<?php
session_start();
header( 'Content-type: text/html; charset=windows-1251' );
error_reporting( 1 );
require($_SERVER['DOCUMENT_ROOT']."/sfb.php");

$id_user = (isset($_SESSION["iduser"]) && preg_match("|^[\d]{1,11}$|", trim($_SESSION["iduser"]))) ? intval(trim($_SESSION["iduser"])) : false;

if(!isset($_SESSION['iduser'])) { exit(); }

// изменить аватар
if ($_FILES['avatar']['name']){
$uploaddir = $_SERVER['DOCUMENT_ROOT'] . '/avp/'; 
$ext = substr($_FILES['avatar']['name'],strpos($_FILES['avatar']['name'],'.'),strlen($_FILES['avatar']['name'])-1); 
$file = $uploaddir . basename($_SESSION["iduser"] . "avatar" . $ext); 
$filetypes = array('.jpg','.gif','.bmp','.png','.JPG','.BMP','.GIF','.PNG','.jpeg','.JPEG');
/// Проверяем на размер
if($_FILES['avatar']['size'] != 0 AND $_FILES['avatar']['size'] < 64*1024){
/// Проверяем содержимое	
if(in_array($ext,$filetypes)){
$imgs = GetImageSize($_FILES['avatar']['tmp_name']);
/// Проверяем размеры файла
if ($imgs[0] > 100 or $imgs[1] > 100) {
echo "<span class='taskquestion'><center>Ошибка, аватар не соответствует требованиям</center></span>";exit();
}else{
/// Проверяем загружен ли файл на сервер
if(is_uploaded_file($_FILES['avatar']['tmp_name'])){
if($byme["avatar"] != 'no.png'){
chmod($_SERVER['DOCUMENT_ROOT'] . "/".$avatar, 0777);
unlink($_SERVER['DOCUMENT_ROOT'] . "/".$avatar);
}
/// Переносим файл из временной папки в нашу	
if (move_uploaded_file($_FILES['avatar']['tmp_name'], $file)) { 
mysql_query("Insert into tb_allhistory (idus,data,doing,title) values ('$id_user','".time()."','1','Пользователь изменил аватар')");
mysql_query("UPDATE b_users SET avatar='".$id_user."avatar".$ext."' WHERE id='".$id_user."'");
echo "<span class='taskquestion'><center>Загружено</center></span>";exit();
}else{
echo "5";exit();
}
}else{
echo "4";exit();
}
}
}else{
echo "3";exit();
}
}else{
echo "<span class='taskquestion'><center>Аватар не соответствует требованиям!</center></span>";exit();
}
}


if(!isset($_POST['func'])) { exit(); }
if( $_SERVER['HTTP_X_REQUESTED_WITH'] != 'XMLHttpRequest' ) { exit(); }

// Расположение кода
if($_POST['func'] == "vibor1") {
$ask_vibor = (isset($_POST["ask_vibor"]) && preg_match("|^[\d]{1}$|", trim($_POST["ask_vibor"]))) ? intval(trim($_POST["ask_vibor"])) : "0";
if($ask_vibor >=0 AND $ask_vibor <= 2){
mysql_query("UPDATE `b_users` SET `vibor`='$ask_vibor' WHERE `id` = '$id_user'") or die(mysql_error());
mysql_query("INSERT INTO `tb_allhistory` (`idus`, `data`, `doing`, `title`) values ('$id_user','".time()."','1','Пользователь изменил расположение блока кода')") or die(mysql_error());
echo "<center><span class='taskquestion'>Настройки сохранены, обновите страницу.</span></center><br />";exit();
}else{
echo "1";exit();
}
}

// Мой род деятельности
if($_POST['func'] == "activities") {
$ask_proff = (isset($_POST["ask_proff"]) && preg_match("|^[\d]{1}$|", trim($_POST["ask_proff"]))) ? intval(trim($_POST["ask_proff"])) : "0";
if($ask_proff >=0 AND $ask_proff <= 6){
mysql_query("UPDATE `b_users` SET `doing` = '$ask_proff' WHERE `id` = '$id_user'") or die(mysql_error());
mysql_query("INSERT INTO `tb_allhistory` (`idus`, `data`, `doing`, `title`) values ('$id_user','".time()."','1','Пользователь изменил род деятельности')") or die(mysql_error());
echo "<center><span class='taskquestion'>Настройки сохранены, обновите страницу.</span></center><br />";exit();
}else{
echo "1";exit();
}
}

// семейное положение
if($_POST['func'] == "family") {
$ask_family = (isset($_POST["ask_family"]) && preg_match("|^[\d]{1}$|", trim($_POST["ask_family"]))) ? intval(trim($_POST["ask_family"])) : "0";
if($ask_family >=0 AND $ask_family <= 6){
mysql_query("UPDATE `b_users` SET `family`='$ask_family' WHERE `id` = '$id_user'") or die(mysql_error());
mysql_query("INSERT INTO `tb_allhistory` (`idus`, `data`, `doing`, `title`) values ('$id_user','".time()."','1','Пользователь изменил семейное положение')") or die(mysql_error());
echo "<center><span class='taskquestion'>Настройки сохранены, обновите страницу.</span></center><br />";exit();
}else{
echo "1";exit();
}
}

// изменение WM кошелька
if($_POST['func'] == "add_purse") {
$sys = validetext($_POST['sys']);

if($sys == "wm") {
$wm_purse = (isset($_POST['purse_us']) && preg_match("|^[R]{1}[\d]{12}$|", trim($_POST['purse_us']))) ? trim($_POST['purse_us']) : false;
//получения wmid через кошелек
$gwmid = getwmid($wm_purse);
$col_wmid = mysql_num_rows(mysql_query("SELECT `id` FROM `b_users` WHERE `wmid` = '$gwmid' OR `pemail`='$wm_purse'"));
$sql_ps = mysql_query("SELECT `wmid`,`purse`,`valuta` FROM `tb_site` WHERE `id`='1'") or die(mysql_error());
$row_ps = mysql_fetch_assoc($sql_ps);
if(MY_WM_PURSE){
echo '4';exit();
}elseif (substr($wm_purse, 0, 1) != $row_ps["valuta"] or strlen($wm_purse) != 13 or !is_numeric(substr($wm_purse, 1, 13)) or $gwmid == 1 OR $row_ps["purse"] == $wm_purse) {
echo "1";exit();
}elseif($row_ps["wmid"] == $gwmid){
echo '3';exit();
}elseif($col_wmid > 0){
echo '2';exit();
}else{
mysql_query("UPDATE `b_users` SET `wmid` = '$gwmid', `pemail` = '$wm_purse' WHERE `id` = '$id_user'") or die(mysql_error());
mysql_query("INSERT INTO `tb_allhistory` (`idus`, `data`, `doing`, `title`) values ('$id_user','".time()."','1','Пользователь добавил номер кошелька WebMoney')") or die(mysql_error());
echo "0";exit();
}
}elseif($sys == "qw"){
$qw_purse = (isset($_POST['purse_us']) && preg_match("/^\+?([87](?!95[4-9]|99\d|907|94[^0]|812[^9]|336)([34]\d|9[^7]|8[13]|7[07])\d{8}|855\d{8}|[12456]\d{9,13}|500[56]\d{4}|376\d{6}|8[68]\d{10,11}|8[14]\d{10}|82\d{9,10}|852\d{8}|90\d{10}|96(0[79]|170|13)\d{6}|96[23]\d{9}|964\d{10}|96(5[69]|89)\d{7}|96(65|77)\d{8}|92[023]\d{9}|91[1879]\d{9}|9[34]7\d{8}|959\d{7}|989\d{9}|97\d{8,12}|99[^45]\d{7,11}|994\d{9}|9955\d{8}|380[34569]\d{8}|38[15]\d{9}|375[234]\d{8}|372\d{7,8}|37[0-4]\d{8}|37[6-9]\d{7,11}|30[69]\d{9}|34[67]\d{8}|3[123569]\d{8,12}|38[1679]\d{8}|382\d{8,9})$/", trim($_POST['purse_us']))) ? strip_tags(trim($_POST['purse_us'])) : false;
$col_purse = mysql_num_rows(mysql_query("SELECT `id` FROM `b_users` WHERE `qw_purse` = '$qw_purse'"));
if($qw_purse == false) {
echo "1";exit();
}elseif(MY_QW_PURSE){
echo "4";exit();
}elseif($col_purse > 0){
echo "2";exit();
}else{
mysql_query("UPDATE `b_users` SET `qw_purse` = '$qw_purse' WHERE `id` = '$id_user'") or die(mysql_error());
mysql_query("INSERT INTO `tb_allhistory` (`idus`, `data`, `doing`, `title`) values ('$id_user','".time()."','1','Пользователь добавил номер кошелька QiWi')") or die(mysql_error());
echo "0";exit();
}
}elseif($sys == "ym"){
$ym_purse = (isset($_POST['purse_us']) && preg_match("|^[\d]{12,16}$|", trim($_POST['purse_us']))) ? trim($_POST['purse_us']) : false;
$col_purse = mysql_num_rows(mysql_query("SELECT `id` FROM `b_users` WHERE `ym_purse` = '$ym_purse'"));
if($ym_purse == false) {
echo "1";exit();
}elseif(MY_YM_PURSE){
echo "4";exit();
}elseif($col_purse > 0){
echo "2";exit();
}else{
mysql_query("UPDATE `b_users` SET `ym_purse` = '$ym_purse' WHERE `id` = '$id_user'") or die(mysql_error());
mysql_query("INSERT INTO `tb_allhistory` (`idus`, `data`, `doing`, `title`) values ('$id_user','".time()."','1','Пользователь добавил номер кошелька YandexMoney')") or die(mysql_error());
echo "0";exit();
}
}elseif($sys == "lp"){
$lp_purse = (isset($_POST['purse_us']) && preg_match("/^\+?([87](?!95[4-9]|99\d|907|94[^0]|812[^9]|336)([34]\d|9[^7]|8[13]|7[07])\d{8}|855\d{8}|[12456]\d{9,13}|500[56]\d{4}|376\d{6}|8[68]\d{10,11}|8[14]\d{10}|82\d{9,10}|852\d{8}|90\d{10}|96(0[79]|170|13)\d{6}|96[23]\d{9}|964\d{10}|96(5[69]|89)\d{7}|96(65|77)\d{8}|92[023]\d{9}|91[1879]\d{9}|9[34]7\d{8}|959\d{7}|989\d{9}|97\d{8,12}|99[^45]\d{7,11}|994\d{9}|9955\d{8}|380[34569]\d{8}|38[15]\d{9}|375[234]\d{8}|372\d{7,8}|37[0-4]\d{8}|37[6-9]\d{7,11}|30[69]\d{9}|34[67]\d{8}|3[123569]\d{8,12}|38[1679]\d{8}|382\d{8,9})$/", trim($_POST['purse_us']))) ? strip_tags(trim($_POST['purse_us'])) : false;
$col_purse = mysql_num_rows(mysql_query("SELECT `id` FROM `b_users` WHERE `lp_purse` = '$lp_purse'"));
if($lp_purse == false) {
echo "1";exit();
}elseif(MY_LP_PURSE){
echo "4";exit();
}elseif($col_purse > 0){
echo "2";exit();
}else{
mysql_query("UPDATE `b_users` SET `lp_purse` = '$lp_purse' WHERE `id` = '$id_user'") or die(mysql_error());
mysql_query("INSERT INTO `tb_allhistory` (`idus`, `data`, `doing`, `title`) values ('$id_user','".time()."','1','Пользователь добавил номер кошелька LiqPay')") or die(mysql_error());
echo "0";exit();
}
}elseif($sys == "pm"){
$pm_purse = (isset($_POST['purse_us']) && preg_match("|^[U]{1}[\d]{1,20}$|", trim($_POST['purse_us']))) ? trim($_POST['purse_us']) : false;
$col_purse = mysql_num_rows(mysql_query("SELECT `id` FROM `b_users` WHERE `pm_purse` = '$pm_purse'"));
if($pm_purse == false) {
echo "1";exit();
}elseif(MY_PM_PURSE){
echo "4";exit();
}elseif($col_purse > 0){
echo "2";exit();
}else{
mysql_query("UPDATE `b_users` SET `pm_purse` = '$pm_purse' WHERE `id` = '$id_user'") or die(mysql_error());
mysql_query("INSERT INTO `tb_allhistory` (`idus`, `data`, `doing`, `title`) values ('$id_user','".time()."','1','Пользователь добавил номер кошелька PerfectMoney')") or die(mysql_error());
echo "0";exit();
}
}elseif($sys == "py"){
$py_purse = (isset($_POST['purse_us']) && preg_match("|^[P]{1}[\d]{1,20}$|", trim($_POST['purse_us']))) ? trim($_POST['purse_us']) : false;
$col_purse = mysql_num_rows(mysql_query("SELECT `id` FROM `b_users` WHERE `py_purse` = '$py_purse'"));
if($py_purse == false) {
echo "1";exit();
}elseif(MY_PY_PURSE){
echo "4";exit();
}elseif($col_purse > 0){
echo "2";exit();
}else{
mysql_query("UPDATE `b_users` SET `py_purse` = '$py_purse' WHERE `id` = '$id_user'") or die(mysql_error());
mysql_query("INSERT INTO `tb_allhistory` (`idus`, `data`, `doing`, `title`) values ('$id_user','".time()."','1','Пользователь добавил номер кошелька Payeer')") or die(mysql_error());
echo "0";exit();
}
}else{exit();}
}

// изменить пароль
if($_POST['func'] == "chenge_pass") {
$newpass = (isset($_POST["ask_passw"]) && preg_match("|^[a-zA-Z0-9\-_]{5,32}$|", trim($_POST["ask_passw"]))) ? strip_tags(stripslashes(trim($_POST["ask_passw"]))) : false;
$cpass = (isset($_POST["ask_cpass"]) && preg_match("|^[a-zA-Z0-9\-_]{5,32}$|", trim($_POST["ask_cpass"]))) ? strip_tags(stripslashes(trim($_POST["ask_cpass"]))) : false;
if($newpass != false) {
if($newpass == $cpass) {
$newpass = md5($newpass);
mysql_query("UPDATE `b_users` SET `password`='$newpass' WHERE `id`='$id_user'") or die(mysql_error());
mysql_query("INSERT INTO `tb_allhistory` (`idus`, `data`, `doing`, `title`) values ('$id_user','".time()."','1','Пользователь изменил пароль')") or die(mysql_error());
$_SESSION["password"] = $newpass;
echo "1";exit();
}else{
echo "<center><span class='taskquestion'>Настройки сохранены, обновите страницу.</span></center>";exit();
}
}else{
echo "3";exit();
}
}

//отправлять мне личные сообщения 
if($_POST['func'] == "mails") {
$newmaccess = (isset($_POST["ch_pmenabled"]) && preg_match("|^[\d]{1}$|", trim($_POST["ch_pmenabled"]))) ? intval(trim($_POST["ch_pmenabled"])) : "0";
if($newmaccess != 1) $newmaccess = "0";
mysql_query("UPDATE `b_users` SET `mailaccess` = '$newmaccess' WHERE `id` = '$id_user'") or die(mysql_error());
exit();
}

if($_POST['func'] == "get_att"){
require_once($_SERVER['DOCUMENT_ROOT']."/merchant/webmoney/wmxml.inc.php");
$r = _WMXML11("333398411706");
$attkod = $r['att'];
if($attkod != $byme["wm_att"]){
mysql_query("UPDATE `b_users` SET `wm_att`='$attkod' WHERE `id`='$id_user'") or die(mysql_error());
echo wm_atestat($attkod);
}
}

#рассылка рефералам
if($_POST['func'] == "send_mail_ref"){
$count = intval($_POST["count"]);
$text = check_text($_POST["text"]);
$text = iconv('utf-8', 'cp1251', $text);
$text = nl2br($text);
$price = round($count*$send_mail_ref,4);
if($price > $r_money){ echo "2";exit(); }
elseif($count > $referals){ echo "3";exit(); }

$sql = mysql_query("SELECT `id`,`username` FROM `b_users` WHERE `referer`='$id_user' LIMIT $count")or die(mysql_error());
while($row = mysql_fetch_assoc($sql)){
mail_ls_n("От реферера", $text, $row["id"], $row["username"],$id_user, $log_user );
}
echo "1";exit();
}
exit();