diff --git a/admin/pages/usersearch.php b/admin/pages/usersearch.php index ca20cec77..0fb22a928 100644 --- a/admin/pages/usersearch.php +++ b/admin/pages/usersearch.php @@ -1,89 +1,118 @@ - -" dir="ltr"> - - - - <?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.user.search"); ?> - - - getLang("admin.exit"); ?> -

getLang("admin.user.search.intro"); ?>

-
-
-
-
-
- - " /> -
- db_link, $sql); +userHasPermission("Backend", "User","Search")){ +?> + + " dir="ltr"> + + + + <?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.user.search"); ?> + + + getLang("admin.exit"); ?> +

getLang("admin.user.search.intro"); ?>

+
+
+
+
+
+ + " /> +
+ db_link, $sql); + } } - } - if(isset($_GET["Mail"]) || isset($_GET["Name"])){ - $userhere = False; - while($row = mysqli_fetch_array($db_erg, MYSQLI_ASSOC)){ - $userhere = True; - ?> -

getLang("admin.user.search.title")); ?>

- - - - - - - - - - - - - - - - - - - -
- Id: - - -
- getLang("admin.user.field.mail"); ?>: - - -
- getLang("admin.user.field.admin"); ?> - - -
- getLang("admin.user.field.blocked"); ?> - - -
- db_link, $sql); + } } - if(!$userhere&&$_GET["Mail"] !== ""){ - echo str_replace("%a", $U->getLang("admin.user.field.mail"), str_replace("%b", $_GET["Mail"], $U->getLang("admin.user.notFound.property"))); + if(isset($_GET["Id"])){ + if($_GET["Id"] !== ""){ + $sql = "SELECT * FROM User WHERE Id='".mysqli::real_escape_string($_GET["Id"])."';"; + $dbRes = mysqli_query($U->db_link, $sql); + } } - if(!$userhere&&$_GET["Name"] !== ""){ - echo str_replace("%a", $U->getLang("admin.user.field.username"), str_replace("%b", $_GET["Name"], $U->getLang("admin.user.notFound.property"))); + if(isset($_GET["Mail"]) || isset($_GET["Name"]) || isset($_GET["Id"])){ + $userhere = False; + while($row = mysqli_fetch_array($dbRes, MYSQLI_ASSOC)){ + $userhere = True; + ?> +

getLang("admin.user.search.title")); ?>

+ + + + + + + + + + + + + + + + + + + +
+ Id: + + +
+ getLang("admin.user.field.mail"); ?>: + + +
+ getLang("admin.user.field.permissionlevel"); ?> + + getPermissionName($row["Type"]); ?> +
+ getLang("admin.user.field.blocked"); ?> + + getLang("admin.no"):$U->getLang("admin.yes"); ?> +
+ getLang("admin.user.field.mail"), str_replace("%b", $_GET["Mail"], $U->getLang("admin.user.notFound.property"))); + } + if(!$userhere&&isset($_GET["Name"])&&$_GET["Name"]!==""){ + echo str_replace("%a", $U->getLang("admin.user.field.username"), str_replace("%b", $_GET["Name"], $U->getLang("admin.user.notFound.property"))); + } + if(!$userhere&&isset($_GET["Id"])){ + echo str_replace("%a", $U->getLang("admin.user.field.id"), str_replace("%b", $_GET["Id"], $U->getLang("admin.user.notFound.property"))); + } } - } - ?> + ?> + + + + + " dir="ltr"> + + + <?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.settings"); ?> + + + getLang("admin.exit"); ?> +

getLang("rights.error"); ?>

- \ No newline at end of file + + diff --git a/login/register.php b/login/register.php index 69852d09a..d409331a6 100644 --- a/login/register.php +++ b/login/register.php @@ -25,8 +25,8 @@ if(preg_match('/^[a-z0-9A-Z.:,;]{8,25}$/',$_POST["P"])){ $register = True; $sql = "SELECT * FROM User"; - $db_erg = mysqli_query($U->db_link, $sql); - while ($row = mysqli_fetch_array($db_erg, MYSQLI_ASSOC)) + $dbRes = mysqli_query($U->db_link, $sql); + while ($row = mysqli_fetch_array($dbRes, MYSQLI_ASSOC)) { //Checks if username or mail are in use if(strtolower($row["Username"]) == strtolower($_POST["U"])||strtolower($row["Mail"])==strtolower($_POST["M"])){ @@ -57,8 +57,8 @@ if($register){ //Register succeeded: //Register user - $sql = 'INSERT INTO User (Username, Mail, Password, Type) VALUES ('."'".$_POST["U"]."'".','."'".$_POST["M"]."'".','."'".password_hash($_POST["P"],PASSWORD_DEFAULT)."'".',0);'; - if($db_erg = mysqli_query($U->db_link, $sql)){ + $sql = 'INSERT INTO User (Username, Mail, Password, Type) VALUES ('."'".mysqli::real_escape_string($_POST["U"])."'".','."'".mysqli::real_escape_string($_POST["M"])."'".','."'".password_hash(mysqli::real_escape_string($_POST["P"]),PASSWORD_DEFAULT)."'".','.$USOC["userRights"]["AfterRegistration"].');'; + if($dbRes = mysqli_query($U->db_link, $sql)){ //Database register is succeeded echo $U->getLang("register.succeed"); header("Location: ".$USOC["DOMAIN"]);