Post.php 104 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902
  1. <?php
  2. /**
  3. * The job of this file is to handle everything related to posting replies,
  4. * new topics, quotes, and modifications to existing posts. It also handles
  5. * quoting posts by way of javascript.
  6. * Simple Machines Forum (SMF)
  7. *
  8. * @package SMF
  9. * @author Simple Machines http://www.simplemachines.org
  10. * @copyright 2011 Simple Machines
  11. * @license http://www.simplemachines.org/about/smf/license.php BSD
  12. *
  13. * @version 2.1 Alpha 1
  14. */
  15. if (!defined('SMF'))
  16. die('Hacking attempt...');
  17. /**
  18. * handles showing the post screen, loading the post to be modified, and loading any post quoted.
  19. * additionally handles previews of posts.
  20. * @uses the Post template and language file, main sub template.
  21. * allows wireless access using the protocol_post sub template.
  22. * requires different permissions depending on the actions, but most notably post_new, post_reply_own, and post_reply_any.
  23. * shows options for the editing and posting of calendar events and attachments, as well as the posting of polls.
  24. * accessed from ?action=post.
  25. */
  26. function Post()
  27. {
  28. global $txt, $scripturl, $topic, $modSettings, $board;
  29. global $user_info, $sc, $board_info, $context, $settings;
  30. global $sourcedir, $options, $smcFunc, $language;
  31. loadLanguage('Post');
  32. // You can't reply with a poll... hacker.
  33. if (isset($_REQUEST['poll']) && !empty($topic) && !isset($_REQUEST['msg']))
  34. unset($_REQUEST['poll']);
  35. // Posting an event?
  36. $context['make_event'] = isset($_REQUEST['calendar']);
  37. $context['robot_no_index'] = true;
  38. // You must be posting to *some* board.
  39. if (empty($board) && !$context['make_event'])
  40. fatal_lang_error('no_board', false);
  41. require_once($sourcedir . '/Subs-Post.php');
  42. if (isset($_REQUEST['xml']))
  43. {
  44. $context['sub_template'] = 'post';
  45. // Just in case of an earlier error...
  46. $context['preview_message'] = '';
  47. $context['preview_subject'] = '';
  48. }
  49. // No message is complete without a topic.
  50. if (empty($topic) && !empty($_REQUEST['msg']))
  51. {
  52. $request = $smcFunc['db_query']('', '
  53. SELECT id_topic
  54. FROM {db_prefix}messages
  55. WHERE id_msg = {int:msg}',
  56. array(
  57. 'msg' => (int) $_REQUEST['msg'],
  58. ));
  59. if ($smcFunc['db_num_rows']($request) != 1)
  60. unset($_REQUEST['msg'], $_POST['msg'], $_GET['msg']);
  61. else
  62. list ($topic) = $smcFunc['db_fetch_row']($request);
  63. $smcFunc['db_free_result']($request);
  64. }
  65. // Check if it's locked. It isn't locked if no topic is specified.
  66. if (!empty($topic))
  67. {
  68. $request = $smcFunc['db_query']('', '
  69. SELECT
  70. t.locked, IFNULL(ln.id_topic, 0) AS notify, t.is_sticky, t.id_poll, t.id_last_msg, mf.id_member,
  71. t.id_first_msg, mf.subject,
  72. CASE WHEN ml.poster_time > ml.modified_time THEN ml.poster_time ELSE ml.modified_time END AS last_post_time
  73. FROM {db_prefix}topics AS t
  74. LEFT JOIN {db_prefix}log_notify AS ln ON (ln.id_topic = t.id_topic AND ln.id_member = {int:current_member})
  75. LEFT JOIN {db_prefix}messages AS mf ON (mf.id_msg = t.id_first_msg)
  76. LEFT JOIN {db_prefix}messages AS ml ON (ml.id_msg = t.id_last_msg)
  77. WHERE t.id_topic = {int:current_topic}
  78. LIMIT 1',
  79. array(
  80. 'current_member' => $user_info['id'],
  81. 'current_topic' => $topic,
  82. )
  83. );
  84. list ($locked, $context['notify'], $sticky, $pollID, $context['topic_last_message'], $id_member_poster, $id_first_msg, $first_subject, $lastPostTime) = $smcFunc['db_fetch_row']($request);
  85. $smcFunc['db_free_result']($request);
  86. // If this topic already has a poll, they sure can't add another.
  87. if (isset($_REQUEST['poll']) && $pollID > 0)
  88. unset($_REQUEST['poll']);
  89. if (empty($_REQUEST['msg']))
  90. {
  91. if ($user_info['is_guest'] && !allowedTo('post_reply_any') && (!$modSettings['postmod_active'] || !allowedTo('post_unapproved_replies_any')))
  92. is_not_guest();
  93. // By default the reply will be approved...
  94. $context['becomes_approved'] = true;
  95. if ($id_member_poster != $user_info['id'])
  96. {
  97. if ($modSettings['postmod_active'] && allowedTo('post_unapproved_replies_any') && !allowedTo('post_reply_any'))
  98. $context['becomes_approved'] = false;
  99. else
  100. isAllowedTo('post_reply_any');
  101. }
  102. elseif (!allowedTo('post_reply_any'))
  103. {
  104. if ($modSettings['postmod_active'] && allowedTo('post_unapproved_replies_own') && !allowedTo('post_reply_own'))
  105. $context['becomes_approved'] = false;
  106. else
  107. isAllowedTo('post_reply_own');
  108. }
  109. }
  110. else
  111. $context['becomes_approved'] = true;
  112. $context['can_lock'] = allowedTo('lock_any') || ($user_info['id'] == $id_member_poster && allowedTo('lock_own'));
  113. $context['can_sticky'] = allowedTo('make_sticky') && !empty($modSettings['enableStickyTopics']);
  114. $context['notify'] = !empty($context['notify']);
  115. $context['sticky'] = isset($_REQUEST['sticky']) ? !empty($_REQUEST['sticky']) : $sticky;
  116. }
  117. else
  118. {
  119. $context['becomes_approved'] = true;
  120. if ((!$context['make_event'] || !empty($board)))
  121. {
  122. if ($modSettings['postmod_active'] && !allowedTo('post_new') && allowedTo('post_unapproved_topics'))
  123. $context['becomes_approved'] = false;
  124. else
  125. isAllowedTo('post_new');
  126. }
  127. $locked = 0;
  128. // @todo These won't work if you're making an event.
  129. $context['can_lock'] = allowedTo(array('lock_any', 'lock_own'));
  130. $context['can_sticky'] = allowedTo('make_sticky') && !empty($modSettings['enableStickyTopics']);
  131. $context['notify'] = !empty($context['notify']);
  132. $context['sticky'] = !empty($_REQUEST['sticky']);
  133. }
  134. // @todo These won't work if you're posting an event!
  135. $context['can_notify'] = allowedTo('mark_any_notify');
  136. $context['can_move'] = allowedTo('move_any');
  137. $context['move'] = !empty($_REQUEST['move']);
  138. $context['announce'] = !empty($_REQUEST['announce']);
  139. // You can only announce topics that will get approved...
  140. $context['can_announce'] = allowedTo('announce_topic') && $context['becomes_approved'];
  141. $context['locked'] = !empty($locked) || !empty($_REQUEST['lock']);
  142. $context['can_quote'] = empty($modSettings['disabledBBC']) || !in_array('quote', explode(',', $modSettings['disabledBBC']));
  143. // Generally don't show the approval box... (Assume we want things approved)
  144. $context['show_approval'] = false;
  145. // An array to hold all the attachments for this topic.
  146. $context['current_attachments'] = array();
  147. // Don't allow a post if it's locked and you aren't all powerful.
  148. if ($locked && !allowedTo('moderate_board'))
  149. fatal_lang_error('topic_locked', false);
  150. // Check the users permissions - is the user allowed to add or post a poll?
  151. if (isset($_REQUEST['poll']) && $modSettings['pollMode'] == '1')
  152. {
  153. // New topic, new poll.
  154. if (empty($topic))
  155. isAllowedTo('poll_post');
  156. // This is an old topic - but it is yours! Can you add to it?
  157. elseif ($user_info['id'] == $id_member_poster && !allowedTo('poll_add_any'))
  158. isAllowedTo('poll_add_own');
  159. // If you're not the owner, can you add to any poll?
  160. else
  161. isAllowedTo('poll_add_any');
  162. require_once($sourcedir . '/Subs-Members.php');
  163. $allowedVoteGroups = groupsAllowedTo('poll_vote', $board);
  164. // Set up the poll options.
  165. $context['poll_options'] = array(
  166. 'max_votes' => empty($_POST['poll_max_votes']) ? '1' : max(1, $_POST['poll_max_votes']),
  167. 'hide' => empty($_POST['poll_hide']) ? 0 : $_POST['poll_hide'],
  168. 'expire' => !isset($_POST['poll_expire']) ? '' : $_POST['poll_expire'],
  169. 'change_vote' => isset($_POST['poll_change_vote']),
  170. 'guest_vote' => isset($_POST['poll_guest_vote']),
  171. 'guest_vote_enabled' => in_array(-1, $allowedVoteGroups['allowed']),
  172. );
  173. // Make all five poll choices empty.
  174. $context['choices'] = array(
  175. array('id' => 0, 'number' => 1, 'label' => '', 'is_last' => false),
  176. array('id' => 1, 'number' => 2, 'label' => '', 'is_last' => false),
  177. array('id' => 2, 'number' => 3, 'label' => '', 'is_last' => false),
  178. array('id' => 3, 'number' => 4, 'label' => '', 'is_last' => false),
  179. array('id' => 4, 'number' => 5, 'label' => '', 'is_last' => true)
  180. );
  181. }
  182. if ($context['make_event'])
  183. {
  184. // They might want to pick a board.
  185. if (!isset($context['current_board']))
  186. $context['current_board'] = 0;
  187. // Start loading up the event info.
  188. $context['event'] = array();
  189. $context['event']['title'] = isset($_REQUEST['evtitle']) ? htmlspecialchars(stripslashes($_REQUEST['evtitle'])) : '';
  190. $context['event']['id'] = isset($_REQUEST['eventid']) ? (int) $_REQUEST['eventid'] : -1;
  191. $context['event']['new'] = $context['event']['id'] == -1;
  192. // Permissions check!
  193. isAllowedTo('calendar_post');
  194. // Editing an event? (but NOT previewing!?)
  195. if (empty($context['event']['new']) && !isset($_REQUEST['subject']))
  196. {
  197. // If the user doesn't have permission to edit the post in this topic, redirect them.
  198. if ((empty($id_member_poster) || $id_member_poster != $user_info['id'] || !allowedTo('modify_own')) && !allowedTo('modify_any'))
  199. {
  200. require_once($sourcedir . '/Calendar.php');
  201. return CalendarPost();
  202. }
  203. // Get the current event information.
  204. $request = $smcFunc['db_query']('', '
  205. SELECT
  206. id_member, title, MONTH(start_date) AS month, DAYOFMONTH(start_date) AS day,
  207. YEAR(start_date) AS year, (TO_DAYS(end_date) - TO_DAYS(start_date)) AS span
  208. FROM {db_prefix}calendar
  209. WHERE id_event = {int:id_event}
  210. LIMIT 1',
  211. array(
  212. 'id_event' => $context['event']['id'],
  213. )
  214. );
  215. $row = $smcFunc['db_fetch_assoc']($request);
  216. $smcFunc['db_free_result']($request);
  217. // Make sure the user is allowed to edit this event.
  218. if ($row['id_member'] != $user_info['id'])
  219. isAllowedTo('calendar_edit_any');
  220. elseif (!allowedTo('calendar_edit_any'))
  221. isAllowedTo('calendar_edit_own');
  222. $context['event']['month'] = $row['month'];
  223. $context['event']['day'] = $row['day'];
  224. $context['event']['year'] = $row['year'];
  225. $context['event']['title'] = $row['title'];
  226. $context['event']['span'] = $row['span'] + 1;
  227. }
  228. else
  229. {
  230. $today = getdate();
  231. // You must have a month and year specified!
  232. if (!isset($_REQUEST['month']))
  233. $_REQUEST['month'] = $today['mon'];
  234. if (!isset($_REQUEST['year']))
  235. $_REQUEST['year'] = $today['year'];
  236. $context['event']['month'] = (int) $_REQUEST['month'];
  237. $context['event']['year'] = (int) $_REQUEST['year'];
  238. $context['event']['day'] = isset($_REQUEST['day']) ? $_REQUEST['day'] : ($_REQUEST['month'] == $today['mon'] ? $today['mday'] : 0);
  239. $context['event']['span'] = isset($_REQUEST['span']) ? $_REQUEST['span'] : 1;
  240. // Make sure the year and month are in the valid range.
  241. if ($context['event']['month'] < 1 || $context['event']['month'] > 12)
  242. fatal_lang_error('invalid_month', false);
  243. if ($context['event']['year'] < $modSettings['cal_minyear'] || $context['event']['year'] > $modSettings['cal_maxyear'])
  244. fatal_lang_error('invalid_year', false);
  245. // Get a list of boards they can post in.
  246. $boards = boardsAllowedTo('post_new');
  247. if (empty($boards))
  248. fatal_lang_error('cannot_post_new', 'user');
  249. // Load a list of boards for this event in the context.
  250. require_once($sourcedir . '/Subs-MessageIndex.php');
  251. $boardListOptions = array(
  252. 'included_boards' => in_array(0, $boards) ? null : $boards,
  253. 'not_redirection' => true,
  254. 'use_permissions' => true,
  255. 'selected_board' => empty($context['current_board']) ? $modSettings['cal_defaultboard'] : $context['current_board'],
  256. );
  257. $context['event']['categories'] = getBoardList($boardListOptions);
  258. }
  259. // Find the last day of the month.
  260. $context['event']['last_day'] = (int) strftime('%d', mktime(0, 0, 0, $context['event']['month'] == 12 ? 1 : $context['event']['month'] + 1, 0, $context['event']['month'] == 12 ? $context['event']['year'] + 1 : $context['event']['year']));
  261. $context['event']['board'] = !empty($board) ? $board : $modSettings['cal_defaultboard'];
  262. }
  263. if (empty($context['post_errors']))
  264. $context['post_errors'] = array();
  265. // See if any new replies have come along.
  266. // Huh, $_REQUEST['msg'] is set upon submit, so this doesn't get executed at submit
  267. // only at preview
  268. if (empty($_REQUEST['msg']) && !empty($topic))
  269. {
  270. if (empty($options['no_new_reply_warning']) && isset($_REQUEST['last_msg']) && $context['topic_last_message'] > $_REQUEST['last_msg'])
  271. {
  272. $request = $smcFunc['db_query']('', '
  273. SELECT COUNT(*)
  274. FROM {db_prefix}messages
  275. WHERE id_topic = {int:current_topic}
  276. AND id_msg > {int:last_msg}' . (!$modSettings['postmod_active'] || allowedTo('approve_posts') ? '' : '
  277. AND approved = {int:approved}') . '
  278. LIMIT 1',
  279. array(
  280. 'current_topic' => $topic,
  281. 'last_msg' => (int) $_REQUEST['last_msg'],
  282. 'approved' => 1,
  283. )
  284. );
  285. list ($context['new_replies']) = $smcFunc['db_fetch_row']($request);
  286. $smcFunc['db_free_result']($request);
  287. if (!empty($context['new_replies']))
  288. {
  289. if ($context['new_replies'] == 1)
  290. $txt['error_new_reply'] = isset($_GET['last_msg']) ? $txt['error_new_reply_reading'] : $txt['error_new_reply'];
  291. else
  292. $txt['error_new_replies'] = sprintf(isset($_GET['last_msg']) ? $txt['error_new_replies_reading'] : $txt['error_new_replies'], $context['new_replies']);
  293. // If they've come from the display page then we treat the error differently....
  294. if (isset($_GET['last_msg']))
  295. $newRepliesError = $context['new_replies'];
  296. else
  297. $context['post_error'][$context['new_replies'] == 1 ? 'new_reply' : 'new_replies'] = true;
  298. $modSettings['topicSummaryPosts'] = $context['new_replies'] > $modSettings['topicSummaryPosts'] ? max($modSettings['topicSummaryPosts'], 5) : $modSettings['topicSummaryPosts'];
  299. }
  300. }
  301. // Check whether this is a really old post being bumped...
  302. if (!empty($modSettings['oldTopicDays']) && $lastPostTime + $modSettings['oldTopicDays'] * 86400 < time() && empty($sticky) && !isset($_REQUEST['subject']))
  303. $oldTopicError = true;
  304. }
  305. // Get a response prefix (like 'Re:') in the default forum language.
  306. if (!isset($context['response_prefix']) && !($context['response_prefix'] = cache_get_data('response_prefix')))
  307. {
  308. if ($language === $user_info['language'])
  309. $context['response_prefix'] = $txt['response_prefix'];
  310. else
  311. {
  312. loadLanguage('index', $language, false);
  313. $context['response_prefix'] = $txt['response_prefix'];
  314. loadLanguage('index');
  315. }
  316. cache_put_data('response_prefix', $context['response_prefix'], 600);
  317. }
  318. // Previewing, modifying, or posting?
  319. // Do we have a body, but an error happened.
  320. if (isset($_REQUEST['message']) || !empty($context['post_error']))
  321. {
  322. // Validate inputs.
  323. if (empty($context['post_error']))
  324. {
  325. if (htmltrim__recursive(htmlspecialchars__recursive($_REQUEST['subject'])) == '')
  326. $context['post_error']['no_subject'] = true;
  327. if (htmltrim__recursive(htmlspecialchars__recursive($_REQUEST['message'])) == '')
  328. $context['post_error']['no_message'] = true;
  329. if (!empty($modSettings['max_messageLength']) && $smcFunc['strlen']($_REQUEST['message']) > $modSettings['max_messageLength'])
  330. $context['post_error']['long_message'] = true;
  331. // Are you... a guest?
  332. if ($user_info['is_guest'])
  333. {
  334. $_REQUEST['guestname'] = !isset($_REQUEST['guestname']) ? '' : trim($_REQUEST['guestname']);
  335. $_REQUEST['email'] = !isset($_REQUEST['email']) ? '' : trim($_REQUEST['email']);
  336. // Validate the name and email.
  337. if (!isset($_REQUEST['guestname']) || trim(strtr($_REQUEST['guestname'], '_', ' ')) == '')
  338. $context['post_error']['no_name'] = true;
  339. elseif ($smcFunc['strlen']($_REQUEST['guestname']) > 25)
  340. $context['post_error']['long_name'] = true;
  341. else
  342. {
  343. require_once($sourcedir . '/Subs-Members.php');
  344. if (isReservedName(htmlspecialchars($_REQUEST['guestname']), 0, true, false))
  345. $context['post_error']['bad_name'] = true;
  346. }
  347. if (empty($modSettings['guest_post_no_email']))
  348. {
  349. if (!isset($_REQUEST['email']) || $_REQUEST['email'] == '')
  350. $context['post_error']['no_email'] = true;
  351. elseif (preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', $_REQUEST['email']) == 0)
  352. $context['post_error']['bad_email'] = true;
  353. }
  354. }
  355. // This is self explanatory - got any questions?
  356. if (isset($_REQUEST['question']) && trim($_REQUEST['question']) == '')
  357. $context['post_error']['no_question'] = true;
  358. // This means they didn't click Post and get an error.
  359. $really_previewing = true;
  360. }
  361. else
  362. {
  363. if (!isset($_REQUEST['subject']))
  364. $_REQUEST['subject'] = '';
  365. if (!isset($_REQUEST['message']))
  366. $_REQUEST['message'] = '';
  367. if (!isset($_REQUEST['icon']))
  368. $_REQUEST['icon'] = 'xx';
  369. // They are previewing if they asked to preview (i.e. came from quick reply).
  370. $really_previewing = !empty($_POST['preview']);
  371. }
  372. // In order to keep the approval status flowing through, we have to pass it through the form...
  373. $context['becomes_approved'] = empty($_REQUEST['not_approved']);
  374. $context['show_approval'] = isset($_REQUEST['approve']) ? ($_REQUEST['approve'] ? 2 : 1) : 0;
  375. $context['can_announce'] &= $context['becomes_approved'];
  376. // Set up the inputs for the form.
  377. $form_subject = strtr($smcFunc['htmlspecialchars']($_REQUEST['subject']), array("\r" => '', "\n" => '', "\t" => ''));
  378. $form_message = $smcFunc['htmlspecialchars']($_REQUEST['message'], ENT_QUOTES);
  379. // Make sure the subject isn't too long - taking into account special characters.
  380. if ($smcFunc['strlen']($form_subject) > 100)
  381. $form_subject = $smcFunc['substr']($form_subject, 0, 100);
  382. // Have we inadvertently trimmed off the subject of useful information?
  383. if ($smcFunc['htmltrim']($form_subject) === '')
  384. $context['post_error']['no_subject'] = true;
  385. // Any errors occurred?
  386. if (!empty($context['post_error']))
  387. {
  388. loadLanguage('Errors');
  389. $context['error_type'] = 'minor';
  390. $context['post_error']['messages'] = array();
  391. foreach ($context['post_error'] as $post_error => $dummy)
  392. {
  393. if ($post_error == 'messages')
  394. continue;
  395. if ($post_error == 'long_message')
  396. $txt['error_' . $post_error] = sprintf($txt['error_' . $post_error], $modSettings['max_messageLength']);
  397. $context['post_error']['messages'][] = $txt['error_' . $post_error];
  398. // If it's not a minor error flag it as such.
  399. if (!in_array($post_error, array('new_reply', 'not_approved', 'new_replies', 'old_topic', 'need_qr_verification')))
  400. $context['error_type'] = 'serious';
  401. }
  402. }
  403. if (isset($_REQUEST['poll']))
  404. {
  405. $context['question'] = isset($_REQUEST['question']) ? $smcFunc['htmlspecialchars'](trim($_REQUEST['question'])) : '';
  406. $context['choices'] = array();
  407. $choice_id = 0;
  408. $_POST['options'] = empty($_POST['options']) ? array() : htmlspecialchars__recursive($_POST['options']);
  409. foreach ($_POST['options'] as $option)
  410. {
  411. if (trim($option) == '')
  412. continue;
  413. $context['choices'][] = array(
  414. 'id' => $choice_id++,
  415. 'number' => $choice_id,
  416. 'label' => $option,
  417. 'is_last' => false
  418. );
  419. }
  420. if (count($context['choices']) < 2)
  421. {
  422. $context['choices'][] = array(
  423. 'id' => $choice_id++,
  424. 'number' => $choice_id,
  425. 'label' => '',
  426. 'is_last' => false
  427. );
  428. $context['choices'][] = array(
  429. 'id' => $choice_id++,
  430. 'number' => $choice_id,
  431. 'label' => '',
  432. 'is_last' => false
  433. );
  434. }
  435. $context['choices'][count($context['choices']) - 1]['is_last'] = true;
  436. }
  437. // Are you... a guest?
  438. if ($user_info['is_guest'])
  439. {
  440. $_REQUEST['guestname'] = !isset($_REQUEST['guestname']) ? '' : trim($_REQUEST['guestname']);
  441. $_REQUEST['email'] = !isset($_REQUEST['email']) ? '' : trim($_REQUEST['email']);
  442. $_REQUEST['guestname'] = htmlspecialchars($_REQUEST['guestname']);
  443. $context['name'] = $_REQUEST['guestname'];
  444. $_REQUEST['email'] = htmlspecialchars($_REQUEST['email']);
  445. $context['email'] = $_REQUEST['email'];
  446. $user_info['name'] = $_REQUEST['guestname'];
  447. }
  448. // Only show the preview stuff if they hit Preview.
  449. if ($really_previewing == true || isset($_REQUEST['xml']))
  450. {
  451. // Set up the preview message and subject and censor them...
  452. $context['preview_message'] = $form_message;
  453. preparsecode($form_message, true);
  454. preparsecode($context['preview_message']);
  455. // Do all bulletin board code tags, with or without smileys.
  456. $context['preview_message'] = parse_bbc($context['preview_message'], isset($_REQUEST['ns']) ? 0 : 1);
  457. if ($form_subject != '')
  458. {
  459. $context['preview_subject'] = $form_subject;
  460. censorText($context['preview_subject']);
  461. censorText($context['preview_message']);
  462. }
  463. else
  464. $context['preview_subject'] = '<em>' . $txt['no_subject'] . '</em>';
  465. // Protect any CDATA blocks.
  466. if (isset($_REQUEST['xml']))
  467. $context['preview_message'] = strtr($context['preview_message'], array(']]>' => ']]]]><![CDATA[>'));
  468. }
  469. // Set up the checkboxes.
  470. $context['notify'] = !empty($_REQUEST['notify']);
  471. $context['use_smileys'] = !isset($_REQUEST['ns']);
  472. $context['icon'] = isset($_REQUEST['icon']) ? preg_replace('~[\./\\\\*\':"<>]~', '', $_REQUEST['icon']) : 'xx';
  473. // Set the destination action for submission.
  474. $context['destination'] = 'post2;start=' . $_REQUEST['start'] . (isset($_REQUEST['msg']) ? ';msg=' . $_REQUEST['msg'] . ';' . $context['session_var'] . '=' . $context['session_id'] : '') . (isset($_REQUEST['poll']) ? ';poll' : '');
  475. $context['submit_label'] = isset($_REQUEST['msg']) ? $txt['save'] : $txt['post'];
  476. // Previewing an edit?
  477. if (isset($_REQUEST['msg']) && !empty($topic))
  478. {
  479. // Get the existing message.
  480. $request = $smcFunc['db_query']('', '
  481. SELECT
  482. m.id_member, m.modified_time, m.smileys_enabled, m.body,
  483. m.poster_name, m.poster_email, m.subject, m.icon, m.approved,
  484. IFNULL(a.size, -1) AS filesize, a.filename, a.id_attach,
  485. a.approved AS attachment_approved, t.id_member_started AS id_member_poster,
  486. m.poster_time
  487. FROM {db_prefix}messages AS m
  488. INNER JOIN {db_prefix}topics AS t ON (t.id_topic = {int:current_topic})
  489. LEFT JOIN {db_prefix}attachments AS a ON (a.id_msg = m.id_msg AND a.attachment_type = {int:attachment_type})
  490. WHERE m.id_msg = {int:id_msg}
  491. AND m.id_topic = {int:current_topic}',
  492. array(
  493. 'current_topic' => $topic,
  494. 'attachment_type' => 0,
  495. 'id_msg' => $_REQUEST['msg'],
  496. )
  497. );
  498. // The message they were trying to edit was most likely deleted.
  499. /**
  500. * @todo Change this error message?
  501. */
  502. if ($smcFunc['db_num_rows']($request) == 0)
  503. fatal_lang_error('no_board', false);
  504. $row = $smcFunc['db_fetch_assoc']($request);
  505. $attachment_stuff = array($row);
  506. while ($row2 = $smcFunc['db_fetch_assoc']($request))
  507. $attachment_stuff[] = $row2;
  508. $smcFunc['db_free_result']($request);
  509. if ($row['id_member'] == $user_info['id'] && !allowedTo('modify_any'))
  510. {
  511. // Give an extra five minutes over the disable time threshold, so they can type - assuming the post is public.
  512. if ($row['approved'] && !empty($modSettings['edit_disable_time']) && $row['poster_time'] + ($modSettings['edit_disable_time'] + 5) * 60 < time())
  513. fatal_lang_error('modify_post_time_passed', false);
  514. elseif ($row['id_member_poster'] == $user_info['id'] && !allowedTo('modify_own'))
  515. isAllowedTo('modify_replies');
  516. else
  517. isAllowedTo('modify_own');
  518. }
  519. elseif ($row['id_member_poster'] == $user_info['id'] && !allowedTo('modify_any'))
  520. isAllowedTo('modify_replies');
  521. else
  522. isAllowedTo('modify_any');
  523. if (!empty($modSettings['attachmentEnable']))
  524. {
  525. $request = $smcFunc['db_query']('', '
  526. SELECT IFNULL(size, -1) AS filesize, filename, id_attach, approved
  527. FROM {db_prefix}attachments
  528. WHERE id_msg = {int:id_msg}
  529. AND attachment_type = {int:attachment_type}',
  530. array(
  531. 'id_msg' => (int) $_REQUEST['msg'],
  532. 'attachment_type' => 0,
  533. )
  534. );
  535. while ($row = $smcFunc['db_fetch_assoc']($request))
  536. {
  537. if ($row['filesize'] <= 0)
  538. continue;
  539. $context['current_attachments'][] = array(
  540. 'name' => htmlspecialchars($row['filename']),
  541. 'id' => $row['id_attach'],
  542. 'approved' => $row['approved'],
  543. );
  544. }
  545. $smcFunc['db_free_result']($request);
  546. }
  547. // Allow moderators to change names....
  548. if (allowedTo('moderate_forum') && !empty($topic))
  549. {
  550. $request = $smcFunc['db_query']('', '
  551. SELECT id_member, poster_name, poster_email
  552. FROM {db_prefix}messages
  553. WHERE id_msg = {int:id_msg}
  554. AND id_topic = {int:current_topic}
  555. LIMIT 1',
  556. array(
  557. 'current_topic' => $topic,
  558. 'id_msg' => (int) $_REQUEST['msg'],
  559. )
  560. );
  561. $row = $smcFunc['db_fetch_assoc']($request);
  562. $smcFunc['db_free_result']($request);
  563. if (empty($row['id_member']))
  564. {
  565. $context['name'] = htmlspecialchars($row['poster_name']);
  566. $context['email'] = htmlspecialchars($row['poster_email']);
  567. }
  568. }
  569. }
  570. // No check is needed, since nothing is really posted.
  571. checkSubmitOnce('free');
  572. }
  573. // Editing a message...
  574. elseif (isset($_REQUEST['msg']) && !empty($topic))
  575. {
  576. $_REQUEST['msg'] = (int) $_REQUEST['msg'];
  577. // Get the existing message.
  578. $request = $smcFunc['db_query']('', '
  579. SELECT
  580. m.id_member, m.modified_time, m.smileys_enabled, m.body,
  581. m.poster_name, m.poster_email, m.subject, m.icon, m.approved,
  582. IFNULL(a.size, -1) AS filesize, a.filename, a.id_attach,
  583. a.approved AS attachment_approved, t.id_member_started AS id_member_poster,
  584. m.poster_time
  585. FROM {db_prefix}messages AS m
  586. INNER JOIN {db_prefix}topics AS t ON (t.id_topic = {int:current_topic})
  587. LEFT JOIN {db_prefix}attachments AS a ON (a.id_msg = m.id_msg AND a.attachment_type = {int:attachment_type})
  588. WHERE m.id_msg = {int:id_msg}
  589. AND m.id_topic = {int:current_topic}',
  590. array(
  591. 'current_topic' => $topic,
  592. 'attachment_type' => 0,
  593. 'id_msg' => $_REQUEST['msg'],
  594. )
  595. );
  596. // The message they were trying to edit was most likely deleted.
  597. /**
  598. * @todo Change this error message?
  599. */
  600. if ($smcFunc['db_num_rows']($request) == 0)
  601. fatal_lang_error('no_board', false);
  602. $row = $smcFunc['db_fetch_assoc']($request);
  603. $attachment_stuff = array($row);
  604. while ($row2 = $smcFunc['db_fetch_assoc']($request))
  605. $attachment_stuff[] = $row2;
  606. $smcFunc['db_free_result']($request);
  607. if ($row['id_member'] == $user_info['id'] && !allowedTo('modify_any'))
  608. {
  609. // Give an extra five minutes over the disable time threshold, so they can type - assuming the post is public.
  610. if ($row['approved'] && !empty($modSettings['edit_disable_time']) && $row['poster_time'] + ($modSettings['edit_disable_time'] + 5) * 60 < time())
  611. fatal_lang_error('modify_post_time_passed', false);
  612. elseif ($row['id_member_poster'] == $user_info['id'] && !allowedTo('modify_own'))
  613. isAllowedTo('modify_replies');
  614. else
  615. isAllowedTo('modify_own');
  616. }
  617. elseif ($row['id_member_poster'] == $user_info['id'] && !allowedTo('modify_any'))
  618. isAllowedTo('modify_replies');
  619. else
  620. isAllowedTo('modify_any');
  621. // When was it last modified?
  622. if (!empty($row['modified_time']))
  623. $context['last_modified'] = timeformat($row['modified_time']);
  624. // Get the stuff ready for the form.
  625. $form_subject = $row['subject'];
  626. $form_message = un_preparsecode($row['body']);
  627. censorText($form_message);
  628. censorText($form_subject);
  629. // Check the boxes that should be checked.
  630. $context['use_smileys'] = !empty($row['smileys_enabled']);
  631. $context['icon'] = $row['icon'];
  632. // Show an "approve" box if the user can approve it, and the message isn't approved.
  633. if (!$row['approved'] && !$context['show_approval'])
  634. $context['show_approval'] = allowedTo('approve_posts');
  635. // Load up 'em attachments!
  636. foreach ($attachment_stuff as $attachment)
  637. {
  638. if ($attachment['filesize'] >= 0 && !empty($modSettings['attachmentEnable']))
  639. $context['current_attachments'][] = array(
  640. 'name' => htmlspecialchars($attachment['filename']),
  641. 'id' => $attachment['id_attach'],
  642. 'approved' => $attachment['attachment_approved'],
  643. );
  644. }
  645. // Allow moderators to change names....
  646. if (allowedTo('moderate_forum') && empty($row['id_member']))
  647. {
  648. $context['name'] = htmlspecialchars($row['poster_name']);
  649. $context['email'] = htmlspecialchars($row['poster_email']);
  650. }
  651. // Set the destinaton.
  652. $context['destination'] = 'post2;start=' . $_REQUEST['start'] . ';msg=' . $_REQUEST['msg'] . ';' . $context['session_var'] . '=' . $context['session_id'] . (isset($_REQUEST['poll']) ? ';poll' : '');
  653. $context['submit_label'] = $txt['save'];
  654. }
  655. // Posting...
  656. else
  657. {
  658. // By default....
  659. $context['use_smileys'] = true;
  660. $context['icon'] = 'xx';
  661. if ($user_info['is_guest'])
  662. {
  663. $context['name'] = isset($_SESSION['guest_name']) ? $_SESSION['guest_name'] : '';
  664. $context['email'] = isset($_SESSION['guest_email']) ? $_SESSION['guest_email'] : '';
  665. }
  666. $context['destination'] = 'post2;start=' . $_REQUEST['start'] . (isset($_REQUEST['poll']) ? ';poll' : '');
  667. $context['submit_label'] = $txt['post'];
  668. // Posting a quoted reply?
  669. if (!empty($topic) && !empty($_REQUEST['quote']))
  670. {
  671. // Make sure they _can_ quote this post, and if so get it.
  672. $request = $smcFunc['db_query']('', '
  673. SELECT m.subject, IFNULL(mem.real_name, m.poster_name) AS poster_name, m.poster_time, m.body
  674. FROM {db_prefix}messages AS m
  675. INNER JOIN {db_prefix}boards AS b ON (b.id_board = m.id_board AND {query_see_board})
  676. LEFT JOIN {db_prefix}members AS mem ON (mem.id_member = m.id_member)
  677. WHERE m.id_msg = {int:id_msg}' . (!$modSettings['postmod_active'] || allowedTo('approve_posts') ? '' : '
  678. AND m.approved = {int:is_approved}') . '
  679. LIMIT 1',
  680. array(
  681. 'id_msg' => (int) $_REQUEST['quote'],
  682. 'is_approved' => 1,
  683. )
  684. );
  685. if ($smcFunc['db_num_rows']($request) == 0)
  686. fatal_lang_error('quoted_post_deleted', false);
  687. list ($form_subject, $mname, $mdate, $form_message) = $smcFunc['db_fetch_row']($request);
  688. $smcFunc['db_free_result']($request);
  689. // Add 'Re: ' to the front of the quoted subject.
  690. if (trim($context['response_prefix']) != '' && $smcFunc['strpos']($form_subject, trim($context['response_prefix'])) !== 0)
  691. $form_subject = $context['response_prefix'] . $form_subject;
  692. // Censor the message and subject.
  693. censorText($form_message);
  694. censorText($form_subject);
  695. // But if it's in HTML world, turn them into htmlspecialchar's so they can be edited!
  696. if (strpos($form_message, '[html]') !== false)
  697. {
  698. $parts = preg_split('~(\[/code\]|\[code(?:=[^\]]+)?\])~i', $form_message, -1, PREG_SPLIT_DELIM_CAPTURE);
  699. for ($i = 0, $n = count($parts); $i < $n; $i++)
  700. {
  701. // It goes 0 = outside, 1 = begin tag, 2 = inside, 3 = close tag, repeat.
  702. if ($i % 4 == 0)
  703. $parts[$i] = preg_replace('~\[html\](.+?)\[/html\]~ise', '\'[html]\' . preg_replace(\'~<br\s?/?' . '>~i\', \'&lt;br /&gt;<br />\', \'$1\') . \'[/html]\'', $parts[$i]);
  704. }
  705. $form_message = implode('', $parts);
  706. }
  707. $form_message = preg_replace('~<br ?/?' . '>~i', "\n", $form_message);
  708. // Remove any nested quotes, if necessary.
  709. if (!empty($modSettings['removeNestedQuotes']))
  710. $form_message = preg_replace(array('~\n?\[quote.*?\].+?\[/quote\]\n?~is', '~^\n~', '~\[/quote\]~'), '', $form_message);
  711. // Add a quote string on the front and end.
  712. $form_message = '[quote author=' . $mname . ' link=topic=' . $topic . '.msg' . (int) $_REQUEST['quote'] . '#msg' . (int) $_REQUEST['quote'] . ' date=' . $mdate . ']' . "\n" . rtrim($form_message) . "\n" . '[/quote]';
  713. }
  714. // Posting a reply without a quote?
  715. elseif (!empty($topic) && empty($_REQUEST['quote']))
  716. {
  717. // Get the first message's subject.
  718. $form_subject = $first_subject;
  719. // Add 'Re: ' to the front of the subject.
  720. if (trim($context['response_prefix']) != '' && $form_subject != '' && $smcFunc['strpos']($form_subject, trim($context['response_prefix'])) !== 0)
  721. $form_subject = $context['response_prefix'] . $form_subject;
  722. // Censor the subject.
  723. censorText($form_subject);
  724. $form_message = '';
  725. }
  726. else
  727. {
  728. $form_subject = isset($_GET['subject']) ? $_GET['subject'] : '';
  729. $form_message = '';
  730. }
  731. }
  732. /**
  733. * This won't work if you're posting an event.
  734. */
  735. if (allowedTo('post_attachment') || allowedTo('post_unapproved_attachments'))
  736. {
  737. if (empty($_SESSION['temp_attachments']))
  738. $_SESSION['temp_attachments'] = array();
  739. if (!empty($modSettings['currentAttachmentUploadDir']))
  740. {
  741. if (!is_array($modSettings['attachmentUploadDir']))
  742. $modSettings['attachmentUploadDir'] = unserialize($modSettings['attachmentUploadDir']);
  743. // Just use the current path for temp files.
  744. $current_attach_dir = $modSettings['attachmentUploadDir'][$modSettings['currentAttachmentUploadDir']];
  745. }
  746. else
  747. $current_attach_dir = $modSettings['attachmentUploadDir'];
  748. // If this isn't a new post, check the current attachments.
  749. if (isset($_REQUEST['msg']))
  750. {
  751. $request = $smcFunc['db_query']('', '
  752. SELECT COUNT(*), SUM(size)
  753. FROM {db_prefix}attachments
  754. WHERE id_msg = {int:id_msg}
  755. AND attachment_type = {int:attachment_type}',
  756. array(
  757. 'id_msg' => (int) $_REQUEST['msg'],
  758. 'attachment_type' => 0,
  759. )
  760. );
  761. list ($quantity, $total_size) = $smcFunc['db_fetch_row']($request);
  762. $smcFunc['db_free_result']($request);
  763. }
  764. else
  765. {
  766. $quantity = 0;
  767. $total_size = 0;
  768. }
  769. $temp_start = 0;
  770. if (!empty($_SESSION['temp_attachments']))
  771. {
  772. if ($context['current_action'] != 'post2' || !empty($_POST['from_qr']))
  773. {
  774. $context['post_error']['messages'][] = $txt['error_temp_attachments'];
  775. $context['error_type'] = 'minor';
  776. }
  777. foreach ($_SESSION['temp_attachments'] as $attachID => $name)
  778. {
  779. $temp_start++;
  780. if (preg_match('~^post_tmp_' . $user_info['id'] . '_\d+$~', $attachID) == 0)
  781. {
  782. unset($_SESSION['temp_attachments'][$attachID]);
  783. continue;
  784. }
  785. if (!empty($_POST['attach_del']) && !in_array($attachID, $_POST['attach_del']))
  786. {
  787. $deleted_attachments = true;
  788. unset($_SESSION['temp_attachments'][$attachID]);
  789. @unlink($current_attach_dir . '/' . $attachID);
  790. continue;
  791. }
  792. $quantity++;
  793. $total_size += filesize($current_attach_dir . '/' . $attachID);
  794. $context['current_attachments'][] = array(
  795. 'name' => htmlspecialchars($name),
  796. 'id' => $attachID,
  797. 'approved' => 1,
  798. );
  799. }
  800. }
  801. if (!empty($_POST['attach_del']))
  802. {
  803. $del_temp = array();
  804. foreach ($_POST['attach_del'] as $i => $dummy)
  805. $del_temp[$i] = (int) $dummy;
  806. foreach ($context['current_attachments'] as $k => $dummy)
  807. if (!in_array($dummy['id'], $del_temp))
  808. {
  809. $context['current_attachments'][$k]['unchecked'] = true;
  810. $deleted_attachments = !isset($deleted_attachments) || is_bool($deleted_attachments) ? 1 : $deleted_attachments + 1;
  811. $quantity--;
  812. }
  813. }
  814. if (!empty($_FILES['attachment']))
  815. foreach ($_FILES['attachment']['tmp_name'] as $n => $dummy)
  816. {
  817. if ($_FILES['attachment']['name'][$n] == '')
  818. continue;
  819. if (!is_uploaded_file($_FILES['attachment']['tmp_name'][$n]) || (ini_get('open_basedir') == '' && !file_exists($_FILES['attachment']['tmp_name'][$n])))
  820. fatal_lang_error('attach_timeout', 'critical');
  821. if (!empty($modSettings['attachmentSizeLimit']) && $_FILES['attachment']['size'][$n] > $modSettings['attachmentSizeLimit'] * 1024)
  822. fatal_lang_error('file_too_big', false, array($modSettings['attachmentSizeLimit']));
  823. $quantity++;
  824. if (!empty($modSettings['attachmentNumPerPostLimit']) && $quantity > $modSettings['attachmentNumPerPostLimit'])
  825. fatal_lang_error('attachments_limit_per_post', false, array($modSettings['attachmentNumPerPostLimit']));
  826. $total_size += $_FILES['attachment']['size'][$n];
  827. if (!empty($modSettings['attachmentPostLimit']) && $total_size > $modSettings['attachmentPostLimit'] * 1024)
  828. fatal_lang_error('file_too_big', false, array($modSettings['attachmentPostLimit']));
  829. if (!empty($modSettings['attachmentCheckExtensions']))
  830. {
  831. if (!in_array(strtolower(substr(strrchr($_FILES['attachment']['name'][$n], '.'), 1)), explode(',', strtolower($modSettings['attachmentExtensions']))))
  832. fatal_error($_FILES['attachment']['name'][$n] . '.<br />' . $txt['cant_upload_type'] . ' ' . $modSettings['attachmentExtensions'] . '.', false);
  833. }
  834. if (!empty($modSettings['attachmentDirSizeLimit']))
  835. {
  836. // Make sure the directory isn't full.
  837. $dirSize = 0;
  838. $dir = @opendir($current_attach_dir) or fatal_lang_error('cant_access_upload_path', 'critical');
  839. while ($file = readdir($dir))
  840. {
  841. if ($file == '.' || $file == '..')
  842. continue;
  843. if (preg_match('~^post_tmp_\d+_\d+$~', $file) != 0)
  844. {
  845. // Temp file is more than 5 hours old!
  846. if (filemtime($current_attach_dir . '/' . $file) < time() - 18000)
  847. @unlink($current_attach_dir . '/' . $file);
  848. continue;
  849. }
  850. $dirSize += filesize($current_attach_dir . '/' . $file);
  851. }
  852. closedir($dir);
  853. // Too big! Maybe you could zip it or something...
  854. if ($_FILES['attachment']['size'][$n] + $dirSize > $modSettings['attachmentDirSizeLimit'] * 1024)
  855. fatal_lang_error('ran_out_of_space');
  856. }
  857. if (!is_writable($current_attach_dir))
  858. fatal_lang_error('attachments_no_write', 'critical');
  859. $attachID = 'post_tmp_' . $user_info['id'] . '_' . $temp_start++;
  860. $_SESSION['temp_attachments'][$attachID] = basename($_FILES['attachment']['name'][$n]);
  861. $context['current_attachments'][] = array(
  862. 'name' => htmlspecialchars(basename($_FILES['attachment']['name'][$n])),
  863. 'id' => $attachID,
  864. 'approved' => 1,
  865. );
  866. $destName = $current_attach_dir . '/' . $attachID;
  867. if (!move_uploaded_file($_FILES['attachment']['tmp_name'][$n], $destName))
  868. fatal_lang_error('attach_timeout', 'critical');
  869. @chmod($destName, 0644);
  870. }
  871. }
  872. // If we are coming here to make a reply, and someone has already replied... make a special warning message.
  873. if (isset($newRepliesError))
  874. {
  875. $context['post_error']['messages'][] = $newRepliesError == 1 ? $txt['error_new_reply'] : $txt['error_new_replies'];
  876. $context['error_type'] = 'minor';
  877. }
  878. if (isset($oldTopicError))
  879. {
  880. $context['post_error']['messages'][] = sprintf($txt['error_old_topic'], $modSettings['oldTopicDays']);
  881. $context['error_type'] = 'minor';
  882. }
  883. // What are you doing? Posting a poll, modifying, previewing, new post, or reply...
  884. if (isset($_REQUEST['poll']))
  885. $context['page_title'] = $txt['new_poll'];
  886. elseif ($context['make_event'])
  887. $context['page_title'] = $context['event']['id'] == -1 ? $txt['calendar_post_event'] : $txt['calendar_edit'];
  888. elseif (isset($_REQUEST['msg']))
  889. $context['page_title'] = $txt['modify_msg'];
  890. elseif (isset($_REQUEST['subject'], $context['preview_subject']))
  891. $context['page_title'] = $txt['preview'] . ' - ' . strip_tags($context['preview_subject']);
  892. elseif (empty($topic))
  893. $context['page_title'] = $txt['start_new_topic'];
  894. else
  895. $context['page_title'] = $txt['post_reply'];
  896. // Build the link tree.
  897. if (empty($topic))
  898. $context['linktree'][] = array(
  899. 'name' => '<em>' . $txt['start_new_topic'] . '</em>'
  900. );
  901. else
  902. $context['linktree'][] = array(
  903. 'url' => $scripturl . '?topic=' . $topic . '.' . $_REQUEST['start'],
  904. 'name' => $form_subject,
  905. 'extra_before' => '<span' . ($settings['linktree_inline'] ? ' class="smalltext"' : '') . '><strong class="nav">' . $context['page_title'] . ' ( </strong></span>',
  906. 'extra_after' => '<span' . ($settings['linktree_inline'] ? ' class="smalltext"' : '') . '><strong class="nav"> )</strong></span>'
  907. );
  908. // Give wireless a linktree url to the post screen, so that they can switch to full version.
  909. if (WIRELESS)
  910. $context['linktree'][count($context['linktree']) - 1]['url'] = $scripturl . '?action=post;' . (!empty($topic) ? 'topic=' . $topic : 'board=' . $board) . '.' . $_REQUEST['start'] . (isset($_REQUEST['msg']) ? ';msg=' . (int) $_REQUEST['msg'] . ';' . $context['session_var'] . '=' . $context['session_id'] : '');
  911. // If they've unchecked an attachment, they may still want to attach that many more files, but don't allow more than num_allowed_attachments.
  912. /**
  913. * @todo This won't work if you're posting an event.
  914. */
  915. $context['num_allowed_attachments'] = empty($modSettings['attachmentNumPerPostLimit']) ? 50 : min($modSettings['attachmentNumPerPostLimit'] - count($context['current_attachments']) + (isset($deleted_attachments) ? $deleted_attachments : 0), $modSettings['attachmentNumPerPostLimit']);
  916. $context['can_post_attachment'] = !empty($modSettings['attachmentEnable']) && $modSettings['attachmentEnable'] == 1 && (allowedTo('post_attachment') || ($modSettings['postmod_active'] && allowedTo('post_unapproved_attachments'))) && $context['num_allowed_attachments'] > 0;
  917. $context['can_post_attachment_unapproved'] = allowedTo('post_attachment');
  918. $context['subject'] = addcslashes($form_subject, '"');
  919. $context['message'] = str_replace(array('"', '<', '>', '&nbsp;'), array('&quot;', '&lt;', '&gt;', ' '), $form_message);
  920. // Needed for the editor and message icons.
  921. require_once($sourcedir . '/Subs-Editor.php');
  922. // Now create the editor.
  923. $editorOptions = array(
  924. 'id' => 'message',
  925. 'value' => $context['message'],
  926. 'labels' => array(
  927. 'post_button' => $context['submit_label'],
  928. ),
  929. // add height and width for the editor
  930. 'height' => '175px',
  931. 'width' => '100%',
  932. // We do XML preview here.
  933. 'preview_type' => 2,
  934. );
  935. create_control_richedit($editorOptions);
  936. // Store the ID.
  937. $context['post_box_name'] = $editorOptions['id'];
  938. $context['attached'] = '';
  939. $context['make_poll'] = isset($_REQUEST['poll']);
  940. // Message icons - customized icons are off?
  941. $context['icons'] = getMessageIcons($board);
  942. if (!empty($context['icons']))
  943. $context['icons'][count($context['icons']) - 1]['is_last'] = true;
  944. $context['icon_url'] = '';
  945. for ($i = 0, $n = count($context['icons']); $i < $n; $i++)
  946. {
  947. $context['icons'][$i]['selected'] = $context['icon'] == $context['icons'][$i]['value'];
  948. if ($context['icons'][$i]['selected'])
  949. $context['icon_url'] = $context['icons'][$i]['url'];
  950. }
  951. if (empty($context['icon_url']))
  952. {
  953. $context['icon_url'] = $settings[file_exists($settings['theme_dir'] . '/images/post/' . $context['icon'] . '.gif') ? 'images_url' : 'default_images_url'] . '/post/' . $context['icon'] . '.gif';
  954. array_unshift($context['icons'], array(
  955. 'value' => $context['icon'],
  956. 'name' => $txt['current_icon'],
  957. 'url' => $context['icon_url'],
  958. 'is_last' => empty($context['icons']),
  959. 'selected' => true,
  960. ));
  961. }
  962. if (!empty($topic) && !empty($modSettings['topicSummaryPosts']))
  963. getTopic();
  964. // If the user can post attachments prepare the warning labels.
  965. if ($context['can_post_attachment'])
  966. {
  967. $context['allowed_extensions'] = strtr($modSettings['attachmentExtensions'], array(',' => ', '));
  968. $context['attachment_restrictions'] = array();
  969. $attachmentRestrictionTypes = array('attachmentNumPerPostLimit', 'attachmentPostLimit', 'attachmentSizeLimit');
  970. foreach ($attachmentRestrictionTypes as $type)
  971. if (!empty($modSettings[$type]))
  972. $context['attachment_restrictions'][] = sprintf($txt['attach_restrict_' . $type], $modSettings[$type]);
  973. }
  974. $context['back_to_topic'] = isset($_REQUEST['goback']) || (isset($_REQUEST['msg']) && !isset($_REQUEST['subject']));
  975. $context['show_additional_options'] = !empty($_POST['additional_options']) || !empty($_SESSION['temp_attachments']) || !empty($deleted_attachments);
  976. $context['is_new_topic'] = empty($topic);
  977. $context['is_new_post'] = !isset($_REQUEST['msg']);
  978. $context['is_first_post'] = $context['is_new_topic'] || (isset($_REQUEST['msg']) && $_REQUEST['msg'] == $id_first_msg);
  979. // Do we need to show the visual verification image?
  980. $context['require_verification'] = !$user_info['is_mod'] && !$user_info['is_admin'] && !empty($modSettings['posts_require_captcha']) && ($user_info['posts'] < $modSettings['posts_require_captcha'] || ($user_info['is_guest'] && $modSettings['posts_require_captcha'] == -1));
  981. if ($context['require_verification'])
  982. {
  983. require_once($sourcedir . '/Subs-Editor.php');
  984. $verificationOptions = array(
  985. 'id' => 'post',
  986. );
  987. $context['require_verification'] = create_control_verification($verificationOptions);
  988. $context['visual_verification_id'] = $verificationOptions['id'];
  989. }
  990. // If they came from quick reply, and have to enter verification details, give them some notice.
  991. if (!empty($_REQUEST['from_qr']) && !empty($context['require_verification']))
  992. {
  993. $context['post_error']['messages'][] = $txt['enter_verification_details'];
  994. $context['error_type'] = 'minor';
  995. }
  996. // WYSIWYG only works if BBC is enabled
  997. $modSettings['disable_wysiwyg'] = !empty($modSettings['disable_wysiwyg']) || empty($modSettings['enableBBC']);
  998. // Register this form in the session variables.
  999. checkSubmitOnce('register');
  1000. // Finally, load the template.
  1001. if (WIRELESS && WIRELESS_PROTOCOL != 'wap')
  1002. $context['sub_template'] = WIRELESS_PROTOCOL . '_post';
  1003. elseif (!isset($_REQUEST['xml']))
  1004. loadTemplate('Post');
  1005. }
  1006. /**
  1007. * actually posts or saves the message composed with Post().
  1008. * requires various permissions depending on the action.
  1009. * handles attachment, post, and calendar saving.
  1010. * sends off notifications, and allows for announcements and moderation.
  1011. * accessed from ?action=post2.
  1012. */
  1013. function Post2()
  1014. {
  1015. global $board, $topic, $txt, $modSettings, $sourcedir, $context;
  1016. global $user_info, $board_info, $options, $smcFunc;
  1017. // Sneaking off, are we?
  1018. if (empty($_POST) && empty($topic))
  1019. redirectexit('action=post;board=' . $board . '.0');
  1020. elseif (empty($_POST) && !empty($topic))
  1021. redirectexit('action=post;topic=' . $topic . '.0');
  1022. // No need!
  1023. $context['robot_no_index'] = true;
  1024. // If we came from WYSIWYG then turn it back into BBC regardless.
  1025. if (!empty($_REQUEST['message_mode']) && isset($_REQUEST['message']))
  1026. {
  1027. require_once($sourcedir . '/Subs-Editor.php');
  1028. $_REQUEST['message'] = html_to_bbc($_REQUEST['message']);
  1029. // We need to unhtml it now as it gets done shortly.
  1030. $_REQUEST['message'] = un_htmlspecialchars($_REQUEST['message']);
  1031. // We need this for everything else.
  1032. $_POST['message'] = $_REQUEST['message'];
  1033. }
  1034. // Previewing? Go back to start.
  1035. if (isset($_REQUEST['preview']))
  1036. return Post();
  1037. // Prevent double submission of this form.
  1038. checkSubmitOnce('check');
  1039. // No errors as yet.
  1040. $post_errors = array();
  1041. // If the session has timed out, let the user re-submit their form.
  1042. if (checkSession('post', '', false) != '')
  1043. $post_errors[] = 'session_timeout';
  1044. // Wrong verification code?
  1045. if (!$user_info['is_admin'] && !$user_info['is_mod'] && !empty($modSettings['posts_require_captcha']) && ($user_info['posts'] < $modSettings['posts_require_captcha'] || ($user_info['is_guest'] && $modSettings['posts_require_captcha'] == -1)))
  1046. {
  1047. require_once($sourcedir . '/Subs-Editor.php');
  1048. $verificationOptions = array(
  1049. 'id' => 'post',
  1050. );
  1051. $context['require_verification'] = create_control_verification($verificationOptions, true);
  1052. if (is_array($context['require_verification']))
  1053. $post_errors = array_merge($post_errors, $context['require_verification']);
  1054. }
  1055. require_once($sourcedir . '/Subs-Post.php');
  1056. loadLanguage('Post');
  1057. // If this isn't a new topic load the topic info that we need.
  1058. if (!empty($topic))
  1059. {
  1060. $request = $smcFunc['db_query']('', '
  1061. SELECT locked, is_sticky, id_poll, approved, id_first_msg, id_last_msg, id_member_started, id_board
  1062. FROM {db_prefix}topics
  1063. WHERE id_topic = {int:current_topic}
  1064. LIMIT 1',
  1065. array(
  1066. 'current_topic' => $topic,
  1067. )
  1068. );
  1069. $topic_info = $smcFunc['db_fetch_assoc']($request);
  1070. $smcFunc['db_free_result']($request);
  1071. // Though the topic should be there, it might have vanished.
  1072. if (!is_array($topic_info))
  1073. fatal_lang_error('topic_doesnt_exist');
  1074. // Did this topic suddenly move? Just checking...
  1075. if ($topic_info['id_board'] != $board)
  1076. fatal_lang_error('not_a_topic');
  1077. }
  1078. // Replying to a topic?
  1079. if (!empty($topic) && !isset($_REQUEST['msg']))
  1080. {
  1081. // Don't allow a post if it's locked.
  1082. if ($topic_info['locked'] != 0 && !allowedTo('moderate_board'))
  1083. fatal_lang_error('topic_locked', false);
  1084. // Sorry, multiple polls aren't allowed... yet. You should stop giving me ideas :P.
  1085. if (isset($_REQUEST['poll']) && $topic_info['id_poll'] > 0)
  1086. unset($_REQUEST['poll']);
  1087. // Do the permissions and approval stuff...
  1088. $becomesApproved = true;
  1089. if ($topic_info['id_member_started'] != $user_info['id'])
  1090. {
  1091. if ($modSettings['postmod_active'] && allowedTo('post_unapproved_replies_any') && !allowedTo('post_reply_any'))
  1092. $becomesApproved = false;
  1093. else
  1094. isAllowedTo('post_reply_any');
  1095. }
  1096. elseif (!allowedTo('post_reply_any'))
  1097. {
  1098. if ($modSettings['postmod_active'] && allowedTo('post_unapproved_replies_own') && !allowedTo('post_reply_own'))
  1099. $becomesApproved = false;
  1100. else
  1101. isAllowedTo('post_reply_own');
  1102. }
  1103. if (isset($_POST['lock']))
  1104. {
  1105. // Nothing is changed to the lock.
  1106. if ((empty($topic_info['locked']) && empty($_POST['lock'])) || (!empty($_POST['lock']) && !empty($topic_info['locked'])))
  1107. unset($_POST['lock']);
  1108. // You're have no permission to lock this topic.
  1109. elseif (!allowedTo(array('lock_any', 'lock_own')) || (!allowedTo('lock_any') && $user_info['id'] != $topic_info['id_member_started']))
  1110. unset($_POST['lock']);
  1111. // You are allowed to (un)lock your own topic only.
  1112. elseif (!allowedTo('lock_any'))
  1113. {
  1114. // You cannot override a moderator lock.
  1115. if ($topic_info['locked'] == 1)
  1116. unset($_POST['lock']);
  1117. else
  1118. $_POST['lock'] = empty($_POST['lock']) ? 0 : 2;
  1119. }
  1120. // Hail mighty moderator, (un)lock this topic immediately.
  1121. else
  1122. $_POST['lock'] = empty($_POST['lock']) ? 0 : 1;
  1123. }
  1124. // So you wanna (un)sticky this...let's see.
  1125. if (isset($_POST['sticky']) && (empty($modSettings['enableStickyTopics']) || $_POST['sticky'] == $topic_info['is_sticky'] || !allowedTo('make_sticky')))
  1126. unset($_POST['sticky']);
  1127. // If the number of replies has changed, if the setting is enabled, go back to Post() - which handles the error.
  1128. if (empty($options['no_new_reply_warning']) && isset($_POST['last_msg']) && $topic_info['id_last_msg'] > $_POST['last_msg'])
  1129. {
  1130. $_REQUEST['preview'] = true;
  1131. return Post();
  1132. }
  1133. $posterIsGuest = $user_info['is_guest'];
  1134. }
  1135. // Posting a new topic.
  1136. elseif (empty($topic))
  1137. {
  1138. // Now don't be silly, new topics will get their own id_msg soon enough.
  1139. unset($_REQUEST['msg'], $_POST['msg'], $_GET['msg']);
  1140. // Do like, the permissions, for safety and stuff...
  1141. $becomesApproved = true;
  1142. if ($modSettings['postmod_active'] && !allowedTo('post_new') && allowedTo('post_unapproved_topics'))
  1143. $becomesApproved = false;
  1144. else
  1145. isAllowedTo('post_new');
  1146. if (isset($_POST['lock']))
  1147. {
  1148. // New topics are by default not locked.
  1149. if (empty($_POST['lock']))
  1150. unset($_POST['lock']);
  1151. // Besides, you need permission.
  1152. elseif (!allowedTo(array('lock_any', 'lock_own')))
  1153. unset($_POST['lock']);
  1154. // A moderator-lock (1) can override a user-lock (2).
  1155. else
  1156. $_POST['lock'] = allowedTo('lock_any') ? 1 : 2;
  1157. }
  1158. if (isset($_POST['sticky']) && (empty($modSettings['enableStickyTopics']) || empty($_POST['sticky']) || !allowedTo('make_sticky')))
  1159. unset($_POST['sticky']);
  1160. $posterIsGuest = $user_info['is_guest'];
  1161. }
  1162. // Modifying an existing message?
  1163. elseif (isset($_REQUEST['msg']) && !empty($topic))
  1164. {
  1165. $_REQUEST['msg'] = (int) $_REQUEST['msg'];
  1166. $request = $smcFunc['db_query']('', '
  1167. SELECT id_member, poster_name, poster_email, poster_time, approved
  1168. FROM {db_prefix}messages
  1169. WHERE id_msg = {int:id_msg}
  1170. LIMIT 1',
  1171. array(
  1172. 'id_msg' => $_REQUEST['msg'],
  1173. )
  1174. );
  1175. if ($smcFunc['db_num_rows']($request) == 0)
  1176. fatal_lang_error('cant_find_messages', false);
  1177. $row = $smcFunc['db_fetch_assoc']($request);
  1178. $smcFunc['db_free_result']($request);
  1179. if (!empty($topic_info['locked']) && !allowedTo('moderate_board'))
  1180. fatal_lang_error('topic_locked', false);
  1181. if (isset($_POST['lock']))
  1182. {
  1183. // Nothing changes to the lock status.
  1184. if ((empty($_POST['lock']) && empty($topic_info['locked'])) || (!empty($_POST['lock']) && !empty($topic_info['locked'])))
  1185. unset($_POST['lock']);
  1186. // You're simply not allowed to (un)lock this.
  1187. elseif (!allowedTo(array('lock_any', 'lock_own')) || (!allowedTo('lock_any') && $user_info['id'] != $topic_info['id_member_started']))
  1188. unset($_POST['lock']);
  1189. // You're only allowed to lock your own topics.
  1190. elseif (!allowedTo('lock_any'))
  1191. {
  1192. // You're not allowed to break a moderator's lock.
  1193. if ($topic_info['locked'] == 1)
  1194. unset($_POST['lock']);
  1195. // Lock it with a soft lock or unlock it.
  1196. else
  1197. $_POST['lock'] = empty($_POST['lock']) ? 0 : 2;
  1198. }
  1199. // You must be the moderator.
  1200. else
  1201. $_POST['lock'] = empty($_POST['lock']) ? 0 : 1;
  1202. }
  1203. // Change the sticky status of this topic?
  1204. if (isset($_POST['sticky']) && (!allowedTo('make_sticky') || $_POST['sticky'] == $topic_info['is_sticky']))
  1205. unset($_POST['sticky']);
  1206. if ($row['id_member'] == $user_info['id'] && !allowedTo('modify_any'))
  1207. {
  1208. if ((!$modSettings['postmod_active'] || $row['approved']) && !empty($modSettings['edit_disable_time']) && $row['poster_time'] + ($modSettings['edit_disable_time'] + 5) * 60 < time())
  1209. fatal_lang_error('modify_post_time_passed', false);
  1210. elseif ($topic_info['id_member_started'] == $user_info['id'] && !allowedTo('modify_own'))
  1211. isAllowedTo('modify_replies');
  1212. else
  1213. isAllowedTo('modify_own');
  1214. }
  1215. elseif ($topic_info['id_member_started'] == $user_info['id'] && !allowedTo('modify_any'))
  1216. {
  1217. isAllowedTo('modify_replies');
  1218. // If you're modifying a reply, I say it better be logged...
  1219. $moderationAction = true;
  1220. }
  1221. else
  1222. {
  1223. isAllowedTo('modify_any');
  1224. // Log it, assuming you're not modifying your own post.
  1225. if ($row['id_member'] != $user_info['id'])
  1226. $moderationAction = true;
  1227. }
  1228. $posterIsGuest = empty($row['id_member']);
  1229. // Can they approve it?
  1230. $can_approve = allowedTo('approve_posts');
  1231. $becomesApproved = $modSettings['postmod_active'] ? ($can_approve && !$row['approved'] ? (!empty($_REQUEST['approve']) ? 1 : 0) : $row['approved']) : 1;
  1232. $approve_has_changed = $row['approved'] != $becomesApproved;
  1233. if (!allowedTo('moderate_forum') || !$posterIsGuest)
  1234. {
  1235. $_POST['guestname'] = $row['poster_name'];
  1236. $_POST['email'] = $row['poster_email'];
  1237. }
  1238. }
  1239. // If the poster is a guest evaluate the legality of name and email.
  1240. if ($posterIsGuest)
  1241. {
  1242. $_POST['guestname'] = !isset($_POST['guestname']) ? '' : trim($_POST['guestname']);
  1243. $_POST['email'] = !isset($_POST['email']) ? '' : trim($_POST['email']);
  1244. if ($_POST['guestname'] == '' || $_POST['guestname'] == '_')
  1245. $post_errors[] = 'no_name';
  1246. if ($smcFunc['strlen']($_POST['guestname']) > 25)
  1247. $post_errors[] = 'long_name';
  1248. if (empty($modSettings['guest_post_no_email']))
  1249. {
  1250. // Only check if they changed it!
  1251. if (!isset($row) || $row['poster_email'] != $_POST['email'])
  1252. {
  1253. if (!allowedTo('moderate_forum') && (!isset($_POST['email']) || $_POST['email'] == ''))
  1254. $post_errors[] = 'no_email';
  1255. if (!allowedTo('moderate_forum') && preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', $_POST['email']) == 0)
  1256. $post_errors[] = 'bad_email';
  1257. }
  1258. // Now make sure this email address is not banned from posting.
  1259. isBannedEmail($_POST['email'], 'cannot_post', sprintf($txt['you_are_post_banned'], $txt['guest_title']));
  1260. }
  1261. // In case they are making multiple posts this visit, help them along by storing their name.
  1262. if (empty($post_errors))
  1263. {
  1264. $_SESSION['guest_name'] = $_POST['guestname'];
  1265. $_SESSION['guest_email'] = $_POST['email'];
  1266. }
  1267. }
  1268. // Check the subject and message.
  1269. if (!isset($_POST['subject']) || $smcFunc['htmltrim']($smcFunc['htmlspecialchars']($_POST['subject'])) === '')
  1270. $post_errors[] = 'no_subject';
  1271. if (!isset($_POST['message']) || $smcFunc['htmltrim']($smcFunc['htmlspecialchars']($_POST['message']), ENT_QUOTES) === '')
  1272. $post_errors[] = 'no_message';
  1273. elseif (!empty($modSettings['max_messageLength']) && $smcFunc['strlen']($_POST['message']) > $modSettings['max_messageLength'])
  1274. $post_errors[] = 'long_message';
  1275. else
  1276. {
  1277. // Prepare the message a bit for some additional testing.
  1278. $_POST['message'] = $smcFunc['htmlspecialchars']($_POST['message'], ENT_QUOTES);
  1279. // Preparse code. (Zef)
  1280. if ($user_info['is_guest'])
  1281. $user_info['name'] = $_POST['guestname'];
  1282. preparsecode($_POST['message']);
  1283. // Let's see if there's still some content left without the tags.
  1284. if ($smcFunc['htmltrim'](strip_tags(parse_bbc($_POST['message'], false), '<img>')) === '' && (!allowedTo('admin_forum') || strpos($_POST['message'], '[html]') === false))
  1285. $post_errors[] = 'no_message';
  1286. }
  1287. if (isset($_POST['calendar']) && !isset($_REQUEST['deleteevent']) && $smcFunc['htmltrim']($_POST['evtitle']) === '')
  1288. $post_errors[] = 'no_event';
  1289. // You are not!
  1290. if (isset($_POST['message']) && strtolower($_POST['message']) == 'i am the administrator.' && !$user_info['is_admin'])
  1291. fatal_error('Knave! Masquerader! Charlatan!', false);
  1292. // Validate the poll...
  1293. if (isset($_REQUEST['poll']) && $modSettings['pollMode'] == '1')
  1294. {
  1295. if (!empty($topic) && !isset($_REQUEST['msg']))
  1296. fatal_lang_error('no_access', false);
  1297. // This is a new topic... so it's a new poll.
  1298. if (empty($topic))
  1299. isAllowedTo('poll_post');
  1300. // Can you add to your own topics?
  1301. elseif ($user_info['id'] == $topic_info['id_member_started'] && !allowedTo('poll_add_any'))
  1302. isAllowedTo('poll_add_own');
  1303. // Can you add polls to any topic, then?
  1304. else
  1305. isAllowedTo('poll_add_any');
  1306. if (!isset($_POST['question']) || trim($_POST['question']) == '')
  1307. $post_errors[] = 'no_question';
  1308. $_POST['options'] = empty($_POST['options']) ? array() : htmltrim__recursive($_POST['options']);
  1309. // Get rid of empty ones.
  1310. foreach ($_POST['options'] as $k => $option)
  1311. if ($option == '')
  1312. unset($_POST['options'][$k], $_POST['options'][$k]);
  1313. // What are you going to vote between with one choice?!?
  1314. if (count($_POST['options']) < 2)
  1315. $post_errors[] = 'poll_few';
  1316. elseif (count($_POST['options']) > 256)
  1317. $post_errors[] = 'poll_many';
  1318. }
  1319. if ($posterIsGuest)
  1320. {
  1321. // If user is a guest, make sure the chosen name isn't taken.
  1322. require_once($sourcedir . '/Subs-Members.php');
  1323. if (isReservedName($_POST['guestname'], 0, true, false) && (!isset($row['poster_name']) || $_POST['guestname'] != $row['poster_name']))
  1324. $post_errors[] = 'bad_name';
  1325. }
  1326. // If the user isn't a guest, get his or her name and email.
  1327. elseif (!isset($_REQUEST['msg']))
  1328. {
  1329. $_POST['guestname'] = $user_info['username'];
  1330. $_POST['email'] = $user_info['email'];
  1331. }
  1332. // Any mistakes?
  1333. if (!empty($post_errors))
  1334. {
  1335. loadLanguage('Errors');
  1336. // Previewing.
  1337. $_REQUEST['preview'] = true;
  1338. $context['post_error'] = array('messages' => array());
  1339. foreach ($post_errors as $post_error)
  1340. {
  1341. $context['post_error'][$post_error] = true;
  1342. if ($post_error == 'long_message')
  1343. $txt['error_' . $post_error] = sprintf($txt['error_' . $post_error], $modSettings['max_messageLength']);
  1344. $context['post_error']['messages'][] = $txt['error_' . $post_error];
  1345. }
  1346. return Post();
  1347. }
  1348. // Make sure the user isn't spamming the board.
  1349. if (!isset($_REQUEST['msg']))
  1350. spamProtection('post');
  1351. // At about this point, we're posting and that's that.
  1352. ignore_user_abort(true);
  1353. @set_time_limit(300);
  1354. // Add special html entities to the subject, name, and email.
  1355. $_POST['subject'] = strtr($smcFunc['htmlspecialchars']($_POST['subject']), array("\r" => '', "\n" => '', "\t" => ''));
  1356. $_POST['guestname'] = htmlspecialchars($_POST['guestname']);
  1357. $_POST['email'] = htmlspecialchars($_POST['email']);
  1358. // At this point, we want to make sure the subject isn't too long.
  1359. if ($smcFunc['strlen']($_POST['subject']) > 100)
  1360. $_POST['subject'] = $smcFunc['substr']($_POST['subject'], 0, 100);
  1361. // Make the poll...
  1362. if (isset($_REQUEST['poll']))
  1363. {
  1364. // Make sure that the user has not entered a ridiculous number of options..
  1365. if (empty($_POST['poll_max_votes']) || $_POST['poll_max_votes'] <= 0)
  1366. $_POST['poll_max_votes'] = 1;
  1367. elseif ($_POST['poll_max_votes'] > count($_POST['options']))
  1368. $_POST['poll_max_votes'] = count($_POST['options']);
  1369. else
  1370. $_POST['poll_max_votes'] = (int) $_POST['poll_max_votes'];
  1371. $_POST['poll_expire'] = (int) $_POST['poll_expire'];
  1372. $_POST['poll_expire'] = $_POST['poll_expire'] > 9999 ? 9999 : ($_POST['poll_expire'] < 0 ? 0 : $_POST['poll_expire']);
  1373. // Just set it to zero if it's not there..
  1374. if (!isset($_POST['poll_hide']))
  1375. $_POST['poll_hide'] = 0;
  1376. else
  1377. $_POST['poll_hide'] = (int) $_POST['poll_hide'];
  1378. $_POST['poll_change_vote'] = isset($_POST['poll_change_vote']) ? 1 : 0;
  1379. $_POST['poll_guest_vote'] = isset($_POST['poll_guest_vote']) ? 1 : 0;
  1380. // Make sure guests are actually allowed to vote generally.
  1381. if ($_POST['poll_guest_vote'])
  1382. {
  1383. require_once($sourcedir . '/Subs-Members.php');
  1384. $allowedVoteGroups = groupsAllowedTo('poll_vote', $board);
  1385. if (!in_array(-1, $allowedVoteGroups['allowed']))
  1386. $_POST['poll_guest_vote'] = 0;
  1387. }
  1388. // If the user tries to set the poll too far in advance, don't let them.
  1389. if (!empty($_POST['poll_expire']) && $_POST['poll_expire'] < 1)
  1390. fatal_lang_error('poll_range_error', false);
  1391. // Don't allow them to select option 2 for hidden results if it's not time limited.
  1392. elseif (empty($_POST['poll_expire']) && $_POST['poll_hide'] == 2)
  1393. $_POST['poll_hide'] = 1;
  1394. // Clean up the question and answers.
  1395. $_POST['question'] = htmlspecialchars($_POST['question']);
  1396. $_POST['question'] = $smcFunc['truncate']($_POST['question'], 255);
  1397. $_POST['question'] = preg_replace('~&amp;#(\d{4,5}|[2-9]\d{2,4}|1[2-9]\d);~', '&#$1;', $_POST['question']);
  1398. $_POST['options'] = htmlspecialchars__recursive($_POST['options']);
  1399. }
  1400. // Check if they are trying to delete any current attachments....
  1401. if (isset($_REQUEST['msg'], $_POST['attach_del']) && (allowedTo('post_attachment') || ($modSettings['postmod_active'] && allowedTo('post_unapproved_attachments'))))
  1402. {
  1403. // @todo check attach_del; this will be executed when:
  1404. // modify a post with attachments; try to remove one, but receive an error
  1405. // (i.e. body empty); then check back the attachment
  1406. $del_temp = array();
  1407. foreach ($_POST['attach_del'] as $i => $dummy)
  1408. $del_temp[$i] = (int) $dummy;
  1409. require_once($sourcedir . '/ManageAttachments.php');
  1410. $attachmentQuery = array(
  1411. 'attachment_type' => 0,
  1412. 'id_msg' => (int) $_REQUEST['msg'],
  1413. 'not_id_attach' => $del_temp,
  1414. );
  1415. removeAttachments($attachmentQuery);
  1416. }
  1417. // ...or attach a new file...
  1418. if (isset($_FILES['attachment']['name']) || (!empty($_SESSION['temp_attachments']) && empty($_POST['from_qr'])))
  1419. {
  1420. // Verify they can post them!
  1421. if (!$modSettings['postmod_active'] || !allowedTo('post_unapproved_attachments'))
  1422. isAllowedTo('post_attachment');
  1423. // Make sure we're uploading to the right place.
  1424. if (!empty($modSettings['currentAttachmentUploadDir']))
  1425. {
  1426. if (!is_array($modSettings['attachmentUploadDir']))
  1427. $modSettings['attachmentUploadDir'] = unserialize($modSettings['attachmentUploadDir']);
  1428. // The current directory, of course!
  1429. $current_attach_dir = $modSettings['attachmentUploadDir'][$modSettings['currentAttachmentUploadDir']];
  1430. }
  1431. else
  1432. $current_attach_dir = $modSettings['attachmentUploadDir'];
  1433. // If this isn't a new post, check the current attachments.
  1434. if (isset($_REQUEST['msg']))
  1435. {
  1436. $request = $smcFunc['db_query']('', '
  1437. SELECT COUNT(*), SUM(size)
  1438. FROM {db_prefix}attachments
  1439. WHERE id_msg = {int:id_msg}
  1440. AND attachment_type = {int:attachment_type}',
  1441. array(
  1442. 'id_msg' => (int) $_REQUEST['msg'],
  1443. 'attachment_type' => 0,
  1444. )
  1445. );
  1446. list ($quantity, $total_size) = $smcFunc['db_fetch_row']($request);
  1447. $smcFunc['db_free_result']($request);
  1448. }
  1449. else
  1450. {
  1451. $quantity = 0;
  1452. $total_size = 0;
  1453. }
  1454. if (!empty($_SESSION['temp_attachments']))
  1455. foreach ($_SESSION['temp_attachments'] as $attachID => $name)
  1456. {
  1457. if (preg_match('~^post_tmp_' . $user_info['id'] . '_\d+$~', $attachID) == 0)
  1458. continue;
  1459. if (!empty($_POST['attach_del']) && !in_array($attachID, $_POST['attach_del']))
  1460. {
  1461. unset($_SESSION['temp_attachments'][$attachID]);
  1462. @unlink($current_attach_dir . '/' . $attachID);
  1463. continue;
  1464. }
  1465. $_FILES['attachment']['tmp_name'][] = $attachID;
  1466. $_FILES['attachment']['name'][] = $name;
  1467. $_FILES['attachment']['size'][] = filesize($current_attach_dir . '/' . $attachID);
  1468. list ($_FILES['attachment']['width'][], $_FILES['attachment']['height'][]) = @getimagesize($current_attach_dir . '/' . $attachID);
  1469. unset($_SESSION['temp_attachments'][$attachID]);
  1470. }
  1471. if (!isset($_FILES['attachment']['name']))
  1472. $_FILES['attachment']['tmp_name'] = array();
  1473. $attachIDs = array();
  1474. foreach ($_FILES['attachment']['tmp_name'] as $n => $dummy)
  1475. {
  1476. if ($_FILES['attachment']['name'][$n] == '')
  1477. continue;
  1478. // Have we reached the maximum number of files we are allowed?
  1479. $quantity++;
  1480. if (!empty($modSettings['attachmentNumPerPostLimit']) && $quantity > $modSettings['attachmentNumPerPostLimit'])
  1481. {
  1482. checkSubmitOnce('free');
  1483. fatal_lang_error('attachments_limit_per_post', false, array($modSettings['attachmentNumPerPostLimit']));
  1484. }
  1485. // Check the total upload size for this post...
  1486. $total_size += $_FILES['attachment']['size'][$n];
  1487. if (!empty($modSettings['attachmentPostLimit']) && $total_size > $modSettings['attachmentPostLimit'] * 1024)
  1488. {
  1489. checkSubmitOnce('free');
  1490. fatal_lang_error('file_too_big', false, array($modSettings['attachmentPostLimit']));
  1491. }
  1492. $attachmentOptions = array(
  1493. 'post' => isset($_REQUEST['msg']) ? $_REQUEST['msg'] : 0,
  1494. 'poster' => $user_info['id'],
  1495. 'name' => $_FILES['attachment']['name'][$n],
  1496. 'tmp_name' => $_FILES['attachment']['tmp_name'][$n],
  1497. 'size' => $_FILES['attachment']['size'][$n],
  1498. 'approved' => !$modSettings['postmod_active'] || allowedTo('post_attachment'),
  1499. );
  1500. if (createAttachment($attachmentOptions))
  1501. {
  1502. $attachIDs[] = $attachmentOptions['id'];
  1503. if (!empty($attachmentOptions['thumb']))
  1504. $attachIDs[] = $attachmentOptions['thumb'];
  1505. }
  1506. else
  1507. {
  1508. if (in_array('could_not_upload', $attachmentOptions['errors']))
  1509. {
  1510. checkSubmitOnce('free');
  1511. fatal_lang_error('attach_timeout', 'critical');
  1512. }
  1513. if (in_array('too_large', $attachmentOptions['errors']))
  1514. {
  1515. checkSubmitOnce('free');
  1516. fatal_lang_error('file_too_big', false, array($modSettings['attachmentSizeLimit']));
  1517. }
  1518. if (in_array('bad_extension', $attachmentOptions['errors']))
  1519. {
  1520. checkSubmitOnce('free');
  1521. fatal_error($attachmentOptions['name'] . '.<br />' . $txt['cant_upload_type'] . ' ' . $modSettings['attachmentExtensions'] . '.', false);
  1522. }
  1523. if (in_array('directory_full', $attachmentOptions['errors']))
  1524. {
  1525. checkSubmitOnce('free');
  1526. fatal_lang_error('ran_out_of_space', 'critical');
  1527. }
  1528. if (in_array('bad_filename', $attachmentOptions['errors']))
  1529. {
  1530. checkSubmitOnce('free');
  1531. fatal_error(basename($attachmentOptions['name']) . '.<br />' . $txt['restricted_filename'] . '.', 'critical');
  1532. }
  1533. if (in_array('taken_filename', $attachmentOptions['errors']))
  1534. {
  1535. checkSubmitOnce('free');
  1536. fatal_lang_error('filename_exists');
  1537. }
  1538. if (in_array('bad_attachment', $attachmentOptions['errors']))
  1539. {
  1540. checkSubmitOnce('free');
  1541. fatal_lang_error('bad_attachment');
  1542. }
  1543. }
  1544. }
  1545. }
  1546. // Make the poll...
  1547. if (isset($_REQUEST['poll']))
  1548. {
  1549. // Create the poll.
  1550. $smcFunc['db_insert']('',
  1551. '{db_prefix}polls',
  1552. array(
  1553. 'question' => 'string-255', 'hide_results' => 'int', 'max_votes' => 'int', 'expire_time' => 'int', 'id_member' => 'int',
  1554. 'poster_name' => 'string-255', 'change_vote' => 'int', 'guest_vote' => 'int'
  1555. ),
  1556. array(
  1557. $_POST['question'], $_POST['poll_hide'], $_POST['poll_max_votes'], (empty($_POST['poll_expire']) ? 0 : time() + $_POST['poll_expire'] * 3600 * 24), $user_info['id'],
  1558. $_POST['guestname'], $_POST['poll_change_vote'], $_POST['poll_guest_vote'],
  1559. ),
  1560. array('id_poll')
  1561. );
  1562. $id_poll = $smcFunc['db_insert_id']('{db_prefix}polls', 'id_poll');
  1563. // Create each answer choice.
  1564. $i = 0;
  1565. $pollOptions = array();
  1566. foreach ($_POST['options'] as $option)
  1567. {
  1568. $pollOptions[] = array($id_poll, $i, $option);
  1569. $i++;
  1570. }
  1571. $smcFunc['db_insert']('insert',
  1572. '{db_prefix}poll_choices',
  1573. array('id_poll' => 'int', 'id_choice' => 'int', 'label' => 'string-255'),
  1574. $pollOptions,
  1575. array('id_poll', 'id_choice')
  1576. );
  1577. }
  1578. else
  1579. $id_poll = 0;
  1580. // Creating a new topic?
  1581. $newTopic = empty($_REQUEST['msg']) && empty($topic);
  1582. $_POST['icon'] = !empty($attachIDs) && $_POST['icon'] == 'xx' ? 'clip' : $_POST['icon'];
  1583. // Collect all parameters for the creation or modification of a post.
  1584. $msgOptions = array(
  1585. 'id' => empty($_REQUEST['msg']) ? 0 : (int) $_REQUEST['msg'],
  1586. 'subject' => $_POST['subject'],
  1587. 'body' => $_POST['message'],
  1588. 'icon' => preg_replace('~[\./\\\\*:"\'<>]~', '', $_POST['icon']),
  1589. 'smileys_enabled' => !isset($_POST['ns']),
  1590. 'attachments' => empty($attachIDs) ? array() : $attachIDs,
  1591. 'approved' => $becomesApproved,
  1592. );
  1593. $topicOptions = array(
  1594. 'id' => empty($topic) ? 0 : $topic,
  1595. 'board' => $board,
  1596. 'poll' => isset($_REQUEST['poll']) ? $id_poll : null,
  1597. 'lock_mode' => isset($_POST['lock']) ? (int) $_POST['lock'] : null,
  1598. 'sticky_mode' => isset($_POST['sticky']) && !empty($modSettings['enableStickyTopics']) ? (int) $_POST['sticky'] : null,
  1599. 'mark_as_read' => true,
  1600. 'is_approved' => !$modSettings['postmod_active'] || empty($topic) || !empty($board_info['cur_topic_approved']),
  1601. );
  1602. $posterOptions = array(
  1603. 'id' => $user_info['id'],
  1604. 'name' => $_POST['guestname'],
  1605. 'email' => $_POST['email'],
  1606. 'update_post_count' => !$user_info['is_guest'] && !isset($_REQUEST['msg']) && $board_info['posts_count'],
  1607. );
  1608. // This is an already existing message. Edit it.
  1609. if (!empty($_REQUEST['msg']))
  1610. {
  1611. // Have admins allowed people to hide their screwups?
  1612. if (time() - $row['poster_time'] > $modSettings['edit_wait_time'] || $user_info['id'] != $row['id_member'])
  1613. {
  1614. $msgOptions['modify_time'] = time();
  1615. $msgOptions['modify_name'] = $user_info['name'];
  1616. }
  1617. // This will save some time...
  1618. if (empty($approve_has_changed))
  1619. unset($msgOptions['approved']);
  1620. modifyPost($msgOptions, $topicOptions, $posterOptions);
  1621. }
  1622. // This is a new topic or an already existing one. Save it.
  1623. else
  1624. {
  1625. createPost($msgOptions, $topicOptions, $posterOptions);
  1626. if (isset($topicOptions['id']))
  1627. $topic = $topicOptions['id'];
  1628. }
  1629. // Editing or posting an event?
  1630. if (isset($_POST['calendar']) && (!isset($_REQUEST['eventid']) || $_REQUEST['eventid'] == -1))
  1631. {
  1632. require_once($sourcedir . '/Subs-Calendar.php');
  1633. // Make sure they can link an event to this post.
  1634. canLinkEvent();
  1635. // Insert the event.
  1636. $eventOptions = array(
  1637. 'board' => $board,
  1638. 'topic' => $topic,
  1639. 'title' => $_POST['evtitle'],
  1640. 'member' => $user_info['id'],
  1641. 'start_date' => sprintf('%04d-%02d-%02d', $_POST['year'], $_POST['month'], $_POST['day']),
  1642. 'span' => isset($_POST['span']) && $_POST['span'] > 0 ? min((int) $modSettings['cal_maxspan'], (int) $_POST['span'] - 1) : 0,
  1643. );
  1644. insertEvent($eventOptions);
  1645. }
  1646. elseif (isset($_POST['calendar']))
  1647. {
  1648. $_REQUEST['eventid'] = (int) $_REQUEST['eventid'];
  1649. // Validate the post...
  1650. require_once($sourcedir . '/Subs-Calendar.php');
  1651. validateEventPost();
  1652. // If you're not allowed to edit any events, you have to be the poster.
  1653. if (!allowedTo('calendar_edit_any'))
  1654. {
  1655. // Get the event's poster.
  1656. $request = $smcFunc['db_query']('', '
  1657. SELECT id_member
  1658. FROM {db_prefix}calendar
  1659. WHERE id_event = {int:id_event}',
  1660. array(
  1661. 'id_event' => $_REQUEST['eventid'],
  1662. )
  1663. );
  1664. $row2 = $smcFunc['db_fetch_assoc']($request);
  1665. $smcFunc['db_free_result']($request);
  1666. // Silly hacker, Trix are for kids. ...probably trademarked somewhere, this is FAIR USE! (parody...)
  1667. isAllowedTo('calendar_edit_' . ($row2['id_member'] == $user_info['id'] ? 'own' : 'any'));
  1668. }
  1669. // Delete it?
  1670. if (isset($_REQUEST['deleteevent']))
  1671. $smcFunc['db_query']('', '
  1672. DELETE FROM {db_prefix}calendar
  1673. WHERE id_event = {int:id_event}',
  1674. array(
  1675. 'id_event' => $_REQUEST['eventid'],
  1676. )
  1677. );
  1678. // ... or just update it?
  1679. else
  1680. {
  1681. $span = !empty($modSettings['cal_allowspan']) && !empty($_REQUEST['span']) ? min((int) $modSettings['cal_maxspan'], (int) $_REQUEST['span'] - 1) : 0;
  1682. $start_time = mktime(0, 0, 0, (int) $_REQUEST['month'], (int) $_REQUEST['day'], (int) $_REQUEST['year']);
  1683. $smcFunc['db_query']('', '
  1684. UPDATE {db_prefix}calendar
  1685. SET end_date = {date:end_date},
  1686. start_date = {date:start_date},
  1687. title = {string:title}
  1688. WHERE id_event = {int:id_event}',
  1689. array(
  1690. 'end_date' => strftime('%Y-%m-%d', $start_time + $span * 86400),
  1691. 'start_date' => strftime('%Y-%m-%d', $start_time),
  1692. 'id_event' => $_REQUEST['eventid'],
  1693. 'title' => $smcFunc['htmlspecialchars']($_REQUEST['evtitle'], ENT_QUOTES),
  1694. )
  1695. );
  1696. }
  1697. updateSettings(array(
  1698. 'calendar_updated' => time(),
  1699. ));
  1700. }
  1701. // Marking read should be done even for editing messages....
  1702. // Mark all the parents read. (since you just posted and they will be unread.)
  1703. if (!$user_info['is_guest'] && !empty($board_info['parent_boards']))
  1704. {
  1705. $smcFunc['db_query']('', '
  1706. UPDATE {db_prefix}log_boards
  1707. SET id_msg = {int:id_msg}
  1708. WHERE id_member = {int:current_member}
  1709. AND id_board IN ({array_int:board_list})',
  1710. array(
  1711. 'current_member' => $user_info['id'],
  1712. 'board_list' => array_keys($board_info['parent_boards']),
  1713. 'id_msg' => $modSettings['maxMsgID'],
  1714. )
  1715. );
  1716. }
  1717. // Turn notification on or off. (note this just blows smoke if it's already on or off.)
  1718. if (!empty($_POST['notify']) && allowedTo('mark_any_notify'))
  1719. {
  1720. $smcFunc['db_insert']('ignore',
  1721. '{db_prefix}log_notify',
  1722. array('id_member' => 'int', 'id_topic' => 'int', 'id_board' => 'int'),
  1723. array($user_info['id'], $topic, 0),
  1724. array('id_member', 'id_topic', 'id_board')
  1725. );
  1726. }
  1727. elseif (!$newTopic)
  1728. $smcFunc['db_query']('', '
  1729. DELETE FROM {db_prefix}log_notify
  1730. WHERE id_member = {int:current_member}
  1731. AND id_topic = {int:current_topic}',
  1732. array(
  1733. 'current_member' => $user_info['id'],
  1734. 'current_topic' => $topic,
  1735. )
  1736. );
  1737. // Log an act of moderation - modifying.
  1738. if (!empty($moderationAction))
  1739. logAction('modify', array('topic' => $topic, 'message' => (int) $_REQUEST['msg'], 'member' => $row['id_member'], 'board' => $board));
  1740. if (isset($_POST['lock']) && $_POST['lock'] != 2)
  1741. logAction('lock', array('topic' => $topicOptions['id'], 'board' => $topicOptions['board']));
  1742. if (isset($_POST['sticky']) && !empty($modSettings['enableStickyTopics']))
  1743. logAction('sticky', array('topic' => $topicOptions['id'], 'board' => $topicOptions['board']));
  1744. // Notify any members who have notification turned on for this topic - only do this if it's going to be approved(!)
  1745. if ($becomesApproved)
  1746. {
  1747. if ($newTopic)
  1748. {
  1749. $notifyData = array(
  1750. 'body' => $_POST['message'],
  1751. 'subject' => $_POST['subject'],
  1752. 'name' => $user_info['name'],
  1753. 'poster' => $user_info['id'],
  1754. 'msg' => $msgOptions['id'],
  1755. 'board' => $board,
  1756. 'topic' => $topic,
  1757. );
  1758. notifyMembersBoard($notifyData);
  1759. }
  1760. elseif (empty($_REQUEST['msg']))
  1761. {
  1762. // Only send it to everyone if the topic is approved, otherwise just to the topic starter if they want it.
  1763. if ($topic_info['approved'])
  1764. sendNotifications($topic, 'reply');
  1765. else
  1766. sendNotifications($topic, 'reply', array(), $topic_info['id_member_started']);
  1767. }
  1768. }
  1769. // Returning to the topic?
  1770. if (!empty($_REQUEST['goback']))
  1771. {
  1772. // Mark the board as read.... because it might get confusing otherwise.
  1773. $smcFunc['db_query']('', '
  1774. UPDATE {db_prefix}log_boards
  1775. SET id_msg = {int:maxMsgID}
  1776. WHERE id_member = {int:current_member}
  1777. AND id_board = {int:current_board}',
  1778. array(
  1779. 'current_board' => $board,
  1780. 'current_member' => $user_info['id'],
  1781. 'maxMsgID' => $modSettings['maxMsgID'],
  1782. )
  1783. );
  1784. }
  1785. if ($board_info['num_topics'] == 0)
  1786. cache_put_data('board-' . $board, null, 120);
  1787. if (!empty($_POST['announce_topic']))
  1788. redirectexit('action=announce;sa=selectgroup;topic=' . $topic . (!empty($_POST['move']) && allowedTo('move_any') ? ';move' : '') . (empty($_REQUEST['goback']) ? '' : ';goback'));
  1789. if (!empty($_POST['move']) && allowedTo('move_any'))
  1790. redirectexit('action=movetopic;topic=' . $topic . '.0' . (empty($_REQUEST['goback']) ? '' : ';goback'));
  1791. // Return to post if the mod is on.
  1792. if (isset($_REQUEST['msg']) && !empty($_REQUEST['goback']))
  1793. redirectexit('topic=' . $topic . '.msg' . $_REQUEST['msg'] . '#msg' . $_REQUEST['msg'], isBrowser('ie'));
  1794. elseif (!empty($_REQUEST['goback']))
  1795. redirectexit('topic=' . $topic . '.new#new', isBrowser('ie'));
  1796. // Dut-dut-duh-duh-DUH-duh-dut-duh-duh! *dances to the Final Fantasy Fanfare...*
  1797. else
  1798. redirectexit('board=' . $board . '.0');
  1799. }
  1800. // General function for topic announcements.
  1801. /**
  1802. * handle the announce topic function (action=announce).
  1803. * checks the topic announcement permissions and loads the announcement template.
  1804. * requires the announce_topic permission.
  1805. * uses the ManageMembers template and Post language file.
  1806. * call the right function based on the sub-action.
  1807. */
  1808. function AnnounceTopic()
  1809. {
  1810. global $context, $txt, $topic;
  1811. isAllowedTo('announce_topic');
  1812. validateSession();
  1813. if (empty($topic))
  1814. fatal_lang_error('topic_gone', false);
  1815. loadLanguage('Post');
  1816. loadTemplate('Post');
  1817. $subActions = array(
  1818. 'selectgroup' => 'AnnouncementSelectMembergroup',
  1819. 'send' => 'AnnouncementSend',
  1820. );
  1821. $context['page_title'] = $txt['announce_topic'];
  1822. // Call the function based on the sub-action.
  1823. $subActions[isset($_REQUEST['sa']) && isset($subActions[$_REQUEST['sa']]) ? $_REQUEST['sa'] : 'selectgroup']();
  1824. }
  1825. /**
  1826. * Allow a user to chose the membergroups to send the announcement to.
  1827. * lets the user select the membergroups that will receive the topic announcement.
  1828. */
  1829. function AnnouncementSelectMembergroup()
  1830. {
  1831. global $txt, $context, $topic, $board, $board_info, $smcFunc;
  1832. $groups = array_merge($board_info['groups'], array(1));
  1833. foreach ($groups as $id => $group)
  1834. $groups[$id] = (int) $group;
  1835. $context['groups'] = array();
  1836. if (in_array(0, $groups))
  1837. {
  1838. $context['groups'][0] = array(
  1839. 'id' => 0,
  1840. 'name' => $txt['announce_regular_members'],
  1841. 'member_count' => 'n/a',
  1842. );
  1843. }
  1844. // Get all membergroups that have access to the board the announcement was made on.
  1845. $request = $smcFunc['db_query']('', '
  1846. SELECT mg.id_group, COUNT(mem.id_member) AS num_members
  1847. FROM {db_prefix}membergroups AS mg
  1848. LEFT JOIN {db_prefix}members AS mem ON (mem.id_group = mg.id_group OR FIND_IN_SET(mg.id_group, mem.additional_groups) != 0 OR mg.id_group = mem.id_post_group)
  1849. WHERE mg.id_group IN ({array_int:group_list})
  1850. GROUP BY mg.id_group',
  1851. array(
  1852. 'group_list' => $groups,
  1853. 'newbie_id_group' => 4,
  1854. )
  1855. );
  1856. while ($row = $smcFunc['db_fetch_assoc']($request))
  1857. {
  1858. $context['groups'][$row['id_group']] = array(
  1859. 'id' => $row['id_group'],
  1860. 'name' => '',
  1861. 'member_count' => $row['num_members'],
  1862. );
  1863. }
  1864. $smcFunc['db_free_result']($request);
  1865. // Now get the membergroup names.
  1866. $request = $smcFunc['db_query']('', '
  1867. SELECT id_group, group_name
  1868. FROM {db_prefix}membergroups
  1869. WHERE id_group IN ({array_int:group_list})',
  1870. array(
  1871. 'group_list' => $groups,
  1872. )
  1873. );
  1874. while ($row = $smcFunc['db_fetch_assoc']($request))
  1875. $context['groups'][$row['id_group']]['name'] = $row['group_name'];
  1876. $smcFunc['db_free_result']($request);
  1877. // Get the subject of the topic we're about to announce.
  1878. $request = $smcFunc['db_query']('', '
  1879. SELECT m.subject
  1880. FROM {db_prefix}topics AS t
  1881. INNER JOIN {db_prefix}messages AS m ON (m.id_msg = t.id_first_msg)
  1882. WHERE t.id_topic = {int:current_topic}',
  1883. array(
  1884. 'current_topic' => $topic,
  1885. )
  1886. );
  1887. list ($context['topic_subject']) = $smcFunc['db_fetch_row']($request);
  1888. $smcFunc['db_free_result']($request);
  1889. censorText($context['announce_topic']['subject']);
  1890. $context['move'] = isset($_REQUEST['move']) ? 1 : 0;
  1891. $context['go_back'] = isset($_REQUEST['goback']) ? 1 : 0;
  1892. $context['sub_template'] = 'announce';
  1893. }
  1894. /**
  1895. * Send the announcement in chunks.
  1896. * splits the members to be sent a topic announcement into chunks.
  1897. * composes notification messages in all languages needed.
  1898. * does the actual sending of the topic announcements in chunks.
  1899. * calculates a rough estimate of the percentage items sent.
  1900. */
  1901. function AnnouncementSend()
  1902. {
  1903. global $topic, $board, $board_info, $context, $modSettings;
  1904. global $language, $scripturl, $txt, $user_info, $sourcedir, $smcFunc;
  1905. checkSession();
  1906. // @todo Might need an interface?
  1907. $chunkSize = empty($modSettings['mail_queue']) ? 50 : 500;
  1908. $context['start'] = empty($_REQUEST['start']) ? 0 : (int) $_REQUEST['start'];
  1909. $groups = array_merge($board_info['groups'], array(1));
  1910. if (isset($_POST['membergroups']))
  1911. $_POST['who'] = explode(',', $_POST['membergroups']);
  1912. // Check whether at least one membergroup was selected.
  1913. if (empty($_POST['who']))
  1914. fatal_lang_error('no_membergroup_selected');
  1915. // Make sure all membergroups are integers and can access the board of the announcement.
  1916. foreach ($_POST['who'] as $id => $mg)
  1917. $_POST['who'][$id] = in_array((int) $mg, $groups) ? (int) $mg : 0;
  1918. // Get the topic subject and censor it.
  1919. $request = $smcFunc['db_query']('', '
  1920. SELECT m.id_msg, m.subject, m.body
  1921. FROM {db_prefix}topics AS t
  1922. INNER JOIN {db_prefix}messages AS m ON (m.id_msg = t.id_first_msg)
  1923. WHERE t.id_topic = {int:current_topic}',
  1924. array(
  1925. 'current_topic' => $topic,
  1926. )
  1927. );
  1928. list ($id_msg, $context['topic_subject'], $message) = $smcFunc['db_fetch_row']($request);
  1929. $smcFunc['db_free_result']($request);
  1930. censorText($context['topic_subject']);
  1931. censorText($message);
  1932. $message = trim(un_htmlspecialchars(strip_tags(strtr(parse_bbc($message, false, $id_msg), array('<br />' => "\n", '</div>' => "\n", '</li>' => "\n", '&#91;' => '[', '&#93;' => ']')))));
  1933. // We need this in order to be able send emails.
  1934. require_once($sourcedir . '/Subs-Post.php');
  1935. // Select the email addresses for this batch.
  1936. $request = $smcFunc['db_query']('', '
  1937. SELECT mem.id_member, mem.email_address, mem.lngfile
  1938. FROM {db_prefix}members AS mem
  1939. WHERE mem.id_member != {int:current_member}' . (!empty($modSettings['allow_disableAnnounce']) ? '
  1940. AND mem.notify_announcements = {int:notify_announcements}' : '') . '
  1941. AND mem.is_activated = {int:is_activated}
  1942. AND (mem.id_group IN ({array_int:group_list}) OR mem.id_post_group IN ({array_int:group_list}) OR FIND_IN_SET({raw:additional_group_list}, mem.additional_groups) != 0)
  1943. AND mem.id_member > {int:start}
  1944. ORDER BY mem.id_member
  1945. LIMIT ' . $chunkSize,
  1946. array(
  1947. 'current_member' => $user_info['id'],
  1948. 'group_list' => $_POST['who'],
  1949. 'notify_announcements' => 1,
  1950. 'is_activated' => 1,
  1951. 'start' => $context['start'],
  1952. 'additional_group_list' => implode(', mem.additional_groups) != 0 OR FIND_IN_SET(', $_POST['who']),
  1953. )
  1954. );
  1955. // All members have received a mail. Go to the next screen.
  1956. if ($smcFunc['db_num_rows']($request) == 0)
  1957. {
  1958. if (!empty($_REQUEST['move']) && allowedTo('move_any'))
  1959. redirectexit('action=movetopic;topic=' . $topic . '.0' . (empty($_REQUEST['goback']) ? '' : ';goback'));
  1960. elseif (!empty($_REQUEST['goback']))
  1961. redirectexit('topic=' . $topic . '.new;boardseen#new', isBrowser('ie'));
  1962. else
  1963. redirectexit('board=' . $board . '.0');
  1964. }
  1965. $announcements = array();
  1966. // Loop through all members that'll receive an announcement in this batch.
  1967. while ($row = $smcFunc['db_fetch_assoc']($request))
  1968. {
  1969. $cur_language = empty($row['lngfile']) || empty($modSettings['userLanguage']) ? $language : $row['lngfile'];
  1970. // If the language wasn't defined yet, load it and compose a notification message.
  1971. if (!isset($announcements[$cur_language]))
  1972. {
  1973. $replacements = array(
  1974. 'TOPICSUBJECT' => $context['topic_subject'],
  1975. 'MESSAGE' => $message,
  1976. 'TOPICLINK' => $scripturl . '?topic=' . $topic . '.0',
  1977. );
  1978. $emaildata = loadEmailTemplate('new_announcement', $replacements, $cur_language);
  1979. $announcements[$cur_language] = array(
  1980. 'subject' => $emaildata['subject'],
  1981. 'body' => $emaildata['body'],
  1982. 'recipients' => array(),
  1983. );
  1984. }
  1985. $announcements[$cur_language]['recipients'][$row['id_member']] = $row['email_address'];
  1986. $context['start'] = $row['id_member'];
  1987. }
  1988. $smcFunc['db_free_result']($request);
  1989. // For each language send a different mail - low priority...
  1990. foreach ($announcements as $lang => $mail)
  1991. sendmail($mail['recipients'], $mail['subject'], $mail['body'], null, null, false, 5);
  1992. $context['percentage_done'] = round(100 * $context['start'] / $modSettings['latestMember'], 1);
  1993. $context['move'] = empty($_REQUEST['move']) ? 0 : 1;
  1994. $context['go_back'] = empty($_REQUEST['goback']) ? 0 : 1;
  1995. $context['membergroups'] = implode(',', $_POST['who']);
  1996. $context['sub_template'] = 'announcement_send';
  1997. // Go back to the correct language for the user ;).
  1998. if (!empty($modSettings['userLanguage']))
  1999. loadLanguage('Post');
  2000. }
  2001. /**
  2002. * notifies members who have requested notification for new topics
  2003. * * posted on a board of said posts.
  2004. * receives data on the topics to send out notifications to by the passed in array.
  2005. * only sends notifications to those who can *currently* see the topic (it doesn't matter if they could when they requested notification.)
  2006. * loads the Post language file multiple times for each language if the userLanguage setting is set.
  2007. * @param array &$topicData
  2008. */
  2009. function notifyMembersBoard(&$topicData)
  2010. {
  2011. global $txt, $scripturl, $language, $user_info;
  2012. global $modSettings, $sourcedir, $board, $smcFunc, $context;
  2013. require_once($sourcedir . '/Subs-Post.php');
  2014. // Do we have one or lots of topics?
  2015. if (isset($topicData['body']))
  2016. $topicData = array($topicData);
  2017. // Find out what boards we have... and clear out any rubbish!
  2018. $boards = array();
  2019. foreach ($topicData as $key => $topic)
  2020. {
  2021. if (!empty($topic['board']))
  2022. $boards[$topic['board']][] = $key;
  2023. else
  2024. {
  2025. unset($topic[$key]);
  2026. continue;
  2027. }
  2028. // Censor the subject and body...
  2029. censorText($topicData[$key]['subject']);
  2030. censorText($topicData[$key]['body']);
  2031. $topicData[$key]['subject'] = un_htmlspecialchars($topicData[$key]['subject']);
  2032. $topicData[$key]['body'] = trim(un_htmlspecialchars(strip_tags(strtr(parse_bbc($topicData[$key]['body'], false), array('<br />' => "\n", '</div>' => "\n", '</li>' => "\n", '&#91;' => '[', '&#93;' => ']')))));
  2033. }
  2034. // Just the board numbers.
  2035. $board_index = array_unique(array_keys($boards));
  2036. if (empty($board_index))
  2037. return;
  2038. // Yea, we need to add this to the digest queue.
  2039. $digest_insert = array();
  2040. foreach ($topicData as $id => $data)
  2041. $digest_insert[] = array($data['topic'], $data['msg'], 'topic', $user_info['id']);
  2042. $smcFunc['db_insert']('',
  2043. '{db_prefix}log_digest',
  2044. array(
  2045. 'id_topic' => 'int', 'id_msg' => 'int', 'note_type' => 'string', 'exclude' => 'int',
  2046. ),
  2047. $digest_insert,
  2048. array()
  2049. );
  2050. // Find the members with notification on for these boards.
  2051. $members = $smcFunc['db_query']('', '
  2052. SELECT
  2053. mem.id_member, mem.email_address, mem.notify_regularity, mem.notify_send_body, mem.lngfile,
  2054. ln.sent, ln.id_board, mem.id_group, mem.additional_groups, b.member_groups,
  2055. mem.id_post_group
  2056. FROM {db_prefix}log_notify AS ln
  2057. INNER JOIN {db_prefix}boards AS b ON (b.id_board = ln.id_board)
  2058. INNER JOIN {db_prefix}members AS mem ON (mem.id_member = ln.id_member)
  2059. WHERE ln.id_board IN ({array_int:board_list})
  2060. AND mem.id_member != {int:current_member}
  2061. AND mem.is_activated = {int:is_activated}
  2062. AND mem.notify_types != {int:notify_types}
  2063. AND mem.notify_regularity < {int:notify_regularity}
  2064. ORDER BY mem.lngfile',
  2065. array(
  2066. 'current_member' => $user_info['id'],
  2067. 'board_list' => $board_index,
  2068. 'is_activated' => 1,
  2069. 'notify_types' => 4,
  2070. 'notify_regularity' => 2,
  2071. )
  2072. );
  2073. while ($rowmember = $smcFunc['db_fetch_assoc']($members))
  2074. {
  2075. if ($rowmember['id_group'] != 1)
  2076. {
  2077. $allowed = explode(',', $rowmember['member_groups']);
  2078. $rowmember['additional_groups'] = explode(',', $rowmember['additional_groups']);
  2079. $rowmember['additional_groups'][] = $rowmember['id_group'];
  2080. $rowmember['additional_groups'][] = $rowmember['id_post_group'];
  2081. if (count(array_intersect($allowed, $rowmember['additional_groups'])) == 0)
  2082. continue;
  2083. }
  2084. $langloaded = loadLanguage('EmailTemplates', empty($rowmember['lngfile']) || empty($modSettings['userLanguage']) ? $language : $rowmember['lngfile'], false);
  2085. // Now loop through all the notifications to send for this board.
  2086. if (empty($boards[$rowmember['id_board']]))
  2087. continue;
  2088. $sentOnceAlready = 0;
  2089. foreach ($boards[$rowmember['id_board']] as $key)
  2090. {
  2091. // Don't notify the guy who started the topic!
  2092. // @todo In this case actually send them a "it's approved hooray" email :P
  2093. if ($topicData[$key]['poster'] == $rowmember['id_member'])
  2094. continue;
  2095. // Setup the string for adding the body to the message, if a user wants it.
  2096. $send_body = empty($modSettings['disallow_sendBody']) && !empty($rowmember['notify_send_body']);
  2097. $replacements = array(
  2098. 'TOPICSUBJECT' => $topicData[$key]['subject'],
  2099. 'TOPICLINK' => $scripturl . '?topic=' . $topicData[$key]['topic'] . '.new#new',
  2100. 'MESSAGE' => $topicData[$key]['body'],
  2101. 'UNSUBSCRIBELINK' => $scripturl . '?action=notifyboard;board=' . $topicData[$key]['board'] . '.0',
  2102. );
  2103. if (!$send_body)
  2104. unset($replacements['MESSAGE']);
  2105. // Figure out which email to send off
  2106. $emailtype = '';
  2107. // Send only if once is off or it's on and it hasn't been sent.
  2108. if (!empty($rowmember['notify_regularity']) && !$sentOnceAlready && empty($rowmember['sent']))
  2109. $emailtype = 'notify_boards_once';
  2110. elseif (empty($rowmember['notify_regularity']))
  2111. $emailtype = 'notify_boards';
  2112. if (!empty($emailtype))
  2113. {
  2114. $emailtype .= $send_body ? '_body' : '';
  2115. $emaildata = loadEmailTemplate($emailtype, $replacements, $langloaded);
  2116. sendmail($rowmember['email_address'], $emaildata['subject'], $emaildata['body'], null, null, false, 3);
  2117. }
  2118. $sentOnceAlready = 1;
  2119. }
  2120. }
  2121. $smcFunc['db_free_result']($members);
  2122. // Sent!
  2123. $smcFunc['db_query']('', '
  2124. UPDATE {db_prefix}log_notify
  2125. SET sent = {int:is_sent}
  2126. WHERE id_board IN ({array_int:board_list})
  2127. AND id_member != {int:current_member}',
  2128. array(
  2129. 'current_member' => $user_info['id'],
  2130. 'board_list' => $board_index,
  2131. 'is_sent' => 1,
  2132. )
  2133. );
  2134. }
  2135. /**
  2136. * Get the topic for display purposes.
  2137. * gets a summary of the most recent posts in a topic.
  2138. * depends on the topicSummaryPosts setting.
  2139. * if you are editing a post, only shows posts previous to that post.
  2140. */
  2141. function getTopic()
  2142. {
  2143. global $topic, $modSettings, $context, $smcFunc, $counter, $options;
  2144. if (isset($_REQUEST['xml']))
  2145. $limit = '
  2146. LIMIT ' . (empty($context['new_replies']) ? '0' : $context['new_replies']);
  2147. else
  2148. $limit = empty($modSettings['topicSummaryPosts']) ? '' : '
  2149. LIMIT ' . (int) $modSettings['topicSummaryPosts'];
  2150. // If you're modifying, get only those posts before the current one. (otherwise get all.)
  2151. $request = $smcFunc['db_query']('', '
  2152. SELECT
  2153. IFNULL(mem.real_name, m.poster_name) AS poster_name, m.poster_time,
  2154. m.body, m.smileys_enabled, m.id_msg, m.id_member
  2155. FROM {db_prefix}messages AS m
  2156. LEFT JOIN {db_prefix}members AS mem ON (mem.id_member = m.id_member)
  2157. WHERE m.id_topic = {int:current_topic}' . (isset($_REQUEST['msg']) ? '
  2158. AND m.id_msg < {int:id_msg}' : '') .(!$modSettings['postmod_active'] || allowedTo('approve_posts') ? '' : '
  2159. AND m.approved = {int:approved}') . '
  2160. ORDER BY m.id_msg DESC' . $limit,
  2161. array(
  2162. 'current_topic' => $topic,
  2163. 'id_msg' => isset($_REQUEST['msg']) ? (int) $_REQUEST['msg'] : 0,
  2164. 'approved' => 1,
  2165. )
  2166. );
  2167. $context['previous_posts'] = array();
  2168. while ($row = $smcFunc['db_fetch_assoc']($request))
  2169. {
  2170. // Censor, BBC, ...
  2171. censorText($row['body']);
  2172. $row['body'] = parse_bbc($row['body'], $row['smileys_enabled'], $row['id_msg']);
  2173. // ...and store.
  2174. $context['previous_posts'][] = array(
  2175. 'counter' => $counter++,
  2176. 'alternate' => $counter % 2,
  2177. 'poster' => $row['poster_name'],
  2178. 'message' => $row['body'],
  2179. 'time' => timeformat($row['poster_time']),
  2180. 'timestamp' => forum_time(true, $row['poster_time']),
  2181. 'id' => $row['id_msg'],
  2182. 'is_new' => !empty($context['new_replies']),
  2183. 'is_ignored' => !empty($modSettings['enable_buddylist']) && !empty($options['posts_apply_ignore_list']) && in_array($row['id_member'], $context['user']['ignoreusers']),
  2184. );
  2185. if (!empty($context['new_replies']))
  2186. $context['new_replies']--;
  2187. }
  2188. $smcFunc['db_free_result']($request);
  2189. }
  2190. /**
  2191. * loads a post an inserts it into the current editing text box.
  2192. * uses the Post language file.
  2193. * uses special (sadly browser dependent) javascript to parse entities for internationalization reasons.
  2194. * accessed with ?action=quotefast.
  2195. */
  2196. function QuoteFast()
  2197. {
  2198. global $modSettings, $user_info, $txt, $settings, $context;
  2199. global $sourcedir, $smcFunc;
  2200. loadLanguage('Post');
  2201. if (!isset($_REQUEST['xml']))
  2202. loadTemplate('Post');
  2203. include_once($sourcedir . '/Subs-Post.php');
  2204. $moderate_boards = boardsAllowedTo('moderate_board');
  2205. // Where we going if we need to?
  2206. $context['post_box_name'] = isset($_GET['pb']) ? $_GET['pb'] : '';
  2207. $request = $smcFunc['db_query']('', '
  2208. SELECT IFNULL(mem.real_name, m.poster_name) AS poster_name, m.poster_time, m.body, m.id_topic, m.subject,
  2209. m.id_board, m.id_member, m.approved
  2210. FROM {db_prefix}messages AS m
  2211. INNER JOIN {db_prefix}topics AS t ON (t.id_topic = m.id_topic)
  2212. INNER JOIN {db_prefix}boards AS b ON (b.id_board = m.id_board AND {query_see_board})
  2213. LEFT JOIN {db_prefix}members AS mem ON (mem.id_member = m.id_member)
  2214. WHERE m.id_msg = {int:id_msg}' . (isset($_REQUEST['modify']) || (!empty($moderate_boards) && $moderate_boards[0] == 0) ? '' : '
  2215. AND (t.locked = {int:not_locked}' . (empty($moderate_boards) ? '' : ' OR b.id_board IN ({array_int:moderation_board_list})') . ')') . '
  2216. LIMIT 1',
  2217. array(
  2218. 'current_member' => $user_info['id'],
  2219. 'moderation_board_list' => $moderate_boards,
  2220. 'id_msg' => (int) $_REQUEST['quote'],
  2221. 'not_locked' => 0,
  2222. )
  2223. );
  2224. $context['close_window'] = $smcFunc['db_num_rows']($request) == 0;
  2225. $row = $smcFunc['db_fetch_assoc']($request);
  2226. $smcFunc['db_free_result']($request);
  2227. $context['sub_template'] = 'quotefast';
  2228. if (!empty($row))
  2229. $can_view_post = $row['approved'] || ($row['id_member'] != 0 && $row['id_member'] == $user_info['id']) || allowedTo('approve_posts', $row['id_board']);
  2230. if (!empty($can_view_post))
  2231. {
  2232. // Remove special formatting we don't want anymore.
  2233. $row['body'] = un_preparsecode($row['body']);
  2234. // Censor the message!
  2235. censorText($row['body']);
  2236. $row['body'] = preg_replace('~<br ?/?' . '>~i', "\n", $row['body']);
  2237. // Want to modify a single message by double clicking it?
  2238. if (isset($_REQUEST['modify']))
  2239. {
  2240. censorText($row['subject']);
  2241. $context['sub_template'] = 'modifyfast';
  2242. $context['message'] = array(
  2243. 'id' => $_REQUEST['quote'],
  2244. 'body' => $row['body'],
  2245. 'subject' => addcslashes($row['subject'], '"'),
  2246. );
  2247. return;
  2248. }
  2249. // Remove any nested quotes.
  2250. if (!empty($modSettings['removeNestedQuotes']))
  2251. $row['body'] = preg_replace(array('~\n?\[quote.*?\].+?\[/quote\]\n?~is', '~^\n~', '~\[/quote\]~'), '', $row['body']);
  2252. // Make the body HTML if need be.
  2253. if (!empty($_REQUEST['mode']))
  2254. {
  2255. require_once($sourcedir . '/Subs-Editor.php');
  2256. $row['body'] = strtr($row['body'], array('&lt;' => '#smlt#', '&gt;' => '#smgt#', '&amp;' => '#smamp#'));
  2257. $row['body'] = bbc_to_html($row['body']);
  2258. $lb = '<br />';
  2259. }
  2260. else
  2261. $lb = "\n";
  2262. // Add a quote string on the front and end.
  2263. $context['quote']['xml'] = '[quote author=' . $row['poster_name'] . ' link=topic=' . $row['id_topic'] . '.msg' . (int) $_REQUEST['quote'] . '#msg' . (int) $_REQUEST['quote'] . ' date=' . $row['poster_time'] . ']' . $lb . $row['body'] . $lb . '[/quote]';
  2264. $context['quote']['text'] = strtr(un_htmlspecialchars($context['quote']['xml']), array('\'' => '\\\'', '\\' => '\\\\', "\n" => '\\n', '</script>' => '</\' + \'script>'));
  2265. $context['quote']['xml'] = strtr($context['quote']['xml'], array('&nbsp;' => '&#160;', '<' => '&lt;', '>' => '&gt;'));
  2266. $context['quote']['mozilla'] = strtr($smcFunc['htmlspecialchars']($context['quote']['text']), array('&quot;' => '"'));
  2267. }
  2268. /**
  2269. * @todo Needs a nicer interface.
  2270. */
  2271. // In case our message has been removed in the meantime.
  2272. elseif (isset($_REQUEST['modify']))
  2273. {
  2274. $context['sub_template'] = 'modifyfast';
  2275. $context['message'] = array(
  2276. 'id' => 0,
  2277. 'body' => '',
  2278. 'subject' => '',
  2279. );
  2280. }
  2281. else
  2282. $context['quote'] = array(
  2283. 'xml' => '',
  2284. 'mozilla' => '',
  2285. 'text' => '',
  2286. );
  2287. }
  2288. function JavaScriptModify()
  2289. {
  2290. global $sourcedir, $modSettings, $board, $topic, $txt;
  2291. global $user_info, $context, $smcFunc, $language;
  2292. // We have to have a topic!
  2293. if (empty($topic))
  2294. obExit(false);
  2295. checkSession('get');
  2296. require_once($sourcedir . '/Subs-Post.php');
  2297. // Assume the first message if no message ID was given.
  2298. $request = $smcFunc['db_query']('', '
  2299. SELECT
  2300. t.locked, t.num_replies, t.id_member_started, t.id_first_msg,
  2301. m.id_msg, m.id_member, m.poster_time, m.subject, m.smileys_enabled, m.body, m.icon,
  2302. m.modified_time, m.modified_name, m.approved
  2303. FROM {db_prefix}messages AS m
  2304. INNER JOIN {db_prefix}topics AS t ON (t.id_topic = {int:current_topic})
  2305. WHERE m.id_msg = {raw:id_msg}
  2306. AND m.id_topic = {int:current_topic}' . (allowedTo('approve_posts') ? '' : (!$modSettings['postmod_active'] ? '
  2307. AND (m.id_member != {int:guest_id} AND m.id_member = {int:current_member})' : '
  2308. AND (m.approved = {int:is_approved} OR (m.id_member != {int:guest_id} AND m.id_member = {int:current_member}))')),
  2309. array(
  2310. 'current_member' => $user_info['id'],
  2311. 'current_topic' => $topic,
  2312. 'id_msg' => empty($_REQUEST['msg']) ? 't.id_first_msg' : (int) $_REQUEST['msg'],
  2313. 'is_approved' => 1,
  2314. 'guest_id' => 0,
  2315. )
  2316. );
  2317. if ($smcFunc['db_num_rows']($request) == 0)
  2318. fatal_lang_error('no_board', false);
  2319. $row = $smcFunc['db_fetch_assoc']($request);
  2320. $smcFunc['db_free_result']($request);
  2321. // Change either body or subject requires permissions to modify messages.
  2322. if (isset($_POST['message']) || isset($_POST['subject']) || isset($_REQUEST['icon']))
  2323. {
  2324. if (!empty($row['locked']))
  2325. isAllowedTo('moderate_board');
  2326. if ($row['id_member'] == $user_info['id'] && !allowedTo('modify_any'))
  2327. {
  2328. if ((!$modSettings['postmod_active'] || $row['approved']) && !empty($modSettings['edit_disable_time']) && $row['poster_time'] + ($modSettings['edit_disable_time'] + 5) * 60 < time())
  2329. fatal_lang_error('modify_post_time_passed', false);
  2330. elseif ($row['id_member_started'] == $user_info['id'] && !allowedTo('modify_own'))
  2331. isAllowedTo('modify_replies');
  2332. else
  2333. isAllowedTo('modify_own');
  2334. }
  2335. // Otherwise, they're locked out; someone who can modify the replies is needed.
  2336. elseif ($row['id_member_started'] == $user_info['id'] && !allowedTo('modify_any'))
  2337. isAllowedTo('modify_replies');
  2338. else
  2339. isAllowedTo('modify_any');
  2340. // Only log this action if it wasn't your message.
  2341. $moderationAction = $row['id_member'] != $user_info['id'];
  2342. }
  2343. $post_errors = array();
  2344. if (isset($_POST['subject']) && $smcFunc['htmltrim']($smcFunc['htmlspecialchars']($_POST['subject'])) !== '')
  2345. {
  2346. $_POST['subject'] = strtr($smcFunc['htmlspecialchars']($_POST['subject']), array("\r" => '', "\n" => '', "\t" => ''));
  2347. // Maximum number of characters.
  2348. if ($smcFunc['strlen']($_POST['subject']) > 100)
  2349. $_POST['subject'] = $smcFunc['substr']($_POST['subject'], 0, 100);
  2350. }
  2351. elseif (isset($_POST['subject']))
  2352. {
  2353. $post_errors[] = 'no_subject';
  2354. unset($_POST['subject']);
  2355. }
  2356. if (isset($_POST['message']))
  2357. {
  2358. if ($smcFunc['htmltrim']($smcFunc['htmlspecialchars']($_POST['message'])) === '')
  2359. {
  2360. $post_errors[] = 'no_message';
  2361. unset($_POST['message']);
  2362. }
  2363. elseif (!empty($modSettings['max_messageLength']) && $smcFunc['strlen']($_POST['message']) > $modSettings['max_messageLength'])
  2364. {
  2365. $post_errors[] = 'long_message';
  2366. unset($_POST['message']);
  2367. }
  2368. else
  2369. {
  2370. $_POST['message'] = $smcFunc['htmlspecialchars']($_POST['message'], ENT_QUOTES);
  2371. preparsecode($_POST['message']);
  2372. if ($smcFunc['htmltrim'](strip_tags(parse_bbc($_POST['message'], false), '<img>')) === '')
  2373. {
  2374. $post_errors[] = 'no_message';
  2375. unset($_POST['message']);
  2376. }
  2377. }
  2378. }
  2379. if (isset($_POST['lock']))
  2380. {
  2381. if (!allowedTo(array('lock_any', 'lock_own')) || (!allowedTo('lock_any') && $user_info['id'] != $row['id_member']))
  2382. unset($_POST['lock']);
  2383. elseif (!allowedTo('lock_any'))
  2384. {
  2385. if ($row['locked'] == 1)
  2386. unset($_POST['lock']);
  2387. else
  2388. $_POST['lock'] = empty($_POST['lock']) ? 0 : 2;
  2389. }
  2390. elseif (!empty($row['locked']) && !empty($_POST['lock']) || $_POST['lock'] == $row['locked'])
  2391. unset($_POST['lock']);
  2392. else
  2393. $_POST['lock'] = empty($_POST['lock']) ? 0 : 1;
  2394. }
  2395. if (isset($_POST['sticky']) && !allowedTo('make_sticky'))
  2396. unset($_POST['sticky']);
  2397. if (empty($post_errors))
  2398. {
  2399. $msgOptions = array(
  2400. 'id' => $row['id_msg'],
  2401. 'subject' => isset($_POST['subject']) ? $_POST['subject'] : null,
  2402. 'body' => isset($_POST['message']) ? $_POST['message'] : null,
  2403. 'icon' => isset($_REQUEST['icon']) ? preg_replace('~[\./\\\\*\':"<>]~', '', $_REQUEST['icon']) : null,
  2404. );
  2405. $topicOptions = array(
  2406. 'id' => $topic,
  2407. 'board' => $board,
  2408. 'lock_mode' => isset($_POST['lock']) ? (int) $_POST['lock'] : null,
  2409. 'sticky_mode' => isset($_POST['sticky']) && !empty($modSettings['enableStickyTopics']) ? (int) $_POST['sticky'] : null,
  2410. 'mark_as_read' => true,
  2411. );
  2412. $posterOptions = array();
  2413. // Only consider marking as editing if they have edited the subject, message or icon.
  2414. if ((isset($_POST['subject']) && $_POST['subject'] != $row['subject']) || (isset($_POST['message']) && $_POST['message'] != $row['body']) || (isset($_REQUEST['icon']) && $_REQUEST['icon'] != $row['icon']))
  2415. {
  2416. // And even then only if the time has passed...
  2417. if (time() - $row['poster_time'] > $modSettings['edit_wait_time'] || $user_info['id'] != $row['id_member'])
  2418. {
  2419. $msgOptions['modify_time'] = time();
  2420. $msgOptions['modify_name'] = $user_info['name'];
  2421. }
  2422. }
  2423. // If nothing was changed there's no need to add an entry to the moderation log.
  2424. else
  2425. $moderationAction = false;
  2426. modifyPost($msgOptions, $topicOptions, $posterOptions);
  2427. // If we didn't change anything this time but had before put back the old info.
  2428. if (!isset($msgOptions['modify_time']) && !empty($row['modified_time']))
  2429. {
  2430. $msgOptions['modify_time'] = $row['modified_time'];
  2431. $msgOptions['modify_name'] = $row['modified_name'];
  2432. }
  2433. // Changing the first subject updates other subjects to 'Re: new_subject'.
  2434. if (isset($_POST['subject']) && isset($_REQUEST['change_all_subjects']) && $row['id_first_msg'] == $row['id_msg'] && !empty($row['num_replies']) && (allowedTo('modify_any') || ($row['id_member_started'] == $user_info['id'] && allowedTo('modify_replies'))))
  2435. {
  2436. // Get the proper (default language) response prefix first.
  2437. if (!isset($context['response_prefix']) && !($context['response_prefix'] = cache_get_data('response_prefix')))
  2438. {
  2439. if ($language === $user_info['language'])
  2440. $context['response_prefix'] = $txt['response_prefix'];
  2441. else
  2442. {
  2443. loadLanguage('index', $language, false);
  2444. $context['response_prefix'] = $txt['response_prefix'];
  2445. loadLanguage('index');
  2446. }
  2447. cache_put_data('response_prefix', $context['response_prefix'], 600);
  2448. }
  2449. $smcFunc['db_query']('', '
  2450. UPDATE {db_prefix}messages
  2451. SET subject = {string:subject}
  2452. WHERE id_topic = {int:current_topic}
  2453. AND id_msg != {int:id_first_msg}',
  2454. array(
  2455. 'current_topic' => $topic,
  2456. 'id_first_msg' => $row['id_first_msg'],
  2457. 'subject' => $context['response_prefix'] . $_POST['subject'],
  2458. )
  2459. );
  2460. }
  2461. if (!empty($moderationAction))
  2462. logAction('modify', array('topic' => $topic, 'message' => $row['id_msg'], 'member' => $row['id_member'], 'board' => $board));
  2463. }
  2464. if (isset($_REQUEST['xml']))
  2465. {
  2466. $context['sub_template'] = 'modifydone';
  2467. if (empty($post_errors) && isset($msgOptions['subject']) && isset($msgOptions['body']))
  2468. {
  2469. $context['message'] = array(
  2470. 'id' => $row['id_msg'],
  2471. 'modified' => array(
  2472. 'time' => isset($msgOptions['modify_time']) ? timeformat($msgOptions['modify_time']) : '',
  2473. 'timestamp' => isset($msgOptions['modify_time']) ? forum_time(true, $msgOptions['modify_time']) : 0,
  2474. 'name' => isset($msgOptions['modify_time']) ? $msgOptions['modify_name'] : '',
  2475. ),
  2476. 'subject' => $msgOptions['subject'],
  2477. 'first_in_topic' => $row['id_msg'] == $row['id_first_msg'],
  2478. 'body' => strtr($msgOptions['body'], array(']]>' => ']]]]><![CDATA[>')),
  2479. );
  2480. censorText($context['message']['subject']);
  2481. censorText($context['message']['body']);
  2482. $context['message']['body'] = parse_bbc($context['message']['body'], $row['smileys_enabled'], $row['id_msg']);
  2483. }
  2484. // Topic?
  2485. elseif (empty($post_errors))
  2486. {
  2487. $context['sub_template'] = 'modifytopicdone';
  2488. $context['message'] = array(
  2489. 'id' => $row['id_msg'],
  2490. 'modified' => array(
  2491. 'time' => isset($msgOptions['modify_time']) ? timeformat($msgOptions['modify_time']) : '',
  2492. 'timestamp' => isset($msgOptions['modify_time']) ? forum_time(true, $msgOptions['modify_time']) : 0,
  2493. 'name' => isset($msgOptions['modify_time']) ? $msgOptions['modify_name'] : '',
  2494. ),
  2495. 'subject' => isset($msgOptions['subject']) ? $msgOptions['subject'] : '',
  2496. );
  2497. censorText($context['message']['subject']);
  2498. }
  2499. else
  2500. {
  2501. $context['message'] = array(
  2502. 'id' => $row['id_msg'],
  2503. 'errors' => array(),
  2504. 'error_in_subject' => in_array('no_subject', $post_errors),
  2505. 'error_in_body' => in_array('no_message', $post_errors) || in_array('long_message', $post_errors),
  2506. );
  2507. loadLanguage('Errors');
  2508. foreach ($post_errors as $post_error)
  2509. {
  2510. if ($post_error == 'long_message')
  2511. $context['message']['errors'][] = sprintf($txt['error_' . $post_error], $modSettings['max_messageLength']);
  2512. else
  2513. $context['message']['errors'][] = $txt['error_' . $post_error];
  2514. }
  2515. }
  2516. }
  2517. else
  2518. obExit(false);
  2519. }
  2520. ?>