updated readme with information on a series of bugs I know exist

[scuttle] / register.php

diff --git a/register.php b/register.php
index 8f95ed6d3ee7f33e24329199590bae13f16ed011..624d4ae0a76d2b7a9e0d42c940f1a730d76591e8 100644 (file)
--- a/register.php
+++ b/register.php
@@ -19,8 +19,9 @@ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 ***************************************************************************/
 
 require_once 'header.inc.php';
 ***************************************************************************/
 
 require_once 'header.inc.php';

-$userservice     =& ServiceFactory::getServiceInstance('UserService');
-$templateservice =& ServiceFactory::getServiceInstance('TemplateService');
+$sf = new ServiceFactory();
+$userservice     =& $sf->getServiceInstance('UserService');
+$templateservice =& $sf->getServiceInstance('TemplateService');

 
 $tplVars   = array();
 $completed = FALSE;
 
 $tplVars   = array();
 $completed = FALSE;


@@ -30,14 +31,20 @@ if ($_POST['submitted']) {
     $posteduser = trim(utf8_strtolower($_POST['username']));
     $postedpass = trim($_POST['password']);
     $postedconf = trim($_POST['passconf']);
     $posteduser = trim(utf8_strtolower($_POST['username']));
     $postedpass = trim($_POST['password']);
     $postedconf = trim($_POST['passconf']);

+    $postedmail = trim($_POST['email']);

 
     // Check token
     if (!isset($_SESSION['token']) || $_POST['token'] != $_SESSION['token']) {
       $tplVars['error'] = T_('Form could not be authenticated. Please try again.');
     }
 
 
     // Check token
     if (!isset($_SESSION['token']) || $_POST['token'] != $_SESSION['token']) {
       $tplVars['error'] = T_('Form could not be authenticated. Please try again.');
     }
 

+    // Check elapsed time
+    if (!isset($_SESSION['token_time']) || time() - $_SESSION['token_time'] < 1) {
+      $tplVars['error'] = T_('Form was submitted too quickly. Please wait before trying again.');
+    }
+

     // Check if form is incomplete
     // Check if form is incomplete

-    elseif (!$posteduser || !$postedpass || !($_POST['email'])) {
+    elseif (!$posteduser || !$postedpass || !$postedmail) {

       $tplVars['error'] = T_('You <em>must</em> enter a username, password and e-mail address.');
     }
 
       $tplVars['error'] = T_('You <em>must</em> enter a username, password and e-mail address.');
     }
 


@@ -62,17 +69,17 @@ if ($_POST['submitted']) {
     }
 
     // Check if e-mail address is blocked
     }
 
     // Check if e-mail address is blocked

-    elseif ($userservice->isBlockedEmail($_POST['email'])) {
+    elseif ($userservice->isBlockedEmail($postedmail)) {

       $tplVars['error'] = T_('This e-mail address is not permitted.');
     }
 
     // Check if e-mail address is valid
       $tplVars['error'] = T_('This e-mail address is not permitted.');
     }
 
     // Check if e-mail address is valid

-    elseif (!$userservice->isValidEmail($_POST['email'])) {
+    elseif (!$userservice->isValidEmail($postedmail)) {

       $tplVars['error'] = T_('E-mail address is not valid. Please try again.');
     }
 
     // Register details
       $tplVars['error'] = T_('E-mail address is not valid. Please try again.');
     }
 
     // Register details

-    elseif ($userservice->addUser($posteduser, $_POST['password'], $_POST['email'])) {
+    elseif ($userservice->addUser($posteduser, $_POST['password'], $postedmail)) {

       // Log in with new username
       $login = $userservice->login($posteduser, $_POST['password']);
       if ($login) {
       // Log in with new username
       $login = $userservice->login($posteduser, $_POST['password']);
       if ($login) {