Merge branch 'master' of https://github.com/savetheinternet/Tinyboard into vichan-devel-4.5

Conflicts:
	inc/config.php
	install.php
	post.php
	stylesheets/style.css

18 files changed, 201 insertions, 17 deletions

diff --git a/templates/banned.html b/templates/banned.html
index 79648156..1a9a3915 100644
--- a/templates/banned.html
+++ b/templates/banned.html
@@ -77,16 +77,60 @@
 	</p>
 	<p>{% trans %}Your IP address is{% endtrans %} <strong>{{ ban.ip }}</strong>.</p>
 
-	{% if post %}
+	{% if config.ban_page_extra %}
+		<p>{{ config.ban_page_extra }}</p>
+	{% endif %}
+	
+	{% if post and config.ban_show_post %}
 		<hr>
-		<p>You were banned for the following post on {{ board.url }}:</p>
+		<p>{% trans %}You were banned for the following post on {% endtrans %}{{ board.url }}:</p>
 		{{ post }}
 		<br>
 	{% endif %}
 	
-	{% if config.ban_page_extra %}
-		<p>{{ config.ban_page_extra }}</p>
+	{% if config.ban_appeals and (not ban.expires or ban.expires - ban.created > config.ban_appeals_min_length )%}
+		<hr>
+		{% if pending_appeal %}
+			<p>
+				{% trans %}You submitted an appeal for this ban on{% endtrans %} 
+				<strong>{{ pending_appeal|date(config.ban_date) }}</strong>. {% trans %}It is still pending{% endtrans %}.
+			</p>
+		{% elseif denied_appeals|length >= config.ban_appeals_max %}
+			{% if denied_appeals|length == 1 %}
+				<p>
+					{% trans %}You appealed this ban on{% endtrans %} 
+					<strong>{{ denied_appeals[0]|date(config.ban_date) }}</strong> 
+					{% trans %}and it was denied. You may not appeal this ban again.{% endtrans %}
+				</p>
+			{% else %}
+				<p>{% trans %}You have submitted the maximum number of ban appeals allowed. You may not appeal this ban again.{% endtrans %}</p>
+			{% endif %}
+		{% else %}
+			{% if denied_appeals|length %}
+				{% if denied_appeals|length == 1 %}
+					<p>
+						{% trans %}You appealed this ban on{% endtrans %} 
+						<strong>{{ denied_appeals[0]|date(config.ban_date) }}</strong> 
+						{% trans %}and it was denied.{% endtrans %}
+					</p>
+					<p>{% trans %}You may appeal this ban again. Please enter your reasoning below.{% endtrans %}</p>
+				{% else %}
+					<p>
+						{% trans %}You last appealed this ban on{% endtrans %} 
+						<strong>{{ denied_appeals[denied_appeals|length - 1]|date(config.ban_date) }}</strong> 
+						{% trans %}and it was denied.{% endtrans %}
+					</p>
+					<p>{% trans %}You may appeal this ban again. Please enter your reasoning below.{% endtrans %}</p>
+				{% endif %}
+			{% else %}
+				<p>{% trans %}You may appeal this ban. Please enter your reasoning below.{% endtrans %}</p>
+			{% endif %}
+			<form class="ban-appeal" action="" method="post">
+				<input type="hidden" name="ban_id" value="{{ ban.id }}">
+				<textarea name="appeal" rows="4" cols="40"></textarea>
+				<input type="submit" value="Submit">
+			</form>
+		{% endif %}
 	{% endif %}
 </div>
-{% endfilter %}
-
+{% endfilter %}
\ No newline at end of file
diff --git a/templates/mod/ban_appeals.html b/templates/mod/ban_appeals.html
new file mode 100644
index 00000000..23eced12
--- /dev/null
+++ b/templates/mod/ban_appeals.html
@@ -0,0 +1,107 @@
+{% for ban in ban_appeals %}
+
+<form action="" method="post" style="margin: 10px 0">
+	<input type="hidden" name="token" value="{{ token }}">
+	<table style="margin: 5px 0">
+		<tr>
+			<th>{% trans 'Status' %}</th>
+			<td>
+				{% if config.mod.view_banexpired and ban.expires != 0 and ban.expires < time() %}
+					{% trans 'Expired' %}
+				{% else %}
+					{% trans 'Active' %}
+				{% endif %}
+			</td>
+		</tr>
+		{% if mod|hasPermission(config.mod.show_ip, board.uri) %}
+			<tr>
+				<th>{% trans 'IP' %}</th>
+				<td>{{ ban.mask }}</td>
+			</tr>
+		{% endif %}
+		<tr>
+			<th>{% trans 'Reason' %}</th>
+			<td>
+				{% if ban.reason %}
+					{{ ban.reason }}
+				{% else %}
+					<em>{% trans 'no reason' %}</em>
+				{% endif %}
+			</td>
+		</tr>
+		<tr>
+			<th>{% trans 'Board' %}</th>
+			<td>
+				{% if ban.board %}
+					{{ config.board_abbreviation|sprintf(ban.board) }}
+				{% else %}
+					<em>{% trans 'all boards' %}</em>
+				{% endif %}
+			</td>
+		</tr>
+		<tr>
+			<th>{% trans 'Set' %}</th>
+			<td>{{ ban.created|date(config.post_date) }}</td>
+		</tr>
+		<tr>
+			<th>{% trans 'Expires' %}</th>
+			<td>
+				{% if ban.expires %}
+					{{ ban.expires|date(config.post_date) }}
+				{% else %}
+					<em>{% trans 'never' %}</em>
+				{% endif %}
+			</td>
+		</tr>
+		<tr>
+			<th>{% trans 'Seen' %}</th>
+			<td>
+				{%  if ban.seen %}
+					{% trans 'Yes' %}
+				{%  else %}
+					{% trans 'No' %}
+				{%  endif %}
+			</td>
+		</tr>
+		<tr>
+			<th>{% trans 'Staff' %}</th>
+			<td>
+				{% if ban.username %}
+					{{ ban.username|e }}
+				{% else %}
+					<em>{% trans 'deleted?' %}</em>
+				{% endif %}
+			</td>
+		</tr>
+	</table>
+
+	<table style="margin: 10px 0">
+		<tr>
+			<th>{% trans 'Appeal time' %}</th>
+			<td>{{ ban.time|date(config.post_date) }}</td>
+		</tr>
+		<tr>
+			<th>{% trans 'Appeal reason' %}</th>
+			<td>{{ ban.message|e }}</td>
+		</tr>
+		{% if mod|hasPermission(config.mod.ban_appeals, board.uri) %}
+			<tr>
+				<th>{% trans 'Action' %}</th>
+				<td>
+					<input type="hidden" name="appeal_id" value="{{ ban.id }}">
+					<input type="submit" name="unban" value="Unban"> 
+					<input type="submit" name="deny" value="Deny appeal">
+				</td>
+			</tr>
+		{% endif %}
+	</table>
+	
+	{% if ban.post %}
+		<div style="">
+			{{ ban.post.build(true) }}
+		</div>
+	{% endif %}
+</form>
+<hr>
+
+{% endfor %}
\ No newline at end of file
diff --git a/templates/mod/ban_list.html b/templates/mod/ban_list.html
index b41cef28..97c02029 100644
--- a/templates/mod/ban_list.html
+++ b/templates/mod/ban_list.html
@@ -1,7 +1,8 @@
 {% if bans|count == 0 %}
 	<p style="text-align:center" class="unimportant">({% trans 'There are no active bans.' %})</p>
 {% else %}
-	<form action="" method="post">
+	<form action="?/bans" method="post">
+		<input type="hidden" name="token" value="{{ token }}">
 		<table class="mod" style="width:100%">
 			<tr>
 				<th>{% trans 'IP address/mask' %}</th>
diff --git a/templates/mod/board.html b/templates/mod/board.html
index 0775e421..4da597a7 100644
--- a/templates/mod/board.html
+++ b/templates/mod/board.html
@@ -5,6 +5,7 @@
 {% endif %}
 
 <form action="{{ action }}" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	<table>
 		<tr>
 			<th>{% trans 'URI' %}</th>
diff --git a/templates/mod/config-editor-php.html b/templates/mod/config-editor-php.html
index 4f76b5dd..0c1a3a09 100644
--- a/templates/mod/config-editor-php.html
+++ b/templates/mod/config-editor-php.html
@@ -21,6 +21,7 @@
 	
 	
 	{% if not readonly %}<form method="post" action="">{% endif %}
+		<input type="hidden" name="token" value="{{ token }}">
 		<textarea name="code" id="code" style="margin:auto;width:100%;height:500px{% if readonly %};background:#eee" readonly{% else %}"{% endif %}>
 		{{ php }}
 		</textarea>
diff --git a/templates/mod/config-editor.html b/templates/mod/config-editor.html
index 4f4cba93..411d55e6 100644
--- a/templates/mod/config-editor.html
+++ b/templates/mod/config-editor.html
@@ -14,6 +14,7 @@
 	</ul>
 {% endif %}
 <form method="post" action="">
+	<input type="hidden" name="token" value="{{ token }}">
 	<table class="mod config-editor">
 		<tr>
 			<th class="minimal">{% trans 'Name' %}</th>
diff --git a/templates/mod/dashboard.html b/templates/mod/dashboard.html
index e2f7507d..7b907533 100644
--- a/templates/mod/dashboard.html
+++ b/templates/mod/dashboard.html
@@ -86,6 +86,9 @@
 		{% if mod|hasPermission(config.mod.view_banlist) %}
 			<li><a href="?/bans">{% trans 'Ban list' %}</a></li>
 		{% endif %}
+		{% if config.ban_appeals and mod|hasPermission(config.mod.view_ban_appeals) %}
+			<li><a href="?/ban-appeals">{% trans 'Ban appeals' %}</a></li>
+		{% endif %}
 		{% if mod|hasPermission(config.mod.manageusers) %}
 			<li><a href="?/users">{% trans 'Manage users' %}</a></li>
 		{% elseif mod|hasPermission(config.mod.change_password) %}
@@ -161,7 +164,7 @@
 	<legend>{% trans 'User account' %}</legend>
 	
 	<ul>
-		<li><a href="?/logout">{% trans 'Logout' %}</a></li>
+		<li><a href="?/logout/{{ logout_token }}">{% trans 'Logout' %}</a></li>
 	</ul>
 </fieldset>
 
diff --git a/templates/mod/debug/apc.html b/templates/mod/debug/apc.html
new file mode 100644
index 00000000..e8733af8
--- /dev/null
+++ b/templates/mod/debug/apc.html
@@ -0,0 +1,18 @@
+<table class="modlog">
+	<tr>
+		<th class="minimal">Key</th>
+		<th class="minimal">Hits</th>
+		<th class="minimal">Created</th>
+		<th class="minimal">Expires</th>
+		<th class="minimal">Size</th>
+	</tr>
+	{% for var in cached_vars if (var.ctime is defined ? var.ctime : var.creation_time) + var.ttl > time() %}
+		<tr>
+			<td class="minimal">{{ var.key is defined ? var.key : var.info }}</td>
+			<td class="minimal">{{ var.nhits is defined ? var.nhits : var.num_hits }}</td>
+			<td class="minimal">{{ (var.ctime is defined ? var.ctime : var.creation_time)|ago }} ago</td>
+			<td class="minimal">{{ ((var.ctime is defined ? var.ctime : var.creation_time) + var.ttl)|until }} (ttl: {{ (time() + var.ttl)|until }})</td>
+			<td class="minimal">{{ var.mem_size }} bytes</td>
+		</tr>
+	{% endfor %}
+</table>
\ No newline at end of file
diff --git a/templates/mod/new_pm.html b/templates/mod/new_pm.html
index 3fd78ac6..605b0973 100644
--- a/templates/mod/new_pm.html
+++ b/templates/mod/new_pm.html
@@ -1,4 +1,5 @@
 <form action="?/new_PM/{{ username|e }}" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	<table>
 		<tr>
 			<th>To</th>
diff --git a/templates/mod/news.html b/templates/mod/news.html
index b0335e0a..510d60ce 100644
--- a/templates/mod/news.html
+++ b/templates/mod/news.html
@@ -2,6 +2,7 @@
 	<fieldset>
 		<legend>{% trans 'New post' %}</legend>
 		<form style="margin:0" action="" method="post">
+			<input type="hidden" name="token" value="{{ token }}">
 			<table>
 				<tr>
 					<th>
@@ -39,7 +40,7 @@
 	<div class="ban">
 		{% if mod|hasPermission(config.mod.news_delete) %}
 			<span style="float:right;padding:2px">
-				<a class="unimportant" href="?/news/delete/{{ post.id }}">[{% trans 'delete' %}]</a>
+				<a class="unimportant" href="?/news/delete/{{ post.id }}/{{ post.delete_token }}">[{% trans 'delete' %}]</a>
 			</span>
 		{% endif %}
 		<h2 id="{{ post.id }}">
diff --git a/templates/mod/noticeboard.html b/templates/mod/noticeboard.html
index 463b8430..fc2e0aef 100644
--- a/templates/mod/noticeboard.html
+++ b/templates/mod/noticeboard.html
@@ -1,7 +1,8 @@
 {% if mod|hasPermission(config.mod.noticeboard_post) %}
 	<fieldset>
 		<legend>{% trans 'New post' %}</legend>
-		<form style="margin:0" action="" method="post">
+		<form style="margin:0" action="?/noticeboard" method="post">
+			<input type="hidden" name="token" value="{{ token }}">
 			<table>
 				<tr>
 					<th>{% trans 'Name' %}</th>
@@ -27,7 +28,7 @@
 	<div class="ban">
 		{% if mod|hasPermission(config.mod.noticeboard_delete) %}
 			<span style="float:right;padding:2px">
-				<a class="unimportant" href="?/noticeboard/delete/{{ post.id }}">[{% trans 'delete' %}]</a>
+				<a class="unimportant" href="?/noticeboard/delete/{{ post.id }}/{{ post.delete_token }}">[{% trans 'delete' %}]</a>
 			</span>
 		{% endif %}
 		<h2 id="{{ post.id }}">
diff --git a/templates/mod/rebuild.html b/templates/mod/rebuild.html
index 7c6b28ba..81d1ead3 100644
--- a/templates/mod/rebuild.html
+++ b/templates/mod/rebuild.html
@@ -1,4 +1,5 @@
 <form style="width:300px;margin:auto" action="?/rebuild" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	<ul id="rebuild">
 		<li style="margin-bottom:8px">
 			<input type="checkbox" name="rebuild_all" id="rebuild_all" onchange="toggleall(this.checked)"> 
diff --git a/templates/mod/report.html b/templates/mod/report.html
index 9c8463ed..b5392d5b 100644
--- a/templates/mod/report.html
+++ b/templates/mod/report.html
@@ -13,13 +13,13 @@
 	{% if mod|hasPermission(config.mod.report_dismiss, report.board) or mod|hasPermission(config.mod.report_dismiss_ip, report.board) %}
 		<hr>
 		{% if mod|hasPermission(config.mod.report_dismiss, report.board) %}
-			<a title="{% trans 'Discard abuse report' %}" href="?/reports/{{ report.id }}/dismiss">Dismiss</a>
+			<a title="{% trans 'Discard abuse report' %}" href="?/reports/{{ report.id }}/dismiss/{{ token }}">Dismiss</a>
 		{% endif %}
 		{% if mod|hasPermission(config.mod.report_dismiss_ip, report.board) %}
 			{% if mod|hasPermission(config.mod.report_dismiss, report.board) %}
 			 | 
 			{% endif %}
-			<a title="{% trans 'Discard all abuse reports by this IP address' %}" href="?/reports/{{ report.id }}/dismissall">Dismiss+</a>
+			<a title="{% trans 'Discard all abuse reports by this IP address' %}" href="?/reports/{{ report.id }}/dismissall/{{ token_all }}">Dismiss+</a>
 		{% endif %}
 	{% endif %}
 </div>
diff --git a/templates/mod/theme_config.html b/templates/mod/theme_config.html
index d85b5df1..d82a1f14 100644
--- a/templates/mod/theme_config.html
+++ b/templates/mod/theme_config.html
@@ -1,4 +1,5 @@
 <form action="" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	{% if not config %}
 		<p style="text-align:center" class="unimportant">(No configuration required.)</p>
 	{% else %}
diff --git a/templates/mod/themes.html b/templates/mod/themes.html
index b596826d..b230bc48 100644
--- a/templates/mod/themes.html
+++ b/templates/mod/themes.html
@@ -28,8 +28,8 @@
 							{% if theme_name in themes_in_use %}{% trans 'Reconfigure' %}{% else %}{% trans 'Install' %}{% endif %}
 						</a></li>
 						{% if theme_name in themes_in_use %}
-							<li><a href="?/themes/{{ theme_name }}/rebuild">{% trans 'Rebuild' %}</a></li>
-							<li><a href="?/themes/{{ theme_name }}/uninstall" onclick="return confirm('Are you sure you want to uninstall this theme?');">{% trans 'Uninstall' %}</a></li>
+							<li><a href="?/themes/{{ theme_name }}/rebuild/{{ theme.rebuild_token }}">{% trans 'Rebuild' %}</a></li>
+							<li><a href="?/themes/{{ theme_name }}/uninstall/{{ theme.uninstall_token }}" onclick="return confirm('Are you sure you want to uninstall this theme?');">{% trans 'Uninstall' %}</a></li>
 						{% endif %}
 					</ul></td>
 				</tr>
diff --git a/templates/mod/user.html b/templates/mod/user.html
index 89240824..08598fe5 100644
--- a/templates/mod/user.html
+++ b/templates/mod/user.html
@@ -5,6 +5,7 @@
 {% endif %}
 
 <form action="{{ action }}" method="post">
+	<input type="hidden" name="token" value="{{ token }}">
 	<table>
 		<tr>
 			<th>{% trans 'Username' %}</th>
diff --git a/templates/mod/users.html b/templates/mod/users.html
index b4c666e1..6f42ce2a 100644
--- a/templates/mod/users.html
+++ b/templates/mod/users.html
@@ -48,10 +48,10 @@
 			{% endif %}
 			<td>
 				{% if mod|hasPermission(config.mod.promoteusers) and user.type < constant(config.mod.groups[0:-1]|last) %}
-					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/promote" title="{% trans 'Promote' %}">&#9650;</a> 
+					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/promote/{{ user.promote_token }}" title="{% trans 'Promote' %}">&#9650;</a> 
 				{% endif %}
 				{% if mod|hasPermission(config.mod.promoteusers) and user.type > constant(config.mod.groups|first) %}
-					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/demote" title="{% trans 'Demote' %}"{% if mod.id == user.id %} onclick="return confirm('{% trans 'Are you sure you want to demote yourself?' %}')"{% endif %}>&#9660;</a> 
+					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/demote/{{ user.demote_token }}" title="{% trans 'Demote' %}"{% if mod.id == user.id %} onclick="return confirm('{% trans 'Are you sure you want to demote yourself?' %}')"{% endif %}>&#9660;</a> 
 				{% endif %}
 				{% if mod|hasPermission(config.mod.modlog) %}
 					<a class="unimportant" style="margin-left:5px;float:right" href="?/log:{{ user.username|e }}">[{% trans 'log' %}]</a> 
diff --git a/templates/mod/view_ip.html b/templates/mod/view_ip.html
index f73c5d5a..1c1c7fa6 100644
--- a/templates/mod/view_ip.html
+++ b/templates/mod/view_ip.html
@@ -57,6 +57,7 @@
 		
 		{% if mod|hasPermission(config.mod.create_notes) %}
 			<form action="" method="post" style="margin:0">
+				<input type="hidden" name="token" value="{{ security_token }}">
 				<table>
 					<tr>
 						<th>{% trans 'Staff' %}</th>
@@ -87,6 +88,7 @@
 		
 		{% for ban in bans %}
 			<form action="" method="post" style="text-align:center">
+				<input type="hidden" name="token" value="{{ security_token }}">
 				<table style="width:400px;margin-bottom:10px;border-bottom:1px solid #ddd;padding:5px">
 					<tr>
 						<th>{% trans 'Status' %}</th>