38 } |
38 } |
39 |
39 |
40 // Set current user ID. |
40 // Set current user ID. |
41 $userid=$_SESSION['userid']; |
41 $userid=$_SESSION['userid']; |
42 |
42 |
43 $query = 'SELECT id FROM perm_items WHERE name='.$db->quote('user_is_ueberuser'); |
43 $query = 'SELECT id FROM perm_items WHERE name='.$db->quote('user_is_ueberuser', 'text'); |
44 $ueberUserId = $db->queryOne($query); |
44 $ueberUserId = $db->queryOne($query); |
45 |
45 |
46 // Find the template ID that this user has been assigned. |
46 // Find the template ID that this user has been assigned. |
47 $query = "SELECT perm_templ |
47 $query = "SELECT perm_templ |
48 FROM users |
48 FROM users |
49 WHERE id = " . $db->quote($userid) ; |
49 WHERE id = " . $db->quote($userid, 'integer') ; |
50 $templ_id = $db->queryOne($query); |
50 $templ_id = $db->queryOne($query); |
51 |
51 |
52 // Does this user have ueberuser rights? |
52 // Does this user have ueberuser rights? |
53 $query = "SELECT id |
53 $query = "SELECT id |
54 FROM perm_templ_items |
54 FROM perm_templ_items |
55 WHERE templ_id = " . $db->quote($templ_id) . " |
55 WHERE templ_id = " . $db->quote($templ_id, 'integer') . " |
56 AND perm_id = ".$ueberUserId; |
56 AND perm_id = ".$ueberUserId; |
57 $response = $db->query($query); |
57 $response = $db->query($query); |
58 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
58 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
59 if ( $response->numRows() > 0 ) { |
59 if ( $response->numRows() > 0 ) { |
60 return 1; |
60 return 1; |
61 } |
61 } |
62 |
62 |
63 // Find the permission ID for the requested permission. |
63 // Find the permission ID for the requested permission. |
64 $query = "SELECT id |
64 $query = "SELECT id |
65 FROM perm_items |
65 FROM perm_items |
66 WHERE name = " . $db->quote($permission) ; |
66 WHERE name = " . $db->quote($permission, 'text') ; |
67 $perm_id = $db->queryOne($query); |
67 $perm_id = $db->queryOne($query); |
68 |
68 |
69 // Check if the permission ID is assigned to the template ID. |
69 // Check if the permission ID is assigned to the template ID. |
70 $query = "SELECT id |
70 $query = "SELECT id |
71 FROM perm_templ_items |
71 FROM perm_templ_items |
72 WHERE templ_id = " . $db->quote($templ_id) . " |
72 WHERE templ_id = " . $db->quote($templ_id, 'integer') . " |
73 AND perm_id = " . $db->quote($perm_id) ; |
73 AND perm_id = " . $db->quote($perm_id, 'integer') ; |
74 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
74 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
75 $response = $db->query($query); |
75 $response = $db->query($query); |
76 if ( $response->numRows() > 0 ) { |
76 if ( $response->numRows() > 0 ) { |
77 return 1; |
77 return 1; |
78 } else { |
78 } else { |
106 { |
106 { |
107 global $db; |
107 global $db; |
108 $add = ''; |
108 $add = ''; |
109 if(is_numeric($id)) { |
109 if(is_numeric($id)) { |
110 //When a user id is given, it is excluded from the userlist returned. |
110 //When a user id is given, it is excluded from the userlist returned. |
111 $add = " WHERE users.id!=".$db->quote($id); |
111 $add = " WHERE users.id!=".$db->quote($id, 'integer'); |
112 } |
112 } |
113 |
113 |
114 // Make a huge query. |
114 // Make a huge query. |
115 $query = "SELECT users.id AS id, |
115 $query = "SELECT users.id AS id, |
116 users.username AS username, |
116 users.username AS username, |
159 */ |
159 */ |
160 function is_valid_user($id) |
160 function is_valid_user($id) |
161 { |
161 { |
162 global $db; |
162 global $db; |
163 if(is_numeric($id)) { |
163 if(is_numeric($id)) { |
164 $response = $db->query("SELECT id FROM users WHERE id=".$db->quote($id)); |
164 $response = $db->query("SELECT id FROM users WHERE id=".$db->quote($id, 'integer')); |
165 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
165 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
166 if ($response->numRows() == 1) { |
166 if ($response->numRows() == 1) { |
167 return true; |
167 return true; |
168 } else { |
168 } else { |
169 return false; |
169 return false; |
177 * return values: true if exists, false if not. |
177 * return values: true if exists, false if not. |
178 */ |
178 */ |
179 function user_exists($user) |
179 function user_exists($user) |
180 { |
180 { |
181 global $db; |
181 global $db; |
182 $response = $db->query("SELECT id FROM users WHERE username=".$db->quote($user)); |
182 $response = $db->query("SELECT id FROM users WHERE username=".$db->quote($user, 'text')); |
183 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
183 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
184 if ($response->numRows() == 0) { |
184 if ($response->numRows() == 0) { |
185 return false; |
185 return false; |
186 } elseif ($response->numRows() == 1) { |
186 } elseif ($response->numRows() == 1) { |
187 return true; |
187 return true; |
213 add_owner_to_zone($zone['zid'], $zone['newowner']); |
213 add_owner_to_zone($zone['zid'], $zone['newowner']); |
214 } |
214 } |
215 } |
215 } |
216 } |
216 } |
217 |
217 |
218 $query = "DELETE FROM zones WHERE owner = " . $db->quote($uid) ; |
218 $query = "DELETE FROM zones WHERE owner = " . $db->quote($uid, 'integer') ; |
219 $response = $db->query($query); |
219 $response = $db->query($query); |
220 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
220 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
221 |
221 |
222 $query = "DELETE FROM users WHERE id = " . $db->quote($uid) ; |
222 $query = "DELETE FROM users WHERE id = " . $db->quote($uid, 'integer') ; |
223 $response = $db->query($query); |
223 $response = $db->query($query); |
224 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
224 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
225 } |
225 } |
226 return true; |
226 return true; |
227 } |
227 } |
282 // First find the current username of the user ID we want to change. If the |
282 // First find the current username of the user ID we want to change. If the |
283 // current username is not the same as the username that was given by the |
283 // current username is not the same as the username that was given by the |
284 // user, the username should apparantly changed. If so, check if the "new" |
284 // user, the username should apparantly changed. If so, check if the "new" |
285 // username already exists. |
285 // username already exists. |
286 |
286 |
287 $query = "SELECT username FROM users WHERE id = " . $db->quote($id); |
287 $query = "SELECT username FROM users WHERE id = " . $db->quote($id, 'integer'); |
288 $response = $db->query($query); |
288 $response = $db->query($query); |
289 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
289 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
290 |
290 |
291 $usercheck = array(); |
291 $usercheck = array(); |
292 $usercheck = $response->fetchRow(); |
292 $usercheck = $response->fetchRow(); |
295 |
295 |
296 // Username of user ID in the database is different from the name |
296 // Username of user ID in the database is different from the name |
297 // we have been given. User wants a change of username. Now, make |
297 // we have been given. User wants a change of username. Now, make |
298 // sure it doesn't already exist. |
298 // sure it doesn't already exist. |
299 |
299 |
300 $query = "SELECT id FROM users WHERE username = " . $db->quote($user); |
300 $query = "SELECT id FROM users WHERE username = " . $db->quote($user, 'integer'); |
301 $response = $db->query($query); |
301 $response = $db->query($query); |
302 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
302 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
303 |
303 |
304 if($response->numRows() > 0) { |
304 if($response->numRows() > 0) { |
305 error(ERR_USER_EXIST); |
305 error(ERR_USER_EXIST); |
309 |
309 |
310 // So, user doesn't want to change username or, if he wants, there is not |
310 // So, user doesn't want to change username or, if he wants, there is not |
311 // another user that goes by the wanted username. So, go ahead! |
311 // another user that goes by the wanted username. So, go ahead! |
312 |
312 |
313 $query = "UPDATE users SET |
313 $query = "UPDATE users SET |
314 username = " . $db->quote($user) . ", |
314 username = " . $db->quote($user, 'text') . ", |
315 fullname = " . $db->quote($fullname) . ", |
315 fullname = " . $db->quote($fullname, 'text') . ", |
316 email = " . $db->quote($email) . ", |
316 email = " . $db->quote($email, 'text') . ", |
317 perm_templ = " . $db->quote($perm_templ) . ", |
317 perm_templ = " . $db->quote($perm_templ, 'integer') . ", |
318 description = " . $db->quote($description) . ", |
318 description = " . $db->quote($description, 'text') . ", |
319 active = " . $db->quote($active) ; |
319 active = " . $db->quote($active, 'integer') ; |
320 |
320 |
321 if($password != "") { |
321 if($password != "") { |
322 $query .= ", password = " . $db->quote(md5($password)) ; |
322 $query .= ", password = " . $db->quote(md5($password), 'text') ; |
323 } |
323 } |
324 |
324 |
325 $query .= " WHERE id = " . $db->quote($id) ; |
325 $query .= " WHERE id = " . $db->quote($id, 'integer') ; |
326 |
326 |
327 $response = $db->query($query); |
327 $response = $db->query($query); |
328 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
328 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
329 |
329 |
330 } else { |
330 } else { |
345 if ($details['newpass'] != $details['newpass2']) { |
345 if ($details['newpass'] != $details['newpass2']) { |
346 error(ERR_USER_MATCH_NEW_PASS); |
346 error(ERR_USER_MATCH_NEW_PASS); |
347 return false; |
347 return false; |
348 } |
348 } |
349 |
349 |
350 $query = "SELECT id, password FROM users WHERE username = " . $db->quote($_SESSION["userlogin"]); |
350 $query = "SELECT id, password FROM users WHERE username = " . $db->quote($_SESSION["userlogin"], 'text'); |
351 $response = $db->query($query); |
351 $response = $db->query($query); |
352 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
352 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
353 |
353 |
354 $rinfo = $response->fetchRow(); |
354 $rinfo = $response->fetchRow(); |
355 |
355 |
356 if(md5($details['currentpass']) == $rinfo['password']) { |
356 if(md5($details['currentpass']) == $rinfo['password']) { |
357 $query = "UPDATE users SET password = " . $db->quote(md5($details['newpass'])) . " WHERE id = " . $db->quote($rinfo['id']) ; |
357 $query = "UPDATE users SET password = " . $db->quote(md5($details['newpass']), 'text') . " WHERE id = " . $db->quote($rinfo['id'], 'integer') ; |
358 $response = $db->query($query); |
358 $response = $db->query($query); |
359 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
359 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
360 |
360 |
361 logout( _('Password has been changed, please login.')); |
361 logout( _('Password has been changed, please login.')); |
362 } else { |
362 } else { |
371 * return values: gives the fullname from a userid. |
371 * return values: gives the fullname from a userid. |
372 */ |
372 */ |
373 function get_fullname_from_userid($id) { |
373 function get_fullname_from_userid($id) { |
374 global $db; |
374 global $db; |
375 if (is_numeric($id)) { |
375 if (is_numeric($id)) { |
376 $response = $db->query("SELECT fullname FROM users WHERE id=".$db->quote($id)); |
376 $response = $db->query("SELECT fullname FROM users WHERE id=".$db->quote($id, 'integer')); |
377 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
377 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
378 $r = $response->fetchRow(); |
378 $r = $response->fetchRow(); |
379 return $r["fullname"]; |
379 return $r["fullname"]; |
380 } else { |
380 } else { |
381 error(ERR_INV_ARG); |
381 error(ERR_INV_ARG); |
391 function get_owner_from_id($id) |
391 function get_owner_from_id($id) |
392 { |
392 { |
393 global $db; |
393 global $db; |
394 if (is_numeric($id)) |
394 if (is_numeric($id)) |
395 { |
395 { |
396 $response = $db->query("SELECT fullname FROM users WHERE id=".$db->quote($id)); |
396 $response = $db->query("SELECT fullname FROM users WHERE id=".$db->quote($id, 'integer')); |
397 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
397 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
398 if ($response->numRows() == 1) |
398 if ($response->numRows() == 1) |
399 { |
399 { |
400 $r = $response->fetchRow(); |
400 $r = $response->fetchRow(); |
401 return $r["fullname"]; |
401 return $r["fullname"]; |
417 */ |
417 */ |
418 function get_fullnames_owners_from_domainid($id) { |
418 function get_fullnames_owners_from_domainid($id) { |
419 |
419 |
420 global $db; |
420 global $db; |
421 if (is_numeric($id)) { |
421 if (is_numeric($id)) { |
422 $response = $db->query("SELECT users.id, users.fullname FROM users, zones WHERE zones.domain_id=".$db->quote($id)." AND zones.owner=users.id ORDER by fullname"); |
422 $response = $db->query("SELECT users.id, users.fullname FROM users, zones WHERE zones.domain_id=".$db->quote($id, 'integer')." AND zones.owner=users.id ORDER by fullname"); |
423 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
423 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
424 if ($response->numRows() == 0) { |
424 if ($response->numRows() == 0) { |
425 return ""; |
425 return ""; |
426 } else { |
426 } else { |
427 $names = array(); |
427 $names = array(); |
442 $userid=$_SESSION["userid"]; |
442 $userid=$_SESSION["userid"]; |
443 |
443 |
444 if (is_numeric($zoneid)) { |
444 if (is_numeric($zoneid)) { |
445 $response = $db->query("SELECT zones.id |
445 $response = $db->query("SELECT zones.id |
446 FROM zones |
446 FROM zones |
447 WHERE zones.owner = " . $db->quote($userid) . " |
447 WHERE zones.owner = " . $db->quote($userid, 'integer') . " |
448 AND zones.domain_id = ". $db->quote($zoneid)) ; |
448 AND zones.domain_id = ". $db->quote($zoneid, 'integer')) ; |
449 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
449 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
450 if ($response->numRows() == 0) { |
450 if ($response->numRows() == 0) { |
451 return "0"; |
451 return "0"; |
452 } else { |
452 } else { |
453 return "1"; |
453 return "1"; |
462 global $db; |
462 global $db; |
463 $userid=$_SESSION['userid']; |
463 $userid=$_SESSION['userid']; |
464 |
464 |
465 |
465 |
466 if (v_num($specific)) { |
466 if (v_num($specific)) { |
467 $sql_add = "AND users.id = " . $db->quote($specific) ; |
467 $sql_add = "AND users.id = " . $db->quote($specific, 'integer') ; |
468 } else { |
468 } else { |
469 if (verify_permission('user_view_others')) { |
469 if (verify_permission('user_view_others')) { |
470 $sql_add = ""; |
470 $sql_add = ""; |
471 } else { |
471 } else { |
472 $sql_add = "AND users.id = " . $db->quote($userid) ; |
472 $sql_add = "AND users.id = " . $db->quote($userid, 'integer') ; |
473 } |
473 } |
474 } |
474 } |
475 |
475 |
476 $query = "SELECT users.id AS uid, |
476 $query = "SELECT users.id AS uid, |
477 username, |
477 username, |
515 function get_permissions_by_template_id($templ_id=0,$return_name_only=false) { |
515 function get_permissions_by_template_id($templ_id=0,$return_name_only=false) { |
516 global $db; |
516 global $db; |
517 |
517 |
518 if ($templ_id > 0) { |
518 if ($templ_id > 0) { |
519 $limit = ", perm_templ_items |
519 $limit = ", perm_templ_items |
520 WHERE perm_templ_items.templ_id = " . $db->quote($templ_id) . " |
520 WHERE perm_templ_items.templ_id = " . $db->quote($templ_id, 'integer') . " |
521 AND perm_templ_items.perm_id = perm_items.id"; |
521 AND perm_templ_items.perm_id = perm_items.id"; |
522 } |
522 } |
523 |
523 |
524 $query = "SELECT perm_items.id AS id, |
524 $query = "SELECT perm_items.id AS id, |
525 perm_items.name AS name, |
525 perm_items.name AS name, |
551 function get_permission_template_details($templ_id) { |
551 function get_permission_template_details($templ_id) { |
552 global $db; |
552 global $db; |
553 |
553 |
554 $query = "SELECT * |
554 $query = "SELECT * |
555 FROM perm_templ |
555 FROM perm_templ |
556 WHERE perm_templ.id = " . $db->quote($templ_id); |
556 WHERE perm_templ.id = " . $db->quote($templ_id, 'integer'); |
557 |
557 |
558 $response = $db->query($query); |
558 $response = $db->query($query); |
559 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
559 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
560 |
560 |
561 $details = $response->fetchRow(); |
561 $details = $response->fetchRow(); |
591 |
591 |
592 // Fix permission template name and description first. |
592 // Fix permission template name and description first. |
593 |
593 |
594 $query = "INSERT INTO perm_templ (name, descr) |
594 $query = "INSERT INTO perm_templ (name, descr) |
595 VALUES (" |
595 VALUES (" |
596 . $db->quote($details['templ_name']) . ", " |
596 . $db->quote($details['templ_name'], 'text') . ", " |
597 . $db->quote($details['templ_descr']) . ")"; |
597 . $db->quote($details['templ_descr'], 'text') . ")"; |
598 |
598 |
599 $response = $db->query($query); |
599 $response = $db->query($query); |
600 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
600 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
601 |
601 |
602 $perm_templ_id = $db->lastInsertId('perm_templ', 'id'); |
602 $perm_templ_id = $db->lastInsertId('perm_templ', 'id'); |
603 |
603 |
604 foreach ($details['perm_id'] AS $perm_id) { |
604 foreach ($details['perm_id'] AS $perm_id) { |
605 $query = "INSERT INTO perm_templ_items (templ_id, perm_id) VALUES (" . $db->quote($perm_templ_id) . "," . $db->quote($perm_id) . ")"; |
605 $query = "INSERT INTO perm_templ_items (templ_id, perm_id) VALUES (" . $db->quote($perm_templ_id, 'integer') . "," . $db->quote($perm_id, 'integer') . ")"; |
606 $response = $db->query($query); |
606 $response = $db->query($query); |
607 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
607 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
608 } |
608 } |
609 |
609 |
610 return true; |
610 return true; |
616 global $db; |
616 global $db; |
617 |
617 |
618 // Fix permission template name and description first. |
618 // Fix permission template name and description first. |
619 |
619 |
620 $query = "UPDATE perm_templ |
620 $query = "UPDATE perm_templ |
621 SET name = " . $db->quote($details['templ_name']) . ", |
621 SET name = " . $db->quote($details['templ_name'], 'text') . ", |
622 descr = " . $db->quote($details['templ_descr']) . " |
622 descr = " . $db->quote($details['templ_descr'], 'text') . " |
623 WHERE id = " . $db->quote($details['templ_id']) ; |
623 WHERE id = " . $db->quote($details['templ_id'], 'integer') ; |
624 $response = $db->query($query); |
624 $response = $db->query($query); |
625 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
625 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
626 |
626 |
627 // Now, update list of permissions assigned to this template. We could do |
627 // Now, update list of permissions assigned to this template. We could do |
628 // this The Correct Way [tm] by comparing the list of permissions that are |
628 // this The Correct Way [tm] by comparing the list of permissions that are |
634 $query = "DELETE FROM perm_templ_items WHERE templ_id = " . $details['templ_id'] ; |
634 $query = "DELETE FROM perm_templ_items WHERE templ_id = " . $details['templ_id'] ; |
635 $response = $db->query($query); |
635 $response = $db->query($query); |
636 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
636 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
637 |
637 |
638 foreach ($details['perm_id'] AS $perm_id) { |
638 foreach ($details['perm_id'] AS $perm_id) { |
639 $query = "INSERT INTO perm_templ_items (templ_id, perm_id) VALUES (" . $db->quote($details['templ_id']) . "," . $db->quote($perm_id) . ")"; |
639 $query = "INSERT INTO perm_templ_items (templ_id, perm_id) VALUES (" . $db->quote($details['templ_id'], 'integer') . "," . $db->quote($perm_id, 'integer') . ")"; |
640 $response = $db->query($query); |
640 $response = $db->query($query); |
641 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
641 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
642 } |
642 } |
643 |
643 |
644 return true; |
644 return true; |
672 // |
672 // |
673 // First find the current username of the user ID we want to change. If the |
673 // First find the current username of the user ID we want to change. If the |
674 // current username is not the same as the username that was given by the |
674 // current username is not the same as the username that was given by the |
675 // user, the username should apparantly changed. If so, check if the "new" |
675 // user, the username should apparantly changed. If so, check if the "new" |
676 // username already exists. |
676 // username already exists. |
677 $query = "SELECT username FROM users WHERE id = " . $db->quote($details['uid']); |
677 $query = "SELECT username FROM users WHERE id = " . $db->quote($details['uid'], 'integer'); |
678 $response = $db->query($query); |
678 $response = $db->query($query); |
679 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
679 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
680 |
680 |
681 $usercheck = array(); |
681 $usercheck = array(); |
682 $usercheck = $response->fetchRow(); |
682 $usercheck = $response->fetchRow(); |
683 |
683 |
684 if ($usercheck['username'] != $details['username']) { |
684 if ($usercheck['username'] != $details['username']) { |
685 // Username of user ID in the database is different from the name |
685 // Username of user ID in the database is different from the name |
686 // we have been given. User wants a change of username. Now, make |
686 // we have been given. User wants a change of username. Now, make |
687 // sure it doesn't already exist. |
687 // sure it doesn't already exist. |
688 $query = "SELECT id FROM users WHERE username = " . $db->quote($details['username']); |
688 $query = "SELECT id FROM users WHERE username = " . $db->quote($details['username'], 'text'); |
689 $response = $db->query($query); |
689 $response = $db->query($query); |
690 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
690 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
691 |
691 |
692 if($response->numRows() > 0) { |
692 if($response->numRows() > 0) { |
693 error(ERR_USER_EXIST); |
693 error(ERR_USER_EXIST); |
697 |
697 |
698 // So, user doesn't want to change username or, if he wants, there is not |
698 // So, user doesn't want to change username or, if he wants, there is not |
699 // another user that goes by the wanted username. So, go ahead! |
699 // another user that goes by the wanted username. So, go ahead! |
700 |
700 |
701 $query = "UPDATE users SET |
701 $query = "UPDATE users SET |
702 username = " . $db->quote($details['username']) . ", |
702 username = " . $db->quote($details['username'], 'text') . ", |
703 fullname = " . $db->quote($details['fullname']) . ", |
703 fullname = " . $db->quote($details['fullname'], 'text') . ", |
704 email = " . $db->quote($details['email']) . ", |
704 email = " . $db->quote($details['email'], 'text') . ", |
705 description = " . $db->quote($details['descr']) . ", |
705 description = " . $db->quote($details['descr'], 'text') . ", |
706 active = " . $db->quote($active) ; |
706 active = " . $db->quote($active, 'integer') ; |
707 |
707 |
708 // If the user is alllowed to change the permission template, set it. |
708 // If the user is alllowed to change the permission template, set it. |
709 if ($perm_templ_perm_edit == "1") { |
709 if ($perm_templ_perm_edit == "1") { |
710 $query .= ", perm_templ = " . $db->quote($details['templ_id']) ; |
710 $query .= ", perm_templ = " . $db->quote($details['templ_id'], 'integer') ; |
711 |
711 |
712 } |
712 } |
713 |
713 |
714 if(isset($details['password']) && $details['password'] != "") { |
714 if(isset($details['password']) && $details['password'] != "") { |
715 $query .= ", password = '" . md5($db->quote($details['password'])) . "' "; |
715 $query .= ", password = " . $db->quote(md5($details['password']), 'text'); |
716 } |
716 } |
717 |
717 |
718 $query .= " WHERE id = " . $db->quote($details['uid']) ; |
718 $query .= " WHERE id = " . $db->quote($details['uid'], 'integer') ; |
719 |
719 |
720 $response = $db->query($query); |
720 $response = $db->query($query); |
721 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
721 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
722 |
722 |
723 } else { |
723 } else { |
746 } else { |
746 } else { |
747 $active = 0; |
747 $active = 0; |
748 } |
748 } |
749 |
749 |
750 $query = "INSERT INTO users (username, password, fullname, email, description, perm_templ, active) VALUES (" |
750 $query = "INSERT INTO users (username, password, fullname, email, description, perm_templ, active) VALUES (" |
751 . $db->quote($details['username']) . ", " |
751 . $db->quote($details['username'], 'text') . ", " |
752 . $db->quote(md5($details['password'])) . ", " |
752 . $db->quote(md5($details['password']), 'text') . ", " |
753 . $db->quote($details['fullname']) . ", " |
753 . $db->quote($details['fullname'], 'text') . ", " |
754 . $db->quote($details['email']) . ", " |
754 . $db->quote($details['email'], 'text') . ", " |
755 . $db->quote($details['descr']) . ", " |
755 . $db->quote($details['descr'], 'text') . ", " |
756 . $db->quote($details['perm_templ']) . ", " |
756 . $db->quote($details['perm_templ'], 'integer') . ", " |
757 . $db->quote($active) |
757 . $db->quote($active, 'integer') |
758 . ")"; |
758 . ")"; |
759 |
759 |
760 $response = $db->query($query); |
760 $response = $db->query($query); |
761 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
761 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
762 |
762 |