diff -r 7e8fd44b36b0 -r dc8741857bde plugins/SpecialUserPrefs.php --- a/plugins/SpecialUserPrefs.php Thu Jun 28 13:49:40 2007 -0400 +++ b/plugins/SpecialUserPrefs.php Thu Jun 28 15:26:40 2007 -0400 @@ -403,10 +403,72 @@ { $real_name = htmlspecialchars($_POST['real_name']); $real_name = $db->escape($real_name); + + $imaddr_aim = htmlspecialchars($_POST['imaddr_aim']); + $imaddr_aim = $db->escape($imaddr_aim); + + $imaddr_msn = htmlspecialchars($_POST['imaddr_msn']); + $imaddr_msn = $db->escape($imaddr_msn); + + $imaddr_yahoo = htmlspecialchars($_POST['imaddr_yahoo']); + $imaddr_yahoo = $db->escape($imaddr_yahoo); + + $imaddr_xmpp = htmlspecialchars($_POST['imaddr_xmpp']); + $imaddr_xmpp = $db->escape($imaddr_xmpp); + + $homepage = htmlspecialchars($_POST['homepage']); + $homepage = $db->escape($homepage); + + $location = htmlspecialchars($_POST['location']); + $location = $db->escape($location); + + $occupation = htmlspecialchars($_POST['occupation']); + $occupation = $db->escape($occupation); + + $hobbies = htmlspecialchars($_POST['hobbies']); + $hobbies = $db->escape($hobbies); + + $email_public = ( isset($_POST['email_public']) ) ? '1' : '0'; + + $session->real_name = $real_name; + + if ( !preg_match('/@([a-z0-9-]+)(\.([a-z0-9-\.]+))?/', $imaddr_msn) ) + { + $imaddr_msn = "$imaddr_msn@hotmail.com"; + } + + if ( substr($homepage, 0, 7) != 'http://' ) + { + $homepage = "http://$homepage"; + } + + if ( !preg_match('/^http:\/\/([a-z0-9-.]+)([A-z0-9@#\$%\&:;<>,\.\?=\+\(\)\[\]_\/\\\\]*?)$/i', $homepage) ) + { + $homepage = ''; + } + + $session->user_extra['user_aim'] = $imaddr_aim; + $session->user_extra['user_msn'] = $imaddr_msn; + $session->user_extra['user_xmpp'] = $imaddr_xmpp; + $session->user_extra['user_yahoo'] = $imaddr_yahoo; + $session->user_extra['user_homepage'] = $homepage; + $session->user_extra['user_location'] = $location; + $session->user_extra['user_job'] = $occupation; + $session->user_extra['user_hobbies'] = $hobbies; + $session->user_extra['email_public'] = intval($email_public); + $q = $db->sql_query('UPDATE '.table_prefix."users SET real_name='$real_name' WHERE user_id=$session->user_id;"); if ( !$q ) $db->_die(); + $q = $db->sql_query('UPDATE '.table_prefix."users_extra SET user_aim='$imaddr_aim',user_yahoo='$imaddr_yahoo',user_msn='$imaddr_msn', + user_xmpp='$imaddr_xmpp',user_homepage='$homepage',user_location='$location',user_job='$occupation', + user_hobbies='$hobbies',email_public=$email_public + WHERE user_id=$session->user_id;"); + + if ( !$q ) + $db->_die(); + echo '