Code Forge

<?php

/**

*

* @package phpBB3

* @copyright (c) 2005 phpBB Group

* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2

*

*/

/**

* @ignore

*/

define('IN_PHPBB', true);

$phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './';

$phpEx = substr(strrchr(__FILE__, '.'), 1);

include($phpbb_root_path . 'common.' . $phpEx);

include($phpbb_root_path . 'includes/functions_posting.' . $phpEx);

include($phpbb_root_path . 'includes/functions_display.' . $phpEx);

include($phpbb_root_path . 'includes/message_parser.' . $phpEx);

// Start session management

$user->session_begin();

$auth->acl($user->data);

// Grab only parameters needed here

$post_id        = request_var('p', 0);

$topic_id        = request_var('t', 0);

$forum_id        = request_var('f', 0);

$draft_id        = request_var('d', 0);

$lastclick        = request_var('lastclick', 0);

$submit                = (isset($_POST['post'])) ? true : false;

$preview        = (isset($_POST['preview'])) ? true : false;

$save                = (isset($_POST['save'])) ? true : false;

$load                = (isset($_POST['load'])) ? true : false;

$delete                = (isset($_POST['delete'])) ? true : false;

$cancel                = (isset($_POST['cancel']) && !isset($_POST['save'])) ? true : false;

$refresh        = (isset($_POST['add_file']) || isset($_POST['delete_file']) || isset($_POST['full_editor']) || isset($_POST['cancel_unglobalise']) || $save || $load) ? true : false;

$mode                = ($delete && !$preview && !$refresh && $submit) ? 'delete' : request_var('mode', '');

$error = $post_data = array();

$current_time = time();

// Was cancel pressed? If so then redirect to the appropriate page

if ($cancel || ($current_time - $lastclick < 2 && $submit))

{

        $f = ($forum_id) ? 'f=' . $forum_id . '&' : '';

        $redirect = ($post_id) ? append_sid("{$phpbb_root_path}viewtopic.$phpEx", $f . 'p=' . $post_id) . '#p' . $post_id : (($topic_id) ? append_sid("{$phpbb_root_path}viewtopic.$phpEx", $f . 't=' . $topic_id) : (($forum_id) ? append_sid("{$phpbb_root_path}viewforum.$phpEx", 'f=' . $forum_id) : append_sid("{$phpbb_root_path}index.$phpEx")));

        redirect($redirect);

}

if (in_array($mode, array('post', 'reply', 'quote', 'edit', 'delete')) && !$forum_id)

{

        trigger_error('NO_FORUM');

}

// We need to know some basic information in all cases before we do anything.

switch ($mode)

{

        case 'post':

                $sql = 'SELECT *

                        FROM ' . FORUMS_TABLE . "

                        WHERE forum_id = $forum_id";

        break;

        case 'bump':

        case 'reply':

                if (!$topic_id)

                {

                        trigger_error('NO_TOPIC');

                }

                // Force forum id

                $sql = 'SELECT forum_id

                        FROM ' . TOPICS_TABLE . '

                        WHERE topic_id = ' . $topic_id;

                $result = $db->sql_query($sql);

                $f_id = (int) $db->sql_fetchfield('forum_id');

                $db->sql_freeresult($result);

                $forum_id = (!$f_id) ? $forum_id : $f_id;

                $sql = 'SELECT f.*, t.*

                        FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f

                        WHERE t.topic_id = $topic_id

                                AND f.forum_id = t.forum_id" .

                        (($auth->acl_get('m_approve', $forum_id)) ? '' : ' AND t.topic_approved = 1');

        break;

        case 'quote':

        case 'edit':

        case 'delete':

                if (!$post_id)

                {

                        $user->setup('posting');

                        trigger_error('NO_POST');

                }

                // Force forum id

                $sql = 'SELECT forum_id

                        FROM ' . POSTS_TABLE . '

                        WHERE post_id = ' . $post_id;

                $result = $db->sql_query($sql);

                $f_id = (int) $db->sql_fetchfield('forum_id');

                $db->sql_freeresult($result);

                $forum_id = (!$f_id) ? $forum_id : $f_id;

                $sql = 'SELECT f.*, t.*, p.*, u.username, u.username_clean, u.user_sig, u.user_sig_bbcode_uid, u.user_sig_bbcode_bitfield

                        FROM ' . POSTS_TABLE . ' p, ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . ' f, ' . USERS_TABLE . " u

                        WHERE p.post_id = $post_id

                                AND t.topic_id = p.topic_id

                                AND u.user_id = p.poster_id

                                AND f.forum_id = t.forum_id" .

                                (($auth->acl_get('m_approve', $forum_id)) ? '' : ' AND p.post_approved = 1');

        break;

        case 'smilies':

                $sql = '';

                generate_smilies('window', $forum_id);

        break;

        case 'popup':

                if ($forum_id)

                {

                        $sql = 'SELECT forum_style

                                FROM ' . FORUMS_TABLE . '

                                WHERE forum_id = ' . $forum_id;

                }

                else

                {

                        upload_popup();

                        return;

                }

        break;

        default:

                $sql = '';

        break;

}

if (!$sql)

{

        $user->setup('posting');

        trigger_error('NO_POST_MODE');

}

$result = $db->sql_query($sql);

$post_data = $db->sql_fetchrow($result);

$db->sql_freeresult($result);

if (!$post_data)

{

        if (!($mode == 'post' || $mode == 'bump' || $mode == 'reply'))

        {

                $user->setup('posting');

        }

        trigger_error(($mode == 'post' || $mode == 'bump' || $mode == 'reply') ? 'NO_TOPIC' : 'NO_POST');

}

// Not able to reply to unapproved posts/topics

// TODO: add more descriptive language key

if ($auth->acl_get('m_approve', $forum_id) && ((($mode == 'reply' || $mode == 'bump') && !$post_data['topic_approved']) || ($mode == 'quote' && !$post_data['post_approved'])))

{

        trigger_error(($mode == 'reply' || $mode == 'bump') ? 'TOPIC_UNAPPROVED' : 'POST_UNAPPROVED');

}

if ($mode == 'popup')

{

        upload_popup($post_data['forum_style']);

        return;

}

$user->setup(array('posting', 'mcp', 'viewtopic'), $post_data['forum_style']);

if ($config['enable_post_confirm'] && !$user->data['is_registered'])

{

        include($phpbb_root_path . 'includes/captcha/captcha_factory.' . $phpEx);

        $captcha = phpbb_captcha_factory::get_instance($config['captcha_plugin']);

        $captcha->init(CONFIRM_POST);

}

// Use post_row values in favor of submitted ones...

$forum_id        = (!empty($post_data['forum_id'])) ? (int) $post_data['forum_id'] : (int) $forum_id;

$topic_id        = (!empty($post_data['topic_id'])) ? (int) $post_data['topic_id'] : (int) $topic_id;

$post_id        = (!empty($post_data['post_id'])) ? (int) $post_data['post_id'] : (int) $post_id;

// Need to login to passworded forum first?

if ($post_data['forum_password'])

{

        login_forum_box(array(

                'forum_id'                        => $forum_id,

                'forum_password'        => $post_data['forum_password'])

        );

}

// Check permissions

if ($user->data['is_bot'])

{

        redirect(append_sid("{$phpbb_root_path}index.$phpEx"));

}

// Is the user able to read within this forum?

if (!$auth->acl_get('f_read', $forum_id))

{

        if ($user->data['user_id'] != ANONYMOUS)

        {

                trigger_error('USER_CANNOT_READ');

        }

        login_box('', $user->lang['LOGIN_EXPLAIN_POST']);

}

// Permission to do the action asked?

$is_authed = false;

switch ($mode)

{

        case 'post':

                if ($auth->acl_get('f_post', $forum_id))

                {

                        $is_authed = true;

                }

        break;

        case 'bump':

                if ($auth->acl_get('f_bump', $forum_id))

                {

                        $is_authed = true;

                }

        break;

        case 'quote':

                $post_data['post_edit_locked'] = 0;

        // no break;

        case 'reply':

                if ($auth->acl_get('f_reply', $forum_id))

                {

                        $is_authed = true;

                }

        break;

        case 'edit':

                if ($user->data['is_registered'] && $auth->acl_gets('f_edit', 'm_edit', $forum_id))

                {

                        $is_authed = true;

                }

        break;

        case 'delete':

                if ($user->data['is_registered'] && $auth->acl_gets('f_delete', 'm_delete', $forum_id))

                {

                        $is_authed = true;

                }

        break;

}

if (!$is_authed)

{

        $check_auth = ($mode == 'quote') ? 'reply' : $mode;

        if ($user->data['is_registered'])

        {

                trigger_error('USER_CANNOT_' . strtoupper($check_auth));

        }

        login_box('', $user->lang['LOGIN_EXPLAIN_' . strtoupper($mode)]);

}

// Is the user able to post within this forum?

if ($post_data['forum_type'] != FORUM_POST && in_array($mode, array('post', 'bump', 'quote', 'reply')))

{

        trigger_error('USER_CANNOT_FORUM_POST');

}

// Forum/Topic locked?

if (($post_data['forum_status'] == ITEM_LOCKED || (isset($post_data['topic_status']) && $post_data['topic_status'] == ITEM_LOCKED)) && !$auth->acl_get('m_edit', $forum_id))

{

        trigger_error(($post_data['forum_status'] == ITEM_LOCKED) ? 'FORUM_LOCKED' : 'TOPIC_LOCKED');

}

// Can we edit this post ... if we're a moderator with rights then always yes

// else it depends on editing times, lock status and if we're the correct user

if ($mode == 'edit' && !$auth->acl_get('m_edit', $forum_id))

{

        if ($user->data['user_id'] != $post_data['poster_id'])

        {

                trigger_error('USER_CANNOT_EDIT');

        }

        if (!($post_data['post_time'] > time() - ($config['edit_time'] * 60) || !$config['edit_time']))

        {

                trigger_error('CANNOT_EDIT_TIME');

        }

        if ($post_data['post_edit_locked'])

        {

                trigger_error('CANNOT_EDIT_POST_LOCKED');

        }

}

// Handle delete mode...

if ($mode == 'delete')

{

        handle_post_delete($forum_id, $topic_id, $post_id, $post_data);

        return;

}

// Handle bump mode...

if ($mode == 'bump')

{

        if ($bump_time = bump_topic_allowed($forum_id, $post_data['topic_bumped'], $post_data['topic_last_post_time'], $post_data['topic_poster'], $post_data['topic_last_poster_id'])

           && check_link_hash(request_var('hash', ''), "topic_{$post_data['topic_id']}"))

        {

                $meta_url = phpbb_bump_topic($forum_id, $topic_id, $post_data, $current_time);

                meta_refresh(3, $meta_url);

                $message = $user->lang['TOPIC_BUMPED'] . '<br /><br />' . $user->lang('VIEW_MESSAGE', '<a href="' . $meta_url . '">', '</a>');

                $message .= '<br /><br />' . sprintf($user->lang['RETURN_FORUM'], '<a href="' . append_sid("{$phpbb_root_path}viewforum.$phpEx", 'f=' . $forum_id) . '">', '</a>');

                trigger_error($message);

        }

        trigger_error('BUMP_ERROR');

}

// Subject length limiting to 60 characters if first post...

if ($mode == 'post' || ($mode == 'edit' && $post_data['topic_first_post_id'] == $post_data['post_id']))

{

        $template->assign_var('S_NEW_MESSAGE', true);

}

// Determine some vars

if (isset($post_data['poster_id']) && $post_data['poster_id'] == ANONYMOUS)

{

        $post_data['quote_username'] = (!empty($post_data['post_username'])) ? $post_data['post_username'] : $user->lang['GUEST'];

}

else

{

        $post_data['quote_username'] = isset($post_data['username']) ? $post_data['username'] : '';

}

$post_data['post_edit_locked']        = (isset($post_data['post_edit_locked'])) ? (int) $post_data['post_edit_locked'] : 0;

$post_data['post_subject_md5']        = (isset($post_data['post_subject']) && $mode == 'edit') ? md5($post_data['post_subject']) : '';

$post_data['post_subject']                = (in_array($mode, array('quote', 'edit'))) ? $post_data['post_subject'] : ((isset($post_data['topic_title'])) ? $post_data['topic_title'] : '');

$post_data['topic_time_limit']        = (isset($post_data['topic_time_limit'])) ? (($post_data['topic_time_limit']) ? (int) $post_data['topic_time_limit'] / 86400 : (int) $post_data['topic_time_limit']) : 0;

$post_data['poll_length']                = (!empty($post_data['poll_length'])) ? (int) $post_data['poll_length'] / 86400 : 0;

$post_data['poll_start']                = (!empty($post_data['poll_start'])) ? (int) $post_data['poll_start'] : 0;

$post_data['icon_id']                        = (!isset($post_data['icon_id']) || in_array($mode, array('quote', 'reply'))) ? 0 : (int) $post_data['icon_id'];

$post_data['poll_options']                = array();

// Get Poll Data

if ($post_data['poll_start'])

{

        $sql = 'SELECT poll_option_text

                FROM ' . POLL_OPTIONS_TABLE . "

                WHERE topic_id = $topic_id

                ORDER BY poll_option_id";

        $result = $db->sql_query($sql);

        while ($row = $db->sql_fetchrow($result))

        {

                $post_data['poll_options'][] = trim($row['poll_option_text']);

        }

        $db->sql_freeresult($result);

}

if ($mode == 'edit')

{

        $original_poll_data = array(

                'poll_title'                => $post_data['poll_title'],

                'poll_length'                => $post_data['poll_length'],

                'poll_max_options'        => $post_data['poll_max_options'],

                'poll_option_text'        => implode("\n", $post_data['poll_options']),

                'poll_start'                => $post_data['poll_start'],

                'poll_last_vote'        => $post_data['poll_last_vote'],

                'poll_vote_change'        => $post_data['poll_vote_change'],

        );

}

$orig_poll_options_size = sizeof($post_data['poll_options']);

$message_parser = new parse_message();

if (isset($post_data['post_text']))

{

        $message_parser->message = &$post_data['post_text'];

        unset($post_data['post_text']);

}

// Set some default variables

$uninit = array('post_attachment' => 0, 'poster_id' => $user->data['user_id'], 'enable_magic_url' => 0, 'topic_status' => 0, 'topic_type' => POST_NORMAL, 'post_subject' => '', 'topic_title' => '', 'post_time' => 0, 'post_edit_reason' => '', 'notify_set' => 0);

foreach ($uninit as $var_name => $default_value)

{

        if (!isset($post_data[$var_name]))

        {

                $post_data[$var_name] = $default_value;

        }

}

unset($uninit);

// Always check if the submitted attachment data is valid and belongs to the user.

// Further down (especially in submit_post()) we do not check this again.

$message_parser->get_submitted_attachment_data($post_data['poster_id']);

if ($post_data['post_attachment'] && !$submit && !$refresh && !$preview && $mode == 'edit')

{

        // Do not change to SELECT *

        $sql = 'SELECT attach_id, is_orphan, attach_comment, real_filename

                FROM ' . ATTACHMENTS_TABLE . "

                WHERE post_msg_id = $post_id

                        AND in_message = 0

                        AND is_orphan = 0

                ORDER BY filetime DESC";

        $result = $db->sql_query($sql);

        $message_parser->attachment_data = array_merge($message_parser->attachment_data, $db->sql_fetchrowset($result));

        $db->sql_freeresult($result);

}

if ($post_data['poster_id'] == ANONYMOUS)

{

        $post_data['username'] = ($mode == 'quote' || $mode == 'edit') ? trim($post_data['post_username']) : '';

}

else

{

        $post_data['username'] = ($mode == 'quote' || $mode == 'edit') ? trim($post_data['username']) : '';

}

$post_data['enable_urls'] = $post_data['enable_magic_url'];

if ($mode != 'edit')

{

        $post_data['enable_sig']                = ($config['allow_sig'] && $user->optionget('attachsig')) ? true: false;

        $post_data['enable_smilies']        = ($config['allow_smilies'] && $user->optionget('smilies')) ? true : false;

        $post_data['enable_bbcode']                = ($config['allow_bbcode'] && $user->optionget('bbcode')) ? true : false;

        $post_data['enable_urls']                = true;

}

$post_data['enable_magic_url'] = $post_data['drafts'] = false;

// User own some drafts?

if ($user->data['is_registered'] && $auth->acl_get('u_savedrafts') && ($mode == 'reply' || $mode == 'post' || $mode == 'quote'))

{

        $sql = 'SELECT draft_id

                FROM ' . DRAFTS_TABLE . '

                WHERE user_id = ' . $user->data['user_id'] .

                        (($forum_id) ? ' AND forum_id = ' . (int) $forum_id : '') .

                        (($topic_id) ? ' AND topic_id = ' . (int) $topic_id : '') .

                        (($draft_id) ? " AND draft_id <> $draft_id" : '');

        $result = $db->sql_query_limit($sql, 1);

        if ($db->sql_fetchrow($result))

        {

                $post_data['drafts'] = true;

        }

        $db->sql_freeresult($result);

}

$check_value = (($post_data['enable_bbcode']+1) << 8) + (($post_data['enable_smilies']+1) << 4) + (($post_data['enable_urls']+1) << 2) + (($post_data['enable_sig']+1) << 1);

// Check if user is watching this topic

if ($mode != 'post' && $config['allow_topic_notify'] && $user->data['is_registered'])

{

        $sql = 'SELECT topic_id

                FROM ' . TOPICS_WATCH_TABLE . '

                WHERE topic_id = ' . $topic_id . '

                        AND user_id = ' . $user->data['user_id'];

        $result = $db->sql_query($sql);

        $post_data['notify_set'] = (int) $db->sql_fetchfield('topic_id');

        $db->sql_freeresult($result);

}

// Do we want to edit our post ?

if ($mode == 'edit' && $post_data['bbcode_uid'])

{

        $message_parser->bbcode_uid = $post_data['bbcode_uid'];

}

// HTML, BBCode, Smilies, Images and Flash status

$bbcode_status        = ($config['allow_bbcode'] && $auth->acl_get('f_bbcode', $forum_id)) ? true : false;

$smilies_status        = ($config['allow_smilies'] && $auth->acl_get('f_smilies', $forum_id)) ? true : false;

$img_status                = ($bbcode_status && $auth->acl_get('f_img', $forum_id)) ? true : false;

$url_status                = ($config['allow_post_links']) ? true : false;

$flash_status        = ($bbcode_status && $auth->acl_get('f_flash', $forum_id) && $config['allow_post_flash']) ? true : false;

$quote_status        = true;

// Save Draft

if ($save && $user->data['is_registered'] && $auth->acl_get('u_savedrafts') && ($mode == 'reply' || $mode == 'post' || $mode == 'quote'))

{

        $subject = utf8_normalize_nfc(request_var('subject', '', true));

        $subject = (!$subject && $mode != 'post') ? $post_data['topic_title'] : $subject;

        $message = utf8_normalize_nfc(request_var('message', '', true));

        if ($subject && $message)

        {

                if (confirm_box(true))

                {

                        $sql = 'INSERT INTO ' . DRAFTS_TABLE . ' ' . $db->sql_build_array('INSERT', array(

                                'user_id'                => (int) $user->data['user_id'],

                                'topic_id'                => (int) $topic_id,

                                'forum_id'                => (int) $forum_id,

                                'save_time'                => (int) $current_time,

                                'draft_subject'        => (string) $subject,

                                'draft_message'        => (string) $message)

                        );

                        $db->sql_query($sql);

                        $meta_info = ($mode == 'post') ? append_sid("{$phpbb_root_path}viewforum.$phpEx", 'f=' . $forum_id) : append_sid("{$phpbb_root_path}viewtopic.$phpEx", "f=$forum_id&t=$topic_id");

                        meta_refresh(3, $meta_info);

                        $message = $user->lang['DRAFT_SAVED'] . '<br /><br />';

                        $message .= ($mode != 'post') ? sprintf($user->lang['RETURN_TOPIC'], '<a href="' . $meta_info . '">', '</a>') . '<br /><br />' : '';

                        $message .= sprintf($user->lang['RETURN_FORUM'], '<a href="' . append_sid("{$phpbb_root_path}viewforum.$phpEx", 'f=' . $forum_id) . '">', '</a>');

                        trigger_error($message);

                }

                else

                {

                        $s_hidden_fields = build_hidden_fields(array(

                                'mode'                => $mode,

                                'save'                => true,

                                'f'                        => $forum_id,

                                't'                        => $topic_id,

                                'subject'        => $subject,

                                'message'        => $message,

                                'attachment_data' => $message_parser->attachment_data,

                                )

                        );

                        $hidden_fields = array(

                                'icon_id'                        => 0,

                                'disable_bbcode'        => false,

                                'disable_smilies'        => false,

                                'disable_magic_url'        => false,

                                'attach_sig'                => true,

                                'lock_topic'                => false,

                                'topic_type'                => POST_NORMAL,

                                'topic_time_limit'        => 0,

                                'poll_title'                => '',

                                'poll_option_text'        => '',

                                'poll_max_options'        => 1,

                                'poll_length'                => 0,

                                'poll_vote_change'        => false,

                        );

                        foreach ($hidden_fields as $name => $default)

                        {

                                if (!isset($_POST[$name]))

                                {

                                        // Don't include it, if its not available

                                        unset($hidden_fields[$name]);

                                        continue;

                                }

                                if (is_bool($default))

                                {

                                        // Use the string representation

                                        $hidden_fields[$name] = request_var($name, '');

                                }

                                else

                                {

                                        $hidden_fields[$name] = request_var($name, $default);

                                }

                        }

                        $s_hidden_fields .= build_hidden_fields($hidden_fields);

                        confirm_box(false, 'SAVE_DRAFT', $s_hidden_fields);

                }

        }

        else

        {

                if (utf8_clean_string($subject) === '')

                {

                        $error[] = $user->lang['EMPTY_SUBJECT'];

                }

                if (utf8_clean_string($message) === '')

                {

                        $error[] = $user->lang['TOO_FEW_CHARS'];

                }

        }

        unset($subject, $message);

}

// Load requested Draft

if ($draft_id && ($mode == 'reply' || $mode == 'quote' || $mode == 'post') && $user->data['is_registered'] && $auth->acl_get('u_savedrafts'))

{

        $sql = 'SELECT draft_subject, draft_message

                FROM ' . DRAFTS_TABLE . "

                WHERE draft_id = $draft_id

                        AND user_id = " . $user->data['user_id'];

        $result = $db->sql_query_limit($sql, 1);

        $row = $db->sql_fetchrow($result);

        $db->sql_freeresult($result);

        if ($row)

        {

                $post_data['post_subject'] = $row['draft_subject'];

                $message_parser->message = $row['draft_message'];

                $template->assign_var('S_DRAFT_LOADED', true);

        }

        else

        {

                $draft_id = 0;

        }

}

// Load draft overview

if ($load && ($mode == 'reply' || $mode == 'quote' || $mode == 'post') && $post_data['drafts'])

{

        load_drafts($topic_id, $forum_id);

}

if ($submit || $preview || $refresh)

{

        $post_data['topic_cur_post_id']        = request_var('topic_cur_post_id', 0);

        $post_data['post_subject']                = utf8_normalize_nfc(request_var('subject', '', true));

        $message_parser->message                = utf8_normalize_nfc(request_var('message', '', true));

        $post_data['username']                        = utf8_normalize_nfc(request_var('username', $post_data['username'], true));

        $post_data['post_edit_reason']        = ($request->variable('edit_reason', false, false, phpbb_request_interface::POST) && $mode == 'edit' && $auth->acl_get('m_edit', $forum_id)) ? utf8_normalize_nfc(request_var('edit_reason', '', true)) : '';

        $post_data['orig_topic_type']        = $post_data['topic_type'];

        $post_data['topic_type']                = request_var('topic_type', (($mode != 'post') ? (int) $post_data['topic_type'] : POST_NORMAL));

        $post_data['topic_time_limit']        = request_var('topic_time_limit', (($mode != 'post') ? (int) $post_data['topic_time_limit'] : 0));