Posts by J.Hermans

<?php


$_language->read_module('login');


if($loggedin) {
	$username='<a href="index.php?site=profile&amp;id='.$userID.'"><b>'.strip_tags(getnickname($userID)).'</b></a>';
	if(isanyadmin($userID)) $admin='<a href="admin/admincenter.php" target="_blank"><img src="images/logged-4.jpg" width="55" height="23" alt="Admincenter" /></a><br />';
	else $admin='';
	if(isclanmember($userID) or iscashadmin($userID)) $cashbox='• <a href="index.php?site=cash_box">'.$_language->module['cash-box'].'</a><br />';
	else $cashbox='';
	$anz=getnewmessages($userID);
	if($anz) {
		$newmessages=' <b><font color="ffc296">'.$anz.'</font></b>';
	}
	else $newmessages='';
	if($getavatar = getavatar($userID)) $l_avatar='<img src="images/avatars/'.$getavatar.'" alt="Avatar" />';
	else $l_avatar=$_language->module['n_a'];




	eval ("$logged = "".gettemplate("logged")."";");
	echo $logged;
}
else {
	//set sessiontest variable (checks if session works correctly)
	$_SESSION['ws_sessiontest'] = true;
	eval ("$loginform = "".gettemplate("login_top")."";");
	echo $loginform;
}


?>

<?php


include("_mysql.php");
include("_settings.php");


// copy pagelock information for session test + deactivated pagelock for checklogin
$closed_tmp = $closed;
$closed = 0;


include("_functions.php");


//settings


$sleep = 1; //idle status for script if password is wrong?


//settings end
$_language->read_module('checklogin');


$get = safe_query("SELECT * FROM ".PREFIX."banned_ips WHERE ip='".$GLOBALS['ip']."'");
if(mysql_num_rows($get) == 0){
	$ws_pwd = md5(stripslashes($_POST['pwd']));
	$ws_user = $_POST['ws_user'];
	
	$check = safe_query("SELECT * FROM ".PREFIX."user WHERE username='".$ws_user."'");
	$anz = mysql_num_rows($check);
	$login = 0;
	
	if(!$closed_tmp AND !isset($_SESSION['ws_sessiontest'])) {
		$error = $_language->module['session_error'];
	}
	else {
		if($anz) {
		
			$check = safe_query("SELECT * FROM ".PREFIX."user WHERE username='".$ws_user."' AND activated='1'");
			if(mysql_num_rows($check)) {
		
				$ds=mysql_fetch_array($check);
		
				// check password
				$login = 0;
				if($ws_pwd == $ds['password']) {
		
					//session
					$_SESSION['ws_auth'] = $ds['userID'].":".$ws_pwd;
					$_SESSION['ws_lastlogin'] = $ds['lastlogin'];
					$_SESSION['referer'] = $_SERVER['HTTP_REFERER'];
					//remove sessiontest variable
					if(isset($_SESSION['ws_sessiontest'])) unset($_SESSION['ws_sessiontest']);
					//cookie
					setcookie("ws_auth", $ds['userID'].":".$ws_pwd, time()+($sessionduration*60*60));					
					//Delete visitor with same IP from whoisonline
					safe_query("DELETE FROM ".PREFIX."whoisonline WHERE ip='".$GLOBALS['ip']."'");
					//Delete IP from failed logins
					safe_query("DELETE FROM ".PREFIX."failed_login_attempts WHERE ip = '".$GLOBALS['ip']."'");
					$login = 1;
					$error = $_language->module['login_successful'];
				}
				elseif(!($ws_pwd == $ds['password'])) {
					if($sleep) sleep(5);
					$get = safe_query("SELECT wrong FROM ".PREFIX."failed_login_attempts WHERE ip = '".$GLOBALS['ip']."'");
					if(mysql_num_rows($get)){
						safe_query("UPDATE ".PREFIX."failed_login_attempts SET wrong = wrong+1 WHERE ip = '".$GLOBALS['ip']."'");
					}
					else{
						safe_query("INSERT INTO ".PREFIX."failed_login_attempts (ip,wrong) VALUES ('".$GLOBALS['ip']."',1)");
					}
					$get = safe_query("SELECT wrong FROM ".PREFIX."failed_login_attempts WHERE ip = '".$GLOBALS['ip']."'");
					if(mysql_num_rows($get)){
						$ban = mysql_fetch_assoc($get);
						if($ban['wrong'] == $max_wrong_pw){
							$bantime = time() + (60*60*3); // 3 hours
							safe_query("INSERT INTO ".PREFIX."banned_ips (ip,deltime,reason) VALUES ('".$GLOBALS['ip']."',".$bantime.",'Possible brute force attack')");
							safe_query("DELETE FROM ".PREFIX."failed_login_attempts WHERE ip = '".$GLOBALS['ip']."'");
						}
					}
					$error= $_language->module['invalid_password'];
				}
			}
			else $error= $_language->module['not_activated'];
		
		}
		else $error=str_replace('%username%', htmlspecialchars($ws_user), $_language->module['no_user']);
	}
}
else{
	$login = 0;
	$data = mysql_fetch_assoc($get);
	$error = str_replace('%reason%', $data['reason'], $_language->module['ip_banned']);
}


?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="description" content="Clanpage using webSPELL 4 CMS" />
<meta name="author" content="webspell.org" />
<meta name="keywords" content="webspell, webspell4, clan, cms" />
<meta name="copyright" content="Copyright &copy; 2005 - 2011 by webspell.org" />
<meta name="generator" content="webSPELL" />
<title><?php echo PAGETITLE; ?></title>
<link href="_stylesheet.css" rel="stylesheet" type="text/css" />
<?php if($login) { echo '<meta http-equiv="refresh" content="1;URL=index.php?site=loginoverview" />'; } ?>
</head>
<body bgcolor="<?php echo PAGEBG; ?>">
<table width="100%" border="0" cellpadding="0" cellspacing="0">
	<tr>
		<td height="500" align="center">
		<table width="350" border="0" cellpadding="10" cellspacing="0" style="border:1px solid <?php echo BORDER; ?>" bgcolor="<?php echo BG_1; ?>">
			<tr>
				<td align="center"><?php echo $error; ?></td>
			</tr>
		</table>
		</td>
	</tr>
</table>
</body>
</html>

<?php


$_language->read_module('register');


eval("$title_register = "".gettemplate("title_register")."";");
echo $title_register;
$show = true;
if(isset($_POST['save'])) {


	if(!$loggedin){
		$username = mb_substr(trim($_POST['username']), 0, 30);
		$nickname = htmlspecialchars(mb_substr(trim($_POST['nickname']), 0, 30));
		$pwd1 = $_POST['pwd1'];
		$pwd2 = $_POST['pwd2'];
		$mail = $_POST['mail'];
		$CAPCLASS = new Captcha;
		
		$error = array();
	  	
	  // check nickname
		if(!(mb_strlen(trim($nickname)))) $error[]=$_language->module['enter_nickname'];
	  
	  // check nickname inuse
		$ergebnis = safe_query("SELECT * FROM ".PREFIX."user WHERE nickname = '$nickname' ");
		$num = mysql_num_rows($ergebnis);
		if($num) $error[]=$_language->module['nickname_inuse'];
	  
	  // check username
	  	if(!(mb_strlen(trim($username)))) $error[]=$_language->module['enter_username'];
		elseif(mb_strlen(trim($username)) > 30 ) $error[]=$_language->module['username_toolong'];
	  
	  // check username inuse
		$ergebnis = safe_query("SELECT * FROM ".PREFIX."user WHERE username = '$username' ");
		$num = mysql_num_rows($ergebnis);
		if($num) $error[]=$_language->module['username_inuse'];
	  
	  // check passwort
		if($pwd1 == $pwd2) {
			if(!(mb_strlen(trim($pwd1)))) $error[]=$_language->module['enter_password'];
		}
		else $error[]=$_language->module['repeat_invalid'];
	  
	  // check e-mail
		if(!validate_email($mail)) $error[]=$_language->module['invalid_mail'];
	  
	  // check e-mail inuse
		$ergebnis = safe_query("SELECT userID FROM ".PREFIX."user WHERE email = '$mail' ");
		$num = mysql_num_rows($ergebnis);
		if($num) $error[]=$_language->module['mail_inuse'];
	  
	  // check captcha
	  	if(!$CAPCLASS->check_captcha($_POST['captcha'], $_POST['captcha_hash'])) $error[]=$_language->module['wrong_securitycode'];
	  
	  	if(count($error)) {
	    	$list = implode('<br />• ', $error);
	    	$showerror = '<div class="errorbox">
	      	<b>'.$_language->module['errors_there'].':</b><br /><br />
	      	• '.$list.'
	    	</div>';
		}
		else {
			// insert in db
			$md5pwd = md5(stripslashes($pwd1));
			$registerdate=time();
			$activationkey = createkey(20);
			$activationlink='http://'.$hp_url.'/index.php?site=register&key='.$activationkey;
	
			safe_query("INSERT INTO `".PREFIX."user` (`registerdate`, `lastlogin`, `username`, `password`, `nickname`, `email`, `newsletter`, `activated`) VALUES ('$registerdate', '$registerdate', '$username', '$md5pwd', '$nickname', '$mail', '1', '".$activationkey."')");
	
			$insertid = mysql_insert_id();
	
			// insert in user_groups
			safe_query("INSERT INTO ".PREFIX."user_groups ( userID ) values('$insertid' )");
	
			// mail to user
			$ToEmail = $mail;
			$ToName = $username;
			$header =  str_replace(Array('%username%', '%password%', '%activationlink%', '%pagetitle%', '%homepage_url%'), Array(stripslashes($username), stripslashes($pwd1), stripslashes($activationlink), $hp_title, $hp_url), $_language->module['mail_subject']);
			$Message = str_replace(Array('%username%', '%password%', '%activationlink%', '%pagetitle%', '%homepage_url%'), Array(stripslashes($username), stripslashes($pwd1), stripslashes($activationlink), $hp_title, $hp_url), $_language->module['mail_text']);
			if(mail($ToEmail,$header, $Message, "From:".$admin_email."nContent-type: text/plain; charset=utf-8n")){
				redirect("index.php",$_language->module['register_successful'],3);
				$show = false;
			}
			else{
				redirect("index.php",$_language->module['mail_failed'],3);
				$show = false;
			}
		}
	}
	else{
		redirect("index.php?site=register",str_replace('%pagename%',$GLOBALS['hp_title'],$_language->module['no_register_when_loggedin']),3);
	}
}
if(isset($_GET['key'])) {


	safe_query("UPDATE `".PREFIX."user` SET activated='1' WHERE activated='".$_GET['key']."'");
	if(mysql_affected_rows()) redirect('index.php?site=login',$_language->module['activation_successful'],3);
	else redirect('index.php?site=login',$_language->module['wrong_activationkey'],3);


}
elseif(isset($_GET['mailkey'])) {
  if(mb_strlen(trim($_GET['mailkey']))==32){
		safe_query("UPDATE `".PREFIX."user` SET email_activate='1', email=email_change, email_change='' WHERE email_activate='".$_GET['mailkey']."'");
		if(mysql_affected_rows()) redirect('index.php?site=login',$_language->module['mail_activation_successful'],3);
		else redirect('index.php?site=login',$_language->module['wrong_activationkey'],3);
  }
}
else {
	if($show == true){
		if(!$loggedin){
			$bg1=BG_1;
			$bg2=BG_2;
			$bg3=BG_3;
			$bg4=BG_4;
		
			$CAPCLASS = new Captcha;
			$captcha = $CAPCLASS->create_captcha();
			$hash = $CAPCLASS->get_hash();
			$CAPCLASS->clear_oldcaptcha();
		
			if(!isset($showerror)) $showerror='';
			if(isset($_POST['nickname'])) $nickname=getforminput($_POST['nickname']);
			else $nickname='';
			if(isset($_POST['username'])) $username=getforminput($_POST['username']);
			else $username='';
			if(isset($_POST['pwd1'])) $pwd1=getforminput($_POST['pwd1']);
			else $pwd1='';
			if(isset($_POST['pwd2'])) $pwd2=getforminput($_POST['pwd2']);
			else $pwd2='';
			if(isset($_POST['mail'])) $mail=getforminput($_POST['mail']);
			else $mail='';
		
			eval("$register = "".gettemplate("register")."";");
			echo $register;
		}
		else{
			redirect("index.php",str_replace('%pagename%',$GLOBALS['hp_title'],$_language->module['no_register_when_loggedin']),3);
		}
	}
}


?>