confirm.php

   1 <?php
   2 /************************************************************************/
   3 /* ATutor                                                                                                                               */
   4 /************************************************************************/
   5 /* Copyright (c) 2002-2007 by Greg Gay, Joel Kronenberg & Heidi Hazelton*/
   6 /* Adaptive Technology Resource Centre / University of Toronto                  */
   7 /* http://atutor.ca                                                                                                             */
   8 /*                                                                                                                                              */
   9 /* This program is free software. You can redistribute it and/or                */
  10 /* modify it under the terms of the GNU General Public License                  */
  11 /* as published by the Free Software Foundation.                                                */
  12 /************************************************************************/
  13 // $Id$
  14
  15 $_user_location = 'public';
  16
  17 define('AT_INCLUDE_PATH', 'include/');
  18 require(AT_INCLUDE_PATH.'vitals.inc.php');
  19
  20 if (isset($_POST['cancel'])) {
  21         $msg->addFeedback('CANCELLED');
  22         header('Location: '.$_base_href.'login.php');
  23         exit;
  24 }
  25
  26 if (isset($_GET['e'], $_GET['id'], $_GET['m'])) {
  27         $id = intval($_GET['id']);
  28         $m  = $_GET['m'];
  29         $e  = $addslashes($_GET['e']);
  30
  31         $sql    = "SELECT creation_date FROM ".TABLE_PREFIX."members WHERE member_id=$id";
  32         $result = mysql_query($sql, $db);
  33         if ($row = mysql_fetch_assoc($result)) {
  34                 $code = substr(md5($_GET['e'] . $row['creation_date'] . $id), 0, 10);
  35
  36                 if ($code == $m) {
  37                         $sql = "UPDATE ".TABLE_PREFIX."members SET email='$_GET[e]', last_login=last_login WHERE member_id=$id";
  38                         $result = mysql_query($sql, $db);
  39
  40                         $msg->addFeedback('CONFIRM_GOOD');
  41
  42                         header('Location: '.$_base_href.'users/index.php');
  43                         exit;
  44                 } else {
  45                         $msg->addError('CONFIRM_BAD');
  46                 }
  47         } else {
  48                 $msg->addError('CONFIRM_BAD');
  49         }
  50
  51 } else if (isset($_GET['id'], $_GET['m'])) {
  52         $id = intval($_GET['id']);
  53         $m  = $_GET['m'];
  54
  55         $sql    = "SELECT email, creation_date FROM ".TABLE_PREFIX."members WHERE member_id=$id AND status=".AT_STATUS_UNCONFIRMED;
  56         $result = mysql_query($sql, $db);
  57         if ($row = mysql_fetch_assoc($result)) {
  58                 $code = substr(md5($row['email'] . $row['creation_date'] . $id), 0, 10);
  59
  60                 if ($code == $m) {
  61                         if (defined('AUTO_APPROVE_INSTRUCTORS') && AUTO_APPROVE_INSTRUCTORS) {
  62                                 $sql = "UPDATE ".TABLE_PREFIX."members SET status=".AT_STATUS_INSTRUCTOR.", creation_date=creation_date, last_login=last_login WHERE member_id=$id";
  63                         } else {
  64                                 $sql = "UPDATE ".TABLE_PREFIX."members SET status=".AT_STATUS_STUDENT.", creation_date=creation_date, last_login=last_login WHERE member_id=$id";
  65                         }
  66                         $result = mysql_query($sql, $db);
  67
  68                         $msg->addFeedback('CONFIRM_GOOD');
  69
  70                         header('Location: '.$_base_href.'login.php');
  71                         exit;
  72                 } else {
  73                         $msg->addError('CONFIRM_BAD');
  74                 }
  75         } else {
  76                 $msg->addError('CONFIRM_BAD');
  77         }
  78 } else if (isset($_POST['submit'])) {
  79         $_POST['email'] = $addslashes($_POST['email']);
  80
  81         $sql    = "SELECT member_id, email, creation_date, status FROM ".TABLE_PREFIX."members WHERE email='$_POST[email]'";
  82         $result = mysql_query($sql, $db);
  83
  84         if ($row = mysql_fetch_assoc($result)) {
  85
  86                 if ($row['status'] == AT_STATUS_UNCONFIRMED) {
  87                         $code = substr(md5($row['email'] . $row['creation_date']. $row['member_id']), 0, 10);
  88                         $confirmation_link = $_base_href . 'confirm.php?id='.$row['member_id'].SEP.'m='.$code;
  89
  90                         /* send the email confirmation message: */
  91                         require(AT_INCLUDE_PATH . 'classes/phpmailer/atutormailer.class.php');
  92                         $mail = new ATutorMailer();
  93
  94                         $mail->From     = $_config['contact_email'];
  95                         $mail->AddAddress($row['email']);
  96                         $mail->Subject = SITE_NAME . ': ' . _AT('email_confirmation_subject');
  97                         $mail->Body    = _AT('email_confirmation_message', $_base_href, $confirmation_link)."\n\n";
  98                         $mail->Send();
  99
 100                         $msg->addFeedback('CONFIRMATION_SENT');
 101                 } else {
 102                         $msg->addFeedback('ACCOUNT_CONFIRMED');
 103                 }
 104
 105                 header('Location: '.$_base_href.'login.php');
 106                 exit;
 107         } else {
 108                 $msg->addError('EMAIL_NOT_FOUND');
 109         }
 110 }
 111
 112 require(AT_INCLUDE_PATH.'header.inc.php'); ?>
 113
 114 <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post" name="form">
 115
 116 <div class="input-form" style="max-width: 400px">
 117         <div class="row">
 118                 <p><?php echo _AT('send_confirmation'); ?></p>
 119         </div>
 120
 121         <div class="row">
 122                 <div class="required" title="<?php echo _AT('required_field'); ?>">*</div><label for="email"><?php echo _AT('email'); ?></label><br />
 123                 <input type="text" name="email" id="email" size="50" />
 124         </div>
 125
 126         <div class="row buttons">
 127                 <input type="submit" name="submit" value="<?php echo _AT('send'); ?>" />
 128                 <input type="submit" name="cancel" value="<?php echo _AT('cancel'); ?>" />
 129         </div>
 130 </div>
 131 </form>
 132
 133 <?php require(AT_INCLUDE_PATH.'footer.inc.php'); ?>