phpBB

<?php

/***************************************************************************

 *                                 modcp.php

 *                            -------------------

 *   begin                : July 4, 2001

 *   copyright            : (C) 2001 The phpBB Group

 *   email                : support@phpbb.com

 *

 *   $Id$

 *

 ***************************************************************************/

/***************************************************************************

 *

 *   This program is free software; you can redistribute it and/or modify

 *   it under the terms of the GNU General Public License as published by

 *   the Free Software Foundation; either version 2 of the License, or

 *   (at your option) any later version.

 *

 ***************************************************************************/

/**

 * Moderator Control Panel

 *

 * From this 'Control Panel' the moderator of a forum will be able to do

 * mass topic operations (locking/unlocking/moving/deleteing), and it will

 * provide an interface to do quick locking/unlocking/moving/deleting of

 * topics via the moderator operations buttons on all of the viewtopic pages.

 */

define('IN_PHPBB', true);

$phpbb_root_path = './';

include($phpbb_root_path . 'extension.inc');

include($phpbb_root_path . 'common.'.$phpEx);

include($phpbb_root_path . 'includes/bbcode.'.$phpEx);

include($phpbb_root_path . 'includes/functions_admin.'.$phpEx);

//

// Obtain initial var settings

//

if ( isset($HTTP_GET_VARS[POST_FORUM_URL]) || isset($HTTP_POST_VARS[POST_FORUM_URL]) )

{

	$forum_id = (isset($HTTP_POST_VARS[POST_FORUM_URL])) ? intval($HTTP_POST_VARS[POST_FORUM_URL]) : intval($HTTP_GET_VARS[POST_FORUM_URL]);

}

else

{

	$forum_id = '';

}

if ( isset($HTTP_GET_VARS[POST_POST_URL]) || isset($HTTP_POST_VARS[POST_POST_URL]) )

{

	$post_id = (isset($HTTP_POST_VARS[POST_POST_URL])) ? intval($HTTP_POST_VARS[POST_POST_URL]) : intval($HTTP_GET_VARS[POST_POST_URL]);

}

else

{

	$post_id = '';

}

if ( isset($HTTP_GET_VARS[POST_TOPIC_URL]) || isset($HTTP_POST_VARS[POST_TOPIC_URL]) )

{

	$topic_id = (isset($HTTP_POST_VARS[POST_TOPIC_URL])) ? intval($HTTP_POST_VARS[POST_TOPIC_URL]) : intval($HTTP_GET_VARS[POST_TOPIC_URL]);

}

else

{

	$topic_id = '';

}

$confirm = ( $HTTP_POST_VARS['confirm'] ) ? TRUE : 0;

//

// Continue var definitions

//

$start = ( isset($HTTP_GET_VARS['start']) ) ? intval($HTTP_GET_VARS['start']) : 0;

$start = ($start < 0) ? 0 : $start;

$delete = ( isset($HTTP_POST_VARS['delete']) ) ? TRUE : FALSE;

$move = ( isset($HTTP_POST_VARS['move']) ) ? TRUE : FALSE;

$lock = ( isset($HTTP_POST_VARS['lock']) ) ? TRUE : FALSE;

$unlock = ( isset($HTTP_POST_VARS['unlock']) ) ? TRUE : FALSE;

if ( isset($HTTP_POST_VARS['mode']) || isset($HTTP_GET_VARS['mode']) )

{

	$mode = ( isset($HTTP_POST_VARS['mode']) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];

	$mode = htmlspecialchars($mode);

}

else

{

	if ( $delete )

	{

		$mode = 'delete';

	}

	else if ( $move )

	{

		$mode = 'move';

	}

	else if ( $lock )

	{

		$mode = 'lock';

	}

	else if ( $unlock )

	{

		$mode = 'unlock';

	}

	else

	{

		$mode = '';

	}

}

// session id check

if (!empty($HTTP_POST_VARS['sid']) || !empty($HTTP_GET_VARS['sid']))

{

	$sid = (!empty($HTTP_POST_VARS['sid'])) ? $HTTP_POST_VARS['sid'] : $HTTP_GET_VARS['sid'];

}

else

{

	$sid = '';

}

// privileged session id check

if (!empty($HTTP_POST_VARS['p_sid']) || !empty($HTTP_GET_VARS['p_sid']))

{

	$p_sid = (!empty($HTTP_POST_VARS['p_sid'])) ? $HTTP_POST_VARS['p_sid'] : $HTTP_GET_VARS['p_sid'];

}

else

{

	$p_sid = '';

}

//

// Obtain relevant data

//

if ( !empty($topic_id) )

{

	$sql = "SELECT f.forum_id, f.forum_name, f.forum_topics

		FROM " . TOPICS_TABLE . " t, " . FORUMS_TABLE . " f

		WHERE t.topic_id = " . $topic_id . "

			AND f.forum_id = t.forum_id";

	if ( !($result = $db->sql_query($sql)) )

	{

		message_die(GENERAL_MESSAGE, 'Topic_post_not_exist');

	}

	$topic_row = $db->sql_fetchrow($result);

	if (!$topic_row)

	{

		message_die(GENERAL_MESSAGE, 'Topic_post_not_exist');

	}

	$forum_topics = ( $topic_row['forum_topics'] == 0 ) ? 1 : $topic_row['forum_topics'];

	$forum_id = $topic_row['forum_id'];

	$forum_name = $topic_row['forum_name'];

}

else if ( !empty($forum_id) )

{

	$sql = "SELECT forum_name, forum_topics

		FROM " . FORUMS_TABLE . "

		WHERE forum_id = " . $forum_id;

	if ( !($result = $db->sql_query($sql)) )

	{

		message_die(GENERAL_MESSAGE, 'Forum_not_exist');

	}

	$topic_row = $db->sql_fetchrow($result);

	if (!$topic_row)

	{

		message_die(GENERAL_MESSAGE, 'Forum_not_exist');

	}

	$forum_topics = ( $topic_row['forum_topics'] == 0 ) ? 1 : $topic_row['forum_topics'];

	$forum_name = $topic_row['forum_name'];

}

else

{

	message_die(GENERAL_MESSAGE, 'Forum_not_exist');

}

//

// Start session management

//

$userdata = session_pagestart($user_ip, $forum_id);

init_userprefs($userdata);

//

// End session management

//

// session id check

if ($p_sid === '' || $p_sid !== $userdata['priv_session_id'])

{

	message_die(GENERAL_ERROR, 'Invalid_session');

}

//

// Check if user did or did not confirm

// If they did not, forward them to the last page they were on

//

if ( isset($HTTP_POST_VARS['cancel']) )

{

	if ( $topic_id )

	{

		$redirect = "viewtopic.$phpEx?" . POST_TOPIC_URL . "=$topic_id";

	}

	else if ( $forum_id )

	{

		$redirect = "viewforum.$phpEx?" . POST_FORUM_URL . "=$forum_id";

	}

	else

	{

		$redirect = "index.$phpEx";

	}

	redirect(append_sid($redirect, true));

}

//

// Start auth check

//

$is_auth = auth(AUTH_ALL, $forum_id, $userdata);

if ( !$is_auth['auth_mod'] )

{

	message_die(GENERAL_MESSAGE, $lang['Not_Moderator'], $lang['Not_Authorised']);

}

//

// End Auth Check

//

//

// Do major work ...

//

switch( $mode )

{

	case 'delete':

		if (!$is_auth['auth_delete'])

		{

			message_die(GENERAL_MESSAGE, sprintf($lang['Sorry_auth_delete'], $is_auth['auth_delete_type']));

		}

		$page_title = $lang['Mod_CP'];

		include($phpbb_root_path . 'includes/page_header.'.$phpEx);

		if ( $confirm )

		{

  			if ( empty($HTTP_POST_VARS['topic_id_list']) && empty($topic_id) )

			{

				message_die(GENERAL_MESSAGE, $lang['None_selected']);

			}

			include($phpbb_root_path . 'includes/functions_search.'.$phpEx);

			$topics = ( isset($HTTP_POST_VARS['topic_id_list']) ) ? $HTTP_POST_VARS['topic_id_list'] : array($topic_id);

			$topic_id_sql = '';

			for($i = 0; $i < count($topics); $i++)

			{

				$topic_id_sql .= ( ( $topic_id_sql != '' ) ? ', ' : '' ) . intval($topics[$i]);

			}

			$sql = "SELECT topic_id

				FROM " . TOPICS_TABLE . "

				WHERE topic_id IN ($topic_id_sql)

					AND forum_id = $forum_id";

			if ( !($result = $db->sql_query($sql)) )

			{

				message_die(GENERAL_ERROR, 'Could not get topic id information', '', __LINE__, __FILE__, $sql);

			}

			$topic_id_sql = '';

			while ($row = $db->sql_fetchrow($result))

			{

				$topic_id_sql .= (($topic_id_sql != '') ? ', ' : '') . intval($row['topic_id']);

			}

			$db->sql_freeresult($result);

			if ( $topic_id_sql == '')

			{

				message_die(GENERAL_MESSAGE, $lang['None_selected']);

			}

			$sql = "SELECT poster_id, COUNT(post_id) AS posts

				FROM " . POSTS_TABLE . "

				WHERE topic_id IN ($topic_id_sql)

				GROUP BY poster_id";

			if ( !($result = $db->sql_query($sql)) )

			{

				message_die(GENERAL_ERROR, 'Could not get poster id information', '', __LINE__, __FILE__, $sql);

			}

			$count_sql = array();

			while ( $row = $db->sql_fetchrow($result) )

			{

				$count_sql[] = "UPDATE " . USERS_TABLE . "

					SET user_posts = user_posts - " . $row['posts'] . "

					WHERE user_id = " . $row['poster_id'];

			}

			$db->sql_freeresult($result);

			if ( sizeof($count_sql) )

			{

				for($i = 0; $i < sizeof($count_sql); $i++)

				{

					if ( !$db->sql_query($count_sql[$i]) )

					{

						message_die(GENERAL_ERROR, 'Could not update user post count information', '', __LINE__, __FILE__, $sql);

					}

				}

			}

			$sql = "SELECT post_id

				FROM " . POSTS_TABLE . "

				WHERE topic_id IN ($topic_id_sql)";

			if ( !($result = $db->sql_query($sql)) )

			{

				message_die(GENERAL_ERROR, 'Could not get post id information', '', __LINE__, __FILE__, $sql);

			}

			$post_id_sql = '';

			while ( $row = $db->sql_fetchrow($result) )

			{

				$post_id_sql .= ( ( $post_id_sql != '' ) ? ', ' : '' ) . intval($row['post_id']);

			}

			$db->sql_freeresult($result);

			$sql = "SELECT vote_id

				FROM " . VOTE_DESC_TABLE . "

				WHERE topic_id IN ($topic_id_sql)";

			if ( !($result = $db->sql_query($sql)) )

			{

				message_die(GENERAL_ERROR, 'Could not get vote id information', '', __LINE__, __FILE__, $sql);

			}

			$vote_id_sql = '';

			while ( $row = $db->sql_fetchrow($result) )

			{

				$vote_id_sql .= ( ( $vote_id_sql != '' ) ? ', ' : '' ) . $row['vote_id'];

			}

			$db->sql_freeresult($result);

			//

			// Got all required info so go ahead and start deleting everything

			//

			$sql = "DELETE

				FROM " . TOPICS_TABLE . "

				WHERE topic_id IN ($topic_id_sql)

					OR topic_moved_id IN ($topic_id_sql)";

			if ( !$db->sql_query($sql, BEGIN_TRANSACTION) )

			{

				message_die(GENERAL_ERROR, 'Could not delete topics', '', __LINE__, __FILE__, $sql);

			}

			if ( $post_id_sql != '' )

			{

				$sql = "DELETE

					FROM " . POSTS_TABLE . "

					WHERE post_id IN ($post_id_sql)";

				if ( !$db->sql_query($sql) )

				{

					message_die(GENERAL_ERROR, 'Could not delete posts', '', __LINE__, __FILE__, $sql);

				}

				$sql = "DELETE

					FROM " . POSTS_TEXT_TABLE . "

					WHERE post_id IN ($post_id_sql)";

				if ( !$db->sql_query($sql) )

				{

					message_die(GENERAL_ERROR, 'Could not delete posts text', '', __LINE__, __FILE__, $sql);

				}

				remove_search_post($post_id_sql);

			}

			if ( $vote_id_sql != '' )

			{

				$sql = "DELETE

					FROM " . VOTE_DESC_TABLE . "

					WHERE vote_id IN ($vote_id_sql)";

				if ( !$db->sql_query($sql) )

				{

					message_die(GENERAL_ERROR, 'Could not delete vote descriptions', '', __LINE__, __FILE__, $sql);

				}

				$sql = "DELETE

					FROM " . VOTE_RESULTS_TABLE . "

					WHERE vote_id IN ($vote_id_sql)";

				if ( !$db->sql_query($sql) )

				{

					message_die(GENERAL_ERROR, 'Could not delete vote results', '', __LINE__, __FILE__, $sql);

				}

				$sql = "DELETE

					FROM " . VOTE_USERS_TABLE . "

					WHERE vote_id IN ($vote_id_sql)";

				if ( !$db->sql_query($sql) )

				{

					message_die(GENERAL_ERROR, 'Could not delete vote users', '', __LINE__, __FILE__, $sql);

				}

			}

			$sql = "DELETE

				FROM " . TOPICS_WATCH_TABLE . "

				WHERE topic_id IN ($topic_id_sql)";

			if ( !$db->sql_query($sql, END_TRANSACTION) )

			{

				message_die(GENERAL_ERROR, 'Could not delete watched post list', '', __LINE__, __FILE__, $sql);

			}

			sync('forum', $forum_id);

			if ( !empty($topic_id) )

			{

				$redirect_page = append_sid("viewforum.$phpEx?" . POST_FORUM_URL . "=$forum_id");

				$l_redirect = sprintf($lang['Click_return_forum'], '<a href="' . $redirect_page . '">', '</a>');

			}

			else

			{

				$redirect_page = append_sid("modcp.$phpEx?" . POST_FORUM_URL . "=$forum_id&p_sid=" . $userdata['priv_session_id']);

				$l_redirect = sprintf($lang['Click_return_modcp'], '<a href="' . $redirect_page . '">', '</a>');

			}

			$template->assign_vars(array(

				'META' => '<meta http-equiv="refresh" content="3;url=' . $redirect_page . '">')

			);

			message_die(GENERAL_MESSAGE, $lang['Topics_Removed'] . '<br /><br />' . $l_redirect);

		}

		else

		{

			// Not confirmed, show confirmation message

			if ( empty($HTTP_POST_VARS['topic_id_list']) && empty($topic_id) )

			{

				message_die(GENERAL_MESSAGE, $lang['None_selected']);

			}

			$hidden_fields = '<input type="hidden" name="sid" value="' . $userdata['session_id'] . '" /><input type="hidden" name="p_sid" value="' . $userdata['priv_session_id'] . '" /><input type="hidden" name="mode" value="' . $mode . '" /><input type="hidden" name="' . POST_FORUM_URL . '" value="' . $forum_id . '" />';

			if ( isset($HTTP_POST_VARS['topic_id_list']) )

			{

				$topics = $HTTP_POST_VARS['topic_id_list'];

				for($i = 0; $i < count($topics); $i++)

				{

					$hidden_fields .= '<input type="hidden" name="topic_id_list[]" value="' . intval($topics[$i]) . '" />';

				}

			}