<?php

/***********************************************************************

  Copyright (C) 2002-2008  PunBB.org

  This file is part of PunBB.

  PunBB is free software; you can redistribute it and/or modify it

  under the terms of the GNU General Public License as published

  by the Free Software Foundation; either version 2 of the License,

  or (at your option) any later version.

  PunBB is distributed in the hope that it will be useful, but

  WITHOUT ANY WARRANTY; without even the implied warranty of

  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

  GNU General Public License for more details.

  You should have received a copy of the GNU General Public License

  along with this program; if not, write to the Free Software

  Foundation, Inc., 59 Temple Place, Suite 330, Boston,

  MA  02111-1307  USA

************************************************************************/

//

// Return all code blocks that hook into $hook_id

//

function get_hook($hook_id)

{

	global $pun_hooks;

	return !defined('PUN_DISABLE_HOOKS') && isset($pun_hooks[$hook_id]) ? implode("\n", $pun_hooks[$hook_id]) : false;

}

//

// Authenticates the provided username and password against the user database

// $user can be either a user ID (integer) or a username (string)

// $password can be either a plaintext password or a password hash including salt ($password_is_hash must be set accordingly)

//

function authenticate_user($user, $password, $password_is_hash = false)

{

	global $pun_db, $pun_user;

	($hook = get_hook('fn_authenticate_user_start')) ? eval($hook) : null;

	// Check if there's a user matching $user and $password

	$query = array(

		'SELECT'	=> 'eu.username AS username, u.*, g.*, o.logged, o.idle, o.csrf_token, o.prev_url',

		'FROM'		=> 'users AS u',

		'JOINS'		=> array(

			array(

				'INNER JOIN'	=> 'groups AS g',

				'ON'			=> 'g.g_id=u.group_id'

			),

			array(

				'LEFT JOIN'		=> 'online AS o',

				'ON'			=> 'o.user_id=u.id'

			)

		)

	);

	// Are we looking for a user ID or a username?

	$query['WHERE'] = is_int($user) ? 'u.id='.intval($user) : 'u.username=\''.$pun_db->escape($user).'\'';

	($hook = get_hook('fn_qr_get_user')) ? eval($hook) : null;

	$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

	$pun_user = $pun_db->fetch_assoc($result);

	if (!isset($pun_user['id']) ||

		($password_is_hash && $password != $pun_user['password']) ||

		(!$password_is_hash && sha1($pun_user['salt'].sha1($password)) != $pun_user['password']))

		set_default_user();

	($hook = get_hook('fn_authenticate_user_end')) ? eval($hook) : null;

}

//

// Replacement for authenticate_user() for Enano.

//

function authenticate_user_enano()

{

	global $pun_db, $pun_user;

	// import Enano globals

	global $db, $session, $paths, $template, $plugins; // Common objects

	($hook = get_hook('fn_authenticate_user_start')) ? eval($hook) : null;

	// Check if there's a user matching $user and $password

	$query = array(

		'SELECT'	=> 'eu.username AS username_authoritative, u.*, u.username AS bla, g.*, o.logged, o.idle, o.csrf_token, o.prev_url',

    'FROM'		=> $pun_db->prefix . 'users AS u',

		'JOINS'		=> array(

      array(

        'LEFT JOIN' => table_prefix . 'users AS eu',

        'ON'        => 'eu.user_id = u.id'

      ),

			array(

				'INNER JOIN'	=> $pun_db->prefix . 'groups AS g',

				'ON'			=> 'g.g_id=u.group_id'

			),

			array(

				'LEFT JOIN'		=> $pun_db->prefix . 'online AS o',

				'ON'			=> 'o.user_id=u.id'

			)

		),

    'PARAMS' => array(

      'NO_PREFIX' => ''

    )

	);

	// Are we looking for a user ID or a username?

	$query['WHERE'] = 'u.id=' . $session->user_id;

	($hook = get_hook('fn_qr_get_user')) ? eval($hook) : null;

	$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

	$pun_user = $pun_db->fetch_assoc($result);

  $pun_user['username'] =& $pun_user['username_authoritative'];

	if (!$session->user_logged_in)

		set_default_user();

	($hook = get_hook('fn_authenticate_user_end')) ? eval($hook) : null;

}

//

// Attempt to login with the user ID and password hash from the cookie

//

function cookie_login(&$pun_user)

{

	global $pun_db, $db_type, $pun_config, $cookie_name, $cookie_path, $cookie_domain, $cookie_secure, $pun_time_formats, $pun_date_formats;

  // import Enano globals

	global $db, $session, $paths, $template, $plugins; // Common objects

	($hook = get_hook('fn_cookie_login_start')) ? eval($hook) : null;

	$now = time();

	($hook = get_hook('fn_cookie_login_fetch_cookie')) ? eval($hook) : null;

	if ( $session->user_logged_in )

	{

		authenticate_user_enano();

		// If we got back the default user, the login failed

		if ($pun_user['id'] == '1')

		{

			// pun_setcookie($cookie_name, base64_encode('1|'.random_key(8, true)), $expire);

			return;

		}

		// Set a default language if the user selected language no longer exists

		if (!@file_exists(PUN_ROOT.'lang/'.$pun_user['language']))

			$pun_user['language'] = $pun_config['o_default_lang'];

		// Set a default style if the user selected style no longer exists

		if (!@file_exists(PUN_ROOT.'style/'.$pun_user['style'].'/'.$pun_user['style'].'.css'))

			$pun_user['style'] = $pun_config['o_default_style'];

		if (!$pun_user['disp_topics'])

			$pun_user['disp_topics'] = $pun_config['o_disp_topics_default'];

		if (!$pun_user['disp_posts'])

			$pun_user['disp_posts'] = $pun_config['o_disp_posts_default'];

		if ($pun_user['save_pass'] == '0')

			$expire = 0;

		// Check user has a valid date and time format

		if (!isset($pun_time_formats[$pun_user['time_format']]))

			$pun_user['time_format'] = 0;

		if (!isset($pun_date_formats[$pun_user['date_format']]))

			$pun_user['date_format'] = 0;

		// Define this if you want this visit to affect the online list and the users last visit data

		if (!defined('PUN_QUIET_VISIT'))

		{

			// Update the online list

			if (!$pun_user['logged'])

			{

				$pun_user['logged'] = $now;

				$pun_user['csrf_token'] = random_key(40, false, true);

				$pun_user['prev_url'] = get_current_url();

				// With MySQL/MySQLi/SQLite, REPLACE INTO avoids a user having two rows in the online table

				switch ($db_type)

				{

					case 'pgsql':

						$query = 'INSERT INTO '.$pun_db->prefix.'online (user_id, ident, logged, csrf_token, prev_url) SELECT '.$pun_user['id'].', \''.$pun_db->escape($pun_user['username']).'\', '.$pun_user['logged'].', \''.$pun_user['csrf_token'].'\', \''.$pun_db->escape($pun_user['prev_url']).'\' FROM '.$pun_db->prefix.'users WHERE id = '.$pun_user['id'].' AND NOT EXISTS (SELECT 1 FROM '.$pun_db->prefix.'online WHERE user_id='.$pun_user['id'].')';

						($hook = get_hook('fn_qr_add_online_user')) ? eval($hook) : null;

						$pun_db->query($query) or error(__FILE__, __LINE__);

						break;

					default:

						$query = array(

							'REPLACE'	=> 'user_id, ident, logged, csrf_token, prev_url',

							'INTO'		=> 'online',

							'VALUES'	=> $pun_user['id'].', \''.$pun_db->escape($pun_user['username']).'\', '.$pun_user['logged'].', \''.$pun_user['csrf_token'].'\', \''.$pun_db->escape($pun_user['prev_url']).'\''

						);

						($hook = get_hook('fn_qr_add_online_user')) ? eval($hook) : null;

						$pun_db->query_build($query) or error(__FILE__, __LINE__);

						break;

				}

				// Reset tracked topics

				set_tracked_topics(null);

			}

			else

			{

				// Special case: We've timed out, but no other user has browsed the forums since we timed out

				if ($pun_user['logged'] < ($now-$pun_config['o_timeout_visit']))

				{

					$query = array(

						'UPDATE'	=> 'users',

						'SET'		=> 'last_visit='.$pun_user['logged'],

						'WHERE'		=> 'id='.$pun_user['id']

					);

					($hook = get_hook('fn_qr_update_user_visit')) ? eval($hook) : null;

					$pun_db->query_build($query) or error(__FILE__, __LINE__);

					$pun_user['last_visit'] = $pun_user['logged'];

				}

				// Now update the logged time and save the current URL in the online list

				$query = array(

					'UPDATE'	=> 'online',

					'SET'		=> 'logged='.$now.', prev_url=\''.$pun_db->escape(get_current_url()).'\'',

					'WHERE'		=> 'user_id='.$pun_user['id']

				);

				if ($pun_user['idle'] == '1')

					$query['SET'] .= ', idle=0';

				($hook = get_hook('fn_qr_update_online_user')) ? eval($hook) : null;

				$pun_db->query_build($query) or error(__FILE__, __LINE__);

				// Update tracked topics with the current expire time

				if (isset($_COOKIE[$cookie_name.'_track']))

					pun_setcookie($cookie_name.'_track', $_COOKIE[$cookie_name.'_track'], time() + $pun_config['o_timeout_visit']);

			}

		}

		$pun_user['is_guest'] = false;

		$pun_user['is_admmod'] = $session->user_level >= USER_LEVEL_MOD || $pun_user['g_moderator'] == '1';

	}

	else

		set_default_user();

	($hook = get_hook('fn_cookie_login_end')) ? eval($hook) : null;

}

//

// Fill $pun_user with default values (for guests)

//

function set_default_user()

{

	global $pun_db, $db_type, $pun_user, $pun_config;

	($hook = get_hook('fn_set_default_user_start')) ? eval($hook) : null;

	$remote_addr = get_remote_address();

	// Fetch guest user

	$query = array(

		'SELECT'	=> 'u.*, g.*, o.logged, o.csrf_token, o.prev_url',

		'FROM'		=> 'users AS u',

		'JOINS'		=> array(

			array(

				'INNER JOIN'	=> 'groups AS g',

				'ON'			=> 'g.g_id=u.group_id'

			),

			array(

				'LEFT JOIN'		=> 'online AS o',

				'ON'			=> 'o.ident=\''.$remote_addr.'\''

			)

		),

		'WHERE'		=> 'u.id=1'

	);

	($hook = get_hook('fn_qr_get_default_user')) ? eval($hook) : null;

	$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

	if (!$pun_db->num_rows($result))

		exit('Unable to fetch guest information. The table \''.$pun_db->prefix.'users\' must contain an entry with id = 1 that represents anonymous users.');

	$pun_user = $pun_db->fetch_assoc($result);

	// Update online list

	if (!$pun_user['logged'])

	{

		$pun_user['logged'] = time();

		$pun_user['csrf_token'] = random_key(40, false, true);

		$pun_user['prev_url'] = get_current_url();

		// With MySQL/MySQLi/SQLite, REPLACE INTO avoids a user having two rows in the online table

		switch ($db_type)

		{

			case 'pgsql':

				$query = 'INSERT INTO '.$pun_db->prefix.'online (user_id, ident, logged, csrf_token, prev_url) SELECT 1, \''.$pun_db->escape($remote_addr).'\', '.$pun_user['logged'].', \''.$pun_user['csrf_token'].'\', \''.$pun_db->escape($pun_user['prev_url']).'\' FROM '.$pun_db->prefix.'users WHERE id=1 AND NOT EXISTS (SELECT 1 FROM '.$pun_db->prefix.'online WHERE user_id=1 AND ident=\''.$pun_db->escape($remote_addr).'\')';

				($hook = get_hook('fn_qr_add_online_guest_user')) ? eval($hook) : null;

				$pun_db->query($query) or error(__FILE__, __LINE__);

				break;

			default:

				$query = array(

					'REPLACE'	=> 'user_id, ident, logged, csrf_token, prev_url',

					'INTO'		=> 'online',

					'VALUES'	=> '1, \''.$pun_db->escape($remote_addr).'\', '.$pun_user['logged'].', \''.$pun_user['csrf_token'].'\', \''.$pun_db->escape($pun_user['prev_url']).'\''

				);

				($hook = get_hook('fn_qr_add_online_guest_user')) ? eval($hook) : null;

				$pun_db->query_build($query) or error(__FILE__, __LINE__);

				break;

		}

	}

	else

	{

		$query = array(

			'UPDATE'	=> 'online',

			'SET'		=> 'logged='.time().', prev_url=\''.$pun_db->escape(get_current_url()).'\'',

			'WHERE'		=> 'ident=\''.$pun_db->escape($remote_addr).'\''

		);

		($hook = get_hook('fn_qr_update_online_guest_user')) ? eval($hook) : null;

		$pun_db->query_build($query) or error(__FILE__, __LINE__);

	}

	$pun_user['disp_topics'] = $pun_config['o_disp_topics_default'];

	$pun_user['disp_posts'] = $pun_config['o_disp_posts_default'];

	$pun_user['timezone'] = $pun_config['o_default_timezone'];

	$pun_user['language'] = $pun_config['o_default_lang'];

	$pun_user['style'] = $pun_config['o_default_style'];

	$pun_user['is_guest'] = true;

	$pun_user['is_admmod'] = false;

}

//

// Set a cookie, PunBB style!

//

function pun_setcookie($name, $value, $expire)

{

	global $cookie_path, $cookie_domain, $cookie_secure;

	($hook = get_hook('fn_pun_setcookie_start')) ? eval($hook) : null;

	// Enable sending of a P3P header by removing // from the following line (try this if login is failing in IE6)

//	@header('P3P: CP="CUR ADM"');

	if (version_compare(PHP_VERSION, '5.2.0', '>='))

		setcookie($name, $value, $expire, $cookie_path, $cookie_domain, $cookie_secure, true);

	else

		setcookie($name, $value, $expire, $cookie_path.'; HttpOnly', $cookie_domain, $cookie_secure);

}

//

// Check whether the connecting user is banned (and delete any expired bans while we're at it)

//

function check_bans()

{

	global $pun_db, $pun_config, $lang_common, $pun_user, $pun_bans;

  // import Enano globals

	global $db, $session, $paths, $template, $plugins; // Common objects

	($hook = get_hook('fn_check_bans_start')) ? eval($hook) : null;

	// Admins aren't affected

	if (defined('PUN_ADMIN') && $session->user_level >= USER_LEVEL_ADMIN || !$pun_bans)

		return;

	// Add a dot at the end of the IP address to prevent banned address 192.168.0.5 from matching e.g. 192.168.0.50

	$user_ip = get_remote_address().'.';

	$bans_altered = false;

	foreach ($pun_bans as $cur_ban)

	{

		// Has this ban expired?

		if ($cur_ban['expire'] != '' && $cur_ban['expire'] <= time())

		{

			$query = array(

				'DELETE'	=> 'bans',

				'WHERE'		=> 'id='.$cur_ban['id']

			);

			($hook = get_hook('fn_qr_delete_expired_ban')) ? eval($hook) : null;

			$pun_db->query_build($query) or error(__FILE__, __LINE__);

			$bans_altered = true;

			continue;

		}

		if ($cur_ban['username'] != '' && strtolower($pun_user['username']) == strtolower($cur_ban['username']))

		{

			$query = array(

				'DELETE'	=> 'online',

				'WHERE'		=> 'ident=\''.$pun_db->escape($pun_user['username']).'\''

			);

			($hook = get_hook('fn_qr_delete_online_user')) ? eval($hook) : null;

			$pun_db->query_build($query) or error(__FILE__, __LINE__);

			message($lang_common['Ban message'].' '.(($cur_ban['expire'] != '') ? sprintf($lang_common['Ban message 2'], strtolower(format_time($cur_ban['expire'], true))) : '').(($cur_ban['message'] != '') ? ' '.$lang_common['Ban message 3'].'<br /><br /><strong>'.htmlspecialchars($cur_ban['message']).'</strong><br /><br />' : '<br /><br />').sprintf($lang_common['Ban message 4'], '<a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>'), true);

		}

		if ($cur_ban['ip'] != '')

		{

			$cur_ban_ips = explode(' ', $cur_ban['ip']);

			$num_ips = count($cur_ban_ips);

			for ($i = 0; $i < $num_ips; ++$i)

			{

				$cur_ban_ips[$i] = $cur_ban_ips[$i].'.';

				if (substr($user_ip, 0, strlen($cur_ban_ips[$i])) == $cur_ban_ips[$i])

				{

					$query = array(

						'DELETE'	=> 'online',

						'WHERE'		=> 'ident=\''.$pun_db->escape($pun_user['username']).'\''

					);

					($hook = get_hook('fn_qr_delete_online_user2')) ? eval($hook) : null;

					$pun_db->query_build($query) or error(__FILE__, __LINE__);

					message($lang_common['Ban message'].' '.(($cur_ban['expire'] != '') ? sprintf($lang_common['Ban message 2'], strtolower(format_time($cur_ban['expire'], true))) : '').(($cur_ban['message'] != '') ? ' '.$lang_common['Ban message 3'].'<br /><br /><strong>'.htmlspecialchars($cur_ban['message']).'</strong><br /><br />' : '<br /><br />').sprintf($lang_common['Ban message 4'], '<a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>'), true);

				}

			}

		}

	}

	// If we removed any expired bans during our run-through, we need to regenerate the bans cache

	if ($bans_altered)

	{

		require_once PUN_ROOT.'include/cache.php';

		generate_bans_cache();

	}

}

//

// Update "Users online"

//

function update_users_online()

{

	global $pun_db, $pun_config, $pun_user;

	$now = time();

	($hook = get_hook('fn_update_users_online_start')) ? eval($hook) : null;

	// Fetch all online list entries that are older than "o_timeout_online"

	$query = array(

		'SELECT'	=> 'o.*',

		'FROM'		=> 'online AS o',

		'WHERE'		=> 'o.logged<'.($now-$pun_config['o_timeout_online'])

	);

	($hook = get_hook('fn_qr_get_old_online_users')) ? eval($hook) : null;

	$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

	while ($cur_user = $pun_db->fetch_assoc($result))

	{

		// If the entry is a guest, delete it

		if ($cur_user['user_id'] == '1')

		{

			$query = array(

				'DELETE'	=> 'online',

				'WHERE'		=> 'ident=\''.$pun_db->escape($cur_user['ident']).'\''

			);

			($hook = get_hook('fn_qr_delete_online_guest_user')) ? eval($hook) : null;

			$pun_db->query_build($query) or error(__FILE__, __LINE__);

		}

		else

		{

			// If the entry is older than "o_timeout_visit", update last_visit for the user in question, then delete him/her from the online list

			if ($cur_user['logged'] < ($now-$pun_config['o_timeout_visit']))

			{

				$query = array(

					'UPDATE'	=> 'users',

					'SET'		=> 'last_visit='.$cur_user['logged'],

					'WHERE'		=> 'id='.$cur_user['user_id']

				);

				($hook = get_hook('fn_qr_update_user_visit2')) ? eval($hook) : null;

				$pun_db->query_build($query) or error(__FILE__, __LINE__);

				$query = array(

					'DELETE'	=> 'online',

					'WHERE'		=> 'user_id='.$cur_user['user_id']

				);

				($hook = get_hook('fn_qr_delete_online_user3')) ? eval($hook) : null;

				$pun_db->query_build($query) or error(__FILE__, __LINE__);

			}

			else if ($cur_user['idle'] == '0')

			{

				$query = array(

					'UPDATE'	=> 'online',

					'SET'		=> 'idle=1',

					'WHERE'		=> 'user_id='.$cur_user['user_id']

				);

				($hook = get_hook('fn_qr_update_online_user2')) ? eval($hook) : null;

				$pun_db->query_build($query) or error(__FILE__, __LINE__);

			}

		}

	}

	($hook = get_hook('fn_update_users_online_end')) ? eval($hook) : null;

}

//

// Generate the "navigator" that appears at the top of every page

//

function generate_navlinks()

{

	global $pun_config, $lang_common, $pun_url, $pun_user;

	// Index should always be displayed

	$links[] = '<li id="navindex"'.((PUN_PAGE == 'index') ? ' class="isactive"' : '').'><a href="'.pun_link($pun_url['index']).'"><span>'.$lang_common['Index'].'</span></a></li>';

	if ($pun_user['g_view_users'] == '1')

		$links[] = '<li id="navuserlist"'.((PUN_PAGE == 'userlist') ? ' class="isactive"' : '').'><a href="'.pun_link($pun_url['users']).'"><span>'.$lang_common['User list'].'</span></a></li>';

	if ($pun_config['o_rules'] == '1')

		$links[] = '<li id="navrules"'.((PUN_PAGE == 'rules') ? ' class="isactive"' : '').'><a href="'.pun_link($pun_url['rules']).'"><span>'.$lang_common['Rules'].'</span></a></li>';