phpBB

<?php

/**

*

* @package phpBB3

* @version $Id$

* @copyright (c) 2005 phpBB Group

* @license http://opensource.org/licenses/gpl-license.php GNU Public License

*

*/

/**

* @ignore

*/

define('IN_PHPBB', true);

if (!defined('PHPBB_ROOT_PATH')) define('PHPBB_ROOT_PATH', './');

if (!defined('PHP_EXT')) define('PHP_EXT', substr(strrchr(__FILE__, '.'), 1));

include(PHPBB_ROOT_PATH . 'common.' . PHP_EXT);

include(PHPBB_ROOT_PATH . 'includes/functions_display.' . PHP_EXT);

// Start session management

$user->session_begin();

$auth->acl($user->data);

$user->setup(array('memberlist', 'groups'));

// Grab data

$mode		= request_var('mode', '');

$action		= request_var('action', '');

$user_id	= request_var('u', ANONYMOUS);

$username	= request_var('un', '', true);

$group_id	= request_var('g', 0);

$topic_id	= request_var('t', 0);

// Check our mode...

if (!in_array($mode, array('', 'group', 'viewprofile', 'email', 'contact', 'searchuser', 'leaders')))

{

	trigger_error('NO_MODE');

}

switch ($mode)

{

	case 'email':

	break;

	default:

		// Can this user view profiles/memberlist?

		if (!$auth->acl_gets('u_viewprofile', 'a_user', 'a_useradd', 'a_userdel'))

		{

			if ($user->data['user_id'] != ANONYMOUS)

			{

				trigger_error('NO_VIEW_USERS');

			}

			login_box('', ((isset($user->lang['LOGIN_EXPLAIN_' . strtoupper($mode)])) ? $user->lang['LOGIN_EXPLAIN_' . strtoupper($mode)] : $user->lang['LOGIN_EXPLAIN_MEMBERLIST']));

		}

	break;

}

$start	= request_var('start', 0);

$submit = (isset($_POST['submit'])) ? true : false;

$default_key = 'c';

$sort_key = request_var('sk', $default_key);

$sort_dir = request_var('sd', 'a');

// Grab rank information for later

$ranks = cache::obtain_ranks();

// What do you want to do today? ... oops, I think that line is taken ...

switch ($mode)

{

	case 'leaders':

		// Display a listing of board admins, moderators

		include(PHPBB_ROOT_PATH . 'includes/functions_user.' . PHP_EXT);

		$page_title = $user->lang['THE_TEAM'];

		$template_html = 'memberlist_leaders.html';

		$user_ary = $auth->acl_get_list(false, array('a_', 'm_'), false);

		$admin_id_ary = $global_mod_id_ary = $mod_id_ary = $forum_id_ary = array();

		foreach ($user_ary as $forum_id => $forum_ary)

		{

			foreach ($forum_ary as $auth_option => $id_ary)

			{

				if (!$forum_id)

				{

					if ($auth_option == 'a_')

					{

						$admin_id_ary = array_merge($admin_id_ary, $id_ary);

					}

					else

					{

						$global_mod_id_ary = array_merge($global_mod_id_ary, $id_ary);

					}

					continue;

				}

				else

				{

					$mod_id_ary = array_merge($mod_id_ary, $id_ary);

				}

				if ($forum_id)

				{

					foreach ($id_ary as $id)

					{

						$forum_id_ary[$id][] = $forum_id;

					}

				}

			}

		}

		$admin_id_ary = array_unique($admin_id_ary);

		$global_mod_id_ary = array_unique($global_mod_id_ary);

		$mod_id_ary = array_merge($mod_id_ary, $global_mod_id_ary);

		$mod_id_ary = array_unique($mod_id_ary);

		// Admin group id...

		$sql = 'SELECT group_id

			FROM ' . GROUPS_TABLE . "

			WHERE group_name = 'ADMINISTRATORS'";

		$result = $db->sql_query($sql);

		$admin_group_id = (int) $db->sql_fetchfield('group_id');

		$db->sql_freeresult($result);

		// Get group memberships for the admin id ary...

		$admin_memberships = group_memberships($admin_group_id, $admin_id_ary);

		$admin_user_ids = array();

		if (!empty($admin_memberships))

		{

			// ok, we only need the user ids...

			foreach ($admin_memberships as $row)

			{

				$admin_user_ids[$row['user_id']] = true;

			}

		}

		unset($admin_memberships);

		$sql = 'SELECT forum_id, forum_name

			FROM ' . FORUMS_TABLE;

		$result = $db->sql_query($sql);

		$forums = array();

		while ($row = $db->sql_fetchrow($result))

		{

			$forums[$row['forum_id']] = $row['forum_name'];

		}

		$db->sql_freeresult($result);

		$sql = $db->sql_build_query('SELECT', array(

			'SELECT'	=> 'u.user_id, u.group_id as default_group, u.username, u.username_clean, u.user_colour, u.user_rank, u.user_posts, u.user_allow_pm, g.group_id, g.group_name, g.group_colour, g.group_type, ug.user_id as ug_user_id',

			'FROM'		=> array(

				USERS_TABLE		=> 'u',

				GROUPS_TABLE	=> 'g'

			),

			'LEFT_JOIN'	=> array(

				array(

					'FROM'	=> array(USER_GROUP_TABLE => 'ug'),

					'ON'	=> 'ug.group_id = g.group_id AND ug.user_pending = 0 AND ug.user_id = ' . $user->data['user_id']

				)

			),

			'WHERE'		=> $db->sql_in_set('u.user_id', array_unique(array_merge($admin_id_ary, $mod_id_ary)), false, true) . '

				AND u.group_id = g.group_id',

			'ORDER_BY'	=> 'g.group_name ASC, u.username_clean ASC'

		));

		$result = $db->sql_query($sql);

		while ($row = $db->sql_fetchrow($result))

		{

			$which_row = (in_array($row['user_id'], $admin_id_ary)) ? 'admin' : 'mod';

			// We sort out admins not within the 'Administrators' group.

			// Else, we will list those as admin only having the permission to view logs for example.

			if ($which_row == 'admin' && empty($admin_user_ids[$row['user_id']]))

			{

				// Remove from admin_id_ary, because the user may be a mod instead

				unset($admin_id_ary[array_search($row['user_id'], $admin_id_ary)]);

				if (!in_array($row['user_id'], $mod_id_ary) && !in_array($row['user_id'], $global_mod_id_ary))

				{

					continue;

				}

				else

				{

					$which_row = 'mod';

				}

			}

			$s_forum_select = '';

			$undisclosed_forum = false;

			if (isset($forum_id_ary[$row['user_id']]) && !in_array($row['user_id'], $global_mod_id_ary))

			{

				if ($which_row == 'mod' && sizeof(array_diff(array_keys($forums), $forum_id_ary[$row['user_id']])))

				{

					foreach ($forum_id_ary[$row['user_id']] as $forum_id)

					{

						if (isset($forums[$forum_id]))

						{

							if ($auth->acl_get('f_list', $forum_id))

							{

								$s_forum_select .= '<option value="">' . $forums[$forum_id] . '</option>';

							}

							else

							{

								$undisclosed_forum = true;

							}

						}

					}

				}

			}

			// If the mod is only moderating non-viewable forums we skip the user. There is no gain in displaying the person then...

			if (!$s_forum_select && $undisclosed_forum)

			{

//				$s_forum_select = '<option value="">' . $user->lang['FORUM_UNDISCLOSED'] . '</option>';

				continue;

			}

			// The person is moderating several "public" forums, therefore the person should be listed, but not giving the real group name if hidden.

			if ($row['group_type'] == GROUP_HIDDEN && !$auth->acl_gets('a_group', 'a_groupadd', 'a_groupdel') && $row['ug_user_id'] != $user->data['user_id'])

			{

				$group_name = $user->lang['GROUP_UNDISCLOSED'];

				$u_group = '';

			}

			else

			{

				$group_name = ($row['group_type'] == GROUP_SPECIAL) ? $user->lang['G_' . $row['group_name']] : $row['group_name'];

				$u_group = append_sid('memberlist', 'mode=group&g=' . $row['group_id']);

			}

			$rank_title = $rank_img = '';

			get_user_rank($row['user_rank'], $row['user_posts'], $rank_title, $rank_img, $rank_img_src);

			$template->assign_block_vars($which_row, array(

				'USER_ID'		=> $row['user_id'],

				'FORUMS'		=> $s_forum_select,

				'RANK_TITLE'	=> $rank_title,

				'GROUP_NAME'	=> $group_name,

				'GROUP_COLOR'	=> $row['group_colour'],

				'RANK_IMG'		=> $rank_img,

				'RANK_IMG_SRC'	=> $rank_img_src,

				'U_GROUP'			=> $u_group,

				'U_PM'				=> ($config['allow_privmsg'] && $auth->acl_get('u_sendpm') && ($row['user_allow_pm'] || $auth->acl_gets('a_', 'm_') || $auth->acl_getf_global('m_'))) ? append_sid('ucp', 'i=pm&mode=compose&u=' . $row['user_id']) : '',

				'USERNAME_FULL'		=> get_username_string('full', $row['user_id'], $row['username'], $row['user_colour']),

				'USERNAME'			=> get_username_string('username', $row['user_id'], $row['username'], $row['user_colour']),

				'USER_COLOR'		=> get_username_string('colour', $row['user_id'], $row['username'], $row['user_colour']),

				'U_VIEW_PROFILE'	=> get_username_string('profile', $row['user_id'], $row['username'], $row['user_colour']),

			));

		}

		$db->sql_freeresult($result);

		$template->assign_vars(array(

			'PM_IMG'		=> $user->img('icon_contact_pm', $user->lang['SEND_PRIVATE_MESSAGE']))

		);

	break;

	case 'contact':

		$page_title = $user->lang['IM_USER'];

		$template_html = 'memberlist_im.html';

		if (!$auth->acl_get('u_sendim'))

		{

			trigger_error('NOT_AUTHORISED');

		}

		$presence_img = '';

		switch ($action)

		{

			case 'aim':

				$lang = 'AIM';

				$sql_field = 'user_aim';

				$s_select = 'S_SEND_AIM';

				$s_action = '';

			break;

			case 'msnm':

				$lang = 'MSNM';

				$sql_field = 'user_msnm';

				$s_select = 'S_SEND_MSNM';

				$s_action = '';

			break;

			case 'jabber':

				$lang = 'JABBER';

				$sql_field = 'user_jabber';

				$s_select = (@extension_loaded('xml') && $config['jab_enable']) ? 'S_SEND_JABBER' : 'S_NO_SEND_JABBER';

				$s_action = append_sid('memberlist', "mode=contact&action=$action&u=$user_id");

			break;

			default:

				trigger_error('NO_MODE', E_USER_ERROR);

			break;

		}

		// Grab relevant data

		$sql = "SELECT user_id, username, user_email, user_lang, $sql_field

			FROM " . USERS_TABLE . "

			WHERE user_id = $user_id

				AND user_type IN (" . USER_NORMAL . ', ' . USER_FOUNDER . ')';

		$result = $db->sql_query($sql);

		$row = $db->sql_fetchrow($result);

		$db->sql_freeresult($result);

		if (!$row)

		{

			trigger_error('NO_USER');

		}

		else if (empty($row[$sql_field]))

		{

			trigger_error('IM_NO_DATA');

		}

		// Post data grab actions

		switch ($action)

		{

			case 'jabber':

				add_form_key('memberlist_messaging');

				if ($submit && @extension_loaded('xml') && $config['jab_enable'])

				{

					if (check_form_key('memberlist_messaging'))

					{

						include_once(PHPBB_ROOT_PATH . 'includes/functions_messenger.' . PHP_EXT);

						$subject = sprintf($user->lang['IM_JABBER_SUBJECT'], $user->data['username'], $config['server_name']);

						$message = utf8_normalize_nfc(request_var('message', '', true));

						if (empty($message))

						{

							trigger_error('EMPTY_MESSAGE_IM');

						}

						$messenger = new messenger(false);

						$messenger->template('profile_send_im', $row['user_lang']);

						$messenger->subject(htmlspecialchars_decode($subject));

						$messenger->replyto($user->data['user_email']);

						$messenger->im($row['user_jabber'], $row['username']);

						$messenger->assign_vars(array(

							'BOARD_CONTACT'	=> $config['board_contact'],

							'FROM_USERNAME'	=> htmlspecialchars_decode($user->data['username']),

							'TO_USERNAME'	=> htmlspecialchars_decode($row['username']),

							'MESSAGE'		=> htmlspecialchars_decode($message))

						);

						$messenger->send(NOTIFY_IM);

						$s_select = 'S_SENT_JABBER';

					}

					else

					{

						trigger_error('FORM_INVALID');

					}

				}

			break;

		}

		// Send vars to the template

		$template->assign_vars(array(

			'IM_CONTACT'	=> $row[$sql_field],

			'A_IM_CONTACT'	=> addslashes($row[$sql_field]),

			'U_AIM_CONTACT'	=> ($action == 'aim') ? 'aim:addbuddy?screenname=' . urlencode($row[$sql_field]) : '',

			'U_AIM_MESSAGE'	=> ($action == 'aim') ? 'aim:goim?screenname=' . urlencode($row[$sql_field]) . '&message=' . urlencode($config['sitename']) : '',

			'USERNAME'		=> $row['username'],

			'CONTACT_NAME'	=> $row[$sql_field],

			'SITENAME'		=> $config['sitename'],

			'PRESENCE_IMG'		=> $presence_img,

			'L_SEND_IM_EXPLAIN'	=> $user->lang['IM_' . $lang],

			'L_IM_SENT_JABBER'	=> sprintf($user->lang['IM_SENT_JABBER'], $row['username']),

			$s_select			=> true,

			'S_IM_ACTION'		=> $s_action)

		);

	break;

	case 'viewprofile':

		// Display a profile

		if ($user_id == ANONYMOUS && !$username)

		{

			trigger_error('NO_USER');

		}

		// Get user...

		$sql = 'SELECT *

			FROM ' . USERS_TABLE . '

			WHERE ' . (($username) ? "username_clean = '" . $db->sql_escape(utf8_clean_string($username)) . "'" : "user_id = $user_id");

		$result = $db->sql_query($sql);

		$member = $db->sql_fetchrow($result);

		$db->sql_freeresult($result);

		if (!$member)

		{

			trigger_error('NO_USER');

		}

		// a_user admins and founder are able to view inactive users and bots to be able to manage them more easily

		// Normal users are able to see at least users having only changed their profile settings but not yet reactivated.

		if (!$auth->acl_get('a_user') && $user->data['user_type'] != USER_FOUNDER)

		{

			if ($member['user_type'] == USER_IGNORE)

			{

				trigger_error('NO_USER');

			}

			else if ($member['user_type'] == USER_INACTIVE && $member['user_inactive_reason'] != INACTIVE_PROFILE)

			{

				trigger_error('NO_USER');

			}

		}

		$user_id = (int) $member['user_id'];

		// Do the SQL thang

		$sql = 'SELECT g.group_id, g.group_name, g.group_type

			FROM ' . GROUPS_TABLE . ' g, ' . USER_GROUP_TABLE . " ug

			WHERE ug.user_id = $user_id

				AND g.group_id = ug.group_id" . ((!$auth->acl_gets('a_group', 'a_groupadd', 'a_groupdel')) ? ' AND g.group_type <> ' . GROUP_HIDDEN : '') . '

				AND ug.user_pending = 0