path: root/include/functions_user.inc.php

<?php
// +-----------------------------------------------------------------------+
// | PhpWebGallery - a PHP based picture gallery                           |
// | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
// | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net |
// +-----------------------------------------------------------------------+
// | branch        : BSF (Best So Far)
// | file          : $RCSfile$
// | last update   : $Date$
// | last modifier : $Author$
// | revision      : $Revision$
// +-----------------------------------------------------------------------+
// | This program is free software; you can redistribute it and/or modify  |
// | it under the terms of the GNU General Public License as published by  |
// | the Free Software Foundation                                          |
// |                                                                       |
// | This program is distributed in the hope that it will be useful, but   |
// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
// | General Public License for more details.                              |
// |                                                                       |
// | You should have received a copy of the GNU General Public License     |
// | along with this program; if not, write to the Free Software           |
// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
// | USA.                                                                  |
// +-----------------------------------------------------------------------+

// validate_mail_address verifies whether the given mail address has the
// right format. ie someone@domain.com "someone" can contain ".", "-" or
// even "_". Exactly as "domain". The extension doesn't have to be
// "com". The mail address can also be empty.
// If the mail address doesn't correspond, an error message is returned.
function validate_mail_address( $mail_address )
{
  global $lang;

  if ( $mail_address == '' )
  {
    return '';
  }
  $regex = '/^[\w-]+(\.[\w-]+)*@[\w-]+(\.[\w-]+)*\.[a-z]+$/';
  if ( !preg_match( $regex, $mail_address ) )
  {
    return $lang['reg_err_mail_address'];
  }
}

function register_user($login, $password, $password_conf,
                       $mail_address, $status = 'guest')
{
  global $lang, $conf;

  $errors = array();
  // login must not
  //      1. be empty
  //      2. start ou end with space character
  //      3. include ' or " characters
  //      4. be already used
  if ($login == '')
  {
    array_push($errors, $lang['reg_err_login1']);
  }
  if (ereg("^.* $", $login))
  {
    array_push($errors, $lang['reg_err_login2']);
  }
  if (ereg("^ .*$", $login))
  {
    array_push($errors, $lang['reg_err_login3']);
  }

  if (ereg("'", $login) or ereg("\"", $login))
  {
    array_push($errors, $lang['reg_err_login4']);
  }
  else
  {
    $query = '
SELECT id
  FROM '.USERS_TABLE.'
  WHERE username = \''.$login.'\'
;';
    $result = pwg_query($query);
    if (mysql_num_rows($result) > 0)
    {
      array_push($errors, $lang['reg_err_login5']);
    }
  }
  // given password must be the same as the confirmation
  if ($password != $password_conf)
  {
    array_push($errors, $lang['reg_err_pass']);
  }

  $error_mail_address = validate_mail_address($mail_address);
  if ($error_mail_address != '')
  {
    array_push($errors, $error_mail_address);
  }

  // if no error until here, registration of the user
  if (count($errors) == 0)
  {
    $insert = array();
    $insert['username'] = $login;
    $insert['password'] = md5($password);
    $insert['status'] = $status;
    $insert['template'] = $conf['default_template'];
    $insert['nb_image_line'] = $conf['nb_image_line'];
    $insert['nb_line_page'] = $conf['nb_line_page'];
    $insert['language'] = $conf['default_language'];
    $insert['recent_period'] = $conf['recent_period'];
    $insert['feed_id'] = find_available_feed_id();
    $insert['expand'] = boolean_to_string($conf['auto_expand']);
    $insert['show_nb_comments'] = boolean_to_string($conf['show_nb_comments']);
    if ( $mail_address != '' )
    {
      $insert['mail_address'] = $mail_address;
    }
    if ($conf['default_maxwidth'] != '')
    {
      $insert['maxwidth'] = $conf['default_maxwidth'];
    }
    if ($conf['default_maxheight'] != '')
    {
      $insert['maxheight'] = $conf['default_maxheight'];
    }

    $query = '
INSERT INTO '.USERS_TABLE.'
  ('.implode(',', array_keys($insert)).')
  VALUES
  (';
    $is_first = true;
    foreach (array_keys($insert) as $field)
    {
      if (!$is_first)
      {
        $query.= ',';
      }
      $query.= "'".$insert[$field]."'";
      $is_first = false;
    }
    $query.= ')
;';
    pwg_query($query);

    $query = '
UPDATE '.USERS_TABLE.'
  SET registration_date = NOW()
  WHERE id = '.mysql_insert_id().'
;';
    pwg_query($query);
  }
  return $errors;
}

function update_user( $user_id, $mail_address, $status,
                      $use_new_password = false, $password = '' )
{
  $error = array();
  $i = 0;
  
  $error_mail_address = validate_mail_address( $mail_address );
  if ( $error_mail_address != '' )
  {
    $error[$i++] = $error_mail_address;
  }

  if ( sizeof( $error ) == 0 )
  {
    $query = 'UPDATE '.USERS_TABLE;
    $query.= " SET status = '".$status."'";
    if ( $use_new_password )
    {
      $query.= ", password = '".md5( $password )."'";
    }
    $query.= ', mail_address = ';
    if ( $mail_address != '' )
    {
      $query.= "'".$mail_address."'";
    }
    else
    {
      $query.= 'NULL';
    }
    $query.= ' WHERE id = '.$user_id;
    $query.= ';';
    pwg_query( $query );
  }
  return $error;
}

function check_login_authorization($guest_allowed = true)
{
  global $user,$lang,$conf,$template;

  if ($user['is_the_guest'] and !$guest_allowed)
  {
    echo '<div style="text-align:center;">'.$lang['only_members'].'<br />';
    echo '<a href="./identification.php">'.$lang['ident_title'].'</a></div>';
    exit();
  }

  if ($conf['gallery_locked'])
  {
    echo '<div style="text-align:center;">';
    echo $lang['gallery_locked_message'];
    echo '</div>';
    if ($user['status'] != 'admin')
    {
      exit();
    }
  }
}

function setup_style($style)
{
  return new Template(PHPWG_ROOT_PATH.'template/'.$style);
}

function getuserdata($user)
{
  $sql = "SELECT * FROM " . USERS_TABLE;
  $sql.= " WHERE ";
  $sql .= ( ( is_integer($user) ) ? "id = $user" : "username = '" .  str_replace("\'", "''", $user) . "'" ) . " AND id <> " . ANONYMOUS;
  $result = pwg_query($sql);
  return ( $row = mysql_fetch_array($result) ) ? $row : false;
}

/*
 * deletes favorites of the current user if he's not allowed to see them
 *
 * @return void
 */
function check_user_favorites()
{
  global $user;

  if ($user['forbidden_categories'] == '')
  {
    return;
  }
  
  $query = '
SELECT f.image_id
  FROM '.FAVORITES_TABLE.' AS f INNER JOIN '.IMAGE_CATEGORY_TABLE.' AS ic
    ON f.image_id = ic.image_id
  WHERE f.user_id = '.$user['id'].'
    AND ic.category_id IN ('.$user['forbidden_categories'].')
;';
  $result = pwg_query($query);
  $elements = array();
  while ($row = mysql_fetch_array($result))
  {
    array_push($elements, $row['image_id']);
  }

  if (count($elements) > 0)
  {
    $query = '
DELETE FROM '.FAVORITES_TABLE.'
  WHERE image_id IN ('.implode(',', $elements).')
    AND user_id = '.$user['id'].'
;';
    pwg_query($query);
  }
}

/**
 * update table user_forbidden for the given user
 *
 * table user_forbidden contains calculated data. Calculation is based on
 * private categories minus categories authorized to the groups the user
 * belongs to minus the categories directly authorized to the user
 *
 * @param int user_id
 * @param string user_status
 * @return string forbidden_categories
 */
function calculate_permissions($user_id, $user_status)
{
  $private_array = array();
  $authorized_array = array();

  $query = '
SELECT id
  FROM '.CATEGORIES_TABLE.'
  WHERE status = \'private\'
;';
  $result = pwg_query($query);
  while ($row = mysql_fetch_array($result))
  {
    array_push($private_array, $row['id']);
  }

  // if user is not an admin, locked categories can be considered as private$
  if ($user_status != 'admin')
  {
    $query = '
SELECT id
  FROM '.CATEGORIES_TABLE.'
  WHERE visible = \'false\'
;';
    $result = pwg_query($query);
    while ($row = mysql_fetch_array($result))
    {
      array_push($private_array, $row['id']);
    }

    $private_array = array_unique($private_array);
  }
  
  // retrieve category ids directly authorized to the user
  $query = '
SELECT cat_id
  FROM '.USER_ACCESS_TABLE.'
  WHERE user_id = '.$user_id.'
;';
  $result = pwg_query($query);
  while ($row = mysql_fetch_array($result))
  {
    array_push($authorized_array, $row['cat_id']);
  }

  // retrieve category ids authorized to the groups the user belongs to
  $query = '
SELECT cat_id
  FROM '.USER_GROUP_TABLE.' AS ug INNER JOIN '.GROUP_ACCESS_TABLE.' AS ga
    ON ug.group_id = ga.group_id
  WHERE ug.user_id = '.$user_id.'
;';
  $result = pwg_query($query);
  while ($row = mysql_fetch_array($result))
  {
    array_push($authorized_array, $row['cat_id']);
  }

  // uniquify ids : some private categories might be authorized for the
  // groups and for the user
  $authorized_array = array_unique($authorized_array);

  // only unauthorized private categories are forbidden
  $forbidden_array = array_diff($private_array, $authorized_array);

  $query = '
DELETE FROM '.USER_FORBIDDEN_TABLE.'
  WHERE user_id = '.$user_id.'
;';
  pwg_query($query);

  $forbidden_categories = implode(',', $forbidden_array);
  
  $query = '
INSERT INTO '.USER_FORBIDDEN_TABLE.'
  (user_id,need_update,forbidden_categories)
  VALUES
  ('.$user_id.',\'false\',\''.$forbidden_categories.'\')
;';
  pwg_query($query);
  
  return $forbidden_categories;
}

/**
 * returns the username corresponding to the given user identifier if exists
 *
 * @param int user_id
 * @return mixed
 */
function get_username($user_id)
{
  $query = '
SELECT username
  FROM '.USERS_TABLE.'
  WHERE id = '.intval($user_id).'
;';
  $result = pwg_query($query);
  if (mysql_num_rows($result) > 0)
  {
    list($username) = mysql_fetch_row($result);
  }
  else
  {
    return false;
  }
  
  return $username;
}

/**
 * search an available feed_id
 *
 * @return string feed identifier
 */
function find_available_feed_id()
{
  while (true)
  {
    $key = generate_key(50);
    $query = '
SELECT COUNT(*)
  FROM '.USERS_TABLE.'
  WHERE feed_id = \''.$key.'\'
;';
    list($count) = mysql_fetch_row(pwg_query($query));
    if (0 == $count)
    {
      return $key;
    }
  }
}
?>