author | Dan |
Thu, 12 Jul 2007 15:00:35 -0400 | |
changeset 3 | c0c445d4a13e |
parent 2 | a8a21e1c7afa |
permissions | -rw-r--r-- |
0 | 1 |
<?php |
2 |
/*********************************************************************** |
|
3 |
||
4 |
Copyright (C) 2002-2005 Rickard Andersson (rickard@punbb.org) |
|
5 |
||
6 |
This file is part of PunBB. |
|
7 |
||
8 |
PunBB is free software; you can redistribute it and/or modify it |
|
9 |
under the terms of the GNU General Public License as published |
|
10 |
by the Free Software Foundation; either version 2 of the License, |
|
11 |
or (at your option) any later version. |
|
12 |
||
13 |
PunBB is distributed in the hope that it will be useful, but |
|
14 |
WITHOUT ANY WARRANTY; without even the implied warranty of |
|
15 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
16 |
GNU General Public License for more details. |
|
17 |
||
18 |
You should have received a copy of the GNU General Public License |
|
19 |
along with this program; if not, write to the Free Software |
|
20 |
Foundation, Inc., 59 Temple Place, Suite 330, Boston, |
|
21 |
MA 02111-1307 USA |
|
22 |
||
23 |
************************************************************************/ |
|
24 |
||
25 |
||
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
26 |
//define('PUN_ROOT', './'); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
27 |
//require PUN_ROOT.'include/common.php'; |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
28 |
|
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
29 |
global $pun_db, $pun_user, $pun_config, $lang_common; |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
30 |
|
0 | 31 |
|
32 |
||
33 |
if ($pun_user['g_read_board'] == '0') |
|
34 |
message($lang_common['No view']); |
|
35 |
||
36 |
||
37 |
$tid = isset($_GET['tid']) ? intval($_GET['tid']) : 0; |
|
38 |
$fid = isset($_GET['fid']) ? intval($_GET['fid']) : 0; |
|
39 |
if ($tid < 1 && $fid < 1 || $tid > 0 && $fid > 0) |
|
40 |
message($lang_common['Bad request']); |
|
41 |
||
42 |
// Fetch some info about the topic and/or the forum |
|
43 |
if ($tid) |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
44 |
$result = $pun_db->query('SELECT f.id, f.forum_name, f.moderators, f.redirect_url, fp.post_replies, fp.post_topics, t.subject, t.closed FROM '.$pun_db->prefix.'topics AS t INNER JOIN '.$pun_db->prefix.'forums AS f ON f.id=t.forum_id LEFT JOIN '.$pun_db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].') WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id='.$tid) or error('Unable to fetch forum info', __FILE__, __LINE__, $pun_db->error()); |
0 | 45 |
else |
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
46 |
$result = $pun_db->query('SELECT f.id, f.forum_name, f.moderators, f.redirect_url, fp.post_replies, fp.post_topics FROM '.$pun_db->prefix.'forums AS f LEFT JOIN '.$pun_db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].') WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND f.id='.$fid) or error('Unable to fetch forum info', __FILE__, __LINE__, $pun_db->error()); |
0 | 47 |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
48 |
if (!$pun_db->num_rows($result)) |
0 | 49 |
message($lang_common['Bad request']); |
50 |
||
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
51 |
$cur_posting = $pun_db->fetch_assoc($result); |
0 | 52 |
|
53 |
// Is someone trying to post into a redirect forum? |
|
54 |
if ($cur_posting['redirect_url'] != '') |
|
55 |
message($lang_common['Bad request']); |
|
56 |
||
57 |
// Sort out who the moderators are and if we are currently a moderator (or an admin) |
|
58 |
$mods_array = ($cur_posting['moderators'] != '') ? unserialize($cur_posting['moderators']) : array(); |
|
59 |
$is_admmod = ($pun_user['g_id'] == PUN_ADMIN || ($pun_user['g_id'] == PUN_MOD && array_key_exists($pun_user['username'], $mods_array))) ? true : false; |
|
60 |
||
61 |
// Do we have permission to post? |
|
62 |
if ((($tid && (($cur_posting['post_replies'] == '' && $pun_user['g_post_replies'] == '0') || $cur_posting['post_replies'] == '0')) || |
|
63 |
($fid && (($cur_posting['post_topics'] == '' && $pun_user['g_post_topics'] == '0') || $cur_posting['post_topics'] == '0')) || |
|
64 |
(isset($cur_posting['closed']) && $cur_posting['closed'] == '1')) && |
|
65 |
!$is_admmod) |
|
66 |
message($lang_common['No permission']); |
|
67 |
||
68 |
// Load the post.php language file |
|
69 |
require PUN_ROOT.'lang/'.$pun_user['language'].'/post.php'; |
|
70 |
||
71 |
// Start with a clean slate |
|
72 |
$errors = array(); |
|
73 |
||
74 |
||
75 |
// Did someone just hit "Submit" or "Preview"? |
|
76 |
if (isset($_POST['form_sent'])) |
|
77 |
{ |
|
78 |
// Make sure form_user is correct |
|
79 |
if (($pun_user['is_guest'] && $_POST['form_user'] != 'Guest') || (!$pun_user['is_guest'] && $_POST['form_user'] != $pun_user['username'])) |
|
80 |
message($lang_common['Bad request']); |
|
81 |
||
82 |
// Flood protection |
|
83 |
if (!$pun_user['is_guest'] && !isset($_POST['preview']) && $pun_user['last_post'] != '' && (time() - $pun_user['last_post']) < $pun_user['g_post_flood']) |
|
84 |
$errors[] = $lang_post['Flood start'].' '.$pun_user['g_post_flood'].' '.$lang_post['flood end']; |
|
85 |
||
86 |
// If it's a new topic |
|
87 |
if ($fid) |
|
88 |
{ |
|
89 |
$subject = pun_trim($_POST['req_subject']); |
|
90 |
||
91 |
if ($subject == '') |
|
92 |
$errors[] = $lang_post['No subject']; |
|
93 |
else if (pun_strlen($subject) > 70) |
|
94 |
$errors[] = $lang_post['Too long subject']; |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
95 |
else if ($pun_config['p_subject_all_caps'] == '0' && strtoupper($subject) == $subject && $pun_user['g_id'] < PUN_MOD) |
0 | 96 |
$subject = ucwords(strtolower($subject)); |
97 |
} |
|
98 |
||
99 |
// If the user is logged in we get the username and e-mail from $pun_user |
|
100 |
if (!$pun_user['is_guest']) |
|
101 |
{ |
|
102 |
$username = $pun_user['username']; |
|
103 |
$email = $pun_user['email']; |
|
104 |
} |
|
105 |
// Otherwise it should be in $_POST |
|
106 |
else |
|
107 |
{ |
|
108 |
$username = trim($_POST['req_username']); |
|
109 |
$email = strtolower(trim(($pun_config['p_force_guest_email'] == '1') ? $_POST['req_email'] : $_POST['email'])); |
|
110 |
||
111 |
// Load the register.php/profile.php language files |
|
112 |
require PUN_ROOT.'lang/'.$pun_user['language'].'/prof_reg.php'; |
|
113 |
require PUN_ROOT.'lang/'.$pun_user['language'].'/register.php'; |
|
114 |
||
115 |
// It's a guest, so we have to validate the username |
|
116 |
if (strlen($username) < 2) |
|
117 |
$errors[] = $lang_prof_reg['Username too short']; |
|
118 |
else if (!strcasecmp($username, 'Guest') || !strcasecmp($username, $lang_common['Guest'])) |
|
119 |
$errors[] = $lang_prof_reg['Username guest']; |
|
120 |
else if (preg_match('/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/', $username)) |
|
121 |
$errors[] = $lang_prof_reg['Username IP']; |
|
122 |
||
123 |
if ((strpos($username, '[') !== false || strpos($username, ']') !== false) && strpos($username, '\'') !== false && strpos($username, '"') !== false) |
|
124 |
$errors[] = $lang_prof_reg['Username reserved chars']; |
|
125 |
if (preg_match('#\[b\]|\[/b\]|\[u\]|\[/u\]|\[i\]|\[/i\]|\[color|\[/color\]|\[quote\]|\[quote=|\[/quote\]|\[code\]|\[/code\]|\[img\]|\[/img\]|\[url|\[/url\]|\[email|\[/email\]#i', $username)) |
|
126 |
$errors[] = $lang_prof_reg['Username BBCode']; |
|
127 |
||
128 |
// Check username for any censored words |
|
129 |
$temp = censor_words($username); |
|
130 |
if ($temp != $username) |
|
131 |
$errors[] = $lang_register['Username censor']; |
|
132 |
||
133 |
// Check that the username (or a too similar username) is not already registered |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
134 |
$result = $pun_db->query('SELECT username FROM '.$pun_db->prefix.'users WHERE (username=\''.$pun_db->escape($username).'\' OR username=\''.$pun_db->escape(preg_replace('/[^\w]/', '', $username)).'\') AND id>1') or error('Unable to fetch user info', __FILE__, __LINE__, $pun_db->error()); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
135 |
if ($pun_db->num_rows($result)) |
0 | 136 |
{ |
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
137 |
$busy = $pun_db->result($result); |
0 | 138 |
$errors[] = $lang_register['Username dupe 1'].' '.pun_htmlspecialchars($busy).'. '.$lang_register['Username dupe 2']; |
139 |
} |
|
140 |
||
141 |
if ($pun_config['p_force_guest_email'] == '1' || $email != '') |
|
142 |
{ |
|
143 |
require PUN_ROOT.'include/email.php'; |
|
144 |
if (!is_valid_email($email)) |
|
145 |
$errors[] = $lang_common['Invalid e-mail']; |
|
146 |
} |
|
147 |
} |
|
148 |
||
149 |
// Clean up message from POST |
|
150 |
$message = pun_linebreaks(pun_trim($_POST['req_message'])); |
|
151 |
||
152 |
if ($message == '') |
|
153 |
$errors[] = $lang_post['No message']; |
|
154 |
else if (strlen($message) > 65535) |
|
155 |
$errors[] = $lang_post['Too long message']; |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
156 |
else if ($pun_config['p_message_all_caps'] == '0' && strtoupper($message) == $message && $pun_user['g_id'] < PUN_MOD) |
0 | 157 |
$message = ucwords(strtolower($message)); |
158 |
||
159 |
// Validate BBCode syntax |
|
160 |
if ($pun_config['p_message_bbcode'] == '1' && strpos($message, '[') !== false && strpos($message, ']') !== false) |
|
161 |
{ |
|
162 |
require PUN_ROOT.'include/parser.php'; |
|
163 |
$message = preparse_bbcode($message, $errors); |
|
164 |
} |
|
165 |
||
166 |
||
167 |
require PUN_ROOT.'include/search_idx.php'; |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
168 |
global $db, $session, $paths, $template, $plugins; // Common objects |
0 | 169 |
|
170 |
$hide_smilies = isset($_POST['hide_smilies']) ? 1 : 0; |
|
171 |
$subscribe = isset($_POST['subscribe']) ? 1 : 0; |
|
172 |
||
173 |
$now = time(); |
|
174 |
||
175 |
// Did everything go according to plan? |
|
176 |
if (empty($errors) && !isset($_POST['preview'])) |
|
177 |
{ |
|
178 |
// If it's a reply |
|
179 |
if ($tid) |
|
180 |
{ |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
181 |
if ($session->user_logged_in) |
0 | 182 |
{ |
183 |
// Insert the new post |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
184 |
$pun_db->query('INSERT INTO '.$pun_db->prefix.'posts (poster, poster_id, poster_ip, message, hide_smilies, posted, topic_id) VALUES(\''.$pun_db->escape($username).'\', '.$pun_user['id'].', \''.get_remote_address().'\', \''.$pun_db->escape($message).'\', \''.$hide_smilies.'\', '.$now.', '.$tid.')') or error('Unable to create post', __FILE__, __LINE__, $pun_db->error()); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
185 |
$new_pid = $pun_db->insert_id(); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
186 |
|
0 | 187 |
// To subscribe or not to subscribe, that ... |
188 |
if ($pun_config['o_subscriptions'] == '1' && $subscribe) |
|
189 |
{ |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
190 |
$result = $pun_db->query('SELECT 1 FROM '.$pun_db->prefix.'subscriptions WHERE user_id='.$pun_user['id'].' AND topic_id='.$tid) or error('Unable to fetch subscription info', __FILE__, __LINE__, $pun_db->error()); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
191 |
if (!$pun_db->num_rows($result)) |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
192 |
$pun_db->query('INSERT INTO '.$pun_db->prefix.'subscriptions (user_id, topic_id) VALUES('.$pun_user['id'].' ,'.$tid.')') or error('Unable to add subscription', __FILE__, __LINE__, $pun_db->error()); |
0 | 193 |
} |
194 |
} |
|
195 |
else |
|
196 |
{ |
|
197 |
// It's a guest. Insert the new post |
|
198 |
$email_sql = ($pun_config['p_force_guest_email'] == '1' || $email != '') ? '\''.$email.'\'' : 'NULL'; |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
199 |
$pun_db->query('INSERT INTO '.$pun_db->prefix.'posts (poster, poster_ip, poster_email, message, hide_smilies, posted, topic_id) VALUES(\''.$pun_db->escape($username).'\', \''.get_remote_address().'\', '.$email_sql.', \''.$pun_db->escape($message).'\', \''.$hide_smilies.'\', '.$now.', '.$tid.')') or error('Unable to create post', __FILE__, __LINE__, $pun_db->error()); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
200 |
$new_pid = $pun_db->insert_id(); |
0 | 201 |
} |
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
202 |
|
0 | 203 |
// Count number of replies in the topic |
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
204 |
$result = $pun_db->query('SELECT COUNT(id) FROM '.$pun_db->prefix.'posts WHERE topic_id='.$tid) or error('Unable to fetch post count for topic', __FILE__, __LINE__, $pun_db->error()); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
205 |
$num_replies = $pun_db->result($result, 0) - 1; |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
206 |
|
0 | 207 |
// Update topic |
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
208 |
$pun_db->query('UPDATE '.$pun_db->prefix.'topics SET num_replies='.$num_replies.', last_post='.$now.', last_post_id='.$new_pid.', last_poster=\''.$pun_db->escape($username).'\' WHERE id='.$tid) or error('Unable to update topic', __FILE__, __LINE__, $pun_db->error()); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
209 |
|
0 | 210 |
update_search_index('post', $new_pid, $message); |
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
211 |
|
0 | 212 |
update_forum($cur_posting['id']); |
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
213 |
|
0 | 214 |
// Should we send out notifications? |
215 |
if ($pun_config['o_subscriptions'] == '1') |
|
216 |
{ |
|
217 |
// Get the post time for the previous post in this topic |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
218 |
$result = $pun_db->query('SELECT posted FROM '.$pun_db->prefix.'posts WHERE topic_id='.$tid.' ORDER BY id DESC LIMIT 1, 1') or error('Unable to fetch post info', __FILE__, __LINE__, $pun_db->error()); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
219 |
$previous_post_time = $pun_db->result($result); |
0 | 220 |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
221 |
// Get any subscribed users that should be notified (banned users are NOT excluded in Enano) |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
222 |
$result = $pun_db->query('SELECT u.id, eu.email, u.notify_with_post, u.language FROM '.$pun_db->prefix.'users AS u LEFT JOIN '.table_prefix.'users AS eu ON eu.user_id=u.id INNER JOIN '.$pun_db->prefix.'subscriptions AS s ON u.id=s.user_id LEFT JOIN '.$pun_db->prefix.'forum_perms AS fp ON (fp.forum_id='.$cur_posting['id'].' AND fp.group_id=u.group_id) LEFT JOIN '.$pun_db->prefix.'online AS o ON u.id=o.user_id WHERE COALESCE(o.logged, u.last_visit)>'.$previous_post_time.' AND (fp.read_forum IS NULL OR fp.read_forum=1) AND s.topic_id='.$tid.' AND u.id!='.intval($pun_user['id'])) or error('Unable to fetch subscription info', __FILE__, __LINE__, $pun_db->error()); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
223 |
if ($pun_db->num_rows($result)) |
0 | 224 |
{ |
225 |
require_once PUN_ROOT.'include/email.php'; |
|
226 |
||
227 |
$notification_emails = array(); |
|
228 |
||
229 |
// Loop through subscribed users and send e-mails |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
230 |
while ($cur_subscriber = $pun_db->fetch_assoc($result)) |
0 | 231 |
{ |
232 |
// Is the subscription e-mail for $cur_subscriber['language'] cached or not? |
|
233 |
if (!isset($notification_emails[$cur_subscriber['language']])) |
|
234 |
{ |
|
235 |
if (file_exists(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply.tpl')) |
|
236 |
{ |
|
237 |
// Load the "new reply" template |
|
238 |
$mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply.tpl')); |
|
239 |
||
240 |
// Load the "new reply full" template (with post included) |
|
241 |
$mail_tpl_full = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply_full.tpl')); |
|
242 |
||
243 |
// The first row contains the subject (it also starts with "Subject:") |
|
244 |
$first_crlf = strpos($mail_tpl, "\n"); |
|
245 |
$mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8)); |
|
246 |
$mail_message = trim(substr($mail_tpl, $first_crlf)); |
|
247 |
||
248 |
$first_crlf = strpos($mail_tpl_full, "\n"); |
|
249 |
$mail_subject_full = trim(substr($mail_tpl_full, 8, $first_crlf-8)); |
|
250 |
$mail_message_full = trim(substr($mail_tpl_full, $first_crlf)); |
|
251 |
||
252 |
$mail_subject = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_subject); |
|
253 |
$mail_message = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_message); |
|
254 |
$mail_message = str_replace('<replier>', $username, $mail_message); |
|
255 |
$mail_message = str_replace('<post_url>', $pun_config['o_base_url'].'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message); |
|
256 |
$mail_message = str_replace('<unsubscribe_url>', $pun_config['o_base_url'].'/misc.php?unsubscribe='.$tid, $mail_message); |
|
257 |
$mail_message = str_replace('<board_mailer>', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message); |
|
258 |
||
259 |
$mail_subject_full = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_subject_full); |
|
260 |
$mail_message_full = str_replace('<topic_subject>', '\''.$cur_posting['subject'].'\'', $mail_message_full); |
|
261 |
$mail_message_full = str_replace('<replier>', $username, $mail_message_full); |
|
262 |
$mail_message_full = str_replace('<message>', $message, $mail_message_full); |
|
263 |
$mail_message_full = str_replace('<post_url>', $pun_config['o_base_url'].'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message_full); |
|
264 |
$mail_message_full = str_replace('<unsubscribe_url>', $pun_config['o_base_url'].'/misc.php?unsubscribe='.$tid, $mail_message_full); |
|
265 |
$mail_message_full = str_replace('<board_mailer>', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message_full); |
|
266 |
||
267 |
$notification_emails[$cur_subscriber['language']][0] = $mail_subject; |
|
268 |
$notification_emails[$cur_subscriber['language']][1] = $mail_message; |
|
269 |
$notification_emails[$cur_subscriber['language']][2] = $mail_subject_full; |
|
270 |
$notification_emails[$cur_subscriber['language']][3] = $mail_message_full; |
|
271 |
||
272 |
$mail_subject = $mail_message = $mail_subject_full = $mail_message_full = null; |
|
273 |
} |
|
274 |
} |
|
275 |
||
276 |
// We have to double check here because the templates could be missing |
|
277 |
if (isset($notification_emails[$cur_subscriber['language']])) |
|
278 |
{ |
|
279 |
if ($cur_subscriber['notify_with_post'] == '0') |
|
280 |
pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][0], $notification_emails[$cur_subscriber['language']][1]); |
|
281 |
else |
|
282 |
pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][2], $notification_emails[$cur_subscriber['language']][3]); |
|
283 |
} |
|
284 |
} |
|
285 |
} |
|
286 |
} |
|
287 |
} |
|
288 |
// If it's a new topic |
|
289 |
else if ($fid) |
|
290 |
{ |
|
291 |
// Create the topic |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
292 |
$pun_db->query('INSERT INTO '.$pun_db->prefix.'topics (poster, subject, posted, last_post, last_poster, forum_id) VALUES(\''.$pun_db->escape($username).'\', \''.$pun_db->escape($subject).'\', '.$now.', '.$now.', \''.$pun_db->escape($username).'\', '.$fid.')') or error('Unable to create topic', __FILE__, __LINE__, $pun_db->error()); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
293 |
$new_tid = $pun_db->insert_id(); |
0 | 294 |
|
295 |
if (!$pun_user['is_guest']) |
|
296 |
{ |
|
297 |
// To subscribe or not to subscribe, that ... |
|
298 |
if ($pun_config['o_subscriptions'] == '1' && (isset($_POST['subscribe']) && $_POST['subscribe'] == '1')) |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
299 |
$pun_db->query('INSERT INTO '.$pun_db->prefix.'subscriptions (user_id, topic_id) VALUES('.$pun_user['id'].' ,'.$new_tid.')') or error('Unable to add subscription', __FILE__, __LINE__, $pun_db->error()); |
0 | 300 |
|
301 |
// Create the post ("topic post") |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
302 |
$pun_db->query('INSERT INTO '.$pun_db->prefix.'posts (poster, poster_id, poster_ip, message, hide_smilies, posted, topic_id) VALUES(\''.$pun_db->escape($username).'\', '.$pun_user['id'].', \''.get_remote_address().'\', \''.$pun_db->escape($message).'\', \''.$hide_smilies.'\', '.$now.', '.$new_tid.')') or error('Unable to create post', __FILE__, __LINE__, $pun_db->error()); |
0 | 303 |
} |
304 |
else |
|
305 |
{ |
|
306 |
// Create the post ("topic post") |
|
307 |
$email_sql = ($pun_config['p_force_guest_email'] == '1' || $email != '') ? '\''.$email.'\'' : 'NULL'; |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
308 |
$pun_db->query('INSERT INTO '.$pun_db->prefix.'posts (poster, poster_ip, poster_email, message, hide_smilies, posted, topic_id) VALUES(\''.$pun_db->escape($username).'\', \''.get_remote_address().'\', '.$email_sql.', \''.$pun_db->escape($message).'\', \''.$hide_smilies.'\', '.$now.', '.$new_tid.')') or error('Unable to create post', __FILE__, __LINE__, $pun_db->error()); |
0 | 309 |
} |
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
310 |
$new_pid = $pun_db->insert_id(); |
0 | 311 |
|
312 |
// Update the topic with last_post_id |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
313 |
$pun_db->query('UPDATE '.$pun_db->prefix.'topics SET last_post_id='.$new_pid.' WHERE id='.$new_tid) or error('Unable to update topic', __FILE__, __LINE__, $pun_db->error()); |
0 | 314 |
|
315 |
update_search_index('post', $new_pid, $message, $subject); |
|
316 |
||
317 |
update_forum($fid); |
|
318 |
} |
|
319 |
||
320 |
// If the posting user is logged in, increment his/her post count |
|
321 |
if (!$pun_user['is_guest']) |
|
322 |
{ |
|
323 |
$low_prio = ($db_type == 'mysql') ? 'LOW_PRIORITY ' : ''; |
|
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
324 |
$pun_db->query('UPDATE '.$low_prio.$pun_db->prefix.'users SET num_posts=num_posts+1, last_post='.$now.' WHERE id='.$pun_user['id']) or error('Unable to update user', __FILE__, __LINE__, $pun_db->error()); |
0 | 325 |
} |
326 |
||
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
327 |
pun_redirect('viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $lang_post['Post redirect']); |
0 | 328 |
} |
329 |
} |
|
330 |
||
331 |
||
332 |
// If a topic id was specified in the url (it's a reply). |
|
333 |
if ($tid) |
|
334 |
{ |
|
335 |
$action = $lang_post['Post a reply']; |
|
336 |
$form = '<form id="post" method="post" action="post.php?action=post&tid='.$tid.'" onsubmit="this.submit.disabled=true;if(process_form(this)){return true;}else{this.submit.disabled=false;return false;}">'; |
|
337 |
||
338 |
// If a quote-id was specified in the url. |
|
339 |
if (isset($_GET['qid'])) |
|
340 |
{ |
|
341 |
$qid = intval($_GET['qid']); |
|
342 |
if ($qid < 1) |
|
343 |
message($lang_common['Bad request']); |
|
344 |
||
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
345 |
$result = $pun_db->query('SELECT poster, message FROM '.$pun_db->prefix.'posts WHERE id='.$qid.' AND topic_id='.$tid) or error('Unable to fetch quote info', __FILE__, __LINE__, $pun_db->error()); |
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
346 |
if (!$pun_db->num_rows($result)) |
0 | 347 |
message($lang_common['Bad request']); |
348 |
||
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
349 |
list($q_poster, $q_message) = $pun_db->fetch_row($result); |
0 | 350 |
|
351 |
$q_message = str_replace('[img]', '[url]', $q_message); |
|
352 |
$q_message = str_replace('[/img]', '[/url]', $q_message); |
|
353 |
$q_message = pun_htmlspecialchars($q_message); |
|
354 |
||
355 |
if ($pun_config['p_message_bbcode'] == '1') |
|
356 |
{ |
|
357 |
// If username contains a square bracket, we add "" or '' around it (so we know when it starts and ends) |
|
358 |
if (strpos($q_poster, '[') !== false || strpos($q_poster, ']') !== false) |
|
359 |
{ |
|
360 |
if (strpos($q_poster, '\'') !== false) |
|
361 |
$q_poster = '"'.$q_poster.'"'; |
|
362 |
else |
|
363 |
$q_poster = '\''.$q_poster.'\''; |
|
364 |
} |
|
365 |
else |
|
366 |
{ |
|
367 |
// Get the characters at the start and end of $q_poster |
|
368 |
$ends = substr($q_poster, 0, 1).substr($q_poster, -1, 1); |
|
369 |
||
370 |
// Deal with quoting "Username" or 'Username' (becomes '"Username"' or "'Username'") |
|
371 |
if ($ends == '\'\'') |
|
372 |
$q_poster = '"'.$q_poster.'"'; |
|
373 |
else if ($ends == '""') |
|
374 |
$q_poster = '\''.$q_poster.'\''; |
|
375 |
} |
|
376 |
||
377 |
$quote = '[quote='.$q_poster.']'.$q_message.'[/quote]'."\n"; |
|
378 |
} |
|
379 |
else |
|
380 |
$quote = '> '.$q_poster.' '.$lang_common['wrote'].':'."\n\n".'> '.$q_message."\n"; |
|
381 |
} |
|
382 |
||
383 |
$forum_name = '<a href="viewforum.php?id='.$cur_posting['id'].'">'.pun_htmlspecialchars($cur_posting['forum_name']).'</a>'; |
|
384 |
} |
|
385 |
// If a forum_id was specified in the url (new topic). |
|
386 |
else if ($fid) |
|
387 |
{ |
|
388 |
$action = $lang_post['Post new topic']; |
|
389 |
$form = '<form id="post" method="post" action="post.php?action=post&fid='.$fid.'" onsubmit="return process_form(this)">'; |
|
390 |
||
391 |
$forum_name = pun_htmlspecialchars($cur_posting['forum_name']); |
|
392 |
} |
|
393 |
else |
|
394 |
message($lang_common['Bad request']); |
|
395 |
||
396 |
||
397 |
$page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$action; |
|
398 |
$required_fields = array('req_email' => $lang_common['E-mail'], 'req_subject' => $lang_common['Subject'], 'req_message' => $lang_common['Message']); |
|
399 |
$focus_element = array('post'); |
|
400 |
||
401 |
if (!$pun_user['is_guest']) |
|
402 |
$focus_element[] = ($fid) ? 'req_subject' : 'req_message'; |
|
403 |
else |
|
404 |
{ |
|
405 |
$required_fields['req_username'] = $lang_post['Guest name']; |
|
406 |
$focus_element[] = 'req_username'; |
|
407 |
} |
|
408 |
||
409 |
require PUN_ROOT.'header.php'; |
|
410 |
||
411 |
?> |
|
412 |
<div class="linkst"> |
|
413 |
<div class="inbox"> |
|
414 |
<ul><li><a href="index.php"><?php echo $lang_common['Index'] ?></a></li><li> » <?php echo $forum_name ?><?php if (isset($cur_posting['subject'])) echo '</li><li> » '.pun_htmlspecialchars($cur_posting['subject']) ?></li></ul> |
|
415 |
</div> |
|
416 |
</div> |
|
417 |
||
418 |
<?php |
|
419 |
||
420 |
// If there are errors, we display them |
|
421 |
if (!empty($errors)) |
|
422 |
{ |
|
423 |
||
424 |
?> |
|
425 |
<div id="posterror" class="block"> |
|
426 |
<h2><span><?php echo $lang_post['Post errors'] ?></span></h2> |
|
427 |
<div class="box"> |
|
428 |
<div class="inbox"> |
|
429 |
<p><?php echo $lang_post['Post errors info'] ?></p> |
|
430 |
<ul> |
|
431 |
<?php |
|
432 |
||
433 |
while (list(, $cur_error) = each($errors)) |
|
434 |
echo "\t\t\t\t".'<li><strong>'.$cur_error.'</strong></li>'."\n"; |
|
435 |
?> |
|
436 |
</ul> |
|
437 |
</div> |
|
438 |
</div> |
|
439 |
</div> |
|
440 |
||
441 |
<?php |
|
442 |
||
443 |
} |
|
444 |
else if (isset($_POST['preview'])) |
|
445 |
{ |
|
446 |
require_once PUN_ROOT.'include/parser.php'; |
|
447 |
$preview_message = parse_message($message, $hide_smilies); |
|
448 |
||
449 |
?> |
|
450 |
<div id="postpreview" class="blockpost"> |
|
451 |
<h2><span><?php echo $lang_post['Post preview'] ?></span></h2> |
|
452 |
<div class="box"> |
|
453 |
<div class="inbox"> |
|
454 |
<div class="postright"> |
|
455 |
<div class="postmsg"> |
|
456 |
<?php echo $preview_message."\n" ?> |
|
457 |
</div> |
|
458 |
</div> |
|
459 |
</div> |
|
460 |
</div> |
|
461 |
</div> |
|
462 |
||
463 |
<?php |
|
464 |
||
465 |
} |
|
466 |
||
467 |
||
468 |
$cur_index = 1; |
|
469 |
||
470 |
?> |
|
471 |
<div class="blockform"> |
|
472 |
<h2><span><?php echo $action ?></span></h2> |
|
473 |
<div class="box"> |
|
474 |
<?php echo $form."\n" ?> |
|
475 |
<div class="inform"> |
|
476 |
<fieldset> |
|
477 |
<legend><?php echo $lang_common['Write message legend'] ?></legend> |
|
478 |
<div class="infldset txtarea"> |
|
479 |
<input type="hidden" name="form_sent" value="1" /> |
|
480 |
<input type="hidden" name="form_user" value="<?php echo (!$pun_user['is_guest']) ? pun_htmlspecialchars($pun_user['username']) : 'Guest'; ?>" /> |
|
481 |
<?php |
|
482 |
||
483 |
if ($pun_user['is_guest']) |
|
484 |
{ |
|
485 |
$email_label = ($pun_config['p_force_guest_email'] == '1') ? '<strong>'.$lang_common['E-mail'].'</strong>' : $lang_common['E-mail']; |
|
486 |
$email_form_name = ($pun_config['p_force_guest_email'] == '1') ? 'req_email' : 'email'; |
|
487 |
||
488 |
?> <label class="conl"><strong><?php echo $lang_post['Guest name'] ?></strong><br /><input type="text" name="req_username" value="<?php if (isset($_POST['req_username'])) echo pun_htmlspecialchars($username); ?>" size="25" maxlength="25" tabindex="<?php echo $cur_index++ ?>" /><br /></label> |
|
489 |
<label class="conl"><?php echo $email_label ?><br /><input type="text" name="<?php echo $email_form_name ?>" value="<?php if (isset($_POST[$email_form_name])) echo pun_htmlspecialchars($email); ?>" size="50" maxlength="50" tabindex="<?php echo $cur_index++ ?>" /><br /></label> |
|
490 |
<div class="clearer"></div> |
|
491 |
<?php |
|
492 |
||
493 |
} |
|
494 |
||
495 |
if ($fid): ?> |
|
496 |
<label><strong><?php echo $lang_common['Subject'] ?></strong><br /><input class="longinput" type="text" name="req_subject" value="<?php if (isset($_POST['req_subject'])) echo pun_htmlspecialchars($subject); ?>" size="80" maxlength="70" tabindex="<?php echo $cur_index++ ?>" /><br /></label> |
|
497 |
<?php endif; ?> <label><strong><?php echo $lang_common['Message'] ?></strong><br /> |
|
498 |
<textarea name="req_message" rows="20" cols="95" tabindex="<?php echo $cur_index++ ?>"><?php echo isset($_POST['req_message']) ? pun_htmlspecialchars($message) : (isset($quote) ? $quote : ''); ?></textarea><br /></label> |
|
499 |
<ul class="bblinks"> |
|
500 |
<li><a href="help.php#bbcode" onclick="window.open(this.href); return false;"><?php echo $lang_common['BBCode'] ?></a>: <?php echo ($pun_config['p_message_bbcode'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> |
|
501 |
<li><a href="help.php#img" onclick="window.open(this.href); return false;"><?php echo $lang_common['img tag'] ?></a>: <?php echo ($pun_config['p_message_img_tag'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> |
|
502 |
<li><a href="help.php#smilies" onclick="window.open(this.href); return false;"><?php echo $lang_common['Smilies'] ?></a>: <?php echo ($pun_config['o_smilies'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li> |
|
503 |
</ul> |
|
504 |
</div> |
|
505 |
</fieldset> |
|
506 |
<?php |
|
507 |
||
508 |
$checkboxes = array(); |
|
509 |
if (!$pun_user['is_guest']) |
|
510 |
{ |
|
511 |
if ($pun_config['o_smilies'] == '1') |
|
512 |
$checkboxes[] = '<label><input type="checkbox" name="hide_smilies" value="1" tabindex="'.($cur_index++).'"'.(isset($_POST['hide_smilies']) ? ' checked="checked"' : '').' />'.$lang_post['Hide smilies']; |
|
513 |
||
514 |
if ($pun_config['o_subscriptions'] == '1') |
|
515 |
$checkboxes[] = '<label><input type="checkbox" name="subscribe" value="1" tabindex="'.($cur_index++).'"'.(isset($_POST['subscribe']) ? ' checked="checked"' : '').' />'.$lang_post['Subscribe']; |
|
516 |
} |
|
517 |
else if ($pun_config['o_smilies'] == '1') |
|
518 |
$checkboxes[] = '<label><input type="checkbox" name="hide_smilies" value="1" tabindex="'.($cur_index++).'"'.(isset($_POST['hide_smilies']) ? ' checked="checked"' : '').' />'.$lang_post['Hide smilies']; |
|
519 |
||
520 |
if (!empty($checkboxes)) |
|
521 |
{ |
|
522 |
||
523 |
?> |
|
524 |
</div> |
|
525 |
<div class="inform"> |
|
526 |
<fieldset> |
|
527 |
<legend><?php echo $lang_common['Options'] ?></legend> |
|
528 |
<div class="infldset"> |
|
529 |
<div class="rbox"> |
|
530 |
<?php echo implode('<br /></label>'."\n\t\t\t\t", $checkboxes).'<br /></label>'."\n" ?> |
|
531 |
</div> |
|
532 |
</div> |
|
533 |
</fieldset> |
|
534 |
<?php |
|
535 |
||
536 |
} |
|
537 |
||
538 |
?> |
|
539 |
</div> |
|
540 |
<p><input type="submit" name="submit" value="<?php echo $lang_common['Submit'] ?>" tabindex="<?php echo $cur_index++ ?>" accesskey="s" /><input type="submit" name="preview" value="<?php echo $lang_post['Preview'] ?>" tabindex="<?php echo $cur_index++ ?>" accesskey="p" /><a href="javascript:history.go(-1)"><?php echo $lang_common['Go back'] ?></a></p> |
|
541 |
</form> |
|
542 |
</div> |
|
543 |
</div> |
|
544 |
||
545 |
<?php |
|
546 |
||
547 |
// Check to see if the topic review is to be displayed. |
|
548 |
if ($tid && $pun_config['o_topic_review'] != '0') |
|
549 |
{ |
|
550 |
require_once PUN_ROOT.'include/parser.php'; |
|
551 |
||
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
552 |
$result = $pun_db->query('SELECT poster, message, hide_smilies, posted FROM '.$pun_db->prefix.'posts WHERE topic_id='.$tid.' ORDER BY id DESC LIMIT '.$pun_config['o_topic_review']) or error('Unable to fetch topic review', __FILE__, __LINE__, $pun_db->error()); |
0 | 553 |
|
554 |
?> |
|
555 |
||
556 |
<div id="postreview" class="blockpost"> |
|
557 |
<h2><span><?php echo $lang_post['Topic review'] ?></span></h2> |
|
558 |
<?php |
|
559 |
||
560 |
//Set background switching on |
|
561 |
$bg_switch = true; |
|
562 |
$post_count = 0; |
|
563 |
||
2
a8a21e1c7afa
Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
Dan
parents:
0
diff
changeset
|
564 |
while ($cur_post = $pun_db->fetch_assoc($result)) |
0 | 565 |
{ |
566 |
// Switch the background color for every message. |
|
567 |
$bg_switch = ($bg_switch) ? $bg_switch = false : $bg_switch = true; |
|
568 |
$vtbg = ($bg_switch) ? ' roweven' : ' rowodd'; |
|
569 |
$post_count++; |
|
570 |
||
571 |
$cur_post['message'] = parse_message($cur_post['message'], $cur_post['hide_smilies']); |
|
572 |
||
573 |
?> |
|
574 |
<div class="box<?php echo $vtbg ?>"> |
|
575 |
<div class="inbox"> |
|
576 |
<div class="postleft"> |
|
577 |
<dl> |
|
578 |
<dt><strong><?php echo pun_htmlspecialchars($cur_post['poster']) ?></strong></dt> |
|
579 |
<dd><?php echo format_time($cur_post['posted']) ?></dd> |
|
580 |
</dl> |
|
581 |
</div> |
|
582 |
<div class="postright"> |
|
583 |
<div class="postmsg"> |
|
584 |
<?php echo $cur_post['message'] ?> |
|
585 |
</div> |
|
586 |
</div> |
|
587 |
<div class="clearer"></div> |
|
588 |
</div> |
|
589 |
</div> |
|
590 |
<?php |
|
591 |
||
592 |
} |
|
593 |
||
594 |
?> |
|
595 |
</div> |
|
596 |
<?php |
|
597 |
||
598 |
} |
|
599 |
||
600 |
require PUN_ROOT.'footer.php'; |