0) unset($_REQUEST['poll']); if (empty($_REQUEST['msg'])) { if ($user_info['is_guest'] && !allowedTo('post_reply_any')) is_not_guest(); if ($ID_MEMBER_POSTER != $ID_MEMBER) isAllowedTo('post_reply_any'); elseif (!allowedTo('post_reply_any')) isAllowedTo('post_reply_own'); } $context['can_lock'] = allowedTo('lock_any') || ($ID_MEMBER == $ID_MEMBER_POSTER && allowedTo('lock_own')); $context['can_sticky'] = allowedTo('make_sticky') && !empty($modSettings['enableStickyTopics']); $context['notify'] = !empty($context['notify']); $context['sticky'] = isset($_REQUEST['sticky']) ? !empty($_REQUEST['sticky']) : $sticky; } else { if ((!$context['make_event'] || !empty($board)) && (!isset($_REQUEST['poll']) || $modSettings['pollMode'] != '1')) isAllowedTo('post_new'); $locked = 0; // !!! These won't work if you're making an event. $context['can_lock'] = allowedTo(array('lock_any', 'lock_own')); $context['can_sticky'] = allowedTo('make_sticky') && !empty($modSettings['enableStickyTopics']); $context['notify'] = !empty($context['notify']); $context['sticky'] = !empty($_REQUEST['sticky']); } // !!! These won't work if you're posting an event! $context['can_notify'] = allowedTo('mark_any_notify'); $context['can_move'] = allowedTo('move_any'); $context['can_announce'] = allowedTo('announce_topic'); $context['locked'] = !empty($locked) || !empty($_REQUEST['lock']); // An array to hold all the attachments for this topic. $context['current_attachments'] = array(); // Don't allow a post if it's locked and you aren't all powerful. if ($locked && !allowedTo('moderate_board')) fatal_lang_error(90, false); // Check the users permissions - is the user allowed to add or post a poll? if (isset($_REQUEST['poll']) && $modSettings['pollMode'] == '1') { // New topic, new poll. if (empty($topic)) isAllowedTo('poll_post'); // This is an old topic - but it is yours! Can you add to it? elseif ($ID_MEMBER == $ID_MEMBER_POSTER && !allowedTo('poll_add_any')) isAllowedTo('poll_add_own'); // If you're not the owner, can you add to any poll? else isAllowedTo('poll_add_any'); // Set up the poll options. $context['poll_options'] = array( 'max_votes' => empty($_POST['poll_max_votes']) ? '1' : max(1, $_POST['poll_max_votes']), 'hide' => empty($_POST['poll_hide']) ? 0 : $_POST['poll_hide'], 'expire' => !isset($_POST['poll_expire']) ? '' : $_POST['poll_expire'], 'change_vote' => isset($_POST['poll_change_vote']) ); // Make all five poll choices empty. $context['choices'] = array( array('id' => 0, 'number' => 1, 'label' => '', 'is_last' => false), array('id' => 1, 'number' => 2, 'label' => '', 'is_last' => false), array('id' => 2, 'number' => 3, 'label' => '', 'is_last' => false), array('id' => 3, 'number' => 4, 'label' => '', 'is_last' => false), array('id' => 4, 'number' => 5, 'label' => '', 'is_last' => true) ); } if ($context['make_event']) { // They might want to pick a board. if (!isset($context['current_board'])) $context['current_board'] = 0; // Start loading up the event info. $context['event'] = array(); $context['event']['title'] = isset($_REQUEST['evtitle']) ? htmlspecialchars(stripslashes($_REQUEST['evtitle'])) : ''; $context['event']['id'] = isset($_REQUEST['eventid']) ? (int) $_REQUEST['eventid'] : -1; $context['event']['new'] = $context['event']['id'] == -1; // Permissions check! isAllowedTo('calendar_post'); // Editing an event? (but NOT previewing!?) if (!$context['event']['new'] && !isset($_REQUEST['subject'])) { // If the user doesn't have permission to edit the post in this topic, redirect them. if ($ID_MEMBER_POSTER != $ID_MEMBER || !allowedTo('modify_own') && !allowedTo('modify_any')) { require_once($sourcedir . '/Calendar.php'); return CalendarPost(); } // Get the current event information. $request = db_query(" SELECT ID_MEMBER, title, MONTH(startDate) AS month, DAYOFMONTH(startDate) AS day, YEAR(startDate) AS year, (TO_DAYS(endDate) - TO_DAYS(startDate)) AS span FROM {$db_prefix}calendar WHERE ID_EVENT = " . $context['event']['id'] . " LIMIT 1", __FILE__, __LINE__); $row = mysql_fetch_assoc($request); mysql_free_result($request); // Make sure the user is allowed to edit this event. if ($row['ID_MEMBER'] != $ID_MEMBER) isAllowedTo('calendar_edit_any'); elseif (!allowedTo('calendar_edit_any')) isAllowedTo('calendar_edit_own'); $context['event']['month'] = $row['month']; $context['event']['day'] = $row['day']; $context['event']['year'] = $row['year']; $context['event']['title'] = $row['title']; $context['event']['span'] = $row['span'] + 1; } else { $today = getdate(); // You must have a month and year specified! if (!isset($_REQUEST['month'])) $_REQUEST['month'] = $today['mon']; if (!isset($_REQUEST['year'])) $_REQUEST['year'] = $today['year']; $context['event']['month'] = (int) $_REQUEST['month']; $context['event']['year'] = (int) $_REQUEST['year']; $context['event']['day'] = isset($_REQUEST['day']) ? $_REQUEST['day'] : ($_REQUEST['month'] == $today['mon'] ? $today['mday'] : 0); $context['event']['span'] = isset($_REQUEST['span']) ? $_REQUEST['span'] : 1; // Make sure the year and month are in the valid range. if ($context['event']['month'] < 1 || $context['event']['month'] > 12) fatal_lang_error('calendar1', false); if ($context['event']['year'] < $modSettings['cal_minyear'] || $context['event']['year'] > $modSettings['cal_maxyear']) fatal_lang_error('calendar2', false); // Get a list of boards they can post in. $boards = boardsAllowedTo('post_new'); if (empty($boards)) fatal_lang_error('cannot_post_new'); $request = db_query(" SELECT c.name AS catName, c.ID_CAT, b.ID_BOARD, b.name AS boardName, b.childLevel FROM {$db_prefix}boards AS b LEFT JOIN {$db_prefix}categories AS c ON (c.ID_CAT = b.ID_CAT) WHERE $user_info[query_see_board]" . (in_array(0, $boards) ? '' : " AND b.ID_BOARD IN (" . implode(', ', $boards) . ")"), __FILE__, __LINE__); $context['event']['boards'] = array(); while ($row = mysql_fetch_assoc($request)) $context['event']['boards'][] = array( 'id' => $row['ID_BOARD'], 'name' => $row['boardName'], 'childLevel' => $row['childLevel'], 'prefix' => str_repeat(' ', $row['childLevel'] * 3), 'cat' => array( 'id' => $row['ID_CAT'], 'name' => $row['catName'] ) ); mysql_free_result($request); } // Find the last day of the month. $context['event']['last_day'] = (int) strftime('%d', mktime(0, 0, 0, $context['event']['month'] == 12 ? 1 : $context['event']['month'] + 1, 0, $context['event']['month'] == 12 ? $context['event']['year'] + 1 : $context['event']['year'])); $context['event']['board'] = !empty($board) ? $board : $modSettings['cal_defaultboard']; } if (empty($context['post_errors'])) $context['post_errors'] = array(); // See if any new replies have come along. if (empty($_REQUEST['msg']) && !empty($topic)) { if (empty($options['no_new_reply_warning']) && isset($_REQUEST['num_replies'])) { $newReplies = $context['num_replies'] > $_REQUEST['num_replies'] ? $context['num_replies'] - $_REQUEST['num_replies'] : 0; if (!empty($newReplies)) { if ($newReplies == 1) $txt['error_new_reply'] = isset($_GET['num_replies']) ? $txt['error_new_reply_reading'] : $txt['error_new_reply']; else $txt['error_new_replies'] = sprintf(isset($_GET['num_replies']) ? $txt['error_new_replies_reading'] : $txt['error_new_replies'], $newReplies); // If they've come from the display page then we treat the error differently.... if (isset($_GET['num_replies'])) $newRepliesError = $newReplies; else $context['post_error'][$newReplies == 1 ? 'new_reply' : 'new_replies'] = true; $modSettings['topicSummaryPosts'] = $newReplies > $modSettings['topicSummaryPosts'] ? max($modSettings['topicSummaryPosts'], 5) : $modSettings['topicSummaryPosts']; } } // Check whether this is a really old post being bumped... if (!empty($modSettings['oldTopicDays']) && $lastPostTime + $modSettings['oldTopicDays'] * 86400 < time() && empty($sticky) && !isset($_REQUEST['subject'])) $oldTopicError = true; } // Get a response prefix (like 'Re:') in the default forum language. if (!isset($context['response_prefix']) && !($context['response_prefix'] = cache_get_data('response_prefix'))) { if ($language === $user_info['language']) $context['response_prefix'] = $txt['response_prefix']; else { loadLanguage('index', $language, false); $context['response_prefix'] = $txt['response_prefix']; loadLanguage('index'); } cache_put_data('response_prefix', $context['response_prefix'], 600); } // Previewing, modifying, or posting? if (isset($_REQUEST['message']) || !empty($context['post_error'])) { // Validate inputs. if (empty($context['post_error'])) { if ($func['htmltrim']($_REQUEST['subject']) == '') $context['post_error']['no_subject'] = true; if ($func['htmltrim']($_REQUEST['message']) == '') $context['post_error']['no_message'] = true; if (!empty($modSettings['max_messageLength']) && $func['strlen']($_REQUEST['message']) > $modSettings['max_messageLength']) $context['post_error']['long_message'] = true; // Are you... a guest? if ($user_info['is_guest']) { $_REQUEST['guestname'] = !isset($_REQUEST['guestname']) ? '' : trim($_REQUEST['guestname']); $_REQUEST['email'] = !isset($_REQUEST['email']) ? '' : trim($_REQUEST['email']); // Validate the name and email. if (!isset($_REQUEST['guestname']) || trim(strtr($_REQUEST['guestname'], '_', ' ')) == '') $context['post_error']['no_name'] = true; elseif ($func['strlen']($_REQUEST['guestname']) > 25) $context['post_error']['long_name'] = true; else { require_once($sourcedir . '/Subs-Members.php'); if (isReservedName(htmlspecialchars($_REQUEST['guestname']), 0, true, false)) { $context['post_error']['bad_name'] = true; } } if (empty($modSettings['guest_post_no_email'])) { if (!isset($_REQUEST['email']) || $_REQUEST['email'] == '') $context['post_error']['no_email'] = true; elseif (preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', stripslashes($_REQUEST['email'])) == 0) $context['post_error']['bad_email'] = true; } } // This is self explanatory - got any questions? if (isset($_REQUEST['question']) && trim($_REQUEST['question']) == '') $context['post_error']['no_question'] = true; // This means they didn't click Post and get an error. $really_previewing = true; } else { if (!isset($_REQUEST['subject'])) $_REQUEST['subject'] = ''; if (!isset($_REQUEST['message'])) $_REQUEST['message'] = ''; if (!isset($_REQUEST['icon'])) $_REQUEST['icon'] = 'xx'; $really_previewing = false; } // Set up the inputs for the form. $form_subject = strtr($func['htmlspecialchars'](stripslashes($_REQUEST['subject'])), array("\r" => '', "\n" => '', "\t" => '')); $form_message = $func['htmlspecialchars'](stripslashes($_REQUEST['message']), ENT_QUOTES); // Make sure the subject isn't too long - taking into account special characters. if ($func['strlen']($form_subject) > 100) $form_subject = $func['substr']($form_subject, 0, 100); // Have we inadvertently trimmed off the subject of useful information? if ($func['htmltrim']($form_subject) === '') $context['post_error']['no_subject'] = true; // Any errors occurred? if (!empty($context['post_error'])) { loadLanguage('Errors'); $context['error_type'] = 'minor'; $context['post_error']['messages'] = array(); foreach ($context['post_error'] as $post_error => $dummy) { if ($post_error == 'messages') continue; $context['post_error']['messages'][] = $txt['error_' . $post_error]; // If it's not a minor error flag it as such. if (!in_array($post_error, array('new_reply', 'new_replies', 'old_topic'))) $context['error_type'] = 'serious'; } } if (isset($_REQUEST['poll'])) { $context['question'] = isset($_REQUEST['question']) ? $func['htmlspecialchars'](stripslashes(trim($_REQUEST['question']))) : ''; $context['choices'] = array(); $choice_id = 0; $_POST['options'] = empty($_POST['options']) ? array() : htmlspecialchars__recursive(stripslashes__recursive($_POST['options'])); foreach ($_POST['options'] as $option) { if (trim($option) == '') continue; $context['choices'][] = array( 'id' => $choice_id++, 'number' => $choice_id, 'label' => $option, 'is_last' => false ); } if (count($context['choices']) < 2) { $context['choices'][] = array( 'id' => $choice_id++, 'number' => $choice_id, 'label' => '', 'is_last' => false ); $context['choices'][] = array( 'id' => $choice_id++, 'number' => $choice_id, 'label' => '', 'is_last' => false ); } $context['choices'][count($context['choices']) - 1]['is_last'] = true; } // Are you... a guest? if ($user_info['is_guest']) { $_REQUEST['guestname'] = !isset($_REQUEST['guestname']) ? '' : trim($_REQUEST['guestname']); $_REQUEST['email'] = !isset($_REQUEST['email']) ? '' : trim($_REQUEST['email']); $_REQUEST['guestname'] = htmlspecialchars($_REQUEST['guestname']); $context['name'] = $_REQUEST['guestname']; $_REQUEST['email'] = htmlspecialchars($_REQUEST['email']); $context['email'] = $_REQUEST['email']; $user_info['name'] = $_REQUEST['guestname']; } // Only show the preview stuff if they hit Preview. if ($really_previewing == true || isset($_REQUEST['xml'])) { // Set up the preview message and subject and censor them... $context['preview_message'] = $form_message; preparsecode($form_message, true); preparsecode($context['preview_message']); // Do all bulletin board code tags, with or without smileys. $context['preview_message'] = parse_bbc($context['preview_message'], isset($_REQUEST['ns']) ? 0 : 1); if ($form_subject != '') { $context['preview_subject'] = $form_subject; censorText($context['preview_subject']); censorText($context['preview_message']); } else $context['preview_subject'] = '' . $txt[24] . ''; // Protect any CDATA blocks. if (isset($_REQUEST['xml'])) $context['preview_message'] = strtr($context['preview_message'], array(']]>' => ']]]]>')); } // Set up the checkboxes. $context['notify'] = !empty($_REQUEST['notify']); $context['use_smileys'] = !isset($_REQUEST['ns']); $context['icon'] = isset($_REQUEST['icon']) ? preg_replace('~[\./\\\\*\':"<>]~', '', $_REQUEST['icon']) : 'xx'; // Set the destination action for submission. $context['destination'] = 'post2;start=' . $_REQUEST['start'] . (isset($_REQUEST['msg']) ? ';msg=' . $_REQUEST['msg'] . ';sesc=' . $sc : '') . (isset($_REQUEST['poll']) ? ';poll' : ''); $context['submit_label'] = isset($_REQUEST['msg']) ? $txt[10] : $txt[105]; // Previewing an edit? if (isset($_REQUEST['msg']) && !empty($topic)) { // Get the existing message. $request = db_query(" SELECT m.ID_MEMBER, m.modifiedTime, m.smileysEnabled, m.body, m.posterName, m.posterEmail, m.subject, m.icon, IFNULL(a.size, -1) AS filesize, a.filename, a.ID_ATTACH, t.ID_MEMBER_STARTED AS ID_MEMBER_POSTER, m.posterTime FROM ({$db_prefix}messages AS m, {$db_prefix}topics AS t) LEFT JOIN {$db_prefix}attachments AS a ON (a.ID_MSG = m.ID_MSG AND a.attachmentType = 0) WHERE m.ID_MSG = " . (int) $_REQUEST['msg'] . " AND m.ID_TOPIC = $topic AND t.ID_TOPIC = $topic", __FILE__, __LINE__); // The message they were trying to edit was most likely deleted. // !!! Change this error message? if (mysql_num_rows($request) == 0) fatal_lang_error('smf232', false); $row = mysql_fetch_assoc($request); $attachment_stuff = array($row); while ($row2 = mysql_fetch_assoc($request)) $attachment_stuff[] = $row2; mysql_free_result($request); if ($row['ID_MEMBER'] == $ID_MEMBER && !allowedTo('modify_any')) { // Give an extra five minutes over the disable time threshold, so they can type. if (!empty($modSettings['edit_disable_time']) && $row['posterTime'] + ($modSettings['edit_disable_time'] + 5) * 60 < time()) fatal_lang_error('modify_post_time_passed', false); elseif ($row['ID_MEMBER_POSTER'] == $ID_MEMBER && !allowedTo('modify_own')) isAllowedTo('modify_replies'); else isAllowedTo('modify_own'); } elseif ($row['ID_MEMBER_POSTER'] == $ID_MEMBER && !allowedTo('modify_any')) isAllowedTo('modify_replies'); else isAllowedTo('modify_any'); if (!empty($modSettings['attachmentEnable'])) { $request = db_query(" SELECT IFNULL(size, -1) AS filesize, filename, ID_ATTACH FROM {$db_prefix}attachments WHERE ID_MSG = " . (int) $_REQUEST['msg'] . " AND attachmentType = 0", __FILE__, __LINE__); while ($row = mysql_fetch_assoc($request)) { if ($row['filesize'] <= 0) continue; $context['current_attachments'][] = array( 'name' => $row['filename'], 'id' => $row['ID_ATTACH'] ); } mysql_free_result($request); } // Allow moderators to change names.... if (allowedTo('moderate_forum') && !empty($topic)) { $request = db_query(" SELECT ID_MEMBER, posterName, posterEmail FROM {$db_prefix}messages WHERE ID_MSG = " . (int) $_REQUEST['msg'] . " AND ID_TOPIC = $topic LIMIT 1", __FILE__, __LINE__); $row = mysql_fetch_assoc($request); mysql_free_result($request); if (empty($row['ID_MEMBER'])) { $context['name'] = htmlspecialchars($row['posterName']); $context['email'] = htmlspecialchars($row['posterEmail']); } } } // No check is needed, since nothing is really posted. checkSubmitOnce('free'); } // Editing a message... elseif (isset($_REQUEST['msg']) && !empty($topic)) { checkSession('get'); // Get the existing message. $request = db_query(" SELECT m.ID_MEMBER, m.modifiedTime, m.smileysEnabled, m.body, m.posterName, m.posterEmail, m.subject, m.icon, IFNULL(a.size, -1) AS filesize, a.filename, a.ID_ATTACH, t.ID_MEMBER_STARTED AS ID_MEMBER_POSTER, m.posterTime FROM ({$db_prefix}messages AS m, {$db_prefix}topics AS t) LEFT JOIN {$db_prefix}attachments AS a ON (a.ID_MSG = m.ID_MSG AND a.attachmentType = 0) WHERE m.ID_MSG = " . (int) $_REQUEST['msg'] . " AND m.ID_TOPIC = $topic AND t.ID_TOPIC = $topic", __FILE__, __LINE__); // The message they were trying to edit was most likely deleted. // !!! Change this error message? if (mysql_num_rows($request) == 0) fatal_lang_error('smf232', false); $row = mysql_fetch_assoc($request); $attachment_stuff = array($row); while ($row2 = mysql_fetch_assoc($request)) $attachment_stuff[] = $row2; mysql_free_result($request); if ($row['ID_MEMBER'] == $ID_MEMBER && !allowedTo('modify_any')) { // Give an extra five minutes over the disable time threshold, so they can type. if (!empty($modSettings['edit_disable_time']) && $row['posterTime'] + ($modSettings['edit_disable_time'] + 5) * 60 < time()) fatal_lang_error('modify_post_time_passed', false); elseif ($row['ID_MEMBER_POSTER'] == $ID_MEMBER && !allowedTo('modify_own')) isAllowedTo('modify_replies'); else isAllowedTo('modify_own'); } elseif ($row['ID_MEMBER_POSTER'] == $ID_MEMBER && !allowedTo('modify_any')) isAllowedTo('modify_replies'); else isAllowedTo('modify_any'); // When was it last modified? if (!empty($row['modifiedTime'])) $context['last_modified'] = timeformat($row['modifiedTime']); // Get the stuff ready for the form. $form_subject = $row['subject']; $form_message = un_preparsecode($row['body']); censorText($form_message); censorText($form_subject); // Check the boxes that should be checked. $context['use_smileys'] = !empty($row['smileysEnabled']); $context['icon'] = $row['icon']; // Load up 'em attachments! foreach ($attachment_stuff as $attachment) { if ($attachment['filesize'] >= 0 && !empty($modSettings['attachmentEnable'])) $context['current_attachments'][] = array( 'name' => $attachment['filename'], 'id' => $attachment['ID_ATTACH'] ); } // Allow moderators to change names.... if (allowedTo('moderate_forum') && empty($row['ID_MEMBER'])) { $context['name'] = htmlspecialchars($row['posterName']); $context['email'] = htmlspecialchars($row['posterEmail']); } // Set the destinaton. $context['destination'] = 'post2;start=' . $_REQUEST['start'] . ';msg=' . $_REQUEST['msg'] . ';sesc=' . $sc . (isset($_REQUEST['poll']) ? ';poll' : ''); $context['submit_label'] = $txt[10]; } // Posting... else { // By default.... $context['use_smileys'] = true; $context['icon'] = 'xx'; if ($user_info['is_guest']) { $context['name'] = ''; $context['email'] = ''; } $context['destination'] = 'post2;start=' . $_REQUEST['start'] . (isset($_REQUEST['poll']) ? ';poll' : ''); $context['submit_label'] = $txt[105]; // Posting a quoted reply? if (!empty($topic) && !empty($_REQUEST['quote'])) { checkSession('get'); // Make sure they _can_ quote this post, and if so get it. $request = db_query(" SELECT m.subject, IFNULL(mem.realName, m.posterName) AS posterName, m.posterTime, m.body FROM ({$db_prefix}messages AS m, {$db_prefix}boards AS b) LEFT JOIN {$db_prefix}members AS mem ON (mem.ID_MEMBER = m.ID_MEMBER) WHERE m.ID_MSG = " . (int) $_REQUEST['quote'] . " AND b.ID_BOARD = m.ID_BOARD AND $user_info[query_see_board] LIMIT 1", __FILE__, __LINE__); if (mysql_num_rows($request) == 0) fatal_lang_error('quoted_post_deleted', false); list ($form_subject, $mname, $mdate, $form_message) = mysql_fetch_row($request); mysql_free_result($request); // Add 'Re: ' to the front of the quoted subject. if (trim($context['response_prefix']) != '' && $func['strpos']($form_subject, trim($context['response_prefix'])) !== 0) $form_subject = $context['response_prefix'] . $form_subject; // Censor the message and subject. censorText($form_message); censorText($form_subject); $form_message = preg_replace('~~i', "\n", $form_message); // Remove any nested quotes, if necessary. if (!empty($modSettings['removeNestedQuotes'])) $form_message = preg_replace(array('~\n?\[quote.*?\].+?\[/quote\]\n?~is', '~^\n~', '~\[/quote\]~'), '', $form_message); // Add a quote string on the front and end. $form_message = '[quote author=' . $mname . ' link=topic=' . $topic . '.msg' . (int) $_REQUEST['quote'] . '#msg' . (int) $_REQUEST['quote'] . ' date=' . $mdate . ']' . "\n" . $form_message . "\n" . '[/quote]'; } // Posting a reply without a quote? elseif (!empty($topic) && empty($_REQUEST['quote'])) { // Get the first message's subject. $form_subject = $first_subject; // Add 'Re: ' to the front of the subject. if (trim($context['response_prefix']) != '' && $form_subject != '' && $func['strpos']($form_subject, trim($context['response_prefix'])) !== 0) $form_subject = $context['response_prefix'] . $form_subject; // Censor the subject. censorText($form_subject); $form_message = ''; } else { $form_subject = isset($_GET['subject']) ? $_GET['subject'] : ''; $form_message = ''; } } // !!! This won't work if you're posting an event. if (allowedTo('post_attachment')) { if (empty($_SESSION['temp_attachments'])) $_SESSION['temp_attachments'] = array(); // If this isn't a new post, check the current attachments. if (isset($_REQUEST['msg'])) { $request = db_query(" SELECT COUNT(*), SUM(size) FROM {$db_prefix}attachments WHERE ID_MSG = " . (int) $_REQUEST['msg'] . " AND attachmentType = 0", __FILE__, __LINE__); list ($quantity, $total_size) = mysql_fetch_row($request); mysql_free_result($request); } else { $quantity = 0; $total_size = 0; } $temp_start = 0; if (!empty($_SESSION['temp_attachments'])) foreach ($_SESSION['temp_attachments'] as $attachID => $name) { $temp_start++; if (preg_match('~^post_tmp_' . $ID_MEMBER . '_\d+$~', $attachID) == 0) { unset($_SESSION['temp_attachments'][$attachID]); continue; } if (!empty($_POST['attach_del']) && !in_array($attachID, $_POST['attach_del'])) { $deleted_attachments = true; unset($_SESSION['temp_attachments'][$attachID]); @unlink($modSettings['attachmentUploadDir'] . '/' . $attachID); continue; } $quantity++; $total_size += filesize($modSettings['attachmentUploadDir'] . '/' . $attachID); $context['current_attachments'][] = array( 'name' => $name, 'id' => $attachID ); } if (!empty($_POST['attach_del'])) { $del_temp = array(); foreach ($_POST['attach_del'] as $i => $dummy) $del_temp[$i] = (int) $dummy; foreach ($context['current_attachments'] as $k => $dummy) if (!in_array($dummy['id'], $del_temp)) { $context['current_attachments'][$k]['unchecked'] = true; $deleted_attachments = !isset($deleted_attachments) || is_bool($deleted_attachments) ? 1 : $deleted_attachments + 1; $quantity--; } } if (!empty($_FILES['attachment'])) foreach ($_FILES['attachment']['tmp_name'] as $n => $dummy) { if ($_FILES['attachment']['name'][$n] == '') continue; if (!is_uploaded_file($_FILES['attachment']['tmp_name'][$n]) || (@ini_get('open_basedir') == '' && !file_exists($_FILES['attachment']['tmp_name'][$n]))) fatal_lang_error('smf124'); if (!empty($modSettings['attachmentSizeLimit']) && $_FILES['attachment']['size'][$n] > $modSettings['attachmentSizeLimit'] * 1024) fatal_lang_error('smf122', false, array($modSettings['attachmentSizeLimit'])); $quantity++; if (!empty($modSettings['attachmentNumPerPostLimit']) && $quantity > $modSettings['attachmentNumPerPostLimit']) fatal_lang_error('attachments_limit_per_post', false, array($modSettings['attachmentNumPerPostLimit'])); $total_size += $_FILES['attachment']['size'][$n]; if (!empty($modSettings['attachmentPostLimit']) && $total_size > $modSettings['attachmentPostLimit'] * 1024) fatal_lang_error('smf122', false, array($modSettings['attachmentPostLimit'])); if (!empty($modSettings['attachmentCheckExtensions'])) { if (!in_array(strtolower(substr(strrchr($_FILES['attachment']['name'][$n], '.'), 1)), explode(',', strtolower($modSettings['attachmentExtensions'])))) fatal_error($_FILES['attachment']['name'][$n] . '.
' . $txt['smf123'] . ' ' . $modSettings['attachmentExtensions'] . '.', false); } if (!empty($modSettings['attachmentDirSizeLimit'])) { // Make sure the directory isn't full. $dirSize = 0; $dir = @opendir($modSettings['attachmentUploadDir']) or fatal_lang_error('smf115b'); while ($file = readdir($dir)) { if (substr($file, 0, -1) == '.') continue; if (preg_match('~^post_tmp_\d+_\d+$~', $file) != 0) { // Temp file is more than 5 hours old! if (filemtime($modSettings['attachmentUploadDir'] . '/' . $file) < time() - 18000) @unlink($modSettings['attachmentUploadDir'] . '/' . $file); continue; } $dirSize += filesize($modSettings['attachmentUploadDir'] . '/' . $file); } closedir($dir); // Too big! Maybe you could zip it or something... if ($_FILES['attachment']['size'][$n] + $dirSize > $modSettings['attachmentDirSizeLimit'] * 1024) fatal_lang_error('smf126'); } if (!is_writable($modSettings['attachmentUploadDir'])) fatal_lang_error('attachments_no_write'); $attachID = 'post_tmp_' . $ID_MEMBER . '_' . $temp_start++; $_SESSION['temp_attachments'][$attachID] = stripslashes(basename($_FILES['attachment']['name'][$n])); $context['current_attachments'][] = array( 'name' => basename(stripslashes($_FILES['attachment']['name'][$n])), 'id' => $attachID ); $destName = $modSettings['attachmentUploadDir'] . '/' . $attachID; if (!move_uploaded_file($_FILES['attachment']['tmp_name'][$n], $destName)) fatal_lang_error('smf124'); @chmod($destName, 0644); } } // If we are coming here to make a reply, and someone has already replied... make a special warning message. if (isset($newRepliesError)) { $context['post_error']['messages'][] = $newRepliesError == 1 ? $txt['error_new_reply'] : $txt['error_new_replies']; $context['error_type'] = 'minor'; } if (isset($oldTopicError)) { $context['post_error']['messages'][] = $txt['error_old_topic']; $context['error_type'] = 'minor'; } // What are you doing? Posting a poll, modifying, previewing, new post, or reply... if (isset($_REQUEST['poll'])) $context['page_title'] = $txt['smf20']; elseif ($context['make_event']) $context['page_title'] = $context['event']['id'] == -1 ? $txt['calendar23'] : $txt['calendar20']; elseif (isset($_REQUEST['msg'])) $context['page_title'] = $txt[66]; elseif (isset($_REQUEST['subject'], $context['preview_subject'])) $context['page_title'] = $txt[507] . ' - ' . strip_tags($context['preview_subject']); elseif (empty($topic)) $context['page_title'] = $txt[33]; else $context['page_title'] = $txt[25]; // Build the link tree. if (empty($topic)) $context['linktree'][] = array( 'name' => '' . $txt[33] . '' ); else $context['linktree'][] = array( 'url' => $scripturl . '?topic=' . $topic . '.' . $_REQUEST['start'], 'name' => $form_subject, 'extra_before' => '' . $context['page_title'] . ' ( ', 'extra_after' => ' )' ); // If they've unchecked an attachment, they may still want to attach that many more files, but don't allow more than num_allowed_attachments. // !!! This won't work if you're posting an event. $context['num_allowed_attachments'] = min($modSettings['attachmentNumPerPostLimit'] - count($context['current_attachments']) + (isset($deleted_attachments) ? $deleted_attachments : 0), $modSettings['attachmentNumPerPostLimit']); $context['can_post_attachment'] = !empty($modSettings['attachmentEnable']) && $modSettings['attachmentEnable'] == 1 && allowedTo('post_attachment') && $context['num_allowed_attachments'] > 0; $context['subject'] = addcslashes($form_subject, '"'); $context['message'] = str_replace(array('"', '<', '>', ' '), array('"', '<', '>', '  '), $form_message); $context['attached'] = ''; $context['allowed_extensions'] = strtr($modSettings['attachmentExtensions'], array(',' => ', ')); $context['make_poll'] = isset($_REQUEST['poll']); // Message icons - customized icons are off? if (empty($modSettings['messageIcons_enable'])) { $context['icons'] = array( array('value' => 'xx', 'name' => $txt[281]), array('value' => 'thumbup', 'name' => $txt[282]), array('value' => 'thumbdown', 'name' => $txt[283]), array('value' => 'exclamation', 'name' => $txt[284]), array('value' => 'question', 'name' => $txt[285]), array('value' => 'lamp', 'name' => $txt[286]), array('value' => 'smiley', 'name' => $txt[287]), array('value' => 'angry', 'name' => $txt[288]), array('value' => 'cheesy', 'name' => $txt[289]), array('value' => 'grin', 'name' => $txt[293]), array('value' => 'sad', 'name' => $txt[291]), array('value' => 'wink', 'name' => $txt[292]) ); foreach ($context['icons'] as $k => $dummy) { $context['icons'][$k]['url'] = $settings['images_url'] . '/post/' . $dummy['value'] . '.gif'; $context['icons'][$k]['is_last'] = false; } $context['icon_url'] = $settings['images_url'] . '/post/' . $context['icon'] . '.gif'; } // Otherwise load the icons, and check we give the right image too... else { // Regardless of what *should* exist, let's do this properly. $stable_icons = array('xx', 'thumbup', 'thumbdown', 'exclamation', 'question', 'lamp', 'smiley', 'angry', 'cheesy', 'grin', 'sad', 'wink', 'moved', 'recycled', 'wireless'); $context['icon_sources'] = array(); foreach ($stable_icons as $icon) $context['icon_sources'][$icon] = 'images_url'; // Array for all icons that need to revert to the default theme! $context['javascript_icons'] = array(); if (($temp = cache_get_data('posting_icons-' . $board, 480)) == null) { $request = db_query(" SELECT title, filename FROM {$db_prefix}message_icons WHERE ID_BOARD IN (0, $board)", __FILE__, __LINE__); $icon_data = array(); while ($row = mysql_fetch_assoc($request)) $icon_data[] = $row; mysql_free_result($request); cache_put_data('posting_icons-' . $board, $icon_data, 480); } else $icon_data = $temp; $context['icons'] = array(); foreach ($icon_data as $icon) { if (!isset($context['icon_sources'][$icon['filename']])) $context['icon_sources'][$icon['filename']] = file_exists($settings['theme_dir'] . '/images/post/' . $icon['filename'] . '.gif') ? 'images_url' : 'default_images_url'; // If the icon exists only in the default theme, ensure the javascript popup respects this. if ($context['icon_sources'][$icon['filename']] == 'default_images_url') $context['javascript_icons'][] = $icon['filename']; $context['icons'][] = array( 'value' => $icon['filename'], 'name' => $icon['title'], 'url' => $settings[$context['icon_sources'][$icon['filename']]] . '/post/' . $icon['filename'] . '.gif', 'is_last' => false, ); } $context['icon_url'] = $settings[isset($context['icon_sources'][$context['icon']]) ? $context['icon_sources'][$context['icon']] : 'images_url'] . '/post/' . $context['icon'] . '.gif'; } if (!empty($context['icons'])) $context['icons'][count($context['icons']) - 1]['is_last'] = true; $found = false; for ($i = 0, $n = count($context['icons']); $i < $n; $i++) { $context['icons'][$i]['selected'] = $context['icon'] == $context['icons'][$i]['value']; if ($context['icons'][$i]['selected']) $found = true; } if (!$found) array_unshift($context['icons'], array( 'value' => $context['icon'], 'name' => $txt['current_icon'], 'url' => $context['icon_url'], 'is_last' => empty($context['icons']), 'selected' => true, )); if (!empty($topic)) getTopic(); $context['back_to_topic'] = isset($_REQUEST['goback']) || (isset($_REQUEST['msg']) && !isset($_REQUEST['subject'])); $context['show_additional_options'] = !empty($_POST['additional_options']) || !empty($_SESSION['temp_attachments']) || !empty($deleted_attachments); $context['is_new_topic'] = empty($topic); $context['is_new_post'] = !isset($_REQUEST['msg']); $context['is_first_post'] = $context['is_new_topic'] || (isset($_REQUEST['msg']) && $_REQUEST['msg'] == $ID_FIRST_MSG); // Register this form in the session variables. checkSubmitOnce('register'); // Finally, load the template. if (WIRELESS) $context['sub_template'] = WIRELESS_PROTOCOL . '_post'; elseif (!isset($_REQUEST['xml'])) loadTemplate('Post'); } function Post2() { global $board, $topic, $txt, $db_prefix, $modSettings, $sourcedir, $context; global $ID_MEMBER, $user_info, $board_info, $options, $func; // Previewing? Go back to start. if (isset($_REQUEST['preview'])) return Post(); // Prevent double submission of this form. checkSubmitOnce('check'); // No errors as yet. $post_errors = array(); // If the session has timed out, let the user re-submit their form. if (checkSession('post', '', false) != '') $post_errors[] = 'session_timeout'; require_once($sourcedir . '/Subs-Post.php'); loadLanguage('Post'); // Replying to a topic? if (!empty($topic) && !isset($_REQUEST['msg'])) { $request = db_query(" SELECT t.locked, t.isSticky, t.ID_POLL, t.numReplies, m.ID_MEMBER FROM ({$db_prefix}topics AS t, {$db_prefix}messages AS m) WHERE t.ID_TOPIC = $topic AND m.ID_MSG = t.ID_FIRST_MSG LIMIT 1", __FILE__, __LINE__); list ($tmplocked, $tmpstickied, $pollID, $numReplies, $ID_MEMBER_POSTER) = mysql_fetch_row($request); mysql_free_result($request); // Don't allow a post if it's locked. if ($tmplocked != 0 && !allowedTo('moderate_board')) fatal_lang_error(90, false); // Sorry, multiple polls aren't allowed... yet. You should stop giving me ideas :P. if (isset($_REQUEST['poll']) && $pollID > 0) unset($_REQUEST['poll']); if ($ID_MEMBER_POSTER != $ID_MEMBER) isAllowedTo('post_reply_any'); elseif (!allowedTo('post_reply_any')) isAllowedTo('post_reply_own'); if (isset($_POST['lock'])) { // Nothing is changed to the lock. if ((empty($tmplocked) && empty($_POST['lock'])) || (!empty($_POST['lock']) && !empty($tmplocked))) unset($_POST['lock']); // You're have no permission to lock this topic. elseif (!allowedTo(array('lock_any', 'lock_own')) || (!allowedTo('lock_any') && $ID_MEMBER != $ID_MEMBER_POSTER)) unset($_POST['lock']); // You are allowed to (un)lock your own topic only. elseif (!allowedTo('lock_any')) { // You cannot override a moderator lock. if ($tmplocked == 1) unset($_POST['lock']); else $_POST['lock'] = empty($_POST['lock']) ? 0 : 2; } // Hail mighty moderator, (un)lock this topic immediately. else $_POST['lock'] = empty($_POST['lock']) ? 0 : 1; } // So you wanna (un)sticky this...let's see. if (isset($_POST['sticky']) && (empty($modSettings['enableStickyTopics']) || $_POST['sticky'] == $tmpstickied || !allowedTo('make_sticky'))) unset($_POST['sticky']); // If the number of replies has changed, if the setting is enabled, go back to Post() - which handles the error. $newReplies = isset($_POST['num_replies']) && $numReplies > $_POST['num_replies'] ? $numReplies - $_POST['num_replies'] : 0; if (empty($options['no_new_reply_warning']) && !empty($newReplies)) { $_REQUEST['preview'] = true; return Post(); } $posterIsGuest = $user_info['is_guest']; } // Posting a new topic. elseif (empty($topic)) { // Now don't be silly, new topics will get their own id_msg soon enough. unset($_REQUEST['msg'], $_POST['msg'], $_GET['msg']); if (!isset($_REQUEST['poll']) || $modSettings['pollMode'] != '1') isAllowedTo('post_new'); if (isset($_POST['lock'])) { // New topics are by default not locked. if (empty($_POST['lock'])) unset($_POST['lock']); // Besides, you need permission. elseif (!allowedTo(array('lock_any', 'lock_own'))) unset($_POST['lock']); // A moderator-lock (1) can override a user-lock (2). else $_POST['lock'] = allowedTo('lock_any') ? 1 : 2; } if (isset($_POST['sticky']) && (empty($modSettings['enableStickyTopics']) || empty($_POST['sticky']) || !allowedTo('make_sticky'))) unset($_POST['sticky']); $posterIsGuest = $user_info['is_guest']; } // Modifying an existing message? elseif (isset($_REQUEST['msg']) && !empty($topic)) { $_REQUEST['msg'] = (int) $_REQUEST['msg']; $request = db_query(" SELECT m.ID_MEMBER, m.posterName, m.posterEmail, m.posterTime, t.ID_FIRST_MSG, t.locked, t.isSticky, t.ID_MEMBER_STARTED AS ID_MEMBER_POSTER FROM ({$db_prefix}messages AS m, {$db_prefix}topics AS t) WHERE m.ID_MSG = $_REQUEST[msg] AND t.ID_TOPIC = $topic LIMIT 1", __FILE__, __LINE__); if (mysql_num_rows($request) == 0) fatal_lang_error('smf272', false); $row = mysql_fetch_assoc($request); mysql_free_result($request); if (!empty($row['locked']) && !allowedTo('moderate_board')) fatal_lang_error(90, false); if (isset($_POST['lock'])) { // Nothing changes to the lock status. if ((empty($_POST['lock']) && empty($row['locked'])) || (!empty($_POST['lock']) && !empty($row['locked']))) unset($_POST['lock']); // You're simply not allowed to (un)lock this. elseif (!allowedTo(array('lock_any', 'lock_own')) || (!allowedTo('lock_any') && $ID_MEMBER != $row['ID_MEMBER_POSTER'])) unset($_POST['lock']); // You're only allowed to lock your own topics. elseif (!allowedTo('lock_any')) { // You're not allowed to break a moderator's lock. if ($row['locked'] == 1) unset($_POST['lock']); // Lock it with a soft lock or unlock it. else $_POST['lock'] = empty($_POST['lock']) ? 0 : 2; } // You must be the moderator. else $_POST['lock'] = empty($_POST['lock']) ? 0 : 1; } // Change the sticky status of this topic? if (isset($_POST['sticky']) && (!allowedTo('make_sticky') || $_POST['sticky'] == $row['isSticky'])) unset($_POST['sticky']); if ($row['ID_MEMBER'] == $ID_MEMBER && !allowedTo('modify_any')) { if (!empty($modSettings['edit_disable_time']) && $row['posterTime'] + ($modSettings['edit_disable_time'] + 5) * 60 < time()) fatal_lang_error('modify_post_time_passed', false); elseif ($row['ID_MEMBER_POSTER'] == $ID_MEMBER && !allowedTo('modify_own')) isAllowedTo('modify_replies'); else isAllowedTo('modify_own'); } elseif ($row['ID_MEMBER_POSTER'] == $ID_MEMBER && !allowedTo('modify_any')) { isAllowedTo('modify_replies'); // If you're modifying a reply, I say it better be logged... $moderationAction = true; } else { isAllowedTo('modify_any'); // Log it, assuming you're not modifying your own post. if ($row['ID_MEMBER'] != $ID_MEMBER) $moderationAction = true; } $posterIsGuest = empty($row['ID_MEMBER']); if (!allowedTo('moderate_forum') || !$posterIsGuest) { $_POST['guestname'] = addslashes($row['posterName']); $_POST['email'] = addslashes($row['posterEmail']); } } // If the poster is a guest evaluate the legality of name and email. if ($posterIsGuest) { $_POST['guestname'] = !isset($_POST['guestname']) ? '' : trim($_POST['guestname']); $_POST['email'] = !isset($_POST['email']) ? '' : trim($_POST['email']); if ($_POST['guestname'] == '' || $_POST['guestname'] == '_') $post_errors[] = 'no_name'; if ($func['strlen']($_POST['guestname']) > 25) $post_errors[] = 'long_name'; if (empty($modSettings['guest_post_no_email'])) { // Only check if they changed it! if (!isset($row) || $row['posterEmail'] != $_POST['email']) { if (!allowedTo('moderate_forum') && (!isset($_POST['email']) || $_POST['email'] == '')) $post_errors[] = 'no_email'; if (!allowedTo('moderate_forum') && preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', stripslashes($_POST['email'])) == 0) $post_errors[] = 'bad_email'; } // Now make sure this email address is not banned from posting. isBannedEmail($_POST['email'], 'cannot_post', sprintf($txt['you_are_post_banned'], $txt[28])); } } // Check the subject and message. if (!isset($_POST['subject']) || $func['htmltrim']($_POST['subject']) === '') $post_errors[] = 'no_subject'; if (!isset($_POST['message']) || $func['htmltrim']($_POST['message']) === '') $post_errors[] = 'no_message'; elseif (!empty($modSettings['max_messageLength']) && $func['strlen']($_POST['message']) > $modSettings['max_messageLength']) $post_errors[] = 'long_message'; else { // Prepare the message a bit for some additional testing. $_POST['message'] = $func['htmlspecialchars']($_POST['message'], ENT_QUOTES); // Preparse code. (Zef) if ($user_info['is_guest']) $user_info['name'] = $_POST['guestname']; preparsecode($_POST['message']); // Let's see if there's still some content left without the tags. if ($func['htmltrim'](strip_tags(parse_bbc($_POST['message'], false), '')) === '') $post_errors[] = 'no_message'; } if (isset($_POST['calendar']) && !isset($_REQUEST['deleteevent']) && $func['htmltrim']($_POST['evtitle']) === '') $post_errors[] = 'no_event'; // You are not! if (isset($_POST['message']) && strtolower($_POST['message']) == 'i am the administrator.' && !$user_info['is_admin']) fatal_error('Knave! Masquerader! Charlatan!', false); // Validate the poll... if (isset($_REQUEST['poll']) && $modSettings['pollMode'] == '1') { if (!empty($topic) && !isset($_REQUEST['msg'])) fatal_lang_error(1, false); // This is a new topic... so it's a new poll. if (empty($topic)) isAllowedTo('poll_post'); // Can you add to your own topics? elseif ($ID_MEMBER == $row['ID_MEMBER_POSTER'] && !allowedTo('poll_add_any')) isAllowedTo('poll_add_own'); // Can you add polls to any topic, then? else isAllowedTo('poll_add_any'); if (!isset($_POST['question']) || trim($_POST['question']) == '') $post_errors[] = 'no_question'; $_POST['options'] = empty($_POST['options']) ? array() : htmltrim__recursive($_POST['options']); // Get rid of empty ones. foreach ($_POST['options'] as $k => $option) if ($option == '') unset($_POST['options'][$k], $_POST['options'][$k]); // What are you going to vote between with one choice?!? if (count($_POST['options']) < 2) $post_errors[] = 'poll_few'; } if ($posterIsGuest) { // If user is a guest, make sure the chosen name isn't taken. require_once($sourcedir . '/Subs-Members.php'); if (isReservedName($_POST['guestname'], 0, true, false) && (!isset($row['posterName']) || $_POST['guestname'] != $row['posterName'])) $post_errors[] = 'bad_name'; } // If the user isn't a guest, get his or her name and email. elseif (!isset($_REQUEST['msg'])) { $_POST['guestname'] = addslashes($user_info['username']); $_POST['email'] = addslashes($user_info['email']); } // Any mistakes? if (!empty($post_errors)) { loadLanguage('Errors'); // Previewing. $_REQUEST['preview'] = true; $context['post_error'] = array('messages' => array()); foreach ($post_errors as $post_error) { $context['post_error'][$post_error] = true; $context['post_error']['messages'][] = $txt['error_' . $post_error]; } return Post(); } // Make sure the user isn't spamming the board. if (!isset($_REQUEST['msg'])) spamProtection('spam'); // At about this point, we're posting and that's that. ignore_user_abort(true); @set_time_limit(300); // Add special html entities to the subject, name, and email. $_POST['subject'] = strtr($func['htmlspecialchars']($_POST['subject']), array("\r" => '', "\n" => '', "\t" => '')); $_POST['guestname'] = htmlspecialchars($_POST['guestname']); $_POST['email'] = htmlspecialchars($_POST['email']); // At this point, we want to make sure the subject isn't too long. if ($func['strlen']($_POST['subject']) > 100) $_POST['subject'] = addslashes($func['substr'](stripslashes($_POST['subject']), 0, 100)); // Make the poll... if (isset($_REQUEST['poll'])) { // Make sure that the user has not entered a ridiculous number of options.. if (empty($_POST['poll_max_votes']) || $_POST['poll_max_votes'] <= 0) $_POST['poll_max_votes'] = 1; elseif ($_POST['poll_max_votes'] > count($_POST['options'])) $_POST['poll_max_votes'] = count($_POST['options']); else $_POST['poll_max_votes'] = (int) $_POST['poll_max_votes']; // Just set it to zero if it's not there.. if (!isset($_POST['poll_hide'])) $_POST['poll_hide'] = 0; else $_POST['poll_hide'] = (int) $_POST['poll_hide']; $_POST['poll_change_vote'] = isset($_POST['poll_change_vote']) ? 1 : 0; // If the user tries to set the poll too far in advance, don't let them. if (!empty($_POST['poll_expire']) && $_POST['poll_expire'] < 1) fatal_lang_error('poll_range_error', false); // Don't allow them to select option 2 for hidden results if it's not time limited. elseif (empty($_POST['poll_expire']) && $_POST['poll_hide'] == 2) $_POST['poll_hide'] = 1; // Clean up the question and answers. $_POST['question'] = $func['htmlspecialchars']($_POST['question']); $_POST['options'] = htmlspecialchars__recursive($_POST['options']); } // Check if they are trying to delete any current attachments.... if (isset($_REQUEST['msg'], $_POST['attach_del']) && allowedTo('post_attachment')) { $del_temp = array(); foreach ($_POST['attach_del'] as $i => $dummy) $del_temp[$i] = (int) $dummy; require_once($sourcedir . '/ManageAttachments.php'); removeAttachments('a.attachmentType = 0 AND a.ID_MSG = ' . (int) $_REQUEST['msg'] . ' AND a.ID_ATTACH NOT IN (' . implode(', ', $del_temp) . ')'); } // ...or attach a new file... if (isset($_FILES['attachment']['name']) || !empty($_SESSION['temp_attachments'])) { isAllowedTo('post_attachment'); // If this isn't a new post, check the current attachments. if (isset($_REQUEST['msg'])) { $request = db_query(" SELECT COUNT(*), SUM(size) FROM {$db_prefix}attachments WHERE ID_MSG = " . (int) $_REQUEST['msg'] . " AND attachmentType = 0", __FILE__, __LINE__); list ($quantity, $total_size) = mysql_fetch_row($request); mysql_free_result($request); } else { $quantity = 0; $total_size = 0; } if (!empty($_SESSION['temp_attachments'])) foreach ($_SESSION['temp_attachments'] as $attachID => $name) { if (preg_match('~^post_tmp_' . $ID_MEMBER . '_\d+$~', $attachID) == 0) continue; if (!empty($_POST['attach_del']) && !in_array($attachID, $_POST['attach_del'])) { unset($_SESSION['temp_attachments'][$attachID]); @unlink($modSettings['attachmentUploadDir'] . '/' . $attachID); continue; } $_FILES['attachment']['tmp_name'][] = $attachID; $_FILES['attachment']['name'][] = addslashes($name); $_FILES['attachment']['size'][] = filesize($modSettings['attachmentUploadDir'] . '/' . $attachID); list ($_FILES['attachment']['width'][], $_FILES['attachment']['height'][]) = @getimagesize($modSettings['attachmentUploadDir'] . '/' . $attachID); unset($_SESSION['temp_attachments'][$attachID]); } if (!isset($_FILES['attachment']['name'])) $_FILES['attachment']['tmp_name'] = array(); $attachIDs = array(); foreach ($_FILES['attachment']['tmp_name'] as $n => $dummy) { if ($_FILES['attachment']['name'][$n] == '') continue; // Have we reached the maximum number of files we are allowed? $quantity++; if (!empty($modSettings['attachmentNumPerPostLimit']) && $quantity > $modSettings['attachmentNumPerPostLimit']) fatal_lang_error('attachments_limit_per_post', false, array($modSettings['attachmentNumPerPostLimit'])); // Check the total upload size for this post... $total_size += $_FILES['attachment']['size'][$n]; if (!empty($modSettings['attachmentPostLimit']) && $total_size > $modSettings['attachmentPostLimit'] * 1024) fatal_lang_error('smf122', false, array($modSettings['attachmentPostLimit'])); $attachmentOptions = array( 'post' => isset($_REQUEST['msg']) ? $_REQUEST['msg'] : 0, 'poster' => $ID_MEMBER, 'name' => $_FILES['attachment']['name'][$n], 'tmp_name' => $_FILES['attachment']['tmp_name'][$n], 'size' => $_FILES['attachment']['size'][$n], ); if (createAttachment($attachmentOptions)) { $attachIDs[] = $attachmentOptions['id']; if (!empty($attachmentOptions['thumb'])) $attachIDs[] = $attachmentOptions['thumb']; } else { if (in_array('could_not_upload', $attachmentOptions['errors'])) fatal_lang_error('smf124'); if (in_array('too_large', $attachmentOptions['errors'])) fatal_lang_error('smf122', false, array($modSettings['attachmentSizeLimit'])); if (in_array('bad_extension', $attachmentOptions['errors'])) fatal_error($attachmentOptions['name'] . '.
' . $txt['smf123'] . ' ' . $modSettings['attachmentExtensions'] . '.', false); if (in_array('directory_full', $attachmentOptions['errors'])) fatal_lang_error('smf126'); if (in_array('bad_filename', $attachmentOptions['errors'])) fatal_error(basename($attachmentOptions['name']) . '.
' . $txt['smf130b'] . '.'); if (in_array('taken_filename', $attachmentOptions['errors'])) fatal_lang_error('smf125'); } } } // Make the poll... if (isset($_REQUEST['poll'])) { // Create the poll. db_query(" INSERT INTO {$db_prefix}polls (question, hideResults, maxVotes, expireTime, ID_MEMBER, posterName, changeVote) VALUES (SUBSTRING('$_POST[question]', 1, 255), $_POST[poll_hide], $_POST[poll_max_votes], " . (empty($_POST['poll_expire']) ? '0' : time() + $_POST['poll_expire'] * 3600 * 24) . ", $ID_MEMBER, SUBSTRING('$_POST[guestname]', 1, 255), $_POST[poll_change_vote])", __FILE__, __LINE__); $ID_POLL = db_insert_id(); // Create each answer choice. $i = 0; $setString = ''; foreach ($_POST['options'] as $option) { $setString .= " ($ID_POLL, $i, SUBSTRING('$option', 1, 255)),"; $i++; } db_query(" INSERT INTO {$db_prefix}poll_choices (ID_POLL, ID_CHOICE, label) VALUES" . substr($setString, 0, -1), __FILE__, __LINE__); } else $ID_POLL = 0; // Creating a new topic? $newTopic = empty($_REQUEST['msg']) && empty($topic); // Collect all parameters for the creation or modification of a post. $msgOptions = array( 'id' => empty($_REQUEST['msg']) ? 0 : (int) $_REQUEST['msg'], 'subject' => $_POST['subject'], 'body' => $_POST['message'], 'icon' => preg_replace('~[\./\\\\*\':"<>]~', '', $_POST['icon']), 'smileys_enabled' => !isset($_POST['ns']), 'attachments' => empty($attachIDs) ? array() : $attachIDs, ); $topicOptions = array( 'id' => empty($topic) ? 0 : $topic, 'board' => $board, 'poll' => isset($_REQUEST['poll']) ? $ID_POLL : null, 'lock_mode' => isset($_POST['lock']) ? (int) $_POST['lock'] : null, 'sticky_mode' => isset($_POST['sticky']) && !empty($modSettings['enableStickyTopics']) ? (int) $_POST['sticky'] : null, 'mark_as_read' => true, ); $posterOptions = array( 'id' => $ID_MEMBER, 'name' => $_POST['guestname'], 'email' => $_POST['email'], 'update_post_count' => !$user_info['is_guest'] && !isset($_REQUEST['msg']) && $board_info['posts_count'], ); // This is an already existing message. Edit it. if (!empty($_REQUEST['msg'])) { // Have admins allowed people to hide their screwups? if (time() - $row['posterTime'] > $modSettings['edit_wait_time'] || $ID_MEMBER != $row['ID_MEMBER']) { $msgOptions['modify_time'] = time(); $msgOptions['modify_name'] = addslashes($user_info['name']); } modifyPost($msgOptions, $topicOptions, $posterOptions); } // This is a new topic or an already existing one. Save it. else { createPost($msgOptions, $topicOptions, $posterOptions); if (isset($topicOptions['id'])) $topic = $topicOptions['id']; } // Editing or posting an event? if (isset($_POST['calendar']) && (!isset($_REQUEST['eventid']) || $_REQUEST['eventid'] == -1)) { require_once($sourcedir . '/Calendar.php'); calendarCanLink(); calendarInsertEvent($board, $topic, $_POST['evtitle'], $ID_MEMBER, $_POST['month'], $_POST['day'], $_POST['year'], isset($_POST['span']) ? $_POST['span'] : null); } elseif (isset($_POST['calendar'])) { $_REQUEST['eventid'] = (int) $_REQUEST['eventid']; // Validate the post... require_once($sourcedir . '/Subs-Post.php'); calendarValidatePost(); // If you're not allowed to edit any events, you have to be the poster. if (!allowedTo('calendar_edit_any')) { // Get the event's poster. $request = db_query(" SELECT ID_MEMBER FROM {$db_prefix}calendar WHERE ID_EVENT = $_REQUEST[eventid]", __FILE__, __LINE__); $row2 = mysql_fetch_assoc($request); mysql_free_result($request); // Silly hacker, Trix are for kids. ...probably trademarked somewhere, this is FAIR USE! (parody...) isAllowedTo('calendar_edit_' . ($row2['ID_MEMBER'] == $ID_MEMBER ? 'own' : 'any')); } // Delete it? if (isset($_REQUEST['deleteevent'])) db_query(" DELETE FROM {$db_prefix}calendar WHERE ID_EVENT = $_REQUEST[eventid] LIMIT 1", __FILE__, __LINE__); // ... or just update it? else { $span = !empty($modSettings['cal_allowspan']) && !empty($_REQUEST['span']) ? min((int) $modSettings['cal_maxspan'], (int) $_REQUEST['span'] - 1) : 0; $start_time = mktime(0, 0, 0, (int) $_REQUEST['month'], (int) $_REQUEST['day'], (int) $_REQUEST['year']); db_query(" UPDATE {$db_prefix}calendar SET endDate = '" . strftime('%Y-%m-%d', $start_time + $span * 86400) . "', startDate = '" . strftime('%Y-%m-%d', $start_time) . "', title = '" . $func['htmlspecialchars']($_REQUEST['evtitle'], ENT_QUOTES) . "' WHERE ID_EVENT = $_REQUEST[eventid] LIMIT 1", __FILE__, __LINE__); } updateStats('calendar'); } // Marking read should be done even for editing messages.... if (!$user_info['is_guest']) { // Mark all the parents read. (since you just posted and they will be unread.) if (!empty($board_info['parent_boards'])) { db_query(" UPDATE {$db_prefix}log_boards SET ID_MSG = $modSettings[maxMsgID] WHERE ID_MEMBER = $ID_MEMBER AND ID_BOARD IN (" . implode(',', array_keys($board_info['parent_boards'])) . ")", __FILE__, __LINE__); } } // Turn notification on or off. (note this just blows smoke if it's already on or off.) if (!empty($_POST['notify'])) { if (allowedTo('mark_any_notify')) db_query(" INSERT IGNORE INTO {$db_prefix}log_notify (ID_MEMBER, ID_TOPIC, ID_BOARD) VALUES ($ID_MEMBER, $topic, 0)", __FILE__, __LINE__); } elseif (!$newTopic) db_query(" DELETE FROM {$db_prefix}log_notify WHERE ID_MEMBER = $ID_MEMBER AND ID_TOPIC = $topic LIMIT 1", __FILE__, __LINE__); // Log an act of moderation - modifying. if (!empty($moderationAction)) logAction('modify', array('topic' => $topic, 'message' => (int) $_REQUEST['msg'], 'member' => $row['ID_MEMBER'])); if (isset($_POST['lock']) && $_POST['lock'] != 2) logAction('lock', array('topic' => $topicOptions['id'])); if (isset($_POST['sticky']) && !empty($modSettings['enableStickyTopics'])) logAction('sticky', array('topic' => $topicOptions['id'])); // Notify any members who have notification turned on for this topic. if ($newTopic) notifyMembersBoard(); elseif (empty($_REQUEST['msg'])) sendNotifications($topic, 'reply'); // Returning to the topic? if (!empty($_REQUEST['goback'])) { // Mark the board as read.... because it might get confusing otherwise. db_query(" UPDATE {$db_prefix}log_boards SET ID_MSG = $modSettings[maxMsgID] WHERE ID_MEMBER = $ID_MEMBER AND ID_BOARD = $board", __FILE__, __LINE__); } if (!empty($_POST['announce_topic'])) redirectexit('action=announce;sa=selectgroup;topic=' . $topic . (!empty($_POST['move']) && allowedTo('move_any') ? ';move' : '') . (empty($_REQUEST['goback']) ? '' : ';goback')); if (!empty($_POST['move']) && allowedTo('move_any')) redirectexit('action=movetopic;topic=' . $topic . '.0' . (empty($_REQUEST['goback']) ? '' : ';goback')); // Return to post if the mod is on. if (isset($_REQUEST['msg']) && !empty($_REQUEST['goback'])) redirectexit('topic=' . $topic . '.msg' . $_REQUEST['msg'] . '#msg' . $_REQUEST['msg'], $context['browser']['is_ie']); elseif (!empty($_REQUEST['goback'])) redirectexit('topic=' . $topic . '.new#new', $context['browser']['is_ie']); // Dut-dut-duh-duh-DUH-duh-dut-duh-duh! *dances to the Final Fantasy Fanfare...* else redirectexit('board=' . $board . '.0'); } // General function for topic announcements. function AnnounceTopic() { global $context, $txt; isAllowedTo('announce_topic'); validateSession(); loadLanguage('Post'); loadTemplate('Post'); $subActions = array( 'selectgroup' => 'AnnouncementSelectMembergroup', 'send' => 'AnnouncementSend', ); $context['page_title'] = $txt['announce_topic']; // Call the function based on the sub-action. $subActions[isset($_REQUEST['sa']) && isset($subActions[$_REQUEST['sa']]) ? $_REQUEST['sa'] : 'selectgroup'](); } // Allow a user to chose the membergroups to send the announcement to. function AnnouncementSelectMembergroup() { global $db_prefix, $txt, $context, $topic, $board, $board_info; $groups = array_merge($board_info['groups'], array(1)); foreach ($groups as $id => $group) $groups[$id] = (int) $group; $context['groups'] = array(); if (in_array(0, $groups)) { $context['groups'][0] = array( 'id' => 0, 'name' => $txt['announce_regular_members'], 'member_count' => 'n/a', ); } // Get all membergroups that have access to the board the announcement was made on. $request = db_query(" SELECT mg.ID_GROUP, mg.groupName, COUNT(mem.ID_MEMBER) AS num_members FROM {$db_prefix}membergroups AS mg LEFT JOIN {$db_prefix}members AS mem ON (mem.ID_GROUP = mg.ID_GROUP OR FIND_IN_SET(mg.ID_GROUP, mem.additionalGroups) OR mg.ID_GROUP = mem.ID_POST_GROUP) WHERE mg.ID_GROUP IN (" . implode(', ', $groups) . ") GROUP BY mg.ID_GROUP ORDER BY mg.minPosts, IF(mg.ID_GROUP < 4, mg.ID_GROUP, 4), mg.groupName", __FILE__, __LINE__); while ($row = mysql_fetch_assoc($request)) { $context['groups'][$row['ID_GROUP']] = array( 'id' => $row['ID_GROUP'], 'name' => $row['groupName'], 'member_count' => $row['num_members'], ); } mysql_free_result($request); // Get the subject of the topic we're about to announce. $request = db_query(" SELECT m.subject FROM ({$db_prefix}messages AS m, {$db_prefix}topics AS t) WHERE t.ID_TOPIC = $topic AND m.ID_MSG = t.ID_FIRST_MSG", __FILE__, __LINE__); list ($context['topic_subject']) = mysql_fetch_row($request); mysql_free_result($request); censorText($context['announce_topic']['subject']); $context['move'] = isset($_REQUEST['move']) ? 1 : 0; $context['go_back'] = isset($_REQUEST['goback']) ? 1 : 0; $context['sub_template'] = 'announce'; } // Send the announcement in chunks. function AnnouncementSend() { global $db_prefix, $topic, $board, $board_info, $context, $modSettings; global $language, $scripturl, $txt, $ID_MEMBER, $sourcedir; checkSession(); // !!! Might need an interface? $chunkSize = 50; $context['start'] = empty($_REQUEST['start']) ? 0 : (int) $_REQUEST['start']; $groups = array_merge($board_info['groups'], array(1)); if (!empty($_POST['membergroups'])) $_POST['who'] = explode(',', $_POST['membergroups']); // Check whether at least one membergroup was selected. if (empty($_POST['who'])) fatal_lang_error('no_membergroup_selected'); // Make sure all membergroups are integers and can access the board of the announcement. foreach ($_POST['who'] as $id => $mg) $_POST['who'][$id] = in_array((int) $mg, $groups) ? (int) $mg : 0; // Get the topic subject and censor it. $request = db_query(" SELECT m.ID_MSG, m.subject, m.body FROM ({$db_prefix}messages AS m, {$db_prefix}topics AS t) WHERE t.ID_TOPIC = $topic AND m.ID_MSG = t.ID_FIRST_MSG", __FILE__, __LINE__); list ($ID_MSG, $context['topic_subject'], $message) = mysql_fetch_row($request); mysql_free_result($request); censorText($context['topic_subject']); censorText($message); $message = trim(un_htmlspecialchars(strip_tags(strtr(parse_bbc($message, false, $ID_MSG), array('
' => "\n", '' => "\n", '' => "\n", '[' => '[', ']' => ']'))))); // We need this in order to be able send emails. require_once($sourcedir . '/Subs-Post.php'); // Select the email addresses for this batch. $request = db_query(" SELECT mem.ID_MEMBER, mem.emailAddress, mem.lngfile FROM {$db_prefix}members AS mem WHERE mem.ID_MEMBER != $ID_MEMBER" . (!empty($modSettings['allow_disableAnnounce']) ? ' AND mem.notifyAnnouncements = 1' : '') . " AND mem.is_activated = 1 AND (mem.ID_GROUP IN (" . implode(', ', $_POST['who']) . ") OR mem.ID_POST_GROUP IN (" . implode(', ', $_POST['who']) . ") OR FIND_IN_SET(" . implode(", mem.additionalGroups) OR FIND_IN_SET(", $_POST['who']) . ", mem.additionalGroups)) AND mem.ID_MEMBER > $context[start] ORDER BY mem.ID_MEMBER LIMIT $chunkSize", __FILE__, __LINE__); // All members have received a mail. Go to the next screen. if (mysql_num_rows($request) == 0) { if (!empty($_REQUEST['move']) && allowedTo('move_any')) redirectexit('action=movetopic;topic=' . $topic . '.0' . (empty($_REQUEST['goback']) ? '' : ';goback')); elseif (!empty($_REQUEST['goback'])) redirectexit('topic=' . $topic . '.new;boardseen#new', $context['browser']['is_ie']); else redirectexit('board=' . $board . '.0'); } // Loop through all members that'll receive an announcement in this batch. while ($row = mysql_fetch_assoc($request)) { $cur_language = empty($row['lngfile']) || empty($modSettings['userLanguage']) ? $language : $row['lngfile']; // If the language wasn't defined yet, load it and compose a notification message. if (!isset($announcements[$cur_language])) { loadLanguage('Post', $cur_language, false); $announcements[$cur_language] = array( 'subject' => $txt['notifyXAnn2'] . ': ' . $context['topic_subject'], 'body' => $message . "\n\n" . $txt['notifyXAnn3'] . "\n\n" . $scripturl . '?topic=' . $topic . ".0\n\n" . $txt[130], 'recipients' => array(), ); } $announcements[$cur_language]['recipients'][$row['ID_MEMBER']] = $row['emailAddress']; $context['start'] = $row['ID_MEMBER']; } mysql_free_result($request); // For each language send a different mail. foreach ($announcements as $lang => $mail) sendmail($mail['recipients'], $mail['subject'], $mail['body']); $context['percentage_done'] = round(100 * $context['start'] / $modSettings['latestMember'], 1); $context['move'] = empty($_REQUEST['move']) ? 0 : 1; $context['go_back'] = empty($_REQUEST['goback']) ? 0 : 1; $context['membergroups'] = implode(',', $_POST['who']); $context['sub_template'] = 'announcement_send'; // Go back to the correct language for the user ;). if (!empty($modSettings['userLanguage'])) loadLanguage('Post'); } // Notify members of a new post. function notifyMembersBoard() { global $board, $topic, $txt, $scripturl, $db_prefix, $language, $user_info; global $ID_MEMBER, $modSettings, $sourcedir; // Can't do it if there's no board. (won't happen but let's check for safety and not sending a zillion email's sake.) if (empty($board)) trigger_error('notifyMembersBoard(): Can\'t send a notification without a board id!', E_USER_NOTICE); require_once($sourcedir . '/Subs-Post.php'); $message = stripslashes($_POST['message']); // Censor the subject and body... censorText($_POST['subject']); censorText($message); $_POST['subject'] = un_htmlspecialchars($_POST['subject']); $message = trim(un_htmlspecialchars(strip_tags(strtr(parse_bbc($message, false), array('
' => "\n", '' => "\n", '' => "\n", '[' => '[', ']' => ']'))))); // Find the members with notification on for this board. $members = db_query(" SELECT mem.ID_MEMBER, mem.emailAddress, mem.notifyOnce, mem.notifySendBody, mem.lngfile, ln.sent, mem.ID_GROUP, mem.additionalGroups, b.memberGroups, mem.ID_POST_GROUP FROM ({$db_prefix}log_notify AS ln, {$db_prefix}members AS mem, {$db_prefix}boards AS b) WHERE ln.ID_BOARD = $board AND b.ID_BOARD = $board AND mem.ID_MEMBER != $ID_MEMBER AND mem.is_activated = 1 AND mem.notifyTypes != 4 AND ln.ID_MEMBER = mem.ID_MEMBER GROUP BY mem.ID_MEMBER ORDER BY mem.lngfile", __FILE__, __LINE__); while ($rowmember = mysql_fetch_assoc($members)) { if ($rowmember['ID_GROUP'] != 1) { $allowed = explode(',', $rowmember['memberGroups']); $rowmember['additionalGroups'] = explode(',', $rowmember['additionalGroups']); $rowmember['additionalGroups'][] = $rowmember['ID_GROUP']; $rowmember['additionalGroups'][] = $rowmember['ID_POST_GROUP']; if (count(array_intersect($allowed, $rowmember['additionalGroups'])) == 0) continue; } loadLanguage('Post', empty($rowmember['lngfile']) || empty($modSettings['userLanguage']) ? $language : $rowmember['lngfile'], false); // Setup the string for adding the body to the message, if a user wants it. $body_text = empty($modSettings['disallow_sendBody']) ? $txt['notification_new_topic_body'] . "\n\n" . $message . "\n\n" : ''; $send_subject = sprintf($txt['notify_boards_subject'], $_POST['subject']); // Send only if once is off or it's on and it hasn't been sent. if (!empty($rowmember['notifyOnce']) && empty($rowmember['sent'])) sendmail($rowmember['emailAddress'], $send_subject, sprintf($txt['notify_boards'], $_POST['subject'], $scripturl . '?topic=' . $topic . '.new#new', un_htmlspecialchars($user_info['name'])) . $txt['notify_boards_once'] . "\n\n" . (!empty($rowmember['notifySendBody']) ? $body_text : '') . $txt['notify_boardsUnsubscribe'] . ': ' . $scripturl . '?action=notifyboard;board=' . $board . ".0\n\n" . $txt[130], null, 't' . $topic); elseif (empty($rowmember['notifyOnce'])) sendmail($rowmember['emailAddress'], $send_subject, sprintf($txt['notify_boards'], $_POST['subject'], $scripturl . '?topic=' . $topic . '.new#new', un_htmlspecialchars($user_info['name'])) . (!empty($rowmember['notifySendBody']) ? $body_text : '') . $txt['notify_boardsUnsubscribe'] . ': ' . $scripturl . '?action=notifyboard;board=' . $board . ".0\n\n" . $txt[130], null, 't' . $topic); } mysql_free_result($members); // Sent! db_query(" UPDATE {$db_prefix}log_notify SET sent = 1 WHERE ID_BOARD = $board AND ID_MEMBER != $ID_MEMBER", __FILE__, __LINE__); } // Get the topic for display purposes. function getTopic() { global $topic, $db_prefix, $modSettings, $context; // Calculate the amount of new replies. $newReplies = empty($_REQUEST['num_replies']) || $context['num_replies'] <= $_REQUEST['num_replies'] ? 0 : $context['num_replies'] - $_REQUEST['num_replies']; if (isset($_REQUEST['xml'])) $limit = " LIMIT " . (empty($newReplies) ? '0' : $newReplies); else $limit = empty($modSettings['topicSummaryPosts']) ? '' : ' LIMIT ' . (int) $modSettings['topicSummaryPosts']; // If you're modifying, get only those posts before the current one. (otherwise get all.) $request = db_query(" SELECT IFNULL(mem.realName, m.posterName) AS posterName, m.posterTime, m.body, m.smileysEnabled, m.ID_MSG FROM {$db_prefix}messages AS m LEFT JOIN {$db_prefix}members AS mem ON (mem.ID_MEMBER = m.ID_MEMBER) WHERE m.ID_TOPIC = $topic" . (isset($_REQUEST['msg']) ? " AND m.ID_MSG < " . (int) $_REQUEST['msg'] : '') . " ORDER BY m.ID_MSG DESC$limit", __FILE__, __LINE__); $context['previous_posts'] = array(); while ($row = mysql_fetch_assoc($request)) { // Censor, BBC, ... censorText($row['body']); $row['body'] = parse_bbc($row['body'], $row['smileysEnabled'], $row['ID_MSG']); // ...and store. $context['previous_posts'][] = array( 'poster' => $row['posterName'], 'message' => $row['body'], 'time' => timeformat($row['posterTime']), 'timestamp' => forum_time(true, $row['posterTime']), 'id' => $row['ID_MSG'], 'is_new' => !empty($newReplies), ); if (!empty($newReplies)) $newReplies--; } mysql_free_result($request); } function QuoteFast() { global $db_prefix, $modSettings, $user_info, $txt, $settings, $context; global $sourcedir, $func; loadLanguage('Post'); if (!isset($_REQUEST['xml'])) loadTemplate('Post'); checkSession('get'); include_once($sourcedir . '/Subs-Post.php'); $moderate_boards = boardsAllowedTo('moderate_board'); $request = db_query(" SELECT IFNULL(mem.realName, m.posterName) AS posterName, m.posterTime, m.body, m.ID_TOPIC, m.subject, t.locked FROM ({$db_prefix}messages AS m, {$db_prefix}boards AS b, {$db_prefix}topics AS t) LEFT JOIN {$db_prefix}members AS mem ON (mem.ID_MEMBER = m.ID_MEMBER) WHERE m.ID_MSG = " . (int) $_REQUEST['quote'] . " AND b.ID_BOARD = m.ID_BOARD AND t.ID_TOPIC = m.ID_TOPIC AND $user_info[query_see_board]" . (!isset($_REQUEST['modify']) || (!empty($moderate_boards) && $moderate_boards[0] == 0) ? '' : ' AND (t.locked = 0' . (empty($moderate_boards) ? '' : ' OR b.ID_BOARD IN (' . implode(', ', $moderate_boards) . ')') . ')') . " LIMIT 1", __FILE__, __LINE__); $context['close_window'] = mysql_num_rows($request) == 0; $context['sub_template'] = 'quotefast'; if (mysql_num_rows($request) != 0) { $row = mysql_fetch_assoc($request); mysql_free_result($request); // Remove special formatting we don't want anymore. $row['body'] = un_preparsecode($row['body']); // Censor the message! censorText($row['body']); $row['body'] = preg_replace('~~i', "\n", $row['body']); // Want to modify a single message by double clicking it? if (isset($_REQUEST['modify'])) { censorText($row['subject']); $context['sub_template'] = 'modifyfast'; $context['message'] = array( 'id' => $_REQUEST['quote'], 'body' => $row['body'], 'subject' => addcslashes($row['subject'], '"'), ); return; } // Remove any nested quotes. if (!empty($modSettings['removeNestedQuotes'])) $row['body'] = preg_replace(array('~\n?\[quote.*?\].+?\[/quote\]\n?~is', '~^\n~', '~\[/quote\]~'), '', $row['body']); // Add a quote string on the front and end. $context['quote']['xml'] = '[quote author=' . $row['posterName'] . ' link=topic=' . $row['ID_TOPIC'] . '.msg' . (int) $_REQUEST['quote'] . '#msg' . (int) $_REQUEST['quote'] . ' date=' . $row['posterTime'] . ']' . "\n" . $row['body'] . "\n" . '[/quote]'; $context['quote']['text'] = strtr(un_htmlspecialchars($context['quote']['xml']), array('\'' => '\\\'', '\\' => '\\\\', "\n" => '\\n', '' => '')); $context['quote']['xml'] = strtr($context['quote']['xml'], array(' ' => ' ', '<' => '<', '>' => '>')); $context['quote']['mozilla'] = strtr($func['htmlspecialchars']($context['quote']['text']), array('"' => '"')); } // !!! Needs a nicer interface. // In case our message has been removed in the meantime. elseif (isset($_REQUEST['modify'])) { $context['sub_template'] = 'modifyfast'; $context['message'] = array( 'id' => 0, 'body' => '', 'subject' => '', ); } else $context['quote'] = array( 'xml' => '', 'mozilla' => '', 'text' => '', ); } function JavaScriptModify() { global $db_prefix, $sourcedir, $modSettings, $board, $topic, $txt; global $user_info, $ID_MEMBER, $context, $func, $language; // We have to have a topic! if (empty($topic)) obExit(false); checkSession('get'); require_once($sourcedir . '/Subs-Post.php'); // Assume the first message if no message ID was given. $request = db_query(" SELECT t.locked, t.numReplies, t.ID_MEMBER_STARTED, t.ID_FIRST_MSG, m.ID_MSG, m.ID_MEMBER, m.posterTime, m.subject, m.smileysEnabled, m.body, m.modifiedTime, m.modifiedName FROM ({$db_prefix}messages AS m, {$db_prefix}topics AS t) WHERE m.ID_MSG = " . (empty($_REQUEST['msg']) ? 't.ID_FIRST_MSG' : (int) $_REQUEST['msg']) . " AND m.ID_TOPIC = $topic AND t.ID_TOPIC = $topic", __FILE__, __LINE__); if (mysql_num_rows($request) == 0) fatal_lang_error('smf232', false); $row = mysql_fetch_assoc($request); mysql_free_result($request); // Change either body or subject requires permissions to modify messages. if (isset($_POST['message']) || isset($_POST['subject']) || isset($_POST['icon'])) { if (!empty($row['locked'])) isAllowedTo('moderate_board'); if ($row['ID_MEMBER'] == $ID_MEMBER && !allowedTo('modify_any')) { if (!empty($modSettings['edit_disable_time']) && $row['posterTime'] + ($modSettings['edit_disable_time'] + 5) * 60 < time()) fatal_lang_error('modify_post_time_passed', false); elseif ($row['ID_MEMBER_STARTED'] == $ID_MEMBER && !allowedTo('modify_own')) isAllowedTo('modify_replies'); else isAllowedTo('modify_own'); } // Otherwise, they're locked out; someone who can modify the replies is needed. elseif ($row['ID_MEMBER_STARTED'] == $ID_MEMBER && !allowedTo('modify_any')) isAllowedTo('modify_replies'); else isAllowedTo('modify_any'); // Only log this action if it wasn't your message. $moderationAction = $row['ID_MEMBER'] != $ID_MEMBER; } $post_errors = array(); if (isset($_POST['subject']) && $func['htmltrim']($_POST['subject']) !== '') { $_POST['subject'] = strtr($func['htmlspecialchars']($_POST['subject']), array("\r" => '', "\n" => '', "\t" => '')); // Maximum number of characters. if ($func['strlen']($_POST['subject']) > 100) $_POST['subject'] = addslashes($func['substr'](stripslashes($_POST['subject']), 0, 100)); } else { $post_errors[] = 'no_subject'; unset($_POST['subject']); } if (isset($_POST['message'])) { if ($func['htmltrim']($_POST['message']) === '') { $post_errors[] = 'no_message'; unset($_POST['message']); } elseif (!empty($modSettings['max_messageLength']) && $func['strlen']($_POST['message']) > $modSettings['max_messageLength']) { $post_errors[] = 'long_message'; unset($_POST['message']); } else { $_POST['message'] = $func['htmlspecialchars']($_POST['message'], ENT_QUOTES); preparsecode($_POST['message']); if ($func['htmltrim'](strip_tags(parse_bbc($_POST['message'], false), '')) === '') { $post_errors[] = 'no_message'; unset($_POST['message']); } } } if (isset($_POST['lock'])) { if (!allowedTo(array('lock_any', 'lock_own')) || (!allowedTo('lock_any') && $ID_MEMBER != $row['ID_MEMBER'])) unset($_POST['lock']); elseif (!allowedTo('lock_any')) { if ($row['locked'] == 1) unset($_POST['lock']); else $_POST['lock'] = empty($_POST['lock']) ? 0 : 2; } elseif (!empty($row['locked']) && !empty($_POST['lock']) || $_POST['lock'] == $row['locked']) unset($_POST['lock']); else $_POST['lock'] = empty($_POST['lock']) ? 0 : 1; } if (isset($_POST['sticky']) && !allowedTo('make_sticky')) unset($_POST['sticky']); if (empty($post_errors)) { $msgOptions = array( 'id' => $row['ID_MSG'], 'subject' => isset($_POST['subject']) ? $_POST['subject'] : null, 'body' => isset($_POST['message']) ? $_POST['message'] : null, 'icon' => isset($_POST['icon']) ? preg_replace('~[\./\\\\*\':"<>]~', '', $_POST['icon']) : null, ); $topicOptions = array( 'id' => $topic, 'board' => $board, 'lock_mode' => isset($_POST['lock']) ? (int) $_POST['lock'] : null, 'sticky_mode' => isset($_POST['sticky']) && !empty($modSettings['enableStickyTopics']) ? (int) $_POST['sticky'] : null, 'mark_as_read' => true, ); $posterOptions = array(); // Only consider marking as editing if they have edited the subject, message or icon. if ((isset($_POST['subject']) && $_POST['subject'] != $row['subject']) || (isset($_POST['message']) && $_POST['message'] != $row['body']) || (isset($_POST['icon']) && $_POST['icon'] != $row['icon'])) { // And even then only if the time has passed... if (time() - $row['posterTime'] > $modSettings['edit_wait_time'] || $ID_MEMBER != $row['ID_MEMBER']) { $msgOptions['modify_time'] = time(); $msgOptions['modify_name'] = addslashes($user_info['name']); } } modifyPost($msgOptions, $topicOptions, $posterOptions); // If we didn't change anything this time but had before put back the old info. if (!isset($msgOptions['modify_time']) && !empty($row['modifiedTime'])) { $msgOptions['modify_time'] = $row['modifiedTime']; $msgOptions['modify_name'] = $row['modifiedName']; } // Changing the first subject updates other subjects to 'Re: new_subject'. if (isset($_POST['subject']) && isset($_REQUEST['change_all_subjects']) && $row['ID_FIRST_MSG'] == $row['ID_MSG'] && !empty($row['numReplies']) && (allowedTo('modify_any') || ($row['ID_MEMBER_STARTED'] == $ID_MEMBER && allowedTo('modify_replies')))) { // Get the proper (default language) response prefix first. if (!isset($context['response_prefix']) && !($context['response_prefix'] = cache_get_data('response_prefix'))) { if ($language === $user_info['language']) $context['response_prefix'] = $txt['response_prefix']; else { loadLanguage('index', $language, false); $context['response_prefix'] = $txt['response_prefix']; loadLanguage('index'); } cache_put_data('response_prefix', $context['response_prefix'], 600); } db_query(" UPDATE {$db_prefix}messages SET subject = '$context[response_prefix]$_POST[subject]' WHERE ID_TOPIC = $topic AND ID_MSG != $row[ID_FIRST_MSG] LIMIT $row[numReplies]", __FILE__, __LINE__); } if ($moderationAction) logAction('modify', array('topic' => $topic, 'message' => $row['ID_MSG'], 'member' => $row['ID_MEMBER_STARTED'])); } if (isset($_REQUEST['xml'])) { $context['sub_template'] = 'modifydone'; if (empty($post_errors) && isset($msgOptions['subject']) && isset($msgOptions['body'])) { $context['message'] = array( 'id' => $row['ID_MSG'], 'modified' => array( 'time' => isset($msgOptions['modify_time']) ? timeformat($msgOptions['modify_time']) : '', 'timestamp' => isset($msgOptions['modify_time']) ? forum_time(true, $msgOptions['modify_time']) : 0, 'name' => isset($msgOptions['modify_time']) ? stripslashes($msgOptions['modify_name']) : '', ), 'subject' => stripslashes($msgOptions['subject']), 'first_in_topic' => $row['ID_MSG'] == $row['ID_FIRST_MSG'], 'body' => strtr(stripslashes($msgOptions['body']), array(']]>' => ']]]]>')), ); censorText($context['message']['subject']); censorText($context['message']['body']); $context['message']['body'] = parse_bbc($context['message']['body'], $row['smileysEnabled'], $row['ID_MSG']); } // Topic? elseif (empty($post_errors) && isset($msgOptions['subject'])) { $context['sub_template'] = 'modifytopicdone'; $context['message'] = array( 'id' => $row['ID_MSG'], 'modified' => array( 'time' => isset($msgOptions['modify_time']) ? timeformat($msgOptions['modify_time']) : '', 'timestamp' => isset($msgOptions['modify_time']) ? forum_time(true, $msgOptions['modify_time']) : 0, 'name' => isset($msgOptions['modify_time']) ? stripslashes($msgOptions['modify_name']) : '', ), 'subject' => stripslashes($msgOptions['subject']), ); censorText($context['message']['subject']); } else { $context['message'] = array( 'id' => $row['ID_MSG'], 'errors' => array(), 'error_in_subject' => in_array('no_subject', $post_errors), 'error_in_body' => in_array('no_message', $post_errors) || in_array('long_message', $post_errors), ); loadLanguage('Errors'); foreach ($post_errors as $post_error) $context['message']['errors'][] = $txt['error_' . $post_error]; } } else obExit(false); } ?>