punbb/misc.php
author Dan
Thu, 12 Jul 2007 01:04:01 -0400
changeset 2 a8a21e1c7afa
parent 0 f9ffdbd96607
permissions -rw-r--r--
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
     1
<?php
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
     2
/***********************************************************************
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
     3
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
     4
  Copyright (C) 2002-2005  Rickard Andersson (rickard@punbb.org)
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
     5
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
     6
  This file is part of PunBB.
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
     7
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
     8
  PunBB is free software; you can redistribute it and/or modify it
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
     9
  under the terms of the GNU General Public License as published
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    10
  by the Free Software Foundation; either version 2 of the License,
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    11
  or (at your option) any later version.
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    12
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    13
  PunBB is distributed in the hope that it will be useful, but
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    14
  WITHOUT ANY WARRANTY; without even the implied warranty of
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    15
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    16
  GNU General Public License for more details.
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    17
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    18
  You should have received a copy of the GNU General Public License
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    19
  along with this program; if not, write to the Free Software
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    20
  Foundation, Inc., 59 Temple Place, Suite 330, Boston,
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    21
  MA  02111-1307  USA
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    22
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    23
************************************************************************/
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    24
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    25
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    26
if (isset($_GET['action']))
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    27
	define('PUN_QUIET_VISIT', 1);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    28
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    29
//define('PUN_ROOT', './');
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    30
//require PUN_ROOT.'include/common.php';
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    31
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    32
global $pun_db, $pun_user, $pun_config, $lang_common;
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    33
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    34
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    35
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    36
// Load the misc.php language file
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    37
require PUN_ROOT.'lang/'.$pun_user['language'].'/misc.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    38
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    39
$action = isset($_GET['action']) ? $_GET['action'] : null;
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    40
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    41
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    42
if ($action == 'rules')
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    43
{
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    44
	// Load the register.php language file
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    45
	require PUN_ROOT.'lang/'.$pun_user['language'].'/register.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    46
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    47
	$page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_register['Forum rules'];
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    48
	require PUN_ROOT.'header.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    49
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    50
?>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    51
<div class="block">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    52
	<h2><span><?php echo $lang_register['Forum rules'] ?></span></h2>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    53
	<div class="box">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    54
		<div class="inbox">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    55
			<p><?php echo $pun_config['o_rules_message'] ?></p>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    56
		</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    57
	</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    58
</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    59
<?php
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    60
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    61
	require PUN_ROOT.'footer.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    62
}
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    63
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    64
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    65
else if ($action == 'markread')
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    66
{
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    67
	if ($pun_user['is_guest'])
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    68
		message($lang_common['No permission']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    69
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    70
	$pun_db->query('UPDATE '.$pun_db->prefix.'users SET last_visit='.$pun_user['logged'].' WHERE id='.$pun_user['id']) or error('Unable to update user last visit data', __FILE__, __LINE__, $pun_db->error());
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    71
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    72
	pun_redirect('index.php', $lang_misc['Mark read redirect']);
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    73
}
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    74
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    75
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    76
else if (isset($_GET['email']))
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    77
{
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    78
	if ($pun_user['is_guest'])
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    79
		message($lang_common['No permission']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    80
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    81
	$recipient_id = intval($_GET['email']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    82
	if ($recipient_id < 2)
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    83
		message($lang_common['Bad request']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    84
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    85
	$result = $pun_db->query('SELECT username, email, email_setting FROM '.$pun_db->prefix.'users WHERE id='.$recipient_id) or error('Unable to fetch user info', __FILE__, __LINE__, $pun_db->error());
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    86
	if (!$pun_db->num_rows($result))
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    87
		message($lang_common['Bad request']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    88
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    89
	list($recipient, $recipient_email, $email_setting) = $pun_db->fetch_row($result);
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    90
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
    91
	if ($email_setting == 2 && $pun_user['g_id'] < PUN_MOD)
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    92
		message($lang_misc['Form e-mail disabled']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    93
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    94
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    95
	if (isset($_POST['form_sent']))
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    96
	{
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    97
		// Clean up message and subject from POST
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    98
		$subject = pun_trim($_POST['req_subject']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
    99
		$message = pun_trim($_POST['req_message']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   100
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   101
		if ($subject == '')
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   102
			message($lang_misc['No e-mail subject']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   103
		else if ($message == '')
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   104
			message($lang_misc['No e-mail message']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   105
		else if (strlen($message) > 65535)
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   106
			message($lang_misc['Too long e-mail message']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   107
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   108
		// Load the "form e-mail" template
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   109
		$mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$pun_user['language'].'/mail_templates/form_email.tpl'));
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   110
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   111
		// The first row contains the subject
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   112
		$first_crlf = strpos($mail_tpl, "\n");
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   113
		$mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8));
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   114
		$mail_message = trim(substr($mail_tpl, $first_crlf));
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   115
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   116
		$mail_subject = str_replace('<mail_subject>', $subject, $mail_subject);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   117
		$mail_message = str_replace('<sender>', $pun_user['username'], $mail_message);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   118
		$mail_message = str_replace('<board_title>', $pun_config['o_board_title'], $mail_message);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   119
		$mail_message = str_replace('<mail_message>', $message, $mail_message);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   120
		$mail_message = str_replace('<board_mailer>', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   121
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   122
		require_once PUN_ROOT.'include/email.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   123
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   124
		pun_mail($recipient_email, $mail_subject, $mail_message, '"'.str_replace('"', '', $pun_user['username']).'" <'.$pun_user['email'].'>');
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   125
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   126
		pun_redirect(htmlspecialchars($_POST['redirect_url']), $lang_misc['E-mail sent redirect']);
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   127
	}
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   128
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   129
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   130
	// Try to determine if the data in HTTP_REFERER is valid (if not, we redirect to the users profile after the e-mail is sent)
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   131
	$redirect_url = (isset($_SERVER['HTTP_REFERER']) && preg_match('#^'.preg_quote($pun_config['o_base_url']).'/(.*?)\.php#i', $_SERVER['HTTP_REFERER'])) ? htmlspecialchars($_SERVER['HTTP_REFERER']) : 'index.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   132
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   133
	$page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_misc['Send e-mail to'].' '.pun_htmlspecialchars($recipient);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   134
	$required_fields = array('req_subject' => $lang_misc['E-mail subject'], 'req_message' => $lang_misc['E-mail message']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   135
	$focus_element = array('email', 'req_subject');
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   136
	require PUN_ROOT.'header.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   137
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   138
?>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   139
<div class="blockform">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   140
	<h2><span><?php echo $lang_misc['Send e-mail to'] ?> <?php echo pun_htmlspecialchars($recipient) ?></span></h2>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   141
	<div class="box">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   142
		<form id="email" method="post" action="misc.php?email=<?php echo $recipient_id ?>" onsubmit="this.submit.disabled=true;if(process_form(this)){return true;}else{this.submit.disabled=false;return false;}">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   143
			<div class="inform">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   144
				<fieldset>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   145
					<legend><?php echo $lang_misc['Write e-mail'] ?></legend>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   146
					<div class="infldset txtarea">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   147
						<input type="hidden" name="form_sent" value="1" />
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   148
						<input type="hidden" name="redirect_url" value="<?php echo $redirect_url ?>" />
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   149
						<label><strong><?php echo $lang_misc['E-mail subject'] ?></strong><br />
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   150
						<input class="longinput" type="text" name="req_subject" size="75" maxlength="70" tabindex="1" /><br /></label>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   151
						<label><strong><?php echo $lang_misc['E-mail message'] ?></strong><br />
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   152
						<textarea name="req_message" rows="10" cols="75" tabindex="2"></textarea><br /></label>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   153
						<p><?php echo $lang_misc['E-mail disclosure note'] ?></p>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   154
					</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   155
				</fieldset>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   156
			</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   157
			<p><input type="submit" name="submit" value="<?php echo $lang_common['Submit'] ?>" tabindex="3" accesskey="s" /><a href="javascript:history.go(-1)"><?php echo $lang_common['Go back'] ?></a></p>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   158
		</form>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   159
	</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   160
</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   161
<?php
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   162
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   163
	require PUN_ROOT.'footer.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   164
}
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   165
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   166
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   167
else if (isset($_GET['report']))
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   168
{
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   169
	if ($pun_user['is_guest'])
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   170
		message($lang_common['No permission']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   171
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   172
	$post_id = intval($_GET['report']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   173
	if ($post_id < 1)
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   174
		message($lang_common['Bad request']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   175
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   176
	if (isset($_POST['form_sent']))
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   177
	{
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   178
		// Clean up reason from POST
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   179
		$reason = pun_linebreaks(pun_trim($_POST['req_reason']));
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   180
		if ($reason == '')
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   181
			message($lang_misc['No reason']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   182
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   183
		// Get the topic ID
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   184
		$result = $pun_db->query('SELECT topic_id FROM '.$pun_db->prefix.'posts WHERE id='.$post_id) or error('Unable to fetch post info', __FILE__, __LINE__, $pun_db->error());
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   185
		if (!$pun_db->num_rows($result))
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   186
			message($lang_common['Bad request']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   187
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   188
		$topic_id = $pun_db->result($result);
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   189
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   190
		// Get the subject and forum ID
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   191
		$result = $pun_db->query('SELECT subject, forum_id FROM '.$pun_db->prefix.'topics WHERE id='.$topic_id) or error('Unable to fetch topic info', __FILE__, __LINE__, $pun_db->error());
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   192
		if (!$pun_db->num_rows($result))
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   193
			message($lang_common['Bad request']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   194
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   195
		list($subject, $forum_id) = $pun_db->fetch_row($result);
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   196
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   197
		// Should we use the internal report handling?
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   198
		if ($pun_config['o_report_method'] == 0 || $pun_config['o_report_method'] == 2)
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   199
			$pun_db->query('INSERT INTO '.$pun_db->prefix.'reports (post_id, topic_id, forum_id, reported_by, created, message) VALUES('.$post_id.', '.$topic_id.', '.$forum_id.', '.$pun_user['id'].', '.time().', \''.$pun_db->escape($reason).'\')' ) or error('Unable to create report', __FILE__, __LINE__, $pun_db->error());
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   200
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   201
		// Should we e-mail the report?
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   202
		if ($pun_config['o_report_method'] == 1 || $pun_config['o_report_method'] == 2)
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   203
		{
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   204
			// We send it to the complete mailing-list in one swoop
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   205
			if ($pun_config['o_mailing_list'] != '')
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   206
			{
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   207
				$mail_subject = 'Report('.$forum_id.') - \''.$subject.'\'';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   208
				$mail_message = 'User \''.$pun_user['username'].'\' has reported the following message:'."\n".$pun_config['o_base_url'].'/viewtopic.php?pid='.$post_id.'#p'.$post_id."\n\n".'Reason:'."\n".$reason;
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   209
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   210
				require PUN_ROOT.'include/email.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   211
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   212
				pun_mail($pun_config['o_mailing_list'], $mail_subject, $mail_message);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   213
			}
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   214
		}
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   215
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   216
		pun_redirect('viewtopic.php?pid='.$post_id.'#p'.$post_id, $lang_misc['Report redirect']);
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   217
	}
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   218
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   219
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   220
	$page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_misc['Report post'];
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   221
	$required_fields = array('req_reason' => $lang_misc['Reason']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   222
	$focus_element = array('report', 'req_reason');
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   223
	require PUN_ROOT.'header.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   224
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   225
?>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   226
<div class="blockform">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   227
	<h2><span><?php echo $lang_misc['Report post'] ?></span></h2>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   228
	<div class="box">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   229
		<form id="report" method="post" action="misc.php?report=<?php echo $post_id ?>" onsubmit="this.submit.disabled=true;if(process_form(this)){return true;}else{this.submit.disabled=false;return false;}">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   230
			<div class="inform">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   231
				<fieldset>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   232
					<legend><?php echo $lang_misc['Reason desc'] ?></legend>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   233
					<div class="infldset txtarea">
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   234
						<input type="hidden" name="form_sent" value="1" />
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   235
						<label><strong><?php echo $lang_misc['Reason'] ?></strong><br /><textarea name="req_reason" rows="5" cols="60"></textarea><br /></label>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   236
					</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   237
				</fieldset>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   238
			</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   239
			<p><input type="submit" name="submit" value="<?php echo $lang_common['Submit'] ?>" accesskey="s" /><a href="javascript:history.go(-1)"><?php echo $lang_common['Go back'] ?></a></p>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   240
		</form>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   241
	</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   242
</div>
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   243
<?php
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   244
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   245
	require PUN_ROOT.'footer.php';
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   246
}
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   247
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   248
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   249
else if (isset($_GET['subscribe']))
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   250
{
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   251
	if ($pun_user['is_guest'] || $pun_config['o_subscriptions'] != '1')
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   252
		message($lang_common['No permission']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   253
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   254
	$topic_id = intval($_GET['subscribe']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   255
	if ($topic_id < 1)
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   256
		message($lang_common['Bad request']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   257
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   258
	$result = $pun_db->query('SELECT 1 FROM '.$pun_db->prefix.'subscriptions WHERE user_id='.$pun_user['id'].' AND topic_id='.$topic_id) or error('Unable to fetch subscription info', __FILE__, __LINE__, $pun_db->error());
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   259
	if ($pun_db->num_rows($result))
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   260
		message($lang_misc['Already subscribed']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   261
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   262
	$pun_db->query('INSERT INTO '.$pun_db->prefix.'subscriptions (user_id, topic_id) VALUES('.$pun_user['id'].' ,'.$topic_id.')') or error('Unable to add subscription', __FILE__, __LINE__, $pun_db->error());
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   263
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   264
	pun_redirect('viewtopic.php?id='.$topic_id, $lang_misc['Subscribe redirect']);
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   265
}
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   266
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   267
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   268
else if (isset($_GET['unsubscribe']))
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   269
{
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   270
	if ($pun_user['is_guest'] || $pun_config['o_subscriptions'] != '1')
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   271
		message($lang_common['No permission']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   272
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   273
	$topic_id = intval($_GET['unsubscribe']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   274
	if ($topic_id < 1)
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   275
		message($lang_common['Bad request']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   276
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   277
	$result = $pun_db->query('SELECT 1 FROM '.$pun_db->prefix.'subscriptions WHERE user_id='.$pun_user['id'].' AND topic_id='.$topic_id) or error('Unable to fetch subscription info', __FILE__, __LINE__, $pun_db->error());
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   278
	if (!$pun_db->num_rows($result))
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   279
		message($lang_misc['Not subscribed']);
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   280
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   281
	$pun_db->query('DELETE FROM '.$pun_db->prefix.'subscriptions WHERE user_id='.$pun_user['id'].' AND topic_id='.$topic_id) or error('Unable to remove subscription', __FILE__, __LINE__, $pun_db->error());
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   282
2
a8a21e1c7afa Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents: 0
diff changeset
   283
	pun_redirect('viewtopic.php?id='.$topic_id, $lang_misc['Unsubscribe redirect']);
0
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   284
}
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   285
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   286
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   287
else
f9ffdbd96607 Initial population
Dan
parents:
diff changeset
   288
	message($lang_common['Bad request']);