<?
include_once("./_common.php");
include_once("$g4[path]/lib/mailer.lib.php");

/*
// 081022 : CSRF token比较没有意义
// 所以注释掉
if ($_POST["token"] && get_session("ss_token") == $_POST["token"]) 
{
    // 如果缓存对比错误
    //if (!get_cookie($_POST["token"])) alert_close("缓存错误");

    // 如果缓存对比成功
    set_session("ss_token", "");
    set_cookie($_POST["token"], 0, 0);
} 
else 
{
    alert_close("token error");
    exit;
}
*/

// 检查
//referer_check();

if (!($w == "" || $w == "u")) 
    alert("W值传递错误！程序终止！");

if ($w == "u" && $is_admin == "super") {
    if (file_exists("$g4[path]/DEMO")) 
        alert("现在站点属于演示运行中，部分功能受限！");
}

// 认证码
//include_once ("./norobot_check.inc.php");

$key = get_session("captcha_keystring");
if (!($key && $key == $_POST[wr_key])) {
    session_unregister("captcha_keystring");
    alert("非正常访问！程序终止！");
}

$mb_id = trim(strip_tags(mysql_escape_string($_POST[mb_id])));
$mb_password = trim(mysql_escape_string($_POST[mb_password]));
$mb_name = trim(strip_tags(mysql_escape_string($_POST[mb_name])));
$mb_nick = trim(strip_tags(mysql_escape_string($_POST[mb_nick])));
$mb_email = trim(strip_tags(mysql_escape_string($_POST[mb_email])));
$mb_homepage = trim(strip_tags(mysql_escape_string($_POST[mb_homepage])));

if ($w == '' || $w == 'u') 
{
    if (!$mb_id) alert('用户名传递错误！');
    if ($w == '' && !$mb_password) alert('登录密码传递错误！');
    if (!$mb_name) alert('会员姓名传递错误！');
    if (!$mb_nick) alert('昵称传递错误！');
    if (!$mb_email) alert('E-mail地址传递错误！');

    if (preg_match("/[\,]?{$mb_id}/i", $config[cf_prohibit_id]))
        alert("\'$mb_id\' 已被禁止作为用户名注册！");

    if (preg_match("/[\,]?{$mb_nick}/i", $config[cf_prohibit_id]))
        alert("\'$mb_nick\' 已被禁止作为昵称注册！");

    // 姓名必须是中文
    if (!check_string($mb_name, _G4_CHN_)) 
        alert('姓名选项必须填写中文姓名');

    // 昵称必须使用中文，英文，数字
    if (!check_string($mb_nick, _G4_CHN_ + _G4_ALPHABETIC_ + _G4_NUMERIC_))
        alert('昵称必须使用中文、英文或数字');

    if ($w=='')
    {
        if (strtolower($mb_id) == strtolower($mb_recommend)) alert('您不能推荐自己');

        $sql = " select count(*) as cnt from $g4[member_table] where mb_nick = '$mb_nick' ";
        $row = sql_fetch($sql);
        if ($row[cnt])
            alert("\'$mb_nick\' 已被其他会员注册使用！");

        $sql = " select count(*) as cnt from $g4[member_table] where mb_email = '$mb_email' ";
        $row = sql_fetch($sql);
        if ($row[cnt])
            alert("\'$mb_email\' 已被其他会员注册使用！");

        // 解决身份认证后直接返回后出现同一身份证注册的问题 (letsgolee 提供 09.06.16)
        if ($config[cf_use_jumin]) {
            $row = sql_fetch(" select mb_name from $g4[member_table] where mb_jumin = '$mb_jumin' ");
            if ($row[mb_name]) {
                if ($row[mb_name] == $mb_name)
                    alert("已有相同身份信息注册！");
                else
                    alert("已有其他会员使用相同身份证信息注册！\\n\\n请与客服联系！");
            }
        }
    }
    else
    {
        // 防止使用js修改
        // 如果还没有到可以修改昵称的时间
        if ($member[mb_nick_date] > date("Y-m-d", $g4[server_time] - ($config[cf_nick_modify] * 86400)))
            $mb_nick = $member[mb_nick];
        // 比较
        $old_email = $member[mb_email];

        $sql = " select count(*) as cnt from $g4[member_table] where mb_nick = '$mb_nick' and mb_id <> '$mb_id' ";
        $row = sql_fetch($sql);
        if ($row[cnt])
            alert("\'$mb_nick\'已被其他用户注册使用！");

        $sql = " select count(*) as cnt from $g4[member_table] where mb_email = '$mb_email' and mb_id <> '$mb_id' ";
        $row = sql_fetch($sql);
        if ($row[cnt])
            alert("\'$mb_email\' 已被其他用户注册使用！");
    }
}

$mb_dir = "$g4[path]/data/member/".substr($mb_id,0,2);

// 删除头像
if ($del_mb_icon)
    @unlink("$mb_dir/$mb_id.gif");

$msg = "";

// 上传头像
$mb_icon = "";
if (is_uploaded_file($_FILES[mb_icon][tmp_name])) 
{
    if (preg_match("/(\.gif)$/i", $_FILES[mb_icon][name])) 
    {
        // 只允许上传指定容量以下的头像文件
        if ($_FILES[mb_icon][size] <= $config[cf_member_icon_size]) 
        {
            @mkdir($mb_dir, 0707);
            @chmod($mb_dir, 0707);
            $dest_path = "$mb_dir/$mb_id.gif";
            move_uploaded_file($_FILES[mb_icon][tmp_name], $dest_path);
            chmod($dest_path, 0606);
            if (file_exists($dest_path)) 
            {
                //=================================================================\
                // 090714
                // 防止在Gif文件中插入木马
                // 不显示错误信息！
                //-----------------------------------------------------------------
                $size = getimagesize($dest_path);
                if ($size[2] != 1) // 如果上传后被判断为不是Gif文件就直接删除
                    @unlink($dest_path);
                else
                // 头像文件超过指定像素就直接删除
                if ($size[0] > $config[cf_member_icon_width] || $size[1] > $config[cf_member_icon_height])
                    @unlink($dest_path);
                //=================================================================\
            }
        }
    }
    else
        $msg .= $_FILES[mb_icon][name] . "不是有效的Gif文件格式！";
}


// 管理员信息
$admin = get_admin('super');


if ($w == "") 
{
    $mb = get_member($mb_id);
    if ($mb[mb_id]) 
        alert("已被注册使用的用户名！");

    $sql = " insert into $g4[member_table]
                set mb_id = '$mb_id',
                    mb_password = '".sql_password($mb_password)."',
                    mb_name = '$mb_name',
                    mb_jumin = '$mb_jumin',
                    mb_sex = '$mb_sex',
                    mb_birth = '$mb_birth',
                    mb_nick = '$mb_nick',
                    mb_nick_date = '$g4[time_ymd]',
                    mb_password_q = '$mb_password_q',
                    mb_password_a = '$mb_password_a',
                    mb_email = '$mb_email',
                    mb_homepage = '$mb_homepage',
                    mb_tel = '$mb_tel',
                    mb_hp = '$mb_hp',
                    mb_zip1 = '$mb_zip1',
                    mb_addr1 = '$mb_addr1',
                    mb_signature = '$mb_signature',
                    mb_profile = '$mb_profile',
                    mb_today_login = '$g4[time_ymdhis]',
                    mb_datetime = '$g4[time_ymdhis]',
                    mb_ip = '$_SERVER[REMOTE_ADDR]',
                    mb_level = '$config[cf_register_level]',
                    mb_recommend = '$mb_recommend',
                    mb_login_ip = '$_SERVER[REMOTE_ADDR]',
                    mb_mailling = '$mb_mailling',
                    mb_sms = '$mb_sms',
                    mb_open = '$mb_open',
                    mb_open_date = '$g4[time_ymd]',
                    mb_1 = '$mb_1',
                    mb_2 = '$mb_2',
                    mb_3 = '$mb_3',
                    mb_4 = '$mb_4',
                    mb_5 = '$mb_5',
                    mb_6 = '$mb_6',
                    mb_7 = '$mb_7',
                    mb_8 = '$mb_8',
                    mb_9 = '$mb_9',
                    mb_10 = '$mb_10' ";
    // 如果没有开启邮件地址认证就直接进行认证时间标识
    if (!$config[cf_use_email_certify])
        $sql .= " , mb_email_certify = '$g4[time_ymdhis]' ";
    sql_query($sql);

    // 会员注册后赠送积分
    insert_point($mb_id, $config[cf_register_point], "注册会员", '@member', $mb_id, '注册会员');

    // 推荐人赠送积分
    if ($config[cf_use_recommend] && $mb_recommend)
        insert_point($mb_recommend, $config[cf_recommend_point], "{$mb_id}注册推荐积分", '@member', $mb_recommend, "{$mb_id} 推荐");

    // 发送邮件
    if ($config[cf_email_mb_member]) 
    {
        $subject = "感谢您注册成为会员！";

        $mb_md5 = md5($mb_id.$mb_email.$g4[time_ymdhis]);
        $certify_href = "$g4[url]/$g4[bbs]/email_certify.php?mb_id=$mb_id&mb_md5=$mb_md5";
        
        ob_start();
        include_once ("./register_form_update_mail1.php");
        $content = ob_get_contents();
        ob_end_clean();
        
        mailer($admin[mb_nick], $admin[mb_email], $mb_email, $subject, $content, 1);
    }

    // 通知管理员
    if ($config[cf_email_mb_super_admin]) 
    {
        $subject = $mb_nick . " 注册成为了会员";
        
        ob_start();
        include_once ("./register_form_update_mail2.php");
        $content = ob_get_contents();
        ob_end_clean();

        mailer($mb_nick, $mb_email, $admin[mb_email], $subject, $content, 1);
    }

    // 如果没有开启邮件认证时登录
    if (!$config[cf_use_email_certify]) 
        set_session("ss_mb_id", $mb_id);

    set_session("ss_mb_reg", $mb_id);
} 
else if ($w == "u") 
{
    if (!trim($_SESSION["ss_mb_id"]))
        alert("尚未登录，请您登录后使用！");

    if ($_SESSION["ss_mb_id"] != $_POST[mb_id])
        alert("登录信息与修改信息不符！\\n\\n由于非正常操作程序自动终止！");

    $sql_password = "";
    if ($mb_password)
        $sql_password = " , mb_password = '".sql_password($mb_password)."' ";

    $sql_icon = "";
    if ($mb_icon)
        $sql_icon = " , mb_icon = '$mb_icon' ";

    $sql_nick_date = "";
    if ($mb_nick_default != $mb_nick)
        $sql_nick_date =  " , mb_nick_date = '$g4[time_ymd]' ";

    $sql_open_date = "";
    if ($mb_open_default != $mb_open)
        $sql_open_date =  " , mb_open_date = '$g4[time_ymd]' ";

    $sql_sex = "";
    if (isset($mb_sex))
        $sql_sex = " , mb_sex = '$mb_sex' ";

    // 邮件地址更改后需要重新进行认证，所以删除标识
    $sql_email_certify = "";
    if ($old_email != $mb_email && $config[cf_use_email_certify])
        $sql_email_certify = " , mb_email_certify = '' ";

                // set mb_name         = '$mb_name', 删除
    $sql = " update $g4[member_table]
                set mb_nick         = '$mb_nick',
                    mb_password_q   = '$mb_password_q',
                    mb_password_a   = '$mb_password_a',
                    mb_mailling     = '$mb_mailling',
                    mb_sms          = '$mb_sms',
                    mb_open         = '$mb_open',
                    mb_email        = '$mb_email',
                    mb_homepage     = '$mb_homepage',
                    mb_tel          = '$mb_tel',
                    mb_hp           = '$mb_hp',
                    mb_zip1         = '$mb_zip1',
                    mb_addr1        = '$mb_addr1',
                    mb_signature    = '$mb_signature',
                    mb_profile      = '$mb_profile',
                    mb_1            = '$mb_1',
                    mb_2            = '$mb_2',
                    mb_3            = '$mb_3',
                    mb_4            = '$mb_4',
                    mb_5            = '$mb_5',
                    mb_6            = '$mb_6',
                    mb_7            = '$mb_7',
                    mb_8            = '$mb_8',
                    mb_9            = '$mb_9',
                    mb_10           = '$mb_10'
                    $sql_password 
                    $sql_icon 
                    $sql_nick_date
                    $sql_open_date
                    $sql_sex
                    $sql_email_certify
              where mb_id = '$_POST[mb_id]' ";
    sql_query($sql);

    // 发送邮件地址认证邮件
    if ($old_email != $mb_email && $config[cf_use_email_certify])
    {
        $subject = "邮件地址认证！";

        $mb_md5 = md5($mb_id.$mb_email.$member[mb_datetime]);
        $certify_href = "$g4[url]/$g4[bbs]/email_certify.php?mb_id=$mb_id&mb_md5=$mb_md5";
        
        ob_start();
        include_once ("./register_form_update_mail3.php");
        $content = ob_get_contents();
        ob_end_clean();
        
        mailer($admin[mb_nick], $admin[mb_email], $mb_email, $subject, $content, 1);
    }
}


// 执行用户自定义代码
@include_once ("$g4[path]/skin/member/$config[cf_member_skin]/register_update.skin.php");


if ($msg) 
    echo "<script type='text/javascript'>alert('{$msg}');</script>";

/* 如果有安全认证服务器的话..
// 结果页面需要将 https 转换为 http 
if ($g4[https_url])
    $https_url = "$g4[https_url]/$g4[bbs]";
else
    $https_url = ".";
*/

$https_url = "$g4[url]/$g4[bbs]";

if ($w == "") {
    goto_url("{$https_url}/register_result.php");
} else if ($w == "u") {
    $row  = sql_fetch(" select mb_password from $g4[member_table] where mb_id = '$member[mb_id]' ");
    $tmp_password = $row['mb_password'];

    if ($old_email != $mb_email && $config[cf_use_email_certify]) {
        set_session("ss_mb_id", "");
        alert("会员资料编辑成功！\\n\\n由于更换了邮件地址，请重新进行邮件地址认证！", $g4[path]);
    } else {
        echo "
        <html><title>账户编辑</title><meta http-equiv='Content-Type' content='text/html; charset=$g4[charset]'></html><body> 
        <form name='fregisterupdate' method='post' action='{$https_url}/register_form.php'>
        <input type='hidden' name='w' value='u'>
        <input type='hidden' name='mb_id' value='{$mb_id}'>
        <input type='hidden' name='mb_password' value='{$tmp_password}'>
        <input type='hidden' name='is_update' value='1'>
        </form>
        <script type='text/javascript'>
        alert('会员资料编辑成功！');
        document.fregisterupdate.submit();
        </script>
        </body>
        </html>";
    }
}
?>
