#!C:/Perl/bin/perl.exe $discus_conf = 'd:/inetpub/wwwroot/wielens/discus_admin/discus.conf'; $pro_fileid = '3348162969543224'; #Discus user profile editor script (board-profile.cgi) #------------------------------------------------------------------------------- # DISCUS VERSION 3.10 COPYRIGHT NOTICE # # Discus 3.10 is copyright (c) 2000 by DiscusWare, LLC, all rights reserved. # The use of Discus is governed by the Discus License Agreement which is # available from the Discus WWW site at: # http://www.discusware.com/discus/license # # Pursuant to the Discus License Agreement, this copyright notice may not be # removed or altered in any way. #------------------------------------------------------------------------------- if (open (FILE, "$discus_conf")) { @file = ; close (FILE); foreach $line (@file) { if ($line =~ /^(\w+)=(.*)/) { $varname = $1; $value = $2; $value =~ s/\r//g; ${$varname} = $value; } } require "$admin_dir/source/src-board-subs-common"; } else { print "Content-type: text/html\n\n"; print "Script Execution Error\n"; print "\n"; print "

Script Execution Error

\n"; print "Discus scripts could not execute because the discus.conf file\n"; print "could not be opened."; print "

Reason: $!" if $!; print "

This generally indicates a setup error of some kind.\n"; print "Consult the Discus "; print "Resource Center for troubleshooting information.\n"; exit(0); } &parse_form; &read_cookie; #------------------------------------------------------------------------------- $FORM{'username'} =~ tr/A-Z/a-z/; $FORM{'password'} =~ tr/A-Z/a-z/; if ($FORM{'action'} eq "clear_cookie") { $COOKIE_STRING .= "Set-Cookie: user$COOKIE_ID=nobody; expires=Sunday, 06-Sep-1998 00:00:00 GMT; path=/\n" if $COOKIE{"user$COOKIE_ID"} ne ""; $COOKIE_STRING .= "Set-Cookie: cpwd$COOKIE_ID=nobody; expires=Sunday, 06-Sep-1998 00:00:00 GMT; path=/\n" if $COOKIE{"cpwd$COOKIE_ID"} ne ""; $COOKIE_STRING .= "Set-Cookie: rpwd$COOKIE_ID=nobody; expires=Sunday, 06-Sep-1998 00:00:00 GMT; path=/\n" if $COOKIE{"rpwd$COOKIE_ID"} ne ""; $COOKIE_STRING .= "Set-Cookie: pass$COOKIE_ID=nobody; expires=Sunday, 06-Sep-1998 00:00:00 GMT; path=/\n" if $COOKIE{"pass$COOKIE_ID"} ne ""; $COOKIE_STRING .= "Set-Cookie: admuser$COOKIE_ID=nobody; expires=Sunday, 06-Sep-1998 00:00:00 GMT; path=/\n" if $COOKIE{"admuser$COOKIE_ID"} ne ""; $COOKIE{'user' . $COOKIE_ID} = ""; $COOKIE{'cpwd' . $COOKIE_ID} = ""; $COOKIE{'rpwd' . $COOKIE_ID} = ""; $COOKIE{'pass' . $COOKIE_ID} = ""; $COOKIE{'admuser' . $COOKIE_ID} = ""; $FORM{'action'} = ""; foreach $key (keys(%COOKIE)) { if ($key =~ m|^auth(\d+)$COOKIE_ID|) { $COOKIE_STRING .= "Set-Cookie: $key=none; expires=Sunday, 06-Sep-1998 00:00:00 GMT; path=/\n"; $COOKIE{$key} = ""; delete $COOKIE{$key}; } } } if ($FORM{'action'} eq "") { &ex('cleaning_jobs', 1); &error_message($L{FILELOCKERROR}, $L{NOTICE_MAINTENANCEMODE}, 0, 1, 1) if $GLOBAL_OPTIONS{'maintenance'}; &header; ($bg, $tx, $li, $vl, $al, $face, $size, $image) = &ex('extract_colorsonly', 1); &ex('printuntil', 1, 1, 0, $L{PROFEDIT_TITLE}); print "

$L{PROFEDIT_TITLE}
\n"; print $L{PROFILE_LOGIN}; $ucid = "user$COOKIE_ID"; print "
\n"; print "\n"; print "\n"; print "\n"; print "\n"; print "
$L{PROFILE_USERNAME}
$L{PROFILE_PASSWORD}

\n"; print "\n"; print "

\n"; print "\n"; $COOKIE{$ucid} = $COOKIE{"admuser$COOKIE_ID"} if ($COOKIE{$ucid} eq "" && $COOKIE{"admuser$COOKIE_ID"} ne ""); if ($COOKIE{$ucid} ne "" || grep(/auth(\d+)$COOKIE_ID/, keys(%COOKIE))) { $ts = $L{LOGIN_YOUARELOGGEDIN}; $cu = $COOKIE{$ucid}; $cu = $L{BPANONYMOUS} if $cu eq ""; $ts =~ s/\%user/$cu/g; print "
\n"; print "
\n"; print $ts; print "

\n"; print "\n"; print "

\n"; } if ($GLOBAL_OPTIONS{'allow_selfreg'}) { print "
\n"; print "
$L{REG_FRONTSCREEN}

\n"; print "\n"; print "\n"; print "

\n"; } &ex('printuntil', 3, 17, 0, "", 0, 1); exit(0); } if ($FORM{'action'} eq "display_profile") { $profile = $FORM{'profile'}; if ($pro) { &ex('display_profile', $profile); } else { &error_message("$L{FEATURE_NOT_SUPPORTED}", "$L{FEATURE_NOT_SUPPORTED_DESCR}"); } exit(0); } if ($FORM{'action'} eq "register") { "a_message if $DO_NOT_WRITE_FILES_FLAG; &error_message($L{FILELOCKERROR}, $L{NOTICE_MAINTENANCEMODE}, 0, 1, 1) if $GLOBAL_OPTIONS{'maintenance'}; &ex('register_1', 1); } if ($FORM{'action'} eq "register_2") { "a_message if $DO_NOT_WRITE_FILES_FLAG; &error_message($L{FILELOCKERROR}, $L{NOTICE_MAINTENANCEMODE}, 0, 1, 1) if $GLOBAL_OPTIONS{'maintenance'}; &ex('register_2', 1); } if ($FORM{'action'} eq "display_picture") { $profile = $FORM{'picture'}; &ex('display_picture', $profile); exit(0); } if ($FORM{'action'} eq "sync") { "a_message if $DO_NOT_WRITE_FILES_FLAG; &error_message($L{FILELOCKERROR}, $L{NOTICE_MAINTENANCEMODE}, 0, 1, 1) if $GLOBAL_OPTIONS{'maintenance'}; ($result) = &ex('verify_user_password', $FORM{'username'}, $FORM{'password'}, 1); @result = split(/\n/, $result); @result_save = @result; foreach $line (@result) { $line =~ s/\s+$//; ($file, $user, $pass, $email, $full, $edit) = split(/:/, $line); $line = "" if $edit == 0; } @result = grep(/\S/, @result); $s = join("\n", @result); foreach $line (@result) { ($file, $user, $pass, $email, $full, $edit, $notify, $last, $group) = split(/:/, $line); if ($edit == 2 || $edit == 4) { $EMAIL_FORCE = $email; } } foreach $line (@result) { ($file, $user, $pass, $email, $full, $edit, $notify, $last, $group) = split(/:/, $line); if ($file eq $FORM{'file'}) { if ($group eq $FORM{'group'}) { $email = $EMAIL_FORCE if $EMAIL_FORCE; $notify = "*" if $notify eq ""; &ex('save_profile_information', $pass, $email, $full, "", $notify, $last, "", @result_save); &ex('synchronize_PRO', $file, $user, $s) if $pro; last; } } } $FORM{'action'} = "profile_editor_screen"; } if ($FORM{'action'} eq "profile_editor_screen") { "a_message if $DO_NOT_WRITE_FILES_FLAG; ($result) = &ex('verify_user_password', $FORM{'username'}, $FORM{'password'}, 1); @result = split(/\n/, $result); foreach $line (@result) { ($file, $user, $pass, $email, $full, $edit) = split(/:/, $line); $line = "" if $edit == 0; $LINE_FORCE = $line if ($edit == 2 || $edit == 4); } @result = grep(/\S/, @result); if (scalar(@result) == 0) { &error_message($L{PROFILE_AUTHERROR}, $L{PROFILE_AUTHERROR_DESCR}, 0, 1, 1); } $r = $result[0]; $r = $LINE_FORCE if $LINE_FORCE; $r =~ s/\n$//; $s = join("\n", @result); @result_save = @result; ($differences) = &ex('compare_profiles', $s) if !$pro; ($differences) = &ex('compare_profiles_PRO', $s) if $pro; &ex('display_profile_differences', $FORM{'username'}, $FORM{'password'}, $s) if ($differences && !$pro); &ex('display_profile_differences_PRO', $FORM{'username'}, $FORM{'password'}, $s) if ($differences && $pro); ($file, $user, $pass, $email, $full, $edit, $notify, $last, $group) = split(/:/, $r); $file =~ tr/A-Z/a-z/; &ex("profile_editor_screen", $file, $FORM{"username"}, $group, $FORM{"username"}, "$script_url/board-profile.$cgi_extension", "profile_editor") if !$pro; &ex("profile_editor_screen_PRO", $file, $FORM{"username"}, $group, $FORM{"username"}, "$script_url/board-profile.$cgi_extension", "profile_editor") if $pro; exit(0); } if ($FORM{'action'} eq "register_info") { "a_message if $DO_NOT_WRITE_FILES_FLAG; &error_message($L{FILELOCKERROR}, $L{NOTICE_MAINTENANCEMODE}, 0, 1, 1) if $GLOBAL_OPTIONS{'maintenance'}; $user = $FORM{'username'}; $user =~ s/://g; @group = split(/,/, $FORM{'group'}); undef @result; open (USERS, "$admin_dir/users.txt"); @users = ; close (USERS); @u = grep(/^$user:/, @users); foreach $line (@u) { chop $line if $line =~ m|\n|; ($u, $p, $e, $f, $d, $n, $l, $g) = split(/:/, $line); if (grep(/^$g$/, @group) || $p eq "*Q*") { push (@result, "USERS:$line\n"); } } @result_save = @result; &ex('info_save_pro', 1); &ex('register_thanks', 1); } if ($FORM{'action'} eq "profile_editor") { "a_message if $DO_NOT_WRITE_FILES_FLAG; if ($FORM{'action2'} eq "editpost") { &error_message($L{FEATURE_NOT_SUPPORTED}, $L{FEATURE_NOT_SUPPORTED_DESCR}, 0, 1) if !$pro; if ($FORM{'HTTP_REFERER'} eq "") { foreach $key (keys(%FORM)) { if ($key =~ m|^(\d+)--(\d+)\%2F(\d+)$|i) { $FORM{'postid'} = $1; $FORM{'HTTP_REFERER'} = "//$2/$3.$ext"; last; } elsif ($key =~ m|^(\d+)--(\d+)/(\d+)$|i) { $FORM{'postid'} = $1; $FORM{'HTTP_REFERER'} = "//$2/$3.$ext"; last; } } } &extract($FORM{'HTTP_REFERER'}); &let_admin_edit_post; } ($result) = &ex('verify_user_password', $FORM{'username'}, $FORM{'password'}, 1); @result = split(/\n/, $result); foreach $line (@result) { ($file, $user, $pass, $email, $full, $edit) = split(/:/, $line); $EMAIL_FORCE = $email if (($edit == 2 || $edit == 4) && $GLOBAL_OPTIONS{'emchange'} == 0); $line = "" if $edit == 0; } @result = grep(/\S/, @result); @result_save = @result; if (scalar(@result) == 0) { &error_message($L{PROFILE_AUTHERROR}, $L{PROFILE_AUTHERROR_DESCR}, 0, 1, 1); } if ($FORM{'action2'} eq "infosave") { $email = $FORM{'profile_email'}; $email = substr($email, 0, 100) if length($email) > 100; $full = $FORM{'profile_fullname'}; if ($GLOBAL_OPTIONS{'name_length_limit'} == 1 || $GLOBAL_OPTIONS{'name_length_limit'} eq "") { $maxlen = 35 if $GLOBAL_OPTIONS{'name_length_limit_number'} == 0; $maxlen = $GLOBAL_OPTIONS{'name_length_limit_number'} if $GLOBAL_OPTIONS{'name_length_limit_number'} > 0; $full = substr($full, 0, $maxlen) if length($full) > $maxlen; } if ($email =~ m|^([\w\-\+\.]+)\@([\w\-\+\.]+)$|) { $email_new = $email; } else { $email_new = "email"; } if ($full eq "") { $full = "fullname"; } else { $full =~ s/\n//g; $full =~ s/[:<>]//g; } $email_new = $EMAIL_FORCE if $EMAIL_FORCE; &ex('save_profile_information', "", $email_new, $full, "", "", "", "", @result); } if ($FORM{'action2'} eq "notifysave") { if (!$pro) { undef @em; foreach $key (keys(%FORM)) { if ($key =~ m|^notify_(\d+)|) { push (@em, $1); } } $emr = join(",", @em); $emr = "*" if $emr eq ""; &ex('save_profile_information', "", "", "", "", $emr, "", "", @result); } else { &ex('notify_save_pro', 1) if $FORM{'submit'} ne $L{PRED_FIRSTLEVEL}; &ex('select_by_subtopics', $file, $FORM{"username"}, $group, $FORM{"username"}, "$script_url/board-profile.$cgi_extension", "profile_editor") if $FORM{'submit'} eq $L{PRED_FIRSTLEVEL}; } } if ($FORM{'action2'} eq "preferences") { &ex('prefs_save_pro', 1); } if ($FORM{'action2'} eq "infosection") { &ex('info_save_pro', 1); } if ($FORM{'action2'} eq "changepass") { $p1 = $FORM{'pass_1'}; $p2 = $FORM{'pass_2'}; $p1 =~ tr/A-Z/a-z/; $p2 =~ tr/A-Z/a-z/; while ($p1 =~ m|(\W)|g) { $o = ord($1); $m = $1; &error_message($L{PROFILE_CHPASS_ERROR}, $L{PROFILE_CHPASS_ERROR_ALPHA}) if $o < 126; } &error_message($L{PROFILE_CHPASS_ERROR}, $L{PROFILE_CHPASS_ERROR_MATCH}) if $p1 ne $p2; &error_message($L{PROFILE_CHPASS_ERROR}, $L{PROFILE_CHPASS_ERROR_LENGTH}) if (length($p1) < 1 || length($p2) > 20); srand(time); undef (@salt); for ($i=1; $i<=2; $i++) { push (@salt, int(rand(26))+65); } $salt = pack('c2', @salt); $new_password = crypt($p1, $salt); &ex('save_profile_information', $new_password, "", "", "", "", "", "", @result); if ($FORM{'password'} eq "adminlogin" && $COOKIE{"pass$COOKIE_ID"} ne "") { $COOKIE_STRING = "Set-Cookie: pass$COOKIE_ID="; $COOKIE_STRING .= crypt($new_password, "cookie"); $COOKIE_STRING .= "; path=/\n"; &header; &ex('printuntil', 1, 1, 0, $L{PROFILE_CHANGEDPASSWORD}); print "
$L{PROFILE_CHANGEDPASSWORD}
\n"; print "Your password has been successfully changed. To continue with administration,\n"; print "click any of the links from the menu in the left frame.

\n"; &ex('printuntil', 3, 17, 0, "", 0, 1); exit(0); } &header; &ex('printuntil', 1, 1, 0, $L{PROFILE_CHANGEDPASSWORD}); print "

$L{PROFILE_CHANGEDPASSWORD}
\n"; $l = $L{PROFILE_CHANGEDPASSWORD_DESCR}; print $l if $FORM{'password'} ne "adminlogin"; $l = $L{BPCLICKCONTINUE}; print "

$l
\n"; &ex('printuntil', 3, 17, 0, "", 0, 1); exit(0); } if ($FORM{'action2'} eq "editpost") { &error_message($L{FEATURE_NOT_SUPPORTED}, $L{FEATURE_NOT_SUPPORTED_DESCR}, 0, 1) if !$pro; undef @fk; foreach $key (keys(%FORM)) { push (@fk, &unescape($key)); } if (($key) = grep(/^(\d+)--(\d+)\/(\d+)$/, @fk)) { $key =~ m|^(\d+)--(\d+)/(\d+)$|; $key = $1; $FORM{'HTTP_REFERER'} = "//$2/$3.$ext"; &ex('edit_post_form', 0, 0, $key, "", "", $FORM{'username'}, 0, $FORM{'HTTP_REFERER'}); &error_message("Editing Error", "Could not execute post editor form properly. You should never see this message.", 0, 1); } else { &error_message("Index not found", "Form did not pass valid message editing parameters.", 0, 1); } } ($result) = &ex('verify_user_password', $FORM{'username'}, $FORM{'password'}, 1); @result = split(/\n/, $result); foreach $line (@result) { ($file, $user, $pass, $email, $full, $edit, $email, $time, $group) = split(/:/, $line); $line = "" if $edit == 0; } foreach $line (@result) { ($file, $user, $pass, $email, $full, $edit, $email, $time, $group) = split(/:/, $line); if ($edit == 2) { last; } } @result = grep(/\S/, @result); @result_save = @result; &ex("profile_editor_screen", $file, $FORM{"username"}, $group, $FORM{"username"}, "$script_url/board-profile.$cgi_extension", "profile_editor") if !$pro; &ex("profile_editor_screen_PRO", $file, $FORM{"username"}, $group, $FORM{"username"}, "$script_url/board-profile.$cgi_extension", "profile_editor") if $pro; } if ($FORM{'action'} eq "editpost") { "a_message if $DO_NOT_WRITE_FILES_FLAG; &error_message($L{FEATURE_NOT_SUPPORTED}, $L{FEATURE_NOT_SUPPORTED_DESCR}, 0, 1) if !$pro; $postid = $FORM{'postid'}; $page = $FORM{'page'}; $extractor = "//$page.$ext"; &extract("$extractor"); &extract("//$FORM{'page'}.$ext"); &let_admin_edit_post; open (LOG, "$admin_dir/msg_index/$topic_number-log.txt"); while () { @c = split(/;/); if ($c[0] == $postid) { ($username, $group) = split(/:/, $c[1]); $FORM{'username'} = $username; last; } } close (LOG); ($result) = &ex('verify_user_password', $FORM{'username'}, $FORM{'password'}); @result = split(/\n/, $result); foreach $line (@result) { ($file, $user, $pass, $email, $full, $edit) = split(/:/, $line); $line = "" if $edit == 0; } @result = grep(/\S/, @result); @result_save = @result; $FORM{'username'} = $username_hold; if (scalar(@result_save) != 0) { $FORM{'RETURN'} = 1; &ex('edit_post_form', 0, 0, $postid, "", "", $user, 0, $page); } ($bg, $tx, $li, $vl, $al, $face, $size, $image) = &ex('extract_colorsonly', 1); &header; &ex('printuntil', 1, 1, 0, $L{PROFEDIT_TITLE}); print "
$L{PROFEDIT_TITLE}
\n"; print $L{ENTER_USERNAME_TO_EDIT}; $ucid = "user$COOKIE_ID"; $pcid = "rpwd$COOKIE_ID"; print "
\n"; print "\n"; print "\n"; print "\n"; print "\n"; print "
$L{PROFILE_USERNAME}
$L{PROFILE_PASSWORD}

\n"; print "\n"; print "\n"; print "\n"; print "\n"; print "\n"; print "\n"; print "

\n"; print "\n"; &ex('printuntil', 3, 17, 0, $L{PROFEDIT_TITLE}); exit(0); } if ($FORM{'action'} eq "edit_message") { "a_message if $DO_NOT_WRITE_FILES_FLAG; ($result) = &ex('verify_user_password', $FORM{'username'}, $FORM{'password'}); @result = split(/\n/, $result); foreach $line (@result) { ($file, $user, $pass, $email, $full, $edit) = split(/:/, $line); $line = "" if $edit == 0; } @result = grep(/\S/, @result); @result_save = @result; if (scalar(@result) == 0) { &error_message($L{PROFILE_AUTHERROR}, $L{PROFILE_AUTHERROR_DESCR}, 0, 1, 1); } &ex('edit_message_action', 1); $file =~ tr/A-Z/a-z/; &ex("profile_editor_screen_PRO", $file, $FORM{"username"}, $group, $FORM{"username"}, "$script_url/board-profile.$cgi_extension", "profile_editor") if !$FORM{'RETURN'}; &extract($FORM{'HTTP_REFERER'}); if (-e "$message_dir/$topic_number") { &seturl("$message_url/$topic_number/$me_number.$ext#POST$FORM{'postindex'}"); } else { &seturl("$script_url/board-auth.$cgi_extension?file=/$topic_number/$me_number.$ext#POST$FORM{'postindex'}"); } } $fa = "
    "; foreach $key (keys(%FORM)) { $fa .= "
  • $key=$FORM{$key}\n"; } $fa .= "
\n"; &error_message("Invalid Query", "You should never see this error message. Contact DiscusWare if this problem persists with the following information:

board-profile.cgi
$ENV{'HTTP_REFERER'}
$ENV{'QUERY_STRING'}
$fa", 0, 1); sub let_admin_edit_post { require "$admin_dir/source/src-board-subs-admin"; $username_hold = $FORM{'username'}; $FORM{'username'} = $COOKIE{"admuser$COOKIE_ID"} if $FORM{'username'} eq ""; $FORM{'username'} = $COOKIE{"user$COOKIE_ID"} if $FORM{'username'} eq ""; $FORM{'username'} =~ tr/A-Z/a-z/; $noencrypt = 0; $code = &check_passwd(0, 0, 592); if ($code == -1) { $COOKIE{"pass$COOKIE_ID"} = $COOKIE{"cpwd$COOKIE_ID"}; $y = $FORM{'password'}; $FORM{'password'} = ""; $code = &check_passwd(0, 0, 592); $FORM{'password'} = $y; $noencrypt = 1; } if (!&verify_owner($owner,$FORM{'username'})) { $code = -1; } if ($code != -1) { $code = crypt($code, "cookie") if !$noencrypt; $COOKIE_STRING = ""; $COOKIE_STRING .= "Set-Cookie: admuser$COOKIE_ID=$FORM{'username'}; path=/\n" if ($FORM{'username'} ne "" && $COOKIE{"admuser$COOKIE_ID"} ne $FORM{'username'}); $COOKIE_STRING .= "Set-Cookie: pass$COOKIE_ID=$code; path=/\n" if $FORM{'password'} ne ""; $FORM{'password'} = ""; &ex('edit_message_form', $topic_number, $me_number, $FORM{'postid'}, "", "", $FORM{"username"}, "", 1); } $FORM{'username'} = $username_hold; } # END - FILE IS CORRECTLY UPLOADED #