<?php
// ======================================================================== //
//                                                                          //
//   KooBI- Webportalsystem                                                 //
//   SCRiPTMAFiA 2005 - THE DiRTY HANDS ON YOUR SCRiPTS                     //
//                                                                          //
//   ====================================================================   //
//                                                                          //   
//   dream4 | webservices - Am Michelsgrund 7 - 69469 Weinheim - Germany    //    
//   tel. +49(0) 6201 - 980442 / fax. +49(0) 6201 - 64809                   //
//                                                                          //
// ======================================================================== //
$sname = simpletitle($lang['changedetails']);

// Ist User eingeloggt? Wenn nicht Fehler ausgeben...
if($islogged==0){
	$EOUT = stderror("nopermission", $lang['nopermission_t'], str_replace("__URL__", "index.php", $lang['redirect']), "index.php", 1);
	$error = 1;
	$NOOUT = 1;
	
	} else {
	
	$sql = new dbc("SELECT avatar_size,avatar_width,avatar_height FROM ".PREFIX."_usergroup WHERE ugroup='".UGROUP."'");
	$row_avatar = $sql->fetchrow();
	$max_bytes = $row_avatar->avatar_size;
	$avatar_width = $row_avatar->avatar_width;
	$avatar_height = $row_avatar->avatar_height;
	
	$sql = new dbc("SELECT * FROM ".PREFIX."_user WHERE uid='".$UID."'");
	$row = $sql->fetchrow();
	
	// ==========================================================
	// <<-- pflichtfelder -->>
	// ==========================================================
	$required_fields = array();
	$required_userfields = array();
	
	$extra = ((permission("edituname")) || (UGROUP==1)) ? "" : "AND fieldname != 'uname'" ;
	$sqlfields = new dbc("SELECT * FROM " . PREFIX . "_userfields 
	WHERE 
	page='register'
	AND active='yes' 
	AND required='yes' 
	AND fieldname != 'pass' 
	AND fieldname != 'pass2' 
	AND fieldname != 'email2' 
	$extra
	ORDER BY posi ASC");
	
	while($row_uf = $sqlfields->fetchrow()){
		
		$required_fields[] = $row_uf->fieldname;
		$row_uf->fieldtext = $lang['userfields_' . $row_uf->fieldname];
		$aktval = $row_uf->fieldname;
		if($_REQUEST['send']==1){
			$row_uf->fieldval = $_REQUEST[$row_uf->fieldname];
		} else {
			$row_uf->fieldval = $row->$aktval;
		}
		switch($row_uf->fieldname){
			case "pass":
			case "pass2":
			$row_uf->fieldtype = "password";
			break;
			
			default :
			$row_uf->fieldtype = "text";
			break;
		}
		
		
		array_push($required_userfields, $row_uf);
	}
	$tmpl->assign('ruf', $required_userfields);
	// ==========================================================
	
	
	// ==========================================================
	// <<-- optonale felder -->>
	// ==========================================================
	$optional_fields = array();
	$optional_userfields = array();
	
	if( (permission("edituname")) || (UGROUP==1) ) {
		$extra = "";
	} else {
		$extra = "AND fieldname != 'uname'";
	}
	
	$sqlfields = new dbc("SELECT * FROM " . PREFIX . "_userfields 
	WHERE 
	page='register' 
	AND active='yes' 
	AND required='no' 
	AND fieldname != 'pass' 
	AND fieldname != 'pass2' 
	AND fieldname != 'email2' 
	$extra
	ORDER BY posi ASC");
	
	while($row_of = $sqlfields->fetchrow()){
		
		$optional_fields[] = $row_of->fieldname;
		$row_of->fieldtext = $lang['userfields_' . $row_of->fieldname];
		
		$aktval = $row_of->fieldname;
		if($_REQUEST['send']==1){
			$row_of->fieldval = $_REQUEST[$row_of->fieldname];
		} else {
			$row_of->fieldval = $row->$aktval;
		}
		switch($row_of->fieldname){
			case "pass":
			case "pass2":
			$row_of->fieldtype = "password";
			break;
			
			default :
			$row_of->fieldtype = "text";
			break;
		}
		
		
		array_push($optional_userfields, $row_of);
	}
	$tmpl->assign('ouf', $optional_userfields);
	// ==========================================================
	
	
	if($_REQUEST['send']==1){
		$ok = "1";
		
		$errors = array();
		
		// Wenn User seinen Benutzernamen bearbeiten darf
		if(permission("edituname")){
			if(empty($_POST['uname'])){
				array_push($errors, $lang['nousername']);
				$ok = "0";
			}
			
			// Abgeschickten Namen nach Sonderzeichen durchsuchen
	         	$puname = str_replace(array("[","]",":","(",")","=",",","'"), "", $_POST['uname']);

			
			// Wenn kein Fehler, prüfen, ob dieser Name schon existiert
			if($ok==1){
				$sql =& new dbc("SELECT uid FROM " . PREFIX . "_user WHERE uname='".escs($_POST['uname'])."' AND uid!='".$UID."'");
				$c= $sql->numrows();
				
				if($c > 0){
					array_push($errors, $lang['nameexists2']);
					$ok = "0";
				}
				if($ok==1){
					$adminuname = "uname='".escs(iform($_POST['uname'],"65",""))."',";
				}
			}
		}
		
		$pname = str_replace(array("[","]",":","(",")","="), "", $_POST['name']);
		if(ereg("[^ _A-Za-zÀ-ÖØ-öø-ÿ0-9-]", $pname)){
			array_push($errors, $lang['nameerror']);
			$ok = "0";
		}
		
		// email
		if(!ereg("^[_A-Za-zÀ-ÖØ-öø-ÿ0-9-]+(\.[_A-Za-zÀ-ÖØ-öø-ÿ0-9-]+)*@([a-zA-Z0-9-]+\.)+([a-zA-Z]{2,4})$", $_REQUEST['email'])){
			array_push($errors, $lang['emailerror']);
		$ok = "0";}
		
		// ist die Signatur länger, als erlaubt?
		if(strlen($_POST['user_sig'])>$MAXSIG){
			array_push($errors, $lang['sigerror']);
		$ok = "0";}
		
		// Wenn bis jetzt kein Fehler, überprüfe, ob Name, Email und ICQ schon in db vorhanden ist
		if($ok == 1){
			$sql2 =& new dbc("SELECT uid FROM " . PREFIX . "_user WHERE email='".escs($_REQUEST['email'])."' AND uid!='".$UID."'");
			$c2 = $sql2->numrows();
			
			if(!empty($_POST['user_icq'])){
				$sql3 = new dbc("SELECT uid FROM " . PREFIX . "_user WHERE user_icq='".escs($_REQUEST['user_icq'])."' AND uid!='".$UID."'");
				$c3 = $sql3->numrows();
			}
			
			// existiert email schon?
			if($c2 > 0){
				array_push($errors, $lang['emailexits']);
			$ok = "0";}
			
			// wurde eine email angegeben?
			if(empty($_REQUEST['email'])){
				array_push($errors, $lang['emailempty']);
			$ok = "0";}
		}
		// Wenn Geburtstag nicht angegeben...
		if((empty($_REQUEST['user_birthday'])) && (in_array("user_birthday", $required_fields)) ){
			array_push($errors, $lang['error_nobirthday']);
			$ok = "0";
		}
	
		if((!ereg("^([0-9]{2})+(\.[0-9]+)+(\.[0-9]{4})$", $_REQUEST['user_birthday'])) && (!empty($_REQUEST['user_birthday'])) ){
			array_push($errors, $lang['error_bithday_wrong']);
			$ok = "0";
		}
		
		// sonstiges (icq, aim, eigene felder)
		$sqlfields = new dbc("SELECT * FROM " . PREFIX . "_userfields WHERE page='register' AND active='yes' AND type='other' AND required='yes' ORDER BY posi ASC");
		while($row_ufs = $sqlfields->fetchrow()){
			
			
			if((empty($_REQUEST[$row_ufs->fieldname])) && (in_array($row_ufs->fieldname, $required_fields)) ){
				if($lang["userfields_" . $row_ufs->fieldname . "_no"] == "" ){
					array_push($errors, $row_ufs->extra_error);
				} else {
					array_push($errors, $lang["userfields_" . $row_ufs->fieldname . "_no"]);
				}
				$ok = "0";
			}
		}
		
	}
	
	
	// wenn kein fehler...
	if($ok == "1"){
		
		
		// avatar
		if(permission('own_avatar')){
			
			$target = "uploads/avatars/";
			if($_FILES['file']['type']=="image/pjpeg"  || 
			$_FILES['file']['type']=="image/jpeg"   || 
			$_FILES['file']['type']=="image/x-png"  || 
			$_FILES['file']['type']=="image/png"    || 
			$_FILES['file']['type']=="image/gif") {
				
				$filesize = @filesize($_FILES['file']['tmp_name']);
				$file_wh = @GetImageSize($_FILES['file']['tmp_name']);
				$file_wh_w = $file_wh[0];
				$file_wh_h = $file_wh[1];
				
				$fupload_name = @ktrim($_FILES['file']['name'],1);
				$fupload_name = @rand_tostring($target ,$fupload_name);
				
				
				if( ($file_wh_w <= $avatar_width) && ($file_wh_h <= $avatar_height) && ($filesize <= $max_bytes) && ($_REQUEST['delav']!=1) ){
					
					
					@move_uploaded_file($_FILES['file']['tmp_name'], $target . $fupload_name);
					@chmod($target . $fupload_name,0777);
					
					$avatar = "user_avatar = '$fupload_name',";
					
					$sql_old = new dbc("SELECT user_avatar FROM " . PREFIX . "_user WHERE uid='" . $UID . "'");
					$row_old = $sql_old->fetchrow();
					@unlink($target . $row_old->user_avatar);
					$avatar .= "user_avatar='$fupload_name',";
					
				}
			}
		}
		if($_REQUEST['delav']==1){
			$sql_old = new dbc("SELECT user_avatar FROM " . PREFIX . "_user WHERE uid='" . $UID . "'");
			$row_old = $sql_old->fetchrow();
			@unlink($target . $row_old->user_avatar);
			$avatar .= "user_avatar='',";
		}
		
		// =========================================================		
		// eintrag...		
		// =========================================================
		$insert = array();	
		
		$extra = ((permission("edituname")) || (UGROUP==1)) ? "" : "AND fieldname != 'uname'" ;
		$sql = new dbc("SELECT * FROM " . PREFIX . "_userfields 
		WHERE page='register' 
		AND fieldname != 'pass'
		AND fieldname != 'pass2' 
		AND fieldname != 'email2' 
		AND  active='yes' 
		$extra
		ORDER BY posi ASC");
		
		while($row = $sql->fetchrow()){
			$fielddata = strip_tags(mysql_escape_string($_REQUEST[$row->fieldname]));
			switch($row->fieldname){
				case 'user_interests' :
				case 'user_sig' :
				$data = substr($fielddata, 0, $MAXSIG);
				break;
				
				default :
				$data =  $fielddata;
				break;
			}
			
			//if($data != ""){
				$insert[]     = "$row->fieldname = '$data'";
			//}
		}
		
		
		
		$dat = implode(",\n", $insert);
		$q = "UPDATE " . PREFIX . "_user 
		SET
		$avatar 
		usedefault_avatar = '$_POST[usedefault_avatar]',
		recieve_newsletter ='$_POST[recieve_newsletter]',
		pntomail = '$_POST[pntomail]',
		user_viewemail = '$_POST[user_viewemail]',
		invisible = '$_POST[invisible]',
		user_canpn = '$_POST[user_canpn]',
		$dat 
		
		WHERE uid='" . UID . "'";
		$sql = new dbc("$q");
		// =========================================================
		$EOUT = msg("changedetails", "detailschangeok", str_replace("__URL__", "index.php?p=changedetails", $lang['redirect']), "index.php?p=changedetails");
		$NOOUT = 1;
	}
	
	
	
	if (($ok==0) && (isset($_REQUEST['send']))) {
		$tmpl->assign('title_error', $lang['error']);
		$tmpl->assign('iserror', 1);
		$tmpl->assign('errors', $errors);
	}
	
	
	$tmpl->assign('row', $row);
	$tmpl->assign('msg', $lang['msgcdetails']);
	$tmpl->assign('name', oform($row->uname));
	$tmpl->assign('t_personalmessage', $lang['personalmessage']);
	
	if (permission("edituname")) {
		$tmpl->assign('isadmin', 1);
		$tmpl->assign('name', $BENUTZER);
	} else {
		$tmpl->assign('isadmin', 0);
		$tmpl->assign('gast', $GROUPSINGLE);
	}
	
	
	$tmpl->assign('maxkb', $max_bytes/1024);
	$tmpl->register_function('permission','permission');
	$tmpl->assign('avatar_height', $avatar_height);
	$tmpl->assign('avatar_width', $avatar_width);
	
	if ($MAXSIG==0 || $MAXSIG=="" || $MAXSIG < 1) {
		$tmpl->assign('sigint', 0);
	}
	
	$tmpl->assign("content", parsetrue("container/".container("profile"), $lang['changedetails'], $tmpl->fetch("user/changedetails.tpl")));
}
?>