ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: home / sudairsocs / www / forum_ancien / Sources

<?php

/**
 * Simple Machines Forum (SMF)
 *
 * @package SMF
 * @author Simple Machines http://www.simplemachines.org
 * @copyright 2011 Simple Machines
 * @license http://www.simplemachines.org/about/smf/license.php BSD
 *
 * @version 2.0.4
 */

if (!defined('SMF'))
	die('Hacking attempt...');

/*	This file deals with sending out reminders, and checking the secret answer
	and question.  It uses just a few functions to do this, which are:

void RemindMe()
		- this is just the controlling delegator.
		- uses the Profile language files and Reminder template.

void RemindMail()
		// !!!

void setPassword()
		// !!!

void setPassword2()
		// !!!

void SecretAnswerInput()
		// !!!

void SecretAnswer2()
		// !!!
*/

// Forgot 'yer password?
function RemindMe()
{
	global $txt, $context;

loadLanguage('Profile');
	loadTemplate('Reminder');

$context['page_title'] = $txt['authentication_reminder'];
	$context['robot_no_index'] = true;

// Delegation can be useful sometimes.
	$subActions = array(
		'picktype' => 'RemindPick',
		'secret2' => 'SecretAnswer2',
		'setpassword' =>'setPassword',
		'setpassword2' =>'setPassword2'
	);

// Any subaction?  If none, fall through to the main template, which will ask for one.
	if (isset($_REQUEST['sa']) && isset($subActions[$_REQUEST['sa']]))
		$subActions[$_REQUEST['sa']]();
}

// Pick a reminder type.
function RemindPick()
{
	global $context, $txt, $scripturl, $sourcedir, $user_info, $webmaster_email, $smcFunc, $language, $modSettings;

checkSession();

// Coming with a known ID?
	if (!empty($_REQUEST['uid']))
	{
		$where = 'id_member = {int:id_member}';
		$where_params['id_member'] = (int) $_REQUEST['uid'];
	}
	elseif (isset($_POST['user']) && $_POST['user'] != '')
	{
		$where = 'member_name = {string:member_name}';
		$where_params['member_name'] = $_POST['user'];
		$where_params['email_address'] = $_POST['user'];
	}

// You must enter a username/email address.
	if (empty($where))
		fatal_lang_error('username_no_exist', false);

// Find the user!
	$request = $smcFunc['db_query']('', '
		SELECT id_member, real_name, member_name, email_address, is_activated, validation_code, lngfile, openid_uri, secret_question
		FROM {db_prefix}members
		WHERE ' . $where . '
		LIMIT 1',
		array_merge($where_params, array(
		))
	);
	// Maybe email?
	if ($smcFunc['db_num_rows']($request) == 0 && empty($_REQUEST['uid']))
	{
		$smcFunc['db_free_result']($request);

$request = $smcFunc['db_query']('', '
			SELECT id_member, real_name, member_name, email_address, is_activated, validation_code, lngfile, openid_uri, secret_question
			FROM {db_prefix}members
			WHERE email_address = {string:email_address}
			LIMIT 1',
			array_merge($where_params, array(
			))
		);
		if ($smcFunc['db_num_rows']($request) == 0)
			fatal_lang_error('no_user_with_email', false);
	}

$row = $smcFunc['db_fetch_assoc']($request);
	$smcFunc['db_free_result']($request);

$context['account_type'] = !empty($row['openid_uri']) ? 'openid' : 'password';

// If the user isn't activated/approved, give them some feedback on what to do next.
	if ($row['is_activated'] != 1)
	{
		// Awaiting approval...
		if (trim($row['validation_code']) == '')
			fatal_error($txt['registration_not_approved'] . ' <a href="' . $scripturl . '?action=activate;user=' . $_POST['user'] . '">' . $txt['here'] . '</a>.', false);
		else
			fatal_error($txt['registration_not_activated'] . ' <a href="' . $scripturl . '?action=activate;user=' . $_POST['user'] . '">' . $txt['here'] . '</a>.', false);
	}

// You can't get emailed if you have no email address.
	$row['email_address'] = trim($row['email_address']);
	if ($row['email_address'] == '')
		fatal_error($txt['no_reminder_email'] . '<br />' . $txt['send_email'] . ' <a href="mailto:' . $webmaster_email . '">webmaster</a> ' . $txt['to_ask_password'] . '.');

// If they have no secret question then they can only get emailed the item, or they are requesting the email, send them an email.
	if (empty($row['secret_question']) || (isset($_POST['reminder_type']) && $_POST['reminder_type'] == 'email'))
	{
		// Randomly generate a new password, with only alpha numeric characters that is a max length of 10 chars.
		require_once($sourcedir . '/Subs-Members.php');
		$password = generateValidationCode();

require_once($sourcedir . '/Subs-Post.php');
		$replacements = array(
			'REALNAME' => $row['real_name'],
			'REMINDLINK' => $scripturl . '?action=reminder;sa=setpassword;u=' . $row['id_member'] . ';code=' . $password,
			'IP' => $user_info['ip'],
			'MEMBERNAME' => $row['member_name'],
			'OPENID' => $row['openid_uri'],
		);

$emaildata = loadEmailTemplate('forgot_' . $context['account_type'], $replacements, empty($row['lngfile']) || empty($modSettings['userLanguage']) ? $language : $row['lngfile']);
		$context['description'] = $txt['reminder_' . (!empty($row['openid_uri']) ? 'openid_' : '') . 'sent'];

// If they were using OpenID simply email them their OpenID identity.
		sendmail($row['email_address'], $emaildata['subject'], $emaildata['body'], null, null, false, 0);
		if (empty($row['openid_uri']))
			// Set the password in the database.
			updateMemberData($row['id_member'], array('validation_code' => substr(md5($password), 0, 10)));

// Set up the template.
		$context['sub_template'] = 'sent';

// Dont really.
		return;
	}
	// Otherwise are ready to answer the question?
	elseif (isset($_POST['reminder_type']) && $_POST['reminder_type'] == 'secret')
	{
		return SecretAnswerInput();
	}

// No we're here setup the context for template number 2!
	$context['sub_template'] = 'reminder_pick';
	$context['current_member'] = array(
		'id' => $row['id_member'],
		'name' => $row['member_name'],
	);
}

// Set your new password
function setPassword()
{
	global $txt, $context;

loadLanguage('Login');

// You need a code!
	if (!isset($_REQUEST['code']))
		fatal_lang_error('no_access', false);

// Fill the context array.
	$context += array(
		'page_title' => $txt['reminder_set_password'],
		'sub_template' => 'set_password',
		'code' => $_REQUEST['code'],
		'memID' => (int) $_REQUEST['u']
	);
}

function setPassword2()
{
	global $context, $txt, $modSettings, $smcFunc, $sourcedir;

checkSession();

if (empty($_POST['u']) || !isset($_POST['passwrd1']) || !isset($_POST['passwrd2']))
		fatal_lang_error('no_access', false);

$_POST['u'] = (int) $_POST['u'];

if ($_POST['passwrd1'] != $_POST['passwrd2'])
		fatal_lang_error('passwords_dont_match', false);

if ($_POST['passwrd1'] == '')
		fatal_lang_error('no_password', false);

loadLanguage('Login');

// Get the code as it should be from the database.
	$request = $smcFunc['db_query']('', '
		SELECT validation_code, member_name, email_address, passwd_flood
		FROM {db_prefix}members
		WHERE id_member = {int:id_member}
			AND is_activated = {int:is_activated}
			AND validation_code != {string:blank_string}
		LIMIT 1',
		array(
			'id_member' => $_POST['u'],
			'is_activated' => 1,
			'blank_string' => '',
		)
	);

// Does this user exist at all?
	if ($smcFunc['db_num_rows']($request) == 0)
		fatal_lang_error('invalid_userid', false);

list ($realCode, $username, $email, $flood_value) = $smcFunc['db_fetch_row']($request);
	$smcFunc['db_free_result']($request);

// Is the password actually valid?
	require_once($sourcedir . '/Subs-Auth.php');
	$passwordError = validatePassword($_POST['passwrd1'], $username, array($email));

// What - it's not?
	if ($passwordError != null)
		fatal_lang_error('profile_error_password_' . $passwordError, false);

require_once($sourcedir . '/LogInOut.php');

// Quit if this code is not right.
	if (empty($_POST['code']) || substr($realCode, 0, 10) !== substr(md5($_POST['code']), 0, 10))
	{
		// Stop brute force attacks like this.
		validatePasswordFlood($_POST['u'], $flood_value, false);

fatal_error($txt['invalid_activation_code'], false);
	}

// Just in case, flood control.
	validatePasswordFlood($_POST['u'], $flood_value, true);

// User validated.  Update the database!
	updateMemberData($_POST['u'], array('validation_code' => '', 'passwd' => sha1(strtolower($username) . $_POST['passwrd1'])));

call_integration_hook('integrate_reset_pass', array($username, $username, $_POST['passwrd1']));

loadTemplate('Login');
	$context += array(
		'page_title' => $txt['reminder_password_set'],
		'sub_template' => 'login',
		'default_username' => $username,
		'default_password' => $_POST['passwrd1'],
		'never_expire' => false,
		'description' => $txt['reminder_password_set']
	);
}

// Get the secret answer.
function SecretAnswerInput()
{
	global $txt, $context, $smcFunc;

checkSession();

// Strings for the register auto javascript clever stuffy wuffy.
	loadLanguage('Login');

// Check they entered something...
	if (empty($_REQUEST['uid']))
		fatal_lang_error('username_no_exist', false);

// Get the stuff....
	$request = $smcFunc['db_query']('', '
		SELECT id_member, real_name, member_name, secret_question, openid_uri
		FROM {db_prefix}members
		WHERE id_member = {int:id_member}
		LIMIT 1',
		array(
			'id_member' => (int) $_REQUEST['uid'],
		)
	);
	if ($smcFunc['db_num_rows']($request) == 0)
		fatal_lang_error('username_no_exist', false);

$row = $smcFunc['db_fetch_assoc']($request);
	$smcFunc['db_free_result']($request);

$context['account_type'] = !empty($row['openid_uri']) ? 'openid' : 'password';

// If there is NO secret question - then throw an error.
	if (trim($row['secret_question']) == '')
		fatal_lang_error('registration_no_secret_question', false);

// Ask for the answer...
	$context['remind_user'] = $row['id_member'];
	$context['remind_type'] = '';
	$context['secret_question'] = $row['secret_question'];

$context['sub_template'] = 'ask';
}

function SecretAnswer2()
{
	global $txt, $context, $modSettings, $smcFunc, $sourcedir;

checkSession();

// Hacker?  How did you get this far without an email or username?
	if (empty($_REQUEST['uid']))
		fatal_lang_error('username_no_exist', false);

loadLanguage('Login');

// Get the information from the database.
	$request = $smcFunc['db_query']('', '
		SELECT id_member, real_name, member_name, secret_answer, secret_question, openid_uri, email_address
		FROM {db_prefix}members
		WHERE id_member = {int:id_member}
		LIMIT 1',
		array(
			'id_member' => $_REQUEST['uid'],
		)
	);
	if ($smcFunc['db_num_rows']($request) == 0)
		fatal_lang_error('username_no_exist', false);

$row = $smcFunc['db_fetch_assoc']($request);
	$smcFunc['db_free_result']($request);

// Check if the secret answer is correct.
	if ($row['secret_question'] == '' || $row['secret_answer'] == '' || md5($_POST['secret_answer']) != $row['secret_answer'])
	{
		log_error(sprintf($txt['reminder_error'], $row['member_name']), 'user');
		fatal_lang_error('incorrect_answer', false);
	}

// If it's OpenID this is where the music ends.
	if (!empty($row['openid_uri']))
	{
		$context['sub_template'] = 'sent';
		$context['description'] = sprintf($txt['reminder_openid_is'], $row['openid_uri']);
		return;
	}

// You can't use a blank one!
	if (strlen(trim($_POST['passwrd1'])) === 0)
		fatal_lang_error('no_password', false);

// They have to be the same too.
	if ($_POST['passwrd1'] != $_POST['passwrd2'])
		fatal_lang_error('passwords_dont_match', false);

// Make sure they have a strong enough password.
	require_once($sourcedir . '/Subs-Auth.php');
	$passwordError = validatePassword($_POST['passwrd1'], $row['member_name'], array($row['email_address']));

// Invalid?
	if ($passwordError != null)
		fatal_lang_error('profile_error_password_' . $passwordError, false);

// Alright, so long as 'yer sure.
	updateMemberData($row['id_member'], array('passwd' => sha1(strtolower($row['member_name']) . $_POST['passwrd1'])));

call_integration_hook('integrate_reset_pass', array($row['member_name'], $row['member_name'], $_POST['passwrd1']));

// Tell them it went fine.
	loadTemplate('Login');
	$context += array(
		'page_title' => $txt['reminder_password_set'],
		'sub_template' => 'login',
		'default_username' => $row['member_name'],
		'default_password' => $_POST['passwrd1'],
		'never_expire' => false,
		'description' => $txt['reminder_password_set']
	);
}

[+] ..
[-] DbSearch-sqlite.php [edit]
[-] ManagePosts.php [edit]
[-] Subs-Db-sqlite.php [edit]
[-] PostModeration.php [edit]
[-] Subs-BoardIndex.php [edit]
[-] Packages.php [edit]
[-] ManageSmileys.php [edit]
[-] Subs-Aeva-Generated-Sites.php [edit]
[-] Poll.php [edit]
[-] ModerationCenter.php [edit]
[-] ManageSearch.php [edit]
[-] MoveTopic.php [edit]
[-] ManagePaid.php [edit]
[-] Subs-Admin.php [edit]
[-] Profile-View.php [edit]
[-] LockTopic.php [edit]
[-] RepairBoards.php [edit]
[-] Post.php [edit]
[-] Subs-Aeva-Sites.php [edit]
[-] Subs-MessageIndex.php [edit]
[-] DbPackages-sqlite.php [edit]
[-] ManageScheduledTasks.php [edit]
[+] downloads
[-] Subs-Categories.php [edit]
[-] DbExtra-sqlite.php [edit]
[-] Subs-Menu.php [edit]
[-] SearchAPI-Standard.php [edit]
[-] Notify.php [edit]
[-] Register.php [edit]
[-] Subs-Compat.php [edit]
[-] Who.php [edit]
[-] ManageServer.php [edit]
[-] PersonalMessage.php [edit]
[-] Karma.php [edit]
[-] DbExtra-mysql.php [edit]
[-] Profile-Actions.php [edit]
[-] DbSearch-postgresql.php [edit]
[-] ManageSettings.php [edit]
[-] ManageErrors.php [edit]
[-] Modlog.php [edit]
[-] Subs-Membergroups.php [edit]
[-] ManageAttachments.php [edit]
[-] Groups.php [edit]
[-] Profile-Modify.php [edit]
[-] SendTopic.php [edit]
[-] Subs-SimpleColorizer.php [edit]
[-] DbExtra-postgresql.php [edit]
[-] Load.php [edit]
[-] ManageCalendar.php [edit]
[-] BoardIndex.php [edit]
[-] Subs-Members.php [edit]
[-] Subs-Post.php [edit]
[-] Printpage.php [edit]
[-] ManageBoards.php [edit]
[-] RemoveTopic.php [edit]
[-] index.php [edit]
[-] Subs-Package.php [edit]
[-] DumpDatabase.php [edit]
[-] Themes.php [edit]
[-] QueryString.php [edit]
[-] ManageBans.php [edit]
[-] Calendar.php [edit]
[-] Subs-Db-postgresql.php [edit]
[-] ManageRegistration.php [edit]
[-] Stats.php [edit]
[-] DbPackages-mysql.php [edit]
[-] Subs-Calendar.php [edit]
[-] Subs-Graphics.php [edit]
[-] DbPackages-postgresql.php [edit]
[-] Security.php [edit]
[-] SplitTopics.php [edit]
[-] SearchAPI-Custom.php [edit]
[-] ScheduledTasks.php [edit]
[-] Subs-Aeva.php [edit]
[-] News.php [edit]
[-] Subs-Aeva-Admin.php [edit]
[-] Display.php [edit]
[-] ManageMembers.php [edit]
[-] Subs-Db-mysql.php [edit]
[-] PackageGet.php [edit]
[-] Class-Package.php [edit]
[-] Subs-Charset.php [edit]
[-] Xml.php [edit]
[-] ManageMaintenance.php [edit]
[-] Admin.php [edit]
[-] Subs-OpenID.php [edit]
[-] Search.php [edit]
[-] Profile.php [edit]
[-] Subs.php [edit]
[-] Subs-Sound.php [edit]
[-] Class-CurlFetchWeb.php [edit]
[-] Reports.php [edit]
[-] Subs-List.php [edit]
[-] Subscriptions-PayPal.php [edit]
[-] Subs-Aeva-Custom-Example.php [edit]
[-] ManageNews.php [edit]
[-] Memberlist.php [edit]
[-] Subs-Recent.php [edit]
[-] SearchAPI-Fulltext.php [edit]
[-] Class-Graphics.php [edit]
[-] MessageIndex.php [edit]
[-] ViewQuery.php [edit]
[-] ManageSearchEngines.php [edit]
[-] ManageMail.php [edit]
[-] DbSearch-mysql.php [edit]
[-] Subs-MembersOnline.php [edit]
[-] Help.php [edit]
[-] Subs-Auth.php [edit]
[-] passwdBoard.php [edit]
[-] Subs-Boards.php [edit]
[-] ManagePermissions.php [edit]
[-] Reminder.php [edit]
[-] Errors.php [edit]
[-] LogInOut.php [edit]
[-] Subs-Editor.php [edit]
[-] Recent.php [edit]
[-] ManageMembergroups.php [edit]