$[No user with that name and password found. Please register or try again].
", "login_not_valid" => "$[No validated user with that name and password found. Please validate your account, register, or try again].
", "email_taken" => "$[That email is already in our database. If you've forgotten your password, please use the Change Password Request form].
", "addnew_loggedin" => "$[You are already logged in as a valid user. Please use your current account or log out to create a new account.].
", "username_taken" => "$[That username is already taken. Please enter another username.]
", "email_invalid" => "$[Email address appears invalid. Please check the email address or notify the administrator.]
", "update_invalid" => "$[Username and current password are required. You must also include either a new email address or new password.]
", "password_invalid" => "$[The old password you entered does not match the password we have on file. Please try again.]
", "user_not_validated" => "$[I'm sorry, your account isn't validated. Please change details in your account after you've validated your account. Please check your email.]
", "validation_error" => "$[There was a problem validating your account. Please contact the site administrator.]
", "email_sent" => "$[An email has been sent to you. Please find the email and click on the validation link.]", "password_mismatch" => "$[Your password and it's duplicate don't match. Please-reenter your new password twice.]", "updates_done" => "$[Your information has been updated. Thank you.]", "email_subject" => "$WikiTitle sign-up validation link", "email_msg" => "\nThank you for signing up to $WikiTitle.\n\nPlease click on the following link to complete your registration:\n", "standalone_error" => "$[There is an error in your configuration settings, or in your form. To use AuthUserDBase with the standalone feature, you must set \$AUDBaseTable's standalone setting to true.]
", "validation_done" => "$[Thank you for validating.]
" ) ); /*********************************/ // Stand-alone database management /*********************************/ //Program Logic // logic only runs for AUD_SA actions if (isset($_REQUEST['AUD_SA'])) { if (!$AUDBaseTable['standalone']) { AUD_SA_FormExit('standalone_error'); return false; } global $AUDBaseTable, $DB; $out = ADOdbConnect($AUDBaseTable['database']); if ($out !== TRUE) die($out); switch ($_REQUEST['AUD_SA']) { case "addnew": AUD_SA_ProcessAddnew(); break; case "update": AUD_SA_ProcessUpdate(); break; case "validate": AUD_SA_ProcessValidate(); break; case "reregister": if ($_POST['AUD_SA'] == "reregister") { AUD_SA_ProcessReRegister(); } else { AUD_SA_CompleteReRegister(); } break; default: AUD_SA_FormExit('form_error'); return false; break; } } // Handle the re-validation email from user request to fix passwords function AUD_SA_CompleteReRegister(){ global $AUDBaseTable; // validate "audcode" as 32 hexidecimal characters in length $password_valid = preg_match('/^[A-Fa-f0-9]{32}$/', $_GET['audcode']); if (!$password_valid) { AUD_SA_FormExit('invalid_reregister_link'); return false; } #----------------------------------- # Query Preparation $u = $AUDBaseTable['user_field']; $p = $AUDBaseTable['pw_field']; $t = $AUDBaseTable['user_table']; $e = $AUDBaseTable['email']; $v = $AUDBaseTable['validate_code']; $vf = $AUDBaseTable['validate_field']; $un = AUD_Safe($_GET['username']); $vc = AUD_Safe($_GET['valcode']); $ac = AUD_Safe($_GET['audcode']); // check username & validation code. $ask = "SELECT * FROM $t WHERE $u=$un AND $v=$vc"; $answer = AUD_Query($AUDBaseTable['database'], $ask); if ($answer === true) { //If valid, then update table with password. $ask = "UPDATE $t SET $v=NULL, $vf='1', $p=$ac WHERE $u=$un"; $answer = AUD_Query($AUDBaseTable['database'], $ask); if ($answer) { AUD_SA_FormExit('validation_done'); } else { AUD_SA_FormExit('validation_error'); } } } // Handle the user request to fix their password function AUD_SA_ProcessReRegister () { global $AUDBaseTable; #----------------------------------- # Query Preparation $u = $AUDBaseTable['user_field']; $p = $AUDBaseTable['pw_field']; $t = $AUDBaseTable['user_table']; $e = $AUDBaseTable['email']; $d = $AUDBaseTable['date_joined']; $v = $AUDBaseTable['validate_code']; $un = AUD_Safe($_POST['aud_username']); $em = AUD_Safe($_POST[aud_email]); // validate all user-entered data // entered passwords must match if (($_POST['aud_newpassword'] != '') && (!AUD_SA_ComparePasswords($_POST['aud_newpassword'], $_POST['aud_dupepassword']))) return false; // validate user - username & email must match account $ask = "SELECT * from $t where $u=$un AND $e=$em"; $answer = AUD_Query($AUDBaseTable['database'], $ask); if (!$answer) { AUD_SA_FormExit('user_not_found'); return false; } // generate new validation code $vcode = AUD_SA_ValidateCode(); // update database with validation code $ask = "UPDATE $t SET $v='$vcode' WHERE $u=$un"; $answer = AUD_Query($AUDBaseTable['database'], $ask); // Send email if ($answer > 0) { AUD_SA_EmailCode ($_POST['aud_username'], $email, $vcode, 1) ; AUD_SA_FormExit('email_sent'); } } // process user information changes - update email &/or password function AUD_SA_ProcessUpdate () { global $AUDBaseTable; // Form validation // Check that there's sufficient info to process the update if (($_POST['aud_username'] == '') || ($_POST['aud_oldpassword'] == '') || ( ($_POST['aud_newpassword'] == '') && ($_POST['aud_newemail'] == '') ) ) { AUD_SA_FormExit('update_invalid'); return false; } // entered passwords must match if (($_POST['aud_newpassword'] != '') && (!AUD_SA_ComparePasswords($_POST['aud_newpassword'], $_POST['aud_dupepassword']))) return false; // Make sure user IS validated if updating record. if (!AUD_SA_IsValidated(AUD_Safe($_POST['aud_username']))) { AUD_SA_FormExit('user_not_validated'); return false; } // If we're going to be updating the email address, make sure it's valid if ($_POST['aud_newemail'] != '') { if (!AUD_SA_ValidateEmail($_POST['aud_newemail'])) { AUD_SA_FormExit('email_invalid'); return false; } } // Check user's password etc. using false as placeholders for unused values if (!AuthUserDatabase(false, $_POST['aud_username'], $_POST['aud_oldpassword'], false)) { AUD_SA_FormExit('password_invalid'); return false; } // entered new passwords must match if (($_POST['aud_newpassword'] != '') && (!AUD_SA_ComparePasswords($_POST['aud_newpassword'], $_POST['aud_dupepassword']))) return false; #----------------------------------- # Query Preparation $u = $AUDBaseTable['user_field']; $p = $AUDBaseTable['pw_field']; $t = $AUDBaseTable['user_table']; $e = $AUDBaseTable['email']; $d = $AUDBaseTable['date_joined']; $ne = AUD_Safe($_POST['aud_newemail']); $un = AUD_Safe($_POST['aud_username']); // create the update query $ask = "UPDATE $t SET "; if ($_POST['aud_newpassword'] != "") { // encrypt password using the format set by user or default $crypt = $AUDBaseTable['encrypt_f']($_POST['aud_newpassword']); $ask .= "$p = '$crypt' " ; } if (($_POST['aud_newemail'] != "") && ($_POST['aud_newpassword'] != "") ) {$ask .= ", ";} if ($_POST['aud_newemail'] != "") { $ask .= "$e = $ne " ;} $ask .= "WHERE $u=$un"; $answer = AUD_Query($AUDBaseTable['database'], $ask); // userfeedback if ($answer == 1) { AUD_SA_FormExit('updates_done'); return true; } else { AUD_SA_FormExit('form_error'); return false; } } // This function adds a new user to the database function AUD_SA_ProcessAddNew () { global $AUDBaseTable, $DB; // Check this --> need to make sure user IS not(!) validated if adding a record. if (AUD_SA_IsValidated(AUD_Safe($_POST['aud_username']))) {AUD_SA_FormExit('addnew_loggedin'); return false;} // entered passwords must match if ($_POST['aud_password'] != '') { $p_answer = AUD_SA_ComparePasswords($_POST['aud_password'], $_POST['aud_dupepassword']); if (!$p_answer) { return false; } } else { AUD_SA_FormExit('password_mismatch'); return false; } // Validate Email Address if (!AUD_SA_ValidateEmail($_POST['aud_email'])) { AUD_SA_FormExit('email_invalid'); return false;} #----------------------------------- # Query Preparation $u = $AUDBaseTable['user_field']; $p = $AUDBaseTable['pw_field']; $t = $AUDBaseTable['user_table']; $e = $AUDBaseTable['email']; $d = $AUDBaseTable['date_joined']; $v = $AUDBaseTable['validate_code']; $em = AUD_Safe($_POST['aud_email']); $un = AUD_Safe($_POST['aud_username']); // check whether requested email address exists $ask = "SELECT * FROM $t WHERE $e=$em"; $eanswer = AUD_Query($AUDBaseTable['database'], $ask); // if email exists, send error to browser if ($eanswer) { AUD_SA_FormExit ('email_taken'); } // check whether requested username exists $ask = "SELECT * FROM $t WHERE $u=$un"; $uanswer = AUD_Query($AUDBaseTable['database'], $ask); // if username exists, send error to browser, ask for new username if ($uanswer) { AUD_SA_FormExit ('username_taken'); } // if neither username or email exist, add user if ((!$uanswer) && (!$eanswer)) { global $AUD_SA_ValidationCodeLength; // generate a random validation code $vcode = AUD_SA_ValidateCode($AUD_SA_ValidationCodeLength); // encrypt password using the encryption format $crypt = $AUDBaseTable['encrypt_f']($_POST['aud_password']); // Add new user to database with validation code $now = $DB[$AUDBaseTable['database']]->DBdate(time()); $ask = "INSERT INTO $t ($u, $e, $p, $v, $d) VALUES ($un, $em, '$crypt', '$vcode', $now )"; // run query $answer = AUD_Query($AUDBaseTable['database'], $ask); // Send out email with validation code // can check $answer, send email, and send message to browser if ($answer) { AUD_SA_EmailCode($_POST['aud_username'], $_POST['aud_email'], $vcode); AUD_SA_FormExit('email_sent'); }; } } // This function sends out emails, whether for first validation or re-validation function AUD_SA_EmailCode ($username, $email, $vcode, $revalidate=0) { global $AUD_SA_Msgs, $ScriptUrl, $pagename, $AUDBaseTable; // create validation URL if ($revalidate == 0) { $url = $ScriptUrl . "?n=$pagename&aud_username=$username&AUD_SA=validate&valcode=$vcode"; } else { $crypt = $AUDBaseTable['encrypt_f']($_POST['aud_newpassword']); $uencuser = urlencode($username); $url = $ScriptUrl . "?n=$pagename&AUD_SA=reregister&username=$uencuser&valcode=$vcode&audcode=$crypt"; } $body = $username . ": \n\n$AUD_SA_Msgs[email_msg]\n" . $url; //may want to add a from line later $from = ""; return (mail($email, $AUD_SA_Msgs['email_subject'], $body )); } //Should check for valid email addresses including ones with abnormal but valid characters function AUD_SA_ValidateEmail ($email) { // This may look like a rather loose email validator, but if you look at RFPs // for real valid email addresses, it's pretty scary what people can put in email // addresses and then there's .info, .name, .museum and a bunch of .com.au etc. // and oddest of all is name@[127.0.0.1] type addresses. $lastdot = strrpos($email, '.'); $amp = strrpos($email, '@'); $length = strlen($email); if ( ($lastdot === false) || (!(substr_count($email, '@')==1)) || ($amp === 0) || ($amp === false) || ($length === false) || (($lastdot - $amp) < 3) || (($length - $lastdot) < 3) ) { $return = false; } else { $return = true; } return $return; } // Quick check to see if the user has already validated their account function AUD_SA_IsValidated ($username) { global $AUDBaseTable; #----------------------------------- # Query Preparation $u = $AUDBaseTable['user_field']; $t = $AUDBaseTable['user_table']; $vf = $AUDBaseTable['validate_field']; // return true/false on whether a user is validated -- no need to check password, etc. $ask = "select $vf from $t where $u = $username"; $answer = AUD_Query($AUDBaseTable['database'], $ask); return $answer; } // Process a request to validate the user - from link in email using GET values function AUD_SA_ProcessValidate () { global $AUDBaseTable; // Note: Consider adding username to the link & query -- valcodes COULD be duped #----------------------------------- # Query Preparation $u = $AUDBaseTable['user_field']; $t = $AUDBaseTable['user_table']; $v = $AUDBaseTable['validate_code']; $vf = $AUDBaseTable['validate_field']; $vc = AUD_Safe($_GET['valcode']); $ask = "SELECT * FROM $t WHERE $v =$vc"; $count = AUD_Query($AUDBaseTable['database'], $ask); if ($count) { $ask = "UPDATE $t SET $v=NULL, $vf=1 WHERE $v =$vc"; $answer = AUD_Query($AUDBaseTable['database'], $ask); if ($answer) { AUD_SA_FormExit('validation_done'); } else { AUD_SA_FormExit('validation_error'); } } } // Process errors and send them to the browser PmWiki-style function AUD_SA_FormExit ($type) { global $MessagesFmt, $AUD_SA_Msgs; $MessagesFmt[] = $AUD_SA_Msgs[$type]; return true; } // Create random alphanumeric code function AUD_SA_ValidateCode ($length=20) { //Borrowed and hacked from Author: Peter Mugane Kionga-Kamau //http://www.pmkmedia.com //code found at http://codewalkers.com/seecode/279.html //"Modify at will." $from = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'; for ($i=0; $i<$length; $i++) $key .= $from[(mt_rand(0,(strlen($from)-1)))]; return $key; } // case-sensitive string comparison -> compare passwords given in dupe password forms function AUD_SA_ComparePasswords($first, $second) { // This function compares two passwords to make sure they're the same, and if not, returns false $result = strcmp($first, $second) ; if ($result != 0) { AUD_SA_FormExit('password_mismatch'); return false; } return true; }