kibi/5ducky
1
0
Fork 0
forked from 4ducky/4ducky
Code Pull Requests Activity
Files
664d8c61176565b13377363a7c10cbbe0fb232e1
5ducky/legacy/lib/users.php
T
kibiandClaude Opus 5.5 664d8c6117 Move the original PHP site into legacy/ 
The PHP sources, templates and old jQuery-based scripts move unchanged into
legacy/ for reference. Shared assets (media/, images/, favicon.ico, the
default avatar) stay at the repository root.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-17 02:15:05 +02:00

601 lines
18 KiB
PHP
Raw Blame History

<?php
/*
An object of this class represents a user on the site. All user
related tasks (registration, login, profile etc.) are handled here.
A user object is created and attempted to login on each page load.
*/
require_once( 'lib/config.php' );
require_once( 'lib/db.php' );
class User {
public $name = '';
public $id = 0;
public $validationString = '';
public $admin = 0;
public $website = 0;
public $color = "0";
public $stylecolor = "black";
public $avatar = "data/avatars/default.png";
public function __construct() {
}
public function validate( $id ) {
$u = DB::getRow(
'SELECT id, name, admin, website, color, style, avatar FROM '.TABLE_USERS.' WHERE valid = 0 AND remember = :1',
$id
);
$reg = DB::getRow("SELECT * FROM pl_settings");
if ($reg["register"] != 1){
return false;
}
if( empty($u) ) {
return false;
}
DB::updateRow( TABLE_USERS, array('id' => $u['id']), array( 'valid' => 0) );
session_name( Config::$sessionCookie );
session_start();
$_SESSION['id'] = $this->id = $u['id'];
$_SESSION['name'] = $this->name = $u['name'];
$_SESSION['admin'] = $this->admin = $u['admin'];
$_SESSION['website'] = $this->website = $u['website'];
$_SESSION['color'] = $this->color = $u['color'];
$_SESSION['stylecolor'] = $this->stylecolor = $u['style'];
$_SESSION['avatar'] = $this->avatar = $u['avatar'];
setcookie( Config::$rememberCookie, $id, time() + 3600 * 24 * 365, Config::$absolutePath );
if( Config::$vbbIntegration['enabled'] ) {
global $vbulletin;
$forum = new ForumOps($vbulletin);
$forum->login(array('username' => $u['name']));
}
return true;
}
public function isSpamLocked() {
// delete all ips older than IP_LOCK_TIME
DB::query( 'DELETE FROM '.TABLE_UPLOADLOCK.' WHERE ts < :1', time() - Config::$uploadLockTime );
$ip = $_SERVER['REMOTE_ADDR'];
$r = DB::getRow( 'SELECT COUNT(*) AS c FROM '.TABLE_UPLOADLOCK.'
WHERE ip = :1',
$ip
);
if( $r['c'] > Config::$maxNumUploads ) {
return true;
} else {
return false;
}
}
public function isSpamer() {
$r = DB::getRow( 'SELECT logged FROM pl_images
WHERE user = :1 order by logged desc',
$this->id
);
$time = strtotime($r["logged"]);
if( (time() - (integer)$time) < 10 ) {
return true;
} else {
return false;
}
}
public function isSpamming() {
$block = DB::getRow("SELECT spamblocked,time FROM pl_users WHERE id=:1",$this->id);
if ( (int)$block["spamblocked"] == 1)
{
if ((int)$block["time"] != 0){
$now = time();
$then = (int)$block["time"];
if ($now > $then) {
DB::updateRow("pl_users",array("id" => $this->id),array("time" => 0,"spamblocked" => 0));
return false;
}else{
return $block["time"];
exit();
}
}else{
return true;
}
}
$count = DB::getRow( 'SELECT COUNT(*) as c FROM pl_images
WHERE user = :1',
$this->id
);
if ( $count["c"] >= 3){
$r = DB::query( 'SELECT id,image,keyword,logged FROM pl_images
WHERE user = :1 LIMIT '.((integer)$count["c"]-3).',2',
$this->id
);
$r0 = DB::getRow( 'SELECT image,keyword,logged FROM pl_images
WHERE user = :1 LIMIT '.((integer)$count["c"]-1).',1',
$this->id
);
require_once("img_class.php");
$ban =0;
foreach ($r as $checkable) {
if ((strtotime($r0["logged"]) - strtotime($checkable["logged"])) < 60){
$splitter = split("/",$checkable["keyword"]);
$file2 = $splitter[0]."/".$splitter[1]."/".$checkable["image"];
$splitter = split("/",$r0["keyword"]);
$file1 = $splitter[0]."/".$splitter[1]."/".$r0["image"];
$diff = new imagediff("data/images/".$file2, "data/images/".$file1);
$dif = $diff->diff();
if ($dif > 0.92){
$ban += 1;
}
}
}
if ($ban >= 2){
foreach ($r as $checkable) {
DB::query("DELETE FROM pl_images WHERE id=:1",$checkable["id"]);
}
DB::updateRow("pl_users",array("id" => $this->id),array("spamblocked" => 1,"spam_reason"=>"Imagespam","time" => time() + (7 * 24 * 60 * 60)));
return true;
}else{
return false;}
}else{ return false;}
}
public function logUpload() {
$ip = $_SERVER['REMOTE_ADDR'];
DB::insertRow( TABLE_UPLOADLOCK, array('ip' => $ip, 'ts' => time(),'user' => $this->id) );
}
public function login() {
// attempt to login via post, session or remeber cookie
session_name( Config::$sessionCookie );
if( isset($_POST['login']) ) { // post login
$u = DB::getRow(
'SELECT id, name, admin, website, color, style,avatar FROM '.TABLE_USERS.' WHERE name = :1 AND pass = :2 and valid = 1',
$_POST['name'], md5($_POST['pass'])
);
$banstate = DB::getRow("SELECT * FROM pl_banned WHERE id=:1",$u['id']);
if ($banstate){
return "ban/".$banstate["reason"];
}
if( !empty($u) ) {
$c = DB::getRow('SELECT ip, created, COUNT(*) as c from pl_registerlock WHERE ip=:1 GROUP BY ip',$_SERVER['REMOTE_ADDR']);
if ((int)$c["c"] == 0){
DB::insertRow( "pl_registerlock", array("ip"=>$_SERVER['REMOTE_ADDR'],"created"=>date('Y-m-d H:i:s')));}else{
DB::query("DELETE FROM pl_registerlock WHERE ip=:1",$_SERVER['REMOTE_ADDR']);
DB::insertRow("pl_registerlock",array('ip'=>$_SERVER['REMOTE_ADDR'],'created'=>date('Y-m-d H:i:s')));
}
session_start();
$_SESSION['id'] = $this->id = $u['id'];
$_SESSION['name'] = $this->name = $u['name'];
$_SESSION['admin'] = $this->admin = $u['admin'];
$_SESSION['website'] = $this->website = $u['website'];
$_SESSION['color'] = $this->color = $u['color'];
$_SESSION['stylecolor'] = $this->stylecolor = $u['style'];
$_SESSION['avatar'] = $this->avatar = $u['avatar'];
if( !empty($_POST['remember']) ) {
$r = md5(uniqid(rand()));
DB::updateRow( TABLE_USERS, array('id' => $this->id), array('remember' => $r ) );
setcookie( Config::$rememberCookie, $r, time() + 3600 * 24 * 365, Config::$absolutePath );
}
if( Config::$vbbIntegration['enabled'] ) {
global $vbulletin;
$forum = new ForumOps($vbulletin);
$forum->login(array('username' => $u['name']));
}
}else{return "wronglogin";}
}
else if( !empty($_COOKIE[Config::$sessionCookie]) ) { // session running
session_start();
$c = DB::getRow('SELECT ip, created, COUNT(*) as c from pl_registerlock WHERE ip=:1 GROUP BY ip',$_SERVER['REMOTE_ADDR']);
if ((int)$c["c"] == 0){
DB::insertRow( "pl_registerlock", array("ip"=>$_SERVER['REMOTE_ADDR'],"created"=>date('Y-m-d H:i:s')));}else{
DB::query("DELETE FROM pl_registerlock WHERE ip=:1",$_SERVER['REMOTE_ADDR']);
DB::insertRow("pl_registerlock",array('ip'=>$_SERVER['REMOTE_ADDR'],'created'=>date('Y-m-d H:i:s')));
}
if( empty($_SESSION['id']) ) {
setcookie(Config::$sessionCookie, false, time() - 3600, Config::$absolutePath );
} else {
$this->id = $_SESSION['id'];
$this->name = $_SESSION['name'];
$this->admin = $_SESSION['admin'];
$this->website = $_SESSION['website'];
$this->color = $u['color'];
$this->stylecolor = $u['stylecolor'];
$this->avatar = $u['avatar'];
}
if (DB::getRow("SELECT id FROM pl_banned WHERE id=:1",$this->id)){
$this->logout();
return "banned";
}
}
else if( !empty($_COOKIE[Config::$rememberCookie]) ) { // remember cookie found
$u = DB::getRow(
'SELECT id, name, admin, website, style, color, avatar FROM '.TABLE_USERS.' WHERE remember = :1',
$_COOKIE[Config::$rememberCookie]
);
if( !empty($u) ) {
session_start();
$_SESSION['id'] = $this->id = $u['id'];
$_SESSION['name'] = $this->name = $u['name'];
$_SESSION['admin'] = $this->admin = $u['admin'];
$_SESSION['website'] = $this->website = $u['website'];
$_SESSION['color'] = $this->color = $u['color'];
$_SESSION['stylecolor'] = $this->stylecolor = $u['style'];
$_SESSION['avatar'] = $this->avatar = $u['avatar'];
// refresh for another year
setcookie( Config::$rememberCookie, $_COOKIE[Config::$rememberCookie], time() + 3600 * 24 * 365, Config::$absolutePath );
$c = DB::getRow('SELECT ip, created, COUNT(*) as c from pl_registerlock WHERE ip=:1 GROUP BY ip',$_SERVER['REMOTE_ADDR']);
if ((int)$c["c"] == 0){
DB::insertRow( "pl_registerlock", array("ip"=>$_SERVER['REMOTE_ADDR'],"created"=>date('Y-m-d H:i:s')));}else{
DB::query("DELETE FROM pl_registerlock WHERE ip=:1",$_SERVER['REMOTE_ADDR']);
DB::insertRow("pl_registerlock",array('ip'=>$_SERVER['REMOTE_ADDR'],'created'=>date('Y-m-d H:i:s')));
}
if (DB::getRow("SELECT id FROM pl_banned WHERE id=:1",$u['id'])){
$this->logout();
return "banned";
}
if( Config::$vbbIntegration['enabled'] ) {
global $vbulletin;
$forum = new ForumOps($vbulletin);
$forum->login(array('username' => $u['name']));
}
}
}
}
public function profile( $localFile, &$messages ) {
$upd = array( 'website' => $_POST['website'] );
$_SESSION['website'] = $_POST['website'];
if( Config::$vbbIntegration['enabled'] ) {
global $vbulletin;
$forum = new ForumOps($vbulletin);
}
$p = trim($_POST['cpass']);
if( !empty( $p ) ) {
if( strlen($_POST['cpass']) < 6 ) {
$messages['passToShort'] = true;
}
else if( $_POST['cpass'] != $_POST['cpass2'] ) {
$messages['passNotEqual'] = true;
}
else {
$upd['pass'] = md5($_POST['cpass2']);
if( Config::$vbbIntegration['enabled'] ) {
$forum->set_pass( $_SESSION['name'], $_POST['cpass2']);
}
}
}
if( !empty( $localFile ) ) {
require_once( 'lib/images.php' );
list( $imgWidth, $imgHeight, $imgtype ) = getimagesize($localFile);
if ( $imgWidth == 64 && $imgHeight == 64 && $imgtype == IMAGETYPE_GIF){
$name = Config::$images['avatarsPath'].uniqid().'.gif';
if (!move_uploaded_file($localFile,$name)){
$messages['avatarFailed'] = true;
$upd['avatar'] = Config::$images['avatarsPath']."default.png";
}else{
$upd['avatar'] = $name;
}
}else{
$name = Config::$images['avatarsPath'].uniqid().'.jpg';
if( Image::createThumb( $localFile, $name, 64,64 ) ) {
$upd['avatar'] = $name;
} else {
$messages['avatarFailed'] = true;
}
}
}
if(!empty($_POST['color'])){
if(preg_match('/^[a-f0-9]{6}$/i', $_POST['color'])){
if ( strtolower($_POST['color']) != "ffffff"){
$upd['color'] = $_POST['color'];
}else{
$upd['color'] = "0";
}
}else{
$messages['colorFailed'] = true;
}
}
//--------------------------------------------------------------------blockuser
if(!empty($_POST['blockuser'])){
if(preg_match('/^\w{2,20}$/', $_POST['blockuser'])){
$blockedusers = array();
$blockedusers = DB::getRow("SELECT id, users FROM pl_blocked WHERE id=:1",$this->id);
if(!empty($blockedusers)){
$blockedusers = unserialize($blockedusers['users']);
if (in_array(strtolower ($_POST['blockuser']),$blockedusers)){
$messages['blockAlready'] = true;
}else{
if(DB::query('SELECT * FROM pl_users WHERE name=:1', strtolower ($_POST['blockuser']))){
array_push($blockedusers,$_POST['blockuser']);
if(DB::query('UPDATE pl_blocked SET users=:1 WHERE id=:2', serialize($blockedusers),$this->id)){
$messages['blocked'] = true;
}else{
$messages['blockFailed'] = true;
}
}else{
$messages['userFailed'] = true;
}
}
}else{
if(DB::query('SELECT * FROM pl_users WHERE name=:1', $_POST['blockuser'])){
$newarray = array();
array_push($newarray,strtolower ($_POST['blockuser']));
if(DB::query("INSERT INTO pl_blocked (id,users) VALUES (:1,:2)",$this->id,serialize($newarray))){
$messages['blocked'] = true;
}else{
$messages['blockFailed'] = true;
}
}else{
$messages['userFailed'] = true;
}
}
}else{
$messages['blockFailed'] = true;
}
}
//--------------------------------------------------------------------UNblockuser
function remove_item_by_value($array, $val = '', $preserve_keys = true) {
if (count($array) == 1) return false;
if (empty($array) || !is_array($array)) return false;
if (!in_array($val, $array)) return $array;
foreach($array as $key => $value) {
if ($value == $val) unset($array[$key]);
}
return ($preserve_keys === true) ? $array : array_values($array);
}
//--------------------------------------------------------------------UNblockuser
if(!empty($_POST['unblockuser'])){
if ($_POST['unblockuser'] != "select"){
if(preg_match('/^\w{2,20}$/', $_POST['unblockuser'])){
if(DB::query('SELECT * FROM pl_users WHERE name=:1', $_POST['unblockuser'])){
$blockedusers = array();
$blockedusers = DB::getRow("SELECT id, users FROM pl_blocked WHERE id=:1",$this->id);
if(!empty($blockedusers)){
$blockedusers = unserialize($blockedusers['users']);
if (in_array($_POST['unblockuser'],$blockedusers)){
$blockedusers = remove_item_by_value($blockedusers,$_POST['unblockuser']);
if ($blockedusers){
DB::query('UPDATE pl_blocked SET users=:1 WHERE id=:2', serialize($blockedusers),$this->id);
$messages['unblocked'] = true;
}else{
DB::query('DELETE FROM pl_blocked WHERE id=:1',$this->id);
$messages['unblocked'] = true;
}
}else{$messages['notBlocked'] = true;}
}else{$messages['unblockFailed'] = true;}
}else{$messages['userFailed'] = true;}
}else{$messages['unblockFailed'] = true;}
}
}
//-------------------------------------------------------------------------STYLE
if(isset($_POST['stylecolor'])) {
if($_POST['stylecolor'] == 'white') {
$upd['style'] = $_POST['stylecolor'];
} elseif($_POST['stylecolor'] == 'black') {
$upd['style'] = $_POST['stylecolor'];
} else{
$upd['style'] = $_POST['black'];
}
}
if( empty($this->email) &&
preg_match('/^[\.\w\-]{1,}@[\.\w\-]{2,}\.[\w]{2,}$/', $_POST['email'])
) {
if( Config::$vbbIntegration['enabled'] ) {
$forum->set_email( $_SESSION['name'], $_POST['email']);
}
$upd['email'] = $_POST['email'];
}
DB::updateRow( TABLE_USERS, array( 'id' => $this->id ), $upd );
}
public function loadEmail() {
$tmp = DB::getRow(
'SELECT email,color,style,avatar FROM '.TABLE_USERS.' WHERE id = :1',
$this->id
);
$this->email = $tmp['email'];
$this->color = $tmp['color'];
$this->stylecolor = $tmp['style'];
$this->avatar = $u['avatar'];
}
public function logout() {
session_unset();
session_destroy();
$_SESSION = array();
setcookie( Config::$rememberCookie, false, time() - 3600, Config::$absolutePath );
setcookie( Config::$sessionCookie, false, time() - 3600, Config::$absolutePath );
if( Config::$vbbIntegration['enabled'] ) {
global $vbulletin;
$forum = new ForumOps($vbulletin);
$forum->logout();
}
}
public function increaseScore( $amount ) {
DB::query(
'UPDATE '.TABLE_USERS.' SET score = score + :1 WHERE id = :2',
intval( $amount ),
$this->id
);
}
public function register( &$messages,$inviteC=false ) {
DB::query( 'DELETE FROM '.TABLE_USERS.' WHERE valid = 0 AND registered < NOW() - INTERVAL 30 MINUTE' );
$iplocks = DB::getRow("DELETE FROM pl_registerlock WHERE created < (NOW() - INTERVAL 1440 MINUTE)");
$reg = DB::getRow("SELECT * FROM pl_settings");
$doubleacc = DB::getRow("SELECT COUNT(*) as c FROM pl_registerlock WHERE ip=:1",$_SERVER['REMOTE_ADDR']);
if($inviteC == false){
if ($reg["register"] != 1 || $doubleacc["c"] > 0){
$messages['registerClosed'] = true;
}
}else{
if ($doubleacc["c"] > 0){
DB::updateRow("pl_invites",array("code"=>$inviteC),array("used"=>1,"usedby"=>1));
$inviteC = false;
$messages['registerClosed'] = true;
}
}
if( !preg_match('/^\w{2,20}$/', $_POST['name']) ) {
$messages['nameInvalid'] = true;
} else {
$u = DB::getRow( 'SELECT * FROM '.TABLE_USERS.' WHERE name = :1', $_POST['name'] );
if( !empty($u) ) {
$messages['nameInUse'] = true;
}
}
if( strlen($_POST['pass']) < 6 ) {
$messages['passToShort'] = true;
}
else if( $_POST['pass'] != $_POST['pass2'] ) {
$messages['passNotEqual'] = true;
}
if( !preg_match( '/^[\.\w\-]{1,}@[\.\w\-]{2,}\.[\w]{2,}$/', $_POST['email'] ) ) {
$messages['wrongEmail'] = true;
} else {
$u = DB::getRow( 'SELECT * FROM '.TABLE_USERS.' WHERE email = :1', $_POST['email'] );
if( !empty($u) ) {
$messages['emailInUse'] = true;
}
}
if( !empty($messages) ) {
return false;
}
$this->validationString = md5(uniqid(rand()));
DB::insertRow( TABLE_USERS, array(
'registered' => date('Y-m-d H:i:s'),
'name' => $_POST['name'],
'pass' => md5($_POST['pass']),
'valid' => 1,
'score' => 0,
'images' => 0,
'website' => '',
'avatar' => Config::$images['avatarsPath'].'default.png',
'remember' => $this->validationString,
'admin' => 0,
'email' => $_POST['email'],
'color' => '0',
'style' => 'black',
'invite' => $inviteC
));
if($inviteC != false){
$lastid= DB::getRow("SELECT LAST_INSERT_ID() as id");
DB::updateRow("pl_invites",array("code"=>$inviteC),array("used"=>1,"usedby"=>$lastid["id"]));
}
DB::insertRow( "pl_registerlock", array("ip"=>$_SERVER['REMOTE_ADDR'],"created"=>date('Y-m-d H:i:s')));
if( Config::$vbbIntegration['enabled'] ) {
global $vbulletin;
$forum = new ForumOps($vbulletin);
$user['name'] = $_POST['name'];
$user['pass'] = $_POST['pass'];
$user['email'] = $_POST['email'];
echo $forum->register_newuser($user, false);
}
$mail = file_get_contents( Config::$templates.'registrationmail.txt' );
preg_match( '/From: (?<from>.*?)\r?\nSubject: (?<subject>.*?)\r?\n\r?\n(?<text>.*)/sim', $mail, $mail );
$mail['text'] = str_replace( '%validationString%', $this->validationString, $mail['text'] );
$mail['text'] = str_replace( '%siteName%', Config::$siteName, $mail['text'] );
$mail['text'] = str_replace( '%frontendPath%', Config::$frontendPath, $mail['text'] );
$mail['text'] = str_replace( '%userName%', $_POST['name'], $mail['text'] );
$mail['subject'] = str_replace( '%siteName%', Config::$siteName, $mail['subject'] );
$mail['subject'] = str_replace( '%userName%', $_POST['name'], $mail['subject'] );
//mail( $_POST['email'], $mail['subject'], $mail['text'], 'FROM: '.$mail['from'] );
mail($_POST['email'],$mail['subject'],$mail['text'],"FROM:".$mail['from']);
return true;
}
}
?>
View Git Blame Copy Permalink