<?php session_start();
/* * ********************************************************************
*  Copyright notice PHP Enter
*
*  (c) 2011 Predrag Rukavina - admin[at]phpenter[dot]net
*  All rights reserved
*
*  This script is part of the PHP Enter project. 
*  The PHP Enter project is free software; you can redistribute it and/or
*  modify it under the terms of the GNU General Public License
*  as published by the Free Software Foundation; either version 2
*  of the License, or (at your option) any later version.
*
*  This program is distributed in the hope that it will be useful,
*  but WITHOUT ANY WARRANTY; without even the implied warranty of
*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
*  GNU General Public License for more details.
*
*  You should have received a copy of the GNU General Public License
*  along with this program; if not, write to the Free Software
*  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
*  MA  02110-1301, USA.
*
*  This copyright notice MUST appear in all copies of the script!
* ********************************************************************** */
include ('settings.php');
require_once ('salt.php');
require_once ('classes/securesession.class.php');
enterLogin($salt);
$ac = $conn->Execute('SELECT * FROM categori ORDER BY name ASC');
if(!$ac)
 print $conn->ErrorMsg();
else
 while(!$ac->EOF) {
  if($ac->fields['cord'] == 0) {
   $categori[] = $ac->fields;
  } else {
   $subcat[] = $ac->fields;
  }
  $ac->MoveNext();
 }
$smarty->assign('categori',$categori);
$smarty->assign('subcat',@$subcat);
$smarty->display('blank.php');
echo '<div class="ten">';
echo '<div class="main">';
if(!@$_SESSION['inecsess']) {
 echo "<div class='errors'>$lang[176]</div></div></div>";
 $smarty->display('footer.php');
 die();
}
$shouter = @$_SESSION['INC_USER_ID'];
?>
<div class="ten">
<div class="linkpanel">
<div class="five column">
<div class="ten">
<?php $ad = $conn->Execute('SELECT * FROM users WHERE usid = ?',array($shouter));
if(!$ad)
 print $conn->ErrorMsg();
else
 while(!$ad->EOF) {
  $fullname = $ad->fields['fullname'];
  $username = $ad->fields['username'];
  $homep = $ad->fields['homep'];
  $biosi = $ad->fields['biosi'];
  $thumbs = $ad->fields['thumbs'];
  $ad->MoveNext();
 }
?>
<div class="ten column marginTop">
<div class="nine"><div class="rightheader"><?php echo $lang['177']; ?></div></div>
<div class="one">
<?php if(!isset($_POST['query'])) {
 if($thumbs == true) { ?>
<img src="maxthumb/<?php echo $thumbs ?>" alt="img" width="50" height="50" />
<?php  } else { ?>
<?php  }
}
?>
</div>
</div>
<?php
if(isset($_POST['query'])) {
 if(get_magic_quotes_gpc()) {
  $fullname = htmlspecialchars(stripslashes($_POST['fullname']));
  $homep = htmlspecialchars(stripslashes($_POST['homep']));
  $biosi = htmlspecialchars(stripslashes($_POST['biosi']));
 } else {
  $fullname = htmlspecialchars($_POST['fullname']);
  $homep = htmlspecialchars($_POST['homep']);
  $biosi = htmlspecialchars($_POST['biosi']);
 }
 $first = array('onload','onclick','javascript','script');
 $second = array('-','-','-','-');
 $fullname = str_replace($first,$second,$fullname);
 $biosi = str_replace($first,$second,$biosi);
 @$checkpass = $_POST['checkpass'];
 if($checkpass == 1) {
  if(get_magic_quotes_gpc()) {
   $oldpass = htmlspecialchars(stripslashes($_POST['oldpass']));
   $newpass = htmlspecialchars(stripslashes($_POST['newpass']));
  } else {
   $oldpass = htmlspecialchars($_POST['oldpass']);
   $newpass = htmlspecialchars($_POST['newpass']);
  }
  if(strlen($oldpass) < 5) {
   echo "<div class='errors'>$lang[284] <a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
  if(strlen($oldpass) > 25) {
   echo "<div class='errors'>$lang[282] <a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
  if(strlen($newpass) < 5) {
   echo "<div class='errors'>$lang[285] <a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
  if(strlen($newpass) > 25) {
   echo "<div class='errors'>$lang[283] <a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
  if(preg_match("/\\s/",$newpass)) {
   echo "<div class='errors'>$lang[289] <a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
  $newpass = md5($newpass);
  $oldpass = md5($oldpass);
  $sql = $conn->Prepare('UPDATE IGNORE users SET password = '.$conn->qstr($newpass).' WHERE usid = '.$conn->qstr($shouter).' and password = '.$conn->qstr($oldpass).'');
  if($conn->Execute($sql) === false) {
   print '<div class="errors">'.$conn->ErrorMsg().'</div>';
  }
  if($conn->affected_rows() == 0) {
   echo "<div class='errors'>$lang[286] <a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  } else {
   session_unset();
   session_destroy();
   $_SESSION = array();
   echo "<div class='info'>$lang[287]</div></div></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
 }
 @$myoption = $_POST['myoption'];
 if($myoption == 1) {
  $file = $thumbs;
  $file1 = $thumbs;
  $file = "uploads/".$file;
  $file1 = "maxthumb/".$file1;
  @unlink($file);
  @unlink($file1);
 }
 if(strlen($homep) > 100) {
  echo "<div class='errors'>$lang[186]&nbsp;<a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
  $smarty->display('footer.php');
  die();
 }
 if(strlen($homep) > 0) {
  if(!preg_match("/^(https?:\/\/+[\w\-]+\.[\w\-]+)/i",$homep)) {
   echo "<div class='errors'>$lang[187]&nbsp;<a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
 }
 if(strlen($biosi) > 2000) {
  echo "<div class='errors'>$lang[188])&nbsp;<a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
  $smarty->display('footer.php');
  die();
 }
 if(strlen($fullname) > 85) {
  echo "<div class='errors'>$lang[189]&nbsp;<a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
  $smarty->display('footer.php');
 }
 if($_FILES['image']['name'] == "") {
  $newimage = "";
 } else {
  $current_image = $_FILES['image']['name'];
  $extension = substr(strrchr($current_image,'.'),1);
  if(($extension != "jpg") && ($extension != "jpeg") && ($extension != "JPG") && ($extension != "png") && ($extension != "gif")) {
   echo "<div class='errors'>$lang[190] <a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
  $time = date("ymdHis");
  $newimage = $time.".".$extension;
  $destination = "uploads/".$newimage;
  $action = copy($_FILES['image']['tmp_name'],$destination);
  $image_info = getimagesize($_FILES['image']['tmp_name']);
  if($image_info == false) {
   echo "<div class='errors'>$lang[190] <a href='link.php'>$lang[135]</a></div></div></div></div></div></div>";
   die();
  }
  enterProfilePic($destination,'maxthumb/'.$newimage,50,50);
 }
 if($myoption == 1) {
  $sql = $conn->Prepare('UPDATE users SET fullname = '.$conn->qstr($fullname).', homep = '.$conn->qstr($homep).', biosi = '.$conn->qstr($biosi).',
thumbs = '.$conn->qstr($newimage).' WHERE usid = '.$conn->qstr($shouter).'');
  if($conn->Execute($sql) === false) {
   print '<div class="errors">'.$conn->ErrorMsg().'</div>';
  }
  $sql2 = $conn->Prepare('UPDATE reviews SET userpic = '.$conn->qstr($newimage).' WHERE userid = '.$conn->qstr($shouter).'');
  if($conn->Execute($sql2) === false) {
   print '<div class="errors">'.$conn->ErrorMsg().'</div>';
  }
  $sql6 = $conn->Prepare('UPDATE newser SET userpic = '.$conn->qstr($newimage).' WHERE userid = '.$conn->qstr($shouter).'');
  if($conn->Execute($sql6) === false) {
   print '<div class="errors">'.$conn->ErrorMsg().'</div>';
  }
  unset($_SESSION['INC_USER_THUMB']);
  $_SESSION['INC_USER_THUMB'] = $newimage;
 } else {
  $sql = $conn->Prepare('UPDATE users SET fullname = '.$conn->qstr($fullname).', homep = '.$conn->qstr($homep).', biosi = '.$conn->qstr($biosi).'
    WHERE usid = '.$conn->qstr($shouter).'');
  if($conn->Execute($sql) === false) {
   print '<div class="errors">'.$conn->ErrorMsg().'</div>';
  }
 }
 echo "<div class ='ten column'><div class ='info'>$lang[196] <a href='link.php'>$lang[222]</a></div></div>";
}
?>
<div class="ten">
<form method="post" enctype="multipart/form-data" action="link.php">
<div class="ten column">
<label><?php echo $lang['179']; ?></label>
<input type="text" name="fullname" class="input" value="<?php echo $fullname ?>" />
</div>
<div class="ten column">
<label><?php echo $lang['178']; ?></label>
<input type="text" name="homep" class="input" value="<?php echo $homep ?>" />
</div>
<div class="ten column">
<label><?php echo $lang['180']; ?></label>
<textarea name="biosi"><?php echo $biosi; ?></textarea>
</div>
<div class="ten column marginTop">
<div class="rightheader"><?php echo $lang['181']; ?></div>
</div>
<div class="ten column">
<div class="six">
<input type="checkbox" name="myoption" value="1" /> <?php echo $lang['182']; ?>
</div>
<div class="four">
<input type="file" name="image" />
</div>
</div>
<div class="ten column marginTop">
<div class="rightheader"><?php echo $lang['279']; ?></div>
</div>
<div class="ten column">
<input class="check" type="checkbox" name="checkpass" value="1" /> <?php echo $lang['288']; ?>
</div>
<div class="ten column">
<label><?php echo $lang['280']; ?></label>
<input type="password" name="oldpass" class="input" data-validation="length" data-validation-length="5-30" data-validation-optional="true" />
</div>
<div class="ten column">
<label><?php echo $lang['281']; ?></label>
<input type="password" name="newpass" class="input" data-validation="length" data-validation-length="5-30" data-validation-optional="true" />
</div>
<div class="ten column">
<input type="submit" value="<?php echo $lang['130']; ?>" name="query" class="medium blue button" />
</div>
</form>
<script src="<?php echo $sitepath; ?>/scripts/jquery.form-validator.min.js"></script>
<script>
  $.validate();
</script>
</div>
</div>
</div>
<div class="five column">
<script>
function goto(site) {
var msg = confirm("<?php echo $lang['192'] ?>")
if (msg) {window.location.href = site}
else (null)
}
</script>
<div class="ten column">
<div class="rightheader"><?php echo $lang['193'] ?></div>
</div>
<?php
if(isset($_GET['ref'])) {
 $id = $_GET['id'];
 $comy = $_GET['comy'];
 $sql = $conn->Prepare('DELETE FROM newser WHERE newsid = '.$conn->qstr($id).'');
 if($conn->Execute($sql) === false) {
  print '<div class="errors">'.$conn->ErrorMsg().'</div>';
 }
 $sql3 = $conn->Prepare('DELETE FROM reviews WHERE comrev = '.$conn->qstr($comy).'');
 if($conn->Execute($sql3) === false) {
  print '<div class="errors">'.$conn->ErrorMsg().'</div>';
 }
 if(isset($_GET['file'])) {
  $file = $_GET['file'];
  $file1 = $_GET['file'];
  $file2 = $_GET['file'];
  $file = "uploads/".$file;
  $file1 = "maxthumb/".$file1;
  $file2 = "minthumb/".$file2;
  @unlink($file);
  @unlink($file1);
  @unlink($file2);
 }
 echo "<div class ='info'>$lang[196]</div>";
}
$ae = $conn->Execute('SELECT * FROM newser where userid = ? ORDER by newsid desc',array($shouter));
if ($ae->fields == 0) {
  echo "<div class ='info'>$lang[291]</div>";
}
if(!$ae)
 print $conn->ErrorMsg();
else
 while(!$ae->EOF) {
?>
<div class="ten column">
<?php echo $ae->fields['title']; ?>
</div>
<div class="ten column">
<?php if($ae->fields['main'] == '4'){ ?><span class="draft">[<?php echo $lang['245']; ?>]</span> <?php } ?><a href="edit.php?id=<?php echo $ae->fields['newsid']; ?>">[<?php echo $lang['194']; ?>]</a> <a href="javascript:goto('link.php?id=<?php echo $ae->fields['newsid']; ?>&file=<?php echo $ae->fields['image']; ?>&ref=1&comy=<?php echo $ae->fields['univer']; ?>')">[<?php echo $lang['195']; ?>]</a>
</div>
<?php
$ae->MoveNext();
 }
?>
</div>
</div>
</div>
</div>
</div>
<?php
$smarty->display('footer.php');
$conn->Close();
######################################
##link.php                      BETA##
######################################
?>