Subversion Repositories cheapmusic

<?php
// Email sending functions
include_once 'includes/email_functions.php';
include_once 'includes/password.php';

// Include Session Handling
require_once ('includes/session.php');
global $systemConf;
if (empty($_POST["nonce"]) || NonceUtil::check($systemConf["nonce_secret"], $_POST["nonce"]) === false) {
    // Redirect to the home page
    MySessionHandler::commit(session_id());
    header("Location:../index.php");
    exit;
}

// Include config file
require_once 'includes/config.php';

// Load and initialize user class
require_once 'includes/User.class.php';
$user = new User();

if (isset($_POST['signupSubmit'])) {
    $valErr = 0;
    $captchaErr = 0;

    // Store post data into session
    $_SESSION['signup_post_data'] = $_POST;

    if (!empty($_POST['g-recaptcha-response'])) {
        $secretKey = GR_SECRET_KEY;
        $ch = curl_init('https://www.google.com/recaptcha/api/siteverify?secret=' . $secretKey . '&response=' . $_POST['g-recaptcha-response']);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        $verifyResponse = curl_exec($ch);
        $responseData = json_decode($verifyResponse);

        if ($responseData->success) {
            if ($responseData->score < 0.6) {
                $captchaErr = 1;
                $sessData['status']['type'] = 'error';
                $sessData['status']['msg'] = 'Robot verification failed, please try again.';
            }
        }
        else {
            $captchaErr = 1;
            $sessData['status']['type'] = 'error';
            $sessData['status']['msg'] = 'Robot verification failed, please try again.';
        }
    }
    else {
        $captchaErr = 1;
        $sessData['status']['type'] = 'error';
        $sessData['status']['msg'] = 'Robot verification failed, please try again.';
    }

    if ($captchaErr == 1) {
        // Redirect back to the registration page
        $_SESSION['sessData'] = $sessData;
        MySessionHandler::commit(session_id());
        header("Location:registration.php");
        exit;
    }

    // Get user inputs
    $first_name = sanitizeInput($_POST['first_name']);
    $last_name = sanitizeInput($_POST['last_name']);
    $email = sanitizeInput($_POST['email']);
    $zip = sanitizeInput($_POST['zip']);
    $password = sanitizeInput($_POST['password']);
    $confirm_password = sanitizeInput($_POST['confirm_password']);

    if (empty($first_name)) {
        $valErr = 1;
        $sessData['field_error']['first_name'] = 'Please enter your first name.';
    }
    /*
    if(empty($last_name)){
    $valErr = 1;
    $sessData['field_error']['last_name'] = 'Please enter your last name.';
    }
    */
    if (empty($email) || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $valErr = 1;
        $sessData['field_error']['email'] = 'Please enter a valid email.';
    }
    if (empty($password)) {
        $valErr = 1;
        $sessData['field_error']['password'] = 'Please enter account password.';
    }
    if (empty($confirm_password)) {
        $valErr = 1;
        $sessData['field_error']['confirm_password'] = 'Please confirm your password.';
    }
    elseif ($password !== $confirm_password) {
        $valErr = 1;
        $sessData['field_error']['confirm_password'] = 'Confirm password does not match the password.';
    }

    if ($valErr == 0) {
        // Check whether user exists in the database
        $cond['where'] = array(
            'email' => $email
        );
        $cond['return_type'] = 'count';
        $userCount = $user->getRows($cond);
        if ($userCount > 0) {
            $sessData['status']['type'] = 'error';
            $sessData['status']['msg'] = 'Email already exists, please use another email.';
        }
        else {
            // Email verification code
            $uniqidStr = md5(uniqid(mt_rand()));

            // Insert user data in the database
            $userData = array(
                'first_name' => $first_name,
                'last_name' => $last_name,
                'email' => $email,
                'password' => password_hash($password, PASSWORD_DEFAULT) ,
                'zip' => $zip,
                'activation_code' => $uniqidStr
            );
            $insert = $user->insert($userData);

            // Set status based on data insert
            if ($insert) {
                // Remove post data from session
                unset($_SESSION['signup_post_data']);

                // Send account verification email
                @emailVerification($userData);

                $sessData['status']['type'] = 'success';
                $sessData['status']['msg'] = 'Your registration was successful. Please check your email inbox (and spam folder) to verify and activate your account.';

                // Remove post data from session
                unset($_SESSION['signup_post_data']);
            }
            else {
                $sessData['status']['type'] = 'error';
                $sessData['status']['msg'] = 'Some problem occurred, please try again.';
            }
        }
    }
    else {
        $sessData['status']['type'] = 'error';
        $sessData['status']['msg'] = 'Please fill all mandatory fields.';
    }

    // Store signup status into the session
    $_SESSION['sessData'] = $sessData;
    $redirectURL = ($sessData['status']['type'] == 'success') ? 'index.php' : 'registration.php';

    // Redirect to the home/login page
    MySessionHandler::commit(session_id());
    header("Location:" . $redirectURL);
    exit;
}
elseif (isset($_POST['loginSubmit'])) {
    // Get user inputs
    $email = sanitizeInput($_POST['email']);
    $password = sanitizeInput($_POST['password']);

    // Check whether login details are empty
    if (!empty($email) && !empty($password)) {
        // Get user data from user class
        $conditions['where'] = array(
            'email' => $email,
            'status' => '1'
        );
        $conditions['return_type'] = 'single';
        $userData = $user->getRows($conditions);

        if (!empty($userData) && password_verify($password, $userData['password'])) {
            // Set user data and status based on login credentials
            if ($userData['activated'] == '0') {
                $sessData['status']['type'] = 'error';
                $sessData['status']['msg'] = 'Your account activation is pending, please check your email inbox to verify and activate your account.';
            }
            else {
                // If remember me is checked
                if (isset($_POST['rememberMe']) && $_POST['rememberMe'] == 1) {
                    setcookie('rememberUserId', $userData['id'], time() + (30 * 86400) , "/");
                    setcookie('hash', password_hash($userData['password'] . $userData['id'], PASSWORD_DEFAULT) , time() + (30 * 86400) , "/");
                }

                $sessData['userLoggedIn'] = true;
                $sessData['userID'] = $userData['id'];
                $sessData['status']['type'] = 'success';
                $sessData['status']['msg'] = 'Welcome ' . $userData['first_name'] . '!';
            }
        }
        else {
            $sessData['status']['type'] = 'error';
            $sessData['status']['msg'] = 'Wrong email or password, please try again.';
        }
    }
    else {
        $sessData['status']['type'] = 'error';
        $sessData['status']['msg'] = 'Enter email and password.';
    }

    // Store login status into the session
    $_SESSION['sessData'] = $sessData;

    // Redirect to the home page
    MySessionHandler::commit(session_id());
    header("Location:index.php");
    exit;
}
elseif (isset($_POST['forgotSubmit'])) {
    $frmDisplay = '';

    // Get user inputs
    $email = sanitizeInput($_POST['email']);

    // Check whether email is empty
    if (!empty($email)) {
        // Check whether user exists in the database
        $cond['where'] = array(
            'email' => $email
        );
        $cond['return_type'] = 'count';
        $userCount = $user->getRows($cond);
        if ($userCount > 0) {
            // Generat unique string
            $uniqidStr = md5(uniqid(mt_rand()));

            // Update data with forgot pass code
            $conditions = array(
                'email' => $email
            );
            $data = array(
                'forgot_pass_identity' => $uniqidStr
            );
            $update = $user->update($data, $conditions);

            if ($update) {
                // Get user details
                $con['where'] = array(
                    'email' => $email
                );
                $con['return_type'] = 'single';
                $userDetails = $user->getRows($con);

                // Send reset password email
                @forgotPassEmail($userDetails);

                $sessData['status']['type'] = 'success';
                $sessData['status']['msg'] = 'Please check your email inbox (and spam folder), we have sent a password reset link to your registered email.';
                $frmDisplay = '?frmDis=0';
            }
            else {
                $sessData['status']['type'] = 'error';
                $sessData['status']['msg'] = 'Some problem occurred, please try again.';
            }
        }
        else {
            $sessData['status']['type'] = 'error';
            $sessData['status']['msg'] = 'Given email is not associated with any account.';
        }

    }
    else {
        $sessData['status']['type'] = 'error';
        $sessData['status']['msg'] = 'Enter email to create a new password for your account.';
    }

    // Store reset password status into the session
    $_SESSION['sessData'] = $sessData;

    // Redirect to the forgot pasword page
    MySessionHandler::commit(session_id());
    header("Location:forgotPassword.php" . $frmDisplay);
}
elseif (isset($_POST['resetSubmit'])) {
    $fp_code = sanitizeInput($_POST['fp_code']);

    // Get user inputs
    $password = sanitizeInput($_POST['password']);
    $confirm_password = sanitizeInput($_POST['confirm_password']);

    if (!empty($password) && !empty($confirm_password) && !empty($fp_code)) {
        // Password and confirm password comparison
        if ($password !== $confirm_password) {
            $sessData['status']['type'] = 'error';
            $sessData['status']['msg'] = 'Confirm password does not match the password.';
        }
        else {
            //check whether identity code exists in the database
            $cond['where'] = array(
                'forgot_pass_identity' => $fp_code
            );
            $cond['return_type'] = 'count';
            $userCount = $user->getRows($cond);
            if ($userCount > 0) {
                // Update data with new password
                $conditions = array(
                    'forgot_pass_identity' => $fp_code
                );
                $data = array(
                    'password' => password_hash($password, PASSWORD_DEFAULT)
                );
                $update = $user->update($data, $conditions);
                if ($update) {
                    $sessData['status']['type'] = 'success';
                    $sessData['status']['msg'] = 'Your account password has been reset. Please login with your new password.';
                }
                else {
                    $sessData['status']['type'] = 'error';
                    $sessData['status']['msg'] = 'Some problem occurred, please try again.';
                }
            }
            else {
                $sessData['status']['type'] = 'error';
                $sessData['status']['msg'] = 'You are not authorized to reset the password for this account.';
            }
        }
    }
    else {
        $sessData['status']['type'] = 'error';
        $sessData['status']['msg'] = 'All fields are mandatory, please fill all the fields.';
    }

    // Store reset password status into the session
    $_SESSION['sessData'] = $sessData;
    $redirectURL = ($sessData['status']['type'] == 'success') ? 'index.php' : 'resetPassword.php?fp_code=' . $fp_code;

    // Redirect to the login/reset pasword page
    MySessionHandler::commit(session_id());
    header("Location:" . $redirectURL);
    exit;
}
elseif (isset($_REQUEST['verifyEmail']) && $_REQUEST['verifyEmail'] == 1) {
    $ac_code = $_REQUEST['ac_code'];

    // Check whether activation code exists in the database
    $cond['where'] = array(
        'activation_code' => $ac_code
    );
    $cond['return_type'] = 'count';
    $userCount = $user->getRows($cond);
    if ($userCount > 0) {
        // Update data with new password
        $conditions = array(
            'activation_code' => $ac_code
        );
        $data = array(
            'activated' => '1'
        );
        $update = $user->update($data, $conditions);
        if ($update) {
            $sessData['status']['type'] = 'success';
            $sessData['status']['msg'] = 'Email verification for your account was successful. Please login to your account.';
        }
        else {
            $sessData['status']['type'] = 'error';
            $sessData['status']['msg'] = 'Some problem occurred, please try again.';
        }
    }
    else {
        $sessData['status']['type'] = 'error';
        $sessData['status']['msg'] = 'You have used the wrong verification link, please check your email inbox and try again.';
    }

    // Store account activation status into the session
    $_SESSION['sessData'] = $sessData;
    $redirectURL = 'index.php';

    // Redirect to the login page
    MySessionHandler::commit(session_id());
    header("Location:" . $redirectURL);
    exit;
}
elseif (isset($_POST['updateProfile']) && !empty($_SESSION['sessData']['userID'])) {
    $valErr = 0;

    $sessData = $_SESSION['sessData'];
    unset($sessData['field_error']);
    unset($sessData['status']);
    $sessUserId = $sessData['userID'];

    //echo "<pre>", print_r($_POST, 1), "</pre>";
    //exit;
    // Get user inputs
    $first_name = sanitizeInput($_POST['first_name']);
    $last_name = sanitizeInput($_POST['last_name']);
    $email = sanitizeInput($_POST['email']);
    $zip = sanitizeInput($_POST['zip']);
    $theme = strtolower(sanitizeInput($_POST['theme']));
    $cardView = $_POST['cardView'];
    $conditionNew = isset($_POST['filterConditionNew']) ? 1 : 0;
    $conditionUsed = isset($_POST['filterConditionUsed']) ? 1 : 0;
    $mediaCD = isset($_POST['filterMediaTypeCD']) ? 1 : 0;
    $mediaRecord = isset($_POST['filterMediaTypeRecord']) ? 1 : 0;
    $mediaDigital = isset($_POST['filterMediaTypeDigital']) ? 1 : 0;
    $mediaBook = isset($_POST['filterMediaTypeBook']) ? 1 : 0;
    $wlEmail = $_POST['wlEmail'];
    $wlFreq = $_POST['wlFreq'];

    if (empty($first_name)) {
        $valErr = 1;
        $sessData['field_error']['first_name'] = 'Please enter your first name.';
    }
    /*
    if(empty($last_name)){
    $valErr = 1;
    $sessData['field_error']['last_name'] = 'Please enter your last name.';
    }
    */
    if (empty($email) || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $valErr = 1;
        $sessData['field_error']['email'] = 'Please enter a valid email.';
    }

    if ($valErr == 0) {
        // Check whether user exists in the database
        $cond['where'] = array(
            'email' => $email
        );
        $cond['where_not'] = array(
            'id' => $sessUserId
        );
        $cond['return_type'] = 'count';
        $userCount = $user->getRows($cond);
        if ($userCount > 0) {
            $sessData['status']['type'] = 'error';
            $sessData['status']['msg'] = 'Email already exists, please use another email.';
        }
        else {
            // Get user information
            $conditions['where'] = array(
                'id' => $sessData['userID'],
            );
            $conditions['return_type'] = 'single';
            $userData = $user->getRows($conditions);
            $prevPicture = $userData['picture'];

            // Prepare user data
            $userData = array(
                'first_name' => $first_name,
                'last_name' => $last_name,
                'email' => $email,
                'zip' => $zip,
                'conditionNew' => $conditionNew,
                'conditionUsed' => $conditionUsed,
                'mediaCD' => $mediaCD,
                'mediaRecord' => $mediaRecord,
                'mediaDigital' => $mediaDigital,
                'mediaBook' => $mediaBook,
                'theme' => $theme,
                'cardView' => $cardView,
                'wlEmailFlag' => $wlEmail,
                'wlFreq' => $wlFreq
            );

            // Profile picture upload
            $fileErr = 0;
            if (!empty($_FILES['picture']['name'])) {
                $targetDir = UPLOAD_PATH . 'profile_picture/';
                $fileName = time() . '_' . basename($_FILES["picture"]["tmp_name"]);
                $targetFilePath = $targetDir . $fileName;
                $fileType = strtolower(pathinfo($_FILES["picture"]["name"], PATHINFO_EXTENSION));
                $allowTypes = array(
                    'jpg',
                    'png',
                    'jpeg',
                    'gif'
                );
                if (in_array($fileType, $allowTypes)) {
                    if ($_FILES["picture"]["size"] > 500000) {
                        $fileErr = 1;
                        $sessData['status']['type'] = 'error';
                        $sessData['status']['msg'] = 'Please upload a smaller image file.';
                    }
                    else {
                        $check = getimagesize($_FILES["picture"]["tmp_name"]);
                        if ($check === false) {
                            $fileErr = 1;
                            $sessData['status']['type'] = 'error';
                            $sessData['status']['msg'] = 'Please upload only gif/jpg/png files.';
                        }
                    }
                }
                else {
                    $fileErr = 1;
                    $sessData['status']['type'] = 'error';
                    $sessData['status']['msg'] = 'Please upload only gif/jpg/png files.';
                }

                if ($fileErr == 0) {
                    if (move_uploaded_file($_FILES["picture"]["tmp_name"], $targetFilePath)) {
                        $userData['picture'] = $fileName;

                        // Delete previous profile picture
                        @unlink(UPLOAD_PATH . 'profile_picture/' . $prevPicture);
                    }
                    else {
                        $fileErr = 1;
                        $sessData['status']['type'] = 'error';
                        $sessData['status']['msg'] = 'Could not upload picture.';
                        @unlink($_FILES["picture"]["tmp_name"]);
                    }
                }
                else {
                    @unlink($_FILES["picture"]["tmp_name"]);
                }
            }

            if ($fileErr == 0) {
                // Update user data in the database
                $conditions = array(
                    'id' => $sessUserId
                );

                $update = $user->update($userData, $conditions);

                // Set status based on data insert
                if ($update) {
                    $sessData['status']['type'] = 'success';
                    $sessData['status']['msg'] = 'Your profile information has been updated.';
                }
                else {
                    $sessData['status']['type'] = 'error';
                    $sessData['status']['msg'] = 'Some problem occurred, please try again.';
                }
            }
        }
    }
    else {
        $sessData['status']['type'] = 'error';
        $sessData['status']['msg'] = 'Please fill all mandatory fields.';
    }

    // Store signup status into the session
    $_SESSION['sessData'] = $sessData;
    $redirectURL = 'editAccount.php';

    // Redirect to the profile page
    MySessionHandler::commit(session_id());
    header("Location:" . $redirectURL);
    exit;
}
elseif (isset($_POST['updatePassword']) && !empty($_SESSION['sessData']['userID'])) {
    $sessData = $_SESSION['sessData'];
    unset($sessData['field_error']);
    unset($sessData['status']);
    $sessUserId = $sessData['userID'];

    // Get user inputs
    $old_password = sanitizeInput($_POST['old_password']);
    $password = sanitizeInput($_POST['password']);
    $confirm_password = sanitizeInput($_POST['confirm_password']);

    if (!empty($password) && !empty($confirm_password)) {
        // Password and confirm password comparison
        if ($password !== $confirm_password) {
            $sessData['status']['type'] = 'error';
            $sessData['status']['msg'] = 'Confirm password does not match the password.';
        }
        else {
            // Check whether identity code exists in the database
            $cond['where'] = array(
                'id' => $sessUserId
            );
            $cond['return_type'] = 'single';
            $userData = $user->getRows($cond);

            if ((!empty($userData) && !empty($sessData['loginType']) && $sessData['loginType'] == 'social') || (!empty($userData) && password_verify($old_password, $userData['password']))) {
                // Update data with new password
                $conditions = array(
                    'id' => $sessUserId
                );
                $passwordHash = password_hash($password, PASSWORD_DEFAULT);
                $data = array(
                    'password' => $passwordHash
                );
                $update = $user->update($data, $conditions);
                if ($update) {
                    if (!empty($_COOKIE['rememberUserId'])) {
                        setcookie('hash', password_hash($passwordHash . $sessUserId, PASSWORD_DEFAULT) , time() + (30 * 86400) , "/");
                    }
                    $sessData['status']['type'] = 'success';
                    $sessData['status']['msg'] = 'Your account password has been updated.';
                }
                else {
                    $sessData['status']['type'] = 'error';
                    $sessData['status']['msg'] = 'Some problem occurred, please try again.';
                }
            }
            else {
                $sessData['status']['type'] = 'error';
                $sessData['status']['msg'] = 'The given old password does not match your current account password.';
            }
        }
    }
    else {
        $sessData['status']['type'] = 'error';
        $sessData['status']['msg'] = 'Please fill all mandatory fields.';
    }

    // Store reset password status into the session
    $_SESSION['sessData'] = $sessData;
    $redirectURL = 'changePassword.php';

    // Redirect to the pasword settings page
    MySessionHandler::commit(session_id());
    header("Location:" . $redirectURL);
    exit;
}
elseif (!empty($_REQUEST['logoutSubmit'])) {
    // Include social login handler
    if (!empty($_SESSION['sessData']['loginType']) && ($_SESSION['sessData']['loginType'] == 'social') && !empty($_SESSION['google_access_token'])) {
        require_once 'includes/socialLogin.php';
    }

    // Remove cookie data
    setcookie("rememberUserId", "", time() - 3600, "/");
    setcookie("hash", "", time() - 3600, "/");
    unset($_COOKIE['rememberUserId']);
    unset($_COOKIE['hash']);

    // Remove session data
    unset($_SESSION['facebook_access_token']);
    unset($_SESSION['FBRLH_state']);
    if (isset($_SESSION['google_access_token'])) {
        // Reset OAuth access token
        $gClient->revokeToken();
    }
    unset($_SESSION['google_access_token']);
    unset($_SESSION['twitter_access_token']);
    unset($_SESSION['twitter_token_secret']);
    unset($_SESSION['sessData']);
    session_destroy();

    // Store logout status into the session
    $sessData['status']['type'] = 'success';
    $sessData['status']['msg'] = 'You have logged off your account.';
    $_SESSION['sessData'] = $sessData;

    // Redirect to the home page
    MySessionHandler::commit(session_id());
    header("Location:../index.php");
    exit;
}
else {
    // Redirect to the home page
    MySessionHandler::commit(session_id());
    header("Location:../index.php");
    exit;
}

// sanitize user input
function sanitizeInput($data) {
    $data = trim(preg_replace('/[\t\n\r\s]+/', ' ', $data));
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}