query ( $sql ); // if the node was found in the DB if ($loc_db->num_rows() == 1) { // if username exists // move to the record $loc_db->next_record(); // if the user hasnt confirmed yet if (!$loc_db->f("confirm")) { //user cant login yet $_SESSION["msg"] = "error. You must confirm your registration before you are able to login"; $_SESSION["msg_type"] = 0; return false; // if the password from the DB matches the one supplied } elseif ($loc_db->f("password") == $password) { $_SESSION["logged_in"] = $loc_db->f("username"); $_SESSION["admin"] = $loc_db->f("admin"); // user is authenticated return true; // else the password is wrong } else { $_SESSION["msg"] = "Incorrect Password"; $_SESSION["msg_type"] = 0; // don't give the user access return false; } // if the user doesn't even exist, then they definately // can't login! } else { $_SESSION["msg"] = "username not found"; $_SESSION["msg_type"] = 0; // don't give the user access return false; } // end ID in DB if } // end login() /* * logout() * * logs the current user out * * Usage: just call it * * Returns: true or false * */ function logout() { session_destroy(); $_SESSION["msg"] = "User successfully logged in"; $_SESSION["msg_type"] = 0; return TRUE; } // end logout /* * email_password_reset() * * send an email to the specfied user with instructions on how * to reset thier password * * Usage: $username - user who wants to reset their password * * Returns: true or false * */ function email_password_reset($username) { // declare global variables GLOBAL $opt_server; GLOBAL $opt_loc_path; GLOBAL $opt_ip_allocater; GLOBAL $opt_ip_allocation_pass; GLOBAL $opt_maintainer_email; // create DB class $loc_db = new locDatabase; // pull users information from the DB $sql = "SELECT * FROM users WHERE username = '" . $username . "'"; $loc_db->query( $sql ); $loc_db->next_record(); // establish emails details $to = $loc_db->f("email"); $subject = "[locfinder] your locfinder password"; $message = "To reset your password, go to http://" . $opt_server . $opt_loc_path . "index.php?action=reset&username=" . $username . "&hash=" . $loc_db->f("password"); $headers = "From: " . $opt_maintainer_email . "\r\nX-Mailer: PHP/" . phpversion(); // send the email and return the result (true/false) $send_mail = mail($to, $subject, $message, $headers); if ($send_mail) { $_SESSION["msg"] = "An email with instructions has been emaield to the email address we have for user " . $username; $_SESSION["msg_type"] = 1; return TRUE; } else { $_SESSION["msg"] = "There was an error whilst trying to send your email"; $_SESSION["msg_type"] = 0; return FALSE; } } // end email_password_reset() /* * reset_password() * * reset a users password to a random string * * Usage: $username - user who wants to reset their password * Usage: $hash - a hash of the users password * * Returns: true or false * */ function reset_password($username, $hash) { // declare global variables GLOBAL $opt_maintainer_email; // create DB class $loc_db = new locDatabase; $loc_db_2 = new locDatabase; // select the users info from the DB $sql = "SELECT * from users WHERE username='$username'"; $loc_db->query( $sql ); $loc_db->next_record(); // if teh supplied hash equals the users password in the db if ($hash == $loc_db->f("password")) { // generate a new random password $new_password = substr(md5(time()), 5, 12); // update the DB with the new password $sql = "UPDATE users SET password='" . md5($new_password) . "' WHERE username='$username'"; $loc_db_2->query( $sql ); // establish email details $to = $loc_db->f("email"); $subject = "[locfinder] Your password has been reset"; $headers = "From: " . $opt_maintainer_email . "\r\nX-Mailer: PHP/" . phpversion(); $message = "Your password has been reset to '" . $new_password . "'"; $send_mail = mail($to, $subject, $message, $headers); if ($send_mail) { $_SESSION["msg"] = "Your password has been successfully reset"; $_SESSION["msg_type"] = 1; return TRUE; } else { $_SESSION["msg"] = "There was an error resetting your password"; $_SESSION["msg_type"] = 0; return FALSE; } } else { $_SESSION["msg"] = "Unable to reset password, the hash was incorrect"; $_SESSION["msg_type"] = 0; return FALSE; } } /* * user_update_password() * * changes a users password * * Usage: $username - user who wants to reset their password * $password - the new password * $confirm_password - the new password * * Returns: true or false * */ function user_update_password($username, $password, $confirm_password) { // create DB class $loc_db = new locDatabase; // if the supplied passwords match if ($password == $confirm_password) { // create the hash of the new passwrd $hash = md5($password); // update the DB with the new password $sql = "UPDATE users SET password='$hash' WHERE username='$username'"; $loc_db->query($sql); $_SESSION["msg"] = "Password successfully changed"; $_SESSION["msg_type"] = 1; return TRUE; } else { $_SESSION["msg"] = "error. Passwords do not match"; $_SESSION["msg_type"] = 0; return FALSE; } } /* * user_update_password() * * changes a users password * * Usage: $username - user who wants to reset their password * $full_name - name of the user * $email - the users email address * $notify_updates - does the user wish to be informed of * changes to locfinder * $password - the new password * * Returns: true or false * */ function register_user($username, $full_name, $email, $notify_updates, $password) { // create DB class $loc_db = new locDatabase; // convert the checkbox values to integers if ($notify_updates == "on") { $notify_updates = 1; } else { $notify_updates = 0; } // insert the user into the DB $sql = "INSERT into users (username, name, email, notify_updates, password, confirm) VALUES('$username', '$fullname', '$email', $notify_updates, '" . md5($password) . "', 0)"; $loc_db->query($sql); // let the user know they need to confirm their registration email_user_confirm($username); write_log(1, "SYSTEM", "Register User", $username); $_SESSION["msg"] = "User successfully registered - instructions on how to confirm this registration have been emailed to you"; $_SESSION["msg_type"] = 1; return true; } /* * email_user_confirm() * * lets a new user now they need to confirm their registration * * Usage: $username - the user to email * * Returns: true or false * */ function email_user_confirm($username) { GLOBAL $opt_maintainer_email; GLOBAL $opt_server; GLOBAL $opt_loc_path; // create a new DB class $loc_db = new locDatabase; // pull the users info from the DB $sql = "SELECT * from users where username='$username'"; $loc_db->query($sql); $loc_db->next_record(); // put the email together $to = $loc_db->f("email"); $subject = "[locfinder] User Confirmation"; $headers = "From: " . $opt_maintainer_email . "\r\nX-Mailer: PHP/" . phpversion(); $message = "Hi" . $loc_db->f("name") . "\r\n\r\nThankyou for registering as a user with locfinder - to complete your registration, all you need to do is click on the link below.\r\n\r\nBest of luck getting your node active!\r\n\r\nhttp://" . $opt_server . $opt_loc_path . "index.php?action=confirm&username=" . $username . "&hash=" . $loc_db->f("password"); // send the email off mail($to, $subject, $message, $headers); } /* * user_confirm() * * lets a new user confirm their registration * * Usage: $username - the user to email * $hash - a hash of the users password * * Returns: true or false * */ function user_confirm($username, $hash) { //create a new DB class $loc_db = new locDatabase; // pull the hash of the users password from the DB $sql = "SELECT password from users where username='$username'"; $loc_db->query($sql); $loc_db->next_record(); // if the hash matches the users password hash if ($loc_db->f("password") == $hash) { // update the DB to indicate the user has confirmed $sql = "UPDATE users set confirm=1 WHERE username='$username'"; $loc_db->query($sql); // let the user know they successfully confirmed $_SESSION["msg"] = "You have successfully confirmed your registration"; $_SESSION["msg_type"] = 1; return TRUE; } else { $_SESSION["msg"] = "error. Incorrect Hash"; $_SESSION["msg_type"] = 0; return FALSE; } } /* * user_update() * * lets a new user confirm their registration * * Usage: $username - the user to email * $name - the users name * $email - the suers email * $notify_updates - if the user wishes to receieve occasional * updates from locfinder * * Returns: true or false * */ function user_update($username, $name, $email, $notify_updates) { // create a DB class $loc_db = new locDatabase; // convert the checkbox values to integar if ($notify_updates == "on") { $notify_updates = 1; } else { $notify_updates = 0; } // update the DB $sql = "UPDATE users SET name='$name', email='$email', notify_updates=$notify_updates WHERE username='$username'"; $loc_db->query($sql); // let the user know they successfully confirmed $_SESSION["msg"] = "User details successfulyl updated"; $_SESSION["msg_type"] = 1; return true; } /* * node_is_users() * * returns true if the given node belongs to the given user * * Usage: $username - the username * $node_id - the node to check * * Returns: true or false * */ function node_is_users($user, $node_id) { // create a DB class $loc_db = new locDatabase; // pull the owner of the given node from the DB $sql = "SELECT owner FROM nodes WHERE id='" . $node_id . "'"; $loc_db->query($sql); $loc_db->next_record(); // if the user matches the nodes owner if ($user == $loc_db->f("owner")) { return TRUE; } else { $_SESSION["msg"] = "You are not authorised to edit node" . $node_id; $_SESSION["msg_type"] = 0; return FALSE; } } function is_member($username) { //create a DB class $user_db = new locDatabase; $sql = "SELECT current_member FROM users WHERE username='$username'"; $user_db->query($sql); $user_db->next_record(); if ($user_db->f("current_member")) { return true; } else { return false; } } function new_member($user, $member_since) { $user_db = new locDatabase; $sql = "SELECT max(membership_no) as membership_no from users"; $user_db->query($sql); $user_db->next_record(); $membership_no = $user_db->f("membership_no") + 1; $sql = "UPDATE users set current_member=1, membership_no=$membership_no, member_since='$member_since', membership_expires=DATE_ADD('$member_since', INTERVAL 1 YEAR) WHERE username='$user'"; $user_db->query($sql); return true; } function update_membership_details($user, $address_1, $address_2, $suburb, $state, $postcode, $occupation, $dob, $correspond_via_email) { $user_db = new locDatabase; if ($correspond_via_email == "on") { $correspond_via_email = 1; } else { $correspond_via_email = 0; } $sql = "UPDATE users set address_1='$address_1', address_2='$address_2', suburb='$suburb', state='$state', postcode='$postcode', occupation='$occupation', birthdate='$dob',correspond_via_email='$correspond_via_email' WHERE username='$user'"; $user_db->query($sql); return true; } function toggle_admin ($user) { $user_db = new locDatabase; $sql = "SELECT admin FROM users WHERE username='$user'"; $user_db->query($sql); $user_db->next_record(); $admin = $user_db->f("admin"); if ($admin == 1) { $admin = 0; } else { $admin = 1; } $sql = "UPDATE users SET admin=$admin WHERE username='$user'"; $user_db->query($sql); return true; } function count_members() { $user_db = new locDatabase; $sql = "SELECT count(username) as count_members FROM users WHERE current_member=1"; $user_db->query($sql); $user_db->next_record(); return $user_db->f("count_members"); } } ?>