profile.php

<?php

include_once('internal/Smarty.class.php');
$main_smarty = new Smarty;

include('config.php');
include(mnminclude.'html1.php');
include(mnminclude.'link.php');
include(mnminclude.'tags.php');
include(mnminclude.'user.php');
include(mnminclude.'csrf.php');
include(mnminclude.'smartyvariables.php');

#ini_set('display_errors', 1);
error_reporting(E_ALL ^ E_NOTICE);

check_referrer();

// sessions used to prevent CSRF
    $CSRF = new csrf();

// sidebar
$main_smarty = do_sidebar($main_smarty);

$canIhaveAccess = ($_GET['login'] == $current_user->user_login);
$canIhaveAccess = $canIhaveAccess + checklevel('admin');
$canIhaveAccess = $canIhaveAccess + checklevel('moderator');

// If not logged in, redirect to the index page
if ($_GET['login'] && $canIhaveAccess) {
    $login = $_GET['login'];
} elseif ($current_user->user_id > 0 && $current_user->authenticated) {
    $login = $current_user->user_login;
    if ($_GET['avatar'] != 'edit') {
        header("Location: $my_base_url$my_pligg_base/user/$login/edit/");
    }
} else {
    //header('Location: '.$my_base_url.$my_pligg_base);
    //die;
    $myname = $my_base_url.$my_pligg_base;
}

// breadcrumbs and page title
$navwhere['text1'] = $main_smarty->get_config_vars('PLIGG_Visual_Breadcrumb_Profile');
$navwhere['link1'] = getmyurl('user2', $login, 'profile');
$navwhere['text2'] = $login;
$navwhere['link2'] = getmyurl('user2', $login, 'profile');
$navwhere['text3'] = $main_smarty->get_config_vars('PLIGG_Visual_Profile_ModifyProfile');
$navwhere['link3'] = getmyurl('profile', '');
$main_smarty->assign('navbar_where', $navwhere);
$main_smarty->assign('posttitle', $main_smarty->get_config_vars('PLIGG_Visual_Profile_ModifyProfile'));

// read the users information from the database
$user = new User();
$user->username = $login;
if (!$user->read()) {
    header('Location: '.$my_base_url.$my_pligg_base);
    die;
}

// setup the links
$main_smarty->assign('user_url_personal_data2', getmyurl('user2', $login));
$main_smarty->assign('user_url_news_sent2', getmyurl('user2', $login, 'history'));
$main_smarty->assign('user_url_news_published2', getmyurl('user2', $login, 'published'));
$main_smarty->assign('user_url_news_unpublished2', getmyurl('user2', $login, 'new'));
$main_smarty->assign('user_url_news_voted2', getmyurl('user2', $login, 'voted'));
$main_smarty->assign('user_url_news_upvoted2', getmyurl('user2', $login, 'upvoted'));
$main_smarty->assign('user_url_news_downvoted2', getmyurl('user2', $login, 'downvoted'));
$main_smarty->assign('user_url_commented2', getmyurl('user2', $login, 'commented'));
$main_smarty->assign('user_url_saved2', getmyurl('user2', $login, 'saved'));
$main_smarty->assign('user_url_friends', getmyurl('user_friends', $login, 'following'));
$main_smarty->assign('user_url_friends2', getmyurl('user_friends', $login, 'followers'));
$main_smarty->assign('user_url_add', getmyurl('user_friends', $login, 'addfriend'));
$main_smarty->assign('user_url_remove', getmyurl('user_friends', $login, 'removefriend'));
$main_smarty->assign('user_rss', getmyurl('rssuser', $login));
$main_smarty->assign('URL_Profile2', getmyurl('user_edit', $login));
$main_smarty->assign('form_action', getmyurl('profile'));
$main_smarty->assign('user_url_member_groups', getmyurl('user2', $login, 'member_groups	'));

$main_smarty->assign('user_followers', $user->getFollowersCount());
$main_smarty->assign('user_following', $user->getFollowingCount());

    // uploading avatar
    if (isset($_POST["avatar"]) && sanitize($_POST["avatar"], 3) == "uploaded" && Enable_User_Upload_Avatar == true) {
        if ($CSRF->check_valid(sanitize($_POST['token'], 3), 'profile_change')) {
            $user_image_path = "avatars/user_uploaded"."/";
            $user_image_apath = "/".$user_image_path;
            $allowedFileTypes = array("image/jpeg","image/gif","image/png",'image/x-png','image/pjpeg');
            unset($imagename);

            $myfile = $_FILES['image_file']['name'];
            $imagename = basename($myfile);

            $mytmpfile = $_FILES['image_file']['tmp_name'];

            if (!in_array($_FILES['image_file']['type'], $allowedFileTypes)) {
                $error['Type'] = 'Only these file types are allowed : jpeg, gif, png';
            }

            if (empty($error)) {
                $imagesize = getimagesize($mytmpfile);
                $width = $imagesize[0];
                $height = $imagesize[1];

                $imagename = $user->id."_original.jpg";

                $newimage = $user_image_path.$imagename ;

                $result = move_uploaded_file($_FILES['image_file']['tmp_name'], $newimage);
                if (empty($result)) {
                    $error["result"] = "There was an error moving the uploaded file.";
                }
            }

            // create large avatar
            include mnminclude."class.pThumb.php";
            $img = new pThumb();
            $img->pSetSize(Avatar_Large, Avatar_Large);
            $img->pSetQuality(100);
            $img->pCreate($newimage);
            $img->pSave($user_image_path.$user->id."_".Avatar_Large.".jpg");
            $img = "";

            // create small avatar
            $img = new pThumb();
            $img->pSetSize(Avatar_Small, Avatar_Small);
            $img->pSetQuality(100);
            $img->pCreate($newimage);
            $img->pSave($user_image_path.$user->id."_".Avatar_Small.".jpg");
            $img = "";

            $db->query($sql = "UPDATE ".table_users." SET user_avatar_source='useruploaded' WHERE user_id='$user->id'");
            unset($cached_users[$user->id]);
        } else {
            echo 'An error occured while uploading your avatar.';
        }
    }

    if (isset($error) && is_array($error)) {
        while (list($key, $val) = each($error)) {
            echo $val;
            echo "<br>";
        }
    }

// Save changes
if (isset($_POST['email'])) {
    $savemsg = save_profile();

    if (is_string($savemsg)) {
        $main_smarty->assign('savemsg', $savemsg);
    } else {
        $save_message_text = $main_smarty->get_config_vars("PLIGG_Visual_Profile_DataUpdated");
        if ($savemsg['username'] == 1) {
            $save_message_text .= "<br/>".$main_smarty->get_config_vars("PLIGG_Visual_Profile_UsernameUpdated");
        }
        if ($savemsg['pass'] == 1) {
            $save_message_text .= "<br/>".$main_smarty->get_config_vars("PLIGG_Visual_Profile_PassUpdated");
        }

        // Reload the page if no error
        $_SESSION['savemsg'] = $save_message_text;
        header("Location: ".getmyurl('user_edit', $login));
        exit;
    }
} else {
    // Show "Profile Updated" message on reload
    $main_smarty->assign('savemsg', $_SESSION['savemsg']);
    unset($_SESSION['savemsg']);
}

// display profile
show_profile();

function show_profile()
{
    global $user, $main_smarty, $the_template, $CSRF, $db;

    $CSRF->create('profile_change', true, true);

    // assign avatar source to smarty
    $main_smarty->assign('UseAvatars', do_we_use_avatars());
    $main_smarty->assign('Avatar', $avatars = get_avatar('all', '', $user->username, $user->email));
    $main_smarty->assign('Avatar_ImgLarge', $avatars['large']);
    $main_smarty->assign('Avatar_ImgSmall', $avatars['small']);

    // module system hook
    $vars = '';
    check_actions('profile_show', $vars);

    // assign profile information to smarty
    $main_smarty->assign('user_id', $user->id);
    $main_smarty->assign('user_email', $user->email);
    $main_smarty->assign('user_login', $user->username);
    $main_smarty->assign('user_names', $user->names);
    $main_smarty->assign('user_username', $user->username);
    $main_smarty->assign('userlevel', $user->level);
    $main_smarty->assign('user_url', $user->url);
    $main_smarty->assign('user_publicemail', $user->public_email);
    $main_smarty->assign('user_location', $user->location);
    $main_smarty->assign('user_occupation', $user->occupation);
    $main_smarty->assign('user_facebook', $user->facebook);
    $main_smarty->assign('user_twitter', $user->twitter);
    $main_smarty->assign('user_linkedin', $user->linkedin);
    $main_smarty->assign('user_googleplus', $user->googleplus);
    $main_smarty->assign('user_skype', $user->skype);
    $main_smarty->assign('user_pinterest', $user->pinterest);
    $main_smarty->assign('user_karma', $user->karma);
    $main_smarty->assign('user_joined', get_date($user->date));
    $main_smarty->assign('user_avatar_source', $user->avatar_source);
    $user->all_stats();
    $main_smarty->assign('user_total_links', $user->total_links);
    $main_smarty->assign('user_published_links', $user->published_links);
    $main_smarty->assign('user_total_comments', $user->total_comments);
    $main_smarty->assign('user_total_votes', $user->total_votes);
    $main_smarty->assign('user_published_votes', $user->published_votes);
    $main_smarty->assign('user_biographie', $user->biographie);

    // If the user language setting is NULL, present the site's default language file
    $main_smarty->assign('user_language', !empty($user->language) ? $user->language : pligg_language);

    $languages = array();
    $files = glob("languages/*.conf");
    foreach ($files as $file) {
        if (preg_match('/lang_(.+?)\.conf/', $file, $m)) {
            $languages[] = $m[1];
        }
    }
    $main_smarty->assign('languages', $languages);

    // pagename
    define('pagename', 'user_edit');
    $main_smarty->assign('pagename', pagename);

    $main_smarty->assign('form_action', $_SERVER["PHP_SELF"]);

    // User Settings
    $user_categories = explode(",", $user->extra_field['user_categories']);

    $categorysql = "SELECT * FROM ".table_categories." where category__auto_id!='0' ";
    $results = $db->get_results($categorysql);
    $results = object_2_array($results);
    $category = array();
    foreach ($results as $key => $val) {
        $category[] = $val['category_name'];
    }

#	$sor = $_GET['err'];
#	if($sor == 1)
#	{
#		$err = "You have to select at least 1 category";
#		$main_smarty->assign('err', $err);
#	}

    $main_smarty->assign('category', $results);
    $main_smarty->assign('user_category', $user_categories);
    $main_smarty->assign('view_href', 'submitted');

    if (Allow_User_Change_Templates) {
        $dir = "templates";
        $templates = array();
        foreach (scandir($dir) as $file) {
            if (strstr($file, ".") !== 0 && file_exists("$dir/$file/header.tpl")) {
                $templates[] = $file;
            }
        }
        $main_smarty->assign('templates', $templates);
        $main_smarty->assign('current_template', sanitize($_COOKIE['template'], 3));
        $main_smarty->assign('Allow_User_Change_Templates', Allow_User_Change_Templates);
    }

    // show the template
    $main_smarty->assign('tpl_center', $the_template.'/user_settings_center');
    $main_smarty->display($the_template.'/pligg.tpl');
}

function save_profile()
{
    global $user, $current_user, $db, $main_smarty, $CSRF, $canIhaveAccess, $language;



    if ($CSRF->check_valid(sanitize($_POST['token'], 3), 'profile_change')) {
        if (!isset($_POST['save_profile']) || !$_POST['process'] || (!$canIhaveAccess && sanitize($_POST['user_id'], 3) != $current_user->user_id)) {
            return;
        }

        if ($user->email != sanitize($_POST['email'], 3)) {
            if (!check_email(sanitize($_POST['email'], 3))) {
                $savemsg = $main_smarty->get_config_vars("PLIGG_Visual_Profile_BadEmail");
                return $savemsg;
            } elseif (email_exists(trim(sanitize($_POST['email'], 3)))) { // if email already exists
            $savemsg = $main_smarty->get_config_vars("PLIGG_Visual_Register_Error_EmailExists");
                return $savemsg;
            } else {
                if (pligg_validate()) {
                    $encode = md5($_POST['email'].$user->karma.$user->username.pligg_hash().$main_smarty->get_config_vars('PLIGG_Visual_Name'));

                    $domain = $main_smarty->get_config_vars('PLIGG_Visual_Name');
                    $validation = my_base_url.my_pligg_base."/validation.php?code=$encode&uid=".urlencode($user->username)."&email=".urlencode($_POST['email']);
                    $str = $main_smarty->get_config_vars('PLIGG_PassEmail_verification_message');
                    eval('$str = "'.str_replace('"', '\"', $str).'";');
                    $message = "$str";

                    if (phpnum() >= 5) {
                        require("libs/class.phpmailer5.php");
                    } else {
                        require("libs/class.phpmailer4.php");
                    }
                    $mail = new PHPMailer();
                    $mail->From = $main_smarty->get_config_vars('PLIGG_PassEmail_From');
                    $mail->FromName = $main_smarty->get_config_vars('PLIGG_PassEmail_Name');
                    $mail->AddAddress($_POST['email']);
                    $mail->AddReplyTo($main_smarty->get_config_vars('PLIGG_PassEmail_From'));
                    $mail->IsHTML(false);
                    $mail->Subject = $main_smarty->get_config_vars('PLIGG_PassEmail_Subject_verification');
                    $mail->Body = $message;
                    $mail->CharSet = 'utf-8';

#print_r($mail);
                if (!$mail->Send()) {
                    return false;
                }
                    $savemsg = $main_smarty->get_config_vars("PLIGG_Visual_Register_Noemail").' '.sprintf($main_smarty->get_config_vars("PLIGG_Visual_Register_ToDo"), $main_smarty->get_config_vars('PLIGG_PassEmail_From'));
                } else {
                    $user->email = sanitize($_POST['email'], 2);
                }
            }
        }

        // User settings
        if (Allow_User_Change_Templates && file_exists("./templates/".$_POST['template']."/header.tpl")) {
            $domain = $_SERVER['HTTP_HOST'] == 'localhost' ? '' : preg_replace('/^www/', '', $_SERVER['HTTP_HOST']);
            setcookie("template", $_POST['template'], time()+60*60*24*30, '/', $domain);
        }

        $sqlGetiCategory = "SELECT category__auto_id from ".table_categories." where category__auto_id!= 0;";
        $sqlGetiCategoryQ = mysql_query($sqlGetiCategory);
        $arr = array();
        while ($row = mysql_fetch_array($sqlGetiCategoryQ, MYSQL_NUM)) {
            $arr[] = $row[0];
        }

        $select_check = $_POST['chack'];
        if (!$select_check) {
            $select_check = array();
        }
        $diff = array_diff($arr, $select_check);
        $select_checked = $db->escape(implode(",", $diff));

        $sql = "UPDATE ".table_users." set user_categories='$select_checked' WHERE user_id = '{$user->id}'";
        $query = mysql_query($sql);
        /////

        // Santizie user input
        $user->url = sanitize($_POST['url'], 2);
        $user->public_email = sanitize($_POST['public_email'], 2);
        $user->location = sanitize($_POST['location'], 2);
        $user->occupation = sanitize($_POST['occupation'], 2);
        $user->facebook = sanitize($_POST['facebook'], 2);
        $user->twitter = sanitize($_POST['twitter'], 2);
        $user->linkedin = sanitize($_POST['linkedin'], 2);
        $user->googleplus = sanitize($_POST['googleplus'], 2);
        $user->skype = sanitize($_POST['skype'], 2);
        $user->pinterest = sanitize($_POST['pinterest'], 2);
        $user->names = sanitize($_POST['names'], 2);
        if (user_language) {
            $user->language = sanitize($_POST['language'], 2);
        }

        // Convert user input social URLs to username values
        $facebookUrl = $user->facebook;
        preg_match("/https?:\/\/(www\.)?facebook\.com\/([^\/]*)/", $facebookUrl, $matches);
        if ($matches) {
            $user->facebook = $matches[2];
        }
        $twitterUrl = $user->twitter;
        preg_match("/https?:\/\/(www\.)?twitter\.com\/(#!\/)?@?([^\/]*)/", $twitterUrl, $matches);
        if ($matches) {
            $user->twitter = $matches[3];
        }
        $linkedinUrl = $user->linkedin;
        preg_match("/https?:\/\/(www\.)?linkedin\.com\/in\/([^\/]*)/", $linkedinUrl, $matches);
        if ($matches) {
            $user->linkedin = $matches[2];
        }
        $googleplusUrl = $user->googleplus;
        preg_match("/https?:\/\/plus\.google\.com\/([^\/]*)/", $googleplusUrl, $matches);
        if ($matches) {
            $user->googleplus = $matches[1];
        }
        $pinterestUrl = $user->pinterest;
        preg_match("/https?:\/\/(www\.)?pinterest\.com\/([^\/]*)/", $pinterestUrl, $matches);
        if ($matches) {
            $user->pinterest = $matches[2];
        }

        // module system hook
        $vars = '';
        check_actions('profile_save', $vars);

/*		$avatar_source = sanitize($_POST['avatarsource'], 2);
        if($avatar_source != "" && $avatar_source != "useruploaded"){
            loghack('Updating profile, avatar source is not one of the list options.', 'username: ' . sanitize($_POST["username"], 3) . '|email: ' . sanitize($_POST["email"], 3));
            $avatar_source == "";
        }
        $user->avatar_source=$avatar_source;
*/
      if ($user->level == "admin" || $user->level == "moderator") {
          if ($user->username != sanitize($_POST['user_login'], 3)) {
              $user_login = sanitize($_POST['user_login'], 2);

              if (preg_match('/\pL/u', 'a')) {    // Check if PCRE was compiled with UTF-8 support
            if (!preg_match('/^[_\-\d\p{L}\p{M}]+$/iu', $user_login)) { // if username contains invalid characters
            $savemsg = $main_smarty->get_config_vars('PLIGG_Visual_Register_Error_UserInvalid');
                return $savemsg;
            }
              } else {
                  if (!preg_match('/^[^~`@%&=\\/;:\\.,<>!"\\\'\\^\\.\\[\\]\\$\\(\\)\\|\\*\\+\\-\\?\\{\\}\\\\]+$/', $user_login)) {
                      $savemsg = $main_smarty->get_config_vars('PLIGG_Visual_Register_Error_UserInvalid');
                      return $savemsg;
                  }
              }


              if (user_exists(trim($user_login))) {
                  $savemsg = $main_smarty->get_config_vars("PLIGG_Visual_Register_Error_UserExists");
                  $user->username = $user_login;
                  return $savemsg;
              } else {
                  $user->username = $user_login;
                  $saved['username'] = 1;
              }
          }
      }

        if (!empty($_POST['newpassword']) || !empty($_POST['newpassword2'])) {
            $oldpass = sanitize($_POST['oldpassword'], 2);
            $userX = $db->get_row("SELECT user_id, user_pass, user_login FROM ".table_users." WHERE user_login = '".$user->username."'");
            $saltedpass = generateHash($oldpass, substr($userX->user_pass, 0, SALT_LENGTH));
            if ($userX->user_pass == $saltedpass) {
                if (sanitize($_POST['newpassword'], 3) !== sanitize($_POST['newpassword2'], 3)) {
                    $savemsg = $main_smarty->get_config_vars("PLIGG_Visual_Profile_BadPass");
                    return $savemsg;
                } else {
                    $saltedpass = generateHash(sanitize($_POST['newpassword'], 3));
                    $user->pass = $saltedpass;
                    $saved['pass'] = 1;
                }
            } else {
                $savemsg = $main_smarty->get_config_vars("PLIGG_Visual_Profile_BadOldPass");
                return $savemsg;
            }
        }

        $user->biographie = htmlspecialchars($_POST['newbiographie']);
        $user->store();
        $user->read();
        if ($saved['pass'] == 1 || $saved['username'] == 1) {
            $current_user->Authenticate($user->username, $user->pass, false, $user->pass);
        } else {
            $current_user->Authenticate($user->username, $user->pass);
            $saved['profile'] = 1;
        }
        return $saved;
    } else {
        return 'There was a token error.';
    }
}