register.php

   1 <?php
   2 /**
   3  * User Account Registration
   4  *
   5  * @author Anthony Parsons (xmpp:ant@specialops.ath.cx)
   6  * @license file://COPYING
   7  * @version $Id$
   8  * @see file://lib/mysql.example
   9  */
  10
  11 require 'con.php';
  12 $page->title = 'Account Registration';
  13
  14 if ( $user instanceof User_Authenticated ) {
  15         isset($_POST['login']) ?
  16                 header('Location: .') : $page->errorfooter('logout');
  17 }
  18
  19 if ( isset($_POST['prompt']) ) {
  20         $_GET = $_POST;
  21 }
  22
  23 if ( isset($_POST['something']) ) {
  24
  25         // Data validation
  26         try {
  27                 // Obvious stuff
  28                 if ( empty($_POST['reg_u']) || empty($_POST['reg_p']) ) {
  29                         throw new LengthException('You left one or more fields empty.');
  30                 }
  31                 if ( $_POST['reg_p'] !== $_POST['reg_c'] ) {
  32                         throw new InvalidInputException('Both passwords must match exactly.');
  33                 }
  34                 if ( $DB->query('SELECT `userid` FROM `users` WHERE `alias` = '.$DB->string($_POST['reg_u']))->num_rows ) {
  35                         throw new InvalidInputException('That username is already in use. Try a different name.');
  36                 }
  37
  38                 // Slows down the more retarded malicious users, which is most of them.
  39                 if ( defined('INVITE_ONLY') && (
  40                                         !isset($_GET['code']) || !isset($_GET['user']) ||
  41                                         0 == $DB->query('SELECT `userid` FROM `things` WHERE `what` = "invite"
  42                                                         AND `data` = '.$DB->string($_GET['code']).' AND `userid` = '.intval($_GET['user']))->num_rows
  43                         ) ) {
  44                         sleep(7);
  45                         throw new InvalidInputException('Form data was submitted incorrectly.');
  46                 }
  47
  48                 // Flood protection
  49                 if ( $DB->query('SELECT `userid` FROM `users`
  50                                         WHERE `reg_ip` = INET_ATON("'.$_SERVER['REMOTE_ADDR'].'")
  51                                         AND `register_date` > (UNIX_TIMESTAMP() - 3600)')->num_rows ) {
  52                         throw new RateLimitException('You can only register a maximum of one account per hour. Try again in one hour.');
  53                 }
  54
  55                 $DB->autocommit(false);
  56
  57                 $DB->query('SET @userip = INET_ATON('.$DB->string($_SERVER['REMOTE_ADDR']).')');
  58                 $DB->query('INSERT INTO `users` (
  59                                         `alias`,
  60                                         `password`,
  61                                         `referrer`,
  62                                         `register_date`,
  63                                         `last_active_date`,
  64                                         `reg_email`,
  65                                         `last_login_ip`,
  66                                         `reg_ip`
  67                                 ) VALUES (
  68                                         '.$DB->string(htmlspecialchars($_POST['reg_u'])).',
  69                                         AES_ENCRYPT('.$DB->string($_POST['reg_p']).', @userip),
  70                                         '.( defined('INVITE_ONLY') ? intval($_GET['user']) : 'NULL' ).',
  71                                         UNIX_TIMESTAMP(),
  72                                         UNIX_TIMESTAMP(),
  73                                         '.$DB->string($_POST['reg_e']).',
  74                                         @userip,
  75                                         @userip
  76                                 )');
  77
  78                 if ( defined('INVITE_ONLY') ) {
  79                         $DB->query('DELETE FROM `things` WHERE `what` = "invite"
  80                                         AND `data` = '.$DB->string($_GET['code']).' AND `userid` = '.intval($_GET['user']));
  81                 }
  82
  83                 $DB->commit();
  84
  85                 setcookie('u', $_POST['reg_u'], time()+86400, '/');
  86                 setcookie('p', $_POST['reg_p'], time()+86400, '/');
  87
  88                 $user->userheader();
  89                         echo '<p class="info">Account has been created.</p>';
  90                 $page->pagefooter();
  91
  92         } catch ( InvalidInputException $e ) {
  93                 header('HTTP/1.1 400 Bad Request');
  94                 $user->userheader();
  95                 echo '<p class="error">',$e->getMessage(),'</p>';
  96         } catch ( RateLimitException $e ) {
  97                 header('HTTP/1.1 400 Bad Request');
  98                 $user->userheader();
  99                 echo '<p class="error">',$e->getMessage(),'</p>';
 100         }
 101 } elseif ( defined('INVITE_ONLY') && (
 102                         !isset($_GET['code']) || !isset($_GET['user']) ||
 103                         0 == $DB->query('SELECT `userid` FROM `things` NATURAL LEFT JOIN `users`
 104                                                 WHERE `what` = "invite" AND `data` = '.$DB->string($_GET['code']).'
 105                                                 AND `users`.`userid` IS NOT NULL AND `things`.`userid` = '.intval($_GET['user']))->num_rows
 106                 ) ) {
 107         $user->userheader();
 108 ?>
 109
 110 <p class="error">You need a valid invitation code to create an account.</p>
 111 <p>Enter the registration code you were given and the user ID number of the person who gave you it.</p>
 112 <form action="<?php echo $_SERVER['PHP_SELF'] ?>" method="get">
 113         <table class="inputlist">
 114                 <tr><th scope="row">Code</th><td><input type="text" name="code" size="36" maxlength="36"/></td></tr>
 115                 <tr><th scope="row">User ID</th><td><input type="text" name="user" size="5"/></td></tr>
 116         </table>
 117         <p><button type="submit">Confirm</button></p>
 118         <p>Don't have an invite? One of <a href="userlist">our members</a> might.</p>
 119 </form>
 120
 121 <?php
 122         $page->pagefooter();
 123 } else {
 124         $user->userheader();
 125 }
 126
 127
 128 if ( ip2long($_SERVER['REMOTE_ADDR']) === false ) { // ipv6 doesn't work yet
 129         echo '<p class="error">Error: You have to register from an IPv4 address.</p>',"\n";
 130         $page->pagefooter();
 131 }
 132
 133 if ( defined('INVITE_ONLY') ) {
 134         printf('<form action="%s?user=%d;code=%s" method="post">',
 135                         $_SERVER['PHP_SELF'], intval($_GET['user']), htmlentities($_GET['code']));
 136 } else {
 137         echo '<form action="',$_SERVER['PHP_SELF'],'" method="post">';
 138 }
 139 ?>
 140
 141 <fieldset><legend>Register Account</legend>
 142         <table class="inputlist">
 143                 <tr><th scope="row">Username</th>
 144                         <td><input type="text" name="reg_u"/></td></tr>
 145                 <tr><th scope="row">Password</th>
 146                         <td><input type="password" name="reg_p"/></td></tr>
 147                 <tr><th scope="row">Confirm Password</th>
 148                         <td><input type="password" name="reg_c"/></td></tr>
 149                 <tr><th scope="row">Contact IRI</th>
 150                         <td><input type="text" name="reg_e"/></td></tr>
 151         </table>
 152         <p>Clicking this button implies that you have read and agree to follow the <a href="stuff">board rules</a>:
 153                 <button type="submit" name="something">Create Account</button></p>
 154 </fieldset>
 155 </form>
 156
 157 <?php
 158 $page->pagefooter();
 159 ?>