diff -r e3d7322305bf -r 5e1f1e916419 punbb/post.php --- a/punbb/post.php Sun Sep 02 11:00:57 2007 -0400 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,600 +0,0 @@ - 0 && $fid > 0) - message($lang_common['Bad request']); - -// Fetch some info about the topic and/or the forum -if ($tid) - $result = $pun_db->query('SELECT f.id, f.forum_name, f.moderators, f.redirect_url, fp.post_replies, fp.post_topics, t.subject, t.closed FROM '.$pun_db->prefix.'topics AS t INNER JOIN '.$pun_db->prefix.'forums AS f ON f.id=t.forum_id LEFT JOIN '.$pun_db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].') WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id='.$tid) or error('Unable to fetch forum info', __FILE__, __LINE__, $pun_db->error()); -else - $result = $pun_db->query('SELECT f.id, f.forum_name, f.moderators, f.redirect_url, fp.post_replies, fp.post_topics FROM '.$pun_db->prefix.'forums AS f LEFT JOIN '.$pun_db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].') WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND f.id='.$fid) or error('Unable to fetch forum info', __FILE__, __LINE__, $pun_db->error()); - -if (!$pun_db->num_rows($result)) - message($lang_common['Bad request']); - -$cur_posting = $pun_db->fetch_assoc($result); - -// Is someone trying to post into a redirect forum? -if ($cur_posting['redirect_url'] != '') - message($lang_common['Bad request']); - -// Sort out who the moderators are and if we are currently a moderator (or an admin) -$mods_array = ($cur_posting['moderators'] != '') ? unserialize($cur_posting['moderators']) : array(); -$is_admmod = ($pun_user['g_id'] == PUN_ADMIN || ($pun_user['g_id'] == PUN_MOD && array_key_exists($pun_user['username'], $mods_array))) ? true : false; - -// Do we have permission to post? -if ((($tid && (($cur_posting['post_replies'] == '' && $pun_user['g_post_replies'] == '0') || $cur_posting['post_replies'] == '0')) || - ($fid && (($cur_posting['post_topics'] == '' && $pun_user['g_post_topics'] == '0') || $cur_posting['post_topics'] == '0')) || - (isset($cur_posting['closed']) && $cur_posting['closed'] == '1')) && - !$is_admmod) - message($lang_common['No permission']); - -// Load the post.php language file -require PUN_ROOT.'lang/'.$pun_user['language'].'/post.php'; - -// Start with a clean slate -$errors = array(); - - -// Did someone just hit "Submit" or "Preview"? -if (isset($_POST['form_sent'])) -{ - // Make sure form_user is correct - if (($pun_user['is_guest'] && $_POST['form_user'] != 'Guest') || (!$pun_user['is_guest'] && $_POST['form_user'] != $pun_user['username'])) - message($lang_common['Bad request']); - - // Flood protection - if (!$pun_user['is_guest'] && !isset($_POST['preview']) && $pun_user['last_post'] != '' && (time() - $pun_user['last_post']) < $pun_user['g_post_flood']) - $errors[] = $lang_post['Flood start'].' '.$pun_user['g_post_flood'].' '.$lang_post['flood end']; - - // If it's a new topic - if ($fid) - { - $subject = pun_trim($_POST['req_subject']); - - if ($subject == '') - $errors[] = $lang_post['No subject']; - else if (pun_strlen($subject) > 70) - $errors[] = $lang_post['Too long subject']; - else if ($pun_config['p_subject_all_caps'] == '0' && strtoupper($subject) == $subject && $pun_user['g_id'] < PUN_MOD) - $subject = ucwords(strtolower($subject)); - } - - // If the user is logged in we get the username and e-mail from $pun_user - if (!$pun_user['is_guest']) - { - $username = $pun_user['username']; - $email = $pun_user['email']; - } - // Otherwise it should be in $_POST - else - { - $username = trim($_POST['req_username']); - $email = strtolower(trim(($pun_config['p_force_guest_email'] == '1') ? $_POST['req_email'] : $_POST['email'])); - - // Load the register.php/profile.php language files - require PUN_ROOT.'lang/'.$pun_user['language'].'/prof_reg.php'; - require PUN_ROOT.'lang/'.$pun_user['language'].'/register.php'; - - // It's a guest, so we have to validate the username - if (strlen($username) < 2) - $errors[] = $lang_prof_reg['Username too short']; - else if (!strcasecmp($username, 'Guest') || !strcasecmp($username, $lang_common['Guest'])) - $errors[] = $lang_prof_reg['Username guest']; - else if (preg_match('/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/', $username)) - $errors[] = $lang_prof_reg['Username IP']; - - if ((strpos($username, '[') !== false || strpos($username, ']') !== false) && strpos($username, '\'') !== false && strpos($username, '"') !== false) - $errors[] = $lang_prof_reg['Username reserved chars']; - if (preg_match('#\[b\]|\[/b\]|\[u\]|\[/u\]|\[i\]|\[/i\]|\[color|\[/color\]|\[quote\]|\[quote=|\[/quote\]|\[code\]|\[/code\]|\[img\]|\[/img\]|\[url|\[/url\]|\[email|\[/email\]#i', $username)) - $errors[] = $lang_prof_reg['Username BBCode']; - - // Check username for any censored words - $temp = censor_words($username); - if ($temp != $username) - $errors[] = $lang_register['Username censor']; - - // Check that the username (or a too similar username) is not already registered - $result = $pun_db->query('SELECT username FROM '.$pun_db->prefix.'users WHERE (username=\''.$pun_db->escape($username).'\' OR username=\''.$pun_db->escape(preg_replace('/[^\w]/', '', $username)).'\') AND id>1') or error('Unable to fetch user info', __FILE__, __LINE__, $pun_db->error()); - if ($pun_db->num_rows($result)) - { - $busy = $pun_db->result($result); - $errors[] = $lang_register['Username dupe 1'].' '.pun_htmlspecialchars($busy).'. '.$lang_register['Username dupe 2']; - } - - if ($pun_config['p_force_guest_email'] == '1' || $email != '') - { - require PUN_ROOT.'include/email.php'; - if (!is_valid_email($email)) - $errors[] = $lang_common['Invalid e-mail']; - } - } - - // Clean up message from POST - $message = pun_linebreaks(pun_trim($_POST['req_message'])); - - if ($message == '') - $errors[] = $lang_post['No message']; - else if (strlen($message) > 65535) - $errors[] = $lang_post['Too long message']; - else if ($pun_config['p_message_all_caps'] == '0' && strtoupper($message) == $message && $pun_user['g_id'] < PUN_MOD) - $message = ucwords(strtolower($message)); - - // Validate BBCode syntax - if ($pun_config['p_message_bbcode'] == '1' && strpos($message, '[') !== false && strpos($message, ']') !== false) - { - require PUN_ROOT.'include/parser.php'; - $message = preparse_bbcode($message, $errors); - } - - - require PUN_ROOT.'include/search_idx.php'; - global $db, $session, $paths, $template, $plugins; // Common objects - - $hide_smilies = isset($_POST['hide_smilies']) ? 1 : 0; - $subscribe = isset($_POST['subscribe']) ? 1 : 0; - - $now = time(); - - // Did everything go according to plan? - if (empty($errors) && !isset($_POST['preview'])) - { - // If it's a reply - if ($tid) - { - if ($session->user_logged_in) - { - // Insert the new post - $pun_db->query('INSERT INTO '.$pun_db->prefix.'posts (poster, poster_id, poster_ip, message, hide_smilies, posted, topic_id) VALUES(\''.$pun_db->escape($username).'\', '.$pun_user['id'].', \''.get_remote_address().'\', \''.$pun_db->escape($message).'\', \''.$hide_smilies.'\', '.$now.', '.$tid.')') or error('Unable to create post', __FILE__, __LINE__, $pun_db->error()); - $new_pid = $pun_db->insert_id(); - - // To subscribe or not to subscribe, that ... - if ($pun_config['o_subscriptions'] == '1' && $subscribe) - { - $result = $pun_db->query('SELECT 1 FROM '.$pun_db->prefix.'subscriptions WHERE user_id='.$pun_user['id'].' AND topic_id='.$tid) or error('Unable to fetch subscription info', __FILE__, __LINE__, $pun_db->error()); - if (!$pun_db->num_rows($result)) - $pun_db->query('INSERT INTO '.$pun_db->prefix.'subscriptions (user_id, topic_id) VALUES('.$pun_user['id'].' ,'.$tid.')') or error('Unable to add subscription', __FILE__, __LINE__, $pun_db->error()); - } - } - else - { - // It's a guest. Insert the new post - $email_sql = ($pun_config['p_force_guest_email'] == '1' || $email != '') ? '\''.$email.'\'' : 'NULL'; - $pun_db->query('INSERT INTO '.$pun_db->prefix.'posts (poster, poster_ip, poster_email, message, hide_smilies, posted, topic_id) VALUES(\''.$pun_db->escape($username).'\', \''.get_remote_address().'\', '.$email_sql.', \''.$pun_db->escape($message).'\', \''.$hide_smilies.'\', '.$now.', '.$tid.')') or error('Unable to create post', __FILE__, __LINE__, $pun_db->error()); - $new_pid = $pun_db->insert_id(); - } - - // Count number of replies in the topic - $result = $pun_db->query('SELECT COUNT(id) FROM '.$pun_db->prefix.'posts WHERE topic_id='.$tid) or error('Unable to fetch post count for topic', __FILE__, __LINE__, $pun_db->error()); - $num_replies = $pun_db->result($result, 0) - 1; - - // Update topic - $pun_db->query('UPDATE '.$pun_db->prefix.'topics SET num_replies='.$num_replies.', last_post='.$now.', last_post_id='.$new_pid.', last_poster=\''.$pun_db->escape($username).'\' WHERE id='.$tid) or error('Unable to update topic', __FILE__, __LINE__, $pun_db->error()); - - update_search_index('post', $new_pid, $message); - - update_forum($cur_posting['id']); - - // Should we send out notifications? - if ($pun_config['o_subscriptions'] == '1') - { - // Get the post time for the previous post in this topic - $result = $pun_db->query('SELECT posted FROM '.$pun_db->prefix.'posts WHERE topic_id='.$tid.' ORDER BY id DESC LIMIT 1, 1') or error('Unable to fetch post info', __FILE__, __LINE__, $pun_db->error()); - $previous_post_time = $pun_db->result($result); - - // Get any subscribed users that should be notified (banned users are NOT excluded in Enano) - $result = $pun_db->query('SELECT u.id, eu.email, u.notify_with_post, u.language FROM '.$pun_db->prefix.'users AS u LEFT JOIN '.table_prefix.'users AS eu ON eu.user_id=u.id INNER JOIN '.$pun_db->prefix.'subscriptions AS s ON u.id=s.user_id LEFT JOIN '.$pun_db->prefix.'forum_perms AS fp ON (fp.forum_id='.$cur_posting['id'].' AND fp.group_id=u.group_id) LEFT JOIN '.$pun_db->prefix.'online AS o ON u.id=o.user_id WHERE COALESCE(o.logged, u.last_visit)>'.$previous_post_time.' AND (fp.read_forum IS NULL OR fp.read_forum=1) AND s.topic_id='.$tid.' AND u.id!='.intval($pun_user['id'])) or error('Unable to fetch subscription info', __FILE__, __LINE__, $pun_db->error()); - if ($pun_db->num_rows($result)) - { - require_once PUN_ROOT.'include/email.php'; - - $notification_emails = array(); - - // Loop through subscribed users and send e-mails - while ($cur_subscriber = $pun_db->fetch_assoc($result)) - { - // Is the subscription e-mail for $cur_subscriber['language'] cached or not? - if (!isset($notification_emails[$cur_subscriber['language']])) - { - if (file_exists(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply.tpl')) - { - // Load the "new reply" template - $mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply.tpl')); - - // Load the "new reply full" template (with post included) - $mail_tpl_full = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply_full.tpl')); - - // The first row contains the subject (it also starts with "Subject:") - $first_crlf = strpos($mail_tpl, "\n"); - $mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8)); - $mail_message = trim(substr($mail_tpl, $first_crlf)); - - $first_crlf = strpos($mail_tpl_full, "\n"); - $mail_subject_full = trim(substr($mail_tpl_full, 8, $first_crlf-8)); - $mail_message_full = trim(substr($mail_tpl_full, $first_crlf)); - - $mail_subject = str_replace('', '\''.$cur_posting['subject'].'\'', $mail_subject); - $mail_message = str_replace('', '\''.$cur_posting['subject'].'\'', $mail_message); - $mail_message = str_replace('', $username, $mail_message); - $mail_message = str_replace('', $pun_config['o_base_url'].'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message); - $mail_message = str_replace('', $pun_config['o_base_url'].'/misc.php?unsubscribe='.$tid, $mail_message); - $mail_message = str_replace('', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message); - - $mail_subject_full = str_replace('', '\''.$cur_posting['subject'].'\'', $mail_subject_full); - $mail_message_full = str_replace('', '\''.$cur_posting['subject'].'\'', $mail_message_full); - $mail_message_full = str_replace('', $username, $mail_message_full); - $mail_message_full = str_replace('', $message, $mail_message_full); - $mail_message_full = str_replace('', $pun_config['o_base_url'].'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message_full); - $mail_message_full = str_replace('', $pun_config['o_base_url'].'/misc.php?unsubscribe='.$tid, $mail_message_full); - $mail_message_full = str_replace('', $pun_config['o_board_title'].' '.$lang_common['Mailer'], $mail_message_full); - - $notification_emails[$cur_subscriber['language']][0] = $mail_subject; - $notification_emails[$cur_subscriber['language']][1] = $mail_message; - $notification_emails[$cur_subscriber['language']][2] = $mail_subject_full; - $notification_emails[$cur_subscriber['language']][3] = $mail_message_full; - - $mail_subject = $mail_message = $mail_subject_full = $mail_message_full = null; - } - } - - // We have to double check here because the templates could be missing - if (isset($notification_emails[$cur_subscriber['language']])) - { - if ($cur_subscriber['notify_with_post'] == '0') - pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][0], $notification_emails[$cur_subscriber['language']][1]); - else - pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][2], $notification_emails[$cur_subscriber['language']][3]); - } - } - } - } - } - // If it's a new topic - else if ($fid) - { - // Create the topic - $pun_db->query('INSERT INTO '.$pun_db->prefix.'topics (poster, subject, posted, last_post, last_poster, forum_id) VALUES(\''.$pun_db->escape($username).'\', \''.$pun_db->escape($subject).'\', '.$now.', '.$now.', \''.$pun_db->escape($username).'\', '.$fid.')') or error('Unable to create topic', __FILE__, __LINE__, $pun_db->error()); - $new_tid = $pun_db->insert_id(); - - if (!$pun_user['is_guest']) - { - // To subscribe or not to subscribe, that ... - if ($pun_config['o_subscriptions'] == '1' && (isset($_POST['subscribe']) && $_POST['subscribe'] == '1')) - $pun_db->query('INSERT INTO '.$pun_db->prefix.'subscriptions (user_id, topic_id) VALUES('.$pun_user['id'].' ,'.$new_tid.')') or error('Unable to add subscription', __FILE__, __LINE__, $pun_db->error()); - - // Create the post ("topic post") - $pun_db->query('INSERT INTO '.$pun_db->prefix.'posts (poster, poster_id, poster_ip, message, hide_smilies, posted, topic_id) VALUES(\''.$pun_db->escape($username).'\', '.$pun_user['id'].', \''.get_remote_address().'\', \''.$pun_db->escape($message).'\', \''.$hide_smilies.'\', '.$now.', '.$new_tid.')') or error('Unable to create post', __FILE__, __LINE__, $pun_db->error()); - } - else - { - // Create the post ("topic post") - $email_sql = ($pun_config['p_force_guest_email'] == '1' || $email != '') ? '\''.$email.'\'' : 'NULL'; - $pun_db->query('INSERT INTO '.$pun_db->prefix.'posts (poster, poster_ip, poster_email, message, hide_smilies, posted, topic_id) VALUES(\''.$pun_db->escape($username).'\', \''.get_remote_address().'\', '.$email_sql.', \''.$pun_db->escape($message).'\', \''.$hide_smilies.'\', '.$now.', '.$new_tid.')') or error('Unable to create post', __FILE__, __LINE__, $pun_db->error()); - } - $new_pid = $pun_db->insert_id(); - - // Update the topic with last_post_id - $pun_db->query('UPDATE '.$pun_db->prefix.'topics SET last_post_id='.$new_pid.' WHERE id='.$new_tid) or error('Unable to update topic', __FILE__, __LINE__, $pun_db->error()); - - update_search_index('post', $new_pid, $message, $subject); - - update_forum($fid); - } - - // If the posting user is logged in, increment his/her post count - if (!$pun_user['is_guest']) - { - $low_prio = ($db_type == 'mysql') ? 'LOW_PRIORITY ' : ''; - $pun_db->query('UPDATE '.$low_prio.$pun_db->prefix.'users SET num_posts=num_posts+1, last_post='.$now.' WHERE id='.$pun_user['id']) or error('Unable to update user', __FILE__, __LINE__, $pun_db->error()); - } - - pun_redirect('viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $lang_post['Post redirect']); - } -} - - -// If a topic id was specified in the url (it's a reply). -if ($tid) -{ - $action = $lang_post['Post a reply']; - $form = '
'; - - // If a quote-id was specified in the url. - if (isset($_GET['qid'])) - { - $qid = intval($_GET['qid']); - if ($qid < 1) - message($lang_common['Bad request']); - - $result = $pun_db->query('SELECT poster, message FROM '.$pun_db->prefix.'posts WHERE id='.$qid.' AND topic_id='.$tid) or error('Unable to fetch quote info', __FILE__, __LINE__, $pun_db->error()); - if (!$pun_db->num_rows($result)) - message($lang_common['Bad request']); - - list($q_poster, $q_message) = $pun_db->fetch_row($result); - - $q_message = str_replace('[img]', '[url]', $q_message); - $q_message = str_replace('[/img]', '[/url]', $q_message); - $q_message = pun_htmlspecialchars($q_message); - - if ($pun_config['p_message_bbcode'] == '1') - { - // If username contains a square bracket, we add "" or '' around it (so we know when it starts and ends) - if (strpos($q_poster, '[') !== false || strpos($q_poster, ']') !== false) - { - if (strpos($q_poster, '\'') !== false) - $q_poster = '"'.$q_poster.'"'; - else - $q_poster = '\''.$q_poster.'\''; - } - else - { - // Get the characters at the start and end of $q_poster - $ends = substr($q_poster, 0, 1).substr($q_poster, -1, 1); - - // Deal with quoting "Username" or 'Username' (becomes '"Username"' or "'Username'") - if ($ends == '\'\'') - $q_poster = '"'.$q_poster.'"'; - else if ($ends == '""') - $q_poster = '\''.$q_poster.'\''; - } - - $quote = '[quote='.$q_poster.']'.$q_message.'[/quote]'."\n"; - } - else - $quote = '> '.$q_poster.' '.$lang_common['wrote'].':'."\n\n".'> '.$q_message."\n"; - } - - $forum_name = ''.pun_htmlspecialchars($cur_posting['forum_name']).''; -} -// If a forum_id was specified in the url (new topic). -else if ($fid) -{ - $action = $lang_post['Post new topic']; - $form = ''; - - $forum_name = pun_htmlspecialchars($cur_posting['forum_name']); -} -else - message($lang_common['Bad request']); - - -$page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$action; -$required_fields = array('req_email' => $lang_common['E-mail'], 'req_subject' => $lang_common['Subject'], 'req_message' => $lang_common['Message']); -$focus_element = array('post'); - -if (!$pun_user['is_guest']) - $focus_element[] = ($fid) ? 'req_subject' : 'req_message'; -else -{ - $required_fields['req_username'] = $lang_post['Guest name']; - $focus_element[] = 'req_username'; -} - -require PUN_ROOT.'header.php'; - -?> -
-
-
  •  » 
  •  » '.pun_htmlspecialchars($cur_posting['subject']) ?>
-
-
- - -
-

-
-
-

-
    -'.$cur_error.''."\n"; -?> -
-
-
-
- - -
-

-
-
-
-
- -
-
-
-
-
- - -
-

-
- -
-
- -
- - -'.$lang_common['E-mail'].'' : $lang_common['E-mail']; - $email_form_name = ($pun_config['p_force_guest_email'] == '1') ? 'req_email' : 'email'; - -?> - -
- - - -
    -
  • :
    • -
  • :
    • -
  • :
    • -
-
-
-'.$lang_post['Hide smilies']; - - if ($pun_config['o_subscriptions'] == '1') - $checkboxes[] = '
-
-
- -
-
- '."\n\t\t\t\t", $checkboxes).'
'."\n" ?> -
-
-
- -
-

- -
-
- -query('SELECT poster, message, hide_smilies, posted FROM '.$pun_db->prefix.'posts WHERE topic_id='.$tid.' ORDER BY id DESC LIMIT '.$pun_config['o_topic_review']) or error('Unable to fetch topic review', __FILE__, __LINE__, $pun_db->error()); - -?> - -
-

-fetch_assoc($result)) - { - // Switch the background color for every message. - $bg_switch = ($bg_switch) ? $bg_switch = false : $bg_switch = true; - $vtbg = ($bg_switch) ? ' roweven' : ' rowodd'; - $post_count++; - - $cur_post['message'] = parse_message($cur_post['message'], $cur_post['hide_smilies']); - -?> -
-
-
-
-
-
-
-
-
-
- -
-
-
-
-
- -
-