decir/restoretopic.php
author Dan
Thu, 29 Nov 2007 21:48:02 -0500
changeset 11 5585ac341820
parent 3 88b85b9b9272
permissions -rw-r--r--
SECURITY: fix stupid XSS vulnerability on initial post submit; add in support for the new search API
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
     1
<?php
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
     2
/*
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
     3
 * Decir
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
     4
 * Version 0.1
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
     5
 * Copyright (C) 2007 Dan Fuhry
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
     6
 * restoretopic.php - restores a deleted topic
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
     7
 *
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
     8
 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
     9
 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    10
 *
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    11
 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    12
 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    13
 */
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    14
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    15
require('common.php');
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    16
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    17
$tid = $paths->getParam(1);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    18
if ( strval(intval($tid)) !== $tid )
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    19
{
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    20
  die_friendly('Error', '<p>Invalid topic ID</p>');
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    21
}
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    22
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    23
$tid = intval($tid);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    24
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    25
// Obtain topic info
3
88b85b9b9272 What can I say? More progress. Mostly bugfixes and ACL stuff now. Which reminds me - don't use this release, there are quite a few access bugs in it right now.
Dan
parents: 2
diff changeset
    26
$q = $db->sql_query('SELECT t.forum_id, t.topic_id, t.topic_deleted, t.topic_deletor, t.topic_starter, t.topic_delete_reason, u.username AS deletor FROM '.table_prefix.'decir_topics AS t
2
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    27
                       LEFT JOIN '.table_prefix.'users AS u
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    28
                         ON ( u.user_id = t.topic_deletor OR t.topic_deletor IS NULL )
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    29
                       WHERE t.topic_id='.$tid.';');
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    30
if ( !$q )
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    31
  $db->_die('Decir restoretopic.php');
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    32
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    33
if ( $db->numrows() < 1 )
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    34
{
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    35
  die_friendly('Error', '<p>The topic you requested does not exist.</p>');
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    36
}
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    37
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    38
$row = $db->fetchrow();
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    39
$db->free_result();
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    40
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    41
$tid = intval($row['topic_id']);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    42
3
88b85b9b9272 What can I say? More progress. Mostly bugfixes and ACL stuff now. Which reminds me - don't use this release, there are quite a few access bugs in it right now.
Dan
parents: 2
diff changeset
    43
$acl_type = ( $row['topic_starter'] == $session->user_id && $session->user_logged_in ) ? 'decir_undelete_own_topic' : 'decir_undelete_other_topic';
2
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    44
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    45
$post_perms = $session->fetch_page_acl(strval($pid), 'DecirPost');
3
88b85b9b9272 What can I say? More progress. Mostly bugfixes and ACL stuff now. Which reminds me - don't use this release, there are quite a few access bugs in it right now.
Dan
parents: 2
diff changeset
    46
if ( !$post_perms->get_permissions($acl_type) )
2
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    47
{
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    48
  die_friendly('Error', '<p>You do not have permission to restore this topic.</p>');
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    49
}
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    50
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    51
$edit_reason = '';
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    52
if ( isset($_GET['act']) && $_GET['act'] == 'submit' )
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    53
{
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    54
  if ( isset($_POST['do']['restore']) )
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    55
  {
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    56
    $result = decir_restore_topic($tid);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    57
    if ( $result )
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    58
    {
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    59
      $url = makeUrlNS('Special', 'Forum/Topic/' . $tid, false, true);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    60
      redirect($url, 'Topic restored', 'The selected topic has been restored.', 4);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    61
    }
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    62
  }
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    63
  else if ( isset($_POST['do']['noop']) )
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    64
  {
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    65
    $url = makeUrlNS('Special', 'Forum/Topic/' . $tid, false, true);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    66
    redirect($url, '', '', 0);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    67
  }
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    68
}
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    69
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    70
$template->header(true);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    71
$form_submit_url = makeUrlNS('Special', 'Forum/RestoreTopic/' . $tid, 'act=submit', true);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    72
?>
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    73
<form action="<?php echo $form_submit_url; ?>" method="post" enctype="multipart/form-data">
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    74
  <p>Are you sure you want to restore this topic? If you do this, the public will be able to view it (providing that an access rule hasn't specified otherwise).</p>
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    75
  <p><input type="submit" name="do[restore]" value="Restore topic" tabindex="3" /> <input tabindex="4" type="submit" name="do[noop]" value="Cancel" /></p>
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    76
</form>
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    77
<?php
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    78
$template->footer(true);
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    79
253118325c65 Pagination on topics and a whole crapload of other stuff.
Dan
parents:
diff changeset
    80
?>