<?php
include("require.php");
if(!isset($_COOKIE["core_user_name"]))
  Header("Location: login.php?action=login&last=user.php");
else
{
  $phpcolor->table=$core_mysql_prefix."user";
  $phpcolor->field="*";
  $phpcolor->where="username = '".$_COOKIE['core_user_name']."'";
  $user=$phpcolor->exist(1);
  if($_GET['action']=="basicsubmit")
  {
    if(md5(md5($_POST['passwd']).$core_scode) != $_COOKIE["core_user_passwd"])
      die("0");
	elseif(strlen($_POST['signature']) > $core_signlong)
      die("1");
    else
    {
	  $_POST['signature']=html_replace(autolink($_POST['signature']));
      $_POST['introduction']=html_replace(autolink(nl2br($_POST['introduction'])));
	  $_POST['email']=bn_replace($_POST['email']);
	  $_POST['userfrom']=bn_replace($_POST['userfrom']);
	  $_POST['age']=bn_replace($_POST['age']);
	  $_POST['sex']=bn_replace($_POST['sex']);
	  $_POST['birthday']=bn_replace($_POST['birthday']);
	  $_POST['blood']=bn_replace($_POST['blood']);
	  $_POST['zodiac']=bn_replace($_POST['zodiac']);
	  $_POST['constellation']=bn_replace($_POST['constellation']);
	  $_POST['school']=bn_replace($_POST['school']);
	  $_POST['profession']=bn_replace($_POST['profession']);
	  $_POST['qq']=bn_replace($_POST['qq']);
	  $_POST['mobile']=bn_replace($_POST['mobile']);
	  $_POST['phone']=bn_replace($_POST['phone']);
	  $phpcolor->field="email = '".$_POST['email']."',userfrom = '".$_POST['userfrom']."',age = '".$_POST['age']."',sex = '".$_POST['sex']."',birthday = '".$_POST['birthday']."',blood = '".$_POST['blood']."',zodiac = '".$_POST['zodiac']."',constellation = '".$_POST['constellation']."',school = '".$_POST['school']."',profession = '".$_POST['profession']."',qq = '".$_POST['qq']."',mobile = '".$_POST['mobile']."',phone = '".$_POST['phone']."',signature = '".$_POST['signature']."',introduction = '".$_POST['introduction']."',userfriendp = '".$_POST['userfriendp']."',istyle = '".$_POST['istyle']."'";
      $phpcolor->upgrade();
      die("2");
    }
  }
  elseif($_GET['action']=="safetysubmit")
  {
    if($_POST['new_safemail']=="")
      $_POST['new_safemail']=$user["safemail"];
    if($_POST['new_question']=="")
      $_POST['new_question']=$user["question"];
    if($_POST['new_answer']=="")
      $_POST['new_answer']=$user["answer"];
    if($_POST['new_passwd']=="")
    {
      $_POST['new_passwd']=$_POST['passwd'];
	  $_POST['new_passwdy']=$_POST['passwd'];
    }
    if(md5(md5($_POST['passwd']).$core_scode) != $_COOKIE["core_user_passwd"])
      die("0");
    elseif($_POST['safemail'] != $user["safemail"] or $_POST['answer'] != $user["answer"])
      die("1"); 
    elseif(strlen($_POST['new_passwd'])<$core_pwdshort or strlen($_POST['new_passwd'])>$core_pwdlong)
      die("2");
    elseif($_POST['new_passwd']!= $_POST['new_passwdy'])
      die("3");
    elseif(!ereg("^[_\.0-9a-z-]+@([0-9a-z][0-9a-z-]+\.)+[a-z]{2,3}$",$_POST['new_safemail']))
      die("4");
    else
    {
	  $new_passwd = md5($_POST['new_passwd']);
	  $phpcolor->field="safemail = '".$_POST['new_safemail']."',question = '".$_POST['new_question']."',answer = '".$_POST['new_answer']."',passwd='".$new_passwd."'";
      $phpcolor->upgrade();
      die("5");
    }
  }
  elseif($_GET['action']=="applyok")
  {
    submitfilter(1,$_GET['id']);
    $phpcolor->table=$core_mysql_prefix."apply_user";
    $phpcolor->where="id = '".$_GET['id']."'";
    $friendsapply=$phpcolor->exist(1);
	$phpcolor->delete();
	$phpcolor->table=$core_mysql_prefix."user";
	$phpcolor->field="id";
	$phpcolor->where="username = '".$friendsapply['username']."'";
	$aid=$phpcolor->exist(1);
	$phpcolor->where="username = '".$friendsapply['object']."'";
	$bid=$phpcolor->exist(1);
	$phpcolor->table=$core_mysql_prefix."user_friends";
	$phpcolor->field="uid, did";
    $phpcolor->where="'".$aid['id']."','".$bid['id']."'";
    $phpcolor->write();
	$phpcolor->table=$core_mysql_prefix."user_friends";
	$phpcolor->field="uid, did";
    $phpcolor->where="'".$bid['id']."','".$aid['id']."'";
    $phpcolor->write();
	$time=date('Y-m-d H:i:s',strtotime(date('Y-m-d H:i:s'))+$core_time*60*60);
    $phpcolor->table=$core_mysql_prefix."message";
    $phpcolor->field="theme, content, addresser, addressee, sent, type";
    $phpcolor->where="'您的好友申请已通过', '".$friendsapply['object']."已接受您的好友申请。', '".$email_addresser."', '".$friendsapply['username']."', '".$time."', '2'";
    $phpcolor->write();
	Header("Location: user.php?action=friendsapply");
  }
  elseif($_GET['action']=="applyno")
  {
    submitfilter(1,$_GET['id']);
    $phpcolor->table=$core_mysql_prefix."apply_user";
    $phpcolor->where="id = '".$_GET['id']."'";
	$friendsapply=$phpcolor->exist(1);
	$phpcolor->delete();
	$phpcolor->table=$core_mysql_prefix."message";
    $phpcolor->field="theme, content, addresser, addressee, sent, type";
    $phpcolor->where="'您的好友申请被拒绝', '".$friendsapply['object']."拒绝了您的好友申请。', '".$email_addresser."', '".$friendsapply['username']."', '".$time."', '2'";
    $phpcolor->write();
	Header("Location: user.php?action=friendsapply");
  }
  elseif($_GET['action']=="friendsdel" && isset($_GET['id']))
  {
    $_GET['id']=submitfilter(1,$_GET['id']);
    $phpcolor->table=$core_mysql_prefix."user_friends";
    $phpcolor->field="*";
    $phpcolor->where="id = '".$_GET['id']."'";
	$rs=$phpcolor->exist(1);
	$phpcolor->delete();
	$phpcolor->where="uid = '".$rs['did']."' and did = '".$rs['uid']."'";
    $phpcolor->delete();
	Header("Location: user.php?action=friends");
  }
  elseif($_GET['action']=="barfavorite")
  {
    if(!isset($_GET['page']))
      $_GET['page']=0;
    $phpcolor->table=$core_mysql_prefix."user_barfavorite";
	$phpcolor->field="*";
    $phpcolor->where="uid = '".$user['id']."'";
   	$count=$phpcolor->exist(2);
	$page=pages($count,10,$_GET['page'],'user','&action=','barfavorite','0');
    $phpcolor->where="uid = '".$user['id']."' limit ".($_GET['page']*10).",10";
    $barfavorite=$phpcolor->assignment();
	for ($count=0;$count<count($barfavorite);$count++)       
    {
	  $phpcolor->table=$core_mysql_prefix."bar";
	  $phpcolor->field="barname,introduction";
	  $phpcolor->where="id='".$barfavorite[$count]['bid']."'";
	  $bar=$phpcolor->exist(1);
	  $barfavorite[$count]['name'] = $bar['barname'];
	  $barfavorite[$count]['introduction'] = $phpcolor->mysubstr($bar['introduction'],0,38);
    }
	$phpcolor->table=$core_mysql_prefix."bar_user";
    $phpcolor->field="bid";
    $phpcolor->where="uid = '".$user['id']."'";
    $jbar=$phpcolor->assignment();
	for ($count=0;$count<count($jbar);$count++)       
    {
	  $phpcolor->table=$core_mysql_prefix."bar";
	  $phpcolor->field="barname";
	  $phpcolor->where="id='".$jbar[$count]['bid']."'";
	  $bar=$phpcolor->exist(1);
	  $jbar[$count]['name'] = $bar['barname'];
    }
	$tpl -> assign("jbar", $jbar); 
    $tpl -> assign("barfavorite", $barfavorite); 
    $tpl -> assign("page", $page);
	$tpl -> assign("core_header_title", "我的贴吧 - ");
  }
  elseif($_GET['action']=="barfavoriteadd")
  {
    submitfilter(1,$_GET['bid']);
    $phpcolor->table=$core_mysql_prefix."user_barfavorite";
	$phpcolor->field="*";
    $phpcolor->where="uid = '".$user['id']."' and bid = '".$_GET['bid']."'";
    $barfavorite=$phpcolor->exist(1);
	if(isset($barfavorite['id']))
	  Header("Location: error.php?id=19&last=list.php?bid=".$_GET['bid']);
	else
	{
      $phpcolor->field="bid, uid";
      $phpcolor->where="'".$_GET['bid']."','".$user['id']."'";
	  $phpcolor->write();
	  Header("Location: list.php?bid=".$_GET['bid']);
	}
  }
  elseif($_GET['action']=="barfavoritedel")
  {
    submitfilter(1,$_GET['id']);
    $phpcolor->table=$core_mysql_prefix."user_barfavorite";
	$phpcolor->field="*";
    $phpcolor->where="id = '".$_GET['id']."'";
    $barfavorite=$phpcolor->exist(1);
    if($barfavorite['uid'] == $user['id'])
    {
	  $phpcolor->delete();
      Header("Location: user.php?action=barfavorite");
    }
    else
      Header("Location: error.php?id=2");
  }
  elseif($_GET['action']=="postfavorite")
  {
    if(!isset($_GET['page']))
      $_GET['page']=0;
    $phpcolor->table=$core_mysql_prefix."user_postfavorite";
	$phpcolor->field="*";
    $phpcolor->where="uid = '".$user['id']."'";
   	$count=$phpcolor->exist(2);
	$page=pages($count,10,$_GET['page'],'user','&action=','postfavorite','0');
    $phpcolor->where="uid = '".$user['id']."' limit ".($_GET['page']*10).",10";
    $postfavorite=$phpcolor->assignment();
	for ($count=0;$count<count($postfavorite);$count++)       
    {
	  $phpcolor->table=$core_mysql_prefix."topic";
	  $phpcolor->field="theme";
	  $phpcolor->where="id='".$postfavorite[$count]['pid']."'";
	  $topic=$phpcolor->exist(1);
	  $postfavorite[$count]['theme'] = $topic['theme'];
    }
    $tpl -> assign("postfavorite", $postfavorite); 
    $tpl -> assign("page", $page);
	$tpl -> assign("core_header_title", "我收藏的主题 - ");
  }
  elseif($_GET['action']=="postfavoriteadd")
  {
    submitfilter(1,$_GET['id']);
    $phpcolor->table=$core_mysql_prefix."user_postfavorite";
	$phpcolor->field="*";
    $phpcolor->where="uid = '".$user['id']."' and pid = '".$_GET['id']."'";
    $barfavorite=$phpcolor->exist(1);
	if(isset($barfavorite['id']))
	  Header("Location: error.php?id=20&last=read.php?id=".$_GET['id']);
	else
	{
      $phpcolor->field="pid, uid";
      $phpcolor->where="'".$_GET['id']."','".$user['id']."'";
	  $phpcolor->write();
	  Header("Location: read.php?id=".$_GET['id']);
	}
  }
  elseif($_GET['action']=="postfavoritedel")
  {
    submitfilter(1,$_GET['id']);
    $phpcolor->table=$core_mysql_prefix."user_postfavorite";
	$phpcolor->field="*";
    $phpcolor->where="id = '".$_GET['id']."'";
    $postfavorite=$phpcolor->exist(1);
    if($postfavorite['uid'] == $user['id'])
    {
	  $phpcolor->delete();
      Header("Location: user.php?action=postfavorite");
    }
    else
      Header("Location: error.php?id=2");
  }
  elseif($_GET['action']=="heads" && isset($_GET['fs']))
  {
    if($_GET['fs']==1)
	  $head=$core_url."images/head/".$_POST['head'];
	elseif($_GET['fs']==2)
	  $head=bn_replace($_POST['head']);
	elseif($_GET['fs']==3)
	{
	  $oldname=$_FILES["file"]["name"];
      $fileextensionname=strtolower(eregi_replace(".+(\..+)","\\1",$oldname));
      $filename = $user["id"].$fileextensionname;
      if(!preg_match( '/^image\//i ',$_FILES["file"]["type"]) || ($_FILES["file"]["size"]/1024)>2048)
	  {
	    Header("Location: error.php?id=16");
	    exit();
	  }
	  if(file_exists("upload/head/".$filename))
        unlink("upload/head/".$filename);
	  move_uploaded_file($_FILES["file"]["tmp_name"],"upload/head/".$filename);
	  $head=$core_url."upload/head/".$filename;
	}
    $phpcolor->table=$core_mysql_prefix."user";
    $phpcolor->field="picture='".$head."'";
    $phpcolor->where="id = '".$user['id']."'";
	$phpcolor->upgrade();
	Header("Location: user.php?action=basic");
  }
  elseif($_GET['action']=="qiandao")
  {
    $phpcolor->table=$core_mysql_prefix."qiandao";
    $yztime=date('Y-m-d',strtotime(date('Y-m-d H:i:s'))+$core_time*60*60);
    $phpcolor->where="published like '%".$yztime."%' and belong='".$userv['id']."' and type='1'";
	$pd=$phpcolor->exist(2);
    if($_POST['qdtb']=="" or $_POST['qdss']=="" or $pd)
	  die("0");
	elseif(strlen($_POST['qdss'])>280)
	  die("2");
	else
	{
	  $_POST['qdss']=html_replace($_POST['qdss']);
	  $time=date('Y-m-d H:i:s',strtotime(date('Y-m-d H:i:s'))+$core_time*60*60);
	  $phpcolor->field="biaoqing,content,published,belong,type";
	  $phpcolor->where="'".$_POST['qdtb']."','".$_POST['qdss']."','".$time."','".$user['id']."','1'";
      $phpcolor->write();
	  die("1");
	}
  }
  elseif ($_GET['action']=="safety")
  {
    $tpl -> assign("question", $user["question"]);
    $tpl -> assign("core_header_title", "安全信息修改 - ");
  }
  elseif ($_GET['action']=="friendsapply")
  {
    $phpcolor->table=$core_mysql_prefix."apply_user";
	$phpcolor->field="*";
    $phpcolor->where="object = '".$user['username']."' and type = '2'";
    $friendsapply=$phpcolor->assignment();
    $tpl -> assign("friendsapply", $friendsapply);
    $tpl -> assign("core_header_title", "好友申请管理 - ");
  }
  elseif ($_GET['action']=="friends")
  {
    $phpcolor->table=$core_mysql_prefix."user_friends";
    $phpcolor->field="*";
    $phpcolor->where="uid = '".$user['id']."'";
    $friends=$phpcolor->assignment();
	$phpcolor->table=$core_mysql_prefix."user";
	$phpcolor->field="username";
	for ($count=0;$count<count($friends);$count++)
    {
	  $phpcolor->where="id = '".$friends[$count]['did']."'";
	  $rs=$phpcolor->exist(1);
	  $friends[$count]['username']=$rs['username'];
	}
    $tpl -> assign("friends", $friends);
    $tpl -> assign("core_header_title", "好友管理 - ");
  }
  elseif ($_GET['action']=="head")
  {
    $handler = opendir('images/head');
    while( ($facename = readdir($handler)) !== false ) 
    {
      if($facename!="." && $facename!="..")
        $head[]=$facename;
    }
    closedir($handler);
	$tpl -> assign("core_userheadup", $core_userheadup);
    $tpl -> assign("head", $head);
    $tpl -> assign("core_header_title", "修改头像 - ");
  }
  else
  {
    $user['signature'] = str_replace("&lt;br /&gt;","",$user['signature']);
	$user['introduction'] = str_replace("&lt;br /&gt;","",$user['introduction']);
    $tpl -> assign("core_header_title", "基本资料修改 - ");
  }
  $tpl -> assign("user", $user);
  $tpl -> assign("action", $_GET['action']);
  $tpl -> display("$core_style/user.htm");
}
?>