From ada3beb0a6c649bd9bfc6a87b2fe69ee8ae563f7 Mon Sep 17 00:00:00 2001 From: Andreas Baumann Date: Sat, 1 Feb 2020 08:57:06 +0100 Subject: initial checkin --- post.php | 781 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 781 insertions(+) create mode 100644 post.php (limited to 'post.php') diff --git a/post.php b/post.php new file mode 100644 index 0000000..067d87b --- /dev/null +++ b/post.php @@ -0,0 +1,781 @@ + 0 && $fid > 0) + message($lang_common['Bad request'], false, '404 Not Found'); + +// Fetch some info about the topic and/or the forum +if ($tid) + $result = $db->query('SELECT f.id, f.forum_name, f.moderators, f.redirect_url, fp.post_replies, fp.post_topics, t.subject, t.closed, s.user_id AS is_subscribed FROM '.$db->prefix.'topics AS t INNER JOIN '.$db->prefix.'forums AS f ON f.id=t.forum_id LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].') LEFT JOIN '.$db->prefix.'topic_subscriptions AS s ON (t.id=s.topic_id AND s.user_id='.$pun_user['id'].') WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id='.$tid) or error('Unable to fetch forum info', __FILE__, __LINE__, $db->error()); +else + $result = $db->query('SELECT f.id, f.forum_name, f.moderators, f.redirect_url, fp.post_replies, fp.post_topics FROM '.$db->prefix.'forums AS f LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].') WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND f.id='.$fid) or error('Unable to fetch forum info', __FILE__, __LINE__, $db->error()); + +if (!$db->num_rows($result)) + message($lang_common['Bad request'], false, '404 Not Found'); + +$cur_posting = $db->fetch_assoc($result); +$is_subscribed = $tid && $cur_posting['is_subscribed']; + +// Is someone trying to post into a redirect forum? +if ($cur_posting['redirect_url'] != '') + message($lang_common['Bad request'], false, '404 Not Found'); + +// Sort out who the moderators are and if we are currently a moderator (or an admin) +$mods_array = ($cur_posting['moderators'] != '') ? unserialize($cur_posting['moderators']) : array(); +$is_admmod = ($pun_user['g_id'] == PUN_ADMIN || ($pun_user['g_moderator'] == '1' && array_key_exists($pun_user['username'], $mods_array))) ? true : false; + +if ($tid && $pun_config['o_censoring'] == '1') + $cur_posting['subject'] = censor_words($cur_posting['subject']); + +// Do we have permission to post? +if ((($tid && (($cur_posting['post_replies'] == '' && $pun_user['g_post_replies'] == '0') || $cur_posting['post_replies'] == '0')) || + ($fid && (($cur_posting['post_topics'] == '' && $pun_user['g_post_topics'] == '0') || $cur_posting['post_topics'] == '0')) || + (isset($cur_posting['closed']) && $cur_posting['closed'] == '1')) && + !$is_admmod) + message($lang_common['No permission'], false, '403 Forbidden'); + +// Load the post.php language file +require PUN_ROOT.'lang/'.$pun_user['language'].'/post.php'; + +// Start with a clean slate +$errors = array(); + + +// Did someone just hit "Submit" or "Preview"? +if (isset($_POST['form_sent'])) +{ + flux_hook('post_before_validation'); + + // Flood protection + if (!isset($_POST['preview']) && $pun_user['last_post'] != '' && (time() - $pun_user['last_post']) < $pun_user['g_post_flood']) + $errors[] = sprintf($lang_post['Flood start'], $pun_user['g_post_flood'], $pun_user['g_post_flood'] - (time() - $pun_user['last_post'])); + + // Make sure they got here from the site + confirm_referrer(array('post.php', 'viewtopic.php')); + + // If it's a new topic + if ($fid) + { + $subject = pun_trim($_POST['req_subject']); + + if ($subject == '') + $errors[] = $lang_post['No subject']; + else if ($pun_config['o_censoring'] == '1') + { + // Censor subject to see if that causes problems + $subject = pun_trim(censor_words($subject)); + + if ($subject == '') + $errors[] = $lang_post['No subject after censoring']; + } + + if (empty($errors)) + { + if (pun_strlen($subject) > 70) + $errors[] = $lang_post['Too long subject']; + else if ($pun_config['p_subject_all_caps'] == '0' && is_all_uppercase($subject) && !$pun_user['is_admmod']) + $errors[] = $lang_post['All caps subject']; + else if ($pun_user['g_post_links'] != '1' && preg_match('%(?:h\s*t|f)\s*t\s*p\s*(?:s\s*)?:\s*/\s*/%', $subject)) + $errors[] = $lang_common['BBCode error tag url not allowed']; + } + } + + // If the user is logged in we get the username and email from $pun_user + if (!$pun_user['is_guest']) + { + $username = $pun_user['username']; + $email = $pun_user['email']; + } + // Otherwise it should be in $_POST + else + { + $username = pun_trim($_POST['req_username']); + $email = strtolower(pun_trim(($pun_config['p_force_guest_email'] == '1') ? $_POST['req_email'] : $_POST['email'])); + $banned_email = false; + + // Load the register.php/prof_reg.php language files + require PUN_ROOT.'lang/'.$pun_user['language'].'/prof_reg.php'; + require PUN_ROOT.'lang/'.$pun_user['language'].'/register.php'; + + // It's a guest, so we have to validate the username + check_username($username); + + if ($pun_config['p_force_guest_email'] == '1' || $email != '') + { + require PUN_ROOT.'include/email.php'; + if (!is_valid_email($email)) + $errors[] = $lang_common['Invalid email']; + + // Check if it's a banned email address + // we should only check guests because members' addresses are already verified + if ($pun_user['is_guest'] && is_banned_email($email)) + { + if ($pun_config['p_allow_banned_email'] == '0') + $errors[] = $lang_prof_reg['Banned email']; + + $banned_email = true; // Used later when we send an alert email + } + } + } + + // Clean up message from POST + $orig_message = $message = pun_linebreaks(pun_trim($_POST['req_message'])); + + // Here we use strlen() not pun_strlen() as we want to limit the post to PUN_MAX_POSTSIZE bytes, not characters + if (strlen($message) > PUN_MAX_POSTSIZE) + $errors[] = sprintf($lang_post['Too long message'], forum_number_format(PUN_MAX_POSTSIZE)); + else if ($pun_config['p_message_all_caps'] == '0' && is_all_uppercase($message) && !$pun_user['is_admmod']) + $errors[] = $lang_post['All caps message']; + + // Validate BBCode syntax + if ($pun_config['p_message_bbcode'] == '1') + { + require PUN_ROOT.'include/parser.php'; + $message = preparse_bbcode($message, $errors); + } + + if (empty($errors)) + { + if ($message == '') + $errors[] = $lang_post['No message']; + else if ($pun_config['o_censoring'] == '1') + { + // Censor message to see if that causes problems + $message = pun_trim(censor_words($message)); + + if ($message == '') + $errors[] = $lang_post['No message after censoring']; + } + } + + $hide_smilies = isset($_POST['hide_smilies']) ? '1' : '0'; + $subscribe = isset($_POST['subscribe']) ? '1' : '0'; + $stick_topic = isset($_POST['stick_topic']) && $is_admmod ? '1' : '0'; + + // Replace four-byte characters (MySQL cannot handle them) + $message = strip_bad_multibyte_chars($message); + + $now = time(); + + flux_hook('post_after_validation'); + + // Did everything go according to plan? + if (empty($errors) && !isset($_POST['preview'])) + { + require PUN_ROOT.'include/search_idx.php'; + + // If it's a reply + if ($tid) + { + if (!$pun_user['is_guest']) + { + $new_tid = $tid; + + // Insert the new post + $db->query('INSERT INTO '.$db->prefix.'posts (poster, poster_id, poster_ip, message, hide_smilies, posted, topic_id) VALUES(\''.$db->escape($username).'\', '.$pun_user['id'].', \''.$db->escape(get_remote_address()).'\', \''.$db->escape($message).'\', '.$hide_smilies.', '.$now.', '.$tid.')') or error('Unable to create post', __FILE__, __LINE__, $db->error()); + $new_pid = $db->insert_id(); + + // To subscribe or not to subscribe, that ... + if ($pun_config['o_topic_subscriptions'] == '1') + { + if ($subscribe && !$is_subscribed) + $db->query('INSERT INTO '.$db->prefix.'topic_subscriptions (user_id, topic_id) VALUES('.$pun_user['id'].' ,'.$tid.')') or error('Unable to add subscription', __FILE__, __LINE__, $db->error()); + else if (!$subscribe && $is_subscribed) + $db->query('DELETE FROM '.$db->prefix.'topic_subscriptions WHERE user_id='.$pun_user['id'].' AND topic_id='.$tid) or error('Unable to remove subscription', __FILE__, __LINE__, $db->error()); + } + } + else + { + // It's a guest. Insert the new post + $email_sql = ($pun_config['p_force_guest_email'] == '1' || $email != '') ? '\''.$db->escape($email).'\'' : 'NULL'; + $db->query('INSERT INTO '.$db->prefix.'posts (poster, poster_ip, poster_email, message, hide_smilies, posted, topic_id) VALUES(\''.$db->escape($username).'\', \''.$db->escape(get_remote_address()).'\', '.$email_sql.', \''.$db->escape($message).'\', '.$hide_smilies.', '.$now.', '.$tid.')') or error('Unable to create post', __FILE__, __LINE__, $db->error()); + $new_pid = $db->insert_id(); + } + + // Update topic + $db->query('UPDATE '.$db->prefix.'topics SET num_replies=num_replies+1, last_post='.$now.', last_post_id='.$new_pid.', last_poster=\''.$db->escape($username).'\' WHERE id='.$tid) or error('Unable to update topic', __FILE__, __LINE__, $db->error()); + + update_search_index('post', $new_pid, $message); + + update_forum($cur_posting['id']); + + // Should we send out notifications? + if ($pun_config['o_topic_subscriptions'] == '1') + { + // Get the post time for the previous post in this topic + $result = $db->query('SELECT posted FROM '.$db->prefix.'posts WHERE topic_id='.$tid.' ORDER BY id DESC LIMIT 1, 1') or error('Unable to fetch post info', __FILE__, __LINE__, $db->error()); + $previous_post_time = $db->result($result); + + // Get any subscribed users that should be notified (banned users are excluded) + $result = $db->query('SELECT u.id, u.email, u.notify_with_post, u.language FROM '.$db->prefix.'users AS u INNER JOIN '.$db->prefix.'topic_subscriptions AS s ON u.id=s.user_id LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id='.$cur_posting['id'].' AND fp.group_id=u.group_id) LEFT JOIN '.$db->prefix.'online AS o ON u.id=o.user_id LEFT JOIN '.$db->prefix.'bans AS b ON u.username=b.username WHERE b.username IS NULL AND COALESCE(o.logged, u.last_visit)>'.$previous_post_time.' AND (fp.read_forum IS NULL OR fp.read_forum=1) AND s.topic_id='.$tid.' AND u.id!='.$pun_user['id']) or error('Unable to fetch subscription info', __FILE__, __LINE__, $db->error()); + if ($db->num_rows($result)) + { + require_once PUN_ROOT.'include/email.php'; + + $notification_emails = array(); + $languages = forum_list_langs(); + + $cleaned_message = bbcode2email($message, -1); + + // Loop through subscribed users and send emails + while ($cur_subscriber = $db->fetch_assoc($result)) + { + if (!in_array($cur_subscriber['language'], $languages)) + $cur_subscriber['language'] = $pun_config['o_default_lang']; + + // Is the subscription email for $cur_subscriber['language'] cached or not? + if (!isset($notification_emails[$cur_subscriber['language']])) + { + if (file_exists(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply.tpl')) + { + // Load the "new reply" template + $mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply.tpl')); + + // Load the "new reply full" template (with post included) + $mail_tpl_full = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_reply_full.tpl')); + + // The first row contains the subject (it also starts with "Subject:") + $first_crlf = strpos($mail_tpl, "\n"); + $mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8)); + $mail_message = trim(substr($mail_tpl, $first_crlf)); + + $first_crlf = strpos($mail_tpl_full, "\n"); + $mail_subject_full = trim(substr($mail_tpl_full, 8, $first_crlf-8)); + $mail_message_full = trim(substr($mail_tpl_full, $first_crlf)); + + $mail_subject = str_replace('', $cur_posting['subject'], $mail_subject); + $mail_message = str_replace('', $cur_posting['subject'], $mail_message); + $mail_message = str_replace('', $username, $mail_message); + $mail_message = str_replace('', get_base_url().'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message); + $mail_message = str_replace('', get_base_url().'/viewtopic.php?id='.$tid.'#unsubscribe', $mail_message); + $mail_message = str_replace('', $pun_config['o_board_title'], $mail_message); + + $mail_subject_full = str_replace('', $cur_posting['subject'], $mail_subject_full); + $mail_message_full = str_replace('', $cur_posting['subject'], $mail_message_full); + $mail_message_full = str_replace('', $username, $mail_message_full); + $mail_message_full = str_replace('', $cleaned_message, $mail_message_full); + $mail_message_full = str_replace('', get_base_url().'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message_full); + $mail_message_full = str_replace('', get_base_url().'/viewtopic.php?id='.$tid.'#unsubscribe', $mail_message_full); + $mail_message_full = str_replace('', $pun_config['o_board_title'], $mail_message_full); + + $notification_emails[$cur_subscriber['language']][0] = $mail_subject; + $notification_emails[$cur_subscriber['language']][1] = $mail_message; + $notification_emails[$cur_subscriber['language']][2] = $mail_subject_full; + $notification_emails[$cur_subscriber['language']][3] = $mail_message_full; + + $mail_subject = $mail_message = $mail_subject_full = $mail_message_full = null; + } + } + + // We have to double check here because the templates could be missing + if (isset($notification_emails[$cur_subscriber['language']])) + { + if ($cur_subscriber['notify_with_post'] == '0') + pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][0], $notification_emails[$cur_subscriber['language']][1]); + else + pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][2], $notification_emails[$cur_subscriber['language']][3]); + } + } + + unset($cleaned_message); + } + } + } + // If it's a new topic + else if ($fid) + { + // Create the topic + $db->query('INSERT INTO '.$db->prefix.'topics (poster, subject, posted, last_post, last_poster, sticky, forum_id) VALUES(\''.$db->escape($username).'\', \''.$db->escape($subject).'\', '.$now.', '.$now.', \''.$db->escape($username).'\', '.$stick_topic.', '.$fid.')') or error('Unable to create topic', __FILE__, __LINE__, $db->error()); + $new_tid = $db->insert_id(); + + if (!$pun_user['is_guest']) + { + // To subscribe or not to subscribe, that ... + if ($pun_config['o_topic_subscriptions'] == '1' && $subscribe) + $db->query('INSERT INTO '.$db->prefix.'topic_subscriptions (user_id, topic_id) VALUES('.$pun_user['id'].' ,'.$new_tid.')') or error('Unable to add subscription', __FILE__, __LINE__, $db->error()); + + // Create the post ("topic post") + $db->query('INSERT INTO '.$db->prefix.'posts (poster, poster_id, poster_ip, message, hide_smilies, posted, topic_id) VALUES(\''.$db->escape($username).'\', '.$pun_user['id'].', \''.$db->escape(get_remote_address()).'\', \''.$db->escape($message).'\', '.$hide_smilies.', '.$now.', '.$new_tid.')') or error('Unable to create post', __FILE__, __LINE__, $db->error()); + } + else + { + // Create the post ("topic post") + $email_sql = ($pun_config['p_force_guest_email'] == '1' || $email != '') ? '\''.$db->escape($email).'\'' : 'NULL'; + $db->query('INSERT INTO '.$db->prefix.'posts (poster, poster_ip, poster_email, message, hide_smilies, posted, topic_id) VALUES(\''.$db->escape($username).'\', \''.$db->escape(get_remote_address()).'\', '.$email_sql.', \''.$db->escape($message).'\', '.$hide_smilies.', '.$now.', '.$new_tid.')') or error('Unable to create post', __FILE__, __LINE__, $db->error()); + } + $new_pid = $db->insert_id(); + + // Update the topic with last_post_id + $db->query('UPDATE '.$db->prefix.'topics SET last_post_id='.$new_pid.', first_post_id='.$new_pid.' WHERE id='.$new_tid) or error('Unable to update topic', __FILE__, __LINE__, $db->error()); + + update_search_index('post', $new_pid, $message, $subject); + + update_forum($fid); + + // Should we send out notifications? + if ($pun_config['o_forum_subscriptions'] == '1') + { + // Get any subscribed users that should be notified (banned users are excluded) + $result = $db->query('SELECT u.id, u.email, u.notify_with_post, u.language FROM '.$db->prefix.'users AS u INNER JOIN '.$db->prefix.'forum_subscriptions AS s ON u.id=s.user_id LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id='.$cur_posting['id'].' AND fp.group_id=u.group_id) LEFT JOIN '.$db->prefix.'bans AS b ON u.username=b.username WHERE b.username IS NULL AND (fp.read_forum IS NULL OR fp.read_forum=1) AND s.forum_id='.$cur_posting['id'].' AND u.id!='.$pun_user['id']) or error('Unable to fetch subscription info', __FILE__, __LINE__, $db->error()); + if ($db->num_rows($result)) + { + require_once PUN_ROOT.'include/email.php'; + + $notification_emails = array(); + $languages = forum_list_langs(); + + $cleaned_message = bbcode2email($message, -1); + + // Loop through subscribed users and send emails + while ($cur_subscriber = $db->fetch_assoc($result)) + { + if (!in_array($cur_subscriber['language'], $languages)) + $cur_subscriber['language'] = $pun_config['o_default_lang']; + + // Is the subscription email for $cur_subscriber['language'] cached or not? + if (!isset($notification_emails[$cur_subscriber['language']])) + { + if (file_exists(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_topic.tpl')) + { + // Load the "new topic" template + $mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_topic.tpl')); + + // Load the "new topic full" template (with post included) + $mail_tpl_full = trim(file_get_contents(PUN_ROOT.'lang/'.$cur_subscriber['language'].'/mail_templates/new_topic_full.tpl')); + + // The first row contains the subject (it also starts with "Subject:") + $first_crlf = strpos($mail_tpl, "\n"); + $mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8)); + $mail_message = trim(substr($mail_tpl, $first_crlf)); + + $first_crlf = strpos($mail_tpl_full, "\n"); + $mail_subject_full = trim(substr($mail_tpl_full, 8, $first_crlf-8)); + $mail_message_full = trim(substr($mail_tpl_full, $first_crlf)); + + $mail_subject = str_replace('', $cur_posting['forum_name'], $mail_subject); + $mail_message = str_replace('', $subject, $mail_message); + $mail_message = str_replace('', $cur_posting['forum_name'], $mail_message); + $mail_message = str_replace('', $username, $mail_message); + $mail_message = str_replace('', get_base_url().'/viewtopic.php?id='.$new_tid, $mail_message); + $mail_message = str_replace('', get_base_url().'/viewforum.php?id='.$cur_posting['id'].'#unsubscribe', $mail_message); + $mail_message = str_replace('', $pun_config['o_board_title'], $mail_message); + + $mail_subject_full = str_replace('', $cur_posting['forum_name'], $mail_subject_full); + $mail_message_full = str_replace('', $subject, $mail_message_full); + $mail_message_full = str_replace('', $cur_posting['forum_name'], $mail_message_full); + $mail_message_full = str_replace('', $username, $mail_message_full); + $mail_message_full = str_replace('', $cleaned_message, $mail_message_full); + $mail_message_full = str_replace('', get_base_url().'/viewtopic.php?id='.$new_tid, $mail_message_full); + $mail_message_full = str_replace('', get_base_url().'/viewforum.php?id='.$cur_posting['id'].'#unsubscribe', $mail_message_full); + $mail_message_full = str_replace('', $pun_config['o_board_title'], $mail_message_full); + + $notification_emails[$cur_subscriber['language']][0] = $mail_subject; + $notification_emails[$cur_subscriber['language']][1] = $mail_message; + $notification_emails[$cur_subscriber['language']][2] = $mail_subject_full; + $notification_emails[$cur_subscriber['language']][3] = $mail_message_full; + + $mail_subject = $mail_message = $mail_subject_full = $mail_message_full = null; + } + } + + // We have to double check here because the templates could be missing + if (isset($notification_emails[$cur_subscriber['language']])) + { + if ($cur_subscriber['notify_with_post'] == '0') + pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][0], $notification_emails[$cur_subscriber['language']][1]); + else + pun_mail($cur_subscriber['email'], $notification_emails[$cur_subscriber['language']][2], $notification_emails[$cur_subscriber['language']][3]); + } + } + + unset($cleaned_message); + } + } + } + + // If we previously found out that the email was banned + if ($pun_user['is_guest'] && $banned_email && $pun_config['o_mailing_list'] != '') + { + // Load the "banned email post" template + $mail_tpl = trim(file_get_contents(PUN_ROOT.'lang/'.$pun_user['language'].'/mail_templates/banned_email_post.tpl')); + + // The first row contains the subject + $first_crlf = strpos($mail_tpl, "\n"); + $mail_subject = trim(substr($mail_tpl, 8, $first_crlf-8)); + $mail_message = trim(substr($mail_tpl, $first_crlf)); + + $mail_message = str_replace('', $username, $mail_message); + $mail_message = str_replace('', $email, $mail_message); + $mail_message = str_replace('', get_base_url().'/viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $mail_message); + $mail_message = str_replace('', $pun_config['o_board_title'], $mail_message); + + pun_mail($pun_config['o_mailing_list'], $mail_subject, $mail_message); + } + + // If the posting user is logged in, increment his/her post count + if (!$pun_user['is_guest']) + { + $db->query('UPDATE '.$db->prefix.'users SET num_posts=num_posts+1, last_post='.$now.' WHERE id='.$pun_user['id']) or error('Unable to update user', __FILE__, __LINE__, $db->error()); + + // Promote this user to a new group if enabled + if ($pun_user['g_promote_next_group'] != 0 && $pun_user['num_posts'] + 1 >= $pun_user['g_promote_min_posts']) + { + $new_group_id = $pun_user['g_promote_next_group']; + $db->query('UPDATE '.$db->prefix.'users SET group_id='.$new_group_id.' WHERE id='.$pun_user['id']) or error('Unable to promote user to new group', __FILE__, __LINE__, $db->error()); + } + + // Topic tracking stuff... + $tracked_topics = get_tracked_topics(); + $tracked_topics['topics'][$new_tid] = time(); + set_tracked_topics($tracked_topics); + } + else + { + $db->query('UPDATE '.$db->prefix.'online SET last_post='.$now.' WHERE ident=\''.$db->escape(get_remote_address()).'\'' ) or error('Unable to update user', __FILE__, __LINE__, $db->error()); + } + + redirect('viewtopic.php?pid='.$new_pid.'#p'.$new_pid, $lang_post['Post redirect']); + } +} + + +// If a topic ID was specified in the url (it's a reply) +if ($tid) +{ + $action = $lang_post['Post a reply']; + $form = '
'; + + // If a quote ID was specified in the url + if (isset($_GET['qid'])) + { + $qid = intval($_GET['qid']); + if ($qid < 1) + message($lang_common['Bad request'], false, '404 Not Found'); + + $result = $db->query('SELECT poster, message FROM '.$db->prefix.'posts WHERE id='.$qid.' AND topic_id='.$tid) or error('Unable to fetch quote info', __FILE__, __LINE__, $db->error()); + if (!$db->num_rows($result)) + message($lang_common['Bad request'], false, '404 Not Found'); + + list($q_poster, $q_message) = $db->fetch_row($result); + + // If the message contains a code tag we have to split it up (text within [code][/code] shouldn't be touched) + if (strpos($q_message, '[code]') !== false && strpos($q_message, '[/code]') !== false) + { + list($inside, $outside) = split_text($q_message, '[code]', '[/code]'); + + $q_message = implode("\1", $outside); + } + + // Remove [img] tags from quoted message + $q_message = preg_replace('%\[img(?:=(?:[^\[]*?))?\]((ht|f)tps?://)([^\s<"]*?)\[/img\]%U', '\1\3', $q_message); + + // If we split up the message before we have to concatenate it together again (code tags) + if (isset($inside)) + { + $outside = explode("\1", $q_message); + $q_message = ''; + + $num_tokens = count($outside); + for ($i = 0; $i < $num_tokens; ++$i) + { + $q_message .= $outside[$i]; + if (isset($inside[$i])) + $q_message .= '[code]'.$inside[$i].'[/code]'; + } + + unset($inside); + } + + if ($pun_config['o_censoring'] == '1') + $q_message = censor_words($q_message); + + $q_message = pun_htmlspecialchars($q_message); + + if ($pun_config['p_message_bbcode'] == '1') + { + // If username contains a square bracket, we add "" or '' around it (so we know when it starts and ends) + if (strpos($q_poster, '[') !== false || strpos($q_poster, ']') !== false) + { + if (strpos($q_poster, '\'') !== false) + $q_poster = '"'.$q_poster.'"'; + else + $q_poster = '\''.$q_poster.'\''; + } + else + { + // Get the characters at the start and end of $q_poster + $ends = substr($q_poster, 0, 1).substr($q_poster, -1, 1); + + // Deal with quoting "Username" or 'Username' (becomes '"Username"' or "'Username'") + if ($ends == '\'\'') + $q_poster = '"'.$q_poster.'"'; + else if ($ends == '""') + $q_poster = '\''.$q_poster.'\''; + } + + $quote = '[quote='.$q_poster.']'.$q_message.'[/quote]'."\n"; + } + else + $quote = '> '.$q_poster.' '.$lang_common['wrote']."\n\n".'> '.$q_message."\n"; + } +} +// If a forum ID was specified in the url (new topic) +else if ($fid) +{ + $action = $lang_post['Post new topic']; + $form = ''; +} +else + message($lang_common['Bad request'], false, '404 Not Found'); + + +$page_title = array(pun_htmlspecialchars($pun_config['o_board_title']), $action); +$required_fields = array('req_email' => $lang_common['Email'], 'req_subject' => $lang_common['Subject'], 'req_message' => $lang_common['Message']); +$focus_element = array('post'); + +if (!$pun_user['is_guest']) + $focus_element[] = ($fid) ? 'req_subject' : 'req_message'; +else +{ + $required_fields['req_username'] = $lang_post['Guest name']; + $focus_element[] = 'req_username'; +} + +flux_hook('post_before_header'); + +define('PUN_ACTIVE_PAGE', 'index'); +require PUN_ROOT.'header.php'; + +?> +
+
+
    +
    • +
  • » 
    • +
  • » 
    • + +
  • » 
    • +
  • » 
    • +
+
+
+ + +
+

+
+
+

+
    +'.$cur_error.''."\n"; +?> +
+
+
+
+ + +
+

+
+
+
+
+
+ +
+
+
+
+
+
+ + +
+

+
+ +
+
+ +
+ +'.$lang_common['Email'].' '.$lang_common['Required'].'' : $lang_common['Email']; + $email_form_name = ($pun_config['p_force_guest_email'] == '1') ? 'req_email' : 'email'; + +?> + + +
+ + + +
    +
    • +
    • +
    • +
    • +
+
+
+'.$lang_common['Stick topic'].'
'; + +if (!$pun_user['is_guest']) +{ + if ($pun_config['o_smilies'] == '1') + $checkboxes[] = ''; + + if ($pun_config['o_topic_subscriptions'] == '1') + { + $subscr_checked = false; + + // If it's a preview + if (isset($_POST['preview'])) + $subscr_checked = isset($_POST['subscribe']) ? true : false; + // If auto subscribed + else if ($pun_user['auto_notify']) + $subscr_checked = true; + // If already subscribed to the topic + else if ($is_subscribed) + $subscr_checked = true; + + $checkboxes[] = ''; + } +} +else if ($pun_config['o_smilies'] == '1') + $checkboxes[] = ''; + +if (!empty($checkboxes)) +{ + +?> +
+
+
+ +
+
+ +
+
+
+ +
+ +

+ +
+
+ +query('SELECT poster, message, hide_smilies, posted FROM '.$db->prefix.'posts WHERE topic_id='.$tid.' ORDER BY id DESC LIMIT '.$pun_config['o_topic_review']) or error('Unable to fetch topic review', __FILE__, __LINE__, $db->error()); + +?> + +
+

+fetch_assoc($result)) + { + $post_count++; + + $cur_post['message'] = parse_message($cur_post['message'], $cur_post['hide_smilies']); + +?> +
+
+
+
+
+
+
+
+
+
+
+
+ +
+
+
+
+
+
+
+ +
+