merged mod branch

1 files changed, 181 insertions, 184 deletions

diff --git a/post.php b/post.php
index 8653a2c3..431be0c0 100644
--- a/post.php
+++ b/post.php
@@ -1,11 +1,12 @@
-<?php
+<?php	
 	require 'inc/functions.php';
 	require 'inc/display.php';
+	require 'inc/config.php';
 	if (file_exists('inc/instance-config.php')) {
 		require 'inc/instance-config.php';
 	}
-	require 'inc/config.php';
 	require 'inc/template.php';
+	require 'inc/database.php';
 	require 'inc/user.php';
 	
 	// Fix for magic quotes
@@ -19,14 +20,77 @@
 		$_POST = strip_array($_POST);
 	}
 	
-	if(isset($_POST['post'])) {
+	if(isset($_POST['delete'])) {
+		// Delete
+		
+		if(	!isset($_POST['board']) ||
+			!isset($_POST['password'])
+			)
+			error($config['error']['bot']);
+		
+		$password = $_POST['password'];
+		
+		if(empty($password))
+			error($config['error']['invalidpassword']);
+		
+		$delete = Array();
+		foreach($_POST as $post => $value) {
+			if(preg_match('/^delete_(\d+)$/', $post, $m)) {
+				$delete[] = (int)$m[1];
+			}
+		}
+		
+		sql_open();
+		
+		// Check if banned
+		checkBan();
+		
+		if($config['block_tor'] && isTor())
+			error($config['error']['tor']);
+			
+		// Check if board exists
+		if(!openBoard($_POST['board']))
+			error($config['error']['noboard']);
+		
+		if(empty($delete))
+			error($config['error']['nodelete']);
+			
+		foreach($delete as &$id) {
+			$query = prepare(sprintf("SELECT `password` FROM `posts_%s` WHERE `id` = :id", $board['uri']));
+			$query->bindValue(':id', $id, PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			if($post = $query->fetch()) {
+				if(!empty($password) && $post['password'] != $password)
+					error($config['error']['invalidpassword']);
+					
+				if(isset($_POST['file'])) {
+					// Delete just the file
+					deleteFile($id);
+				} else {
+					// Delete entire post
+					deletePost($id);
+				}
+			}
+		}
+		
+		buildIndex();
+		
+		sql_close();
+		
+		$is_mod = isset($_POST['mod']) && $_POST['mod'];
+		$root = $is_mod ? $config['root'] . $config['file_mod'] . '?/' : $config['root'];
+		
+		header('Location: ' . $root . $board['dir'] . $config['file_index'], true, $config['redirect_http']);
+		
+	} elseif(isset($_POST['post'])) {
 		if(	!isset($_POST['name']) ||
 			!isset($_POST['email']) ||
 			!isset($_POST['subject']) ||
 			!isset($_POST['body']) ||
 			!isset($_POST['board']) ||
 			!isset($_POST['password'])
-			) error(ERROR_BOT);
+			) error($config['error']['bot']);
 		
 		$post = Array('board' => $_POST['board']);
 		
@@ -35,13 +99,13 @@
 			$post['thread'] = round($_POST['thread']);
 		} else $OP = true;
 		
-		if(!(($OP && $_POST['post'] == BUTTON_NEWTOPIC) ||
-		    (!$OP && $_POST['post'] == BUTTON_REPLY)))
-			error(ERROR_BOT);
+		if(!(($OP && $_POST['post'] == $config['button_newtopic']) ||
+		    (!$OP && $_POST['post'] == $config['button_reply'])))
+			error($config['error']['bot']);
 		
 		// Check the referrer
 		if($OP) {
-			if(!isset($_SERVER['HTTP_REFERER']) || !preg_match(URL_MATCH, $_SERVER['HTTP_REFERER'])) error(ERROR_BOT);
+			if(!isset($_SERVER['HTTP_REFERER']) || !preg_match($config['url_match'], $_SERVER['HTTP_REFERER'])) error($config['error']['bot']);
 		}
 		
 		// TODO: Since we're now using static HTML files, we can't give them cookies on their first page view
@@ -49,7 +113,7 @@
 		
 		/*
 		// Check if he has a valid cookie.
-		if(!$user['valid']) error(ERROR_BOT);
+		if(!$user['valid']) error($config['error']['bot']);
 		
 		// Check how long he has been here.
 		if(time()-$user['appeared']<LURKTIME) error(ERROR_LURK);
@@ -58,18 +122,28 @@
 		// Open database connection
 		sql_open();
 		
+		// Check if banned
+		checkBan();
+		
+		if($config['block_tor'] && isTor())
+			error($config['error']['tor']);
+			
 		// Check if board exists
 		if(!openBoard($post['board']))
-			error(ERROR_NOBOARD);
+			error($config['error']['noboard']);
+		
+		//if(ROBOT_ENABLE && $board['uri'] == ROBOT_BOARD && ROBOT_MUTE) {
+		//	checkMute();
+		//}
 		
 		//Check if thread exists
 		if(!$OP && !threadExists($post['thread']))
-			error(ERROR_NONEXISTANT);
-		
+			error($config['error']['nonexistant']);
+			
 		// Check for a file
 		if($OP) {
 			if(!isset($_FILES['file']['tmp_name']) || empty($_FILES['file']['tmp_name']))
-				error(ERROR_NOIMAGE);
+				error($config['error']['noimage']);
 		}
 		
 		$post['name'] = (!empty($_POST['name'])?$_POST['name']:'Anonymous');
@@ -77,16 +151,52 @@
 		$post['email'] = utf8tohtml($_POST['email']);
 		$post['body'] = $_POST['body'];
 		$post['password'] = $_POST['password'];
-		$post['filename'] = $_FILES['file']['name'];
+		$post['filename'] = get_magic_quotes_gpc() ? stripslashes($_FILES['file']['name']) : $_FILES['file']['name'];
 		$post['has_file'] = $OP || !empty($_FILES['file']['tmp_name']);
+		$post['mod'] = isset($_POST['mod']) && $_POST['mod'];
+		
+		if(empty($post['body']) && $config['force_body'])
+			error($config['error']['tooshortbody']);
+		
+		if($post['mod']) {
+			require 'inc/mod.php';
+			if(!$mod) {
+				// Liar. You're not a mod.
+				error($config['error']['notamod']);
+			}
+			
+			$post['sticky'] = $OP && isset($_POST['sticky']);
+			$post['locked'] = $OP && isset($_POST['lock']);
+			$post['raw'] = isset($_POST['raw']);
+			
+			if($post['sticky'] && $mod['type'] < $config['mod']['sticky']) error($config['error']['noaccess']);
+			if($post['locked'] && $mod['type'] < $config['mod']['lock']) error($config['error']['noaccess']);
+			if($post['raw'] && $mod['type'] < $config['mod']['rawhtml']) error($config['error']['noaccess']);
+		}
+		
+		// Check if thread is locked
+		// but allow mods to post
+		if(!$OP && (!$mod || $mod['type'] < $config['mod']['postinlocked'])) {
+			if(threadLocked($post['thread']))
+				error($config['error']['locked']);
+		}
 		
 		if($post['has_file']) {
 			$size = $_FILES['file']['size'];
-			if($size > MAX_FILESIZE)
-				error(sprintf3(ERR_FILESIZE, array(
+			if($size > $config['max_filesize'])
+				error(sprintf3($config['error']['filesize'], array(
 					'sz'=>commaize($size),
 					'filesz'=>commaize($size),
-					'maxsz'=>commaize(MAX_FILESIZE))));
+					'maxsz'=>commaize($config['max_filesize']))));
+		}
+		
+		if($mod && $mod['type'] >= MOD && preg_match('/^((.+) )?## (.+)$/', $post['name'], $match)) {
+			if(($mod['type'] == MOD && $match[3] == 'Mod') || $mod['type'] >= ADMIN) {
+				$post['mod_tag'] = $match[3];
+				$post['name'] = !empty($match[2])?$match[2]:'Anonymous';
+			}
+		} else {
+			$post['mod_tag'] = false;
 		}
 		
 		$trip = generate_tripcode($post['name']);
@@ -100,40 +210,37 @@
 		
 		if($post['has_file']) {
 			$post['extension'] = strtolower(substr($post['filename'], strrpos($post['filename'], '.') + 1));
-			$post['file_id'] = rand(0, 1000000000);
-			$post['file'] = $board['dir'] . DIR_IMG . $post['file_id'] . '.' . $post['extension'];
-			$post['thumb'] = $board['dir'] . DIR_THUMB . $post['file_id'] . '.png';
-			$post['zip'] = $OP && $post['has_file'] && ALLOW_ZIP && $post['extension'] == 'zip' ? $post['file'] : false;
-			if(!($post['zip'] || in_array($post['extension'], $allowed_ext))) error(ERROR_FILEEXT);
+			$post['file_id'] = time() . rand(100, 999);
+			$post['file'] = $board['dir'] . $config['dir']['img'] . $post['file_id'] . '.' . $post['extension'];
+			$post['thumb'] = $board['dir'] . $config['dir']['thumb'] . $post['file_id'] . '.png';
 		}
 		
 		// Check string lengths
-		if(strlen($post['name']) > 25) error(sprintf(ERROR_TOOLONG, 'name'));
-		if(strlen($post['email']) > 30) error(sprintf(ERROR_TOOLONG, 'email'));
-		if(strlen($post['subject']) > 40) error(sprintf(ERROR_TOOLONG, 'subject'));
-		if(strlen($post['body']) > MAX_BODY) error(ERROR_TOOLONGBODY);
-		if(!(!$OP && $post['has_file']) && strlen($post['body']) < 1) error(ERROR_TOOSHORTBODY);
-		if(strlen($post['password']) > 20) error(sprintf(ERROR_TOOLONG, 'password'));
+		if(strlen($post['name']) > 50) error(sprintf($config['error']['toolong'], 'name'));			
+		if(strlen($post['email']) > 30) error(sprintf($config['error']['toolong'], 'email'));
+		if(strlen($post['subject']) > 40) error(sprintf($config['error']['toolong'], 'subject'));
+		if(!$mod && strlen($post['body']) > $config['max_body']) error($config['error']['toolongbody']);
+		if(!(!$OP && $post['has_file']) && strlen($post['body']) < 1) error($config['error']['tooshortbody']);
+		if(strlen($post['password']) > 20) error(sprintf($config['error']['toolong'], 'password'));
+		
+		if($post['mod_tag'])
+			$post['trip'] .= ' <a class="nametag">## ' . $post['mod_tag'] . '</a>';
+		
+		$post['body_nomarkup'] = $post['body'];
 		
-		markup($post['body']);
+		if(!($mod && $post['raw']))
+			markup($post['body']);
+		
+		// Check for a flood
+		if(checkFlood($post)) {
+			error($config['error']['flood']);
+		}
 		
 		if($post['has_file']) {
 			// Just trim the filename if it's too long
 			if(strlen($post['filename']) > 30) $post['filename'] = substr($post['filename'], 0, 27).'…';
 			// Move the uploaded file
-			if(!@move_uploaded_file($_FILES['file']['tmp_name'], $post['file'])) error(ERROR_NOMOVE);
-			
-			if($post['zip']) {
-				// Validate ZIP file
-				if(is_resource($zip = zip_open($post['zip'])))
-					// TODO: Check if it's not empty and has at least one (valid) image
-					zip_close($zip);
-				else
-					error(ERR_INVALIDZIP);
-				
-				$post['file'] = ZIP_IMAGE;
-				$post['extension'] = strtolower(substr($post['file'], strrpos($post['file'], '.') + 1));
-			}
+			if(!@move_uploaded_file($_FILES['file']['tmp_name'], $post['file'])) error($config['error']['nomove']);
 			
 			$size = @getimagesize($post['file']);
 			$post['width'] = $size[0];
@@ -142,189 +249,79 @@
 			// Check if the image is valid
 			if($post['width'] < 1 || $post['height'] < 1) {
 				unlink($post['file']);
-				error(ERR_INVALIDIMG);
+				error($config['error']['invalidimg']);
 			}
 			
-			if($post['width'] > MAX_WIDTH || $post['height'] > MAX_HEIGHT) {
+			if($post['width'] > $config['max_width'] || $post['height'] > $config['max_height']) {
 				unlink($post['file']);
-				error(ERR_MAXSIZE);
+				error($config['error']['maxsize']);
 			}
 			
-			$post['filehash'] = md5_file($post['file']);
+			$post['filehash'] = $config['file_hash']($post['file']);
 			$post['filesize'] = filesize($post['file']);
 			
 			$image = createimage($post['extension'], $post['file']);
 			
-			if(REDRAW_IMAGE && !$post['zip']) {
-				switch($post['extension']) {
-					case 'jpg':
-					case 'jpeg':
-						imagejpeg($image, $post['file'], JPEG_QUALITY);
-						break;
-					case 'png':
-						imagepng($image, $post['file'], 7);
-						break;
-					case 'gif':
-						if(REDRAW_GIF)
-							imagegif($image, $post['file']);
-						break;
-					case 'bmp':
-						imagebmp($image, $post['file']);
-						break;
-					default:
-						error('Unknwon file extension.');
-				}
-			}
-			
 			// Create a thumbnail
-			$thumb = resize($image, $post['width'], $post['height'], $post['thumb'], THUMB_WIDTH, THUMB_HEIGHT);
+			$thumb = resize($image, $post['width'], $post['height'], $post['thumb'], $config['thumb_width'], $config['thumb_height']);
 			
 			$post['thumbwidth'] = $thumb['width'];
 			$post['thumbheight'] = $thumb['height'];
 		}
 		
+		/*
+		if(!($mod && $mod['type'] >= $config['mod']['postunoriginal']) && ROBOT_ENABLE && $board['uri'] == ROBOT_BOARD && checkRobot($post['body_nomarkup'])) {
+			if(ROBOT_MUTE) {
+				error(sprintf($config['error']['muted'], mute()));
+			} else {
+				error($config['error']['unoriginal']);
+			}
+		}
+		*/
+		
 		// Remove DIR_* before inserting them into the database.
 		if($post['has_file']) {
-			$post['file'] = substr_replace($post['file'], '', 0, strlen($board['dir'] . DIR_IMG));
-			$post['thumb'] = substr_replace($post['thumb'], '', 0, strlen($board['dir'] . DIR_THUMB));
+			$post['file'] = substr_replace($post['file'], '', 0, strlen($board['dir'] . $config['dir']['img']));
+			$post['thumb'] = substr_replace($post['thumb'], '', 0, strlen($board['dir'] . $config['dir']['thumb']));
 		}
 		
 		// Todo: Validate some more, remove messy code, allow more specific configuration
-		
-		// MySQLify
-		mysql_safe_array($post);
-		
 		$id = post($post, $OP);
 		
-		if($post['has_file'] && $post['zip']) {
-			// Open ZIP
-			$zip = zip_open($post['zip']);
-			// Read files
-			while($entry = zip_read($zip)) {
-				$filename = basename(zip_entry_name($entry));
-				$extension = strtolower(substr($filename, strrpos($filename, '.') + 1));
-				
-				if(in_array($extension, $allowed_ext)) {
-					  if (zip_entry_open($zip, $entry, 'r')) {
-						// Fake post
-						$dump_post = Array(
-							'subject' => $post['subject'],
-							'email' => $post['email'],
-							'name' => $post['name'],
-							'trip' => $post['trip'],
-							'body' => '',
-							'thread' => $id,
-							'password' => '',
-							'has_file' => true,
-							'file_id' => rand(0, 1000000000),
-							'filename' => $filename
-						);
-						
-						$dump_post['file'] = $board['dir'] . DIR_IMG . $dump_post['file_id'] . '.' . $extension;
-						$dump_post['thumb'] = $board['dir'] . DIR_THUMB . $dump_post['file_id'] . '.png';
-						
-						// Extract the image from the ZIP
-						$fp = fopen($dump_post['file'], 'w+');
-						fwrite($fp, zip_entry_read($entry, zip_entry_filesize($entry)));
-						fclose($fp);
-						
-						$size = @getimagesize($dump_post['file']);
-						$dump_post['width'] = $size[0];
-						$dump_post['height'] = $size[1];
-						
-						// Check if the image is valid
-						if($dump_post['width'] < 1 || $dump_post['height'] < 1) {
-							unlink($dump_post['file']);
-						} else {
-							if($dump_post['width'] > MAX_WIDTH || $dump_post['height'] > MAX_HEIGHT) {
-								unlink($dump_post['file']);
-								error(ERR_MAXSIZE);
-							} else {
-								$dump_post['filehash'] = md5_file($dump_post['file']);
-								$dump_post['filesize'] = filesize($dump_post['file']);
-								
-								$image = createimage($extension, $dump_post['file']);
-								
-								$success = true;
-								if(REDRAW_IMAGE) {
-									switch($extension) {
-										case 'jpg':
-										case 'jpeg':
-											imagejpeg($image, $dump_post['file'], JPEG_QUALITY);
-											break;
-										case 'png':
-											imagepng($image, $dump_post['file'], 7);
-											break;
-										case 'gif':
-											if(REDRAW_GIF)
-												imagegif($image, $dump_post['file']);
-											break;
-										case 'bmp':
-											imagebmp($image, $dump_post['file']);
-											break;
-										default:
-											$success = false;
-									}
-								}
-						
-						
-								// Create a thumbnail
-								$thumb = resize($image, $dump_post['width'], $dump_post['height'], $dump_post['thumb'], THUMB_WIDTH, THUMB_HEIGHT);
-								
-								$dump_post['thumbwidth'] = $thumb['width'];
-								$dump_post['thumbheight'] = $thumb['height'];
-								
-								// Remove DIR_* before inserting them into the database.
-								$dump_post['file'] = substr_replace($dump_post['file'], '', 0, strlen($board['dir'] . DIR_IMG));
-								$dump_post['thumb'] = substr_replace($dump_post['thumb'], '', 0, strlen($board['dir'] . DIR_THUMB));
-								
-								// Create the post
-								post($dump_post, false);
-							}
-						}
-						
-						// Close the ZIP
-						zip_entry_close($entry);
-					}
-				}
-			}
-			zip_close($zip);
-			unlink($post['zip']);
-		}
-		
 		buildThread(($OP?$id:$post['thread']));
 		
-		if(!$OP) {
-			mysql_query(
-				sprintf("UPDATE `posts` SET `bump` = '%d' WHERE `id` = '%s' AND `thread` IS NULL",
-					time(),
-					$post['thread']
-				), $sql) or error(mysql_error($sql));
+		if(!$OP && strtolower($post['email']) != 'sage' && ($config['reply_limit'] == 0 || numPosts($post['thread']) < $config['reply_limit'])) {
+			bumpThread($post['thread']);
 		}
 		
+		if($OP)
+			clean();
+		
 		buildIndex();
 		sql_close();
 		
-		if(ALWAYS_NOKO || $noko) {
-			header('Location: ' . ROOT . $board['dir'] . DIR_RES . ($OP?$id:$post['thread']) . '.html' . (!$OP?'#'.$id:''), true, 302);
+		$root = $post['mod'] ? $config['root'] . $config['file_mod'] . '?/' : $config['root'];
+		
+		if($config['always_noko'] || $noko) {
+			header('Location: ' . $root . $board['dir'] . $config['dir']['res'] . ($OP?$id:$post['thread']) . '.html' . (!$OP?'#'.$id:''), true, $config['redirect_http']);
 		} else {
-			header('Location: ' . ROOT . $board['dir'] . FILE_INDEX, true, 302);
+			header('Location: ' . $root . $board['dir'] . $config['file_index'], true, $config['redirect_http']);
 		}
 		
 		exit;
 	} else {
-		if(!file_exists(HAS_INSTALLED)) {
+		if(!file_exists($config['has_installed'])) {
 			sql_open();
 			
 			// Build all boards
-			$boards_res = mysql_query('SELECT * FROM `boards`', $sql) or error(mysql_error($sql));
-			while($_board = mysql_fetch_array($boards_res)) {
+			$boards = listBoards();
+			foreach($boards as &$_board) {
 				setupBoard($_board);
 				buildIndex();
 			}
 			
 			sql_close();
-			touch(HAS_INSTALLED, 0777);
+			touch($config['has_installed'], 0777);
 			
 			die(Element('page.html', Array(
 				'index'=>ROOT,
@@ -336,7 +333,7 @@
 		} else {
 			// They opened post.php in their browser manually.
 			// Possible TODO: Redirect back to homepage.
-			error(ERROR_NOPOST);
+			error($config['error']['nopost']);
 		}
 	}
 ?>