| changeset 359 | e0787bb6285b |
| parent 345 | 4ccdfeee9a11 |
| child 362 | 02d315d1cc58 |
| 358:b25d34fbc7ab | 359:e0787bb6285b |
|---|---|
421 'job' => $occupation, |
421 'job' => $occupation, |
422 'hobbies' => $hobbies |
422 'hobbies' => $hobbies |
423 ); |
423 ); |
424 $form->email_public = ( isset($_POST['email_public']) ); |
424 $form->email_public = ( isset($_POST['email_public']) ); |
425 $form->account_active = ( isset($_POST['account_active']) ); |
425 $form->account_active = ( isset($_POST['account_active']) ); |
426 // This is SAFE. The smartform calls is_valid_ip() on this value, thus preventing XSS |
|
427 // attempts from making it into the form HTML. Badly coded templates may still be |
|
428 // affected, but if have_reg_ip is checked for, then you're fine. |
|
429 $form->reg_ip_addr = $_POST['user_registration_ip']; |
|
426 echo $form->render(); |
430 echo $form->render(); |
427 return false; |
431 return false; |
428 } |
432 } |
429 |
433 |
430 # |
434 # |
444 else |
448 else |
445 { |
449 { |
446 echo 'No username provided'; |
450 echo 'No username provided'; |
447 return false; |
451 return false; |
448 } |
452 } |
449 $q = $db->sql_query('SELECT u.user_id AS authoritative_uid, u.username, u.email, u.real_name, u.signature, u.account_active, u.user_level, u.user_has_avatar, u.avatar_type, x.* FROM '.table_prefix.'users AS u |
453 $q = $db->sql_query('SELECT u.user_id AS authoritative_uid, u.username, u.email, u.real_name, u.signature, u.account_active, u.user_level, u.user_has_avatar, u.avatar_type, u.user_registration_ip, x.* FROM '.table_prefix.'users AS u |
450 LEFT JOIN '.table_prefix.'users_extra AS x |
454 LEFT JOIN '.table_prefix.'users_extra AS x |
451 ON ( u.user_id = x.user_id OR x.user_id IS NULL ) |
455 ON ( u.user_id = x.user_id OR x.user_id IS NULL ) |
452 WHERE ( ' . ENANO_SQLFUNC_LOWERCASE . '(u.username) = \'' . $db->escape(strtolower($username)) . '\' OR u.username = \'' . $db->escape($username) . '\' ) AND u.user_id != 1;'); |
456 WHERE ( ' . ENANO_SQLFUNC_LOWERCASE . '(u.username) = \'' . $db->escape(strtolower($username)) . '\' OR u.username = \'' . $db->escape($username) . '\' ) AND u.user_id != 1;'); |
453 if ( !$q ) |
457 if ( !$q ) |
454 $db->_die(); |
458 $db->_die(); |
483 'location' => $row['user_location'], |
487 'location' => $row['user_location'], |
484 'job' => $row['user_job'], |
488 'job' => $row['user_job'], |
485 'hobbies' => $row['user_hobbies'], |
489 'hobbies' => $row['user_hobbies'], |
486 ); |
490 ); |
487 $form->email_public = ( $row['email_public'] == 1 ); |
491 $form->email_public = ( $row['email_public'] == 1 ); |
492 $form->reg_ip_addr = ( $row['user_registration_ip'] ) ? $row['user_registration_ip'] : ''; |
|
488 $html = $form->render(); |
493 $html = $form->render(); |
489 if ( !$html ) |
494 if ( !$html ) |
490 { |
495 { |
491 echo 'Internal error: form processor returned false'; |
496 echo 'Internal error: form processor returned false'; |
492 } |
497 } |
759 */ |
764 */ |
760 |
765 |
761 var $avi_type = 'png'; |
766 var $avi_type = 'png'; |
762 |
767 |
763 /** |
768 /** |
769 * The IP address of the user during registration |
|
770 * @var string |
|
771 */ |
|
772 |
|
773 var $reg_ip_addr = ''; |
|
774 |
|
775 /** |
|
764 * Constructor. |
776 * Constructor. |
765 */ |
777 */ |
766 |
778 |
767 function Admin_UserManager_SmartForm() |
779 function Admin_UserManager_SmartForm() |
768 { |
780 { |
1084 <option value="{USER_LEVEL_ADMIN}"<!-- BEGIN ul_admin --> selected="selected"<!-- END ul_admin -->>{lang:userfuncs_ml_level_admin}</option> |
1096 <option value="{USER_LEVEL_ADMIN}"<!-- BEGIN ul_admin --> selected="selected"<!-- END ul_admin -->>{lang:userfuncs_ml_level_admin}</option> |
1085 </select> |
1097 </select> |
1086 </td> |
1098 </td> |
1087 </tr> |
1099 </tr> |
1088 |
1100 |
1101 <!-- BEGIN have_reg_ip --> |
|
1102 <tr> |
|
1103 <td class="row2"> |
|
1104 {lang:acpum_field_reg_ip} |
|
1105 </td> |
|
1106 <td class="row1"> |
|
1107 {REG_IP_ADDR} |
|
1108 <input type="hidden" name="user_registration_ip" value="{REG_IP_ADDR}" /> |
|
1109 </td> |
|
1110 </tr> |
|
1111 <!-- BEGINELSE have_reg_ip --> |
|
1112 <input type="hidden" name="user_registration_ip" value="" /> |
|
1113 <!-- END have_reg_ip --> |
|
1114 |
|
1089 <tr> |
1115 <tr> |
1090 <td class="row2"> |
1116 <td class="row2"> |
1091 {lang:acpum_field_deleteaccount_title} |
1117 {lang:acpum_field_deleteaccount_title} |
1092 </td> |
1118 </td> |
1093 <td class="row1"> |
1119 <td class="row1"> |
1178 'IM_XMPP' => $im_xmpp, |
1204 'IM_XMPP' => $im_xmpp, |
1179 'HOMEPAGE' => $homepage, |
1205 'HOMEPAGE' => $homepage, |
1180 'LOCATION' => $location, |
1206 'LOCATION' => $location, |
1181 'JOB' => $job, |
1207 'JOB' => $job, |
1182 'HOBBIES' => $hobbies, |
1208 'HOBBIES' => $hobbies, |
1183 'FORM_ACTION' => $form_action |
1209 'FORM_ACTION' => $form_action, |
1210 'REG_IP_ADDR' => $this->reg_ip_addr |
|
1184 )); |
1211 )); |
1185 |
1212 |
1186 if ( $this->has_avatar ) |
1213 if ( $this->has_avatar ) |
1187 { |
1214 { |
1188 $parser->assign_vars(array( |
1215 $parser->assign_vars(array( |
1197 'ul_mod' => ( $this->user_level == USER_LEVEL_MOD ), |
1224 'ul_mod' => ( $this->user_level == USER_LEVEL_MOD ), |
1198 'ul_admin' => ( $this->user_level == USER_LEVEL_ADMIN ), |
1225 'ul_admin' => ( $this->user_level == USER_LEVEL_ADMIN ), |
1199 'account_active' => ( $this->account_active === true ), |
1226 'account_active' => ( $this->account_active === true ), |
1200 'email_public' => ( $this->email_public === true ), |
1227 'email_public' => ( $this->email_public === true ), |
1201 'same_user' => ( $this->user_id == $session->user_id ), |
1228 'same_user' => ( $this->user_id == $session->user_id ), |
1202 'user_has_avatar' => ( $this->has_avatar ) |
1229 'user_has_avatar' => ( $this->has_avatar ), |
1230 'have_reg_ip' => ( intval(@strlen($this->reg_ip_addr)) > 0 && is_valid_ip($this->reg_ip_addr) ) |
|
1203 )); |
1231 )); |
1204 |
1232 |
1205 $parsed = $parser->run(); |
1233 $parsed = $parser->run(); |
1206 return $parsed; |
1234 return $parsed; |
1207 } |
1235 } |