phpBB

<?php

/**

*

* @package phpBB3

* @version $Id$

* @copyright (c) 2005 phpBB Group

* @license http://opensource.org/licenses/gpl-license.php GNU Public License

*

*/

/**

* @ignore

*/

define('IN_PHPBB', true);

if (!defined('PHPBB_ROOT_PATH')) define('PHPBB_ROOT_PATH', './');

if (!defined('PHP_EXT')) define('PHP_EXT', substr(strrchr(__FILE__, '.'), 1));

include(PHPBB_ROOT_PATH . 'common.' . PHP_EXT);

include(PHPBB_ROOT_PATH . 'includes/functions_posting.' . PHP_EXT);

include(PHPBB_ROOT_PATH . 'includes/functions_display.' . PHP_EXT);

include(PHPBB_ROOT_PATH . 'includes/message_parser.' . PHP_EXT);

// Start session management

$user->session_begin();

$auth->acl($user->data);

// Grab only parameters needed here

$post_id	= request_var('p', 0);

$topic_id	= request_var('t', 0);

$forum_id	= request_var('f', 0);

$draft_id	= request_var('d', 0);

$lastclick	= request_var('lastclick', 0);

$submit		= (isset($_POST['post'])) ? true : false;

$preview	= (isset($_POST['preview'])) ? true : false;

$save		= (isset($_POST['save'])) ? true : false;

$load		= (isset($_POST['load'])) ? true : false;

$delete		= (isset($_POST['delete'])) ? true : false;

$cancel		= (isset($_POST['cancel']) && !isset($_POST['save'])) ? true : false;

$refresh	= (isset($_POST['add_file']) || isset($_POST['delete_file']) || isset($_POST['cancel_unglobalise']) || $save || $load) ? true : false;

$mode		= ($delete && !$preview && !$refresh && $submit) ? 'delete' : request_var('mode', '');

$error = $post_data = array();

$current_time = time();

if ($config['enable_post_confirm'] && !$user->data['is_registered'])

{

	include(PHPBB_ROOT_PATH . 'includes/captcha/captcha_factory.' . PHP_EXT);

	$captcha = phpbb_captcha_factory::get_instance($config['captcha_plugin']);

	$captcha->init(CONFIRM_POST);

}

// Was cancel pressed? If so then redirect to the appropriate page

if ($cancel || ($current_time - $lastclick < 2 && $submit))

{

	$redirect = ($post_id) ? append_sid('viewtopic', 'p=' . $post_id) . '#p' . $post_id : (($topic_id) ? append_sid('viewtopic', 't=' . $topic_id) : (($forum_id) ? append_sid('viewforum', 'f=' . $forum_id) : append_sid('index')));

	redirect($redirect);

}

if (in_array($mode, array('post', 'reply', 'quote', 'edit', 'delete')) && !$forum_id)

{

	trigger_error('NO_FORUM');

}

// We need to know some basic information in all cases before we do anything.

switch ($mode)

{

	case 'post':

		$sql = 'SELECT *

			FROM ' . FORUMS_TABLE . "

			WHERE forum_id = $forum_id";

	break;

	case 'bump':

	case 'reply':

		if (!$topic_id)

		{

			trigger_error('NO_TOPIC');

		}

		$sql = 'SELECT f.*, t.*

			FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f

			WHERE t.topic_id = $topic_id

				AND (f.forum_id = t.forum_id

					OR f.forum_id = $forum_id)";

	break;

	case 'quote':

	case 'edit':

	case 'delete':

		if (!$post_id)

		{

			$user->setup('posting');

			trigger_error('NO_POST');

		}

		$sql = 'SELECT f.*, t.*, p.*, u.username, u.username_clean, u.user_sig, u.user_sig_bbcode_uid, u.user_sig_bbcode_bitfield

			FROM ' . POSTS_TABLE . ' p, ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . ' f, ' . USERS_TABLE . " u

			WHERE p.post_id = $post_id

				AND t.topic_id = p.topic_id

				AND u.user_id = p.poster_id

				AND (f.forum_id = t.forum_id

					OR f.forum_id = $forum_id)";

	break;

	case 'smilies':

		$sql = '';

		generate_smilies('window', $forum_id);

	break;

	case 'popup':

		if ($forum_id)

		{

			$sql = 'SELECT forum_style

				FROM ' . FORUMS_TABLE . '

				WHERE forum_id = ' . $forum_id;

		}

		else

		{

			upload_popup();

			return;

		}

	break;

	default:

		$sql = '';

	break;

}

if (!$sql)

{

	$user->setup('posting');

	trigger_error('NO_POST_MODE');

}

$result = $db->sql_query($sql);

$post_data = $db->sql_fetchrow($result);

$db->sql_freeresult($result);

if (!$post_data)

{

	if (!($mode == 'post' || $mode == 'bump' || $mode == 'reply'))

	{

		$user->setup('posting');

	}

	trigger_error(($mode == 'post' || $mode == 'bump' || $mode == 'reply') ? 'NO_TOPIC' : 'NO_POST');

}

if ($mode == 'popup')

{

	upload_popup($post_data['forum_style']);

	return;

}

$user->setup(array('posting', 'mcp', 'viewtopic'), $post_data['forum_style']);

// Use post_row values in favor of submitted ones...

$forum_id	= (!empty($post_data['forum_id'])) ? (int) $post_data['forum_id'] : (int) $forum_id;

$topic_id	= (!empty($post_data['topic_id'])) ? (int) $post_data['topic_id'] : (int) $topic_id;

$post_id	= (!empty($post_data['post_id'])) ? (int) $post_data['post_id'] : (int) $post_id;

// Need to login to passworded forum first?

if ($post_data['forum_password'])

{

	login_forum_box(array(

		'forum_id'			=> $forum_id,

		'forum_password'	=> $post_data['forum_password'])

	);

}

// Check permissions

if ($user->data['is_bot'])

{

	redirect(append_sid('index'));

}

// Is the user able to read within this forum?

if (!$auth->acl_get('f_read', $forum_id))

{

	if ($user->data['user_id'] != ANONYMOUS)

	{

		trigger_error('USER_CANNOT_READ');

	}

	login_box('', $user->lang['LOGIN_EXPLAIN_POST']);

}

// Permission to do the action asked?

$is_authed = false;

switch ($mode)

{

	case 'post':

		if ($auth->acl_get('f_post', $forum_id))

		{

			$is_authed = true;

		}

	break;

	case 'bump':

		if ($auth->acl_get('f_bump', $forum_id))

		{

			$is_authed = true;

		}

	break;

	case 'quote':

		$post_data['post_edit_locked'] = 0;

	// no break;

	case 'reply':

		if ($auth->acl_get('f_reply', $forum_id))

		{

			$is_authed = true;

		}

	break;

	case 'edit':

		if ($user->data['is_registered'] && $auth->acl_gets('f_edit', 'm_edit', $forum_id))

		{

			$is_authed = true;

		}

	break;

	case 'delete':

		if ($user->data['is_registered'] && $auth->acl_gets('f_delete', 'm_delete', $forum_id))

		{

			$is_authed = true;

		}

	break;

}

if (!$is_authed)

{

	$check_auth = ($mode == 'quote') ? 'reply' : $mode;

	if ($user->data['is_registered'])

	{

		trigger_error('USER_CANNOT_' . strtoupper($check_auth));

	}

	login_box('', $user->lang['LOGIN_EXPLAIN_' . strtoupper($mode)]);

}

// Is the user able to post within this forum?

if ($post_data['forum_type'] != FORUM_POST && in_array($mode, array('post', 'bump', 'quote', 'reply')))

{

	trigger_error('USER_CANNOT_FORUM_POST');

}

// Forum/Topic locked?

if (($post_data['forum_status'] == ITEM_LOCKED || (isset($post_data['topic_status']) && $post_data['topic_status'] == ITEM_LOCKED)) && !$auth->acl_get('m_edit', $forum_id))

{

	trigger_error(($post_data['forum_status'] == ITEM_LOCKED) ? 'FORUM_LOCKED' : 'TOPIC_LOCKED');

}

// Can we edit this post ... if we're a moderator with rights then always yes

// else it depends on editing times, lock status and if we're the correct user

if ($mode == 'edit' && !$auth->acl_get('m_edit', $forum_id))

{

	if ($user->data['user_id'] != $post_data['poster_id'])

	{

		trigger_error('USER_CANNOT_EDIT');

	}

	if (!($post_data['post_time'] > time() - ($config['edit_time'] * 60) || !$config['edit_time']))

	{

		trigger_error('CANNOT_EDIT_TIME');

	}

	if ($post_data['post_edit_locked'])

	{

		trigger_error('CANNOT_EDIT_POST_LOCKED');

	}

}

// Handle delete mode...

if ($mode == 'delete')

{

	handle_post_delete($forum_id, $topic_id, $post_id, $post_data);

	return;

}

// Handle bump mode...

if ($mode == 'bump')

{

	if ($bump_time = bump_topic_allowed($forum_id, $post_data['topic_bumped'], $post_data['topic_last_post_time'], $post_data['topic_poster'], $post_data['topic_last_poster_id'])

	   && check_link_hash(request_var('hash', ''),"topic_{$post_data['topic_id']}"))

	{

		$db->sql_transaction('begin');

		$sql = 'UPDATE ' . POSTS_TABLE . "

			SET post_time = $current_time

			WHERE post_id = {$post_data['topic_last_post_id']}

				AND topic_id = $topic_id";

		$db->sql_query($sql);

		$sql = 'UPDATE ' . TOPICS_TABLE . "

			SET topic_last_post_time = $current_time,

				topic_bumped = 1,

				topic_bumper = " . $user->data['user_id'] . "

			WHERE topic_id = $topic_id";

		$db->sql_query($sql);

		update_post_information('forum', $forum_id);

		$sql = 'UPDATE ' . USERS_TABLE . "

			SET user_lastpost_time = $current_time

			WHERE user_id = " . $user->data['user_id'];

		$db->sql_query($sql);

		$db->sql_transaction('commit');

		markread('post', $forum_id, $topic_id, $current_time);

		add_log('mod', $forum_id, $topic_id, 'LOG_BUMP_TOPIC', $post_data['topic_title']);

		$meta_url = append_sid('viewtopic', "f=$forum_id&t=$topic_id&p={$post_data['topic_last_post_id']}") . "#p{$post_data['topic_last_post_id']}";

		meta_refresh(3, $meta_url);

		$message = $user->lang['TOPIC_BUMPED'] . '<br /><br />' . sprintf($user->lang['VIEW_MESSAGE'], '<a href="' . $meta_url . '">', '</a>');

		$message .= '<br /><br />' . sprintf($user->lang['RETURN_FORUM'], '<a href="' . append_sid('viewforum', 'f=' . $forum_id) . '">', '</a>');

		trigger_error($message);

	}

	trigger_error('BUMP_ERROR');

}

// Subject length limiting to 60 characters if first post...

if ($mode == 'post' || ($mode == 'edit' && $post_data['topic_first_post_id'] == $post_data['post_id']))

{

	$template->assign_var('S_NEW_MESSAGE', true);

}

// Determine some vars

if (isset($post_data['poster_id']) && $post_data['poster_id'] == ANONYMOUS)

{

	$post_data['quote_username'] = (!empty($post_data['post_username'])) ? $post_data['post_username'] : $user->lang['GUEST'];

}

else

{

	$post_data['quote_username'] = isset($post_data['username']) ? $post_data['username'] : '';

}

$post_data['post_edit_locked']	= (isset($post_data['post_edit_locked'])) ? (int) $post_data['post_edit_locked'] : 0;

$post_data['post_subject']		= (in_array($mode, array('quote', 'edit'))) ? $post_data['post_subject'] : ((isset($post_data['topic_title'])) ? $post_data['topic_title'] : '');

$post_data['topic_time_limit']	= (isset($post_data['topic_time_limit'])) ? (($post_data['topic_time_limit']) ? (int) $post_data['topic_time_limit'] / 86400 : (int) $post_data['topic_time_limit']) : 0;

$post_data['poll_length']		= (!empty($post_data['poll_length'])) ? (int) $post_data['poll_length'] / 86400 : 0;

$post_data['poll_start']		= (!empty($post_data['poll_start'])) ? (int) $post_data['poll_start'] : 0;

$post_data['icon_id']			= (!isset($post_data['icon_id']) || in_array($mode, array('quote', 'reply'))) ? 0 : (int) $post_data['icon_id'];

$post_data['poll_options']		= array();

// Get Poll Data

if ($post_data['poll_start'])

{

	$sql = 'SELECT poll_option_text

		FROM ' . POLL_OPTIONS_TABLE . "

		WHERE topic_id = $topic_id

		ORDER BY poll_option_id";

	$result = $db->sql_query($sql);

	while ($row = $db->sql_fetchrow($result))

	{

		$post_data['poll_options'][] = trim($row['poll_option_text']);

	}

	$db->sql_freeresult($result);

}

$orig_poll_options_size = sizeof($post_data['poll_options']);

$message_parser = new parse_message();

if (isset($post_data['post_text']))

{

	$message_parser->message = &$post_data['post_text'];

	unset($post_data['post_text']);

}

// Set some default variables

$uninit = array('post_attachment' => 0, 'poster_id' => $user->data['user_id'], 'enable_magic_url' => 0, 'topic_status' => 0, 'topic_type' => POST_NORMAL, 'post_subject' => '', 'topic_title' => '', 'post_time' => 0, 'post_edit_reason' => '', 'notify_set' => 0);

foreach ($uninit as $var_name => $default_value)

{

	if (!isset($post_data[$var_name]))

	{

		$post_data[$var_name] = $default_value;

	}

}

unset($uninit);

// Always check if the submitted attachment data is valid and belongs to the user.

// Further down (especially in submit_post()) we do not check this again.

$message_parser->get_submitted_attachment_data($post_data['poster_id']);

if ($post_data['post_attachment'] && !$submit && !$refresh && !$preview && $mode == 'edit')

{

	// Do not change to SELECT *

	$sql = 'SELECT attach_id, is_orphan, attach_comment, real_filename

		FROM ' . ATTACHMENTS_TABLE . "

		WHERE post_msg_id = $post_id

			AND in_message = 0

			AND is_orphan = 0

		ORDER BY filetime DESC";

	$result = $db->sql_query($sql);

	$message_parser->attachment_data = array_merge($message_parser->attachment_data, $db->sql_fetchrowset($result));

	$db->sql_freeresult($result);

}

if ($post_data['poster_id'] == ANONYMOUS)

{

	$post_data['username'] = ($mode == 'quote' || $mode == 'edit') ? trim($post_data['post_username']) : '';

}

else

{

	$post_data['username'] = ($mode == 'quote' || $mode == 'edit') ? trim($post_data['username']) : '';

}

$post_data['enable_urls'] = $post_data['enable_magic_url'];

if ($mode != 'edit')

{

	$post_data['enable_sig']		= ($config['allow_sig'] && $user->optionget('attachsig')) ? true: false;

	$post_data['enable_smilies']	= ($config['allow_smilies'] && $user->optionget('smilies')) ? true : false;

	$post_data['enable_bbcode']		= ($config['allow_bbcode'] && $user->optionget('bbcode')) ? true : false;

	$post_data['enable_urls']		= true;

}

$post_data['enable_magic_url'] = $post_data['drafts'] = false;

// User own some drafts?

if ($user->data['is_registered'] && $auth->acl_get('u_savedrafts') && ($mode == 'reply' || $mode == 'post' || $mode == 'quote'))

{