From 1326eea040ef2637ac58c92512f9b6f7dd7696bb Mon Sep 17 00:00:00 2001
From: Debabrata Trivedi <effone@mybb.com>
Date: Tue, 16 Jun 2020 00:25:24 +0530
Subject: [PATCH] Fixes #4040 Isolate hard-coded js from member.php (#4041)

Co-authored-by: Jordan Mussi <JordanMussi@users.noreply.github.com>
---
 install/resources/mybb_theme.xml |   3 +-
 jscripts/regvalidator.js         | 171 ++++++++++++++++++++++++
 member.php                       | 219 +++++--------------------------
 3 files changed, 209 insertions(+), 184 deletions(-)
 create mode 100644 jscripts/regvalidator.js
diff --git a/install/resources/mybb_theme.xml b/install/resources/mybb_theme.xml
index 36484a93d4..fb95289fb1 100644
--- a/install/resources/mybb_theme.xml
+++ b/install/resources/mybb_theme.xml
@@ -5107,7 +5107,7 @@ if(use_xmlhttprequest == "1")
 		</table>
 	</div>
 </div>]]></template>
-		<template name="member_register" version="1821"><![CDATA[<html>
+		<template name="member_register" version="1823"><![CDATA[<html>
 <head>
 <title>{$mybb->settings['bbname']} - {$lang->registration}</title>
 {$headerinclude}
@@ -5233,6 +5233,7 @@ if(use_xmlhttprequest == "1")
 </div>
 </form>
 {$validator_javascript}
+<script type="text/javascript" src="{$mybb->asset_url}/jscripts/regvalidator.js?ver=1823"></script>
 {$footer}
 </body>
 </html>]]></template>
diff --git a/jscripts/regvalidator.js b/jscripts/regvalidator.js
new file mode 100644
index 0000000000..3b0374aeed
--- /dev/null
+++ b/jscripts/regvalidator.js
@@ -0,0 +1,171 @@
+$(function () {
+	$('#registration_form').validate({
+		rules: {
+			username: {
+				required: true,
+				minlength: regsettings.minnamelength,
+				maxlength: regsettings.maxnamelength,
+				remote: {
+					url: 'xmlhttp.php?action=username_availability',
+					type: 'post',
+					dataType: 'json',
+					data:
+					{
+						my_post_key: my_post_key
+					},
+				},
+			},
+			email: {
+				required: true,
+				email: true,
+				remote: {
+					url: 'xmlhttp.php?action=email_availability',
+					type: 'post',
+					dataType: 'json',
+					data:
+					{
+						my_post_key: my_post_key
+					},
+				},
+			},
+			email2: {
+				required: true,
+				email: true,
+				equalTo: '#email'
+			},
+		},
+		messages: {
+			username: {
+				minlength: lang.js_validator_username_length,
+				maxlength: lang.js_validator_username_length,
+			},
+			email: lang.js_validator_invalid_email,
+			email2: lang.js_validator_email_match,
+		},
+		errorPlacement: function (error, element) {
+			if (element.is(':checkbox') || element.is(':radio'))
+				error.insertAfter($('input[name=\"' + element.attr('name') + '\"]').last().next('span'));
+			else
+				error.insertAfter(element);
+		}
+	});
+
+	var requiredfields = JSON.parse(regsettings.requiredfields);
+	$.each(requiredfields, function () {
+		var input_type = 'input';
+		var depth = "";
+		if (this.type == "textarea") {
+			input_type = "textarea";
+		} else if (this.type == "multiselect") {
+			input_type = "select";
+			depth = "[]";
+		} else if (this.type == "checkbox") {
+			depth = "[]";
+		}
+
+		$(input_type + '[name="profile_fields[' + this.fid + ']' + depth + '"]').rules('add', {
+			required: true,
+			messages: {
+				required: lang.js_validator_not_empty
+			}
+		});
+	});
+
+	if (regsettings.captchaimage == "1" && regsettings.captchahtml == "1") {
+		$('#imagestring').rules('add', {
+			required: true,
+			remote: {
+				url: 'xmlhttp.php?action=validate_captcha',
+				type: 'post',
+				dataType: 'json',
+				data:
+				{
+					imagehash: function () {
+						return $('#imagehash').val();
+					},
+					my_post_key: my_post_key
+				},
+			},
+			messages: {
+				remote: lang.js_validator_no_image_text
+			}
+		});
+	}
+
+	if (regsettings.securityquestion == "1" && regsettings.questionexists == "1") {
+		$('#answer').rules('add', {
+			required: true,
+			remote: {
+				url: 'xmlhttp.php?action=validate_question',
+				type: 'post',
+				dataType: 'json',
+				data:
+				{
+					question: function () {
+						return $('#question_id').val();
+					},
+					my_post_key: my_post_key
+				},
+			},
+			messages: {
+				remote: lang.js_validator_no_security_question
+			}
+		});
+	}
+
+	if (regsettings.regtype !== "randompass") {
+		$.validator.addMethod('passwordSecurity', function (value, element, param) {
+			return !(
+				($('#email').val() != '' && value == $('#email').val()) ||
+				($('#username').val() != '' && value == $('#username').val()) ||
+				($('#email').val() != '' && value.indexOf($('#email').val()) > -1) ||
+				($('#username').val() != '' && value.indexOf($('#username').val()) > -1) ||
+				($('#email').val() != '' && $('#email').val().indexOf(value) > -1) ||
+				($('#username').val() != '' && $('#username').val().indexOf(value) > -1)
+			);
+		}, lang.js_validator_bad_password_security);
+
+		if (regsettings.requirecomplexpasswords == "1") {
+			$('#password').rules('add', {
+				required: true,
+				minlength: regsettings.minpasswordlength,
+				remote: {
+					url: 'xmlhttp.php?action=complex_password',
+					type: 'post',
+					dataType: 'json',
+					data:
+					{
+						my_post_key: my_post_key
+					},
+				},
+				passwordSecurity: '',
+				messages: {
+					minlength: lang.js_validator_password_length,
+					required: lang.js_validator_password_length,
+					remote: lang.js_validator_no_image_text
+				}
+			});
+		} else {
+			$('#password').rules('add', {
+				required: true,
+				minlength: regsettings.minpasswordlength,
+				passwordSecurity: '',
+				messages: {
+					minlength: lang.js_validator_password_length,
+					required: lang.js_validator_password_length
+				}
+			});
+		}
+
+		$('#password2').rules('add', {
+			required: true,
+			minlength: regsettings.minpasswordlength,
+			equalTo: '#password',
+			messages: {
+				minlength: lang.js_validator_password_length,
+				required: lang.js_validator_password_length,
+				equalTo: lang.js_validator_password_matches
+			}
+		});
+	}
+});
diff --git a/member.php b/member.php
index 976dc4da9f..2e7bdab636 100755
--- a/member.php
+++ b/member.php
@@ -790,59 +790,6 @@
 			$lang->js_validator_username_length = $lang->sprintf($lang->js_validator_username_length, $mybb->settings['minnamelength'], $mybb->settings['maxnamelength']);
 		}
 
-		$validator_javascript = "<script type=\"text/javascript\">
-$(function() {
-	$('#registration_form').validate({
-		rules: {
-			username: {
-				required: true,
-				minlength: {$mybb->settings['minnamelength']},
-				maxlength: {$mybb->settings['maxnamelength']},
-				remote: {
-					url: 'xmlhttp.php?action=username_availability',
-					type: 'post',
-					dataType: 'json',
-					data:
-					{
-						my_post_key: my_post_key
-					},
-				},
-			},
-			email: {
-				required: true,
-				email: true,
-				remote: {
-					url: 'xmlhttp.php?action=email_availability',
-					type: 'post',
-					dataType: 'json',
-					data:
-					{
-						my_post_key: my_post_key
-					},
-				},
-			},
-			email2: {
-				required: true,
-				email: true,
-				equalTo: '#email'
-			},
-		},
-		messages: {
-			username: {
-				minlength: '{$lang->js_validator_username_length}',
-				maxlength: '{$lang->js_validator_username_length}',
-			},
-			email: '{$lang->js_validator_invalid_email}',
-			email2: '{$lang->js_validator_email_match}',
-		},
-		errorPlacement: function(error, element) {
-			if(element.is(':checkbox') || element.is(':radio'))
-				error.insertAfter($('input[name=\"' + element.attr('name') + '\"]').last().next('span'));
-			else
-				error.insertAfter(element);
-		}
-	});\n";
-
 		if(isset($mybb->input['timezoneoffset']))
 		{
 			$timezoneoffset = $mybb->get_input('timezoneoffset');
@@ -945,6 +892,7 @@
 
 		if(is_array($pfcache))
 		{
+			$jsvar_reqfields = array();
 			foreach($pfcache as $profilefield)
 			{
 				if($profilefield['required'] != 1 && $profilefield['registration'] != 1 || !is_member($profilefield['editableby'], array('usergroup' => $mybb->user['usergroup'], 'additionalgroups' => $usergroup)))
@@ -1107,30 +1055,10 @@
 					// JS validator extra, choose correct selectors for everything except single select which always has value
 					if($type != 'select')
 					{
-						if($type == "textarea")
-						{
-							$inp_selector = "$('textarea[name=\"profile_fields[{$field}]\"]')";
-						}
-						elseif($type == "multiselect")
-						{
-							$inp_selector = "$('select[name=\"profile_fields[{$field}][]\"]')";
-						}
-						elseif($type == "checkbox")
-						{
-							$inp_selector = "$('input[name=\"profile_fields[{$field}][]\"]')";
-						}
-						else
-						{
-							$inp_selector = "$('input[name=\"profile_fields[{$field}]\"]')";
-						}
-
-						$validator_javascript .= "
-	{$inp_selector}.rules('add', {
-		required: true,
-		messages: {
-			required: '{$lang->js_validator_not_empty}'
-		}
-	});\n";
+						$jsvar_reqfields[] = array(
+							'type' => $type,
+							'fid' => $field,
+						);
 					}
 
 					eval("\$requiredfields .= \"".$templates->get("member_register_customfield")."\";");
@@ -1170,6 +1098,7 @@
 			$regerrors = '';
 		}
 		// Spambot registration image thingy
+		$captcha_html = 0;
 		if($mybb->settings['captchaimage'])
 		{
 			require_once MYBB_ROOT.'inc/class_captcha.php';
@@ -1177,36 +1106,14 @@
 
 			if($captcha->html)
 			{
+				$captcha_html = 1;
 				$regimage = $captcha->html;
-
-				if($mybb->settings['captchaimage'] == 1)
-				{
-					// JS validator extra for our default CAPTCHA
-					$validator_javascript .= "
-	$('#imagestring').rules('add', {
-		required: true,
-		remote:{
-			url: 'xmlhttp.php?action=validate_captcha',
-			type: 'post',
-			dataType: 'json',
-			data:
-			{
-				imagehash: function () {
-					return $('#imagehash').val();
-				},
-				my_post_key: my_post_key
-			},
-		},
-		messages: {
-			remote: '{$lang->js_validator_no_image_text}'
-		}
-	});\n";
-				}
 			}
 		}
 
 		// Security Question
 		$questionbox = '';
+		$question_exists = 0;
 		if($mybb->settings['securityquestion'])
 		{
 			$sid = generate_question();
@@ -1218,6 +1125,7 @@
 			");
 			if($db->num_rows($query) > 0)
 			{
+				$question_exists = 1;
 				$question = $db->fetch_array($query);
 
 				//Set parser options for security question
@@ -1247,26 +1155,6 @@
 				}
 
 				eval("\$questionbox = \"".$templates->get("member_register_question")."\";");
-
-				$validator_javascript .= "
-	$('#answer').rules('add', {
-		required: true,
-		remote:{
-			url: 'xmlhttp.php?action=validate_question',
-			type: 'post',
-			dataType: 'json',
-			data:
-			{
-				question: function () {
-					return $('#question_id').val();
-				},
-				my_post_key: my_post_key
-			},
-		},
-		messages: {
-			remote: '{$lang->js_validator_no_security_question}'
-		}
-	});\n";
 			}
 		}
 
@@ -1283,70 +1171,11 @@
 			// JS validator extra
 			$lang->js_validator_password_length = $lang->sprintf($lang->js_validator_password_length, $mybb->settings['minpasswordlength']);
 
-			$validator_javascript .= "
-	$.validator.addMethod('passwordSecurity', function(value, element, param) {
-		return !(
-				($('#email').val() != '' && value == $('#email').val()) ||
-				($('#username').val() != '' && value == $('#username').val()) ||
-				($('#email').val() != '' && value.indexOf($('#email').val()) > -1) ||
-				($('#username').val() != '' && value.indexOf($('#username').val()) > -1) ||
-				($('#email').val() != '' && $('#email').val().indexOf(value) > -1) ||
-				($('#username').val() != '' && $('#username').val().indexOf(value) > -1)
-		);
-	}, '{$lang->js_validator_bad_password_security}');\n";
-
 			// See if the board has "require complex passwords" enabled.
 			if($mybb->settings['requirecomplexpasswords'] == 1)
 			{
 				$lang->password = $lang->complex_password = $lang->sprintf($lang->complex_password, $mybb->settings['minpasswordlength']);
-
-				$validator_javascript .= "
-	$('#password').rules('add', {
-		required: true,
-		minlength: {$mybb->settings['minpasswordlength']},
-		remote:{
-			url: 'xmlhttp.php?action=complex_password',
-			type: 'post',
-			dataType: 'json',
-			data:
-			{
-				my_post_key: my_post_key
-			},
-		},
-		passwordSecurity: '',
-		messages: {
-			minlength: '{$lang->js_validator_password_length}',
-			required: '{$lang->js_validator_password_length}',
-			remote: '{$lang->js_validator_no_image_text}'
-		}
-	});\n";
 			}
-			else
-			{
-				$validator_javascript .= "
-	$('#password').rules('add', {
-		required: true,
-		minlength: {$mybb->settings['minpasswordlength']},
-        passwordSecurity: '',
-		messages: {
-			minlength: '{$lang->js_validator_password_length}',
-			required: '{$lang->js_validator_password_length}'
-		}
-	});\n";
-			}
-
-			$validator_javascript .= "
-	$('#password2').rules('add', {
-		required: true,
-		minlength: {$mybb->settings['minpasswordlength']},
-		equalTo: '#password',
-		messages: {
-			minlength: '{$lang->js_validator_password_length}',
-			required: '{$lang->js_validator_password_length}',
-			equalTo: '{$lang->js_validator_password_matches}'
-		}
-	});\n";
-
 			eval("\$passboxes = \"".$templates->get("member_register_password")."\";");
 		}
 
@@ -1374,10 +1203,34 @@
 		$time = TIME_NOW;
 
 		$plugins->run_hooks("member_register_end");
+		
+		$jsvar_reqfields = json_encode($jsvar_reqfields);
 
-		$validator_javascript .= "
-});
-</script>\n";
+		$validator_javascript = "<script type=\"text/javascript\">
+			var regsettings = {
+				requiredfields: '{$jsvar_reqfields}',
+				minnamelength: '{$mybb->settings['minnamelength']}',
+				maxnamelength: '{$mybb->settings['maxnamelength']}',
+				minpasswordlength: '{$mybb->settings['minpasswordlength']}',
+				captchaimage: '{$mybb->settings['captchaimage']}',
+				captchahtml: '{$captcha_html}',
+				securityquestion: '{$mybb->settings['securityquestion']}',
+				questionexists: '{$question_exists}',
+				requirecomplexpasswords: '{$mybb->settings['requirecomplexpasswords']}',
+				regtype: '{$mybb->settings['regtype']}',
+				hiddencaptchaimage: '{$mybb->settings['hiddencaptchaimage']}'
+			};
+		
+			lang.js_validator_username_length = '{$lang->js_validator_username_length}';
+			lang.js_validator_invalid_email = '{$lang->js_validator_invalid_email}';
+			lang.js_validator_email_match = '{$lang->js_validator_email_match}';
+			lang.js_validator_not_empty = '{$lang->js_validator_not_empty}';
+			lang.js_validator_password_length = '{$lang->js_validator_password_length}';
+			lang.js_validator_password_matches = '{$lang->js_validator_password_matches}';
+			lang.js_validator_no_image_text = '{$lang->js_validator_no_image_text}';
+			lang.js_validator_no_security_question = '{$lang->js_validator_no_security_question}';
+			lang.js_validator_bad_password_security = '{$lang->js_validator_bad_password_security}';
+		</script>\n";
 
 		eval("\$registration = \"".$templates->get("member_register")."\";");
 		output_page($registration);
