Subversion Repositories cheapmusic

<?php

// Email sending functions

include_once 'includes/email_functions.php';

include_once 'includes/password.php';

// Include Session Handling

require_once('includes/session.php');

// Include config file

require_once 'includes/config.php';

// Load and initialize user class

require_once 'includes/User.class.php';

$user = new User();

if(isset($_POST['signupSubmit'])){

	$valErr = 0;

	$captchaErr = 0;

	// Store post data into session

	$_SESSION['signup_post_data'] = $_POST;

    if (!empty($_POST['g-recaptcha-response'])) {

        $secretKey = GR_SECRET_KEY;

        $ch = curl_init('https://www.google.com/recaptcha/api/siteverify?secret=' . $secretKey . '&response=' . $_POST['g-recaptcha-response']);

        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

        $verifyResponse = curl_exec($ch);

        $responseData = json_decode($verifyResponse);

        if ($responseData->success){

            if ($responseData->score < 0.6) {

            	$captchaErr = 1;

                $sessData['status']['type'] = 'error';

                $sessData['status']['msg'] = 'Robot verification failed, please try again.';

            }

        } else {

        	$captchaErr = 1;

            $sessData['status']['type'] = 'error';

            $sessData['status']['msg'] = 'Robot verification failed, please try again.';

        }

    } else {

    	$captchaErr = 1;

        $sessData['status']['type'] = 'error';

        $sessData['status']['msg'] = 'Robot verification failed, please try again.';

    }

    if ($captchaErr == 1) {

    	// Redirect back to the registration page

        $_SESSION['sessData'] = $sessData;

        MySessionHandler::commit(session_id());

        header("Location:registration.php");

    	exit;

    }

	// Get user inputs

	$first_name = sanitizeInput($_POST['first_name']);

	$last_name = sanitizeInput($_POST['last_name']);

	$email = sanitizeInput($_POST['email']);

	$zip = sanitizeInput($_POST['zip']);

	$password = sanitizeInput($_POST['password']);

	$confirm_password = sanitizeInput($_POST['confirm_password']);

	if(empty($first_name)){

		$valErr = 1;

		$sessData['field_error']['first_name'] = 'Please enter your first name.';

	}

/*

	if(empty($last_name)){

		$valErr = 1;

		$sessData['field_error']['last_name'] = 'Please enter your last name.';

	}

*/

	if(empty($email) || !filter_var($email, FILTER_VALIDATE_EMAIL)){

		$valErr = 1;

		$sessData['field_error']['email'] = 'Please enter a valid email.';

	}

	if(empty($password)){

		$valErr = 1;

		$sessData['field_error']['password'] = 'Please enter account password.';

	}

	if(empty($confirm_password)){

		$valErr = 1;

		$sessData['field_error']['confirm_password'] = 'Please confirm your password.';

	}elseif($password !== $confirm_password){

		$valErr = 1;

		$sessData['field_error']['confirm_password'] = 'Confirm password does not match the password.';

	}

	if($valErr == 0){

		// Check whether user exists in the database

		$cond['where'] = array('email' => $email);

		$cond['return_type'] = 'count';

		$userCount = $user->getRows($cond);

		if($userCount > 0){

			$sessData['status']['type'] = 'error';

			$sessData['status']['msg'] = 'Email already exists, please use another email.';

		}else{

			// Email verification code

			$uniqidStr = md5(uniqid(mt_rand()));

			// Insert user data in the database

			$userData = array(

				'first_name' => $first_name,

				'last_name' => $last_name,

				'email' => $email,

				'password' => password_hash($password, PASSWORD_DEFAULT),

				'zip' => $zip,

				'activation_code' => $uniqidStr

			);

			$insert = $user->insert($userData);

			// Set status based on data insert

			if($insert){

				// Remove post data from session

				unset($_SESSION['signup_post_data']);

				// Send account verification email

				@emailVerification($userData);

				$sessData['status']['type'] = 'success';

				$sessData['status']['msg'] = 'Your registration was successful. Please check your email inbox to verify and activate your account.';

				// Remove post data from session

				unset($_SESSION['signup_post_data']);

			}else{

				$sessData['status']['type'] = 'error';

				$sessData['status']['msg'] = 'Some problem occurred, please try again.';

			}

		}

	}else{

        $sessData['status']['type'] = 'error';

        $sessData['status']['msg'] = 'Please fill all mandatory fields.';

    }

	// Store signup status into the session

    $_SESSION['sessData'] = $sessData;

    $redirectURL = ($sessData['status']['type'] == 'success')?'index.php':'registration.php';

	// Redirect to the home/login page

    MySessionHandler::commit(session_id());

    header("Location:".$redirectURL);

	exit;

}elseif(isset($_POST['loginSubmit'])){

	// Get user inputs

	$email = sanitizeInput($_POST['email']);

	$password = sanitizeInput($_POST['password']);

	// Check whether login details are empty

    if(!empty($email) && !empty($password)){

		// Get user data from user class

        $conditions['where'] = array(

            'email' => $email,

            'status' => '1'

        );

        $conditions['return_type'] = 'single';

        $userData = $user->getRows($conditions);

		if(!empty($userData) && password_verify($password, $userData['password'])){

			// Set user data and status based on login credentials

			if($userData['activated'] == '0'){

				$sessData['status']['type'] = 'error';

				$sessData['status']['msg'] = 'Your account activation is pending, please check your email inbox to verify and activate your account.';

			}else{

				// If remember me is checked

				if (isset($_POST['rememberMe']) && $_POST['rememberMe'] == 1) {

					setcookie('rememberUserId', $userData['id'], time() + (30 * 86400), "/");

					setcookie('hash', password_hash($userData['password'] . $userData['id'], PASSWORD_DEFAULT), time() + (30 * 86400), "/");

				}

				$sessData['userLoggedIn'] = true;

				$sessData['userID'] = $userData['id'];

				$sessData['status']['type'] = 'success';

				$sessData['status']['msg'] = 'Welcome '.$userData['first_name'].'!';

			}

		}else{

			$sessData['status']['type'] = 'error';

            $sessData['status']['msg'] = 'Wrong email or password, please try again.';

		}

    }else{

        $sessData['status']['type'] = 'error';

        $sessData['status']['msg'] = 'Enter email and password.';

    }

	// Store login status into the session

    $_SESSION['sessData'] = $sessData;

	// Redirect to the home page

    MySessionHandler::commit(session_id());

    header("Location:index.php");

	exit;

}elseif(isset($_POST['forgotSubmit'])){

	$frmDisplay = '';

	// Get user inputs

	$email = sanitizeInput($_POST['email']);

	// Check whether email is empty

    if(!empty($email)){

		// Check whether user exists in the database

		$cond['where'] = array('email' => $email);

		$cond['return_type'] = 'count';

		$userCount = $user->getRows($cond);

		if($userCount > 0){

			// Generat unique string

			$uniqidStr = md5(uniqid(mt_rand()));

			// Update data with forgot pass code

			$conditions = array(

				'email' => $email

			);

			$data = array(

				'forgot_pass_identity' => $uniqidStr

			);

			$update = $user->update($data, $conditions);

			if($update){

				// Get user details

				$con['where'] = array('email' => $email);

				$con['return_type'] = 'single';

				$userDetails = $user->getRows($con);

				// Send reset password email

                @forgotPassEmail($userDetails);

				$sessData['status']['type'] = 'success';

				$sessData['status']['msg'] = 'Please check your email inbox, we have sent a password reset link to your registered email.';

				$frmDisplay = '?frmDis=0';

			}else{

				$sessData['status']['type'] = 'error';

				$sessData['status']['msg'] = 'Some problem occurred, please try again.';

			}

		}else{

			$sessData['status']['type'] = 'error';

			$sessData['status']['msg'] = 'Given email is not associated with any account.';

		}

    }else{

        $sessData['status']['type'] = 'error';

        $sessData['status']['msg'] = 'Enter email to create a new password for your account.';

    }

	// Store reset password status into the session

    $_SESSION['sessData'] = $sessData;

	// Redirect to the forgot pasword page

    MySessionHandler::commit(session_id());

    header("Location:forgotPassword.php".$frmDisplay);

}elseif(isset($_POST['resetSubmit'])){

	$fp_code = sanitizeInput($_POST['fp_code']);

	// Get user inputs

	$password = sanitizeInput($_POST['password']);

	$confirm_password = sanitizeInput($_POST['confirm_password']);

	if(!empty($password) && !empty($confirm_password) && !empty($fp_code)){

		// Password and confirm password comparison

        if($password !== $confirm_password){

            $sessData['status']['type'] = 'error';

            $sessData['status']['msg'] = 'Confirm password does not match the password.';

        }else{

			//check whether identity code exists in the database

            $cond['where'] = array('forgot_pass_identity' => $fp_code);

            $cond['return_type'] = 'count';

            $userCount = $user->getRows($cond);

            if($userCount > 0){

				// Update data with new password

				$conditions = array(

					'forgot_pass_identity' => $fp_code

				);

				$data = array(

					'password' => password_hash($password, PASSWORD_DEFAULT)

				);

				$update = $user->update($data, $conditions);

				if($update){

					$sessData['status']['type'] = 'success';

                    $sessData['status']['msg'] = 'Your account password has been reset. Please login with your new password.';

				}else{

					$sessData['status']['type'] = 'error';

					$sessData['status']['msg'] = 'Some problem occurred, please try again.';

				}

            }else{

                $sessData['status']['type'] = 'error';

                $sessData['status']['msg'] = 'You are not authorized to reset the password for this account.';

            }

        }

    }else{

        $sessData['status']['type'] = 'error';

        $sessData['status']['msg'] = 'All fields are mandatory, please fill all the fields.';

    }

	// Store reset password status into the session

    $_SESSION['sessData'] = $sessData;

    $redirectURL = ($sessData['status']['type'] == 'success')?'index.php':'resetPassword.php?fp_code='.$fp_code;

	// Redirect to the login/reset pasword page

    MySessionHandler::commit(session_id());

    header("Location:".$redirectURL);

	exit;

}elseif(isset($_REQUEST['verifyEmail']) && $_REQUEST['verifyEmail'] == 1){

	$ac_code = $_REQUEST['ac_code'];

	// Check whether activation code exists in the database

	$cond['where'] = array('activation_code' => $ac_code);

	$cond['return_type'] = 'count';

	$userCount = $user->getRows($cond);

	if($userCount > 0){

		// Update data with new password

		$conditions = array(

			'activation_code' => $ac_code

		);

		$data = array(

			'activated' => '1'

		);

		$update = $user->update($data, $conditions);

		if($update){

			$sessData['status']['type'] = 'success';

			$sessData['status']['msg'] = 'Email verification for your account was successful. Please login to your account.';

		}else{

			$sessData['status']['type'] = 'error';

			$sessData['status']['msg'] = 'Some problem occurred, please try again.';

		}

	}else{

		$sessData['status']['type'] = 'error';

		$sessData['status']['msg'] = 'You have used the wrong verification link, please check your email inbox and try again.';

	}

	// Store account activation status into the session

    $_SESSION['sessData'] = $sessData;

    $redirectURL = 'index.php';

	// Redirect to the login page

    MySessionHandler::commit(session_id());

    header("Location:".$redirectURL);

	exit;

}elseif(isset($_POST['updateProfile']) && !empty($_SESSION['sessData']['userID'])){

	$valErr = 0;

	$sessData = $_SESSION['sessData'];

	unset($sessData['field_error']);

	unset($sessData['status']);

	$sessUserId = $sessData['userID'];

//echo "<pre>", print_r($_POST, 1), "</pre>";

//exit;

	// Get user inputs

	$first_name = sanitizeInput($_POST['first_name']);

	$last_name = sanitizeInput($_POST['last_name']);

	$email = sanitizeInput($_POST['email']);

	$zip = sanitizeInput($_POST['zip']);

	$theme = strtolower(sanitizeInput($_POST['theme']));

	$conditionNew = isset($_POST['filterConditionNew']) ? 1 : 0;

	$conditionUsed = isset($_POST['filterConditionUsed']) ? 1 : 0;

	$mediaCD = isset($_POST['filterMediaTypeCD']) ? 1 : 0;

	$mediaRecord = isset($_POST['filterMediaTypeRecord']) ? 1 : 0;

	$mediaDigital = isset($_POST['filterMediaTypeDigital']) ? 1 : 0;

	$mediaBook = isset($_POST['filterMediaTypeBook']) ? 1 : 0;

	if(empty($first_name)){

		$valErr = 1;

		$sessData['field_error']['first_name'] = 'Please enter your first name.';

	}

/*

	if(empty($last_name)){

		$valErr = 1;

		$sessData['field_error']['last_name'] = 'Please enter your last name.';

	}

*/

	if(empty($email) || !filter_var($email, FILTER_VALIDATE_EMAIL)){

		$valErr = 1;

		$sessData['field_error']['email'] = 'Please enter a valid email.';

	}

	if($valErr == 0){

		// Check whether user exists in the database

		$cond['where'] = array('email' => $email);

		$cond['where_not'] = array('id' => $sessUserId);

		$cond['return_type'] = 'count';

		$userCount = $user->getRows($cond);

		if($userCount > 0){

			$sessData['status']['type'] = 'error';

			$sessData['status']['msg'] = 'Email already exists, please use another email.';

		}else{

			// Get user information

			$conditions['where'] = array(

				'id' => $sessData['userID'],

			);

			$conditions['return_type'] = 'single';

			$userData = $user->getRows($conditions);

			$prevPicture = $userData['picture'];

			// Prepare user data

			$userData = array(

				'first_name' => $first_name,

				'last_name' => $last_name,

				'email' => $email,

				'zip' => $zip,

				'conditionNew' => $conditionNew,

				'conditionUsed' => $conditionUsed,

				'mediaCD' => $mediaCD,

				'mediaRecord' => $mediaRecord,

				'mediaDigital' => $mediaDigital,

				'mediaBook' => $mediaBook,

                                'theme' => $theme

			);

			// Profile picture upload

			$fileErr = 0;

			if(!empty($_FILES['picture']['name'])){

				$targetDir = UPLOAD_PATH.'profile_picture/';

				$fileName = time() . '_'.basename($_FILES["picture"]["tmp_name"]);

				$targetFilePath = $targetDir . $fileName;

				$fileType = strtolower(pathinfo($_FILES["picture"]["name"], PATHINFO_EXTENSION));

				$allowTypes = array('jpg','png','jpeg','gif');

				if (in_array($fileType, $allowTypes)) {

                    if ($_FILES["picture"]["size"] > 500000) {

    					$fileErr = 1;

	    				$sessData['status']['type'] = 'error';

		    			$sessData['status']['msg'] = 'Please upload a smaller image file.';

                    } else {

                        $check = getimagesize($_FILES["picture"]["tmp_name"]);

                        if ($check === false) {

        					$fileErr = 1;

	        				$sessData['status']['type'] = 'error';

		        			$sessData['status']['msg'] = 'Please upload only gif/jpg/png files.';

                        }

                    }

                } else {

	    			$fileErr = 1;

		    		$sessData['status']['type'] = 'error';

			    	$sessData['status']['msg'] = 'Please upload only gif/jpg/png files.';

                }

    			if($fileErr == 0) {

	    			if(move_uploaded_file($_FILES["picture"]["tmp_name"], $targetFilePath)){

		    			$userData['picture'] = $fileName;

			    		// Delete previous profile picture

				    	@unlink(UPLOAD_PATH.'profile_picture/'.$prevPicture);

        			} else {

                        $fileErr = 1;

    		    		$sessData['status']['type'] = 'error';

	    		    	$sessData['status']['msg'] = 'Could not upload picture.';

    			    	@unlink($_FILES["picture"]["tmp_name"]);

        			}

    		    } else {

			    	@unlink($_FILES["picture"]["tmp_name"]);

    			}

	    	}

   			if($fileErr == 0) {

       		    // Update user data in the database

   	    		$conditions = array(

   		    		'id' => $sessUserId

   			    );

   				$update = $user->update($userData, $conditions);

       			// Set status based on data insert

       			if($update){

   	    			$sessData['status']['type'] = 'success';

   		    		$sessData['status']['msg'] = 'Your profile information has been updated.';

   			    }else{

   				   	$sessData['status']['type'] = 'error';

   				    $sessData['status']['msg'] = 'Some problem occurred, please try again.';

       			}

            }

		}

    }else{

        $sessData['status']['type'] = 'error';

        $sessData['status']['msg'] = 'Please fill all mandatory fields.';

    }

	// Store signup status into the session

    $_SESSION['sessData'] = $sessData;

	$redirectURL = 'editAccount.php';

	// Redirect to the profile page

    MySessionHandler::commit(session_id());

    header("Location:".$redirectURL);

	exit;

}elseif(isset($_POST['updatePassword']) && !empty($_SESSION['sessData']['userID'])){

	$sessData = $_SESSION['sessData'];

	unset($sessData['field_error']);

	unset($sessData['status']);

	$sessUserId = $sessData['userID'];

	// Get user inputs

	$old_password = sanitizeInput($_POST['old_password']);

	$password = sanitizeInput($_POST['password']);

	$confirm_password = sanitizeInput($_POST['confirm_password']);

	if(!empty($password) && !empty($confirm_password)){

		// Password and confirm password comparison

        if($password !== $confirm_password){

            $sessData['status']['type'] = 'error';

            $sessData['status']['msg'] = 'Confirm password does not match the password.';

        }else{

			// Check whether identity code exists in the database

			$cond['where'] = array('id' => $sessUserId);

            $cond['return_type'] = 'single';

            $userData = $user->getRows($cond);

			if((!empty($userData) && !empty($sessData['loginType']) && $sessData['loginType'] == 'social') || (!empty($userData) && password_verify($old_password, $userData['password']))){

				// Update data with new password

				$conditions = array(

					'id' => $sessUserId

				);

				$passwordHash = password_hash($password, PASSWORD_DEFAULT);

				$data = array(

					'password' => $passwordHash

				);

				$update = $user->update($data, $conditions);

				if($update){

                    if (!empty($_COOKIE['rememberUserId'])){

    					setcookie('hash', password_hash($passwordHash . $sessUserId, PASSWORD_DEFAULT), time() + (30 * 86400), "/");

    				}

					$sessData['status']['type'] = 'success';

                    $sessData['status']['msg'] = 'Your account password has been updated.';

				}else{

					$sessData['status']['type'] = 'error';

					$sessData['status']['msg'] = 'Some problem occurred, please try again.';

				}

            }else{

                $sessData['status']['type'] = 'error';

                $sessData['status']['msg'] = 'The given old password does not match your current account password.';

            }

        }

    }else{

        $sessData['status']['type'] = 'error';

        $sessData['status']['msg'] = 'Please fill all mandatory fields.';

    }

	// Store reset password status into the session

    $_SESSION['sessData'] = $sessData;

    $redirectURL = 'changePassword.php';

	// Redirect to the pasword settings page

    MySessionHandler::commit(session_id());

    header("Location:".$redirectURL);

	exit;

}elseif(!empty($_REQUEST['logoutSubmit'])){

	// Include social login handler

	if(!empty($_SESSION['sessData']['loginType']) && ($_SESSION['sessData']['loginType'] == 'social') && !empty($_SESSION['google_access_token'])){

		require_once 'includes/socialLogin.php';

	}

	// Remove cookie data

	setcookie("rememberUserId", "", time() - 3600, "/");

	setcookie("hash", "", time() - 3600, "/");

    unset($_COOKIE['rememberUserId']);

    unset($_COOKIE['hash']);

	// Remove session data

	unset($_SESSION['facebook_access_token']);

	unset($_SESSION['FBRLH_state']);

	if(isset($_SESSION['google_access_token'])){

		// Reset OAuth access token

		$gClient->revokeToken();

	}

	unset($_SESSION['google_access_token']);

	unset($_SESSION['twitter_access_token']);

	unset($_SESSION['twitter_token_secret']);

    unset($_SESSION['sessData']);

    session_destroy();

	// Store logout status into the session

    $sessData['status']['type'] = 'success';

    $sessData['status']['msg'] = 'You have logged off your account.';

    $_SESSION['sessData'] = $sessData;

	// Redirect to the home page

    MySessionHandler::commit(session_id());

    header("Location:../index.php");

	exit;

}else{

	// Redirect to the home page

    MySessionHandler::commit(session_id());

    header("Location:../index.php");

	exit;

}

// sanitize user input

function sanitizeInput($data) {

    $data = trim(preg_replace('/[\t\n\r\s]+/', ' ', $data));

    $data = stripslashes($data);

    $data = htmlspecialchars($data);

    return $data;

}