<?php
//=================================================================
// KOOBI R7 - CMS - PORTALSOFTWARE(c) DREAM4(r) 
// HTTP://WWW.DREAM4.DE
//=================================================================
// ACHTUNG!
// DIESER PROGRAMMCODE IST URHERRECHTLICH GESCHUETZT
// DIE URHEBERRECHTE LIEGEN BEI DEN JEWEILIGEN AUTOREN.
// AENDERUNGEN IN DIESER DATEI ERFOLGEN AUF EIGENE GEFAHR!
// ES IST NICHT GESTATTET, DEN COPYRIGHTHINWEIS ZU AENDERN ODER ZU
// ENTFERNEN. NUR WENN SIE EINE COPYRIGHTHINWEIS-ENTFERNUNG BESTELLT
// HABEN, DUERFEN SIE DIESEN ENTFERNEN.
//================================================================
// BEI FRAGEN WENDEN SIE SICH BITTE AN: KONTAKT@DREAM4.DE
//=================================================================
class User
{
	var $_changepass_tpl = 'changepass.tpl';
	var $_muster = '/[^ ._A-Za-zÀ-ÖØ-öø-ÿ0-9-]/';
	var $_muster_strasse = '/[^ \/._A-Za-zÀ-ÖØ-öø-ÿ0-9-]/';
	var $_muster_email = '/^[ -._A-Za-zÀ-ÖØ-öø-ÿ0-9-]+(\.[_A-Za-zÀ-ÖØ-öø-ÿ0-9-]+)*@([a-zA-Z0-9-]+\.)+([a-zA-Z]{2,4})$/';
	var $deZip = 5;
	var $chZip = 4;
	var $atZip = 4;
	var $frZip = 5;
	var $itZip = 5;
	
	function getNameById($id)
	{
		$sql = $GLOBALS['db']->Query("SELECT Benutzername FROM " . PREFIX . "_benutzer WHERE Id = '{$id}'");
		$row = $sql->fetchrow();
		if(is_object($row)) return $row->Benutzername;
	}
	
	
	//=================================================================
	// Profil aendern
	//=================================================================
	function Profile()
	{
		$GLOBALS['tmpl']->assign('headernav', $GLOBALS['config_vars']['Profile_page_title']);
		$GLOBALS['tmpl']->assign('pagetitle_html', $GLOBALS['config_vars']['Profile_page_title']);
		
		if(!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] != 1)
		{
			$GLOBALS['tmpl']->assign('content', $GLOBALS['tmpl']->fetch($GLOBALS['config']['source'] . '/misc/no_access.tpl'));
		} else {
			if (isset($_POST['send']) && $_POST['send']=='1') 
			{
				#define('AJAX_OUTPUT',1);
				$muster = $this->_muster;
				$muster_strasse = $this->_muster_strasse;
				$muster_email = $this->_muster_email;
				$error = '';
				$update_email = '';
				$update_username = '';
				$update_firstname = '';
				$update_lastname = '';
				$update_street = '';
				$update_zip = '';
				$update_town = '';
				$update_phone = '';
				$update_fax = '';
				
				//=================================================================
				// Es soll die E-Mail geaendert werden
				//=================================================================
				if(!empty($_POST['newmail']) && !empty($_POST['newmail2']) && permission('email_change'))
				{
					if(@!preg_match($muster_email, $_POST['newmail']))  $error[] = $GLOBALS['config_vars']['RegE_wrongmail'];
					if($_POST['newmail'] != $_POST['newmail2']) $error[] = $GLOBALS['config_vars']['RegE_wrongmail2'];
					
					//=================================================================
					// Pruefen ob E-Mail schon verwendet wird
					//=================================================================
					if(empty($error))
					{
						$row_c = $GLOBALS['db']->RowQuery("SELECT Email FROM " . PREFIX . "_benutzer WHERE Email = '".$_POST['newmail']."' AND Email != '" . $_SESSION['login_email'] . "'  LIMIT 1");
						if(is_object($row_c) && $row_c->Email != '') $error[] = $GLOBALS['config_vars']['RegE_mailinuse'];
					}
					
					//=================================================================
					// Pruefen ob E-Mail gesperrt ist
					//=================================================================
					if(empty($error))
					{
						if($this->lockedEmails($_POST['newmail'])) $error[] = $GLOBALS['config_vars']['RegE_maillocked'];
					}
					
					if(empty($error))
					{
						$update_email = "Email = '" . $_POST['newmail'] . "',";
					}
				//=================================================================
				// Keine E-Mail Aenderung
				//=================================================================
				} else {
					$_POST['newmail'] = '';
					$_POST['newmail2'] = '';
				}
				
				$_POST['msn'] = trim(eregi_replace('[^ €@|_.A-Za-zÀ-ÖØ-öø-ÿ0-9:-]', '', @$_POST['msn']));
				$_POST['aim'] = trim(eregi_replace('[^ €@|_.A-Za-zÀ-ÖØ-öø-ÿ0-9:-]', '', @$_POST['aim']));
				$_POST['icq'] = trim(eregi_replace('[^ €@|_.A-Za-zÀ-ÖØ-öø-ÿ0-9:-]', '', @$_POST['icq']));
				$_POST['Webseite'] = trim(eregi_replace('[^ €\/@|_.A-Za-zÀ-ÖØ-öø-ÿ0-9:-]', '', @$_POST['Webseite']));
				$_POST['Firma'] = trim(eregi_replace('[^ €@|_.A-Za-zÀ-ÖØ-öø-ÿ0-9:-]', '', @$_POST['Firma']));
				$_POST['UStId'] = trim(eregi_replace('[^ €@|_.A-Za-zÀ-ÖØ-öø-ÿ0-9]', '', @$_POST['UStId']));
				
				//================================================================
				// Land und Laender-Code
				//================================================================
				$Landcode = eregi_replace('[^A-Za-zÀ-ÖØ-öø-ÿ]', '', $_POST['country']);
				$sql_l = $GLOBALS['db']->Query("SELECT Name FROM " . PREFIX . "_laender WHERE Code = '" . $Landcode . "'");
				$row_l = $sql_l->fetchrow();
				
				if(is_object($row_l))
				{
					$Land = $row_l->Name;
				} else {
					$Landcode = $GLOBALS['settings']['Land'];
					$sql_l = $GLOBALS['db']->Query("SELECT Name FROM " . PREFIX . "_laender WHERE Code = '" . $Landcode . "'");
					$row_l = $sql_l->fetchrow();
					$Land = $row_l->Name;
				}
					
				if(!empty($_POST['birth']))
				{
					if (!preg_match ("/(^[0-9]{2}).([0-9]{2}).([0-9]{4}$)/", $_POST['birth']))  $error[] = $GLOBALS['config_vars']['RegE_wrongBirth'];
					$year_d = substr($_POST['birth'],0,2);
					$year_m = substr($_POST['birth'],3,2);
					$year_b = substr($_POST['birth'],6);
					
					if($year_d < 1 || $year_d > 31) $error[] = $GLOBALS['config_vars']['RegE_wrongBirthD'];
					if($year_m < 1 || $year_m > 12) $error[] = $GLOBALS['config_vars']['RegE_wrongBirthM'];
					if($year_b < (date("Y") - 80) || $year_b > (date("Y") - 10)) $error[] = $GLOBALS['config_vars']['RegE_wrongBirthY'];
				}
				
				//================================================================
				// Wenn der Benutzer seinen Benutzernamen aendern darf:
				// Pruefen, ob Benutzername angegeben wurde bzw. ob dieser schon
				// verwendet wird
				//================================================================
				if(permission('username'))
				{
					if(empty($_POST['reg_username'])) $error[] = $GLOBALS['config_vars']['RegE_noUsername'];
					if(!empty($_POST['reg_username']) && @preg_match($muster, $_POST['reg_username']))  $error[] = $GLOBALS['config_vars']['RegE_wrongUsername'];
				
					@$_POST['reg_username'] = trim(eregi_replace('[^ ._A-Za-zÀ-ÖØ-öø-ÿ0-9-]', '', @$_POST['reg_username']));
					$row_c = $GLOBALS['db']->RowQuery("SELECT Benutzername FROM " . PREFIX . "_benutzer WHERE Benutzername = '" . $_POST['reg_username'] . "' AND Benutzername != '" . $_SESSION['user_name'] . "' LIMIT 1");
					if(is_object($row_c) && $row_c->Benutzername != '') $error[] = $GLOBALS['config_vars']['RegE_usernameUsed'];
					
					if(!empty($_POST['reg_username']) && !SpamCheck($_POST['reg_username'])) $error[] = $GLOBALS['config_vars']['Profile_Username'] . ': ' . $GLOBALS['config_vars']['SpamUsed'];
					
					if(empty($error))
					{
						$new_name = substr($_POST['reg_username'],0,20);
						$update_username = "Benutzername = '" . $new_name . "',";
						$_SESSION['user_name'] = $new_name;
					}
				}
				
				if(VERSION == 'PRO')
				{
					// Vorname
					if(empty($_POST['Vorname'])) $error[] = $GLOBALS['config_vars']['Profile_NoFirstName'];
					if(!empty($_POST['Vorname']) && @preg_match($muster, $_POST['Vorname']))  $error[] = $GLOBALS['config_vars']['Profile_CheckFirstName'];
					if(empty($error)) $update_firstname = "Vorname = '" . chop($_POST['Vorname']) . "',";
					
					// Nachname
					if(empty($_POST['Nachname'])) $error[] = $GLOBALS['config_vars']['Profile_NoLastName'];
					if(!empty($_POST['Nachname']) && @preg_match($muster, $_POST['Nachname']))  $error[] = $GLOBALS['config_vars']['Profile_CheckLastName'];
					if(empty($error)) $update_lastname = "Nachname = '" . chop($_POST['Nachname']) . "',";
					
					// Strasse + Hausnummer
					if(empty($_POST['Strasse_Nr'])) $error[] = $GLOBALS['config_vars']['Profile_NoStreet'];
					if(!empty($_POST['Strasse_Nr']) && @preg_match($muster_strasse, $_POST['Strasse_Nr']))  $error[] = $GLOBALS['config_vars']['Profile_WrongStreet'];
					if(empty($error)) $update_street = "Strasse_Nr = '" . chop($_POST['Strasse_Nr']) . "',";
					
					// Postleitzahl
					if(empty($_POST['Postleitzahl'])) $error[] = $GLOBALS['config_vars']['Profile_NoZip'];
					if(!empty($_POST['Postleitzahl']) && @preg_match($muster, $_POST['Postleitzahl']))  $error[] = $GLOBALS['config_vars']['Profile_WrongZip'];
					if(empty($error)) $update_zip = "Postleitzahl = '" . chop($_POST['Postleitzahl']) . "',";
					
					// Ort
					if(empty($_POST['Ort'])) $error[] = $GLOBALS['config_vars']['Profile_NoTown'];
					if(!empty($_POST['Ort']) && @preg_match($muster, $_POST['Ort']))  $error[] = $GLOBALS['config_vars']['Profile_WrongTown'];
					if(empty($error)) $update_town = "Ort = '" . chop($_POST['Ort']) . "',";
					
					// Telefon
					if(!empty($_POST['Telefon']) && @preg_match($muster, $_POST['Telefon']))  $error[] = $GLOBALS['config_vars']['Profile_WrongPhone'];
					if(empty($error)) $update_phone = "Telefon = '" . chop($_POST['Telefon']) . "',";
					
					// Telefax
					if(!empty($_POST['Telefax']) && @preg_match($muster, $_POST['Telefax']))  $error[] = $GLOBALS['config_vars']['Profile_WrongFax'];
					if(empty($error)) $update_fax = "Telefax = '" . chop($_POST['Telefax']) . "',";
				}
				
				
				if(!empty($_POST['icq']) && !SpamCheck(@$_POST['icq'])) $error[] = $GLOBALS['config_vars']['Profile_ICQ'] . ': ' . $GLOBALS['config_vars']['SpamUsed'];
				if(!empty($_POST['msn']) && !SpamCheck(@$_POST['msn'])) $error[] = $GLOBALS['config_vars']['Profile_MSN'] . ': ' . $GLOBALS['config_vars']['SpamUsed'];
				if(!empty($_POST['aim']) && !SpamCheck(@$_POST['aim'])) $error[] = $GLOBALS['config_vars']['Profile_AIM'] . ': ' . $GLOBALS['config_vars']['SpamUsed'];
				if(!empty($_POST['Webseite']) && !SpamCheck(@$_POST['Webseite'])) $error[] = $GLOBALS['config_vars']['Profile_Web'] . ': ' . $GLOBALS['config_vars']['SpamUsed'];
				if(!empty($_POST['Signatur']) && !SpamCheck(@$_POST['Signatur'])) $error[] = $GLOBALS['config_vars']['Profile_Sig'] . ': ' . $GLOBALS['config_vars']['SpamUsed'];
				if(!empty($_POST['Interessen']) && !SpamCheck(@$_POST['Interessen'])) $error[] = $GLOBALS['config_vars']['Profile_Int'] . ': ' . $GLOBALS['config_vars']['SpamUsed'];
				if(!empty($_POST['Firma']) && !SpamCheck(@$_POST['Firma'])) $error[] = $GLOBALS['config_vars']['Profile_company'] . ': ' . $GLOBALS['config_vars']['SpamUsed'];
				if(!empty($_POST['UStId']) && !SpamCheck(@$_POST['UStId'])) $error[] = $GLOBALS['config_vars']['Profile_vatnum'] . ': ' . $GLOBALS['config_vars']['SpamUsed'];
				
				//================================================================
				// Avatar
				//================================================================
				$avatar_db  = (isset($_POST['Avatar_Default'])) ? "Avatar_Default = '" . $_POST['Avatar_Default'] . "'," : "";
				if(isset($_POST['Avatar_Del']) && $_POST['Avatar_Del'] == 1) 
				{
					$avatar_del  = "Avatar = '',";
					$avatar_file = $GLOBALS['db']->RowQuery("SELECT Avatar FROM " . PREFIX . "_benutzer WHERE Id = '" . $_SESSION['benutzer_id'] . "' AND Kennwort = '" . $_SESSION['login_pass'] . "' LIMIT 1");
					@unlink(BASE_DIR . "/uploads/avatars/$avatar_file->Avatar");
				} else {
					$avatar_del = "";
				}
				
				// Wenn Berechtigung fuer eigenes Avatar
				if(permission('own_avatar') && function_exists('getimagesize'))
				{
					if(isset($_POST['Avatar_Del']) && $_POST['Avatar_Del']==1)
					{
						$avatar_db = "Avatar='',";
					}
					
					$avatar_std_db  = "Avatar_Default = '".@abs((int)$_POST['Avatar_Default'])."',";
					
					if(isset($_POST['newAvatar']) && !empty($_POST['newAvatar']))
					{
						$_POST['newAvatar'] = preg_replace('/([^-A-Za-zÀ-ÖØ-öø-ÿ0-9-.]*)/', '', $_POST['newAvatar']);
						$avatar_db = "Avatar='".$_POST['newAvatar']."',";
						$avatar_std_db  = "Avatar_Default = '',";
					}
				}
				
				
				//================================================================
				// Alles in Ordnung. Daten speichern
				//================================================================
				if(!empty($error))
				{
					$GLOBALS['tmpl']->assign('error', $error);
				} else {
				
					//================================================================
					// Eigene Videos
					//================================================================
					if(get_active('user_videos'))
					{
						if(isset($_POST['VideoSource']) && !empty($_POST['VideoSource']))
						{
							foreach($_POST['VideoSource'] as $vid => $video)
							{
								$VideoSrc = preg_replace('/([^-A-Za-zÀ-ÖØ-öø-ÿ0-9]*)/', '', $_POST['VideoSource'][$vid]);
								$Video = preg_replace('/([^-A-Za-zÀ-ÖØ-öø-ÿ0-9-|]*)/', '', $_POST['Video'][$vid]);
								$Name = preg_replace('/([^-A-Za-zÀ-ÖØ-öø-ÿ0-9]*)/', '', @$_POST['Name'][$vid]);
								
								$q = "UPDATE ".PREFIX."_benutzer_videos SET 
									VideoSource = '".$VideoSrc."',
									Video = '".$Video."',
									Name = '".$Name."',
									Position = '".abs((int)$_POST['Position'][$vid])."'
								WHERE 
									Id = '$vid' AND 
									Benutzer = '".$_SESSION['benutzer_id']."'";
								$GLOBALS['db']->Query($q);
								
								if(@$_POST['DelVideo'][$vid]==1)
								{
									$GLOBALS['db']->Query("DELETE FROM ".PREFIX."_benutzer_videos WHERE Id='$vid' AND Benutzer = '".$_SESSION['benutzer_id']."'");
								}
							}
						}
						
						
						$VideoCount = userVideosCount($_SESSION['benutzer_id']);
						if(isset($_POST['VideoNeu']) && !empty($_POST['VideoNeu']) && $VideoCount<4)
						{	
							foreach($_POST['VideoNeu'] as $vid => $video)
							{
								$VideoCount = userVideosCount($_SESSION['benutzer_id']);
								if($VideoCount<5 && !empty($_POST['VideoNeu'][$vid]))
								{
									$VideoSrc = preg_replace('/([^-A-Za-zÀ-ÖØ-öø-ÿ0-9]*)/', '', $_POST['VideoSourceNeu'][$vid]);
									$Video = preg_replace('/([^-A-Za-zÀ-ÖØ-öø-ÿ0-9-|]*)/', '', $_POST['VideoNeu'][$vid]);
									$Name = preg_replace('/([^-A-Za-zÀ-ÖØ-öø-ÿ0-9-|]*)/', '', $_POST['NameNeu'][$vid]);
									$GLOBALS['db']->Query("INSERT INTO ".PREFIX."_benutzer_videos 
									(
										Id,
										Benutzer,
										VideoSource,
										Video,
										Name,
										Position 
									) VALUES (
										'',
										'".abs((int)$_SESSION['benutzer_id'])."',
										'".$VideoSrc."',
										'".$Video."',
										'".$Name."',
										'".@abs((int)$_POST['PositionNeu'][$vid])."'
									)");
								}
							}
						}
					}
				
					$_SESSION['benutzer_vorname'] = @$_POST['Vorname'];
					$_SESSION['benutzer_nachname'] = @$_POST['Nachname'];
					$query = "UPDATE " . PREFIX . "_benutzer SET 
					   $avatar_std_db 
						$avatar_del 
						$avatar_db 
						$update_fax 
						$update_phone 
						$update_town 
						$update_zip 
						$update_street 
						$update_lastname 
						$update_firstname 
						$update_username 
						$update_email 
						LandCode = '$Landcode',
						Land = '$Land',
						Profil_public = '$_POST[Profil_public]',
						Geburtstag_public = '$_POST[Geburtstag_public]',
						Geburtstag = '$_POST[birth]',
						Unsichtbar = '$_POST[Unsichtbar]',
						Newsletter = '$_POST[Newsletter]',
						Emailempfang = '$_POST[Emailempfang]', 
						Pnempfang = '$_POST[Pnempfang]', 
						PnEmail = '$_POST[PnEmail]', 
						Gaestebuch = '$_POST[Gaestebuch]',
						msn = '$_POST[msn]',
						aim = '$_POST[aim]',
						icq = '$_POST[icq]',
						skype = '$_POST[skype]',
						Profil_Alle = '" . @$_POST['Profil_Alle'] . "',
						Webseite = '" . @$_POST['Webseite'] . "',
						Signatur = '" . substr(@$_POST['Signatur'],0,SIG_LAENGE) . "',
						Interessen = '" . @$_POST['Interessen'] . "',
						Firma = '" . @$_POST['Firma'] . "',
						UStId = '" . @$_POST['UStId'] . "',
						Geschlecht = '" . @$_POST['Geschlecht'] . "',
						Beruf = '" . @$_POST['Beruf'] . "',
						Hobbys = '" . @$_POST['Hobbys'] . "',
						Essen = '" . @$_POST['Essen'] . "',
						Musik = '" . @$_POST['Musik'] . "',
						PnPopup = '" . @$_POST['PnPopup'] . "',
						Ort_Public = '" . @$_POST['Ort_Public'] . "',
						Gaestebuch_Moderiert = '" . @$_POST['Gaestebuch_Moderiert'] . "',
						Gaestebuch_KeineGaeste = '" . @$_POST['Gaestebuch_KeineGaeste'] . "',
						Gaestebuch_Zeichen = '" . @$_POST['Gaestebuch_Zeichen'] . "',
						Gaestebuch_smilies = '" . @$_POST['Gaestebuch_smilies'] . "',
						Gaestebuch_bbcode = '" . @$_POST['Gaestebuch_bbcode'] . "',
						Gaestebuch_imgcode = '" . @$_POST['Gaestebuch_imgcode'] . "',
						Forum_Beitraege_Limit = '" . @$_POST['Forum_Beitraege_Limit'] . "',
						Forum_Themen_Limit = '" . @$_POST['Forum_Themen_Limit'] . "' 
					WHERE 
						Kennwort = '" . $_SESSION['login_pass'] . "' AND Id = '" . $_SESSION['benutzer_id'] . "'";
					$GLOBALS['db']->RowQuery($query);
					
					Logger('User ' . $_SESSION['user_name'] . ' has changed the profile.', '', $_SESSION['benutzer_id']);
					
					if(!empty($update_email))
					{
						$_SESSION['login_email'] = $_POST['newmail'];
					}
					
					// Erfolgreich, Meldung ausgeben
					refer('index.php?p=useraction&action=profile&area='.AREA);
				
				}
			}
			
			$sql = $GLOBALS['db']->Query("SELECT * FROM " . PREFIX . "_benutzer  WHERE Id = '" . $_SESSION['benutzer_id'] . "' AND Kennwort = '" . $_SESSION['login_pass'] . "' LIMIT 1");
			$data = $sql->fetcharray();
			$data['Av_Start'] = 40;
			$data['Av_End'] = (!defined('AVATAR_W')) ? '100' : AVATAR_W;
			
			$VideoCount = userVideosCount($_SESSION['benutzer_id']);
			$VideoCountLoop = 4-$VideoCount;
			
			$GLOBALS['tmpl']->assign('avatar', getAvatar($data['Gruppe'],$data['Avatar'],$data['Avatar_Default']));
			$GLOBALS['tmpl']->assign('avatar_def', getAvatar($data['Gruppe'],'',1));
			$GLOBALS['tmpl']->assign('data', $data);
			$GLOBALS['tmpl']->assign('settings', $GLOBALS['settings']);
			$GLOBALS['tmpl']->assign('countries', getCountries());
			$GLOBALS['tmpl']->assign('startyear', date("Y")-80);
			$GLOBALS['tmpl']->assign('endyear', date("Y")-10);
			$GLOBALS['tmpl']->assign('signatur_erlaubt', SIG_ERLAUBT);
			$GLOBALS['tmpl']->assign('signatur_laenge', SIG_LAENGE);
			$GLOBALS['tmpl']->assign('signatur_koobicode', SIG_KOOBICODE);
			$GLOBALS['tmpl']->assign('myvideos', userVideos($_SESSION['benutzer_id']));
			$GLOBALS['tmpl']->assign('myvideosCount', $VideoCount);
			$GLOBALS['tmpl']->assign('myvideosCountLoop', $VideoCountLoop);
			$GLOBALS['tmpl']->assign('content', $GLOBALS['tmpl']->fetch($GLOBALS['config']['source'] . '/user/profile.tpl'));
		}
	}
	
	
	//=================================================================
	// Funktion zur Pruefung ob E-Mail gesperrt ist
	//=================================================================
	function lockedEmails($email)
	{
		$gesperrte_mails = array();
		$row = $GLOBALS['db']->RowQuery("SELECT EmailDomainsGesperrt, EmailGesperrt FROM " . PREFIX . "_einstellungen");
		$mails = @str_replace(array("\r\n","\n"), ',', trim($row->EmailGesperrt));
		$mails_domains = str_replace(array("\r\n","\n"), ',', trim($row->EmailDomainsGesperrt));
		
		$gesperrte_mails = explode(",", $mails);
		$gesperrte_mail_domains = explode(",", $mails_domains);
		
		$email_domain_post = @explode("@", $email);
		
		if(in_array($email, $gesperrte_mails) || in_array("@" . $email_domain_post[1], $gesperrte_mail_domains)) return true;
		return false;
	}
	
}
?>