ilch.de :: Forum :: Ilch Clan 1.1 :: Kritik und Verbesserungen

Hier die Dateien:
profil_edit.php

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

<?php
#   Copyright by: Manuel
#   Support: www.ilch.de
 
 
defined ('main') or die ( 'no direct access' );
 
 
$title = $allgAr['title'].' :: Users :: Profil';
$hmenu  = $extented_forum_menu.'<a class="smalfont" href="?user">Users</a><b> &raquo; </b> Profil'.$extented_forum_menu_sufix;
$design = new design ( $title , $hmenu, 1);
 
 
 
if ( $_SESSION['authright'] <= -1 ) {
 
if ( empty ($_POST['submit']) ) {
  $design->header();
    $abf = 'SELECT email,wohnort,homepage,aim,msn,icq,yahoo,avatar,status,staat,gebdatum,sig,opt_pm_popup,opt_pm,opt_mail,geschlecht,spezrank FROM `prefix_user` WHERE id = "'.$_SESSION['authid'].'"';
    $erg = db_query($abf);
    if ( db_num_rows($erg) > 0 ) {
      $row = db_fetch_assoc($erg);
 
        $tpl = new tpl ('user/profil_edit');
        $row['staat'] = '<option></option>'.arliste ( $row['staat'] , get_nationality_array() , $tpl , 'staat' );
    $row['geschlecht0'] = ( $row['geschlecht'] < 1 ? 'checked' : '' );
    $row['geschlecht1'] = ( $row['geschlecht'] == 1 ? 'checked' : '' );
    $row['geschlecht2'] = ( $row['geschlecht'] == 2 ? 'checked' : '' );
    if ( $row['status'] == 1 ) { $row['status1'] = 'checked'; $row['status0'] = ''; } else { $row['status1'] = ''; $row['status0'] = 'checked'; }
    if ( $row['opt_mail'] == 1 ) { $row['opt_mail1'] = 'checked'; $row['opt_mail0'] = ''; } else { $row['opt_mail1'] = ''; $row['opt_mail0'] = 'checked'; }
    if ( $row['opt_pm'] == 1 ) { $row['opt_pm1'] = 'checked'; $row['opt_pm0'] = ''; } else { $row['opt_pm1'] = ''; $row['opt_pm0'] = 'checked'; }
    if ( $row['opt_pm_popup'] == 1 ) { $row['opt_pm_popup1'] = 'checked'; $row['opt_pm_popup0'] = ''; } else { $row['opt_pm_popup1'] = ''; $row['opt_pm_popup0'] = 'checked'; }
 
    $row['avatarbild'] = ( file_exists ( $row['avatar'] ) ? '<img src="'.$row['avatar'].'" alt=""><br />' : '' );
    $row['Fabreite'] = $allgAr['Fabreite'];
    $row['Fahohe'] = $allgAr['Fahohe'];
    $row['Fasize'] = $allgAr['Fasize'];
    $row['forum_max_sig'] = $allgAr['forum_max_sig'];
    $row['uid'] = $_SESSION['authid'];
    $row['forum_usergallery'] = $allgAr['forum_usergallery'];
    $tpl->set_ar_out($row,0);
    if ($allgAr['forum_avatar_upload']) $tpl->out(1);
    $tpl->set_ar_out($row,2);
        profilefields_change ( $_SESSION['authid'] );
        $tpl->out(3);
 
  } else {
    $tpl = new tpl ( 'user/login.htm' );
    $tpl->set_out('WDLINK','index.php',0);
    }
 
} else {  # submit
 
  # change poassword
    if ( !empty($_POST['np1']) AND !empty($_POST['np2']) AND !empty($_POST['op'])) {
    if ($_POST['np1'] == $_POST['np2']) {
          $akpw = db_result(db_query("SELECT pass FROM prefix_user WHERE id = ".$_SESSION['authid']),0);
            if ($akpw == md5($_POST['op'])) {
              $newpw = md5($_POST['np1']);
                db_query("UPDATE prefix_user SET pass = '".$newpw."' WHERE id = ".$_SESSION['authid']);
        setcookie(session_und_cookie_name(), $_SESSION['authid'].'='.$newpw, time() + 31104000, "/" );
                $fmsg = $lang['passwortchanged'];
            } else {
            $fmsg = $lang['passwortwrong'];
          }
        } else {
          $fmsg = $lang['passwortnotequal'];
      }
  }
 
  # avatar speichern START
            $avatar_sql_update = '';
      if ( !empty ( $_FILES['avatarfile']['name'] ) AND $allgAr['forum_avatar_upload'] ) {
                $file_tmpe = $_FILES['avatarfile']['tmp_name'];
        $rile_type = ic_mime_type ($_FILES['avatarfile']['tmp_name']);
                $file_type = $_FILES['avatarfile']['type'];
                $file_size = $_FILES['avatarfile']['size'];
        $fmsg = $lang['avatarisnopicture'];
        $size  = @getimagesize ($file_tmpe);
        $endar = array (1 => 'gif', 2 => 'jpg', 3 => 'png');
                if ( ($size[2] == 1 OR $size[2] == 2 OR $size[2] == 3) AND $size[0] > 10 AND $size[1] > 10 AND substr ( $file_type , 0 , 6 ) == 'image/' AND substr ( $rile_type , 0 , 6 ) == 'image/' ) {
                  $endung = $endar[$size[2]];
          $breite = $size[0];
          $hoehe  = $size[1];
          $fmsg = $lang['avatarcannotupload'];
                  if ( $file_size <= $allgAr['Fasize'] AND $breite <= $allgAr['Fabreite'] AND $hoehe <=  $allgAr['Fahohe'] ) {
                      $neuer_name = 'include/images/avatars/'.$_SESSION['authid'].'.'.$endung;
                        @unlink (db_result(db_query("SELECT avatar FROM prefix_user WHERE id = ".$_SESSION['authid']),0));
            move_uploaded_file ( $file_tmpe , $neuer_name );
            @chmod($neuer_name, 0777);
            $avatar_sql_update = "avatar = '".$neuer_name."',";
            $fmsg = $lang['pictureuploaded'];
                    }
                }
            } elseif ( isset($_POST['avatarloeschen']) ) {
        $fmsg = $lang['picturedelete'];
        @unlink (db_result(db_query("SELECT avatar FROM prefix_user WHERE id = ".$_SESSION['authid']),0));
        $avatar_sql_update = "avatar = '',";
      }
  # avatar speichern ENDE
 
 
  # email aendern
  if ($_POST['email'] != $_POST['aemail']) {
    $id = $_SESSION['authid'].'||'.md5 (uniqid (rand()));
    db_query("INSERT INTO prefix_usercheck (`check`,email,datime,ak)
    VALUES ('".$id."','".escape($_POST['email'],'string')."',NOW(),3)");
    $page = $_SERVER["HTTP_HOST"].$_SERVER["SCRIPT_NAME"];
    $text = $lang['changedthemail'] . sprintf ($lang['registconfirmlink'], $page, $id );
    icmail ($_POST['email'], $lang['mail'].' '.$lang['changed'], $text );
    $fmsg = $lang['pleaseconfirmmail'];
  }
  #
 
  #remove account
  if (isset($_POST['removeaccount'])) {
    $id = $_SESSION['authid'].'-remove-'.md5 (uniqid (rand()));
    db_query("INSERT INTO prefix_usercheck (`check`,email,datime,ak)
    VALUES ('".$id."','".escape($_POST['email'],'string')."',NOW(),5)");
    $page = $_SERVER["HTTP_HOST"].$_SERVER["SCRIPT_NAME"];
    $text = $lang['removeconfirm'] . sprintf ($lang['registconfirmlink'], $page, $id );
    icmail ($_POST['email'], html_entity_decode($lang['removeaccount']), $text );
    $fmsg = $lang['pleaseconfirmremove'];
  }
  #remove account
 
 
  # statische felder speichern
          db_query("UPDATE prefix_user
              SET
          homepage = '".get_homepage(escape($_POST['homepage'], 'string'))."',
          wohnort = '".escape($_POST['wohnort'], 'string')."',
          icq = '".escape($_POST['icq'], 'string')."',
          msn = '".escape($_POST['msn'], 'string')."',
          yahoo = '".escape($_POST['yahoo'], 'string')."',
          ".$avatar_sql_update."
          aim = '".escape($_POST['aim'], 'string')."',
          staat = '".escape($_POST['staat'], 'string')."',
          geschlecht = '".escape($_POST['geschlecht'], 'string')."',
          status = '".escape($_POST['status'], 'string')."',
          opt_mail = '".escape($_POST['opt_mail'], 'string')."',
          opt_pm = '".escape($_POST['opt_pm'], 'string')."',
          opt_pm_popup = '".escape($_POST['opt_pm_popup'], 'string')."',
          gebdatum = '".get_datum(escape($_POST['gebdatum'], 'string'))."',
          sig = '".substr(escape($_POST['sig'], 'string'),0,$allgAr['forum_max_sig'])."'
                WHERE id = ".$_SESSION['authid']
      );
 
 
    # change other profil fields
 
  profilefields_change_save ( $_SESSION['authid'] );
    $design->header();
 
    # definie and print msg
    $fmsg = ( isset($fmsg) ? $fmsg : $lang['changesuccessful'] );
    wd('?user-8' , $fmsg  , 3 );
 
}
 
} else {
        $tpl = new tpl ( 'user/login' );
        $tpl->set_out('WDLINK', '?user-8', 0);
}
 
$design->footer();

user_details.php

<?php
#   Copyright by: Manuel
#   Support: www.ilch.de
 
 
defined ('main') or die ( 'no direct access' );
 
$uid = intval($menu->get(2));
 
$abf = 'SELECT * FROM prefix_user WHERE id = "'.$uid.'"';
$erg = db_query($abf);
 
if (db_num_rows($erg)) {
    $row = db_fetch_assoc($erg);
 
    $avatar = '';
    if ( file_exists($row['avatar'])) {
        $avatar = '<img src="'.$row['avatar'].'" border="0">';
    }
 
    $regsek = mktime ( 0,0,0, date('m'), date('d'), date('Y') )  - $row['regist'];
    $regday = round($regsek / 86400);
    $postpday = ( $regday == 0 ? 0 : round($row['posts'] / $regday, 2 ) );
 
    $ar = array (
      'NAME' => $row['name'],
        'JOINED'  => date('d M Y',$row['regist']),
        'LASTAK'  => date('d M Y - H:i',$row['llogin']),
        'POSTS'   => $row['posts'],
        'postpday' => $postpday,
        'RANG'    => userrang ($row['posts'],$uid),
        'AVATA'   => $avatar,
    );
 
 
    $title = $allgAr['title'].' :: Users :: Details von '.$row['name'];
    $hmenu  = $extented_forum_menu.'<a class="smalfont" href="?user">Users</a><b> &raquo; </b> Details von '.$row['name'].$extented_forum_menu_sufix;
    $design = new design ( $title , $hmenu, 1);
    $design->header();
 
    $tpl = new tpl ( 'user/userdetails' );
 
    $l = profilefields_show ( $uid );
 
    $ar['rowspan'] = 4 + substr_count($l, '<tr><td class="');
 
    $ar['profilefields'] = $l;
    $tpl->set_ar_out($ar,0);
} else {
    $title = $allgAr['title'].' :: Users :: User nicht gefunden';
    $hmenu  = $extented_forum_menu.'<a class="smalfont" href="?user">Users</a> '.$extented_forum_menu_sufix;
    $design = new design ( $title , $hmenu, 1);
    $design->header();
 
    echo 'Der Benutzer wurde nicht gefunden bzw. die Seite wurde nicht richtig aufgerufen.<br />';
}
 
$design->footer();

profil_edit.htm

<form action="index.php?user-profil" method="POST" enctype="multipart/form-data">
    <fieldset>
      <legend>Persönliche Daten ändern</legend>
          <br />
          <label style="float:left; width:35%;">{_lang_mail}</label><input style="margin-bottom:2px;" name="email" value="{email}" /><input type="hidden" name="aemail" value="{email}" /><font class="smalfont">{_lang_mustbeentered}</font><br />
            <label style="float:left; width:35%;">{_lang_homepage}</label><input style="margin-bottom:2px;" name="homepage" value="{homepage}" /><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_hometown}</label><input style="margin-bottom:2px;" name="wohnort" value="{wohnort}" /><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_icq}</label><input style="margin-bottom:2px;" name="icq" value="{icq}" /><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_msn}</label><input style="margin-bottom:2px;" name="msn" value="{msn}" /><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_yahoo}</label><input style="margin-bottom:2px;" name="yahoo" value="{yahoo}" /><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_aim}</label><input style="margin-bottom:2px;" name="aim" value="{aim}" /><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_birthday}</label><input style="margin-bottom:2px;" name="gebdatum" value="{gebdatum}" /><font class="smalfont">{_lang_dateformat}</font><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_state}</label><select style="margin-bottom:2px;" name="staat">{_list_staat@<option%1 value="%2">%3</option>}</select><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_sex}</label><input style="margin-bottom:2px;" type="radio" value="1" id="geschlecht1" name="geschlecht" {geschlecht1} /><label for="geschlecht1"> {_lang_male}</label>, <input id="geschlecht2" type="radio" value="2" name="geschlecht" {geschlecht2} /><label for="geschlecht2"> {_lang_female}</label>, <input id="geschlecht0" type="radio" value="0" name="geschlecht" {geschlecht0} /><label for="geschlecht0"> {_lang_itdoesntmatter}</label><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_status}</label><input id="status_aktiv" type="radio" value="1" name="status" {status1} /><label for="status_aktiv"> {_lang_active}</label>, <input id="status_inaktiv" type="radio" value="0" name="status" {status0} /><label for="status_inaktiv"> {_lang_inactive}</label><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_mails}<span class="smalfont"> {_lang_fromotherusers}?</span></label><input id="opt_mail1" type="radio" value="1" name="opt_mail" {opt_mail1} /><label for="opt_mail1"> {_lang_yes}</label>, <input id="opt_mail0" type="radio" value="0" name="opt_mail" {opt_mail0} /><label for="opt_mail0"> {_lang_no}</label><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_privatemessages}<span class="smalfont"> {_lang_fromotherusers}?</span></label><input id="opt_pm1" type="radio" value="1" name="opt_pm" {opt_pm1} /><label for="opt_pm1"> {_lang_yes}</label>, <input id="opt_pm0" type="radio" value="0" name="opt_pm" {opt_pm0} /><label for="opt_pm0"> {_lang_no}</label><br style="clear:both;" />
            <label style="float:left; width:35%;">{_lang_privatemessages}<span class="smalfont"> {_lang_popupbynewmsg}?</span></label><input id="opt_pm_popup1" type="radio" value="1" name="opt_pm_popup" {opt_pm_popup1} /><label for="opt_pm_popup1"> {_lang_yes}</label>, <input id="opt_pm_popup0" type="radio" value="0" name="opt_pm_popup" {opt_pm_popup0} /><label for="opt_pm_popup0"> {_lang_no}</label><br  style="fclear:both;" /><br />
            {_if_{forum_usergallery}=='1'}<div align="center">
                <a href="index.php?user-usergallery-{uid}">Usergallery</a> &nbsp; <a href="index.php?user-remove"/></a>
            </div>{/_endif}<br />
            {EXPLODE}
      <fieldset>
      <legend>{_lang_removeaccount}</legend>
      <label style="float:left; width:35%;">&nbsp;</label><input type="checkbox" value="yes" name="removeaccount" /> {_lang_delete}? &nbsp; <font class="smalfont">{_lang_mustbeentered}</font>
      </fieldset>
      <fieldset>
              <legend>{_lang_avatar}</legend>
                <label style="float:left; width:35%;">&nbsp;</label>{avatarbild}<input type="checkbox" value="yes" name="avatarloeschen" /> {_lang_delete}?<br /><br />
                <label style="float:left; width:35%;">&nbsp;</label><input style="margin-bottom:2px;" type="file" name="avatarfile" /><br /><font class="smalfont"><br />{_lang_criterions}: {_lang_maxwidth} {Fabreite}px, {_lang_maxheight} {Fahohe}px {_lang_and} max size {Fasize} bytes.  {_lang_otherwisenoaction}.</font><br />
            </fieldset>
            <br />
            {EXPLODE}
            <fieldset>
              <legend>{_lang_signature}</legend>
                <label style="float:left; width:35%;"><font class="smalfont">{_lang_max} {forum_max_sig} {_lang_signs}.</font></label><textarea style="margin-bottom:2px;" cols="60" rows="2" name="sig">{sig}</textarea><br />
            </fieldset>
            <br />
            <fieldset>
              <legend>{_lang_editpassword}</legend>
                <br />
                <label style="float:left; width:35%;">{_lang_current}</label><input style="margin-bottom:2px;" type="password" name="op" maxlength="20"><br />
                <label style="float:left; width:35%;">{_lang_new}</label><input style="margin-bottom:2px;" type="password" name="np1" maxlength="20"><br />
                <label style="float:left; width:35%;">{_lang_repeat}</label><input style="margin-bottom:2px;" type="password" name="np2" maxlength="20"><br />
            </fieldset>
      <br />
      <fieldset>
        <br />
    {EXPLODE}
      </fieldset>
      <br />
      <div align="center">
      <input style="margin-bottom:2px;" type="submit" value="{_lang_send2}" name="submit">
      </div>
    </fieldset>
</form>

userdetails.htm

<a href="javascript:history.back(1)"><b>&laquo;</b> {_lang_back}</a>
<br />
<br />
 
<table width="100%" cellpadding="3" cellspacing="1" class="border">
  <tr class="Chead"> 
    <th colspan="3"><b>{_lang_detailsfrom} {NAME}</b></th>
  </tr><tr>
    <td class="Cmite" width="30%">{_lang_nickname}</td>
    <td class="Cnorm" width="40%">{NAME}</td>
    <td class="Cnorm" width="30%" rowspan="{rowspan}" valign="top" align="center">
          {AVATA}
            <br /><br />
            <font class="smalfont">{RANG}</font>
        </td>
  </tr><tr>
    <td class="Cmite">{_lang_regsince}</td>
    <td class="Cnorm">{JOINED}</td>
  </tr><tr>
    <td class="Cmite">{_lang_lastactivity}</td>
    <td class="Cnorm">{LASTAK}</td>
  </tr><tr>
    <td class="Cmite">{_lang_posts2}</td>
    <td class="Cnorm">{POSTS}, {_lang_perday}: {postpday}</td>
  </tr>
     
{profilefields}
     
</table>
 
<br />

Hoffe es sind die richtigen Dateien.

Beitrag zur Merkliste hinzufügen

ilch Forum » Ilch Clan 1.1 » Kritik und Verbesserungen » eMail-Sicherheit-Schwachstelle?