diff --git a/phpBB/includes/sessions.php b/phpBB/includes/sessions.php index e25d7561ae..83f42b199a 100644 --- a/phpBB/includes/sessions.php +++ b/phpBB/includes/sessions.php @@ -1,25 +1,25 @@ sql_query($sql); - if (!$result) + if (!$result) { message_die(CRITICAL_ERROR, "Couldn't obtain ban information.", __LINE__, __FILE__, $sql); } @@ -76,7 +76,7 @@ function session_begin($user_id, $user_ip, $page_id, $session_length, $login = 0 // // Check for user and ip ban ... - // + // if($ban_info['ban_ip'] || $ban_info['ban_userid']) { include($phpbb_root_path . 'language/lang_' . $board_config['default_lang'] . '.'.$phpEx); @@ -85,8 +85,8 @@ function session_begin($user_id, $user_ip, $page_id, $session_length, $login = 0 else { /* - $sql = "SELECT COUNT(*) - FROM " . SESSIONS_TABLE . " + $sql = "SELECT COUNT(*) + FROM " . SESSIONS_TABLE . " WHERE session_ip = '$user_ip'"; if($result = $db->sql_query($sql)) { @@ -102,7 +102,7 @@ function session_begin($user_id, $user_ip, $page_id, $session_length, $login = 0 $login = 0; $autologin = 0; } - + // // Try and pull the last time stored // in a cookie, if it exists @@ -118,7 +118,7 @@ function session_begin($user_id, $user_ip, $page_id, $session_length, $login = 0 if(!$result || !$db->sql_affectedrows()) { $session_id = md5(uniqid($user_ip)); - + $sql_insert = "INSERT INTO " . SESSIONS_TABLE . " (session_id, session_user_id, session_start, session_time, session_last_visit, session_ip, session_page, session_logged_in) VALUES ('$session_id', $user_id, $current_time, $current_time, " . $sessiondata['lastvisit'] . ", '$user_ip', $page_id, $login)"; @@ -209,7 +209,7 @@ function session_pagestart($user_ip, $thispage_id, $session_length) if( !empty($session_id) ) { // - // session_id exists so go ahead and attempt to grab all + // session_id exists so go ahead and attempt to grab all // data in preparation // $sql = "SELECT u.*, s.* @@ -218,16 +218,16 @@ function session_pagestart($user_ip, $thispage_id, $session_length) AND s.session_ip = '$user_ip' AND u.user_id = s.session_user_id"; $result = $db->sql_query($sql); - if (!$result) + if (!$result) { message_die(CRITICAL_ERROR, "Error doing DB query userdata row fetch : session_pagestart", __LINE__, __FILE__, $sql); } - + $userdata = $db->sql_fetchrow($result); - + // // Did the session exist in the DB? - // + // if(isset($userdata['user_id'])) { $SID = ($sessionmethod == SESSION_METHOD_GET) ? "sid=" . $session_id : ""; @@ -262,7 +262,7 @@ function session_pagestart($user_ip, $thispage_id, $session_length) // We didn't need to update session // so just return userdata // - + return $userdata; } } @@ -277,14 +277,14 @@ function session_pagestart($user_ip, $thispage_id, $session_length) if( isset($sessiondata['userid']) && isset($sessiondata['autologinid']) ) { $sql = "SELECT user_id, user_autologin_key - FROM " . USERS_TABLE . " + FROM " . USERS_TABLE . " WHERE user_id = " . $sessiondata['userid']; $result = $db->sql_query($sql); - if (!$result) + if (!$result) { message_die(CRITICAL_ERROR, "Error doing DB query userdata row fetch (non-session) : session_pagestart", __LINE__, __FILE__, $sql); } - + $userdata = $db->sql_fetchrow($result); if($userdata['user_autologin_key']) @@ -292,7 +292,7 @@ function session_pagestart($user_ip, $thispage_id, $session_length) if($userdata['user_autologin_key'] == $sessiondata['autologinid']) { // - // We have a match, and not the kind you light ... + // We have a match, and not the kind you light ... // $login = 1; $autologin = 1; @@ -329,7 +329,7 @@ function session_pagestart($user_ip, $thispage_id, $session_length) AND s.session_ip = '$user_ip' AND u.user_id = s.session_user_id"; $result = $db->sql_query($sql); - if (!$result) + if (!$result) { message_die(CRITICAL_ERROR, "Error doing DB query userdata row fetch : session_pagestart new user", __LINE__, __FILE__, $sql); } @@ -346,7 +346,7 @@ function session_pagestart($user_ip, $thispage_id, $session_length) // deleting the corresponding entry // in the sessions table // -function session_end($session_id, $user_id) +function session_end($session_id, $user_id) { global $db, $lang, $board_config; global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID; @@ -376,7 +376,7 @@ function session_end($session_id, $user_id) WHERE (session_id = '" . $session_id . "') AND (session_user_id = $user_id)"; $result = $db->sql_query($sql, $db); - if (!$result) + if (!$result) { message_die(CRITICAL_ERROR, "Couldn't delete user session : session_end", __LINE__, __FILE__, $sql); } @@ -387,7 +387,7 @@ function session_end($session_id, $user_id) SET user_autologin_key = '' WHERE user_id = $user_id"; $result = $db->sql_query($sql, $db); - if (!$result) + if (!$result) { message_die(CRITICAL_ERROR, "Couldn't reset user autologin key : session_end", __LINE__, __FILE__, $sql); } diff --git a/phpBB/language/email/activate_english.tpl b/phpBB/language/email/activate_english.tpl new file mode 100755 index 0000000000..a29ee1306d --- /dev/null +++ b/phpBB/language/email/activate_english.tpl @@ -0,0 +1,7 @@ +Your account on {SITENAME} has been deactivated, most likily due to changes +made to your profile. In order to reactivate your account you must click +on the link below: + +{U_ACTIVATE} + +{EMAIL_SIG} \ No newline at end of file diff --git a/phpBB/language/lang_english.php b/phpBB/language/lang_english.php index 3cb808dfa1..1b8d131f09 100755 --- a/phpBB/language/lang_english.php +++ b/phpBB/language/lang_english.php @@ -426,6 +426,7 @@ $lang['Avatar_imagesize'] = "The avatar must be less than " . $board_config['ava $lang['Account_added'] = "Thank you for registering, your account has been created. You may now login with your username and password"; $lang['Account_inactive'] = "Your account has been created. However, this forum requires account activation, an activation key has been sent to the email address you provided. Pease check your email for further information"; $lang['Account_active'] = "Your account has now been activated. Thank you for registering"; +$lang['Reactivate'] = "Reactivate your account!"; $lang['Welcome_subject'] = "Welcome to " . $board_config['sitename'] . " Forums"; diff --git a/phpBB/profile.php b/phpBB/profile.php index a27fb4a021..3c778d7d91 100644 --- a/phpBB/profile.php +++ b/phpBB/profile.php @@ -246,6 +246,7 @@ if(isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode'])) if($mode == "editprofile") { $user_id = $HTTP_POST_VARS['user_id']; + $current_email = trim(strip_tags(htmlspecialchars($HTTP_POST_VARS['current_email']))); } $username = (!empty($HTTP_POST_VARS['username'])) ? trim(strip_tags(htmlspecialchars($HTTP_POST_VARS['username']))) : ""; $email = (!empty($HTTP_POST_VARS['email'])) ? trim(strip_tags(htmlspecialchars($HTTP_POST_VARS['email']))) : ""; @@ -646,12 +647,50 @@ if(isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode'])) { if($mode == "editprofile") { + if($email != $current_email && $board_config['require_activation']) + { + $user_active = 0; + $user_actkey = generate_activation_key(); + + // + // The user is inactive, remove their session forcing them to login again befor they can post. + // + $sql = "DELETE FROM " . SESSIONS_TABLE . " + WHERE session_user_id = " . $userdata['user_id']; + + $db->sql_query($sql); + + } + else + { + $user_active = 1; + $user_actkey = ""; + } + $sql = "UPDATE " . USERS_TABLE . " - SET " . $username_sql . $passwd_sql . "user_email = '$email', user_icq = '$icq', user_website = '$website', user_occ = '$occupation', user_from = '$location', user_interests = '$interests', user_sig = '$signature', user_viewemail = $viewemail, user_aim = '$aim', user_yim = '$yim', user_msnm = '$msn', user_attachsig = $attachsig, user_allowsmile = $allowsmilies, user_allowhtml = $allowhtml, user_allowbbcode = $allowbbcode, user_allow_viewonline = $allowviewonline, user_notify_pm = $notifypm, user_timezone = $user_timezone, user_dateformat = '$user_dateformat', user_lang = '$user_lang', user_template = '$user_template', user_theme = $user_theme" . $avatar_sql . " + SET " . $username_sql . $passwd_sql . "user_email = '$email', user_icq = '$icq', user_website = '$website', user_occ = '$occupation', user_from = '$location', user_interests = '$interests', user_sig = '$signature', user_viewemail = $viewemail, user_aim = '$aim', user_yim = '$yim', user_msnm = '$msn', user_attachsig = $attachsig, user_allowsmile = $allowsmilies, user_allowhtml = $allowhtml, user_allowbbcode = $allowbbcode, user_allow_viewonline = $allowviewonline, user_notify_pm = $notifypm, user_timezone = $user_timezone, user_dateformat = '$user_dateformat', user_lang = '$user_lang', user_template = '$user_template', user_active = $user_active, user_actkey = '$user_actkey', user_theme = $user_theme" . $avatar_sql . " WHERE user_id = $user_id"; if($result = $db->sql_query($sql)) { + if($user_active == 0) + { + // + // The users account has been deactivated, send them an email with a new activation key + // + $email_headers = "From: " . $board_config['board_email_from'] . "\r\n"; + + $emailer->use_template("activate"); + $emailer->email_address($email); + $emailer->set_subject($lang['Reactivate']); + $emailer->extra_headers($email_headers); + + $emailer->assign_vars(array("SITENAME" => $board_config['sitename'], + "U_ACTIVATE" => "http://".$SERVER_NAME.$PHP_SELF."?mode=activate&act_key=$user_actkey", + "EMAIL_SIG" => $board_config['board_email'])); + $emailer->send(); + $emailer->reset(); + } message_die(GENERAL_MESSAGE, $lang['Profile_updated']); } else @@ -730,7 +769,7 @@ if(isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode'])) $emailer->assign_vars(array("WELCOME_MSG" => $lang['Welcome_subject'], "USERNAME" => $username, "PASSWORD" => $password_confirm, - "ACTIVATE_URL" => "http://".$SERVER_NAME."/".$PHP_SELF."?mode=activate&act_key=$act_key", + "ACTIVATE_URL" => "http://".$SERVER_NAME.$PHP_SELF."?mode=activate&act_key=$act_key", "EMAIL_SIG" => $board_config['board_email'])); $emailer->send(); $emailer->reset(); @@ -819,6 +858,9 @@ if(isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode'])) if($mode == "editprofile") { $s_hidden_fields .= ''; + // Send the users current email address. If they change it, and account activation is turned on + // the user account will be disabled and the user will have to reactivate their account. + $s_hidden_fields .= ''; } $template->set_filenames(array(