<?php

/***********************************************************************

  Copyright (C) 2002-2008  PunBB.org

  This file is part of PunBB.

  PunBB is free software; you can redistribute it and/or modify it

  under the terms of the GNU General Public License as published

  by the Free Software Foundation; either version 2 of the License,

  or (at your option) any later version.

  PunBB is distributed in the hope that it will be useful, but

  WITHOUT ANY WARRANTY; without even the implied warranty of

  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

  GNU General Public License for more details.

  You should have received a copy of the GNU General Public License

  along with this program; if not, write to the Free Software

  Foundation, Inc., 59 Temple Place, Suite 330, Boston,

  MA  02111-1307  USA

************************************************************************/

// if (!defined('PUN_ROOT'))

// 	define('PUN_ROOT', './');

// require PUN_ROOT.'include/common.php';

// import globals (I really hope this isn't dangerous)

foreach ( $GLOBALS as $key => $_ )

{

  $$key =& $GLOBALS[$key];

}

($hook = get_hook('se_start')) ? eval($hook) : null;

// Load the search.php language file

require PUN_ROOT.'lang/'.$pun_user['language'].'/search.php';

if ($pun_user['g_read_board'] == '0')

	message($lang_common['No view']);

else if ($pun_user['g_search'] == '0')

	message($lang_search['No search permission']);

// Figure out what to do :-)

if (isset($_GET['action']) || isset($_GET['search_id']))

{

	// Grab and validate all the submitted data

	$action = (isset($_GET['action'])) ? $_GET['action'] : null;

	$value = (isset($_GET['value'])) ? intval($_GET['value']) : 86400;

	$forum = (isset($_GET['forum'])) ? intval($_GET['forum']) : -1;

	$sort_dir = (isset($_GET['sort_dir'])) ? (($_GET['sort_dir'] == 'DESC') ? 'DESC' : 'ASC') : 'DESC';

	if (isset($search_id)) unset($search_id);

	// If a search_id was supplied

	if (isset($_GET['search_id']))

	{

		$search_id = intval($_GET['search_id']);

		if ($db_type == 'mysql' || $db_type == 'mysqli')

			message($lang_common['Bad request']);

		if ($search_id < 1)

			message($lang_common['Bad request']);

	}

	// A list of valid actions (extensions can add their own actions to the array)

	$valid_actions = array('search', 'show_new', 'show_recent', 'show_user_posts', 'show_user_topics', 'show_subscriptions', 'show_unanswered');

	($hook = get_hook('se_search_selected')) ? eval($hook) : null;

	// Validate action

	if ($action && !in_array($action, $valid_actions))

		message($lang_common['Bad request']);

	// If it's a regular search (keywords and/or author)

	if ($action == 'search')

	{

		$keywords = (isset($_GET['keywords'])) ? strtolower(trim($_GET['keywords'])) : null;

		$author = (isset($_GET['author'])) ? strtolower(trim($_GET['author'])) : null;

		if (preg_match('#^[\*%]+$#', $keywords) || pun_strlen(str_replace(array('*', '%'), '', $keywords)) < 3)

			$keywords = '';

		if (preg_match('#^[\*%]+$#', $author) || pun_strlen(str_replace(array('*', '%'), '', $author)) < 2)

			$author = '';

		if (!$keywords && !$author)

			message($lang_search['No terms']);

		if ($author)

			$author = str_replace('*', '%', $author);

		$show_as = (isset($_GET['show_as'])) ? $_GET['show_as'] : 'posts';

		$sort_by = (isset($_GET['sort_by'])) ? intval($_GET['sort_by']) : null;

		$search_in = (!isset($_GET['search_in']) || $_GET['search_in'] == 'all') ? 0 : (($_GET['search_in'] == 'message') ? 1 : -1);

	}

	// If it's a user search (by id), make sure we have a user_id

	else if ($action == 'show_user_posts' || $action == 'show_user_topics')

	{

		$user_id = isset($_GET['user_id']) ? intval($_GET['user_id']) : 0;

		if ($user_id < 2)

			message($lang_common['Bad request']);

	}

	// First of all lets find out if we need to cache the results, we only need to do this for detailed queries, not quicksearches or for mysql(i)

	if ($db_type != 'mysql' && $db_type != 'mysqli' && (isset($keywords) || isset($author)))

	{

		// We need to grab results, insert them into the cache and reload with a search id before showing them

		$keyword_results = $author_results = array();

		// If it's a search for keywords

		if ($keywords)

		{

			$stopwords = (array)@file(PUN_ROOT.'lang/'.$pun_user['language'].'/stopwords.txt');

			$stopwords = array_map('trim', $stopwords);

			// Filter out non-alphabetical chars

			$noise_match = array('^', '$', '&', '(', ')', '<', '>', '`', '\'', '"', '|', ',', '@', '_', '?', '%', '~', '[', ']', '{', '}', ':', '\\', '/', '=', '#', '\'', ';', '!', '¤');

			$noise_replace = array(' ', ' ', ' ', ' ', ' ', ' ', ' ', '',  '',   ' ', ' ', ' ', ' ', '',  ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '' ,  ' ', ' ', ' ', ' ',  ' ', ' ', ' ');

			$keywords = str_replace($noise_match, $noise_replace, $keywords);

			// Strip out excessive whitespace

			$keywords = trim(preg_replace('#\s+#', ' ', $keywords));

			// Fill an array with all the words

			$keywords_array = explode(' ', $keywords);

			if (empty($keywords_array))

				message($lang_search['No hits']);

			while (list($i, $word) = @each($keywords_array))

			{

				$num_chars = pun_strlen($word);

				if ($word !== 'or' && ($num_chars < 3 || $num_chars > 20 || in_array($word, $stopwords)))

					unset($keywords_array[$i]);

			}

			$word_count = 0;

			$match_type = 'and';

			$result_list = array();

			@reset($keywords_array);

			while (list(, $cur_word) = @each($keywords_array))

			{

				switch ($cur_word)

				{

					case 'and':

					case 'or':

					case 'not':

						$match_type = $cur_word;

						break;

					default:

					{

						$cur_word = str_replace('*', '%', $cur_word);

						$query = array(

							'SELECT'	=> 'm.post_id',

							'FROM'		=> 'search_words AS w',

							'JOINS'		=> array(

								array(

									'INNER JOIN'	=> 'search_matches AS m',

									'ON'			=> 'm.word_id=w.id'

								)

							),

							'WHERE'		=> 'w.word LIKE \''.$cur_word.'\''

						);

						// Search in what?

						if ($search_in)

							$query['WHERE'] .= ($search_in > 0 ? ' AND m.subject_match=0' : ' AND m.subject_match=1');

						($hook = get_hook('se_qr_get_keyword_hits')) ? eval($hook) : null;

						$result = $pun_db->query_build($query, true) or error(__FILE__, __LINE__);

						$row = array();

						while ($temp = $pun_db->fetch_row($result))

						{

							$row[$temp[0]] = 1;

							if (!$word_count)

								$result_list[$temp[0]] = 1;

							else if ($match_type == 'or')

								$result_list[$temp[0]] = 1;

							else if ($match_type == 'not')

								$result_list[$temp[0]] = 0;

						}

						if ($match_type == 'and' && $word_count)

						{

							@reset($result_list);

							while (list($post_id,) = @each($result_list))

							{

								if (!isset($row[$post_id]))

									$result_list[$post_id] = 0;

							}

						}

						++$word_count;

						$pun_db->free_result($result);

						break;

					}

				}

			}

			@reset($result_list);

			while (list($post_id, $matches) = @each($result_list))

			{

				if ($matches)

					$keyword_results[] = $post_id;

			}

			unset($result_list);

		}

		// If it's a search for author name (and that author name isn't Guest)

		if ($author && strtolower($author) != 'guest' && strtolower($author) != strtolower($lang_common['Guest']))

		{

			$query = array(

				'SELECT'	=> 'u.id',

				'FROM'		=> 'users AS u',

				'WHERE'		=> 'u.username '.($db_type == 'pgsql' ? 'ILIKE' : 'LIKE').' \''.$pun_db->escape($author).'\''

			);

			($hook = get_hook('se_qr_get_author')) ? eval($hook) : null;

			$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

			if ($pun_db->num_rows($result))

			{

				$user_ids = '';

				while ($row = $pun_db->fetch_row($result))

					$user_ids .= (($user_ids != '') ? ',' : '').$row[0];

				$query = array(

					'SELECT'	=> 'p.id',

					'FROM'		=> 'posts AS p',

					'WHERE'		=> 'p.poster_id IN('.$user_ids.')'

				);

				($hook = get_hook('se_qr_get_author_hits')) ? eval($hook) : null;

				$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

				$search_ids = array();

				while ($row = $pun_db->fetch_row($result))

					$author_results[] = $row[0];

				$pun_db->free_result($result);

			}

		}

		if ($author && $keywords)

		{

			// If we searched for both keywords and author name we want the intersection between the results

			$search_ids = array_intersect($keyword_results, $author_results);

			unset($keyword_results, $author_results);

		}

		else if ($keywords)

			$search_ids = $keyword_results;

		else

			$search_ids = $author_results;

		if (count($search_ids) == 0)

			message($lang_search['No hits']);

		// Setup the default show_as topics search

		$query = array(

			'SELECT'	=> 't.id',

			'FROM'		=> 'posts AS p',

			'JOINS'		=> array(

				array(

					'INNER JOIN'	=> 'topics AS t',

					'ON'			=> 't.id=p.topic_id'

				),

				array(

					'LEFT JOIN'		=> 'forum_perms AS fp',

					'ON'			=> '(fp.forum_id=t.forum_id AND fp.group_id='.$pun_user['g_id'].')'

				)

			),

			'WHERE'		=> '(fp.read_forum IS NULL OR fp.read_forum=1) AND p.id IN('.implode(',', $search_ids).')',

			'GROUP BY'	=> 't.id'

		);

		// Search a specific forum?

		if ($forum != -1 || ($forum == -1 && $pun_config['o_search_all_forums'] == '0' && !$pun_user['is_admmod']))

			$query['WHERE'] .= ' AND t.forum_id = '.$forum;

		// Adjust the query if show_as posts

		if ($show_as == 'posts')

		{

			$query['SELECT'] = 'p.id';

			unset($query['GROUP BY']);

		}

		($hook = get_hook('se_qr_get_hits')) ? eval($hook) : null;

		$result = $pun_db->query_build($query, true) or error(__FILE__, __LINE__);

		$search_ids = array();

		while ($row = $pun_db->fetch_row($result))

			$search_ids[] = $row[0];

		// Prune "old" search results

		$query = array(

			'SELECT'	=> 'o.ident',

			'FROM'		=> 'online AS o'

		);

		($hook = get_hook('se_qr_get_online_idents')) ? eval($hook) : null;

		$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

		if ($pun_db->num_rows($result))

		{

			$online_idents = array();

			while ($row = $pun_db->fetch_row($result))

				$online_idents[] = '\''.$pun_db->escape($row[0]).'\'';

			$query = array(

				'DELETE'	=> 'search_cache',

				'WHERE'		=> 'ident NOT IN('.implode(',', $online_idents).')'

			);

			($hook = get_hook('se_qr_delete_old_cached_searches')) ? eval($hook) : null;

			$pun_db->query_build($query) or error(__FILE__, __LINE__);

		}

		// Final search results

		$search_results = implode(',', $search_ids);

		// Fill an array with our results and search properties

		$temp['search_results'] = $search_results;

		$temp['sort_by'] = $sort_by;

		$temp['sort_dir'] = $sort_dir;

		$temp['show_as'] = $show_as;

		$temp = serialize($temp);

		$search_id = mt_rand(1, 2147483647);

		$ident = ($pun_user['is_guest']) ? get_remote_address() : $pun_user['username'];

		$query = array(

			'INSERT'	=> 'id, ident, search_data',

			'INTO'		=> 'search_cache',

			'VALUES'	=> $search_id.', \''.$pun_db->escape($ident).'\', \''.$pun_db->escape($temp).'\''

		);

		($hook = get_hook('se_qr_cache_search')) ? eval($hook) : null;

		$pun_db->query_build($query) or error(__FILE__, __LINE__);

		$pun_db->end_transaction();

		$pun_db->close();

		// Redirect the user to the cached result page

		header('Location: '.str_replace('&', '&', pun_link($pun_url['search_results'], $search_id)));

		exit;

	}

	// If we're still running we don't need to cache results but we still need to get them, either from the cache or from their respective sources.

	// We're doing a fulltext search!

	else if (($db_type == 'mysql' || $db_type == 'mysqli') && (isset($keywords) || isset($author)))

	{

		// Are we limiting the results to a specific forum?

		if ($forum != -1 || ($forum == -1 && $pun_config['o_search_all_forums'] == '0' && !$pun_user['is_admmod']))

			$forum_where = ' AND f.id = '.$forum;

		else

			$forum_where = '';

		// Sort out how to order the results

		switch ($sort_by)

		{

			case 1:

				$sort_by_sql = ($show_as == 'topics') ? 'poster' : 'p.poster';

				break;

			case 2:

				$sort_by_sql = 'subject';

				break;

			case 3:

				$sort_by_sql = 'forum_id';

				break;

			case 4:

				if ($show_as == 'posts')

					$sort_by_sql = 'MATCH(p.message) AGAINST(\''.$pun_db->escape($keywords).'\')';

				else

					$sort_by_sql = 'total_relevance';

				break;

			default:

				$sort_by_sql = ($show_as == 'topics') ? 'posted' : 'p.posted';

				break;

		}

		// Generate the query to give us our results

		if ($show_as == 'posts')

			$query = '

				SELECT

					p.id AS pid, p.poster AS pposter, p.posted AS pposted, p.poster_id, SUBSTRING(p.message, 1, 1000) AS message, t.id AS tid, t.poster, t.subject, t.first_post_id, t.posted, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.forum_id, f.forum_name

				FROM '.$pun_db->prefix.'posts AS p LEFT JOIN '.$pun_db->prefix.'topics AS t ON t.id=p.topic_id LEFT JOIN '.$pun_db->prefix.'forums AS f ON f.id=t.forum_id LEFT JOIN '.$pun_db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].')

				WHERE

					(fp.read_forum IS NULL OR fp.read_forum=1)

					'.($author ? 'AND p.poster LIKE \''.$pun_db->escape($author).'\'' : '').'

					'.($keywords ? 'AND MATCH(p.message) AGAINST(\''.$pun_db->escape($keywords).'\' IN BOOLEAN MODE)' : '').'

					'.$forum_where.'

				ORDER BY '.$sort_by_sql.' '.$sort_dir;

		else

		{

			$query = '

				SELECT

					*, SUM(relevance) AS total_relevance FROM

				(

					SELECT

						t.id AS tid, t.poster, t.subject, t.first_post_id, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id, t.posted, f.forum_name, MATCH(t.subject) AGAINST(\''.$pun_db->escape($keywords).'\') AS relevance

					FROM '.$pun_db->prefix.'topics AS t LEFT JOIN '.$pun_db->prefix.'forums AS f ON f.id=t.forum_id LEFT JOIN '.$pun_db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].')

					WHERE

						(fp.read_forum IS NULL OR fp.read_forum=1)

						'.($keywords ? 'AND MATCH(t.subject) AGAINST(\''.$pun_db->escape($keywords).'\' IN BOOLEAN MODE)' : '').'

						'.$forum_where.'

					UNION

					SELECT

						t.id AS tid, t.poster, t.subject, t.first_post_id, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id, t.posted, f.forum_name, MATCH(p.message) AGAINST(\''.$pun_db->escape($keywords).'\') AS relevance

					FROM '.$pun_db->prefix.'posts AS p INNER JOIN '.$pun_db->prefix.'topics AS t ON p.topic_id = t.id LEFT JOIN '.$pun_db->prefix.'forums AS f ON f.id=t.forum_id LEFT JOIN '.$pun_db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].')

					WHERE

						(fp.read_forum IS NULL OR fp.read_forum=1)

						'.($author ? 'AND p.poster LIKE \''.$pun_db->escape($author).'\'' : '').'

						'.($keywords ? 'AND MATCH(p.message) AGAINST(\''.$pun_db->escape($keywords).'\' IN BOOLEAN MODE)' : '').'

						'.$forum_where.'

				) AS tmp

				GROUP BY tid

				ORDER BY '.$sort_by_sql.' '.$sort_dir;

		}

		$url_type = $pun_url['search_resultft'];

		$search_id = array($keywords, $forum, $author, ($search_in == 0 ) ? 'all' : (($search_in == 1) ? 'message' : 'subject'), $sort_by, $sort_dir, $show_as);

	}

	// We aren't doing a fulltext but we are getting results, if a valid search_id was supplied we attempt to fetch the search results from the cache

	else if (isset($search_id))

	{

		$ident = ($pun_user['is_guest']) ? get_remote_address() : $pun_user['username'];

		$query = array(

			'SELECT'	=> 'sc.search_data',

			'FROM'		=> 'search_cache AS sc',

			'WHERE'		=> 'sc.id='.$search_id.' AND sc.ident=\''.$pun_db->escape($ident).'\''

		);

		($hook = get_hook('se_qr_get_cached_search_data')) ? eval($hook) : null;

		$result = $pun_db->query_build($query) or error(__FILE__, __LINE__);

		if ($row = $pun_db->fetch_assoc($result))

		{

			$temp = unserialize($row['search_data']);

			$search_results = $temp['search_results'];

			$sort_by = $temp['sort_by'];

			$sort_dir = $temp['sort_dir'];

			$show_as = $temp['show_as'];

			unset($temp);

		}

		else

			message($lang_search['No hits']);

		switch ($sort_by)

		{

			case 1:

				$sort_by_sql = ($show_as == 'topics') ? 't.poster' : 'p.poster';

				break;

			case 2:

				$sort_by_sql = 't.subject';

				break;

			case 3:

				$sort_by_sql = 't.forum_id';

				break;

			default:

				$sort_by_sql = ($show_as == 'topics') ? 't.posted' : 'p.posted';

				break;

		}

		if ($show_as == 'posts')

		{

			$query = array(

				'SELECT'	=> 'p.id AS pid, p.poster AS pposter, p.posted AS pposted, p.poster_id, '.(($db_type != 'sqlite') ? 'SUBSTRING' : 'SUBSTR').'(p.message, 1, 1000) AS message, t.id AS tid, t.poster, t.subject, t.first_post_id, t.posted, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.forum_id, f.forum_name',

				'FROM'		=> 'posts AS p',

				'JOINS'		=> array(

					array(

						'INNER JOIN'	=> 'topics AS t',

						'ON'			=> 't.id=p.topic_id'

					),

					array(

						'INNER JOIN'	=> 'forums AS f',

						'ON'			=> 'f.id=t.forum_id'

					)

				),

				'WHERE'		=> 'p.id IN('.$search_results.')',

				'ORDER BY'	=> $sort_by_sql

			);

			($hook = get_hook('se_qr_get_cached_hits_as_posts')) ? eval($hook) : null;

		}

		else

		{

			$query = array(

				'SELECT'	=> 't.id AS tid, t.poster, t.subject, t.first_post_id, t.posted, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id, f.forum_name',

				'FROM'		=> 'topics AS t',

				'JOINS'		=> array(

					array(

						'INNER JOIN'	=> 'forums AS f',

						'ON'			=> 'f.id=t.forum_id'

					)

				),

				'WHERE'		=> 't.id IN('.$search_results.')',

				'ORDER BY'	=> 'p.id, '.$sort_by_sql

			);

			($hook = get_hook('se_qr_get_cached_hits_as_topics')) ? eval($hook) : null;

		}

		$url_type = $pun_url['search_results'];

	}

	else if (in_array($action, $valid_actions))

	{

		$search_id = '';

		$show_as = 'topics';