root/include/functions_check.php

<?php
function check_username($username, $allowed_all = false)</span>
<span class="code-keyword">{
    global $db, $lang;

    if( !$allowed_all && !preg_match("/^[a-zA-Z0-9]+$/", $username) ) {
        return array('error' => true, 'error_msg' => $lang['invalid_username']);
    }

    $sql = "SELECT name AS username
            FROM " . USERS_TABLE . "
            WHERE LOWER(name) = '" . $db->sql_escape(utf_strtolower($username)) . "'";
    $result = $db->sql_query($sql);
    if ( $row = $db->sql_fetchrow($result) ) {
        return array('error' => true, 'error_msg' => sprintf($lang['username_already_in_use'], $username) );
    }

    $sql = "SELECT group_name
            FROM " . GROUPS_TABLE . "
            WHERE LOWER(group_name) = '" . $db->sql_escape(utf_strtolower($username)) . "'";
    if ( $row = $db->sql_fetchrow($result) ) {
        return array('error' => true, 'error_msg' => sprintf($lang['username_already_in_use'], $username) );
    }

    $sql = "SELECT disallow_username FROM " . DISALLOW_TABLE;
    $result = $db->sql_query($sql);
    if ( $row = $db->sql_fetchrow($result) ) {
        do {
            if (preg_match("#\b(" . str_replace("\*", ".*?", preg_quote($row['disallow_username'], '#')) . ")\b#i", $username)) {
                return array('error' => true, 'error_msg' => sprintf($lang['username_disallowed'], $username) );
               }
          }
        while( $row = $db->sql_fetchrow($result) );
    }

    $sql = 'SELECT word FROM  ' . WORDS_TABLE;
    $result = $db->sql_query($sql);
    if ( $row = $db->sql_fetchrow($result) ) {
        do {
            if (preg_match("#\b(" . str_replace("\*", ".*?", preg_quote($row['word'], '#')) . ")\b#i", $username)) {
                return array('error' => true, 'error_msg' => sprintf($lang['username_disallowed'], $username) );
               }
          }
        while ( $row = $db->sql_fetchrow($result) );
    }

    if( utf_strlen($username) < 3 || utf_strlen($username) > 30 ) {
        return array('error' => true, 'error_msg' => $lang['username_between_2_and_30']);
    }

     return;
}

function check_filename($name) {
        return preg_match('/^[^\0-\x1f:\\\\\/?*\xff#<>|]+$/si', $name);
}

function check_email($email)
{
        global $db, $lang;

        if ($email != '')
        {
                if (preg_match('/^[a-z0-9&\'\.\-_\+]+@[a-z0-9\-]+\.([a-z0-9\-]+\.)*?[a-z]+$/is', $email))
                {
                        $sql = 'SELECT ban_email
                                FROM ' . BANLIST_TABLE . '
                                WHERE ban_type = ' . BAN_GLOBAL;
                        if ($result = $db->sql_query($sql))
                        {
                                if ($row = $db->sql_fetchrow($result))
                                {
                                        do
                                        {
                                                $match_email = str_replace('*', '.*?', $row['ban_email']);
                                                if (preg_match('/^' . $match_email . '$/is', $email))
                                                {
                                                        $db->sql_freeresult($result);
                                                        return array('error' => true, 'error_msg' => sprintf($lang['email_banned'], $email) );
                                                }
                                        }
                                        while($row = $db->sql_fetchrow($result));
                                }
                        }
                        $db->sql_freeresult($result);

                        $sql = "SELECT email
                                FROM " . USERS_TABLE . "
                                WHERE email = '" . str_replace("\'", "''", $email) . "'";
                        $result = $db->sql_query($sql);

                        if ($row = $db->sql_fetchrow($result))
                        {
                                return array('error' => true, 'error_msg' => sprintf($lang['email_already_in_use'], $email) );
                        }
                        $db->sql_freeresult($result);

                        return;
                }
        }

        return array('error' => true, 'error_msg' => $lang['email_invalid']);
}

function check_user_class($class) {
    return is_numeric($class) && floor($class) == $class && $class >= UC_PEASANT && $class <= UC_SYSOP;
}

function check_language( $language ) {
    global $root_path;

    $language = utf_strtolower($language);
     $dirname = 'languages';
     $dir = opendir($root_path . $dirname);
     $valid = array();
     while ( $file = readdir($dir) ) {
        if (preg_match('#^lang_#i', $file) && !is_file($root_path . $dirname . '/' . $file) && !is_link($root_path . $dirname . '/' . $file)) {
              $filename = trim(str_replace("lang_", "", $file));
               $displayname = preg_replace("/^(.*?)_(.*)$/", "\\1 [ \\2 ]", $filename);
               $displayname = preg_replace("/\[(.*?)_(.*)\]/", "[ \\1 - \\2 ]", $displayname);
               $valid[] = utf_strtolower($displayname);
          }
     }
     return in_array($language, $valid);
}

function check_style_id ( $style_id ) {
    global $db;

    if ( is_numeric($style_id) && floor($style_id) == $style_id ) {
        $sql = 'SELECT themes_id, style_name FROM ' . THEMES_TABLE . ' WHERE themes_id = ' . $style_id;
        $result = $db->sql_query($sql);
        if ( !($row = $db->sql_fetchrow($result)) ) {
            return false;
        }
        else {
            return true;
        }
    }
    else {
        return false;
    }
}

function check_remote_avatar($avatar_filename) {
    global $config, $lang;

    if ( !preg_match("#^((ht|f)tp://)([^ \?&=\#\"\n\r\t<]*?(\.(jpg|jpeg|gif|png))$)#is", $avatar_filename) ) {
        return $lang['image_adress_invalid'];
    }

    if ( strpos($avatar_filename, 'imageshack') ) {
        return $lang['image_adress_invalid'];
    }

    $remote_file = @fopen ($avatar_filename, "rb");

    if(!$remote_file)
    {
        return $lang['image_adress_invalid'];
    }

    $user_avatar_size = 0;
    do
    {
        if (strlen(@fread($remote_file, 1)) == 0 || $user_avatar_size > $config['avatar_filesize'])
        {
            break;
        }
        $user_avatar_size++;
    }
    while(true);
    @fclose($remote_file);

    if($user_avatar_size > $config['avatar_filesize'])
    {
        return sprintf($lang['image_avatar_error_filesize'], mksize($config['avatar_filesize']));
    }

    list($user_avatar_width, $user_avatar_height) = @getimagesize($avatar_filename);

    if( !$user_avatar_width || !$user_avatar_height )
    {
        return $lang['avatar_adress_invalid'];
    }

    if($user_avatar_width > $config['avatar_max_width'] || $user_avatar_height > $config['avatar_max_height'])
    {
        return sprintf($lang['image_is_too_big'], $config['avatar_max_width'], $config['avatar_max_height']);
    }
    return;
}

function check_ip($ip) {
        if (!empty($ip) && ip2long($ip)!=-1) {
                // reserved IANA IPv4 addresses
                // http://www.iana.org/assignments/ipv4-address-space
                $reserved_ips = array (
                                array('0.0.0.0','2.255.255.255'),
                                array('10.0.0.0','10.255.255.255'),
                                array('127.0.0.0','127.255.255.255'),
                                array('169.254.0.0','169.254.255.255'),
                                array('172.16.0.0','172.31.255.255'),
                                array('192.0.2.0','192.0.2.255'),
                                array('192.168.0.0','192.168.255.255'),
                                array('255.255.255.0','255.255.255.255')
                );

                foreach ($reserved_ips as $r) {
                    $min = ip2long($r[0]);
                    $max = ip2long($r[1]);
                    if ((ip2long($ip) >= $min) && (ip2long($ip) <= $max)) {
                        return false;
                    }
                }
                return true;
        }
        else {
            return false;
        }
}

function check_internet_speed( $internet_speed ) {
    for ( $i = 64; $i <= 1024; $i +=64 ) {
        if ( $internet_speed == $i  * 1024 ) {
            return true;
        }
    }
    for ( $i = 2; $i <= 101; ++$i ) {
        if ( $i > 10 ) {
            $i += 1;
        }
        if ( $i > 30 ) {
            $i += 3;
        }
        if ( $internet_speed == $i * 1024 * 1024 ) {
            return true;
        }
    }
    return false;
}

function check_category_id ( $category_id, $check_allow_upload = false ) {
    global $db;

    if ( is_numeric($category_id) && floor($category_id) == $category_id ) {
        $sql = 'SELECT * FROM ' . CATEGORIES_TABLE . ' WHERE id = ' . $category_id . ( $check_allow_upload ? ' AND allow_upload = 1' : '' );
        $result = $db->sql_query($sql);
        if ( !($row = $db->sql_fetchrow($result)) ) {
            return false;
        }
        else {
            return true;
        }
    }
    else {
        return false;
    }
}

function check_country_id ( $country_id ) {
    global $db;

    if ( is_numeric($country_id) && floor($country_id) == $country_id ) {
        $sql = 'SELECT * FROM ' . COUNTRIES_TABLE . ' WHERE id = ' . $country_id;
        $result = $db->sql_query($sql);
        if ( !($row = $db->sql_fetchrow($result)) ) {
            return false;
        }
        else {
            return true;
        }
    }
    else {
        return false;
    }
}

function validate_optional_fields(&$icq, &$aim, &$msnm, &$yim, &$skype, &$sig)
{
    $check_var_length = array('aim', 'msnm', 'yim', 'skype');

    for($i = 0; $i < sizeof($check_var_length); $i++)
    {
        if (utf_strlen($$check_var_length[$i]) < 2 || utf_strlen($$check_var_length[$i]) > 66 )
        {
            $$check_var_length[$i] = '';
        }
    }

    if ( utf_strlen($sig) < 2 ) {
        $sig = '';
    }

    // ICQ number has to be only numbers.
    if (!preg_match('/^[0-9]+$/', $icq))
    {
        $icq = '';
    }

    return;
}

function check_torrent ( $torrent_file ) {
    global $lang, $config, $root_path;

    require ($root_path . 'include/class.bencode.php');

    $errors = array();

    $torrent_dir = $root_path . ( !empty($config['torrent_dir']) ? $config['torrent_dir'] : 'torrents');

    if ( !check_filename($torrent_file['name']) || empty($torrent_file['name']) ) {
        $errors[] = $lang['invalid_filename'];
    }

    if (!preg_match("/^[a-zA-Z0-9_~!@$^()&'`\[\]{}%,.-\s]+$/", $torrent_file['name'])) {
        $errors[] = $lang['invalid_filename'];
    }

    if (!preg_match('/^(.+)\.torrent$/si', $torrent_file['name'], $matches)) {
          $errors[] = $lang['invalid_type_not_torrent'];
    }

    if ( !@is_uploaded_file($torrent_file['tmp_name']) || !@filesize($torrent_file['tmp_name'])  ) {
          $errors[] = $lang['invalid_file'];
    }

    if ( $torrent_file['error'] == UPLOAD_ERR_FORM_SIZE ) {
        trigger_error(sprintf($lang['torrent_is_too_big'], mksize($config['max_torrent_size'])));
    }

    $torrent = new Torrent($torrent_file['tmp_name']);

    if ( !$torrent->is_torrent($torrent_file['tmp_name']) ) {
        $errors[] = $lang['you_upload_not_torrent_file'];
    }

    $site_url = generate_base_url();

    if ( defined('USE_XBTT') ) {
        $base_announce = $config['xbt_listen_url'] . ':' . $config['listen_port'] . '/announce/';
    }
    else {
        $base_announce = $site_url . '/announce.php';
    }

    $torrent->announce(array($base_announce));

    $dname = $torrent->name();
    $plen = $torrent->piece_length();

    $flist = $torrent->content();

    if (!sizeof($flist)) {
        $errors[] = $lang['no_files'];
    }

    $totallen = 0;
    $filelist = array();

     foreach ( $flist AS $file => $size ) {
         $filelist[] = array($file, $size);
         $totallen += $size;
     }

    if ( !$torrent->is_private() ) {
        $torrent->is_private(true);
    }

    if ( sizeof($errors) ) {
        trigger_error($lang['next_errors_occured'] . '<br />' . implode('<br />', $errors) );
    }

    $infohash = $torrent->hash_info();

    $filename = md5($infohash . time());

    if ( @move_uploaded_file($torrent_file['tmp_name'], $torrent_dir . DIRECTORY_SEPARATOR . $filename . '.torrent') === false ) {
        trigger_error($lang['file_cannot_be_uploaded']);
    }

    $torrent->save($torrent_dir . DIRECTORY_SEPARATOR . $filename . '.torrent');

    return array($infohash, $torrent_file['name'], $totallen, $filelist, $dname, $filename);
}

function check_upload_image ( $image_file, $upload_path, $max_size = 0, $max_height = 0, $max_width = 0, $name = '' ) {
    global $config, $db, $lang, $root_path;

    if ( !$image_file ) {
        trigger_error($lang['please_select_file']);
    }

    $upload_name = ( isset($image_file['name']) ? $image_file['name'] : '' );
     $tmp_name = ( isset($image_file['tmp_name']) && $image_file['tmp_name'] != 'none' ? $image_file['tmp_name'] : '' );
     $filesize = ( isset($image_file['size']) ? $image_file['size'] : 0 );
     $filetype = ( isset($image_file['type']) ? $image_file['type'] : '' );

    if ( !$upload_name || !$filesize )
     {
        trigger_error($lang['please_select_file']);
     }

     if ( $max_size && $filesize > $max_size ) {
         trigger_error(sprintf($lang['remote_image_error_filesize'], mksize($max_size)));
     }


    list($width, $height) = getimagesize($tmp_name);

    if( !$width || !$height )
    {
        trigger_error($lang['image_adress_invalid']);
    }

    if ( $max_width && $width > $max_width ) {
        trigger_error(sprintf($lang['image_is_too_big'], $max_width, $max_height));
    }

    if ( $max_height && $height > $max_height ) {
        trigger_error(sprintf($lang['image_is_too_big'], $max_width, $max_height));
    }

     $ini_val = ( @phpversion() >= '4.0.0' ) ? 'ini_get' : 'get_cfg_var';

     preg_match('#image\/[x\-]*([a-z]+)#', $filetype, $filetype);

     $filetype = ( isset($filetype[1]) ? $filetype[1] : '' );

     switch( $filetype )
     {
        case 'jpeg':
          case 'pjpeg':
          case 'jpg':
            $ext = '.jpg';
          break;
        case 'gif':
            $ext = '.gif';
          break;
        case 'png':
            $ext = '.png';
          break;
          default:
            trigger_error($lang['invalid_image_filetype']);
          break;
     }

     $upload_name = ( $name ? $name . $ext : $upload_name );

    if ( !is_dir($root_path . $upload_path) || !is_writable($root_path . $upload_path) ) {
        trigger_error($lang['dir_not_exist_or_not_writable']);
     }

    if( file_exists($root_path . $upload_path . $upload_name) && !$name ) {
        trigger_error($lang['su_file_already']);
     }
     else {
         @unlink($root_path . $upload_path . $upload_name);
     }

    if ( @$ini_val('open_basedir') != '' ) {
        if ( @phpversion() < '4.0.3' ) {
            trigger_error($lang['su_open_basedir']);
          }
          $move_file = 'move_uploaded_file';
     }
     else {
        $move_file = 'copy';
     }

    $file_moved = @$move_file($tmp_name, $root_path . $upload_path . $upload_name);

    if( $file_moved ) {
        @chmod($root_path . $upload_path . $upload_name, 0777);
            return array('filename' => $upload_name, 'full_path' => $root_path . $upload_path . $upload_name);
     }
     else {
        trigger_error($lang['upload_failed']);
     }
}
?>