile_field['fid']}", $user['user_fields']))
1049              {
1050                  continue;
1051              }
1052              $user['user_fields']["fid{$profile_field['fid']}"] = '';
1053          }
1054  
1055          $db->insert_query("userfields", $user['user_fields'], false);
1056          
1057          if($this->user_insert_data['referrer'] != 0)
1058          {
1059              $db->write_query("
1060                  UPDATE ".TABLE_PREFIX."users
1061                  SET referrals=referrals+1
1062                  WHERE uid='{$this->user_insert_data['referrer']}'
1063              ");
1064          }
1065  
1066          // Update forum stats
1067          update_stats(array('numusers' => '+1'));
1068  
1069          return array(
1070              "uid" => $this->uid,
1071              "username" => $user['username'],
1072              "loginkey" => $user['loginkey'],
1073              "email" => $user['email'],
1074              "password" => $user['password'],
1075              "usergroup" => $user['usergroup']
1076          );
1077      }
1078  
1079      /**
1080      * Updates a user in the database.
1081      */
1082  	function update_user()
1083      {
1084          global $db, $plugins, $cache;
1085  
1086          // Yes, validating is required.
1087          if(!$this->get_validated())
1088          {
1089              die("The user needs to be validated before inserting it into the DB.");
1090          }
1091          if(count($this->get_errors()) > 0)
1092          {
1093              die("The user is not valid.");
1094          }
1095  
1096          $user = &$this->data;
1097          $user['uid'] = intval($user['uid']);
1098          $this->uid = $user['uid'];
1099  
1100          // Set up the update data.
1101          if(isset($user['username']))
1102          {
1103              $this->user_update_data['username'] = $db->escape_string($user['username']);
1104          }
1105          if(isset($user['saltedpw']))
1106          {
1107              $this->user_update_data['password'] = $user['saltedpw'];
1108              $this->user_update_data['salt'] = $user['salt'];
1109              $this->user_update_data['loginkey'] = $user['loginkey'];
1110          }
1111          if(isset($user['email']))
1112          {
1113              $this->user_update_data['email'] = $user['email'];
1114          }
1115          if(isset($user['postnum']))
1116          {
1117              $this->user_update_data['postnum'] = intval($user['postnum']);
1118          }
1119          if(isset($user['avatar']))
1120          {
1121              $this->user_update_data['avatar'] = $db->escape_string($user['avatar']);
1122              $this->user_update_data['avatartype'] = $db->escape_string($user['avatartype']);
1123          }
1124          if(isset($user['usergroup']))
1125          {
1126              $this->user_update_data['usergroup'] = intval($user['usergroup']);
1127          }
1128          if(isset($user['additionalgroups']))
1129          {
1130              $this->user_update_data['additionalgroups'] = $db->escape_string($user['additionalgroups']);
1131          }
1132          if(isset($user['displaygroup']))
1133          {
1134              $this->user_update_data['displaygroup'] = intval($user['displaygroup']);
1135          }
1136          if(isset($user['usertitle']))
1137          {
1138              $this->user_update_data['usertitle'] = $db->escape_string(htmlspecialchars_uni($user['usertitle']));
1139          }
1140          if(isset($user['regdate']))
1141          {
1142              $this->user_update_data['regdate'] = intval($user['regdate']);
1143          }
1144          if(isset($user['lastactive']))
1145          {
1146              $this->user_update_data['lastactive'] = intval($user['lastactive']);
1147          }
1148          if(isset($user['lastvisit']))
1149          {
1150              $this->user_update_data['lastvisit'] = intval($user['lastvisit']);
1151          }
1152          if(isset($user['signature']))
1153          {
1154              $this->user_update_data['signature'] = $db->escape_string($user['signature']);
1155          }
1156          if(isset($user['website']))
1157          {
1158              $this->user_update_data['website'] = $db->escape_string(htmlspecialchars($user['website']));
1159          }
1160          if(isset($user['icq']))
1161          {
1162              $this->user_update_data['icq'] = intval($user['icq']);
1163          }
1164          if(isset($user['aim']))
1165          {
1166              $this->user_update_data['aim'] = $db->escape_string(htmlspecialchars($user['aim']));
1167          }
1168          if(isset($user['yahoo']))
1169          {
1170              $this->user_update_data['yahoo'] = $db->escape_string(htmlspecialchars($user['yahoo']));
1171          }
1172          if(isset($user['msn']))
1173          {
1174              $this->user_update_data['msn'] = $db->escape_string(htmlspecialchars($user['msn']));
1175          }
1176          if(isset($user['bday']))
1177          {
1178              $this->user_update_data['birthday'] = $user['bday'];
1179          }
1180          if(isset($user['birthdayprivacy']))
1181          {
1182              $this->user_update_data['birthdayprivacy'] = $db->escape_string($user['birthdayprivacy']);
1183          }
1184          if(isset($user['style']))
1185          {
1186              $this->user_update_data['style'] = intval($user['style']);
1187          }
1188          if(isset($user['timezone']))
1189          {
1190              $this->user_update_data['timezone'] = $db->escape_string($user['timezone']);
1191          }
1192          if(isset($user['dateformat']))
1193          {
1194              $this->user_update_data['dateformat'] = $db->escape_string($user['dateformat']);
1195          }
1196          if(isset($user['timeformat']))
1197          {
1198              $this->user_update_data['timeformat'] = $db->escape_string($user['timeformat']);
1199          }
1200          if(isset($user['regip']))
1201          {
1202              $this->user_update_data['regip'] = $db->escape_string($user['regip']);
1203          }
1204          if(isset($user['language']))
1205          {
1206              $this->user_update_data['language'] = $db->escape_string($user['language']);
1207          }
1208          if(isset($user['away']))
1209          {
1210              $this->user_update_data['away'] = $user['away']['away'];
1211              $this->user_update_data['awaydate'] = $db->escape_string($user['away']['date']);
1212              $this->user_update_data['returndate'] = $db->escape_string($user['away']['returndate']);
1213              $this->user_update_data['awayreason'] = $db->escape_string($user['away']['awayreason']);
1214          }
1215          if(isset($user['notepad']))
1216          {
1217              $this->user_update_data['notepad'] = $db->escape_string($user['notepad']);
1218          }
1219          if(isset($user['usernotes']))
1220          {
1221              $this->user_update_data['usernotes'] = $db->escape_string($user['usernotes']);
1222          }
1223          if(is_array($user['options']))
1224          {
1225              foreach($user['options'] as $option => $value)
1226              {
1227                  $this->user_update_data[$option] = $value;
1228              }
1229          }
1230          if(array_key_exists('coppa_user', $user))
1231          {
1232              $this->user_update_data['coppauser'] = intval($user['coppa_user']);
1233          }
1234          // First, grab the old user details for later use.
1235          $old_user = get_user($user['uid']);
1236  
1237          // If old user has new pmnotice and new user has = yes, keep old value
1238          if($old_user['pmnotice'] == "2" && $this->user_update_data['pmnotice'] == 1)
1239          {
1240              unset($this->user_update_data['pmnotice']);
1241          }
1242          
1243          $plugins->run_hooks_by_ref("datahandler_user_update", $this);
1244          
1245          if(count($this->user_update_data) < 1 && empty($user['user_fields']))
1246          { 
1247              return false; 
1248          }        
1249  
1250          if(count($this->user_update_data) > 0)
1251          {
1252              // Actual updating happens here.
1253              $db->update_query("users", $this->user_update_data, "uid='{$user['uid']}'");
1254          }
1255          
1256          $cache->update_moderators();
1257          if(isset($user['bday']))
1258          {
1259              $cache->update_birthdays();
1260          }
1261  
1262          // Maybe some userfields need to be updated?
1263          if(is_array($user['user_fields']))
1264          {
1265              $query = $db->simple_select("userfields", "*", "ufid='{$user['uid']}'");
1266              $fields = $db->fetch_array($query);
1267              if(!$fields['ufid'])
1268              {
1269                  $user_fields = array(
1270                      'ufid' => $user['uid']
1271                  );
1272  
1273                  $fields_array = $db->show_fields_from("userfields");
1274                  foreach($fields_array as $field)
1275                  {
1276                      if($field['Field'] == 'ufid')
1277                      {
1278                          continue;
1279                      }
1280                      $user_fields[$field['Field']] = '';
1281                  }
1282                  $db->insert_query("userfields", $user_fields);
1283              }
1284              $db->update_query("userfields", $user['user_fields'], "ufid='{$user['uid']}'", false);
1285          }
1286  
1287          // Let's make sure the user's name gets changed everywhere in the db if it changed.
1288          if($this->user_update_data['username'] != $old_user['username'] && $this->user_update_data['username'] != '')
1289          {
1290              $username_update = array(
1291                  "username" => $this->user_update_data['username']
1292              );
1293              $lastposter_update = array(
1294                  "lastposter" => $this->user_update_data['username']
1295              );
1296  
1297              $db->update_query("posts", $username_update, "uid='{$user['uid']}'");
1298              $db->update_query("threads", $username_update, "uid='{$user['uid']}'");
1299              $db->update_query("threads", $lastposter_update, "lastposteruid='{$user['uid']}'");
1300              $db->update_query("forums", $lastposter_update, "lastposteruid='{$user['uid']}'");
1301              
1302              $stats = $cache->read("stats");
1303              if($stats['lastuid'] == $user['uid'])
1304              {
1305                  // User was latest to register, update stats
1306                  update_stats(array("numusers" => "+0"));
1307              }
1308          }
1309      }
1310  }
1311  ?>