<?

require_once("include/bittorrent.inc.php");

function bark($msg) {
	genbark($msg, "Update failed!");
}

dbconn();

loggedinorreturn();

if (!mkglobal("email:chpassword:passagain"))
	bark("missing form data");

$set = array();

$updateset = array();
$changedemail = $newsecret = 0;

if ($chpassword != "") {
	if (strlen($chpassword) > 40)
		bark("Sorry, password is too long (max is 40 chars)");
	if ($chpassword != $passagain)
		bark("The passwords didn't match. Try again.");
	$updateset[] = "password = " . sqlesc($chpassword);
	$newsecret = 1;
}

if ($email != $CURUSER["email"]) {
	if (!validemail($email))
		bark("That doesn't look like a valid email address.");
	$changedemail = 1;
}

/* ****** */

$urladd = "";

if ($newsecret) {
	$sec = mksecret();
	$updateset[] = "secret = " . sqlesc($sec);
	logincookie($CURUSER["id"], $chpassword, $sec);
}

if ($changedemail) {
	$sec = mksecret();
	$hash = md5($sec . $email . $sec);
	$obemail = urlencode($email);
	$updateset[] = "editsecret = " . sqlesc($sec);
	$body = <<<EOD
You have requested that your user profile (username {$CURUSER["username"]})
on $thisdomain should be updated with this email address ($email) as
user contact.

If you did not do this, please ignore this email. The person who entered your
email address had the IP address {$_SERVER["REMOTE_ADDR"]}. Please do not reply.

To complete the update of your user profile, please follow this link:

$tracker_url/confirmemail.php/{$CURUSER["id"]}/$hash/$obemail

Your new email address will appear in your profile after you do this. Otherwise
your profile will remain unchanged.
EOD;

	mail($email, "$thisdomain profile change confirmation", $body, "From: $tracker_url site robot <noreply@$tracker_url>");

	$urladd .= "&mailsent=1";
}

mysql_query("UPDATE users SET " . implode(",", $updateset) . " WHERE id = " . $CURUSER["id"]);

header("Refresh: 0; url=my.php?edited=1" . $urladd);

?>
