<?
include "header.php";
if(isset($_POST['task'])) { $task = $_POST['task']; } elseif(isset($_GET['task'])) { $task = $_GET['task']; } else { $task = "step_one"; }
$admin_info = mysql_fetch_assoc(mysql_query("SELECT * FROM ims_admin"));
$is_error = "no";
$p_id = $_GET['p'];



$plans = mysql_query("SELECT * FROM ims_plans");
$plans_on = mysql_query("SELECT * FROM ims_plans WHERE status='on'");
if(mysql_num_rows($plans) == 0) {
echo $header;
echo "
<table width='520' cellpadding='0' cellspacing='0'>
<tr><td>
<b>An Error Has Occurred:</b><br>
The administrator has not yet created any signup plans.<br>
Please check back at a later time.

</td>
</tr>
</table>
";
echo $footer;
exit();
} elseif(mysql_num_rows($plans_on) == 0) {
echo $header;
echo "
<table width='520' cellpadding='0' cellspacing='0'>
<tr><td>
<b>An Error Has Occurred:</b><br>
The administrator has not made any signup plans available.<br>
Please check back at a later time.

</td>
</tr>
</table>
";
echo $footer;
exit();
}







if($task == "step_two") {

  if(preg_match("/[^a-z,A-Z,0-9]/", $_POST['password'])) {
  $is_error = "yes";
  $error = "Passwords may only contain alpha-numeric characters.";
  }
  if($_POST['password'] != $_POST['password2']) {
  $is_error = "yes";
  $error = "Your password and password confirmation fields do not match.";
  }
  if(!preg_match("/^[-_.[:alnum:]]+@((([[:alnum:]]|[[:alnum:]][[:alnum:]-]*[[:alnum:]])\.)+(ad|ae|aero|af|ag|ai|al|am|an|ao|aq|ar|arpa|as|at|au|aw|az|ba|bb|bd|be|bf|bg|bh|bi|biz|bj|bm|bn|bo|br|bs|bt|bv|bw|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|com|coop|cr|cs|cu|cv|cx|cy|cz|de|dj|dk|dm|do|dz|ec|edu|ee|eg|eh|er|es|et|eu|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gh|gi|gl|gm|gn|gov|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|hr|ht|hu|id|ie|il|in|info|int|io|iq|ir|is|it|jm|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|mg|mh|mil|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|museum|mv|mw|mx|my|mz|na|name|nc|ne|net|nf|ng|ni|nl|no|np|nr|nt|nu|nz|om|org|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|pro|ps|pt|pw|py|qa|re|ro|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|st|su|sv|sy|sz|tc|td|tf|tg|th|tj|tk|tm|tn|to|tp|tr|tt|tv|tw|tz|ua|ug|uk|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|yu|za|zm|zw)|(([0-9][0-9]?|[0-1][0-9][0-9]|[2][0-4][0-9]|[2][5][0-5])\.){3}([0-9][0-9]?|[0-1][0-9][0-9]|[2][0-4][0-9]|[2][5][0-5]))$/i", $_POST['email'])) {
  $is_error = "yes";
  $error = "Please make sure you have provided a valid email address.";
  }
  $duplicates = mysql_num_rows(mysql_query("SELECT * FROM ims WHERE email='$_POST[email]'"));
  if($duplicates != 0) {
  $is_error = "yes";
  $error = "A user with the email address \"$_POST[email]\" already exists.<br>If you have forgotten your password, <a href='forgot.php?r=login'>click here</a> to have your password sent to you.";
  }
  if(strlen($_POST['password']) < 4) { 
  $is_error = "yes";
  $error = "Your password must be 4 or more characters in length.";
  }
  $banned_emails = explode(",", $admin_info[ban_email]);
  $banned_ip = explode(",", $admin_info[ban_ip]);
  if(($_POST['email'] != "" & in_array($_POST['email'], $banned_emails)) | ($_SERVER['REMOTE_ADDR'] != "" & in_array($_SERVER['REMOTE_ADDR'], $banned_ip))) {
  $is_error = "yes";
  $error = "You have been banned from using this system by the administrator.";
  }
  if($_POST['email'] == "" | $_POST['password'] == "" | $_POST['password2'] == "" | $_POST['fname'] == "" | $_POST['lname'] == "") {
  $is_error = "yes";
  $error = "Please make sure you have completed all the fields.";
  }
 
  if($is_error == "yes") {
  $task = "step_one";
  }

if($task == "step_two") {
$server_array = explode("/", $_SERVER['PHP_SELF']);
$server_array_mod = array_pop($server_array);
$server_info = implode("/", $server_array);
$server = "http://".$_SERVER['HTTP_HOST'].$server_info;
$plan_info = mysql_fetch_assoc(mysql_query("SELECT * FROM ims_plans WHERE p_id='$_POST[p_id]'"));
if($plan_info[price] != 0 & $admin_info[approve_deny] != "yes") { $action = "https://www.paypal.com/cgi-bin/webscr"; } else { $action = "signup.php"; }
  $custom = trim($_POST['email']).",".trim($_POST['password']).",".trim(str_replace("'", "&#39", stripslashes($_POST['fname']))).",".trim(str_replace("'", "&#39", stripslashes($_POST['lname']))).",".trim($_POST['IP']);
  $date = date("H:i:s M d, Y T", time());
  echo $header;

echo "
<table width='520' cellpadding='0' cellspacing='0'>
<tr>
<td valign='top'>

<b>Create New Account - Step 2 of 3</b><br>
";

if($plan_info[price] != 0 & $admin_info[approve_deny] != "yes") {
$button = "Continue to PayPal";
echo "
Next, you must review and agree with our Terms of Service. Then, you will
continue to a secure PayPal subscription page where you can provide your
billing information.
<br><br>
";
} else {
$button = "Create Account";
echo "
After you have reviewed our Terms of Service, click the button
to complete the signup process.
<br><br>
";
}

echo "
<table width='520' cellpadding='0' cellspacing='0'><tr>
<td style='padding: 4px; padding-left: 8px; padding-right: 8px; border: 1px solid #AAAAAA; background: #FFFFFF;'>
<b>Selected Hosting Package:</b><br>
<font color='#003366'><b>$plan_info[plan]</font></b><br>
$plan_info[plan_description]
</td>
</tr>
</table>
<br>

<table cellpadding='0' cellspacing='0'>
<form name='paypal' action='$action' method='POST' onSubmit='return checkAgree()'>
<tr>
<td><input type='checkbox' name='agree' value='yes'>&nbsp;</td>
<td>I have thoroughly read and agree to the <a href='terms.php' target='_blank'>Terms of Service</a>.</td>
</tr>
</table>

<script language='JavaScript'>
<!--
function checkAgree() {
if(document.paypal.agree.checked == true) { return true; } else { alert('You must read and agree to our Terms of Service to continue.'); return false; }
}
// -->
</script>

<br>
<table cellpadding='0' cellspacing='0'>
<tr>
  <input type='hidden' name='task' value='step_three'>
  <input type='hidden' name='cmd' value='_xclick-subscriptions'>
  <input type='hidden' name='business' value='$admin_info[paypal_email]'>
  <input type='hidden' name='item_name' value='$plan_info[plan]'>
  <input type='hidden' name='item_number' value='$plan_info[p_id]'>
  <input type='hidden' name='return' value='$server/signup_result.php'>
  <input type='hidden' name='rm' value='2'>
  <input type='hidden' name='cancel_return' value='$server/signup.php'>
  <input type='hidden' name='a3' value='$plan_info[price]'>
  <input type='hidden' name='p3' value='1'>
  <input type='hidden' name='t3' value='M'>
  <input type='hidden' name='src' value='1'>
  <input type='hidden' name='no_shipping' value='1'>
  <input type='hidden' name='no_note' value='1'>
  <input type='hidden' name='custom' value='$custom'>
  <input type='hidden' name='notify_url' value='$server/paypal.php'>
<td>
  <input type='submit' class='button' value='$button'>
</td>
  </form>
</tr>
</table>

</td>
</tr>
</table>


  ";
  echo $footer;
  exit;
}}












if($task == "step_one") {

echo $header;
echo "
<table width='520' cellpadding='0' cellspacing='0'>
<tr><td>
<b>Create New Account - Step 1 of 3</b><br>
Thank you for choosing $admin_info[site_name] as your premier image hosting provider!<br>
Please provide the following information to create your account.
<br><br>
</td>
</tr>
</table>

<table width='520' cellpadding='0' cellspacing='0'>
<form action='signup.php' method='POST'>
<tr><td valign='top'>

<table cellpadding='3' cellspacing='0'>
<tr>
 <td width='120' align='right'><b>Hosting Package</b></td>
 <td>
 <select name='p_id' class='text'>";
 $plans = mysql_query("SELECT * FROM ims_plans WHERE status='on' ORDER BY price, plan");
 while($plan_info = mysql_fetch_assoc($plans)) {
 echo "<option value='$plan_info[p_id]'"; if($p_id == $plan_info[p_id] OR $_POST[p_id] == "$plan_info[p_id]") { echo " SELECTED"; } echo ">$plan_info[plan]</option>";
 }
 echo "
 </select>
 </td>
</tr>
<tr>
 <td align='right'><b>Email Address</b></td>
 <td><input size='25' type='text' class='text' name='email' maxlength='50' value='".str_replace("'", "&#39;", stripslashes($_POST[email]))."'></td>
</tr>
<tr>
 <td align='right'><b>Password</b></td>
 <td><input size='25' type='password' class='text' name='password' maxlength='20'></td>
</tr>
<tr>
 <td align='right'><b>Confirm Password</b></td>
 <td><input size='25' type='password' class='text' name='password2' maxlength='20'></td>
</tr>
<tr>
 <td align='right'><b>First Name</b></td>
 <td><input size='25' type='text' class='text' name='fname' maxlength='20' value='".str_replace("'", "&#39;", stripslashes($_POST[fname]))."'></td>
</tr>
<tr>
 <td align='right'><b>Last Name</b></td>
 <td><input size='25' type='text' class='text' name='lname' maxlength='20' value='".str_replace("'", "&#39;", stripslashes($_POST[lname]))."'></td>
</tr>
<tr>
 <td align='right'>&nbsp;</td>
 <td>
 <input type='hidden' name='IP' value='$_SERVER[REMOTE_ADDR]'>
 <input type='hidden' name='task' value='step_two'>
 <input class='button' type='submit' value='Click to Continue'>
 </td>
</tr>
";

if($error != "") { 
echo "
<tr><td>&nbsp;</td><td><b><font color='#000000'>$error</font></b></td></tr>
";
}

echo "
</table>
</td>
</form>
</tr>
</table>
";
echo $footer;
}



















if($task == "step_three") {
$custom = trim($_POST['custom']);
$custom_array = explode(",", $custom);
$email = $custom_array[0];
$password = $custom_array[1];
$fname = str_replace("'", "&#39;", stripslashes($custom_array[2]));
$lname = str_replace("'", "&#39;", stripslashes($custom_array[3]));
$IP = $custom_array[4];
$plan_info = mysql_fetch_assoc(mysql_query("SELECT * FROM ims_plans WHERE p_id='$_POST[item_number]'"));

if(mysql_num_rows(mysql_query("SELECT * FROM ims WHERE email='$email'")) == 0) {

if($admin_info[approve_deny] == "yes") { $is_approved = "no"; } else { $is_approved = "yes"; }
if($plan_info[price] > 0) { $subscribed = "no"; } else { $subscribed = "yes"; }
$signup_date = time();
$code = randomcode();
mysql_query("INSERT INTO ims (email,password,code,fname,lname,subscribed,account_active,reset,plan,price,signup_date,IP,last_login,ext_list,space_avail,folders_avail,max_filesize,bandwidth_allotted,photo_album,is_approved,prefs_newwin,prefs_listby,prefs_images_per_page,albumprefs_on,albumprefs_privacy,albumprefs_password,albumprefs_logo,albumprefs_thumbs,albumprefs_align,albumprefs_width) VALUES ('$email','$password','$code','$fname','$lname','$subscribed','yes','$signup_date','$_POST[item_number]','$plan_info[price]','$signup_date','$IP','Never','$plan_info[ext_list]','$plan_info[allocated_space]','$plan_info[allowed_folders]','$plan_info[max_filesize]','$plan_info[bandwidth_allotted]','$plan_info[photo_album]','$is_approved','yes','oldest','10','no','public','','','yes','left','500')");
$user_info = mysql_fetch_assoc(mysql_query("SELECT * FROM ims WHERE email='$email' AND password='$password'"));
mkdir("./u/$user_info[u_id]", 0700);
chmod("./u/$user_info[u_id]", 0777);
$newurl = "http".($_SERVER['HTTPS']=="on"?"s":"")."://".$_SERVER['SERVER_NAME'].strrev(strstr(strrev("$_SERVER[PHP_SELF]"),"/"));
$login_url = $newurl."index.php";

if($admin_info[welcome] == "yes") {
$fname = str_replace("&#39;", "'", $fname);
$lname = str_replace("&#39;", "'", $lname);
$welcome_note = str_replace("&#39;", "'", stripslashes($admin_info[welcome_note]));
$welcome_sub = str_replace("&#39;", "'", stripslashes($admin_info[welcome_sub]));
$welcome_note = str_replace("[email]", "$email", $welcome_note);
$welcome_sub = str_replace("[email]", "$email", $welcome_sub);
$welcome_note = str_replace("[password]", "$password", $welcome_note);
$welcome_sub = str_replace("[password]", "$password", $welcome_sub);
$welcome_note = str_replace("[name]", "$fname $lname", $welcome_note);
$welcome_sub = str_replace("[name]", "$fname $lname", $welcome_sub);
$welcome_note = str_replace("[url]", "$login_url", $welcome_note);
$welcome_sub = str_replace("[url]", "$login_url", $welcome_sub);
mail($email, $welcome_sub, $welcome_note, "From: $admin_info[email]");
}

if($admin_info[notify] == "yes") {
$fname = str_replace("&#39;", "'", $fname);
$lname = str_replace("&#39;", "'", $lname);
$subject = "A new IMS account has been created.";
$message = "A new user has signed up to your IMS.
Full Name: $fname $lname\nUsername: $email\nPassword: $password";
mail($admin_info[email], $subject, $message, "From: $admin_info[email]");
}

header("Location: signup_result.php?u_id=$user_info[u_id]");
}
exit;

}

?>