You need to log in to view your private messages.
'); + $argv = Array(); + $argv[] = $paths->getParam(0); + $argv[] = $paths->getParam(1); + $argv[] = $paths->getParam(2); + if(!$argv[0]) $argv[0] = 'InVaLiD'; + switch($argv[0]) + { + default: + header('Location: '.makeUrlNS('Special', 'PrivateMessages/Folder/Inbox')); + break; + case 'View': + $id = $argv[1]; + if(!preg_match('#^([0-9]+)$#', $id)) die_friendly('Message error', 'Invalid message ID
'); + $q = $db->sql_query('SELECT p.message_from, p.message_to, p.subject, p.message_text, p.date, p.folder_name, u.signature FROM '.table_prefix.'privmsgs AS p LEFT JOIN '.table_prefix.'users AS u ON (p.message_from=u.username) WHERE message_id='.$id.''); + if(!$q) $db->_die('The message data could not be selected.'); + $r = $db->fetchrow(); + $db->free_result(); + if( ($r['message_to'] != $session->username && $r['message_from'] != $session->username ) || $r['folder_name']=='drafts' ) die_friendly('Access denied', 'You are not authorized to view this message.
'); + if($r['message_to'] == $session->username) + { + $q = $db->sql_query('UPDATE '.table_prefix.'privmsgs SET message_read=1 WHERE message_id='.$id.''); + $db->free_result(); + if(!$q) $db->_die('Could not mark message as read'); + } + $template->header(); + userprefs_show_menu(); + ?> +| Private message from | |
|---|---|
| Subject: | |
| Date: | |
| Message: | '; + echo RenderMan::render($r['signature']); + } + ?> |
| Send reply | Delete message | Archive message | Return to inbox | |
Invalid message ID
'); + $q = $db->sql_query('SELECT message_to FROM '.table_prefix.'privmsgs WHERE message_id='.$id.''); + if(!$q) $db->_die('The message data could not be selected.'); + $r = $db->fetchrow(); + $db->free_result(); + if($r['message_to'] != $session->username) die_friendly('Access denied', 'You are not authorized to alter this message.
'); + $fname = $argv[2]; + if(!$fname || ( $fname != 'Inbox' && $fname != 'Outbox' && $fname != 'Sent' && $fname != 'Drafts' && $fname != 'Archive' ) ) die_friendly('Invalid request', 'The folder name "'.$fname.'" is invalid.
'); + $q = $db->sql_query('UPDATE '.table_prefix.'privmsgs SET folder_name=\''.strtolower($fname).'\' WHERE message_id='.$id.';'); + $db->free_result(); + if(!$q) $db->_die('The message was not successfully moved.'); + die_friendly('Message status', 'Your message has been moved to the folder "'.$fname.'".
'); + break; + case 'Delete': + $id = $argv[1]; + if(!preg_match('#^([0-9]+)$#', $id)) die_friendly('Message error', 'Invalid message ID
'); + $q = $db->sql_query('SELECT message_to FROM '.table_prefix.'privmsgs WHERE message_id='.$id.''); + if(!$q) $db->_die('The message data could not be selected.'); + $r = $db->fetchrow(); + if($r['message_to'] != $session->username) die_friendly('Access denied', 'You are not authorized to delete this message.
'); + $q = $db->sql_query('DELETE FROM '.table_prefix.'privmsgs WHERE message_id='.$id.';'); + if(!$q) $db->_die('The message was not successfully deleted.'); + $db->free_result(); + die_friendly('Message status', 'The message has been deleted.
'); + break; + case 'Compose': + if($argv[1]=='Send' && isset($_POST['_send'])) + { + // Check each POST DATA parameter... + if(!isset($_POST['to']) || ( isset($_POST['to']) && $_POST['to'] == '')) die_friendly('Sending of message failed', 'Please enter the username to which you want to send your message.
'); + if(!isset($_POST['subject']) || ( isset($_POST['subject']) && $_POST['subject'] == '')) die_friendly('Sending of message failed', 'Please enter a subject for your message.
'); + if(!isset($_POST['message']) || ( isset($_POST['message']) && $_POST['message'] == '')) die_friendly('Sending of message failed', 'Please enter a message to send.
'); + $namelist = $_POST['to']; + $namelist = str_replace(', ', ',', $namelist); + $namelist = explode(',', $namelist); + foreach($namelist as $n) { $n = $db->escape($n); } + $subject = RenderMan::preprocess_text($_POST['subject']); + $message = RenderMan::preprocess_text($_POST['message']); + $base_query = 'INSERT INTO '.table_prefix.'privmsgs(message_from,message_to,date,subject,message_text,folder_name,message_read) VALUES'; + foreach($namelist as $n) + { + $base_query .= '(\''.$session->username.'\', \''.$n.'\', '.time().', \''.$subject.'\', \''.$message.'\', \'inbox\', 0),'; + } + $base_query = substr($base_query, 0, strlen($base_query)-1) . ';'; + $result = $db->sql_query($base_query); + $db->free_result(); + if(!$result) $db->_die('The message could not be sent.'); + else die_friendly('Message status', 'Your message has been sent. You may edit the message if you wish; one copy for each recipient will be in your outbox until each recipient has read it. Return to your inbox.
'); + return; + } elseif($argv[1]=='Send' && isset($_POST['_savedraft'])) { + // Check each POST DATA parameter... + if(!isset($_POST['to']) || ( isset($_POST['to']) && $_POST['to'] == '')) die_friendly('Sending of message failed', 'Please enter the username to which you want to send your message.
'); + if(!isset($_POST['subject']) || ( isset($_POST['subject']) && $_POST['subject'] == '')) die_friendly('Sending of message failed', 'Please enter a subject for your message.
'); + if(!isset($_POST['message']) || ( isset($_POST['message']) && $_POST['message'] == '')) die_friendly('Sending of message failed', 'Please enter a message to send.
'); + $namelist = $_POST['to']; + $namelist = str_replace(', ', ',', $namelist); + $namelist = explode(',', $namelist); + foreach($namelist as $n) { $n = $db->escape($n); } + if(count($namelist) > MAX_PMS_PER_BATCH && $session->get_permssions('mod_misc')) die_friendly('Limit exceeded', 'You can only send this message to a maximum of '.MAX_PMS_PER_BATCH.' users.
'); + $subject = $db->escape($_POST['subject']); + $message = RenderMan::preprocess_text($_POST['message']); + $base_query = 'INSERT INTO '.table_prefix.'privmsgs(message_from,message_to,date,subject,message_text,folder_name,message_read) VALUES'; + foreach($namelist as $n) + { + $base_query .= '(\''.$session->username.'\', \''.$n.'\', '.time().', \''.$subject.'\', \''.$message.'\', \'drafts\', 0),'; + } + $base_query = substr($base_query, 0, strlen($base_query)-1) . ';'; + $result = $db->sql_query($base_query); + $db->free_result(); + if(!$result) $db->_die('The message could not be saved.'); + } elseif(isset($_POST['_inbox'])) { + header('Location: '.makeUrlNS('Special', 'PrivateMessages/Folder/Inbox')); + } + if($argv[1] == 'ReplyTo' && preg_match('#^([0-9]+)$#', $argv[2])) + { + $to = ''; + $text = ''; + $subj = ''; + $id = $argv[2]; + $q = $db->sql_query('SELECT p.message_from, p.message_to, p.subject, p.message_text, p.date, p.folder_name, u.signature FROM '.table_prefix.'privmsgs AS p LEFT JOIN '.table_prefix.'users AS u ON (p.message_from=u.username) WHERE message_id='.$id.';'); + if(!$q) $db->_die('The message data could not be selected.'); + $r = $db->fetchrow(); + $db->free_result(); + if( ($r['message_to'] != $session->username && $r['message_from'] != $session->username ) || $r['folder_name']=='drafts' ) die_friendly('Access denied', 'You are not authorized to view the contents of this message.
'); + $subj = 'Re: ' . $r['subject']; + $text = "\n\n\nOn ".date('M j, Y G:i', $r['date']).", ".$r['message_from']." wrote:\n> ".str_replace("\n", "\n> ", $r['message_text']); // Way less complicated than using a regex ;-) + + $tbuf = $text; + while( preg_match("/\n([\> ]*?)\> \>/", $text) ) + { + $text = preg_replace("/\n([\> ]*?)\> \>/", '\\1>>', $text); + if ( $text == $tbuf ) + break; + $tbuf = $text; + } + + $to = $r['message_from']; + } else { + if($argv[1]=='to' && $argv[2]) $to = $argv[2]; + else $to = ''; + $text = ''; + $subj = ''; + } + $template->header(); + userprefs_show_menu(); + echo '