diff options
59 files changed, 7312 insertions, 3524 deletions
diff --git a/inc/anti-bot.php b/inc/anti-bot.php index 81afca1b..716e301c 100644 --- a/inc/anti-bot.php +++ b/inc/anti-bot.php @@ -19,7 +19,7 @@ class AntiBot { if ($uppercase) $chars .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'; if ($special_chars) - $chars .= ' ~!@#$%^&*()_+,./;\'[]\\{}|:"<>?=-` '; + $chars .= ' ~!@#$%^&*()_+,./;\'[]\\{}|:<>?=-` '; $chars = str_split($chars); @@ -48,8 +48,9 @@ class AntiBot { foreach ($chars as &$c) { if (rand(0, 2) != 0) - continue; - $c = mb_encode_numericentity($c, array(0, 0xffff, 0, 0xffff), 'UTF-8'); + $c = utf8tohtml($c); + else + $c = mb_encode_numericentity($c, array(0, 0xffff, 0, 0xffff), 'UTF-8'); } return implode('', $chars); diff --git a/inc/cache.php b/inc/cache.php index 19e6b356..0bb73589 100644 --- a/inc/cache.php +++ b/inc/cache.php @@ -48,7 +48,7 @@ class Cache { } // debug - if ($data && $config['debug']) { + if ($data !== false && $config['debug']) { $debug['cached'][] = $key; } diff --git a/inc/config.php b/inc/config.php index 866fefae..cd5896fc 100644 --- a/inc/config.php +++ b/inc/config.php @@ -38,7 +38,6 @@ $config['check_updates_time'] = 43200; // 12 hours // Shows some extra information at the bottom of pages. Good for debugging development. - // Also experimental. $config['debug'] = false; // For development purposes. Turns 'display_errors' on. Not recommended for production. $config['verbose_errors'] = true; @@ -362,7 +361,7 @@ $config['markup'][] = array("/'''(.+?)'''/", "<strong>\$1</strong>"); $config['markup'][] = array("/''(.+?)''/", "<em>\$1</em>"); $config['markup'][] = array("/\*\*(.+?)\*\*/", "<span class=\"spoiler\">\$1</span>"); - $config['markup'][] = array("/^\s*==(.+?)==\s*$/m", "<span class=\"heading\">\$1</span>"); + $config['markup'][] = array("/^[ |\t]*==(.+?)==[ |\t]*$/m", "<span class=\"heading\">\$1</span>"); // Highlight PHP code wrapped in <code> tags (PHP 5.3.0+) // $config['markup'][] = array( @@ -816,8 +815,6 @@ // Do a DNS lookup on IP addresses to get their hostname on the IP summary page $config['mod']['dns_lookup'] = true; - // Show ban form on the IP summary page - $config['mod']['ip_banform'] = true; // How many recent posts, per board, to show in the IP summary page $config['mod']['ip_recentposts'] = 5; @@ -826,12 +823,17 @@ // How many actions to show per page in the moderation log $config['mod']['modlog_page'] = 350; + // How many bans to show per page in the ban list + $config['mod']['banlist_page'] = 350; + + // Number of news entries to display per page + $config['mod']['news_page'] = 40; // Maximum number of results to display for a search, per board $config['mod']['search_results'] = 75; - // Maximum number of notices to display on the moderator noticeboard - $config['mod']['noticeboard_display'] = 50; + // How many entries to show per page in the moderator noticeboard + $config['mod']['noticeboard_page'] = 50; // Number of entries to summarize and display on the dashboard $config['mod']['noticeboard_dashboard'] = 5; @@ -867,7 +869,20 @@ * Mod permissions * ==================== */ - + + // Capcode permissions + $config['mod']['capcode'] = array( + // JANITOR => array('Janitor'), + MOD => array('Mod'), + ADMIN => true + ); + + // Example: Allow mods to post with "## Moderator" as well + // $config['mod']['capcode'][MOD][] = 'Moderator'; + + // Example: Allow janitors to post with any capcode + // $config['mod']['capcode'][JANITOR] = true; + // Set any of the below to "DISABLED" to make them unavailable for everyone. // Don't worry about per-board moderators. Let all mods moderate any board. @@ -1043,6 +1058,4 @@ // Complex regular expression to catch URLs $config['url_regex'] = '/' . '(https?|ftp):\/\/' . '(([\w\-]+\.)+[a-zA-Z]{2,6}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' . '(:\d+)?' . '(\/([\w\-~.#\/?=&;:+%!*\[\]@$\'()+,|\^]+)?)?' . '/'; - // INSANE regular expression for IPv6 addresses - $config['ipv6_regex'] = '((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?'; diff --git a/inc/filters.php b/inc/filters.php index 7204614a..ab48598f 100644 --- a/inc/filters.php +++ b/inc/filters.php @@ -28,7 +28,7 @@ class Filter { case 'name': return preg_match($match, $post['name']); case 'trip': - return preg_match($match, $post['trip']); + return $match === $post['trip']; case 'email': return preg_match($match, $post['email']); case 'subject': diff --git a/inc/functions.php b/inc/functions.php index bd255b35..eedbf9b9 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -32,7 +32,30 @@ function loadConfig() { if (!isset($_SERVER['REMOTE_ADDR'])) $_SERVER['REMOTE_ADDR'] = '0.0.0.0'; - $arrays = array('db', 'cache', 'cookies', 'error', 'dir', 'mod', 'spam', 'flood_filters', 'wordfilters', 'custom_capcode', 'custom_tripcode', 'dnsbl', 'dnsbl_exceptions', 'remote', 'allowed_ext', 'allowed_ext_files', 'file_icons', 'footer', 'stylesheets', 'additional_javascript', 'markup'); + $arrays = array( + 'db', + 'cache', + 'cookies', + 'error', + 'dir', + 'mod', + 'spam', + 'flood_filters', + 'wordfilters', + 'custom_capcode', + 'custom_tripcode', + 'dnsbl', + 'dnsbl_exceptions', + 'remote', + 'allowed_ext', + 'allowed_ext_files', + 'file_icons', + 'footer', + 'stylesheets', + 'additional_javascript', + 'markup', + 'custom_pages' + ); $config = array(); foreach ($arrays as $key) { @@ -277,10 +300,13 @@ function setupBoard($array) { $board = array( 'uri' => $array['uri'], - 'name' => $array['title'], - 'title' => $array['subtitle'] + 'title' => $array['title'], + 'subtitle' => $array['subtitle'] ); + // older versions + $board['name'] = &$board['title']; + $board['dir'] = sprintf($config['board_path'], $board['uri']); $board['url'] = sprintf($config['board_abbreviation'], $board['uri']); @@ -690,13 +716,13 @@ function post(array $post) { $query->bindValue(':password', $post['password']); $query->bindValue(':ip', isset($post['ip']) ? $post['ip'] : $_SERVER['REMOTE_ADDR']); - if ($post['mod'] && $post['sticky']) { + if ($post['op'] && $post['mod'] && $post['sticky']) { $query->bindValue(':sticky', 1, PDO::PARAM_INT); } else { $query->bindValue(':sticky', 0, PDO::PARAM_INT); } - if ($post['mod'] && $post['locked']) { + if ($post['op'] && $post['mod'] && $post['locked']) { $query->bindValue(':locked', 1, PDO::PARAM_INT); } else { $query->bindValue(':locked', 0, PDO::PARAM_INT); @@ -777,12 +803,8 @@ function deleteFile($id, $remove_entirely_if_already=true) { $query = prepare(sprintf("SELECT `thread`,`thumb`,`file` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri'])); $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - - if ($query->rowCount() < 1) { + if (!$post = $query->fetch()) error($config['error']['invalidpost']); - } - - $post = $query->fetch(); if ($post['file'] == 'deleted' && !$post['thread']) return; // Can't delete OP's image completely. @@ -801,13 +823,14 @@ function deleteFile($id, $remove_entirely_if_already=true) { // Set file to 'deleted' $query->bindValue(':file', 'deleted', PDO::PARAM_INT); } - // Update database $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); if ($post['thread']) buildThread($post['thread']); + else + buildThread($id); } // rebuild post (markup) @@ -1179,6 +1202,7 @@ function buildIndex() { global $board, $config; $pages = getPages(); + $antibot = create_antibot($board['uri']); $page = 1; while ($page <= $config['max_pages'] && $content = index($page)) { @@ -1188,7 +1212,7 @@ function buildIndex() { $content['pages'] = $pages; $content['pages'][$page-1]['selected'] = true; $content['btn'] = getPageButtons($content['pages']); - $content['antibot'] = create_antibot($board['uri']); + $content['antibot'] = $antibot; file_write($filename, Element('index.html', $content)); if (isset($md5) && $md5 == md5_file($filename)) { @@ -1370,8 +1394,10 @@ function markup(&$body, $track_cites = false) { if ($config['auto_unicode']) { $body = unicodify($body); - foreach ($markup_urls as &$url) { - $body = str_replace(unicodify($url), $url, $body); + if ($config['markup_urls']) { + foreach ($markup_urls as &$url) { + $body = str_replace(unicodify($url), $url, $body); + } } } diff --git a/inc/lib/Twig/Extensions/Extension/Tinyboard.php b/inc/lib/Twig/Extensions/Extension/Tinyboard.php index b515e8d2..0a128e7b 100644 --- a/inc/lib/Twig/Extensions/Extension/Tinyboard.php +++ b/inc/lib/Twig/Extensions/Extension/Tinyboard.php @@ -10,19 +10,22 @@ class Twig_Extensions_Extension_Tinyboard extends Twig_Extension public function getFilters() { return Array( - 'filesize' => new Twig_Filter_Function('format_bytes', Array('needs_environment' => false)), - 'truncate' => new Twig_Filter_Function('twig_truncate_filter', array('needs_environment' => false)), - 'truncate_body' => new Twig_Filter_Function('truncate', array('needs_environment' => false)), - 'extension' => new Twig_Filter_Function('twig_extension_filter', array('needs_environment' => false)), - 'sprintf' => new Twig_Filter_Function('sprintf', array('needs_environment' => false)), - 'capcode' => new Twig_Filter_Function('capcode', array('needs_environment' => false)), - 'hasPermission' => new Twig_Filter_Function('twig_hasPermission_filter', array('needs_environment' => false)), - 'date' => new Twig_Filter_Function('twig_date_filter', array('needs_environment' => false)), - 'poster_id' => new Twig_Filter_Function('poster_id', array('needs_environment' => false)), - 'remove_whitespace' => new Twig_Filter_Function('twig_remove_whitespace_filter', array('needs_environment' => false)), - 'count' => new Twig_Filter_Function('count', array('needs_environment' => false)), - 'until' => new Twig_Filter_Function('until', array('needs_environment' => false)), - 'addslashes' => new Twig_Filter_Function('addslashes', array('needs_environment' => false)), + 'filesize' => new Twig_Filter_Function('format_bytes'), + 'truncate' => new Twig_Filter_Function('twig_truncate_filter'), + 'truncate_body' => new Twig_Filter_Function('truncate'), + 'extension' => new Twig_Filter_Function('twig_extension_filter'), + 'sprintf' => new Twig_Filter_Function('sprintf'), + 'capcode' => new Twig_Filter_Function('capcode'), + 'hasPermission' => new Twig_Filter_Function('twig_hasPermission_filter'), + 'date' => new Twig_Filter_Function('twig_date_filter'), + 'poster_id' => new Twig_Filter_Function('poster_id'), + 'remove_whitespace' => new Twig_Filter_Function('twig_remove_whitespace_filter'), + 'count' => new Twig_Filter_Function('count'), + 'ago' => new Twig_Filter_Function('ago'), + 'until' => new Twig_Filter_Function('until'), + 'split' => new Twig_Filter_Function('twig_split_filter'), + 'push' => new Twig_Filter_Function('twig_push_filter'), + 'addslashes' => new Twig_Filter_Function('addslashes') ); } @@ -34,10 +37,11 @@ class Twig_Extensions_Extension_Tinyboard extends Twig_Extension public function getFunctions() { return Array( - 'time' => new Twig_Filter_Function('time', array('needs_environment' => false)), - 'timezone' => new Twig_Filter_Function('twig_timezone_function', array('needs_environment' => false)), - 'hiddenInputs' => new Twig_Filter_Function('hiddenInputs', array('needs_environment' => false)), - 'hiddenInputsHash' => new Twig_Filter_Function('hiddenInputsHash', array('needs_environment' => false)) + 'time' => new Twig_Filter_Function('time'), + 'floor' => new Twig_Filter_Function('floor'), + 'timezone' => new Twig_Filter_Function('twig_timezone_function'), + 'hiddenInputs' => new Twig_Filter_Function('hiddenInputs'), + 'hiddenInputsHash' => new Twig_Filter_Function('hiddenInputsHash'), ); } @@ -57,6 +61,15 @@ function twig_timezone_function() { return sprintf("%s%02d", ($hr = (int)floor(($tz = date('Z')) / 3600)) > 0 ? '+' : '-', abs($hr)) . ':' . sprintf("%02d", (($tz / 3600) - $hr) * 60); } +function twig_split_filter($str, $delim) { + return explode($delim, $str); +} + +function twig_push_filter($array, $value) { + array_push($array, $value); + return $array; +} + function twig_remove_whitespace_filter($data) { return preg_replace('/[\t\r\n]/', '', $data); } @@ -65,7 +78,7 @@ function twig_date_filter($date, $format) { return strftime($format, $date); } -function twig_hasPermission_filter($mod, $permission, $board) { +function twig_hasPermission_filter($mod, $permission, $board = null) { return hasPermission($permission, $board, $mod); } diff --git a/inc/mod-old.php b/inc/mod-old.php new file mode 100644 index 00000000..9065bb82 --- /dev/null +++ b/inc/mod-old.php @@ -0,0 +1,287 @@ +<?php + +/* + * Copyright (c) 2010-2012 Tinyboard Development Group + */ + +if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) { + // You cannot request this file directly. + exit; +} + +// create a hash/salt pair for validate logins +function mkhash($username, $password, $salt = false) { + global $config; + + if (!$salt) { + // create some sort of salt for the hash + $salt = substr(base64_encode(sha1(rand() . time(), true) . $config['cookies']['salt']), 0, 15); + + $generated_salt = true; + } + + // generate hash (method is not important as long as it's strong) + $hash = substr(base64_encode(md5($username . sha1($username . $password . $salt . ($config['mod']['lock_ip'] ? $_SERVER['REMOTE_ADDR'] : ''), true), true)), 0, 20); + + if (isset($generated_salt)) + return Array($hash, $salt); + else + return $hash; +} + +function login($username, $password, $makehash=true) { + global $mod; + + // SHA1 password + if ($makehash) { + $password = sha1($password); + } + + $query = prepare("SELECT `id`,`type`,`boards` FROM `mods` WHERE `username` = :username AND `password` = :password LIMIT 1"); + $query->bindValue(':username', $username); + $query->bindValue(':password', $password); + $query->execute() or error(db_error($query)); + + if ($user = $query->fetch()) { + return $mod = Array( + 'id' => $user['id'], + 'type' => $user['type'], + 'username' => $username, + 'hash' => mkhash($username, $password), + 'boards' => explode(',', $user['boards']) + ); + } else return false; +} + +function setCookies() { + global $mod, $config; + if (!$mod) + error('setCookies() was called for a non-moderator!'); + + setcookie($config['cookies']['mod'], + $mod['username'] . // username + ':' . + $mod['hash'][0] . // password + ':' . + $mod['hash'][1], // salt + time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true); +} + +function destroyCookies() { + global $config; + // Delete the cookies + setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, false, true); +} + +function create_pm_header() { + global $mod; + $query = prepare("SELECT `id` FROM `pms` WHERE `to` = :id AND `unread` = 1"); + $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if ($pm = $query->fetch()) { + return Array('id' => $pm['id'], 'waiting' => $query->rowCount() - 1); + } + + return false; +} + +function modLog($action, $_board=null) { + global $mod, $board, $config; + $query = prepare("INSERT INTO `modlogs` VALUES (:id, :ip, :board, :time, :text)"); + $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); + $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); + $query->bindValue(':time', time(), PDO::PARAM_INT); + $query->bindValue(':text', $action); + if (isset($_board)) + $query->bindValue(':board', $_board); + elseif (isset($board)) + $query->bindValue(':board', $board['uri']); + else + $query->bindValue(':board', null, PDO::PARAM_NULL); + $query->execute() or error(db_error($query)); + + if ($config['syslog']) + _syslog(LOG_INFO, '[mod/' . $mod['username'] . ']: ' . $action); +} + +// Generates a <ul> element with a list of linked +// boards and their subtitles. (without the <ul> opening and ending tags) +function ulBoards() { + global $mod, $config; + + $body = ''; + + // List of boards + $boards = listBoards(); + + foreach ($boards as &$b) { + $body .= '<li>' . + '<a href="?/' . + sprintf($config['board_path'], $b['uri']) . $config['file_index'] . + '">' . + sprintf($config['board_abbreviation'], $b['uri']) . + '</a> - ' . + $b['title'] . + (isset($b['subtitle']) ? '<span class="unimportant"> — ' . $b['subtitle'] . '</span>' : '') . + ($mod['type'] >= $config['mod']['manageboards'] ? + ' <a href="?/' . $b['uri'] . '/edit" class="unimportant">[manage]</a>' : '') . + '</li>'; + } + + if ($mod['type'] >= $config['mod']['newboard']) { + $body .= '<li style="margin-top:15px;"><a href="?/new"><strong>' . _('Create new board') . '</strong></a></li>'; + } + return $body; +} + +function form_newBan($ip=null, $reason='', $continue=false, $delete=false, $board=false, $allow_public = false) { + global $config, $mod; + + $boards = listBoards(); + $__boards = '<li><input type="radio" checked="checked" name="board" id="board_*" value=""/> <label style="display:inline" for="board_*"><em>' . _('all boards') . '</em></label></li>'; + foreach ($boards as &$_board) { + $__boards .= '<li>' . + '<input type="radio" name="board" id="board_' . $_board['uri'] . '" value="' . $_board['uri'] . '">' . + '<label style="display:inline" for="board_' . $_board['uri'] . '"> ' . + ($_board['uri'] == '*' ? + '<em>"*"</em>' + : + sprintf($config['board_abbreviation'], $_board['uri']) + ) . + ' - ' . $_board['title'] . + '</label>' . + '</li>'; + } + + return '<fieldset><legend>New ban</legend>' . + '<form action="?/ban" method="post">' . + ($continue ? '<input type="hidden" name="continue" value="' . htmlentities($continue) . '" />' : '') . + ($delete || $allow_public ? '<input type="hidden" name="' . (!$allow_public ? 'delete' : 'post') . '" value="' . htmlentities($delete) . '" />' : '') . + ($board ? '<input type="hidden" name="board" value="' . htmlentities($board) . '" />' : '') . + '<table>' . + '<tr>' . + '<th><label for="ip">IP ' . + ($config['ban_cidr'] ? '<span class="unimportant">(or subnet)' : '') . + '</span></label></th>' . + '<td><input type="text" name="ip" id="ip" size="30" maxlength="30" ' . + (isset($ip) ? + 'value="' . htmlentities($ip) . '" ' : '' + ) . + '/></td>' . + '</tr>' . + '<tr>' . + '<th><label for="reason">Reason</label></th>' . + '<td><textarea name="reason" id="reason" rows="5" cols="30">' . + htmlentities($reason) . + '</textarea></td>' . + '</tr>' . + ($mod['type'] >= $config['mod']['public_ban'] && $allow_public ? + '<tr>' . + '<th><label for="message">Message</label></th>' . + '<td><input type="checkbox" id="public_message" name="public_message"/>' . + ' <input type="text" name="message" id="message" size="35" maxlength="200" value="' . htmlentities($config['mod']['default_ban_message']) . '" />' . + ' <span class="unimportant">(public; attached to post)</span></td>' . + '<script type="text/javascript">' . + 'document.getElementById(\'message\').disabled = true;' . + 'document.getElementById(\'public_message\').onchange = function() {' . + 'document.getElementById(\'message\').disabled = !this.checked;' . + '}' . + + '</script>' . + '</tr>' + : '') . + '<tr>' . + '<th><label for="length">Length</label></th>' . + '<td><input type="text" name="length" id="length" size="20" maxlength="40" />' . + ' <span class="unimportant">(eg. "2d1h30m" or "2 days")</span></td>' . + '</tr>' . + + '<tr>' . + '<th>Board</th>' . + '<td><ul style="list-style:none;padding:2px 5px">' . $__boards . '</tl></td>' . + '</tr>' . + + '<tr>' . + '<td></td>' . + '<td><input name="new_ban" type="submit" value="New Ban" /></td>' . + '</tr>' . + '</table>' . + '</form>' . + '</fieldset>'; +} + +function form_newBoard() { + return '<fieldset><legend>New board</legend>' . + '<form action="?/new" method="post">' . + '<table>' . + '<tr>' . + '<th><label for="board">URI</label></th>' . + '<td><input type="text" name="uri" id="board" size="10" />' . + ' <span class="unimportant">(eg. "b"; "mu")</span></td>' . + '</tr>' . + '<tr>' . + '<th><label for="title">Title</label></th>' . + '<td><input type="text" name="title" id="title" size="25" />' . + ' <span class="unimportant">(eg. "Random")</span></td>' . + '</tr>' . + '<tr>' . + '<th><label for="subtitle">Subtitle</label></th>' . + '<td><input type="text" name="subtitle" id="subtitle" size="25" />' . + ' <span class="unimportant">(optional)</span></td>' . + '</tr>' . + '<tr>' . + '<td></td>' . + '<td><input name="new_board" type="submit" value="New Board" /></td>' . + '</tr>' . + '</table>' . + '</form>' . + '</fieldset>'; +} + + +function removeBan($id) { + global $config, $memcached; + + $query = prepare("DELETE FROM `bans` WHERE `id` = :id"); + $query->bindValue(':id', $id, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + //if ($config['memcached']['enabled']) { + // Remove cached ban + // TODO + // $memcached->delete("ban_{$id}"); + //} +} + + +// Validate session + +if (isset($_COOKIE[$config['cookies']['mod']])) { + // Should be username:hash:salt + $cookie = explode(':', $_COOKIE[$config['cookies']['mod']]); + if (count($cookie) != 3) { + destroyCookies(); + error($config['error']['malformed']); + } + + $query = prepare("SELECT `id`, `type`, `boards`, `password` FROM `mods` WHERE `username` = :username LIMIT 1"); + $query->bindValue(':username', $cookie[0]); + $query->execute() or error(db_error($query)); + $user = $query->fetch(); + + // validate password hash + if ($cookie[1] != mkhash($cookie[0], $user['password'], $cookie[2])) { + // Malformed cookies + destroyCookies(); + error($config['error']['malformed']); + } + + $mod = Array( + 'id' => $user['id'], + 'type' => $user['type'], + 'username' => $cookie[0], + 'boards' => explode(',', $user['boards']) + ); +} + diff --git a/inc/mod.php b/inc/mod.php index 9065bb82..7b95d05d 100644 --- a/inc/mod.php +++ b/inc/mod.php @@ -4,284 +4,12 @@ * Copyright (c) 2010-2012 Tinyboard Development Group */ +// WARNING: Including this file is DEPRECIATED. It's only here to support older versions and won't exist forever. + if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) { // You cannot request this file directly. exit; } -// create a hash/salt pair for validate logins -function mkhash($username, $password, $salt = false) { - global $config; - - if (!$salt) { - // create some sort of salt for the hash - $salt = substr(base64_encode(sha1(rand() . time(), true) . $config['cookies']['salt']), 0, 15); - - $generated_salt = true; - } - - // generate hash (method is not important as long as it's strong) - $hash = substr(base64_encode(md5($username . sha1($username . $password . $salt . ($config['mod']['lock_ip'] ? $_SERVER['REMOTE_ADDR'] : ''), true), true)), 0, 20); - - if (isset($generated_salt)) - return Array($hash, $salt); - else - return $hash; -} - -function login($username, $password, $makehash=true) { - global $mod; - - // SHA1 password - if ($makehash) { - $password = sha1($password); - } - - $query = prepare("SELECT `id`,`type`,`boards` FROM `mods` WHERE `username` = :username AND `password` = :password LIMIT 1"); - $query->bindValue(':username', $username); - $query->bindValue(':password', $password); - $query->execute() or error(db_error($query)); - - if ($user = $query->fetch()) { - return $mod = Array( - 'id' => $user['id'], - 'type' => $user['type'], - 'username' => $username, - 'hash' => mkhash($username, $password), - 'boards' => explode(',', $user['boards']) - ); - } else return false; -} - -function setCookies() { - global $mod, $config; - if (!$mod) - error('setCookies() was called for a non-moderator!'); - - setcookie($config['cookies']['mod'], - $mod['username'] . // username - ':' . - $mod['hash'][0] . // password - ':' . - $mod['hash'][1], // salt - time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true); -} - -function destroyCookies() { - global $config; - // Delete the cookies - setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, false, true); -} - -function create_pm_header() { - global $mod; - $query = prepare("SELECT `id` FROM `pms` WHERE `to` = :id AND `unread` = 1"); - $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if ($pm = $query->fetch()) { - return Array('id' => $pm['id'], 'waiting' => $query->rowCount() - 1); - } - - return false; -} - -function modLog($action, $_board=null) { - global $mod, $board, $config; - $query = prepare("INSERT INTO `modlogs` VALUES (:id, :ip, :board, :time, :text)"); - $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); - $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); - $query->bindValue(':time', time(), PDO::PARAM_INT); - $query->bindValue(':text', $action); - if (isset($_board)) - $query->bindValue(':board', $_board); - elseif (isset($board)) - $query->bindValue(':board', $board['uri']); - else - $query->bindValue(':board', null, PDO::PARAM_NULL); - $query->execute() or error(db_error($query)); - - if ($config['syslog']) - _syslog(LOG_INFO, '[mod/' . $mod['username'] . ']: ' . $action); -} - -// Generates a <ul> element with a list of linked -// boards and their subtitles. (without the <ul> opening and ending tags) -function ulBoards() { - global $mod, $config; - - $body = ''; - - // List of boards - $boards = listBoards(); - - foreach ($boards as &$b) { - $body .= '<li>' . - '<a href="?/' . - sprintf($config['board_path'], $b['uri']) . $config['file_index'] . - '">' . - sprintf($config['board_abbreviation'], $b['uri']) . - '</a> - ' . - $b['title'] . - (isset($b['subtitle']) ? '<span class="unimportant"> — ' . $b['subtitle'] . '</span>' : '') . - ($mod['type'] >= $config['mod']['manageboards'] ? - ' <a href="?/' . $b['uri'] . '/edit" class="unimportant">[manage]</a>' : '') . - '</li>'; - } - - if ($mod['type'] >= $config['mod']['newboard']) { - $body .= '<li style="margin-top:15px;"><a href="?/new"><strong>' . _('Create new board') . '</strong></a></li>'; - } - return $body; -} - -function form_newBan($ip=null, $reason='', $continue=false, $delete=false, $board=false, $allow_public = false) { - global $config, $mod; - - $boards = listBoards(); - $__boards = '<li><input type="radio" checked="checked" name="board" id="board_*" value=""/> <label style="display:inline" for="board_*"><em>' . _('all boards') . '</em></label></li>'; - foreach ($boards as &$_board) { - $__boards .= '<li>' . - '<input type="radio" name="board" id="board_' . $_board['uri'] . '" value="' . $_board['uri'] . '">' . - '<label style="display:inline" for="board_' . $_board['uri'] . '"> ' . - ($_board['uri'] == '*' ? - '<em>"*"</em>' - : - sprintf($config['board_abbreviation'], $_board['uri']) - ) . - ' - ' . $_board['title'] . - '</label>' . - '</li>'; - } - - return '<fieldset><legend>New ban</legend>' . - '<form action="?/ban" method="post">' . - ($continue ? '<input type="hidden" name="continue" value="' . htmlentities($continue) . '" />' : '') . - ($delete || $allow_public ? '<input type="hidden" name="' . (!$allow_public ? 'delete' : 'post') . '" value="' . htmlentities($delete) . '" />' : '') . - ($board ? '<input type="hidden" name="board" value="' . htmlentities($board) . '" />' : '') . - '<table>' . - '<tr>' . - '<th><label for="ip">IP ' . - ($config['ban_cidr'] ? '<span class="unimportant">(or subnet)' : '') . - '</span></label></th>' . - '<td><input type="text" name="ip" id="ip" size="30" maxlength="30" ' . - (isset($ip) ? - 'value="' . htmlentities($ip) . '" ' : '' - ) . - '/></td>' . - '</tr>' . - '<tr>' . - '<th><label for="reason">Reason</label></th>' . - '<td><textarea name="reason" id="reason" rows="5" cols="30">' . - htmlentities($reason) . - '</textarea></td>' . - '</tr>' . - ($mod['type'] >= $config['mod']['public_ban'] && $allow_public ? - '<tr>' . - '<th><label for="message">Message</label></th>' . - '<td><input type="checkbox" id="public_message" name="public_message"/>' . - ' <input type="text" name="message" id="message" size="35" maxlength="200" value="' . htmlentities($config['mod']['default_ban_message']) . '" />' . - ' <span class="unimportant">(public; attached to post)</span></td>' . - '<script type="text/javascript">' . - 'document.getElementById(\'message\').disabled = true;' . - 'document.getElementById(\'public_message\').onchange = function() {' . - 'document.getElementById(\'message\').disabled = !this.checked;' . - '}' . - - '</script>' . - '</tr>' - : '') . - '<tr>' . - '<th><label for="length">Length</label></th>' . - '<td><input type="text" name="length" id="length" size="20" maxlength="40" />' . - ' <span class="unimportant">(eg. "2d1h30m" or "2 days")</span></td>' . - '</tr>' . - - '<tr>' . - '<th>Board</th>' . - '<td><ul style="list-style:none;padding:2px 5px">' . $__boards . '</tl></td>' . - '</tr>' . - - '<tr>' . - '<td></td>' . - '<td><input name="new_ban" type="submit" value="New Ban" /></td>' . - '</tr>' . - '</table>' . - '</form>' . - '</fieldset>'; -} - -function form_newBoard() { - return '<fieldset><legend>New board</legend>' . - '<form action="?/new" method="post">' . - '<table>' . - '<tr>' . - '<th><label for="board">URI</label></th>' . - '<td><input type="text" name="uri" id="board" size="10" />' . - ' <span class="unimportant">(eg. "b"; "mu")</span></td>' . - '</tr>' . - '<tr>' . - '<th><label for="title">Title</label></th>' . - '<td><input type="text" name="title" id="title" size="25" />' . - ' <span class="unimportant">(eg. "Random")</span></td>' . - '</tr>' . - '<tr>' . - '<th><label for="subtitle">Subtitle</label></th>' . - '<td><input type="text" name="subtitle" id="subtitle" size="25" />' . - ' <span class="unimportant">(optional)</span></td>' . - '</tr>' . - '<tr>' . - '<td></td>' . - '<td><input name="new_board" type="submit" value="New Board" /></td>' . - '</tr>' . - '</table>' . - '</form>' . - '</fieldset>'; -} - - -function removeBan($id) { - global $config, $memcached; - - $query = prepare("DELETE FROM `bans` WHERE `id` = :id"); - $query->bindValue(':id', $id, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - //if ($config['memcached']['enabled']) { - // Remove cached ban - // TODO - // $memcached->delete("ban_{$id}"); - //} -} - - -// Validate session - -if (isset($_COOKIE[$config['cookies']['mod']])) { - // Should be username:hash:salt - $cookie = explode(':', $_COOKIE[$config['cookies']['mod']]); - if (count($cookie) != 3) { - destroyCookies(); - error($config['error']['malformed']); - } - - $query = prepare("SELECT `id`, `type`, `boards`, `password` FROM `mods` WHERE `username` = :username LIMIT 1"); - $query->bindValue(':username', $cookie[0]); - $query->execute() or error(db_error($query)); - $user = $query->fetch(); - - // validate password hash - if ($cookie[1] != mkhash($cookie[0], $user['password'], $cookie[2])) { - // Malformed cookies - destroyCookies(); - error($config['error']['malformed']); - } - - $mod = Array( - 'id' => $user['id'], - 'type' => $user['type'], - 'username' => $cookie[0], - 'boards' => explode(',', $user['boards']) - ); -} +require 'inc/mod/auth.php'; diff --git a/inc/mod/auth.php b/inc/mod/auth.php new file mode 100644 index 00000000..d200c23f --- /dev/null +++ b/inc/mod/auth.php @@ -0,0 +1,152 @@ +<?php + +/* + * Copyright (c) 2010-2012 Tinyboard Development Group + */ + +if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) { + // You cannot request this file directly. + exit; +} + +// create a hash/salt pair for validate logins +function mkhash($username, $password, $salt = false) { + global $config; + + if (!$salt) { + // create some sort of salt for the hash + $salt = substr(base64_encode(sha1(rand() . time(), true) . $config['cookies']['salt']), 0, 15); + + $generated_salt = true; + } + + // generate hash (method is not important as long as it's strong) + $hash = substr(base64_encode(md5($username . sha1($username . $password . $salt . ($config['mod']['lock_ip'] ? $_SERVER['REMOTE_ADDR'] : ''), true), true)), 0, 20); + + if (isset($generated_salt)) + return Array($hash, $salt); + else + return $hash; +} + +function login($username, $password, $makehash=true) { + global $mod; + + // SHA1 password + if ($makehash) { + $password = sha1($password); + } + + $query = prepare("SELECT `id`,`type`,`boards` FROM `mods` WHERE `username` = :username AND `password` = :password LIMIT 1"); + $query->bindValue(':username', $username); + $query->bindValue(':password', $password); + $query->execute() or error(db_error($query)); + + if ($user = $query->fetch()) { + return $mod = Array( + 'id' => $user['id'], + 'type' => $user['type'], + 'username' => $username, + 'hash' => mkhash($username, $password), + 'boards' => explode(',', $user['boards']) + ); + } else return false; +} + +function setCookies() { + global $mod, $config; + if (!$mod) + error('setCookies() was called for a non-moderator!'); + + setcookie($config['cookies']['mod'], + $mod['username'] . // username + ':' . + $mod['hash'][0] . // password + ':' . + $mod['hash'][1], // salt + time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true); +} + +function destroyCookies() { + global $config; + // Delete the cookies + setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, false, true); +} + +function modLog($action, $_board=null) { + global $mod, $board, $config; + $query = prepare("INSERT INTO `modlogs` VALUES (:id, :ip, :board, :time, :text)"); + $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); + $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']); + $query->bindValue(':time', time(), PDO::PARAM_INT); + $query->bindValue(':text', $action); + if (isset($_board)) + $query->bindValue(':board', $_board); + elseif (isset($board)) + $query->bindValue(':board', $board['uri']); + else + $query->bindValue(':board', null, PDO::PARAM_NULL); + $query->execute() or error(db_error($query)); + + if ($config['syslog']) + _syslog(LOG_INFO, '[mod/' . $mod['username'] . ']: ' . $action); +} + +// Validate session + +if (isset($_COOKIE[$config['cookies']['mod']])) { + // Should be username:hash:salt + $cookie = explode(':', $_COOKIE[$config['cookies']['mod']]); + if (count($cookie) != 3) { + destroyCookies(); + error($config['error']['malformed']); + } + + $query = prepare("SELECT `id`, `type`, `boards`, `password` FROM `mods` WHERE `username` = :username LIMIT 1"); + $query->bindValue(':username', $cookie[0]); + $query->execute() or error(db_error($query)); + $user = $query->fetch(); + + // validate password hash + if ($cookie[1] != mkhash($cookie[0], $user['password'], $cookie[2])) { + // Malformed cookies + destroyCookies(); + error($config['error']['malformed']); + } + + $mod = Array( + 'id' => $user['id'], + 'type' => $user['type'], + 'username' => $cookie[0], + 'boards' => explode(',', $user['boards']) + ); +} + +function create_pm_header() { + global $mod, $config; + + if ($config['cache']['enabled'] && ($header = cache::get('pm_unread_' . $mod['id'])) !== false) { + if ($header === true) + return false; + + return $header; + } + + $query = prepare("SELECT `id` FROM `pms` WHERE `to` = :id AND `unread` = 1"); + $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if ($pm = $query->fetch()) + $header = Array('id' => $pm['id'], 'waiting' => $query->rowCount() - 1); + else + $header = true; + + if ($config['cache']['enabled']) + cache::set('pm_unread_' . $mod['id'], $header); + + if ($header === true) + return false; + + return $header; +} + diff --git a/inc/mod/ban.php b/inc/mod/ban.php new file mode 100644 index 00000000..51befe27 --- /dev/null +++ b/inc/mod/ban.php @@ -0,0 +1,95 @@ +<?php + +/* + * Copyright (c) 2010-2012 Tinyboard Development Group + */ + +if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) { + // You cannot request this file directly. + exit; +} + +function parse_time($str) { + if (empty($str)) + return false; + + if (($time = @strtotime($str)) !== false) + return $time; + + if (!preg_match('/^((\d+)\s?ye?a?r?s?)?\s?+((\d+)\s?mon?t?h?s?)?\s?+((\d+)\s?we?e?k?s?)?\s?+((\d+)\s?da?y?s?)?((\d+)\s?ho?u?r?s?)?\s?+((\d+)\s?mi?n?u?t?e?s?)?\s?+((\d+)\s?se?c?o?n?d?s?)?$/', $str, $matches)) + return false; + + $expire = 0; + + if (isset($matches[2])) { + // Years + $expire += $matches[2]*60*60*24*365; + } + if (isset($matches[4])) { + // Months + $expire += $matches[4]*60*60*24*30; + } + if (isset($matches[6])) { + // Weeks + $expire += $matches[6]*60*60*24*7; + } + if (isset($matches[8])) { + // Days + $expire += $matches[8]*60*60*24; + } + if (isset($matches[10])) { + // Hours + $expire += $matches[10]*60*60; + } + if (isset($matches[12])) { + // Minutes + $expire += $matches[12]*60; + } + if (isset($matches[14])) { + // Seconds + $expire += $matches[14]; + } + + return time() + $expire; +} + +function ban($mask, $reason, $length, $board) { + global $mod, $pdo; + + $query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :time, :expires, :reason, :board)"); + $query->bindValue(':ip', $mask); + $query->bindValue(':mod', $mod['id']); + $query->bindValue(':time', time()); + if ($reason !== '') { + markup($reason); + $query->bindValue(':reason', $reason); + } else + $query->bindValue(':reason', null, PDO::PARAM_NULL); + + if ($length > 0) + $query->bindValue(':expires', $length); + else + $query->bindValue(':expires', null, PDO::PARAM_NULL); + + if ($board) + $query->bindValue(':board', $board); + else + $query->bindValue(':board', null, PDO::PARAM_NULL); + + $query->execute() or error(db_error($query)); + + modLog('Created a new ' . + ($length > 0 ? preg_replace('/^(\d+) (\w+?)s?$/', '$1-$2', until($length)) : 'permanent') . + ' ban (<small>#' . $pdo->lastInsertId() . '</small>) for ' . + (filter_var($mask, FILTER_VALIDATE_IP) !== false ? "<a href=\"?/IP/$mask\">$mask</a>" : utf8tohtml($mask)) . + ' with ' . ($reason ? 'reason: ' . utf8tohtml($reason) . '' : 'no reason')); +} + +function unban($id) { + $query = prepare("DELETE FROM `bans` WHERE `id` = :id"); + $query->bindValue(':id', $id); + $query->execute() or error(db_error($query)); + + modLog("Removed ban #{$id}"); +} + diff --git a/inc/mod/config-editor.php b/inc/mod/config-editor.php new file mode 100644 index 00000000..484bd908 --- /dev/null +++ b/inc/mod/config-editor.php @@ -0,0 +1,75 @@ +<?php + +function config_vars() { + global $config; + + $config_file = file('inc/config.php', FILE_IGNORE_NEW_LINES); + $conf = array(); + + $var = array( + 'name' => false, + 'comment' => array(), + 'default' => false, + 'default_temp' => false + ); + $temp_comment = false; + foreach ($config_file as $line) { + if ($temp_comment) { + $var['comment'][] = $temp_comment; + $temp_comment = false; + } + + if (preg_match('!^\s*// (.*)$!', $line, $matches)) { + if ($var['default'] !== false) { + $line = ''; + $temp_comment = $matches[1]; + } else { + $var['comment'][] = $matches[1]; + } + } else if ($var['default_temp'] !== false) { + $var['default_temp'] .= "\n" . $line; + } elseif (preg_match('!^\s*\$config\[(.+?)\] = (.+?)(;( //.+)?)?$!', $line, $matches)) { + $var['name'] = explode('][', $matches[1]); + if (count($var['name']) == 1) { + $var['name'] = preg_replace('/^\'(.*)\'$/', '$1', end($var['name'])); + } else { + foreach ($var['name'] as &$i) + $i = preg_replace('/^\'(.*)\'$/', '$1', $i); + } + + if (isset($matches[3])) + $var['default'] = $matches[2]; + else + $var['default_temp'] = $matches[2]; + } + + if (trim($line) === '') { + if ($var['name'] !== false) { + if ($var['default_temp']) + $var['default'] = $var['default_temp']; + + $temp = eval('return ' . $var['default'] . ';'); + if (!isset($temp)) + $var['type'] = 'unknown'; + else + $var['type'] = gettype($temp); + + unset($var['default_temp']); + + if (!is_array($var['name']) || (end($var['name']) != '' && !in_array(reset($var['name']), array('stylesheets')))) { + $conf[] = $var; + } + } + + $var = array( + 'name' => false, + 'comment' => array(), + 'default' => false, + 'default_temp' => false + ); + } + } + + return $conf; +} + diff --git a/inc/mod/pages.php b/inc/mod/pages.php new file mode 100644 index 00000000..ad69ae39 --- /dev/null +++ b/inc/mod/pages.php @@ -0,0 +1,1796 @@ +<?php + +/* + * Copyright (c) 2010-2012 Tinyboard Development Group + */ + +if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) { + // You cannot request this file directly. + exit; +} + +function mod_page($title, $template, $args, $subtitle = false) { + global $config, $mod; + + echo Element('page.html', array( + 'config' => $config, + 'mod' => $mod, + 'hide_dashboard_link' => $template == 'mod/dashboard.html', + 'title' => $title, + 'subtitle' => $subtitle, + 'body' => Element($template, + array_merge( + array('config' => $config, 'mod' => $mod), + $args + ) + ) + ) + ); +} + +function mod_login() { + global $config; + + $args = array(); + + if (isset($_POST['login'])) { + // Check if inputs are set and not empty + if (!isset($_POST['username'], $_POST['password']) || $_POST['username'] == '' || $_POST['password'] == '') { + $args['error'] = $config['error']['invalid']; + } elseif (!login($_POST['username'], $_POST['password'])) { + if ($config['syslog']) + _syslog(LOG_WARNING, 'Unauthorized login attempt!'); + + $args['error'] = $config['error']['invalid']; + } else { + modLog('Logged in'); + + // Login successful + // Set cookies + setCookies(); + + header('Location: ?/', true, $config['redirect_http']); + } + } + + if (isset($_POST['username'])) + $args['username'] = $_POST['username']; + + mod_page(_('Login'), 'mod/login.html', $args); +} + +function mod_confirm($request) { + mod_page(_('Confirm action'), 'mod/confirm.html', array('request' => $request)); +} + +function mod_logout() { + destroyCookies(); + + header('Location: ?/', true, $config['redirect_http']); +} + +function mod_dashboard() { + global $config, $mod; + + $args = array(); + + $args['boards'] = listBoards(); + + if (hasPermission($config['mod']['noticeboard'])) { + if (!$config['cache']['enabled'] || !$args['noticeboard'] = cache::get('noticeboard_preview')) { + $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); + $query->bindValue(':limit', $config['mod']['noticeboard_dashboard'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $args['noticeboard'] = $query->fetchAll(PDO::FETCH_ASSOC); + + if ($config['cache']['enabled']) + cache::set('noticeboard_preview', $args['noticeboard']); + } + } + + if (!$config['cache']['enabled'] || ($args['unread_pms'] = cache::get('pm_unreadcount_' . $mod['id'])) === false) { + $query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :id AND `unread` = 1'); + $query->bindValue(':id', $mod['id']); + $query->execute() or error(db_error($query)); + $args['unread_pms'] = $query->fetchColumn(0); + + if ($config['cache']['enabled']) + cache::set('pm_unreadcount_' . $mod['id'], $args['unread_pms']); + } + + $query = query('SELECT COUNT(*) FROM `reports`') or error(db_error($query)); + $args['reports'] = $query->fetchColumn(0); + + if ($mod['type'] >= ADMIN && $config['check_updates']) { + if (!$config['version']) + error(_('Could not find current version! (Check .installed)')); + + if (isset($_COOKIE['update'])) { + $latest = unserialize($_COOKIE['update']); + } else { + $ctx = stream_context_create(array('http' => array('timeout' => 5))); + if ($code = @file_get_contents('http://tinyboard.org/version.txt', 0, $ctx)) { + eval($code); + if (preg_match('/v(\d+)\.(\d)\.(\d+)(-dev.+)?$/', $config['version'], $matches)) { + $current = array( + 'massive' => (int) $matches[1], + 'major' => (int) $matches[2], + 'minor' => (int) $matches[3] + ); + if (isset($m[4])) { + // Development versions are always ahead in the versioning numbers + $current['minor'] --; + } + // Check if it's newer + if (!( $latest['massive'] > $current['massive'] || + $latest['major'] > $current['major'] || + ($latest['massive'] == $current['massive'] && + $latest['major'] == $current['major'] && + $latest['minor'] > $current['minor'] + ))) + $latest = false; + } else { + $latest = false; + } + } else { + // Couldn't get latest version + $latest = false; + } + + setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true); + } + + if ($latest) + $args['newer_release'] = $latest; + } + + mod_page(_('Dashboard'), 'mod/dashboard.html', $args); +} + +function mod_edit_board($boardName) { + global $board, $config; + + if (!openBoard($boardName)) + error($config['error']['noboard']); + + if (!hasPermission($config['mod']['manageboards'], $board['uri'])) + error($config['error']['noaccess']); + + if (isset($_POST['title'], $_POST['subtitle'])) { + if (isset($_POST['delete'])) { + if (!hasPermission($config['mod']['manageboards'], $board['uri'])) + error($config['error']['deleteboard']); + + $query = prepare('DELETE FROM `boards` WHERE `uri` = :uri'); + $query->bindValue(':uri', $board['uri']); + $query->execute() or error(db_error($query)); + + modLog('Deleted board: ' . sprintf($config['board_abbreviation'], $board['uri']), false); + + // Delete entire board directory + rrmdir($board['uri'] . '/'); + + // Delete posting table + $query = query(sprintf('DROP TABLE IF EXISTS `posts_%s`', $board['uri'])) or error(db_error()); + + // Clear reports + $query = prepare('DELETE FROM `reports` WHERE `board` = :id'); + $query->bindValue(':id', $board['uri'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + // Delete from table + $query = prepare('DELETE FROM `boards` WHERE `uri` = :uri'); + $query->bindValue(':uri', $board['uri'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + $query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board"); + $query->bindValue(':board', $board['uri']); + $query->execute() or error(db_error($query)); + while ($cite = $query->fetch(PDO::FETCH_ASSOC)) { + if ($board['uri'] != $cite['board']) { + if (!isset($tmp_board)) + $tmp_board = $board; + openBoard($cite['board']); + rebuildPost($cite['post']); + } + } + + $query = prepare('DELETE FROM `cites` WHERE `board` = :board OR `target_board` = :board'); + $query->bindValue(':board', $board['uri']); + $query->execute() or error(db_error($query)); + + $query = prepare('DELETE FROM `antispam` WHERE `board` = :board'); + $query->bindValue(':board', $board['uri']); + $query->execute() or error(db_error($query)); + } else { + $query = prepare('UPDATE `boards` SET `title` = :title, `subtitle` = :subtitle WHERE `uri` = :uri'); + $query->bindValue(':uri', $board['uri']); + $query->bindValue(':title', $_POST['title']); + $query->bindValue(':subtitle', $_POST['subtitle']); + $query->execute() or error(db_error($query)); + } + + if ($config['cache']['enabled']) { + cache::delete('board_' . $board['uri']); + cache::delete('all_boards'); + } + + rebuildThemes('boards'); + + header('Location: ?/', true, $config['redirect_http']); + } else { + mod_page(sprintf('%s: ' . $config['board_abbreviation'], _('Edit board'), $board['uri']), 'mod/board.html', array('board' => $board)); + } +} + +function mod_new_board() { + global $config, $board; + + if (!hasPermission($config['mod']['newboard'])) + error($config['error']['noaccess']); + + if (isset($_POST['uri'], $_POST['title'], $_POST['subtitle'])) { + if ($_POST['uri'] == '') + error(sprintf($config['error']['required'], 'URI')); + + if ($_POST['title'] == '') + error(sprintf($config['error']['required'], 'title')); + + if (!preg_match('/^\w+$/', $_POST['uri'])) + error(sprintf($config['error']['invalidfield'], 'URI')); + + if (openBoard($_POST['uri'])) { + error(sprintf($config['error']['boardexists'], $board['url'])); + } + + $query = prepare('INSERT INTO `boards` VALUES (:uri, :title, :subtitle)'); + $query->bindValue(':uri', $_POST['uri']); + $query->bindValue(':title', $_POST['title']); + $query->bindValue(':subtitle', $_POST['subtitle']); + $query->execute() or error(db_error($query)); + + modLog('Created a new board: ' . sprintf($config['board_abbreviation'], $_POST['uri'])); + + if (!openBoard($_POST['uri'])) + error(_("Couldn't open board after creation.")); + + query(Element('posts.sql', array('board' => $board['uri']))) or error(db_error()); + + if ($config['cache']['enabled']) + cache::delete('all_boards'); + + // Build the board + buildIndex(); + + rebuildThemes('boards'); + + header('Location: ?/' . $board['uri'] . '/' . $config['file_index'], true, $config['redirect_http']); + } + + mod_page(_('New board'), 'mod/board.html', array('new' => true)); +} + +function mod_noticeboard($page_no = 1) { + global $config, $pdo, $mod; + + if ($page_no < 1) + error($config['error']['404']); + + if (!hasPermission($config['mod']['noticeboard'])) + error($config['error']['noaccess']); + + if (isset($_POST['subject'], $_POST['body'])) { + if (!hasPermission($config['mod']['noticeboard_post'])) + error($config['error']['noaccess']); + + markup($_POST['body']); + + $query = prepare('INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)'); + $query->bindValue(':mod', $mod['id']); + $query->bindvalue(':time', time()); + $query->bindValue(':subject', $_POST['subject']); + $query->bindValue(':body', $_POST['body']); + $query->execute() or error(db_error($query)); + + if ($config['cache']['enabled']) + cache::delete('noticeboard_preview'); + + modLog('Posted a noticeboard entry'); + + header('Location: ?/noticeboard#' . $pdo->lastInsertId(), true, $config['redirect_http']); + } + + $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :offset, :limit"); + $query->bindValue(':limit', $config['mod']['noticeboard_page'], PDO::PARAM_INT); + $query->bindValue(':offset', ($page_no - 1) * $config['mod']['noticeboard_page'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $noticeboard = $query->fetchAll(PDO::FETCH_ASSOC); + + if (empty($noticeboard) && $page_no > 1) + error($config['error']['404']); + + $query = prepare("SELECT COUNT(*) FROM `noticeboard`"); + $query->execute() or error(db_error($query)); + $count = $query->fetchColumn(0); + + mod_page(_('Noticeboard'), 'mod/noticeboard.html', array('noticeboard' => $noticeboard, 'count' => $count)); +} + +function mod_noticeboard_delete($id) { + global $config; + + if (!hasPermission($config['mod']['noticeboard_delete'])) + error($config['error']['noaccess']); + + $query = prepare('DELETE FROM `noticeboard` WHERE `id` = :id'); + $query->bindValue(':id', $id); + $query->execute() or error(db_error($query)); + + modLog('Deleted a noticeboard entry'); + + header('Location: ?/noticeboard', true, $config['redirect_http']); +} + +function mod_news($page_no = 1) { + global $config, $pdo, $mod; + + if ($page_no < 1) + error($config['error']['404']); + + if (isset($_POST['subject'], $_POST['body'])) { + if (!hasPermission($config['mod']['news'])) + error($config['error']['noaccess']); + + markup($_POST['body']); + + $query = prepare('INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)'); + $query->bindValue(':name', isset($_POST['name']) && hasPermission($config['mod']['news_custom']) ? $_POST['name'] : $mod['username']); + $query->bindvalue(':time', time()); + $query->bindValue(':subject', $_POST['subject']); + $query->bindValue(':body', $_POST['body']); + $query->execute() or error(db_error($query)); + + modLog('Posted a news entry'); + + rebuildThemes('news'); + + header('Location: ?/news#' . $pdo->lastInsertId(), true, $config['redirect_http']); + } + + $query = prepare("SELECT * FROM `news` ORDER BY `id` DESC LIMIT :offset, :limit"); + $query->bindValue(':limit', $config['mod']['news_page'], PDO::PARAM_INT); + $query->bindValue(':offset', ($page_no - 1) * $config['mod']['news_page'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $news = $query->fetchAll(PDO::FETCH_ASSOC); + + if (empty($news) && $page_no > 1) + error($config['error']['404']); + + $query = prepare("SELECT COUNT(*) FROM `news`"); + $query->execute() or error(db_error($query)); + $count = $query->fetchColumn(0); + + mod_page(_('News'), 'mod/news.html', array('news' => $news, 'count' => $count)); +} + +function mod_news_delete($id) { + global $config; + + if (!hasPermission($config['mod']['news_delete'])) + error($config['error']['noaccess']); + + $query = prepare('DELETE FROM `news` WHERE `id` = :id'); + $query->bindValue(':id', $id); + $query->execute() or error(db_error($query)); + + modLog('Deleted a news entry'); + + header('Location: ?/news', true, $config['redirect_http']); +} + +function mod_log($page_no = 1) { + global $config; + + if ($page_no < 1) + error($config['error']['404']); + + if (!hasPermission($config['mod']['modlog'])) + error($config['error']['noaccess']); + + $query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY `time` DESC LIMIT :offset, :limit"); + $query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT); + $query->bindValue(':offset', ($page_no - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $logs = $query->fetchAll(PDO::FETCH_ASSOC); + + if (empty($logs) && $page_no > 1) + error($config['error']['404']); + + $query = prepare("SELECT COUNT(*) FROM `modlogs`"); + $query->execute() or error(db_error($query)); + $count = $query->fetchColumn(0); + + mod_page(_('Moderation log'), 'mod/log.html', array('logs' => $logs, 'count' => $count)); +} + +function mod_view_board($boardName, $page_no = 1) { + global $config, $mod; + + if (!openBoard($boardName)) + error($config['error']['noboard']); + + if (!$page = index($page_no, $mod)) { + error($config['error']['404']); + } + + $page['pages'] = getPages(true); + $page['pages'][$page_no-1]['selected'] = true; + $page['btn'] = getPageButtons($page['pages'], true); + $page['mod'] = true; + $page['config'] = $config; + + echo Element('index.html', $page); +} + +function mod_view_thread($boardName, $thread) { + global $config, $mod; + + if (!openBoard($boardName)) + error($config['error']['noboard']); + + $page = buildThread($thread, true, $mod); + echo $page; +} + +function mod_ip_remove_note($ip, $id) { + global $config, $mod; + + if (!hasPermission($config['mod']['remove_notes'])) + error($config['error']['noaccess']); + + if (filter_var($ip, FILTER_VALIDATE_IP) === false) + error("Invalid IP address."); + + $query = prepare('DELETE FROM `ip_notes` WHERE `ip` = :ip AND `id` = :id'); + $query->bindValue(':ip', $ip); + $query->bindValue(':id', $id); + $query->execute() or error(db_error($query)); + + modLog("Removed a note for <a href=\"?/IP/{$ip}\">{$ip}</a>"); + + header('Location: ?/IP/' . $ip . '#notes', true, $config['redirect_http']); +} + +function mod_page_ip($ip) { + global $config, $mod; + + if (filter_var($ip, FILTER_VALIDATE_IP) === false) + error("Invalid IP address."); + + if (isset($_POST['ban_id'], $_POST['unban'])) { + if (!hasPermission($config['mod']['unban'])) + error($config['error']['noaccess']); + + require_once 'inc/mod/ban.php'; + + unban($_POST['ban_id']); + + header('Location: ?/IP/' . $ip . '#bans', true, $config['redirect_http']); + return; + } + + if (isset($_POST['note'])) { + if (!hasPermission($config['mod']['create_notes'])) + error($config['error']['noaccess']); + + markup($_POST['note']); + $query = prepare('INSERT INTO `ip_notes` VALUES (NULL, :ip, :mod, :time, :body)'); + $query->bindValue(':ip', $ip); + $query->bindValue(':mod', $mod['id']); + $query->bindValue(':time', time()); + $query->bindValue(':body', $_POST['note']); + $query->execute() or error(db_error($query)); + + modLog("Added a note for <a href=\"?/IP/{$ip}\">{$ip}</a>"); + + header('Location: ?/IP/' . $ip . '#notes', true, $config['redirect_http']); + return; + } + + $args = array(); + $args['ip'] = $ip; + $args['posts'] = array(); + + if ($config['mod']['dns_lookup']) + $args['hostname'] = rDNS($ip); + + $boards = listBoards(); + foreach ($boards as $board) { + openBoard($board['uri']); + + $query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `id` DESC LIMIT :limit', $board['uri'])); + $query->bindValue(':ip', $ip); + $query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { + if (!$post['thread']) { + // TODO: There is no reason why this should be such a fucking mess. + $po = new Thread( + $post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], + $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], + $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], + $post['sage'], $post['embed'], '?/', $mod, false + ); + } else { + $po = new Post( + $post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], + $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], + $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod + ); + } + + if (!isset($args['posts'][$board['uri']])) + $args['posts'][$board['uri']] = array('board' => $board, 'posts' => array()); + $args['posts'][$board['uri']]['posts'][] = $po->build(true); + } + } + + $args['boards'] = $boards; + + + if (hasPermission($config['mod']['view_ban'])) { + $query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip"); + $query->bindValue(':ip', $ip); + $query->execute() or error(db_error($query)); + $args['bans'] = $query->fetchAll(PDO::FETCH_ASSOC); + } + + if (hasPermission($config['mod']['view_notes'])) { + $query = prepare("SELECT `ip_notes`.*, `username` FROM `ip_notes` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip"); + $query->bindValue(':ip', $ip); + $query->execute() or error(db_error($query)); + $args['notes'] = $query->fetchAll(PDO::FETCH_ASSOC); + } + + mod_page(sprintf('%s: %s', _('IP'), $ip), 'mod/view_ip.html', $args, $args['hostname']); +} + +function mod_ban() { + global $config; + + if (!hasPermission($config['mod']['ban'])) + error($config['error']['noaccess']); + + if (!isset($_POST['ip'], $_POST['reason'], $_POST['length'], $_POST['board'])) { + mod_page(_('New ban'), 'mod/ban_form.html', array()); + return; + } + + require_once 'inc/mod/ban.php'; + + ban($_POST['ip'], $_POST['reason'], parse_time($_POST['length']), $_POST['board'] == '*' ? false : $_POST['board']); + + if (isset($_POST['redirect'])) + header('Location: ' . $_POST['redirect'], true, $config['redirect_http']); + else + header('Location: ?/', true, $config['redirect_http']); +} + +function mod_bans($page_no = 1) { + global $config; + + if ($page_no < 1) + error($config['error']['404']); + + if (!hasPermission($config['mod']['view_banlist'])) + error($config['error']['noaccess']); + + if (isset($_POST['unban'])) { + if (!hasPermission($config['mod']['unban'])) + error($config['error']['noaccess']); + + $unban = array(); + foreach ($_POST as $name => $unused) { + if (preg_match('/^ban_(\d+)$/', $name, $match)) + $unban[] = $match[1]; + } + + if (!empty($unban)) { + query('DELETE FROM `bans` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error()); + + foreach ($unban as $id) { + modLog("Removed ban #{$id}"); + } + } + + header('Location: ?/bans', true, $config['redirect_http']); + } + + if ($config['mod']['view_banexpired']) { + $query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC LIMIT :offset, :limit"); + } else { + // Filter out expired bans + $query = prepare("SELECT `bans`.*, `username` FROM `bans` INNER JOIN `mods` ON `mod` = `mods`.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC LIMIT :offset, :limit"); + } + $query->bindValue(':time', time(), PDO::PARAM_INT); + $query->bindValue(':limit', $config['mod']['banlist_page'], PDO::PARAM_INT); + $query->bindValue(':offset', ($page_no - 1) * $config['mod']['banlist_page'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $bans = $query->fetchAll(PDO::FETCH_ASSOC); + + if (empty($bans) && $page_no > 1) + error($config['error']['404']); + + $query = prepare("SELECT COUNT(*) FROM `bans`"); + $query->execute() or error(db_error($query)); + $count = $query->fetchColumn(0); + + foreach ($bans as &$ban) { + if (filter_var($ban['ip'], FILTER_VALIDATE_IP) !== false) + $ban['real_ip'] = true; + } + + mod_page(_('Ban list'), 'mod/ban_list.html', array('bans' => $bans, 'count' => $count)); +} + + +function mod_lock($board, $unlock, $post) { + global $config; + + if (!openBoard($board)) + error($config['error']['noboard']); + + if (!hasPermission($config['mod']['lock'], $board)) + error($config['error']['noaccess']); + + $query = prepare(sprintf('UPDATE `posts_%s` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL', $board)); + $query->bindValue(':id', $post); + $query->bindValue(':locked', $unlock ? 0 : 1); + $query->execute() or error(db_error($query)); + if ($query->rowCount()) { + modLog(($unlock ? 'Unlocked' : 'Locked') . " thread #{$post}"); + buildThread($post); + buildIndex(); + } + + header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']); +} + +function mod_sticky($board, $unsticky, $post) { + global $config; + + if (!openBoard($board)) + error($config['error']['noboard']); + + if (!hasPermission($config['mod']['sticky'], $board)) + error($config['error']['noaccess']); + + $query = prepare(sprintf('UPDATE `posts_%s` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL', $board)); + $query->bindValue(':id', $post); + $query->bindValue(':sticky', $unsticky ? 0 : 1); + $query->execute() or error(db_error($query)); + if ($query->rowCount()) { + modLog(($unlock ? 'Unstickied' : 'Stickied') . " thread #{$post}"); + buildThread($post); + buildIndex(); + } + + header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']); +} + +function mod_bumplock($board, $unbumplock, $post) { + global $config; + + if (!openBoard($board)) + error($config['error']['noboard']); + + if (!hasPermission($config['mod']['bumplock'], $board)) + error($config['error']['noaccess']); + + $query = prepare(sprintf('UPDATE `posts_%s` SET `sage` = :bumplock WHERE `id` = :id AND `thread` IS NULL', $board)); + $query->bindValue(':id', $post); + $query->bindValue(':bumplock', $unbumplock ? 0 : 1); + $query->execute() or error(db_error($query)); + if ($query->rowCount()) { + modLog(($unlock ? 'Unbumplocked' : 'Bumplocked') . " thread #{$post}"); + buildThread($post); + buildIndex(); + } + + header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']); +} + +function mod_move($originBoard, $postID) { + global $board, $config, $mod; + + if (!openBoard($originBoard)) + error($config['error']['noboard']); + + if (!hasPermission($config['mod']['move'], $originBoard)) + error($config['error']['noaccess']); + + $query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL', $originBoard)); + $query->bindValue(':id', $postID); + $query->execute() or error(db_error($query)); + if (!$post = $query->fetch(PDO::FETCH_ASSOC)) + error($config['error']['404']); + + if (isset($_POST['board'])) { + $targetBoard = $_POST['board']; + $shadow = isset($_POST['shadow']); + + if ($targetBoard === $originBoard) + error(_('Target and source board are the same.')); + + // copy() if leaving a shadow thread behind; else, rename(). + $clone = $shadow ? 'copy' : 'rename'; + + // indicate that the post is a thread + $post['op'] = true; + + if ($post['file']) { + $post['has_file'] = true; + $post['width'] = &$post['filewidth']; + $post['height'] = &$post['fileheight']; + + $file_src = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']; + $file_thumb = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']; + } else { + $post['has_file'] = false; + } + + // allow thread to keep its same traits (stickied, locked, etc.) + $post['mod'] = true; + + if (!openBoard($targetBoard)) + error($config['error']['noboard']); + + // create the new thread + $newID = post($post); + + if ($post['has_file']) { + // copy image + $clone($file_src, sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']); + $clone($file_thumb, sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']); + } + + // go back to the original board to fetch replies + openBoard($originBoard); + + $query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id`', $originBoard)); + $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + $replies = array(); + + while ($post = $query->fetch()) { + $post['mod'] = true; + $post['thread'] = $newID; + + if ($post['file']) { + $post['has_file'] = true; + $post['width'] = &$post['filewidth']; + $post['height'] = &$post['fileheight']; + + $post['file_src'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']; + $post['file_thumb'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']; + } else { + $post['has_file'] = false; + } + + $replies[] = $post; + } + + $newIDs = array($postID => $newID); + + openBoard($targetBoard); + + foreach ($replies as &$post) { + $query = prepare('SELECT `target` FROM `cites` WHERE `target_board` = :board AND `board` = :board AND `post` = :post'); + $query->bindValue(':board', $originBoard); + $query->bindValue(':post', $post['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($qurey)); + + // correct >>X links + while ($cite = $query->fetch(PDO::FETCH_ASSOC)) { + if (isset($newIDs[$cite['target']])) { + $post['body_nomarkup'] = preg_replace( + '/(>>(>\/' . preg_quote($originBoard, '/') . '\/)?)' . preg_quote($cite['target'], '/') . '/', + '>>' . $newIDs[$cite['target']], + $post['body_nomarkup']); + + $post['body'] = $post['body_nomarkup']; + } + } + + $post['body'] = $post['body_nomarkup']; + + $post['op'] = false; + $post['tracked_cites'] = markup($post['body'], true); + + // insert reply + $newIDs[$post['id']] = $newPostID = post($post); + + if ($post['has_file']) { + // copy image + $clone($post['file_src'], sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']); + $clone($post['file_thumb'], sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']); + } + + foreach ($post['tracked_cites'] as $cite) { + $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); + $query->bindValue(':board', $board['uri']); + $query->bindValue(':post', $newPostID, PDO::PARAM_INT); + $query->bindValue(':target_board',$cite[0]); + $query->bindValue(':target', $cite[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } + } + + // build new hread + buildThread($newID); + buildIndex(); + + // trigger themes + rebuildThemes('post'); + + // return to original board + openBoard($originBoard); + + if ($shadow) { + // lock old thread + $query = prepare(sprintf('UPDATE `posts_%s` SET `locked` = 1 WHERE `id` = :id', $originBoard)); + $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + // leave a reply, linking to the new thread + $post = array( + 'mod' => true, + 'subject' => '', + 'email' => '', + 'name' => $config['mod']['shadow_name'], + 'capcode' => $config['mod']['shadow_capcode'], + 'trip' => '', + 'password' => '', + 'has_file' => false, + // attach to original thread + 'thread' => $postID, + 'op' => false + ); + + $post['body'] = $post['body_nomarkup'] = sprintf($config['mod']['shadow_mesage'], '>>>/' . $targetBoard . '/' . $newID); + + markup($post['body']); + + $botID = post($post); + buildThread($postID); + + buildIndex(); + + header('Location: ?/' . sprintf($config['board_path'], $originBoard) . $config['dir']['res'] .sprintf($config['file_page'], $postID) . + '#' . $botID, true, $config['redirect_http']); + } else { + deletePost($postID); + buildIndex(); + + openBoard($targetBoard); + header('Location: ?/' . sprintf($config['board_path'], $board['uri']) . $config['dir']['res'] . sprintf($config['file_page'], $newID), true, $config['redirect_http']); + } + } + + $boards = listBoards(); + if (count($boards) <= 1) + error(_('Impossible to move thread; there is only one board.')); + + mod_page(_('Move thread'), 'mod/move.html', array('post' => $postID, 'board' => $originBoard, 'boards' => $boards)); +} + +function mod_ban_post($board, $delete, $post) { + global $config, $mod; + + if (!openBoard($board)) + error($config['error']['noboard']); + + if (!hasPermission($config['mod']['delete'], $board)) + error($config['error']['noaccess']); + + $query = prepare(sprintf('SELECT `ip`, `thread` FROM `posts_%s` WHERE `id` = :id', $board)); + $query->bindValue(':id', $post); + $query->execute() or error(db_error($query)); + if (!$_post = $query->fetch(PDO::FETCH_ASSOC)) + error($config['error']['404']); + + $thread = $_post['thread']; + $ip = $_post['ip']; + + if (isset($_POST['new_ban'], $_POST['reason'], $_POST['length'], $_POST['board'])) { + require_once 'inc/mod/ban.php'; + + if (isset($_POST['ip'])) + $ip = $_POST['ip']; + + ban($ip, $_POST['reason'], parse_time($_POST['length']), $_POST['board'] == '*' ? false : $_POST['board']); + + if (isset($_POST['public_message'], $_POST['message'])) { + // public ban message + $query = prepare(sprintf('UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id', $board)); + $query->bindValue(':id', $post); + $query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message']))); + $query->execute() or error(db_error($query)); + + modLog("Attached a public ban message to post #{$post}: " . utf8tohtml($_POST['message'])); + buildThread($thread ? $thread : $post); + buildIndex(); + } elseif (isset($_POST['delete']) && (int) $_POST['delete']) { + // Delete post + deletePost($post); + modLog("Deleted post #{$post}"); + // Rebuild board + buildIndex(); + } + + header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']); + } + + $args = array( + 'ip' => $ip, + 'hide_ip' => !hasPermission($config['mod']['show_ip'], $board), + 'post' => $post, + 'board' => $board, + 'delete' => (bool)$delete, + 'boards' => listBoards() + ); + + mod_page(_('New ban'), 'mod/ban_form.html', $args); +} + +function mod_delete($board, $post) { + global $config, $mod; + + if (!openBoard($board)) + error($config['error']['noboard']); + + if (!hasPermission($config['mod']['delete'], $board)) + error($config['error']['noaccess']); + + // Delete post + deletePost($post); + // Record the action + modLog("Deleted post #{$post}"); + // Rebuild board + buildIndex(); + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']); +} + +function mod_deletefile($board, $post) { + global $config, $mod; + + if (!openBoard($board)) + error($config['error']['noboard']); + + if (!hasPermission($config['mod']['deletefile'], $board)) + error($config['error']['noaccess']); + + // Delete file + deleteFile($post); + // Record the action + modLog("Deleted file from post #{$post}"); + // Rebuild thread + buildThread($post); + // Rebuild board + buildIndex(); + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']); +} + +function mod_deletebyip($boardName, $post, $global = false) { + global $config, $mod, $board; + + $global = (bool)$global; + + if (!openBoard($boardName)) + error($config['error']['noboard']); + + if (!$global && !hasPermission($config['mod']['deletebyip'], $boardName)) + error($config['error']['noaccess']); + + if ($global && !hasPermission($config['mod']['deletebyip_global'], $boardName)) + error($config['error']['noaccess']); + + // Find IP address + $query = prepare(sprintf('SELECT `ip` FROM `posts_%s` WHERE `id` = :id', $boardName)); + $query->bindValue(':id', $post); + $query->execute() or error(db_error($query)); + if (!$ip = $query->fetchColumn(0)) + error($config['error']['invalidpost']); + + $boards = $global ? listBoards() : array(array('uri' => $boardName)); + + $query = ''; + foreach ($boards as $_board) { + $query .= sprintf("SELECT `id`, '%s' AS `board` FROM `posts_%s` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']); + } + $query = preg_replace('/UNION ALL $/', '', $query); + + $query = prepare($query); + $query->bindValue(':ip', $ip); + $query->execute() or error(db_error($query)); + + if ($query->rowCount() < 1) + error($config['error']['invalidpost']); + + $boards = array(); + while ($post = $query->fetch()) { + openBoard($post['board']); + $boards[] = $post['board']; + + deletePost($post['id'], false); + } + + $boards = array_unique($boards); + + foreach ($boards as $_board) { + openBoard($_board); + buildIndex(); + } + + if ($global) { + $board = false; + } + + // Record the action + modLog("Deleted all posts by IP address: <a href=\"?/IP/$ip\">$ip</a>"); + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); +} + +function mod_user($uid) { + global $config, $mod; + + if (!hasPermission($config['mod']['editusers']) && !(hasPermission($config['mod']['change_password']) && $uid == $mod['id'])) + error($config['error']['noaccess']); + + $query = prepare('SELECT * FROM `mods` WHERE `id` = :id'); + $query->bindValue(':id', $uid); + $query->execute() or error(db_error($query)); + if (!$user = $query->fetch(PDO::FETCH_ASSOC)) + error($config['error']['404']); + + if (hasPermission($config['mod']['editusers']) && isset($_POST['username'], $_POST['password'])) { + if (isset($_POST['allboards'])) { + $boards = array('*'); + } else { + $_boards = listBoards(); + foreach ($_boards as &$board) { + $board = $board['uri']; + } + + $boards = array(); + foreach ($_POST as $name => $value) { + if (preg_match('/^board_(\w+)$/', $name, $matches) && in_array($matches[1], $_boards)) + $boards[] = $matches[1]; + } + } + + if (isset($_POST['delete'])) { + if (!hasPermission($config['mod']['deleteusers'])) + error($config['error']['noaccess']); + + $query = prepare('DELETE FROM `mods` WHERE `id` = :id'); + $query->bindValue(':id', $uid); + $query->execute() or error(db_error($query)); + + modLog('Deleted user ' . utf8tohtml($user['username']) . ' <small>(#' . $user['id'] . ')</small>'); + + header('Location: ?/users', true, $config['redirect_http']); + + return; + } + + if ($_POST['username'] == '') + error(sprintf($config['error']['required'], 'username')); + + $query = prepare('UPDATE `mods` SET `username` = :username, `boards` = :boards WHERE `id` = :id'); + $query->bindValue(':id', $uid); + $query->bindValue(':username', $_POST['username']); + $query->bindValue(':boards', implode(',', $boards)); + $query->execute() or error(db_error($query)); + + if ($user['username'] !== $_POST['username']) { + // account was renamed + modLog('Renamed user "' . utf8tohtml($user['username']) . '" <small>(#' . $user['id'] . ')</small> to "' . utf8tohtml($_POST['username']) . '"'); + } + + if ($_POST['password'] != '') { + $query = prepare('UPDATE `mods` SET `password` = SHA1(:password) WHERE `id` = :id'); + $query->bindValue(':id', $uid); + $query->bindValue(':password', $_POST['password']); + $query->execute() or error(db_error($query)); + + modLog('Changed password for ' . utf8tohtml($_POST['username']) . ' <small>(#' . $user['id'] . ')</small>'); + + if ($uid == $mod['id']) { + login($_POST['username'], $_POST['password']); + setCookies(); + } + } + + if (hasPermission($config['mod']['manageusers'])) + header('Location: ?/users', true, $config['redirect_http']); + else + header('Location: ?/', true, $config['redirect_http']); + + return; + } + + if (hasPermission($config['mod']['change_password']) && $uid == $mod['id'] && isset($_POST['password'])) { + if ($_POST['password'] != '') { + $query = prepare('UPDATE `mods` SET `password` = SHA1(:password) WHERE `id` = :id'); + $query->bindValue(':id', $uid); + $query->bindValue(':password', $_POST['password']); + $query->execute() or error(db_error($query)); + + modLog('Changed own password'); + + login($user['username'], $_POST['password']); + setCookies(); + } + + if (hasPermission($config['mod']['manageusers'])) + header('Location: ?/users', true, $config['redirect_http']); + else + header('Location: ?/', true, $config['redirect_http']); + + return; + } + + if (hasPermission($config['mod']['modlog'])) { + $query = prepare('SELECT * FROM `modlogs` WHERE `mod` = :id ORDER BY `time` DESC LIMIT 5'); + $query->bindValue(':id', $uid); + $query->execute() or error(db_error($query)); + $log = $query->fetchAll(PDO::FETCH_ASSOC); + } else { + $log = array(); + } + + $user['boards'] = explode(',', $user['boards']); + + mod_page(_('Edit user'), 'mod/user.html', array('user' => $user, 'logs' => $log, 'boards' => listBoards())); +} + +function mod_user_new() { + global $pdo, $config; + + if (!hasPermission($config['mod']['createusers'])) + error($config['error']['noaccess']); + + if (isset($_POST['username'], $_POST['password'], $_POST['type'])) { + if ($_POST['username'] == '') + error(sprintf($config['error']['required'], 'username')); + if ($_POST['password'] == '') + error(sprintf($config['error']['required'], 'password')); + + if (isset($_POST['allboards'])) { + $boards = array('*'); + } else { + $_boards = listBoards(); + foreach ($_boards as &$board) { + $board = $board['uri']; + } + + $boards = array(); + foreach ($_POST as $name => $value) { + if (preg_match('/^board_(\w+)$/', $name, $matches) && in_array($matches[1], $_boards)) + $boards[] = $matches[1]; + } + } + + $_POST['type'] = (int) $_POST['type']; + if ($_POST['type'] !== JANITOR && $_POST['type'] !== MOD && $_POST['type'] !== ADMIN) + error(sprintf($config['error']['invalidfield'], 'type')); + + $query = prepare('INSERT INTO `mods` VALUES (NULL, :username, SHA1(:password), :type, :boards)'); + $query->bindValue(':username', $_POST['username']); + $query->bindValue(':password', $_POST['password']); + $query->bindValue(':type', $_POST['type']); + $query->bindValue(':boards', implode(',', $boards)); + $query->execute() or error(db_error($query)); + + $userID = $pdo->lastInsertId(); + + modLog('Created a new user: ' . utf8tohtml($_POST['username']) . ' <small>(#' . $userID . ')</small>'); + + header('Location: ?/users', true, $config['redirect_http']); + return; + } + + mod_page(_('Edit user'), 'mod/user.html', array('new' => true, 'boards' => listBoards())); +} + + +function mod_users() { + global $config; + + if (!hasPermission($config['mod']['manageusers'])) + error($config['error']['noaccess']); + + $query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error()); + $users = $query->fetchAll(PDO::FETCH_ASSOC); + + mod_page(sprintf('%s (%d)', _('Manage users'), count($users)), 'mod/users.html', array('users' => $users)); +} + +function mod_user_promote($uid, $action) { + global $config; + + if (!hasPermission($config['mod']['promoteusers'])) + error($config['error']['noaccess']); + + $query = prepare("UPDATE `mods` SET `type` = `type` " . ($action == 'promote' ? "+1 WHERE `type` < " . (int)ADMIN : "-1 WHERE `type` > " . (int)JANITOR) . " AND `id` = :id"); + $query->bindValue(':id', $uid); + $query->execute() or error(db_error($query)); + + modLog(($action == 'promote' ? 'Promoted' : 'Demoted') . " user #{$uid}"); + + header('Location: ?/users', true, $config['redirect_http']); +} + +function mod_pm($id, $reply = false) { + global $mod, $config; + + if ($reply && !hasPermission($config['mod']['create_pm'])) + error($config['error']['noaccess']); + + $query = prepare("SELECT `mods`.`username`, `mods_to`.`username` AS `to_username`, `pms`.* FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` LEFT JOIN `mods` AS `mods_to` ON `mods_to`.`id` = `to` WHERE `pms`.`id` = :id"); + $query->bindValue(':id', $id); + $query->execute() or error(db_error($query)); + + if ((!$pm = $query->fetch(PDO::FETCH_ASSOC)) || ($pm['to'] != $mod['id'] && !hasPermission($config['mod']['master_pm']))) + error($config['error']['404']); + + if (isset($_POST['delete'])) { + $query = prepare("DELETE FROM `pms` WHERE `id` = :id"); + $query->bindValue(':id', $id); + $query->execute() or error(db_error($query)); + + if ($config['cache']['enabled']) { + cache::delete('pm_unread_' . $mod['id']); + cache::delete('pm_unreadcount_' . $mod['id']); + } + + header('Location: ?/', true, $config['redirect_http']); + return; + } + + if ($pm['unread'] && $pm['to'] == $mod['id']) { + $query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `id` = :id"); + $query->bindValue(':id', $id); + $query->execute() or error(db_error($query)); + + if ($config['cache']['enabled']) { + cache::delete('pm_unread_' . $mod['id']); + cache::delete('pm_unreadcount_' . $mod['id']); + } + + modLog('Read a PM'); + } + + if ($reply) { + if (!$pm['to_username']) + error($config['error']['404']); // deleted? + + mod_page(sprintf('%s %s', _('New PM for'), $pm['to_username']), 'mod/new_pm.html', array( + 'username' => $pm['username'], 'id' => $pm['sender'], 'message' => quote($pm['message']) + )); + } else { + mod_page(sprintf('%s – #%d', _('Private message'), $id), 'mod/pm.html', $pm); + } +} + +function mod_inbox() { + global $config, $mod; + + $query = prepare('SELECT `unread`,`pms`.`id`, `time`, `sender`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC'); + $query->bindValue(':mod', $mod['id']); + $query->execute() or error(db_error($query)); + $messages = $query->fetchAll(PDO::FETCH_ASSOC); + + $query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :mod AND `unread` = 1'); + $query->bindValue(':mod', $mod['id']); + $query->execute() or error(db_error($query)); + $unread = $query->fetchColumn(0); + + foreach ($messages as &$message) { + $message['snippet'] = pm_snippet($message['message']); + } + + mod_page(sprintf('%s (%s)', _('PM inbox'), count($messages) > 0 ? $unread . ' unread' : 'empty'), 'mod/inbox.html', array( + 'messages' => $messages, + 'unread' => $unread + )); +} + + +function mod_new_pm($username) { + global $config, $mod; + + if (!hasPermission($config['mod']['create_pm'])) + error($config['error']['noaccess']); + + $query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username"); + $query->bindValue(':username', $username); + $query->execute() or error(db_error($query)); + if (!$id = $query->fetchColumn(0)) { + // Old style ?/PM: by user ID + $query = prepare("SELECT `username` FROM `mods` WHERE `id` = :username"); + $query->bindValue(':username', $username); + $query->execute() or error(db_error($query)); + if ($username = $query->fetchColumn(0)) + header('Location: ?/new_PM/' . $username, true, $config['redirect_http']); + else + error($config['error']['404']); + } + + if (isset($_POST['message'])) { + markup($_POST['message']); + + $query = prepare("INSERT INTO `pms` VALUES (NULL, :me, :id, :message, :time, 1)"); + $query->bindValue(':me', $mod['id']); + $query->bindValue(':id', $id); + $query->bindValue(':message', $_POST['message']); + $query->bindValue(':time', time()); + $query->execute() or error(db_error($query)); + + if ($config['cache']['enabled']) { + cache::delete('pm_unread_' . $id); + cache::delete('pm_unreadcount_' . $id); + } + + modLog('Sent a PM to ' . utf8tohtml($username)); + + header('Location: ?/', true, $config['redirect_http']); + } + + mod_page(sprintf('%s %s', _('New PM for'), $username), 'mod/new_pm.html', array('username' => $username, 'id' => $id)); +} + +function mod_rebuild() { + global $config, $twig; + + if (!hasPermission($config['mod']['rebuild'])) + error($config['error']['noaccess']); + + if (isset($_POST['rebuild'])) { + $log = array(); + $boards = listBoards(); + $rebuilt_scripts = array(); + + if (isset($_POST['rebuild_cache'])) { + if ($config['cache']['enabled']) { + $log[] = 'Flushing cache'; + Cache::flush(); + } + + $log[] = 'Clearing template cache'; + load_twig(); + $twig->clearCacheFiles(); + } + + if (isset($_POST['rebuild_themes'])) { + $log[] = 'Regenerating theme files'; + rebuildThemes('all'); + } + + if (isset($_POST['rebuild_javascript'])) { + $log[] = 'Rebuilding <strong>' . $config['file_script'] . '</strong>'; + buildJavascript(); + $rebuilt_scripts[] = $config['file_script']; + } + + foreach ($boards as $board) { + if (!(isset($_POST['boards_all']) || isset($_POST['board_' . $board['uri']]))) + continue; + + openBoard($board['uri']); + + if (isset($_POST['rebuild_index'])) { + buildIndex(); + $log[] = '<strong>' . sprintf($config['board_abbreviation'], $board['uri']) . '</strong>: Creating index pages'; + } + + if (isset($_POST['rebuild_javascript']) && !in_array($config['file_script'], $rebuilt_scripts)) { + $log[] = '<strong>' . sprintf($config['board_abbreviation'], $board['uri']) . '</strong>: Rebuilding <strong>' . $config['file_script'] . '</strong>'; + buildJavascript(); + $rebuilt_scripts[] = $config['file_script']; + } + + if (isset($_POST['rebuild_thread'])) { + $query = query(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); + while ($post = $query->fetch(PDO::FETCH_ASSOC)) { + $log[] = '<strong>' . sprintf($config['board_abbreviation'], $board['uri']) . '</strong>: Rebuilding thread #' . $post['id']; + buildThread($post['id']); + } + } + } + + mod_page(_('Rebuild'), 'mod/rebuilt.html', array('logs' => $log)); + return; + } + + mod_page(_('Rebuild'), 'mod/rebuild.html', array('boards' => listBoards())); +} + +function mod_reports() { + global $config, $mod; + + if (!hasPermission($config['mod']['reports'])) + error($config['error']['noaccess']); + + $query = prepare("SELECT * FROM `reports` ORDER BY `time` DESC LIMIT :limit"); + $query->bindValue(':limit', $config['mod']['recent_reports'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $reports = $query->fetchAll(PDO::FETCH_ASSOC); + + $report_queries = array(); + foreach ($reports as $report) { + if (!isset($report_queries[$report['board']])) + $report_queries[$report['board']] = array(); + $report_queries[$report['board']][] = $report['post']; + } + + $report_posts = array(); + foreach ($report_queries as $board => $posts) { + $report_posts[$board] = array(); + + $query = query(sprintf('SELECT * FROM `posts_%s` WHERE `id` = ' . implode(' OR `id` = ', $posts), $board)) or error(db_error()); + while ($post = $query->fetch()) { + $report_posts[$board][$post['id']] = $post; + } + } + + $count = 0; + $body = ''; + foreach ($reports as $report) { + if (!isset($report_posts[$report['board']][$report['post']])) { + // // Invalid report (post has since been deleted) + $query = prepare("DELETE FROM `reports` WHERE `post` = :id AND `board` = :board"); + $query->bindValue(':id', $report['post'], PDO::PARAM_INT); + $query->bindValue(':board', $report['board']); + $query->execute() or error(db_error($query)); + continue; + } + + openBoard($report['board']); + + $post = &$report_posts[$report['board']][$report['post']]; + + if (!$post['thread']) { + // Still need to fix this: + $po = new Thread( + $post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], + $post['capcode'], $post['body'], $post['time'], $post['thumb'], + $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], + $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], + $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false + ); + } else { + $po = new Post( + $post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], + $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], + $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod + ); + } + + // a little messy and inefficient + $append_html = Element('mod/report.html', array('report' => $report, 'config' => $config, 'mod' => $mod)); + + // Bug fix for https://github.com/savetheinternet/Tinyboard/issues/21 + $po->body = truncate($po->body, $po->link(), $config['body_truncate'] - substr_count($append_html, '<br>')); + + if (mb_strlen($po->body) + mb_strlen($append_html) > $config['body_truncate_char']) { + // still too long; temporarily increase limit in the config + $__old_body_truncate_char = $config['body_truncate_char']; + $config['body_truncate_char'] = mb_strlen($po->body) + mb_strlen($append_html); + } + + $po->body .= $append_html; + + $body .= $po->build(true) . '<hr>'; + + if (isset($__old_body_truncate_char)) + $config['body_truncate_char'] = $__old_body_truncate_char; + + $count++; + } + + mod_page(sprintf('%s (%d)', _('Report queue'), $count), 'mod/reports.html', array('reports' => $body, 'count' => $count)); +} + +function mod_report_dismiss($id, $all = false) { + global $config; + + $query = prepare("SELECT `post`, `board`, `ip` FROM `reports` WHERE `id` = :id"); + $query->bindValue(':id', $id); + $query->execute() or error(db_error($query)); + if ($report = $query->fetch(PDO::FETCH_ASSOC)) { + $ip = $report['ip']; + $board = $report['board']; + $post = $report['post']; + } else + error($config['error']['404']); + + if (!$all && !hasPermission($config['mod']['report_dismiss'], $board)) + error($config['error']['noaccess']); + + if ($all && !hasPermission($config['mod']['report_dismiss_ip'], $board)) + error($config['error']['noaccess']); + + if ($all) { + $query = prepare("DELETE FROM `reports` WHERE `ip` = :ip"); + $query->bindValue(':ip', $ip); + } else { + $query = prepare("DELETE FROM `reports` WHERE `id` = :id"); + $query->bindValue(':id', $id); + } + $query->execute() or error(db_error($query)); + + + if ($all) + modLog("Dismissed all reports by <a href=\"?/IP/$ip\">$ip</a>"); + else + modLog("Dismissed a report for post #{$id}", $board); + + header('Location: ?/reports', true, $config['redirect_http']); +} + + +function mod_config() { + global $config, $mod; + + if (!hasPermission($config['mod']['edit_config'])) + error($config['error']['noaccess']); + + require_once 'inc/mod/config-editor.php'; + + $conf = config_vars(); + + foreach ($conf as &$var) { + if (is_array($var['name'])) { + $c = &$config; + foreach ($var['name'] as $n) + $c = &$c[$n]; + } else { + $c = $config[$var['name']]; + } + + $var['value'] = $c; + } + unset($var); + + if (isset($_POST['save'])) { + $config_append = ''; + + foreach ($conf as $var) { + $field_name = 'cf_' . (is_array($var['name']) ? implode('/', $var['name']) : $var['name']); + + if ($var['type'] == 'boolean') + $value = isset($_POST[$field_name]); + elseif (isset($_POST[$field_name])) + $value = $_POST[$field_name]; + else + continue; // ??? + + if (!settype($value, $var['type'])) + continue; // invalid + + if ($value != $var['value']) { + // This value has been changed. + + $config_append .= '$config'; + + if (is_array($var['name'])) { + foreach ($var['name'] as $name) + $config_append .= '[' . var_export($name, true) . ']'; + } else { + $config_append .= '[' . var_export($var['name'], true) . ']'; + } + + $config_append .= ' = ' . var_export($value, true) . ";\n"; + } + } + + if (!empty($config_append)) { + $config_append = "\n// Changes made via web editor by \"" . $mod['username'] . "\" @ " . date('r') . ":\n" . $config_append . "\n"; + + if (!@file_put_contents('inc/instance-config.php', $config_append, FILE_APPEND)) { + $config_append = htmlentities($config_append); + + if ($config['minify_html']) + $config_append = str_replace("\n", '
', $config_append); + $page = array(); + $page['title'] = 'Cannot write to file!'; + $page['config'] = $config; + $page['body'] = ' + <p style="text-align:center">Tinyboard could not write to <strong>inc/instance-config.php</strong> with the ammended configuration, probably due to a permissions error.</p> + <p style="text-align:center">You may proceed with these changes manually by copying and pasting the following code to the end of <strong>inc/instance-config.php</strong>:</p> + <textarea style="width:700px;height:370px;margin:auto;display:block;background:white;color:black" readonly>' . $config_append . '</textarea> + '; + echo Element('page.html', $page); + exit; + } + } + + header('Location: ?/', true, $config['redirect_http']); + + exit; + } + + mod_page(_('Config editor'), 'mod/config-editor.html', array('conf' => $conf)); +} + +function mod_debug_antispam() { + global $pdo, $config; + + $args = array(); + + if (isset($_POST['board'], $_POST['thread'])) { + $where = '`board` = ' . $pdo->quote($_POST['board']); + if ($_POST['thread'] != '') + $where .= ' AND `thread` = ' . $pdo->quote($_POST['thread']); + + if (isset($_POST['purge'])) { + $query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where); + $query->bindValue(':expires', $config['spam']['hidden_inputs_expire']); + $query->execute() or error(db_error()); + } + + $args['board'] = $_POST['board']; + $args['thread'] = $_POST['thread']; + } else { + $where = ''; + } + + $query = query('SELECT COUNT(*) FROM `antispam`' . ($where ? " WHERE $where" : '')) or error(db_error()); + $args['total'] = number_format($query->fetchColumn(0)); + + $query = query('SELECT COUNT(*) FROM `antispam` WHERE `expires` IS NOT NULL' . ($where ? " AND $where" : '')) or error(db_error()); + $args['expiring'] = number_format($query->fetchColumn(0)); + + $query = query('SELECT * FROM `antispam` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `passed` DESC LIMIT 40') or error(db_error()); + $args['top'] = $query->fetchAll(PDO::FETCH_ASSOC); + + mod_page(_('Debug: Anti-spam'), 'mod/debug/antispam.html', $args); +} + +function mod_themes_list() { + global $config; + + if (!hasPermission($config['mod']['themes'])) + error($config['error']['noaccess']); + + if(!is_dir($config['dir']['themes'])) + error(_('Themes directory doesn\'t exist!')); + if(!$dir = opendir($config['dir']['themes'])) + error(_('Cannot open themes directory; check permissions.')); + + $query = query('SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL') or error(db_error()); + $themes_in_use = $query->fetchAll(PDO::FETCH_COLUMN); + + // Scan directory for themes + $themes = array(); + while ($file = readdir($dir)) { + if ($file[0] != '.' && is_dir($config['dir']['themes'] . '/' . $file)) { + $themes[$file] = loadThemeConfig($file); + } + } + closedir($dir); + + mod_page(_('Manage themes'), 'mod/themes.html', array( + 'themes' => $themes, + 'themes_in_use' => $themes_in_use, + )); +} + +function mod_theme_configure($theme_name) { + global $config; + + if (!hasPermission($config['mod']['themes'])) + error($config['error']['noaccess']); + + if(!$theme = loadThemeConfig($theme_name)) { + error($config['error']['invalidtheme']); + } + + if(isset($_POST['install'])) { + // Check if everything is submitted + foreach($theme['config'] as &$conf) { + if(!isset($_POST[$conf['name']]) && $conf['type'] != 'checkbox') + error(sprintf($config['error']['required'], $c['title'])); + } + + // Clear previous settings + $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query->bindValue(':theme', $theme_name); + $query->execute() or error(db_error($query)); + + foreach($theme['config'] as &$conf) { + $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, :name, :value)"); + $query->bindValue(':theme', $theme_name); + $query->bindValue(':name', $conf['name']); + $query->bindValue(':value', $_POST[$conf['name']]); + $query->execute() or error(db_error($query)); + } + + $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, NULL, NULL)"); + $query->bindValue(':theme', $theme_name); + $query->execute() or error(db_error($query)); + + $result = true; + $message = false; + if(isset($theme['install_callback'])) { + $ret = $theme['install_callback'](themeSettings($theme_name)); + if($ret && !empty($ret)) { + if(is_array($ret) && count($ret) == 2) { + $result = $ret[0]; + $message = $ret[1]; + } + } + } + + if(!$result) { + // Install failed + $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query->bindValue(':theme', $theme_name); + $query->execute() or error(db_error($query)); + } + + // Build themes + rebuildThemes('all'); + + mod_page(sprintf(_($result ? 'Installed theme: %s' : 'Installation failed: %s'), $theme['name']), 'mod/theme_installed.html', array( + 'theme_name' => $theme_name, + 'theme' => $theme, + 'result' => $result, + 'message' => $message, + )); + } + + $settings = themeSettings($theme_name); + + mod_page(sprintf(_('Configuring theme: %s'), $theme['name']), 'mod/theme_config.html', array( + 'theme_name' => $theme_name, + 'theme' => $theme, + 'settings' => $settings, + )); +} + +function mod_theme_uninstall($theme_name) { + global $config; + + if (!hasPermission($config['mod']['themes'])) + error($config['error']['noaccess']); + + $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query->bindValue(':theme', $theme_name); + $query->execute() or error(db_error($query)); + + header('Location: ?/themes', true, $config['redirect_http']); +} + +function mod_theme_rebuild($theme_name) { + global $config; + + if (!hasPermission($config['mod']['themes'])) + error($config['error']['noaccess']); + + rebuildTheme($theme_name, 'all'); + + mod_page(sprintf(_('Rebuilt theme: %s'), $theme_name), 'mod/theme_rebuilt.html', array( + 'theme_name' => $theme_name, + )); +} diff --git a/inc/template.php b/inc/template.php index 8d679d25..351bde62 100644 --- a/inc/template.php +++ b/inc/template.php @@ -27,7 +27,7 @@ function load_twig() { $twig = new Twig_Environment($loader, array(
'autoescape' => false,
'cache' => "{$config['dir']['template']}/cache",
- 'debug' => ($config['debug'] ? true : false),
+ 'debug' => $config['debug']
));
$twig->addExtension(new Twig_Extensions_Extension_Tinyboard());
$twig->addExtension(new Twig_Extensions_Extension_I18n());
@@ -39,7 +39,7 @@ function Element($templateFile, array $options) { if (!$twig)
load_twig();
- if (function_exists('create_pm_header') && ((isset($options['mod']) && $options['mod']) || isset($options['__mod']))) {
+ if (function_exists('create_pm_header') && ((isset($options['mod']) && $options['mod']) || isset($options['__mod'])) && !preg_match('!^mod/!', $templateFile)) {
$options['pm'] = create_pm_header();
}
diff --git a/install.php b/install.php index 2e732c4c..1e872911 100644 --- a/install.php +++ b/install.php @@ -1,7 +1,7 @@ <?php // Installation/upgrade file -define('VERSION', 'v0.9.6-dev-4'); +define('VERSION', 'v0.9.6-dev-5'); require 'inc/functions.php'; @@ -210,6 +210,8 @@ if (file_exists($config['has_installed'])) { } case 'v0.9.6-dev-3': query("ALTER TABLE `antispam` CHANGE `hash` `hash` CHAR( 40 ) NOT NULL") or error(db_error()); + case 'v0.9.6-dev-4': + query("ALTER TABLE `news` DROP INDEX `id`, ADD PRIMARY KEY ( `id` )") or error(db_error()); case false: // Update version number file_write($config['has_installed'], VERSION); diff --git a/mod-old.php b/mod-old.php new file mode 100644 index 00000000..31273e39 --- /dev/null +++ b/mod-old.php @@ -0,0 +1,3128 @@ +<?php + +/* + * Copyright (c) 2010-2012 Tinyboard Development Group + */ + +// WARNING: This file is currently a clusterfuck of code. I will be rewriting it very soon. + +require 'inc/functions.php'; +require 'inc/mod.php'; + +if (get_magic_quotes_gpc()) { + function strip_array($var) { + return is_array($var) ? array_map('strip_array', $var) : stripslashes($var); + } + + $_GET = strip_array($_GET); + $_POST = strip_array($_POST); +} + +$query = isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : ''; + +// If not logged in +if(!$mod) { + if(isset($_POST['login'])) { + // Check if inputs are set and not empty + if( !isset($_POST['username']) || + !isset($_POST['password']) || + empty($_POST['username']) || + empty($_POST['password']) + ) loginForm($config['error']['invalid'], $_POST['username'], '?' . $query); + + + if(!login($_POST['username'], $_POST['password'])) { + if($config['syslog']) + _syslog(LOG_WARNING, 'Unauthorized login attempt!'); + loginForm($config['error']['invalid'], $_POST['username'], '?' . $query); + } + + modLog("Logged in."); + + // Login successful + // Set cookies + setCookies(); + + // Redirect + if(isset($_POST['redirect'])) + header('Location: ' . $_POST['redirect'], true, $config['redirect_http']); + else + header('Location: ?' . $config['mod']['default'], true, $config['redirect_http']); + } else { + loginForm(false, false, '?' . $query); + } +} else { + // Redirect (for index pages) + if(count($_GET) == 2 && isset($_GET['status']) && isset($_GET['r'])) { + header('Location: ' . $_GET['r'], true, $_GET['status']); + exit; + } + + // A sort of "cache" + // Stops calling preg_quote and str_replace when not needed; only does it once + $regex = array( + 'board' => str_replace('%s', '(\w{1,8})', preg_quote($config['board_path'], '/')), + 'page' => str_replace('%d', '(\d+)', preg_quote($config['file_page'], '/')), + 'img' => preg_quote($config['dir']['img'], '/'), + 'thumb' => preg_quote($config['dir']['thumb'], '/'), + 'res' => preg_quote($config['dir']['res'], '/'), + 'index' => preg_quote($config['file_index'], '/') + ); + + if(preg_match('/^\/?$/', $query)) { + // Dashboard + $fieldset = array( + 'Boards' => '', + 'Noticeboard' => '', + 'Administration' => '', + 'Themes' => '', + 'Search' => '', + 'Update' => '', + 'Logout' => '' + ); + + // Boards + $fieldset['Boards'] .= ulBoards(); + + if(hasPermission($config['mod']['noticeboard'])) { + if(!$config['cache']['enabled'] || !($fieldset['Noticeboard'] = cache::get('noticeboard_preview'))) { + $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); + $query->bindValue(':limit', $config['mod']['noticeboard_dashboard'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + $fieldset['Noticeboard'] .= '<li>'; + + $_body = ''; + while($notice = $query->fetch()) { + $_body .= '<li><a href="?/noticeboard#' . + $notice['id'] . + '">' . + ($notice['subject'] ? + $notice['subject'] + : + '<em>' . _('no subject') . '</em>' + ) . + '</a><span class="unimportant"> — by ' . + (isset($notice['username']) ? + utf8tohtml($notice['username']) + : '<em>???</em>') . + ' at ' . + strftime($config['post_date'], $notice['time']) . + '</span></li>'; + } + if(!empty($_body)) { + $fieldset['Noticeboard'] .= '<ul>' . $_body . '</ul></li><li>'; + } + if($config['cache']['enabled']) + cache::set('noticeboard_preview', $fieldset['Noticeboard']); + } + + $fieldset['Noticeboard'] .= '<a href="?/noticeboard">' . _('View all entries') . '</a></li>'; + + $query = prepare("SELECT COUNT(*) AS `count` FROM `pms` WHERE `to` = :id AND `unread` = 1"); + $query->bindValue(':id', $mod['id']); + $query->execute() or error(db_error($query)); + $count = $query->fetch(); + $count = $count['count']; + + $fieldset['Noticeboard'] .= '<li><a href="?/inbox">' . _('PM Inbox') . + ($count > 0 + ? + ' <strong>(' . $count . ' unread)</strong>' + : '') . + '</a></li>'; + + $fieldset['Noticeboard'] .= '<li><a href="?/news">' . _('News') . '</a></li>'; + } + + + if(hasPermission($config['mod']['reports'])) { + $fieldset['Administration'] .= '<li><a href="?/reports">' . _('Report queue') . '</a></li>'; + } + if(hasPermission($config['mod']['view_banlist'])) { + $fieldset['Administration'] .= '<li><a href="?/bans">' . _('Ban list') . '</a></li>'; + } + if(hasPermission($config['mod']['manageusers'])) { + $fieldset['Administration'] .= '<li><a href="?/users">' . _('Manage users') . '</a></li>'; + } elseif(hasPermission($config['mod']['change_password'])) { + $fieldset['Administration'] .= '<li><a href="?/users/' . $user['id'] . '">' . _('Change own password') . '</a></li>'; + } + if(hasPermission($config['mod']['modlog'])) { + $fieldset['Administration'] .= '<li><a href="?/log">' . _('Moderation log') . '</a></li>'; + } + if(hasPermission($config['mod']['rebuild'])) { + $fieldset['Administration'] .= '<li><a href="?/rebuild">' . _('Rebuild static files') . '</a></li>'; + } + if(hasPermission($config['mod']['rebuild']) && $config['cache']['enabled']) { + $fieldset['Administration'] .= '<li><a href="?/flush">' . _('Clear cache') . '</a></li>'; + } + if(hasPermission($config['mod']['show_config'])) { + $fieldset['Administration'] .= '<li><a href="?/config">' . _('Show configuration') . '</a></li>'; + } + + if(hasPermission($config['mod']['themes'])) { + $fieldset['Themes'] .= '<li><a href="?/themes">' . _('Manage themes') . '</a></li>'; + } + + if(hasPermission($config['mod']['search'])) { + $fieldset['Search'] .= '<li><form style="display:inline" action="?/search" method="post">' . + '<label style="display:inline" for="search">' . _('Phrase:') . '</label> ' . + '<input id="search" name="search" type="text" size="35" />' . + '<input type="submit" value="' . _('Search') . '" />' . + '</form>' . + '<p class="unimportant">' . _('(Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)') . '</p>' . + '</li>'; + } + + if($mod['type'] >= ADMIN && $config['check_updates']) { + if(!$config['version']) + error(_('Could not find current version! (Check .installed)')); + if(isset($_COOKIE['update'])) { + $latest = unserialize($_COOKIE['update']); + } else { + $ctx = stream_context_create(array( + 'http' => array( + 'timeout' => 3 + ) + ) + ); + + if($code = @file_get_contents('http://tinyboard.org/version.txt', 0, $ctx)) { + eval($code); + if(preg_match('/v(\d+)\.(\d)\.(\d+)(-dev.+)?$/', $config['version'], $m)) { + $current = array( + 'massive' => (int)$m[1], + 'major' => (int)$m[2], + 'minor' => (int)$m[3] + ); + if(isset($m[4])) { + // Development versions are always ahead in the versioning numbers + $current['minor'] --; + } + } + // Check if it's newer + if( $latest['massive'] > $current['massive'] || + $latest['major'] > $current['major'] || + ($latest['massive'] == $current['massive'] && + $latest['major'] == $current['major'] && + $latest['minor'] > $current['minor'] + )) { + $latest = $latest; + } else $latest = false; + } else { + // Couldn't get latest version + // TODO: Display some sort of warning message + $latest = false; + } + + + setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true); + } + + if($latest) { + $fieldset['Update'] .= + '<li>A newer version of Tinyboard (<strong>v' . + $latest['massive'] . '.' . + $latest['major'] . '.' . + $latest['minor'] . + '</strong>) is available! See <a href="http://tinyboard.org">http://tinyboard.org/</a> for upgrade instructions.</li>'; + } + } + + $fieldset['Logout'] .= '<li><a href="?/logout">' . _('Logout') . '</a></li>'; + + // TODO: Statistics, etc, in the dashboard. + + $body = ''; + foreach($fieldset as $title => $data) { + if($data) + $body .= '<fieldset><legend>' . _($title) . '</legend><ul>' . $data . '</ul></fieldset>'; + } + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Dashboard'), + 'body'=>$body, + '__mod'=>true + )); + } elseif(preg_match('/^\/logout$/', $query)) { + destroyCookies(); + + header('Location: ?/', true, $config['redirect_http']); + } elseif(preg_match('/^\/confirm\/(.+)$/', $query, $matches)) { + $uri = &$matches[1]; + + $body = '<p style="text-align:center">' . + '<span class="heading" style="margin-bottom:6px">Are you sure you want to do that?</span>' . + 'We were unable to serve a confirmation dialog for ' . + '<strong>?/' . utf8tohtml($uri) . '</strong>' . + ', probably due to Javascript being disabled.' . + '</p>' . + '<p style="text-align:center"><a style="margin:block;font-size:150%;font-weight:bold" href="?/' . utf8tohtml($uri) . '">Confirm</a></p>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Confirm', + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/upgrade$/', $query)) { + if($mod['type'] != ADMIN) + error($config['error']['noaccess']); + + if(is_dir('.git')) { + // use git instead + + $body = '<div class="ban"><h2>git pull</h2>'; + $body .= '<p>' . str_replace("\n", '<br/>', shell_exec('git pull')) . '</p>'; + $body .= '</div>'; + echo Element('page.html', array( + 'config' => $config, + 'title' => 'Upgraded', + 'body' => $body + )); + exit; + } + + if(!extension_loaded('curl')) + error('You need the cURL PHP extension to do that.'); + + if(!class_exists('ZipArchive')) + error('You need <a href="http://php.net/manual/en/class.ziparchive.php">the ZipArchive class</a> to do that.'); + + if(!in_array('zip', stream_get_wrappers())) + error('You need the zip:// stream wrapper to do that.'); + + $temp = tempnam($config['tmp'], 'tinyboard'); + + $fp = fopen($temp, 'w+'); + + $curl = curl_init(); + curl_setopt($curl, CURLOPT_URL, 'https://github.com/savetheinternet/Tinyboard/zipball/master'); + curl_setopt($curl, CURLOPT_FAILONERROR, true); + curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true); + curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, true); + curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2); + curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 5); + curl_setopt($curl, CURLOPT_TIMEOUT, 45); + curl_setopt($curl, CURLOPT_FILE, $fp); + curl_setopt($curl, CURLOPT_WRITEHEADER, $header = tmpfile()); + curl_setopt($curl, CURLOPT_HEADER, true); + + curl_exec($curl); + + if(curl_errno($curl)) + error('Failed downloading newest revision: ' . curl_error($curl)); + + curl_close($curl); + + fflush($fp); + fclose($fp); + + fseek($header, 0); + $version = false; + while($line = fgets($header)) { + if(preg_match('/^Content-Disposition: attachment; filename=savetheinternet-Tinyboard-(.+)\.zip\s?$/', $line, $m)) { + $version = $m[1]; + } + } + fclose($header); + + $zip = new ZipArchive(); + if(!$zip->open($temp)) + error('Could not make sense of the ZIP archive.'); + + $version = preg_replace('/^savetheinternet-Tinyboard-(\w+)\//', '$1', $dir = $zip->getNameIndex(0)); + + $errors = array(); + for($i = 1; $i < $zip->numFiles; $i++) { + $filename = str_replace($dir, '', $zip->getNameIndex($i)); + + if($filename == 'inc/instance-config.php') + continue; // don't override config + + // are we able to write here? + if(!((file_exists($filename) && is_writable($filename)) || (!file_exists($filename) && is_writable(dirname($filename))))) { + // nope + $errors[] = 'Cannot write to ' . $filename . '!'; + } + } + + $zip->close(); + + if($errors) { + $body = '<div class="ban"><h2>Error(s) upgrading</h2><p>Tinyboard can not self-upgrade until the following is fixed:</p><ul>'; + foreach($errors as $error) { + $body .= '<li>' . $error . '</li>'; + } + $body .= '</ul><p>Please fix the above errors and refresh to try again.</p></div>'; + + unlink($temp); + + echo Element('page.html', array( + 'config' => $config, + 'title' => 'Error(s) upgrading', + 'body' => $body + )); + exit; + } + + // For some reason, reading the ZIP entries in PHP doesn't seem to work very well. + // Use shell instead. + shell_exec('TEMP_DIR=$(mktemp -d); unzip -q ' . escapeshellarg($temp) . ' -d $TEMP_DIR -x "' . escapeshellarg($dir) . 'inc/instance-config.php"; mv -v $TEMP_DIR/' . escapeshellarg($dir) . '* "' . getcwd() . '"; rm -rf $TEMP_DIR'); + + unlink($temp); + + echo Element('page.html', array( + 'config' => $config, + 'title' => 'Upgraded', + 'body' => '<p style="text-align:center">Upgrading seems to have gone okay. You are now at revision <strong>' . $version . '</strong>.</p>' + )); + } elseif(preg_match('/^\/log(\/(\d+))?$/', $query, $match)) { + if(!hasPermission($config['mod']['modlog'])) error($config['error']['noaccess']); + + $page = isset($match[2]) ? $match[2] : 1; + + $boards = array(); + $_boards = listBoards(); + foreach($_boards as &$_b) { + $boards[$_b['id']] = $_b['uri']; + } + + $query = prepare("SELECT `mod` as `id`, `username`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY `time` DESC LIMIT :offset, :limit"); + $query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT); + $query->bindValue(':offset', ($page - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if(!$query->rowCount()) { + $body = '<p class="unimportant" style="text-align:center">(Nothing to display.)</p>'; + } else { + $body = '<table class="modlog">' . + '<tr>' . + '<th>' . _('User') . '</th>' . + '<th>' . _('IP address') . '</th>' . + '<th>' . _('Ago') . '</th>' . + '<th>' . _('Board') . '</th>' . + '<th>' . _('Action') . '</th>' . + '</tr>'; + while($log = $query->fetch()) { + $log_id = 'log_' . md5($log['text']); + + if($config['cache']['enabled'] && $_log = cache::get($log_id)) + $log['text'] = $_log; + else { + + $log['text'] = utf8tohtml($log['text']); + $log['text'] = preg_replace('/(\d+\.\d+\.\d+\.\d+)/', '<a href="?/IP/$1">$1</a>', $log['text']); + + if(isset($boards[$log['board']])) { + if(preg_match('/post #(\d+)/', $log['text'], $match)) { + $post_query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $boards[$log['board']])); + $post_query->bindValue(':id', $match[1], PDO::PARAM_INT); + $post_query->execute() or error(db_error($query)); + + if($post = $post_query->fetch()) { + $log['text'] = preg_replace('/post (#(\d+))/', + 'post <a href="' . + '?/' . + sprintf($config['board_path'], $boards[$log['board']]) . + $config['dir']['res'] . + ($post['thread'] ? + sprintf($config['file_page'], $post['thread']) . '#' . $match[1] + : sprintf($config['file_page'], $match[1])) . + '">$1</a>', $log['text']); + } else { + $log['text'] = preg_replace('/post (#(\d+))/', 'post <s>$1</s>', $log['text']); + } + + if($config['cache']['enabled']) + cache::set($log_id, $log['text']); + } + } + } + + $body .= '<tr>' . + '<td class="minimal">' . + ($log['username'] ? + '<a href="?/new_PM/' . $log['id'] . '">' . $log['username'] . '</a>' + : '<em>' . ($log['id'] < 0 ? 'system' : 'deleted?') . '</em>') . + '</td>' . + '<td class="minimal">' . ($log['id'] < 0 ? '–' : '<a href="?/IP/' . $log['ip'] . '">' . $log['ip'] . '</a>') . '</td>' . + '<td class="minimal">' . ago($log['time']) . '</td>' . + '<td class="minimal">' . + ($log['board'] ? + '<a href="?/' . sprintf($config['board_path'], $log['board']) . $config['file_index'] . '">' . sprintf($config['board_abbreviation'], $log['board']) . '</a></td>' + : '-') . + '<td>' . $log['text'] . '</td>' . + '</tr>'; + } + + $body .= '</table>'; + + $query = prepare("SELECT COUNT(*) AS `count` FROM `modlogs`"); + $query->execute() or error(db_error($query)); + $count = $query->fetch(); + + $body .= '<p class="unimportant" style="text-align:center;word-wrap:break-word">'; + for($x = 0; $x < $count['count'] / $config['mod']['modlog_page']; $x ++) { + $body .= '<a href="?/log/' . ($x+1) . '">[' . ($x + 1) . ']</a> '; + } + $body .= '</p>'; + } + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Moderation log'), + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/themes\/none$/', $query, $match)) { + if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); + + // Clearsettings + query("TRUNCATE TABLE `theme_settings`") or error(db_error()); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'No theme', + 'body'=>'<p style="text-align:center">Successfully uninstalled all themes.</p>' . + '<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>', + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/themes\/([\w\-]+)\/rebuild$/', $query, $match)) { + if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); + + rebuildTheme($match[1], 'all'); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Rebuilt', + 'body'=>'<p style="text-align:center">Successfully rebuilt the <strong>' . $match[1] . '</strong> theme.</p>' . + '<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>', + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/themes\/(\w+)\/uninstall$/', $query, $match)) { + if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); + + $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query->bindValue(':theme', $match[1]); + $query->execute() or error(db_error($query)); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Uninstalled', + 'body'=>'<p style="text-align:center">Successfully uninstalled the <strong>' . $match[1] . '</strong> theme.</p>' . + '<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>', + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/themes(\/([\w\-]+))?$/', $query, $match)) { + if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); + + if(!is_dir($config['dir']['themes'])) + error(_('Themes directory doesn\'t exist!')); + if(!$dir = opendir($config['dir']['themes'])) + error(_('Cannot open themes directory; check permissions.')); + + if(isset($match[2])) { + $_theme = &$match[2]; + + if(!$theme = loadThemeConfig($_theme)) { + error($config['error']['invalidtheme']); + } + + if(isset($_POST['install'])) { + // Check if everything is submitted + foreach($theme['config'] as &$c) { + if(!isset($_POST[$c['name']]) && $c['type'] != 'checkbox') + error(sprintf($config['error']['required'], $c['title'])); + } + + // Clear previous settings + $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query->bindValue(':theme', $_theme); + $query->execute() or error(db_error($query)); + + foreach($theme['config'] as &$c) { + $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, :name, :value)"); + $query->bindValue(':theme', $_theme); + $query->bindValue(':name', $c['name']); + $query->bindValue(':value', $_POST[$c['name']]); + $query->execute() or error(db_error($query)); + } + + $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, NULL, NULL)"); + $query->bindValue(':theme', $_theme); + $query->execute() or error(db_error($query)); + + $result = true; + $body = ''; + if(isset($theme['install_callback'])) { + $ret = $theme['install_callback'](themeSettings($_theme)); + if($ret && !empty($ret)) { + if(is_array($ret) && count($ret) == 2) { + $result = $ret[0]; + $ret = $ret[1]; + } + $body .= '<div style="border:1px dashed maroon;padding:20px;margin:auto;max-width:800px">' . $ret . '</div>'; + } + } + + if($result) { + $body .= '<p style="text-align:center">Successfully installed and built theme.</p>'; + } else { + // install failed + $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query->bindValue(':theme', $_theme); + $query->execute() or error(db_error($query)); + } + + $body .= '<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>'; + + // Build themes + rebuildThemes('all'); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>($result ? 'Installed "' . utf8tohtml($theme['name']) . '"' : 'Installation failed!'), + 'body'=>$body, + 'mod'=>true + ) + ); + } else { + $body = '<form action="" method="post">'; + + if(!isset($theme['config']) || empty($theme['config'])) { + $body .= '<p style="text-align:center" class="unimportant">(No configuration required.)</p>'; + } else { + $settings = themeSettings($_theme); + + $body .= '<table>'; + foreach($theme['config'] as &$c) { + $body .= '<tr><th>' . $c['title'] . '</th><td>'; + switch($c['type']) { + case 'text': + default: + $body .= '<input type="text" name="' . utf8tohtml($c['name']) . '" ' . + (isset($settings[$c['name']]) ? + ' value="' . utf8tohtml($settings[$c['name']]) . '" ' + : + (isset($c['default']) ? + 'value="' . utf8tohtml($c['default']) . '" ' + : '') + ) . + (isset($c['size']) ? 'size="' . (int)$c['size'] . '" ' :'') . + '/>'; + } + if(isset($c['comment'])) + $body .= ' <span class="unimportant">' . $c['comment'] . '</span>'; + $body .= '</td></tr>'; + } + $body .= '</table>'; + } + + $body .= '<p style="text-align:center"><input name="install" type="submit" value="Install theme" /></p></form>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Installing "' . utf8tohtml($theme['name']) . '"', + 'body'=>$body, + 'mod'=>true + ) + ); + } + } else { + + $themes_in_use = array(); + $query = query("SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error()); + while($theme = $query->fetch()) { + $themes_in_use[$theme['theme']] = true; + } + + // Scan directory for themes + $themes = array(); + while($file = readdir($dir)) { + if($file[0] != '.' && is_dir($config['dir']['themes'] . '/' . $file)) { + $themes[] = $file; + } + } + closedir($dir); + + $body = ''; + if(empty($themes)) { + $body = '<p style="text-align:center" class="unimportant">(No themes installed.)</p>'; + } else { + $body .= '<table class="modlog">'; + foreach($themes as &$_theme) { + $theme = loadThemeConfig($_theme); + + markup($theme['description']); + + $body .= '<tr>' . + '<th class="minimal">' . _('Name') . '</th>' . + '<td>' . utf8tohtml($theme['name']) . '</td>' . + '</tr>' . + '<tr>' . + '<th class="minimal">' . _('Version') . '</th>' . + '<td>' . utf8tohtml($theme['version']) . '</td>' . + '</tr>' . + '<tr>' . + '<th class="minimal">' . _('Description') . '</th>' . + '<td>' . $theme['description'] . '</td>' . + '</tr>' . + '<tr>' . + '<th class="minimal">' . _('Thumbnail') . '</th>' . + '<td><img style="float:none;margin:4px' . + (isset($themes_in_use[$_theme]) ? + ';border:2px solid red;padding:4px' + : '') . + '" src="' . $config['dir']['themes_uri'] . '/' . $_theme . '/thumb.png" /></td>' . + '</tr>' . + '<tr>' . + '<th class="minimal">' . _('Actions') . '</th>' . + '<td><ul style="padding:0 20px">' . + '<li><a title="' . _('Use theme') . '" href="?/themes/' . $_theme . '">' . + (isset($themes_in_use[$_theme]) ? _('Reconfigure') : _('Install')) . + '</a></li>' . + (isset($themes_in_use[$_theme]) ? + '<li><a href="?/themes/' . $_theme . '/rebuild">' . _('Rebuild') . '</a></li>' . + '<li><a href="?/themes/' . $_theme . '/uninstall">' . _('Uninstall') . '</a></li>' + : + '') . + '</ul></td>' . + '</tr>' . + '<tr style="height:40px"><td colspan="2"><hr/></td></tr>'; + } + $body .= '</table>'; + } + + if(!empty($themes_in_use)) + $body .= '<p style="text-align:center"><a href="?/themes/none">' . _('Uninstall all themes.') . '</a></p>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Manage themes'), + 'body'=>$body, + 'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/noticeboard\/delete\/(\d+)$/', $query, $match)) { + if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']); + + $query = prepare("DELETE FROM `noticeboard` WHERE `id` = :id"); + $query->bindValue(':id', $match[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($config['cache']['enabled']) + cache::delete('noticeboard_preview'); + + header('Location: ?/noticeboard', true, $config['redirect_http']); + } elseif(preg_match('/^\/noticeboard$/', $query)) { + if(!hasPermission($config['mod']['noticeboard'])) error($config['error']['noaccess']); + + $body = ''; + + if(hasPermission($config['mod']['noticeboard_post']) && isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) { + $query = prepare("INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)"); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + $query->bindvalue(':time', time(), PDO::PARAM_INT); + $query->bindValue(':subject', utf8tohtml($_POST['subject'])); + + markup($_POST['body']); + $query->bindValue(':body', $_POST['body']); + $query->execute() or error(db_error($query)); + + if($config['cache']['enabled']) + cache::delete('noticeboard_preview'); + + header('Location: ?/noticeboard#' . $pdo->lastInsertId(), true, $config['redirect_http']); + } else { + + if(hasPermission($config['mod']['noticeboard_post'])) { + $body .= '<fieldset><legend>New post</legend><form style="display:inline" action="" method="post"><table>' . + '<tr>' . + '<th><label for="subject">' . _('Name') . '</label></th>' . + '<td>' . $mod['username'] . '</td>' . + '</tr><tr>' . + '<th>' . _('Subject') . '</th>' . + '<td><input type="text" size="55" name="subject" id="subject" /></td>' . + '</tr><tr>' . + '<th>' . _('Body') . '</th>' . + '<td><textarea name="body" style="width:100%;height:100px"></textarea></td>' . + '</tr><tr>' . + '<td></td><td><input type="submit" value="' . _('Post to noticeboard') . '" /></td>' . + '</tr></table>' . + '</form></fieldset>'; + } + + $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); + $query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + while($notice = $query->fetch()) { + $body .= '<div class="ban">' . + (hasPermission($config['mod']['noticeboard_delete']) ? + '<span style="float:right;padding:2px"><a class="unimportant" href="?/noticeboard/delete/' . $notice['id'] . '">[delete]</a></span>' + : '') . + '<h2 id="' . $notice['id'] . '">' . + ($notice['subject'] ? + $notice['subject'] + : + '<em>' . _('no subject') . '</em>' + ) . + '<span class="unimportant"> — by ' . + (isset($notice['username']) ? + utf8tohtml($notice['username']) + : + '<em>???</em>' + ) . + ' at ' . + strftime($config['post_date'], $notice['time']) . + '</span></h2><p>' . $notice['body'] . '</p></div>'; + } + + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Noticeboard'), + 'body'=>$body, + 'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/news\/delete\/(\d+)$/', $query, $match)) { + if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']); + + $query = prepare("DELETE FROM `news` WHERE `id` = :id"); + $query->bindValue(':id', $match[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + rebuildThemes('news'); + + header('Location: ?/news', true, $config['redirect_http']); + } elseif(preg_match('/^\/news$/', $query)) { + $body = ''; + + if(hasPermission($config['mod']['news'])) { + if(isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) { + $query = prepare("INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)"); + + if(isset($_POST['name']) && hasPermission($config['mod']['news_custom'])) + $name = &$_POST['name']; + else + $name = &$mod['username']; + + $query->bindValue(':name', utf8tohtml($name), PDO::PARAM_INT); + $query->bindvalue(':time', time(), PDO::PARAM_INT); + $query->bindValue(':subject', utf8tohtml($_POST['subject'])); + + markup($_POST['body']); + $query->bindValue(':body', $_POST['body']); + $query->execute() or error(db_error($query)); + + rebuildThemes('news'); + } + + $body .= '<fieldset><legend>New post</legend><form style="display:inline" action="" method="post"><table>' . + '<tr>' . + '<th>' . _('Name') . '</th>' . + (hasPermission($config['mod']['news_custom']) ? + '<td><input type="text" size="55" name="name" id="name" value="' . utf8tohtml($mod['username']) . '" /></td>' + : + '<td>' . $mod['username'] . '</td>') . + '</tr><tr>' . + '<th>' . _('Subject') . '</th>' . + '<td><input type="text" size="55" name="subject" id="subject" /></td>' . + '</tr><tr>' . + '<th>' . _('Body') . '</th>' . + '<td><textarea name="body" style="width:100%;height:100px"></textarea></td>' . + '</tr><tr>' . + '<td></td><td><input type="submit" value="' . _('Post to news') . '" /></td>' . + '</tr></table>' . + '</form></fieldset>'; + } + + $query = prepare("SELECT * FROM `news` ORDER BY `id` DESC LIMIT :limit"); + $query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + while($news = $query->fetch()) { + $body .= '<div class="ban">' . + (hasPermission($config['mod']['news_delete']) ? + '<span style="float:right;padding:2px"><a class="unimportant" href="?/news/delete/' . $news['id'] . '">[delete]</a></span>' + : '') . + '<h2 id="' . $news['id'] . '">' . + ($news['subject'] ? + $news['subject'] + : + '<em>' . _('no subject') . '</em>' + ) . + '<span class="unimportant"> — by ' . + $news['name'] . + ' at ' . + strftime($config['post_date'], $news['time']) . + '</span></h2><p>' . $news['body'] . '</p></div>'; + } + + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('News'), + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/inbox\/readall$/', $query, $match)) { + $query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `to` = :id"); + $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + modLog('Marked all PMs as read'); + + header('Location: ?/inbox', true, $config['redirect_http']); + } elseif(preg_match('/^\/inbox$/', $query, $match)) { + $query = prepare("SELECT `unread`,`pms`.`id`, `time`, `sender`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC"); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($query->rowCount() == 0) { + $body = '<p style="text-align:center" class="unimportant">(' . _('No private messages for you.') . ')</p>'; + } else { + $unread_pms = 0; + + $body = '<table class="modlog"><tr><th>ID</th><th>From</th><th>Date</th><th>Message snippet</th></tr>'; + while($pm = $query->fetch()) { + $body .= '<tr' . ($pm['unread'] ? ' style="font-weight:bold"' : '') . '>' . + '<td class="minimal"><a href="?/PM/' . $pm['id'] . '">' . $pm['id'] . '</a></td>' . + '<td class="minimal">' . + ($pm['username'] ? + '<a href="?/new_PM/' . $pm['sender'] . '">' . $pm['username'] . '</a>' + : '<em>deleted?</em>') . + '</td>' . + '<td class="minimal">' . strftime($config['post_date'], $pm['time']) . '</td>' . + '<td><a href="?/PM/' . $pm['id'] . '">' . pm_snippet($pm['message']) . '</a></td>' . + '</tr>'; + + if($pm['unread']) + $unread_pms++; + } + $body .= '</table>'; + + if($unread_pms) { + $body = '<p style="text-align:center" class="unimportant">(<a href="?/inbox/readall">Mark all as read</a>)</p>' . $body; + } + } + + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('PM Inbox') . ' (' . ($query->rowCount() == 0 ? _('empty') : $unread_pms . ' ' . _('unread')) . ')', + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/PM\/(\d+)$/', $query, $match)) { + $id = &$match[1]; + + if(hasPermission($config['mod']['master_pm'])) { + $query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id"); + } else { + $query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id AND `to` = :mod"); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + } + + $query->bindValue(':id', $id, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if(!$pm = $query->fetch()) { + // Mod doesn't exist + error($config['error']['404']); + } + + if(isset($_POST['delete'])) { + $query = prepare("DELETE FROM `pms` WHERE `id` = :id"); + $query->bindValue(':id', $id, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + modLog('Deleted a PM'); + + header('Location: ?/inbox', true, $config['redirect_http']); + } else { + if($pm['unread']) { + $query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `id` = :id"); + $query->bindValue(':id', $id, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + modLog('Read a PM'); + } + + if($pm['to'] != $mod['id']) { + $query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id"); + $query->bindValue(':id', $pm['to'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($_mod = $query->fetch()) { + $__to = &$_mod['username']; + } else { + $__to = false; + } + } + + $body = '<form action="" method="post" style="margin:0"><table>' . + + '<th>From</th><td>' . + (!$pm['username'] ? + '<em>???</em>' + : + '<a href="?/new_PM/' . $pm['sender'] . '">' . utf8tohtml($pm['username']) . '</a>' + ) . + '</td></tr>' . + + (isset($__to) ? + '<th>To</th><td>' . + ($__to === false ? + '<em>???</em>' + : + '<a href="?/new_PM/' . $pm['to'] . '">' . utf8tohtml($__to) . '</a>' + ) . + '</td></tr>' + : '') . + + '<tr><th>Date</th><td> ' . strftime($config['post_date'], $pm['time']) . '</td></tr>' . + + '<tr><th>Message</th><td> ' . $pm['message'] . '</td></tr>' . + + '</table>' . + + '<p style="text-align:center"><input type="submit" name="delete" value="Delete forever" /></p>' . + + '</form>' . + + '<p style="text-align:center"><a href="?/new_PM/' . $pm['sender'] . '/' . $pm['id'] . '">Reply with quote</a></p>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Private message', + 'body'=>$body, + 'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/new_PM\/(\d+)(\/(\d+))?$/', $query, $match)) { + if(!hasPermission($config['mod']['create_pm'])) error($config['error']['noaccess']); + + $to = &$match[1]; + + $query = prepare("SELECT `username`,`id` FROM `mods` WHERE `id` = :id"); + $query->bindValue(':id', $to, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if(!$to = $query->fetch()) { + // Mod doesn't exist + error($config['error']['404']); + } + + if(isset($_POST['message'])) { + // Post message + $message = &$_POST['message']; + + if(empty($message)) + error($config['error']['tooshort_body']); + + markup($message); + + $query = prepare("INSERT INTO `pms` VALUES (NULL, :sender, :to, :message, :time, 1)"); + $query->bindValue(':sender', $mod['id'], PDO::PARAM_INT); + $query->bindValue(':to', $to['id'], PDO::PARAM_INT); + $query->bindValue(':message', $message); + $query->bindValue(':time', time(), PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + modLog('Sent a PM to ' . $to['username']); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'PM sent', + 'body'=>'<p style="text-align:center">Message sent successfully to ' . utf8tohtml($to['username']) . '.</p>', + 'mod'=>true + ) + ); + } else { + $value = ''; + if(isset($match[3])) { + $reply = &$match[3]; + + $query = prepare("SELECT `message` FROM `pms` WHERE `sender` = :sender AND `to` = :mod AND `id` = :id"); + $query->bindValue(':sender', $to['id'], PDO::PARAM_INT); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + $query->bindValue(':id', $reply, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + if($pm = $query->fetch()) { + $value = quote($pm['message']); + } + } + + + $body = '<form action="" method="post">' . + + '<table>' . + + '<tr><th>To</th><td>' . + (hasPermission($config['mod']['editusers']) ? + '<a href="?/users/' . $to['id'] . '">' . utf8tohtml($to['username']) . '</a>' : + utf8tohtml($to['username']) + ) . + '</td>' . + + '<tr><th>Message</th><td><textarea name="message" rows="10" cols="40">' . $value . '</textarea></td>' . + + '</table>' . + + '<p style="text-align:center"><input type="submit" value="Send message" /></p>' . + + '</form>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'New PM for ' . utf8tohtml($to['username']), + 'body'=>$body, + 'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/search$/', $query)) { + if(!hasPermission($config['mod']['search'])) error($config['error']['noaccess']); + + $body = '<div class="ban"><h2>Search</h2><form style="display:inline" action="?/search" method="post">' . + '<p><label style="display:inline" for="search">Phrase:</label> ' . + '<input id="search" name="search" type="text" size="35" ' . + (isset($_POST['search']) ? 'value="' . str_replace('"', '"', utf8tohtml($_POST['search'])) . '" ' : '') . + '/>' . + '<input type="submit" value="Search" />' . + '</p></form>' . + '<p><span class="unimportant">(Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)</span></p>' . + '</div>'; + + if(isset($_POST['search']) && !empty($_POST['search'])) { + $phrase = &$_POST['search']; + $_body = ''; + + $filters = array(); + + function search_filters($m) { + global $filters; + $name = $m[2]; + $value = isset($m[4]) ? $m[4] : $m[3]; + + if(!in_array($name, array('id', 'thread', 'subject', 'email', 'name', 'trip', 'capcode', 'filename', 'filehash', 'ip'))) { + // unknown filter + return $m[0]; + } + + $filters[$name] = $value; + + return $m[1]; + } + + $phrase = trim(preg_replace_callback('/(^|\s)(\w+):("(.*)?"|[^\s]*)/', 'search_filters', $phrase)); + + // Escape escape character + $phrase = str_replace('!', '!!', $phrase); + + // Remove SQL wildcard + $phrase = str_replace('%', '!%', $phrase); + + // Use asterisk as wildcard to suit convention + $phrase = str_replace('*', '%', $phrase); + + $like = ''; + $match = array(); + + // Find exact phrases + if(preg_match_all('/"(.+?)"/', $phrase, $m)) { + foreach($m[1] as &$quote) { + $phrase = str_replace("\"{$quote}\"", '', $phrase); + $match[] = $pdo->quote($quote); + } + } + + $words = explode(' ', $phrase); + foreach($words as &$word) { + if(empty($word)) + continue; + $match[] = $pdo->quote($word); + } + + $like = ''; + foreach($match as &$phrase) { + if(!empty($like)) + $like .= ' AND '; + $phrase = preg_replace('/^\'(.+)\'$/', '\'%$1%\'', $phrase); + $like .= '`body` LIKE ' . $phrase . ' ESCAPE \'!\''; + } + + foreach($filters as $name => $value) { + if(!empty($like)) + $like .= ' AND '; + $like .= '`' . $name . '` = '. $pdo->quote($value); + } + + $like = str_replace('%', '%%', $like); + + $boards = listBoards(); + foreach($boards as &$_b) { + openBoard($_b['uri']); + + $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE " . $like . " ORDER BY `time` DESC LIMIT :limit", $board['uri'])); + $query->bindValue(':limit', $config['mod']['search_results'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + $temp = ''; + while($post = $query->fetch()) { + if(!$post['thread']) { + $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); + } else { + $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); + } + $temp .= $po->build(true) . '<hr/>'; + } + + if(!empty($temp)) + $_body .= '<fieldset><legend>' . $query->rowCount() . ' result' . ($query->rowCount() != 1 ? 's' : '') . ' on <a href="?/' . + sprintf($config['board_path'], $board['uri']) . $config['file_index'] . + '">' . + sprintf($config['board_abbreviation'], $board['uri']) . ' - ' . $board['title'] . + '</a></legend>' . $temp . '</fieldset>'; + } + + $body .= '<hr/>'; + if(!empty($_body)) + $body .= $_body; + else + $body .= '<p style="text-align:center" class="unimportant">(No results.)</p>'; + } + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Search', + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/users$/', $query)) { + if(!hasPermission($config['mod']['manageusers'])) error($config['error']['noaccess']); + + $body = '<form action="" method="post"><table class="modlog" style="width:auto"><tr><th>' . _('ID') . '</th><th>' . _('Username') . '</th><th>' . _('Type') . '</th><th>' . _('Boards') . '</th><th>' . _('Last action') . '</th><th>…</th></tr>'; + + $query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error()); + while($_mod = $query->fetch()) { + $type = $_mod['type'] == JANITOR ? 'Janitor' : ($_mod['type'] == MOD ? 'Mod' : 'Admin'); + + $_mod['boards'] = explode(',', $_mod['boards']); + foreach($_mod['boards'] as &$_board) { + if($_board != '*') + $_board = '/' . $_board . '/'; + } + + $body .= '<tr>' . + '<td>' . + $_mod['id'] . + '</td>' . + + '<td>' . + utf8tohtml($_mod['username']) . + '</td>' . + + '<td>' . + $type . + '</td>' . + + '<td>' . + implode(', ', $_mod['boards']) . + '</td>' . + + '<td>' . + ($_mod['last'] ? + (hasPermission($config['mod']['modlog']) ? + '<span title="' . str_replace('"', '"', utf8tohtml($_mod['action'])) . '">' . ago($_mod['last']) . '</span>' + : ago($_mod['last'])) + : '<em>never</em>') . + '</td>' . + + '<td style="white-space:nowrap">' . + (hasPermission($config['mod']['promoteusers']) ? + ($_mod['type'] != ADMIN ? + '<a style="float:left;text-decoration:none" href="?/users/' . $_mod['id'] . '/promote" title="Promote">▲</a>' + :'') . + ($_mod['type'] != JANITOR ? + '<a style="float:left;text-decoration:none" href="?/users/' . $_mod['id'] . '/demote" title="Demote">▼</a>' + :'') + : '' + ) . + (hasPermission($config['mod']['editusers']) || + (hasPermission($config['mod']['change_password']) && $_mod['id'] == $mod['id'])? + '<a class="unimportant" style="margin-left:5px;float:right" href="?/users/' . $_mod['id'] . '">[edit]</a>' + : '' ) . + (hasPermission($config['mod']['create_pm']) ? + '<a class="unimportant" style="margin-left:5px;float:right" href="?/new_PM/' . $_mod['id'] . '">[PM]</a>' + : '' ) . + '</td></tr>'; + } + + $body .= '</table>'; + + if(hasPermission($config['mod']['createusers'])) { + $body .= '<p style="text-align:center"><a href="?/users/new">' . _('Create new user') . '</a></p>'; + } + + $body .= '</form>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Manage users'), + 'body'=>$body + ,'mod'=>true + ) + ); + } elseif(preg_match('/^\/users\/new$/', $query)) { + if(!hasPermission($config['mod']['createusers'])) error($config['error']['noaccess']); + + if(isset($_POST['username']) && isset($_POST['password'])) { + if(!isset($_POST['type'])) { + error(sprintf($config['error']['required'], 'type')); + } + + if($_POST['type'] != ADMIN && $_POST['type'] != MOD && $_POST['type'] != JANITOR) { + error(sprintf($config['error']['invalidfield'], 'type')); + } + + // Check if already exists + $query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username"); + $query->bindValue(':username', $_POST['username']); + $query->execute() or error(db_error($query)); + + if($_mod = $query->fetch()) { + error(sprintf($config['error']['modexists'], $_mod['id'])); + } + + $boards = array(); + foreach($_POST as $name => $null) { + if(preg_match('/^board_(.+)$/', $name, $m)) + $boards[] = $m[1]; + } + $boards = implode(',', $boards); + + $query = prepare("INSERT INTO `mods` VALUES (NULL, :username, :password, :type, :boards)"); + $query->bindValue(':username', $_POST['username']); + $query->bindValue(':password', sha1($_POST['password'])); + $query->bindValue(':type', $_POST['type'], PDO::PARAM_INT); + $query->bindValue(':boards', $boards); + $query->execute() or error(db_error($query)); + + modLog('Create a new user: "' . $_POST['username'] . '"'); + header('Location: ?/users', true, $config['redirect_http']); + } else { + + $__boards = '<ul style="list-style:none;padding:2px 5px">'; + $boards = array_merge( + array(array('uri' => '*', 'title' => 'All') + ), listBoards()); + foreach($boards as &$_board) { + $__boards .= '<li>' . + '<input type="checkbox" name="board_' . $_board['uri'] . '" id="board_' . $_board['uri'] . '">' . + '<label style="display:inline" for="board_' . $_board['uri'] . '"> ' . + ($_board['uri'] == '*' ? + '<em>"*"</em>' + : + sprintf($config['board_abbreviation'], $_board['uri']) + ) . + ' - ' . $_board['title'] . + '</label>' . + '</li>'; + } + + $body = '<fieldset><legend>New user</legend>' . + + // Begin form + '<form style="text-align:center" action="" method="post">' . + + '<table>' . + + '<tr><th>Username</th><td><input size="20" maxlength="30" type="text" name="username" value="" autocomplete="off" /></td></tr>' . + '<tr><th>Password</th><td><input size="20" maxlength="30" type="password" name="password" value="" autocomplete="off" /></td></tr>' . + '<tr><th>Type</th><td>' . + '<div><label for="janitor">Janitor</label> <input type="radio" id="janitor" name="type" value="' . JANITOR . '" /></div>' . + '<div><label for="mod">Mod</label> <input type="radio" id="mod" name="type" value="' . MOD . '" /></div>' . + '<div><label for="admin">Admin</label> <input type="radio" id="admin" name="type" value="' . ADMIN . '" /></div>' . + '</td></tr>' . + '<tr><th>Boards</th><td>' . $__boards . '</td></tr>' . + '</table>' . + + '<input style="margin-top:10px" type="submit" value="Create user" />' . + + // End form + '</form></fieldset>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'New user', + 'body'=>$body + ,'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/users\/(\d+)(\/(promote|demote|delete))?$/', $query, $matches)) { + $modID = &$matches[1]; + + if(isset($matches[2])) { + if($matches[3] == 'delete') { + if(!hasPermission($config['mod']['deleteusers'])) error($config['error']['noaccess']); + + $query = prepare("DELETE FROM `mods` WHERE `id` = :id"); + $query->bindValue(':id', $modID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + modLog('Deleted user #' . $modID); + } else { + // Promote/demote + if(!hasPermission($config['mod']['promoteusers'])) error($config['error']['noaccess']); + + if($matches[3] == 'promote') { + $query = prepare("UPDATE `mods` SET `type` = `type` + 1 WHERE `type` != :admin AND `id` = :id"); + $query->bindValue(':admin', ADMIN, PDO::PARAM_INT); + } else { + $query = prepare("UPDATE `mods` SET `type` = `type` - 1 WHERE `type` != :janitor AND `id` = :id"); + $query->bindValue(':janitor', JANITOR, PDO::PARAM_INT); + } + + $query->bindValue(':id', $modID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } + header('Location: ?/users', true, $config['redirect_http']); + } else { + // Edit user + if(!hasPermission($config['mod']['editusers']) && !hasPermission($config['mod']['change_password'])) + error($config['error']['noaccess']); + + $query = prepare("SELECT * FROM `mods` WHERE `id` = :id"); + $query->bindValue(':id', $modID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if(!$_mod = $query->fetch()) { + error($config['error']['404']); + } + + if(!hasPermission($config['mod']['editusers']) && !(hasPermission($config['mod']['change_password']) && $mod['id'] == $_mod['id'] && $change_password_only = true)) + error($config['error']['noaccess']); + + if((isset($_POST['username']) && isset($_POST['password'])) || (isset($change_password_only) && isset($_POST['password']))) { + if(!isset($change_password_only)) { + $boards = array(); + foreach($_POST as $name => $null) { + if(preg_match('/^board_(.+)$/', $name, $m)) + $boards[] = $m[1]; + } + $boards = implode(',', $boards); + + $query = prepare("UPDATE `mods` SET `username` = :username, `boards` = :boards WHERE `id` = :id"); + $query->bindValue(':username', $_POST['username'], PDO::PARAM_STR); + $query->bindValue(':boards', $boards, PDO::PARAM_STR); + $query->bindValue(':id', $modID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + modLog('Edited login details for user "' . $_mod['username'] . '"'); + } else { + modLog('Changed own password'); + } + if(!empty($_POST['password'])) { + $query = prepare("UPDATE `mods` SET `password` = :password WHERE `id` = :id"); + $query->bindValue(':password', sha1($_POST['password'])); + $query->bindValue(':id', $modID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } + + // Refresh + $query = prepare("SELECT * FROM `mods` WHERE `id` = :id"); + $query->bindValue(':id', $modID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if(!$_mod = $query->fetch()) { + error($config['error']['404']); + } + + if($_mod['id'] == $mod['id']) { + // Changed own password. Update cookies + + if(!login($_mod['username'], $_mod['password'], false, true)) + error(_('Could not re-login after changing password. (?)')); + + setCookies(); + } + + if(hasPermission($config['mod']['manageusers'])) + header('Location: ?/users', true, $config['redirect_http']); + else + header('Location: ?/', true, $config['redirect_http']); + exit; + } + + $__boards = '<ul style="list-style:none;padding:2px 5px">'; + $boards = array_merge( + array(array('uri' => '*', 'title' => 'All') + ), listBoards()); + + $_mod['boards'] = explode(',', $_mod['boards']); + foreach($boards as &$_board) { + $__boards .= '<li>' . + '<input type="checkbox" name="board_' . $_board['uri'] . '" id="board_' . $_board['uri'] . '"' . + (in_array($_board['uri'], $_mod['boards']) ? + ' checked="checked"' + : '') . + '/> ' . + '<label style="display:inline" for="board_' . $_board['uri'] . '">' . + ($_board['uri'] == '*' ? + '<em>"*"</em>' + : + sprintf($config['board_abbreviation'], $_board['uri']) + ) . + ' - ' . $_board['title'] . + '</label>' . + '</li>'; + } + $__boards .= '</ul>'; + + $body = '<fieldset><legend>Edit user</legend>' . + + // Begin form + '<form style="text-align:center" action="" method="post">' . + + '<table>' . + + '<tr><th>Username</th><td>' . + + (isset($change_password_only) ? + utf8tohtml($_mod['username']) + : '<input size="20" maxlength="30" type="text" name="username" value="' . utf8tohtml($_mod['username']) . '" autocomplete="off" />') . + + '</td></tr>' . + '<tr><th>Password <span class="unimportant">(new; optional)</span></th><td><input size="20" maxlength="30" type="password" name="password" value="" autocomplete="off" /></td></tr>' . + + (isset($change_password_only) ? '' : + '<tr><th>Boards</th><td>' . $__boards . '</td></tr>' + ) . + + '</table>' . + + '<input type="submit" value="Save changes" />' . + + // End form + '</form> ' . + + // Delete button + (hasPermission($config['mod']['deleteusers']) ? + '<p style="text-align:center"><a href="?/users/' . $_mod['id'] . '/delete">Delete user</a></p>' + :'') . + + '</fieldset>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Edit user', + 'body'=>$body + ,'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/reports$/', $query)) { + if(!hasPermission($config['mod']['reports'])) error($config['error']['noaccess']); + + $body = ''; + $reports = 0; + + $query = prepare("SELECT * FROM `reports` ORDER BY `time` DESC LIMIT :limit"); + $query->bindValue(':limit', $config['mod']['recent_reports'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + while($report = $query->fetch()) { + $p_query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `id` = :id", $report['board'])); + $p_query->bindValue(':id', $report['post'], PDO::PARAM_INT); + $p_query->execute() or error(db_error($p_query)); + + if(!$post = $p_query->fetch()) { + // Invalid report (post has since been deleted) + $p_query = prepare("DELETE FROM `reports` WHERE `post` = :id AND `board` = :board"); + $p_query->bindValue(':id', $report['post'], PDO::PARAM_INT); + $p_query->bindValue(':board', $report['board']); + $p_query->execute() or error(db_error($p_query)); + continue; + } + + $reports++; + openBoard($report['uri']); + + if(!$post['thread']) { + $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); + } else { + $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); + } + + $append_html = + '<div class="report">' . + '<hr/>' . + 'Board: <a href="?/' . $report['uri'] . '/' . $config['file_index'] . '">' . sprintf($config['board_abbreviation'], $report['uri']) . '</a><br/>' . + 'Reason: ' . $report['reason'] . '<br/>' . + 'Report date: ' . strftime($config['post_date'], $report['time']) . '<br/>' . + (hasPermission($config['mod']['show_ip']) ? + 'Reported by: <a href="?/IP/' . $report['ip'] . '">' . $report['ip'] . '</a><br/>' + : '') . + '<hr/>' . + (hasPermission($config['mod']['report_dismiss']) ? + '<a title="Discard abuse report" href="?/reports/' . $report['id'] . '/dismiss">Dismiss</a> | ' : '') . + (hasPermission($config['mod']['report_dismiss_ip']) ? + '<a title="Discard all abuse reports by this user" href="?/reports/' . $report['id'] . '/dismiss/all">Dismiss+</a>' : '') . + '</div>'; + + // Bug fix for https://github.com/savetheinternet/Tinyboard/issues/21 + $po->body = truncate($po->body, $po->link(), $config['body_truncate'] - substr_count($append_html, '<br/>')); + + if(mb_strlen($po->body) + mb_strlen($append_html) > $config['body_truncate_char']) { + // still too long. temporarily increase limit in the config + $__old_body_truncate_char = $config['body_truncate_char']; + $config['body_truncate_char'] = mb_strlen($po->body) + mb_strlen($append_html); + } + + $po->body .= $append_html; + + $body .= $po->build(true) . '<hr/>'; + + if(isset($__old_body_truncate_char)) + $config['body_truncate_char'] = $__old_body_truncate_char; + } + + $query = query("SELECT COUNT(`id`) AS `count` FROM `reports`") or error(db_error()); + $count = $query->fetch(); + + $body .= '<p class="unimportant" style="text-align:center">Showing ' . + ($reports == $count['count'] ? 'all ' . $reports . ' reports' : $reports . ' of ' . $count['count'] . ' reports') . '.</p>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Report queue') . ' (' . $count['count'] . ')', + 'body'=>$body, + 'mod'=>true + )); + } elseif(preg_match('/^\/reports\/(\d+)\/dismiss(\/all)?$/', $query, $matches)) { + if(isset($matches[2]) && $matches[2] == '/all') { + if(!hasPermission($config['mod']['report_dismiss_ip'])) error($config['error']['noaccess']); + + $query = prepare("SELECT `ip` FROM `reports` WHERE `id` = :id"); + $query->bindValue(':id', $matches[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($report = $query->fetch()) { + $query = prepare("DELETE FROM `reports` WHERE `ip` = :ip"); + $query->bindValue(':ip', $report['ip'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + modLog('Dismissed all reports by ' . $report['ip']); + } + } else { + if(!hasPermission($config['mod']['report_dismiss'])) error($config['error']['noaccess']); + + $query = prepare("SELECT `post`, `board` FROM `reports` WHERE `id` = :id"); + $query->bindValue(':id', $matches[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($report = $query->fetch()) { + modLog('Dismissed a report for post #' . $report['post'], $report['board']); + + $query = prepare("DELETE FROM `reports` WHERE `post` = :post AND `board` = :board"); + $query->bindValue(':board', $report['board'], PDO::PARAM_INT); + $query->bindValue(':post', $report['post'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } + } + + // Redirect + header('Location: ?/reports', true, $config['redirect_http']); + } elseif(preg_match('/^\/(\w+)\/edit(\/delete)?$/', $query, $matches)) { + if(!hasPermission($config['mod']['manageboards'])) error($config['error']['noaccess']); + + if(!openBoard($matches[1])) + error($config['error']['noboard']); + + if(isset($matches[2]) && $matches[2] == '/delete') { + if(!hasPermission($config['mod']['deleteboard'])) error($config['error']['noaccess']); + // Delete board + + modLog('Deleted board ' . sprintf($config['board_abbreviation'], $board['uri'])); + + // Delete entire board directory + rrmdir($board['uri'] . '/'); + + // Delete posting table + $query = query(sprintf("DROP TABLE IF EXISTS `posts_%s`", $board['uri'])) or error(db_error()); + + // Clear reports + $query = prepare("DELETE FROM `reports` WHERE `board` = :id"); + $query->bindValue(':id', $board['uri'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + // Delete from table + $query = prepare("DELETE FROM `boards` WHERE `uri` = :uri"); + $query->bindValue(':uri', $board['uri'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($config['cache']['enabled']) { + cache::delete('board_' . $board['uri']); + cache::delete('all_boards'); + } + + $query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board"); + $query->bindValue(':board', $board['uri']); + $query->execute() or error(db_error($query)); + while($cite = $query->fetch()) { + if($board['uri'] != $cite['board']) { + if(!isset($tmp_board)) + $tmp_board = $board; + openBoard($cite['board']); + rebuildPost($cite['post']); + } + } + + if(isset($tmp_board)) + $board = $tmp_board; + + $query = prepare("DELETE FROM `cites` WHERE `board` = :board OR `target_board` = :board"); + $query->bindValue(':board', $board['uri']); + $query->execute() or error(db_error($query)); + + $query = prepare("DELETE FROM `antispam` WHERE `board` = :board"); + $query->bindValue(':board', $board['uri']); + $query->execute() or error(db_error($query)); + + $_board = $board; + + rebuildThemes('boards'); + + $board = $_board; + + header('Location: ?/', true, $config['redirect_http']); + } else { + if(isset($_POST['title']) && isset($_POST['subtitle'])) { + $query = prepare("UPDATE `boards` SET `title` = :title, `subtitle` = :subtitle WHERE `uri` = :uri"); + $query->bindValue(':title', utf8tohtml($_POST['title'], true)); + + if(!empty($_POST['subtitle'])) + $query->bindValue(':subtitle', utf8tohtml($_POST['subtitle'], true)); + else + $query->bindValue(':subtitle', null, PDO::PARAM_NULL); + + $query->bindValue(':id', $board['uri'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($config['cache']['enabled']) { + cache::delete('board_' . $board['uri']); + cache::delete('all_boards'); + } + + $_board = $board; + + rebuildThemes('boards'); + + $board = $_board; + + openBoard($board['uri']); + } + + $body = + '<fieldset><legend><a href="?/' . + $board['uri'] . '/' . $config['file_index'] . '">' . + sprintf($config['board_abbreviation'], $board['uri']) . '</a>' . + ' - ' . $board['name'] . '</legend>' . + + // Begin form + '<form style="text-align:center" action="" method="post">' . + + '<table>' . + + '<tr><th>URI</th><td>' . $board['uri'] . '</td>' . + '<tr><th>Title</th><td><input size="20" type="text" name="title" value="' . $board['name'] . '" /></td></tr>' . + '<tr><th>Subtitle</th><td><input size="20" type="text" name="subtitle" value="' . + (isset($board['title']) ? $board['title'] : '') . '" /></td></tr>' . + + '</table>' . + + '<input type="submit" value="Update" />' . + + // End form + '</form> ' . + + // Delete button + (hasPermission($config['mod']['deleteboard']) ? + '<p style="text-align:center"><a href="?/' . $board['uri'] . '/edit/delete">Delete board</a></p>' + :'') . + + '</fieldset>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Manage – ' . sprintf($config['board_abbreviation'], $board['uri']), + 'body'=>$body, + 'mod'=>true + )); + } + } elseif(preg_match('/^\/bans$/', $query)) { + if(!hasPermission($config['mod']['view_banlist'])) error($config['error']['noaccess']); + + if(isset($_POST['unban'])) { + if(!hasPermission($config['mod']['unban'])) error($config['error']['noaccess']); + + foreach($_POST as $post => $value) { + if(preg_match('/^ban_(\d+)$/', $post, $m)) { + removeBan($m[1]); + } + } + } + if(hasPermission($config['mod']['view_banexpired'])) { + $query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC"); + $query->bindValue(':time', time(), PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } else { + // Filter out expired bans + $query = prepare("SELECT `bans`.*, `username` FROM `bans` INNER JOIN `mods` ON `mod` = `mods`.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC"); + $query->bindValue(':time', time(), PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } + + if($query->rowCount() < 1) { + $body = '<p style="text-align:center" class="unimportant">(There are no active bans.)</p>'; + } else { + $body = '<form action="" method="post">'; + $body .= '<table><tr><th>' . _('IP address') . '</th><th>' . _('Reason') . '</th><th>' . _('Board') . '</th><th>' . _('Set') . '</th><th>' . _('Expires') . '</th><th>' . _('Staff') . '</th></tr>'; + + while($ban = $query->fetch()) { + $body .= + '<tr' . + ($config['mod']['view_banexpired'] && $ban['expires'] != 0 && $ban['expires'] < time() ? + ' style="text-decoration:line-through"' + :'') . + '>' . + + '<td style="white-space: nowrap">' . + + // Checkbox + '<input type="checkbox" name="ban_' . $ban['id'] . '" id="ban_' . $ban['id'] . '" /> ' . + + // IP address + (preg_match('/^(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $ban['ip']) ? + '<a href="?/IP/' . + $ban['ip'] . + '">'. $ban['ip'] . '</a>' + : utf8tohtml($ban['ip'])) . + + '</td>' . + + // Reason + '<td>' . ($ban['reason'] ? $ban['reason'] : '<em>-</em>') . '</td>' . + + + '<td style="white-space: nowrap">' . + (isset($ban['board']) ? + sprintf($config['board_abbreviation'], $ban['board']) + : + '<em>' . _('all boards') . '</em>' + ) . '</td>' . + + // Set + '<td style="white-space: nowrap">' . strftime($config['post_date'], $ban['set']) . '</td>' . + + // Expires + '<td style="white-space: nowrap">' . + ($ban['expires'] == 0 ? + '<em>Never</em>' + : + strftime($config['post_date'], $ban['expires']) + ) . + '</td>' . + + // Staff + '<td>' . + (isset($ban['username']) ? + (!hasPermission($config['mod']['view_banstaff']) ? + ($config['mod']['view_banquestionmark'] ? + '?' + : + ($ban['type'] == JANITOR ? 'Janitor' : + ($ban['type'] == MOD ? 'Mod' : + ($ban['type'] == ADMIN ? 'Admin' : + '?'))) + ) + : + utf8tohtml($ban['username']) + ) + : + '<em>deleted?</em>' + ) . + '</td>' . + + '</tr>'; + } + + $body .= '</table>' . + + (hasPermission($config['mod']['unban']) ? + '<p style="text-align:center"><input name="unban" type="submit" value="Unban selected" /></p>' + : '') . + + '</form>'; + } + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Ban list'), + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/flush$/', $query)) { + if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']); + if(!$config['cache']['enabled']) error(_('Cache is not enabled.')); + + if(cache::flush()) { + $body = 'Successfully invalidated all items in cache.'; + modLog('Cleared cache'); + } else { + $body = 'An error occured while trying to flush cache.'; + } + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Flushed', + 'body'=>'<p style="text-align:center">' . $body . '</p>', + 'mod'=>true + )); + } elseif(preg_match('/^\/rebuild$/', $query)) { + if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']); + + set_time_limit($config['mod']['rebuild_timelimit']); + + $body = '<div class="ban"><h2>Rebuilding…</h2><p>'; + + $body .= 'Clearing template cache…<br/>'; + + load_twig(); + $twig->clearCacheFiles(); + + $body .= 'Regenerating theme files…<br/>'; + rebuildThemes('all'); + + $body .= 'Generating Javascript file…<br/>'; + buildJavascript(); + + $main_js = $config['file_script']; + + $boards = listBoards(); + + foreach($boards as &$board) { + $body .= "<strong style=\"display:inline-block;margin: 15px 0 2px 0;\">Opening board /{$board['uri']}/</strong><br/>"; + openBoard($board['uri']); + + $body .= 'Creating index pages<br/>'; + buildIndex(); + + if($config['file_script'] != $main_js) { + // different javascript file + $body .= 'Generating Javascript file…<br/>'; + buildJavascript(); + } + + $query = query(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); + while($post = $query->fetch()) { + $body .= "Rebuilding #{$post['id']}<br/>"; + buildThread($post['id']); + } + } + $body .= 'Complete!</p></div>'; + + unset($board); + modLog('Rebuilt everything'); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Rebuilt', + 'body'=>$body, + 'mod'=>true + )); + } elseif(preg_match('/^\/config\/edit$/', $query)) { + if(!hasPermission($config['mod']['edit_config'])) + error($config['error']['noaccess']); + + // TODO: display "unset variables" + // $config_file = file_get_contents('inc/config.php'); + // preg_match_all('/\$config\[\'(\w+)\']/', $config_file, $matches); + // $config_variables = array_unique($matches[1]); + + $body = '<fieldset><legend>' . _('Configuration') . '</legend><form action="" method="post"><table style="width:100%">'; + + $var_force_string = array('blotter'); + $var_system = array('version'); + + if(isset($_POST['save_changes'])) { + $config_append = ''; + + foreach($config as $name => $original_value) { + if(in_array($name, $var_system)) + continue; + $type = gettype($original_value); + if($type == 'array' || $type == 'NULL') + continue; + + if($type == 'boolean' && in_array($name, $var_force_string)) + $type = 'string'; + + if(!isset($_POST[$name]) && $type != 'boolean') + continue; + + if($type == 'boolean') + $value = isset($_POST[$name]); + else + $value = $_POST[$name]; + + if($value != $original_value) { + // value has been changed + $config_append .= "\$config['" . addslashes($name) . "'] = "; + if($type == 'boolean') + $config_append .= $value ? 'true' : 'false'; + elseif($type == 'integer') + $config_append .= (int)$value; + elseif($type == 'string') + $config_append .= '\'' . addslashes($value) . '\''; + $config_append .= ";\n"; + } + } + + if(!empty($config_append)) { + $config_append = "\n// Changes made via web editor by \"" . $mod['username'] . "\" @ " . date('r') . ":\n" . $config_append . "\n"; + if(@file_put_contents('inc/instance-config.php', $config_append, FILE_APPEND)) { + header('Location: ?/config' . $b['uri'], true, $config['redirect_http']); + exit; + } else { + $config_append = htmlentities($config_append); + + if($config['minify_html']) + $config_append = str_replace("\n", '
', $config_append); + $page = array(); + $page['title'] = 'Cannot write to file!'; + $page['config'] = $config; + $page['body'] = ' + <p>Tinyboard could not write to <strong>inc/instance-config.php</strong> with the ammended configuration, probably due to a permissions error.</p> + <p>You may proceed with these changes manually by copying and pasting the following code to the bottom of <strong>inc/instance-config.php</strong>:</p> + <textarea style="width:700px;height:370px;margin:auto;display:block;background:white;color:black" readonly>' . $config_append . '</textarea> + '; + echo Element('page.html', $page); + exit; + } + } + } + + foreach($config as $name => $value) { + $body .= '<tr>'; + + $body .= '<th style="text-align:left" class="minimal">' . utf8tohtml($name) . '</th>'; + $type = gettype($value); + if($type == 'array') { + $body .= '<td><a href="?/config/edit/' . utf8tohtml($name) . '">[edit]' . '</a></td>'; + } else { + if($type == 'string' || $type == 'integer') { + $body .= '<td><input style="width:100%" type="text" name="' .utf8tohtml($name) . '" value="'. str_replace('"', '"', utf8tohtml($value)) . '"' . + (in_array($name, $var_system) ? ' readonly="readonly"' : '') . '></td>'; + } elseif($type == 'boolean') { + if(in_array($name, $var_force_string)) + $body .= '<td><input style="width:100%" type="text" name="' . utf8tohtml($name) . '" value=""></td>'; + else + $body .= '<td><input type="checkbox" name="' . utf8tohtml($name) . '" ' . ($value ? 'checked' : '') . '></td>'; + } else { + $body .= '<td>' . utf8tohtml($value) . '</td>'; + } + } + + $body .= '</tr>'; + } + + $body .= '</table><div style="text-align:center"><input name="save_changes" type="submit" value="Save changes"></div></form></fieldset>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Configuration'), + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/config$/', $query)) { + if(!hasPermission($config['mod']['show_config'])) + error($config['error']['noaccess']); + + // Show instance-config.php + + $data = ''; + + function do_array_part($array, $prefix = '') { + global $data, $config; + + foreach($array as $name => $value) { + if(is_array($value)) { + do_array_part($value, $prefix . $name . ' → '); + } else { + if($config['mod']['never_reveal_password'] && $prefix == 'db → ' && $name == 'password') { + $value = '<em>hidden</em>'; + } elseif(gettype($value) == 'boolean') { + $value = $value ? '<span style="color:green;">On</span>' : '<span style="color:red;">Off</span>'; + } elseif(gettype($value) == 'string') { + if(empty($value)) + $value = '<em>empty</em>'; + else + $value = '<span style="color:maroon;">' . utf8tohtml(substr($value, 0, 110) . (mb_strlen($value) > 110 ? '…' : '')) . '</span>'; + } elseif(gettype($value) == 'integer') { + $value = '<span style="color:black;">' . $value . '</span>'; + } elseif(is_object($value) && get_class($value) == 'Closure') { + $value = '[callback]'; + } + + $data .= + '<tr><th style="text-align:left;">' . + $prefix . (gettype($name) == 'integer' ? '[]' : utf8tohtml($name)) . + '</th><td>' . + $value . + '</td></tr>'; + } + } + } + + do_array_part($config); + + + $body = (hasPermission($config['mod']['edit_config']) ? + '<p style="text-align:center" class="unimportant">' . + '<a href="?/config/edit">[Edit using web editor]</a>' : '') . + '<fieldset><legend>' . _('Configuration') . '</legend><table>' . $data . '</table></fieldset>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Configuration'), + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/new$/', $query)) { + if(!hasPermission($config['mod']['newboard'])) error($config['error']['noaccess']); + + // New board + $body = ''; + + if(isset($_POST['new_board'])) { + // Create new board + if( !isset($_POST['uri']) || + !isset($_POST['title']) || + !isset($_POST['subtitle']) + ) error($config['error']['missedafield']); + + $b = array( + 'uri' => $_POST['uri'], + 'title' => $_POST['title'], + 'subtitle' => $_POST['subtitle'] + ); + + // HTML characters + $b['title'] = utf8tohtml($b['title'], true); + $b['subtitle'] = utf8tohtml($b['subtitle'], true); + + // Check required fields + if(empty($b['uri'])) + error(sprintf($config['error']['required'], 'URI')); + if(empty($b['title'])) + error(sprintf($config['error']['required'], 'title')); + + if(!preg_match('/^\w+$/', $b['uri'])) + error(sprintf($config['error']['invalidfield'], 'URI')); + + if(openBoard($b['uri'])) { + unset($board); + error(sprintf($config['error']['boardexists'], sprintf($config['board_abbreviation'], $b['uri']))); + } + + $query = prepare("INSERT INTO `boards` VALUES (:uri, :title, :subtitle)"); + $query->bindValue(':uri', $b['uri']); + $query->bindValue(':title', $b['title']); + if(!empty($b['subtitle'])) { + $query->bindValue(':subtitle', $b['subtitle']); + } else { + $query->bindValue(':subtitle', null, PDO::PARAM_NULL); + } + $query->execute() or error(db_error($query)); + + // Record the action + modLog("Created a new board: {$b['title']}"); + + // Open the board + openBoard($b['uri']) or error(_("Couldn't open board after creation.")); + + // Create the posts table + query(Element('posts.sql', array('board' => $board['uri']))) or error(db_error()); + + if($config['cache']['enabled']) + cache::delete('all_boards'); + + // Build the board + buildIndex(); + + rebuildThemes('boards'); + + header('Location: ?/' . $b['uri'] . '/' . $config['file_index'], true, $config['redirect_http']); + } else { + + $body .= form_newBoard(); + + // TODO: Statistics, etc, in the dashboard. + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'New board', + 'body'=>$body, + 'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/' . $regex['board'] . '(' . $regex['index'] . '|' . $regex['page'] . ')?$/', $query, $matches)) { + // Board index + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + $page_no = empty($matches[2]) || $matches[2] == $config['file_index'] ? 1 : $matches[2]; + + if(!$page = index($page_no, $mod)) { + error($config['error']['404']); + } + + $page['pages'] = getPages(true); + $page['pages'][$page_no-1]['selected'] = true; + $page['btn'] = getPageButtons($page['pages'], true); + $page['mod'] = true; + echo Element('index.html', $page); + } elseif(preg_match('/^\/' . $regex['board'] . $regex['res'] . $regex['page'] . '$/', $query, $matches)) { + // View thread + + $boardName = &$matches[1]; + $thread = &$matches[2]; + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + $page = buildThread($thread, true, $mod); + + echo $page; + } elseif(preg_match('/^\/' . $regex['board'] . 'edit\/(\d+)$/', $query, $matches)) { + // Edit post body + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['editpost'], $boardName)) error($config['error']['noaccess']); + + $postID = &$matches[2]; + + $query = prepare(sprintf("SELECT `body_nomarkup`, `name`, `subject`, `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $post = $query->fetch() or error($config['error']['invalidpost']); + + if(isset($_POST['submit']) && isset($_POST['body']) && isset($_POST['subject'])) { + if(mb_strlen($_POST['subject']) > 100) + error(sprintf($config['error']['toolong'], 'subject')); + + $body = $_POST['body']; + $body_nomarkup = $body; + + wordfilters($body); + $tracked_cites = markup($body, true); + + $query = prepare("DELETE FROM `cites` WHERE `board` = :board AND `post` = :post"); + $query->bindValue(':board', $board['uri']); + $query->bindValue(':post', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + $query = prepare(sprintf("UPDATE `posts_%s` SET `body` = :body, `body_nomarkup` = :body_nomarkup, `subject` = :subject WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->bindValue(':body', $body); + $query->bindValue(':body_nomarkup', $body_nomarkup); + $query->bindValue(':subject', utf8tohtml($_POST['subject'])); + $query->execute() or error(db_error($query)); + + if(isset($tracked_cites)) { + foreach($tracked_cites as $cite) { + $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); + $query->bindValue(':board', $board['uri']); + $query->bindValue(':post', $postID, PDO::PARAM_INT); + $query->bindValue(':target_board',$cite[0]); + $query->bindValue(':target', $cite[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } + } + + // Record the action + modLog("Edited post #{$postID}"); + + buildThread($post['thread'] ? $post['thread'] : $postID); + + // Rebuild board + buildIndex(); + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + exit; + } + + $post['body_nomarkup'] = utf8tohtml($post['body_nomarkup']); + + if($config['minify_html']) + $post['body_nomarkup'] = str_replace("\n", '
', $post['body_nomarkup']); + + $body = '<form name="post" action="" method="post">' . + '<table>' . + '<tr>' . + '<th>Name</th>' . + '<td>' . utf8tohtml($post['name']) . '</td>' . + '</tr>' . + '<tr>' . + '<th>Subject</th>' . + '<td>' . + '<input style="float:left;" type="text" name="subject" size="25" maxlength="50" value="' . str_replace('"', '"', $post['subject']) . '"/>' . + '<input style="margin-left:2px;" type="submit" name="submit" value="Edit Post"/>' . + '</td>' . + '</tr>' . + '<tr>' . + '<th>Body</th>' . + '<td>' . + '<textarea name="body" rows="8" cols="38">' . + $post['body_nomarkup'] . + '</textarea>' . + '</td>' . + '</tr>' . + '</table>' . + '</form>'; + + echo Element('page.html', array( + 'config' => $config, + 'body' => $body, + 'title' => 'Edit Post #' . $postID + )); + } elseif(preg_match('/^\/' . $regex['board'] . 'deletefile\/(\d+)$/', $query, $matches)) { + // Delete file from post + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['deletefile'], $boardName)) error($config['error']['noaccess']); + + $post = &$matches[2]; + + // Delete post + deleteFile($post); + + // Record the action + modLog("Removed file from post #{$post}"); + + // Rebuild board + buildIndex(); + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/' . $regex['board'] . 'delete\/(\d+)$/', $query, $matches)) { + // Delete post + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['delete'], $boardName)) + error($config['error']['noaccess']); + + $post = &$matches[2]; + + // Delete post + deletePost($post); + + // Record the action + modLog("Deleted post #{$post}"); + + // Rebuild board + buildIndex(); + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/' . $regex['board'] . '(un)?sticky\/(\d+)$/', $query, $matches)) { + // Add/remove sticky + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['sticky'], $boardName)) error($config['error']['noaccess']); + + $post = &$matches[3]; + + $query = prepare(sprintf("UPDATE `posts_%s` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + + if($matches[2] == 'un') { + // Record the action + modLog("Unstickied post #{$post}"); + $query->bindValue(':sticky', 0, PDO::PARAM_INT); + } else { + // Record the action + modLog("Stickied post #{$post}"); + $query->bindValue(':sticky', 1, PDO::PARAM_INT); + } + + $query->execute() or error(db_error($query)); + + buildIndex(); + buildThread($post); + + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/' . $regex['board'] . '(un)?lock\/(\d+)$/', $query, $matches)) { + // Lock/Unlock + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['lock'], $boardName)) error($config['error']['noaccess']); + + $post = &$matches[3]; + + $query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + + if($matches[2] == 'un') { + // Record the action + modLog("Unlocked post #{$post}"); + $query->bindValue(':locked', 0, PDO::PARAM_INT); + } else { + // Record the action + modLog("Locked post #{$post}"); + $query->bindValue(':locked', 1, PDO::PARAM_INT); + } + + $query->execute() or error(db_error($query)); + + buildIndex(); + buildThread($post); + + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/' . $regex['board'] . 'bump(un)?lock\/(\d+)$/', $query, $matches)) { + // Lock/Unlock + + $boardName = &$matches[1]; + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['bumplock'], $boardName)) error($config['error']['noaccess']); + + $post = &$matches[3]; + + $query = prepare(sprintf("UPDATE `posts_%s` SET `sage` = :bumplocked WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + + if($matches[2] == 'un') { + // Record the action + modLog("Unbumplocked post #{$post}"); + $query->bindValue(':bumplocked', 0, PDO::PARAM_INT); + } else { + // Record the action + modLog("Bumplocked post #{$post}"); + $query->bindValue(':bumplocked', 1, PDO::PARAM_INT); + } + + $query->execute() or error(db_error($query)); + + buildIndex(); + buildThread($post); + + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/' . $regex['board'] . 'deletebyip\/(\d+)(\/global)?$/', $query, $matches)) { + // Delete all posts by an IP + + $boardName = &$matches[1]; + $post = &$matches[2]; + $global = isset($matches[3]) && $matches[3] == '/global'; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + $query = prepare(sprintf("SELECT `ip` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $post); + $query->execute() or error(db_error($query)); + + if(!$post = $query->fetch()) + error($config['error']['invalidpost']); + + $ip = $post['ip']; + + if($global) + $boards = listBoards(); + else + $boards = array(array('uri' => $board['uri'])); + + $query = ''; + foreach($boards as $_board) { + $query .= sprintf("SELECT `id`, '%s' AS `board` FROM `posts_%s` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']); + } + $query = preg_replace('/UNION ALL $/', '', $query); + + $query = prepare($query); + $query->bindValue(':ip', $ip); + $query->execute() or error(db_error($query)); + + if($query->rowCount() < 1) + error($config['error']['invalidpost']); + + $boards = array(); + while($post = $query->fetch()) { + openBoard($post['board']); + $boards[] = $post['board']; + + deletePost($post['id'], false); + } + + foreach($boards as &$_board) { + openBoard($_board); + buildIndex(); + } + + // Record the action + modLog("Deleted all posts by IP address: {$ip}"); + + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/ban$/', $query)) { + if(!hasPermission($config['mod']['ban'])) error($config['error']['noaccess']); + // Ban page + + if(isset($_POST['new_ban'])) { + if( !isset($_POST['ip']) || + !isset($_POST['reason']) || + !isset($_POST['length']) + ) error($config['error']['missedafield']); + + // Check required fields + if(empty($_POST['ip'])) + error(sprintf($config['error']['required'], 'IP address')); + + $query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board)"); + + // 1yr2hrs30mins + // 1y2h30m + $expire = 0; + if(preg_match('/^((\d+)\s?ye?a?r?s?)?\s?+((\d+)\s?mon?t?h?s?)?\s?+((\d+)\s?we?e?k?s?)?\s?+((\d+)\s?da?y?s?)?((\d+)\s?ho?u?r?s?)?\s?+((\d+)\s?mi?n?u?t?e?s?)?\s?+((\d+)\s?se?c?o?n?d?s?)?$/', $_POST['length'], $m)) { + if(isset($m[2])) { + // Years + $expire += $m[2]*60*60*24*365; + } + if(isset($m[4])) { + // Months + $expire += $m[4]*60*60*24*30; + } + if(isset($m[6])) { + // Weeks + $expire += $m[6]*60*60*24*7; + } + if(isset($m[8])) { + // Days + $expire += $m[8]*60*60*24; + } + if(isset($m[10])) { + // Hours + $expire += $m[10]*60*60; + } + if(isset($m[12])) { + // Minutes + $expire += $m[12]*60; + } + if(isset($m[14])) { + // Seconds + $expire += $m[14]; + } + } + if($expire) { + $query->bindValue(':expires', time()+$expire, PDO::PARAM_INT); + } else { + // Never expire + $query->bindValue(':expires', null, PDO::PARAM_NULL); + } + + $query->bindValue(':ip', $_POST['ip'], PDO::PARAM_STR); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + $query->bindValue(':set', time(), PDO::PARAM_INT); + + + + if(!empty($_POST['reason'])) { + $reason = $_POST['reason']; + markup($reason); + $query->bindValue(':reason', $reason, PDO::PARAM_STR); + } else { + $query->bindValue(':reason', null, PDO::PARAM_NULL); + } + + if($_POST['board'] == '') { + $query->bindValue(':board', null, PDO::PARAM_NULL); + } else { + $query->bindValue(':board', $_POST['board'], PDO::PARAM_INT); + } + + // Record the action + modLog('Created a ' . ($expire ? $expire . ' second' : 'permanent') . " ban for {$_POST['ip']} with " . (!empty($_POST['reason']) ? "reason \"${reason}\"" : 'no reason')); + + $query->execute() or error(db_error($query)); + + if(isset($_POST['board'])) + openBoard($_POST['board']); + + // Delete too + if(isset($_POST['delete']) && isset($_POST['board']) && hasPermission($config['mod']['delete'], $_POST['board'])) { + $post = round($_POST['delete']); + + deletePost($post); + + // Record the action + modLog("Deleted post #{$post}"); + + // Rebuild board + buildIndex(); + } + + if(hasPermission($config['mod']['public_ban']) && isset($_POST['post']) && isset($_POST['board']) && isset($_POST['public_message']) && isset($_POST['message'])) { + $post = round($_POST['post']); + + $query = prepare(sprintf("UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + $query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message']))); + $query->execute() or error(db_error($query)); + + // Rebuild thread + $query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $thread = $query->fetch(); + if($thread['thread']) + buildThread($thread['thread']); + else + buildThread($post); + + // Rebuild board + buildIndex(); + + // Record the action + modLog("Attached a public ban message for post #{$post}: " . $_POST['message']); + } + + // Redirect + if(isset($_POST['continue'])) + header('Location: ' . $_POST['continue'], true, $config['redirect_http']); + elseif(isset($board)) + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + else + header('Location: ?/', true, $config['redirect_http']); + } + } elseif(preg_match('/^\/' . $regex['board'] . 'move\/(\d+)$/', $query, $matches)) { + + $boardName = &$matches[1]; + $postID = $matches[2]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['move'], $boardName)) error($config['error']['noaccess']); + + if(isset($_POST['board'])) { + $targetBoard = $_POST['board']; + $shadow = isset($_POST['shadow']); + + if($targetBoard == $boardName) + error(_("Target and source board are the same.")); + + // copy() if leaving a shadow thread behind. otherwise, rename(). + $clone = $shadow ? 'copy' : 'rename'; + + $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` IS NULL AND `id` = :id", $board['uri'])); + $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + if(!$post = $query->fetch()) { + error($config['error']['nonexistant']); + } + $post['op'] = true; + + if($post['file']) { + $post['has_file'] = true; + $post['width'] = &$post['filewidth']; + $post['height'] = &$post['fileheight']; + + $file_src = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']; + $file_thumb = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']; + } else $post['has_file'] = false; + + // allow thread to keep its same traits (stickied, locked, etc.) + $post['mod'] = true; + + if(!openBoard($targetBoard)) + error($config['error']['noboard']); + + $newID = post($post); + + if($post['has_file']) { + $clone($file_src, sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']); + $clone($file_thumb, sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']); + } + + // move replies too... + openBoard($boardName); + + $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id`", $board['uri'])); + $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + $replies = array(); + while($post = $query->fetch()) { + $post['mod'] = true; + $post['thread'] = $newID; + + if($post['file']) { + $post['has_file'] = true; + $post['width'] = &$post['filewidth']; + $post['height'] = &$post['fileheight']; + + $post['file_src'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']; + $post['file_thumb'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']; + } else $post['has_file'] = false; + + $replies[] = $post; + } + + $newIDs = array($postID => $newID); + + openBoard($targetBoard); + foreach($replies as &$post) { + $query = prepare("SELECT `target` FROM `cites` WHERE `target_board` = :board AND `board` = :board AND `post` = :post"); + $query->bindValue(':board', $boardName); + $query->bindValue(':post', $post['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($qurey)); + while($cite = $query->fetch(PDO::FETCH_ASSOC)) { + if(isset($newIDs[$cite['target']])) { + $post['body_nomarkup'] = preg_replace( + '/(>>(>\/' . preg_quote($boardName, '/') . '\/)?)' . preg_quote($cite['target'], '/') . '/', + '>>' . $newIDs[$cite['target']], + $post['body_nomarkup']); + + $post['body'] = $post['body_nomarkup']; + } + } + $post['op'] = false; + $post['tracked_cites'] = markup($post['body'], true); + + $newIDs[$post['id']] = $newPostID = post($post); + + if($post['has_file']) { + $clone($post['file_src'], sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']); + $clone($post['file_thumb'], sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']); + } + + foreach($post['tracked_cites'] as $cite) { + $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); + $query->bindValue(':board', $board['uri']); + $query->bindValue(':post', $newPostID, PDO::PARAM_INT); + $query->bindValue(':target_board',$cite[0]); + $query->bindValue(':target', $cite[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } + } + + // build thread + buildThread($newID); + buildIndex(); + + // trigger themes + rebuildThemes('post'); + + openBoard($boardName); + + if($shadow) { + // lock thread + $query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = 1 WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + $post = array( + 'mod' => true, + 'subject' => '', + 'email' => '', + 'name' => $config['mod']['shadow_name'], + 'capcode' => $config['mod']['shadow_capcode'], + 'trip' => '', + 'body' => sprintf($config['mod']['shadow_mesage'], '>>>/' . $targetBoard . '/' . $newID), + 'password' => '', + 'has_file' => false, + // attach to original thread + 'thread' => $postID, + 'op' => false + ); + + markup($post['body']); + + $botID = post($post); + buildThread($postID); + + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['dir']['res'] . sprintf($config['file_page'], $postID) . '#' . $botID, true, $config['redirect_http']); + } else { + deletePost($postID); + buildIndex(); + + openBoard($targetBoard); + header('Location: ?/' . sprintf($config['board_path'], $board['uri']) . $config['dir']['res'] . sprintf($config['file_page'], $newID), true, $config['redirect_http']); + } + } else { + + $body = '<fieldset><legend>Move thread</legend>' . + '<form action="?/' . $boardName . '/move/' . $postID . '" method="post">' . + '<table>' + ; + + $boards = listBoards(); + if(count($boards) <= 1) + error(_('No board to move to; there is only one.')); + + $__boards = ''; + foreach($boards as &$_board) { + if($_board['uri'] == $board['uri']) + continue; + $__boards .= '<li>' . + '<input type="radio" name="board" id="board_' . $_board['uri'] . '" value="' . $_board['uri'] . '">' . + '<label style="display:inline" for="board_' . $_board['uri'] . '"> ' . + sprintf($config['board_abbreviation'], $_board['uri']) . + ' - ' . $_board['title'] . + '</label>' . + '</li>'; + } + + $body .= '<tr>' . + '<th>Thread ID</th>' . + '<td><input type="text" size="7" value="' . $postID . '" disabled /></td>' . + '</tr>' . + + '<tr>' . + '<th><label for="message">Leave shadow thread</label></th>' . + '<td>' . + '<input type="checkbox" id="shadow" name="shadow" checked/>' . + ' <span class="unimportant">(locks thread; replies to it with a link.)</span>' . + '</td>' . + '</tr>' . + + '<tr>' . + '<th>Target board</th>' . + '<td><ul style="list-style:none;padding:2px 5px">' . $__boards . '</tl></td>' . + '</tr>' . + + '<tr>' . + '<td></td>' . + '<td><input type="submit" value="Move thread" /></td>' . + '</tr>' . + '</table>' . + '</form></fieldset>'; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Move #' . $postID, + 'body'=>$body, + 'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/' . $regex['board'] . 'ban(&delete)?\/(\d+)$/', $query, $matches)) { + + // Ban by post + + $boardName = &$matches[1]; + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['ban'], $boardName)) error($config['error']['noaccess']); + + $delete = isset($matches[2]) && $matches[2] == '&delete'; + if($delete && !hasPermission($config['mod']['delete'], $boardName)) error($config['error']['noaccess']); + + $post = $matches[3]; + + $query = prepare(sprintf("SELECT `ip`,`id` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($query->rowCount() < 1) { + error($config['error']['invalidpost']); + } + + $post = $query->fetch(); + + $body = form_newBan($post['ip'], null, '?/' . sprintf($config['board_path'], $board['uri']) . $config['file_index'], $post['id'], $boardName, !$delete); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'New ban', + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')\/deletenote\/(?P<id>\d+)$/', $query, $matches)) { + if(!hasPermission($config['mod']['remove_notes'])) error($config['error']['noaccess']); + + $ip = $matches[1]; + $id = $matches['id']; + + $query = prepare("DELETE FROM `ip_notes` WHERE `ip` = :ip AND `id` = :id"); + $query->bindValue(':ip', $ip); + $query->bindValue(':id', $id); + $query->execute() or error(db_error($query)); + + header('Location: ?/IP/' . $ip, true, $config['redirect_http']); + } elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $query, $matches)) { + // View information on an IP address + + $ip = $matches[1]; + $host = $config['mod']['dns_lookup'] ? rDNS($ip) : false; + + if(hasPermission($config['mod']['unban']) && isset($_POST['unban']) && isset($_POST['ban_id'])) { + removeBan($_POST['ban_id']); + header('Location: ?/IP/' . $ip, true, $config['redirect_http']); + } elseif(hasPermission($config['mod']['create_notes']) && isset($_POST['note'])) { + $query = prepare("INSERT INTO `ip_notes` VALUES(NULL, :ip, :mod, :time, :body)"); + $query->bindValue(':ip', $ip); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + $query->bindValue(':time', time(), PDO::PARAM_INT); + markup($_POST['note']); + $query->bindValue(':body', $_POST['note']); + $query->execute() or error(db_error($query)); + + header('Location: ?/IP/' . $ip, true, $config['redirect_http']); + } else { + $body = ''; + $boards = listBoards(); + foreach($boards as &$_board) { + openBoard($_board['uri']); + + $temp = ''; + $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `time` DESC LIMIT :limit", $_board['uri'])); + $query->bindValue(':ip', $ip); + $query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + while($post = $query->fetch()) { + if(!$post['thread']) { + $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); + } else { + $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); + } + $temp .= $po->build(true) . '<hr/>'; + } + + if(!empty($temp)) + $body .= '<fieldset><legend>Last ' . $query->rowCount() . ' posts on <a href="?/' . + sprintf($config['board_path'], $_board['uri']) . $config['file_index'] . + '">' . + sprintf($config['board_abbreviation'], $_board['uri']) . ' - ' . $_board['title'] . + '</a></legend>' . $temp . '</fieldset>'; + } + + if(hasPermission($config['mod']['view_notes'])) { + $query = prepare("SELECT * FROM `ip_notes` WHERE `ip` = :ip ORDER BY `id` DESC"); + $query->bindValue(':ip', $ip); + $query->execute() or error(db_error($query)); + + if($query->rowCount() > 0 || hasPermission($config['mod']['create_notes'])) { + $body .= '<fieldset><legend>' . + $query->rowCount() . ' note' . ($query->rowCount() == 1 ?'' : 's') . ' on record' . + '</legend>'; + if($query->rowCount() > 0) { + $body .= '<table class="modlog">' . + '<tr><th>Staff</th><th>Note</th><th>Date</th>' . + (hasPermission($config['mod']['remove_notes']) ? '<th>Actions</th>' : '') . + '</td>'; + while($note = $query->fetch()) { + + if($note['mod']) { + $_query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id"); + $_query->bindValue(':id', $note['mod']); + $_query->execute() or error(db_error($_query)); + if($_mod = $_query->fetch()) { + $staff = '<a href="?/new_PM/' . $note['mod'] . '">' . utf8tohtml($_mod['username']) . '</a>'; + } else { + $staff = '<em>???</em>'; + } + } else { + $staff = '<em>system</em>'; + } + $body .= '<tr>' . + '<td class="minimal">' . + $staff . + '</td><td>' . + $note['body'] . + '</td><td class="minimal">' . + strftime($config['post_date'], $note['time']) . + '</td>' . + (hasPermission($config['mod']['remove_notes']) ? + '<td class="minimal"><a class="unimportant" href="?/IP/' . $ip . '/deletenote/' . $note['id'] . '">[delete]</a></td>' + : '') . + '</tr>'; + } + $body .= '</table>'; + } + + if(hasPermission($config['mod']['create_notes'])) { + $body .= '<form action="" method="post" style="text-align:center;margin:0">' . + '<table>' . + '<tr>' . + '<th>Staff</th>' . + '<td>' . $mod['username'] . '</td>' . + '</tr>' . + '<tr>' . + '<th><label for="note">Note</label></th>' . + '<td><textarea id="note" name="note" rows="5" cols="30"></textarea></td>' . + '</tr>' . + '<tr>' . + '<td></td>' . + '<td><input type="submit" value="New note" /></td>' . + '</tr>' . + '</table>' . + '</form>'; + } + + $body .= '</fieldset>'; + } + } + + if(hasPermission($config['mod']['view_ban'])) { + $query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip"); + $query->bindValue(':ip', $ip); + $query->execute() or error(db_error($query)); + + if($query->rowCount() > 0) { + $body .= '<fieldset><legend>Ban' . ($query->rowCount() == 1 ? '' : 's') . ' on record</legend>'; + + while($ban = $query->fetch()) { + $body .= '<form action="" method="post" style="text-align:center">' . + '<table style="width:400px;margin-bottom:10px;border-bottom:1px solid #ddd;padding:5px"><tr><th>Status</th><td>' . + ($config['mod']['view_banexpired'] && $ban['expires'] != 0 && $ban['expires'] < time() ? + 'Expired' + : 'Active') . + '</td></tr>' . + + // IP + '<tr><th>IP</th><td>' . $ban['ip'] . '</td></tr>' . + + // Reason + '<tr><th>Reason</th><td>' . $ban['reason'] . '</td></tr>' . + + // Board + '<tr><th>Board</th><td>' . + (isset($ban['board']) ? + sprintf($config['board_abbreviation'], $ban['board']) + : + '<em>' . _('all boards') . '</em>' + ) . + '</td></tr>' . + + // Set + '<tr><th>Set</th><td>' . strftime($config['post_date'], $ban['set']) . '</td></tr>' . + + // Expires + '<tr><th>Expires</th><td>' . + ($ban['expires'] == 0 ? + '<em>Never</em>' + : + strftime($config['post_date'], $ban['expires']) + ) . + '</td></tr>' . + + // Staff + '<tr><th>Staff</th><td>' . + (isset($ban['username']) ? + (!hasPermission($config['mod']['view_banstaff']) ? + ($config['mod']['view_banquestionmark'] ? + '?' + : + ($ban['type'] == JANITOR ? 'Janitor' : + ($ban['type'] == MOD ? 'Mod' : + ($ban['type'] == ADMIN ? 'Admin' : + '?'))) + ) + : + utf8tohtml($ban['username']) + ) + : '<em>deleted?</em>' + ) . + '</td></tr></table>' . + + '<input type="hidden" name="ban_id" value="' . $ban['id'] . '" />' . + + '<input type="submit" name="unban" value="Remove ban" ' . + (!hasPermission($config['mod']['unban']) ? 'disabled' : '') . + '/></form>'; + } + + $body .= '</fieldset>'; + + } + } + + if(hasPermission($config['mod']['ip_banform'])) + $body .= form_newBan($ip, null, '?/IP/' . $ip); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'IP: ' . $ip, + 'subtitle' => $host, + 'body'=>$body, + 'mod'=>true + ) + ); + } + } else { + error($config['error']['404']); + } +} + @@ -4,11 +4,11 @@ * Copyright (c) 2010-2012 Tinyboard Development Group */ -// WARNING: This file is currently a clusterfuck of code. I will be rewriting it very soon. - require 'inc/functions.php'; -require 'inc/mod.php'; +require 'inc/mod/auth.php'; +require 'inc/mod/pages.php'; +// Fix for magic quotes if (get_magic_quotes_gpc()) { function strip_array($var) { return is_array($var) ? array_map('strip_array', $var) : stripslashes($var); @@ -20,3103 +20,119 @@ if (get_magic_quotes_gpc()) { $query = isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : ''; -// If not logged in -if(!$mod) { - if(isset($_POST['login'])) { - // Check if inputs are set and not empty - if( !isset($_POST['username']) || - !isset($_POST['password']) || - empty($_POST['username']) || - empty($_POST['password']) - ) loginForm($config['error']['invalid'], $_POST['username'], '?' . $query); - - - if(!login($_POST['username'], $_POST['password'])) { - if($config['syslog']) - _syslog(LOG_WARNING, 'Unauthorized login attempt!'); - loginForm($config['error']['invalid'], $_POST['username'], '?' . $query); - } - - modLog("Logged in."); - - // Login successful - // Set cookies - setCookies(); - - // Redirect - if(isset($_POST['redirect'])) - header('Location: ' . $_POST['redirect'], true, $config['redirect_http']); - else - header('Location: ?' . $config['mod']['default'], true, $config['redirect_http']); - } else { - loginForm(false, false, '?' . $query); - } -} else { - // Redirect (for index pages) - if(count($_GET) == 2 && isset($_GET['status']) && isset($_GET['r'])) { - header('Location: ' . $_GET['r'], true, $_GET['status']); - exit; - } +$pages = array( + '' => ':?/', // redirect to dashboard + '/' => 'dashboard', // dashboard + '/confirm/(.+)' => 'confirm', // confirm action (if javascript didn't work) + '/logout' => 'logout', // logout - // A sort of "cache" - // Stops calling preg_quote and str_replace when not needed; only does it once - $regex = array( - 'board' => str_replace('%s', '(\w{1,8})', preg_quote($config['board_path'], '/')), - 'page' => str_replace('%d', '(\d+)', preg_quote($config['file_page'], '/')), - 'img' => preg_quote($config['dir']['img'], '/'), - 'thumb' => preg_quote($config['dir']['thumb'], '/'), - 'res' => preg_quote($config['dir']['res'], '/'), - 'index' => preg_quote($config['file_index'], '/') - ); + '/users' => 'users', // manage users + '/users/(\d+)' => 'user', // edit user + '/users/(\d+)/(promote|demote)' => 'user_promote', // prmote/demote user + '/users/new' => 'user_new', // create a new user + '/new_PM/([^/]+)' => 'new_pm', // create a new pm + '/PM/(\d+)(/reply)?' => 'pm', // read a pm + '/inbox' => 'inbox', // pm inbox - if(preg_match('/^\/?$/', $query)) { - // Dashboard - $fieldset = array( - 'Boards' => '', - 'Noticeboard' => '', - 'Administration' => '', - 'Themes' => '', - 'Search' => '', - 'Update' => '', - 'Logout' => '' - ); - - // Boards - $fieldset['Boards'] .= ulBoards(); - - if(hasPermission($config['mod']['noticeboard'])) { - if(!$config['cache']['enabled'] || !($fieldset['Noticeboard'] = cache::get('noticeboard_preview'))) { - $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); - $query->bindValue(':limit', $config['mod']['noticeboard_dashboard'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - $fieldset['Noticeboard'] .= '<li>'; - - $_body = ''; - while($notice = $query->fetch()) { - $_body .= '<li><a href="?/noticeboard#' . - $notice['id'] . - '">' . - ($notice['subject'] ? - $notice['subject'] - : - '<em>' . _('no subject') . '</em>' - ) . - '</a><span class="unimportant"> — by ' . - (isset($notice['username']) ? - utf8tohtml($notice['username']) - : '<em>???</em>') . - ' at ' . - strftime($config['post_date'], $notice['time']) . - '</span></li>'; - } - if(!empty($_body)) { - $fieldset['Noticeboard'] .= '<ul>' . $_body . '</ul></li><li>'; - } - if($config['cache']['enabled']) - cache::set('noticeboard_preview', $fieldset['Noticeboard']); - } - - $fieldset['Noticeboard'] .= '<a href="?/noticeboard">' . _('View all entries') . '</a></li>'; - - $query = prepare("SELECT COUNT(*) AS `count` FROM `pms` WHERE `to` = :id AND `unread` = 1"); - $query->bindValue(':id', $mod['id']); - $query->execute() or error(db_error($query)); - $count = $query->fetch(); - $count = $count['count']; - - $fieldset['Noticeboard'] .= '<li><a href="?/inbox">' . _('PM Inbox') . - ($count > 0 - ? - ' <strong>(' . $count . ' unread)</strong>' - : '') . - '</a></li>'; - - $fieldset['Noticeboard'] .= '<li><a href="?/news">' . _('News') . '</a></li>'; - } - - - if(hasPermission($config['mod']['reports'])) { - $fieldset['Administration'] .= '<li><a href="?/reports">' . _('Report queue') . '</a></li>'; - } - if(hasPermission($config['mod']['view_banlist'])) { - $fieldset['Administration'] .= '<li><a href="?/bans">' . _('Ban list') . '</a></li>'; - } - if(hasPermission($config['mod']['manageusers'])) { - $fieldset['Administration'] .= '<li><a href="?/users">' . _('Manage users') . '</a></li>'; - } elseif(hasPermission($config['mod']['change_password'])) { - $fieldset['Administration'] .= '<li><a href="?/users/' . $user['id'] . '">' . _('Change own password') . '</a></li>'; - } - if(hasPermission($config['mod']['modlog'])) { - $fieldset['Administration'] .= '<li><a href="?/log">' . _('Moderation log') . '</a></li>'; - } - if(hasPermission($config['mod']['rebuild'])) { - $fieldset['Administration'] .= '<li><a href="?/rebuild">' . _('Rebuild static files') . '</a></li>'; - } - if(hasPermission($config['mod']['rebuild']) && $config['cache']['enabled']) { - $fieldset['Administration'] .= '<li><a href="?/flush">' . _('Clear cache') . '</a></li>'; - } - if(hasPermission($config['mod']['show_config'])) { - $fieldset['Administration'] .= '<li><a href="?/config">' . _('Show configuration') . '</a></li>'; - } - - if(hasPermission($config['mod']['themes'])) { - $fieldset['Themes'] .= '<li><a href="?/themes">' . _('Manage themes') . '</a></li>'; - } - - if(hasPermission($config['mod']['search'])) { - $fieldset['Search'] .= '<li><form style="display:inline" action="?/search" method="post">' . - '<label style="display:inline" for="search">' . _('Phrase:') . '</label> ' . - '<input id="search" name="search" type="text" size="35" />' . - '<input type="submit" value="' . _('Search') . '" />' . - '</form>' . - '<p class="unimportant">' . _('(Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)') . '</p>' . - '</li>'; - } - - if($mod['type'] >= ADMIN && $config['check_updates']) { - if(!$config['version']) - error(_('Could not find current version! (Check .installed)')); - if(isset($_COOKIE['update'])) { - $latest = unserialize($_COOKIE['update']); - } else { - $ctx = stream_context_create(array( - 'http' => array( - 'timeout' => 3 - ) - ) - ); - - if($code = @file_get_contents('http://tinyboard.org/version.txt', 0, $ctx)) { - eval($code); - if(preg_match('/v(\d+)\.(\d)\.(\d+)(-dev.+)?$/', $config['version'], $m)) { - $current = array( - 'massive' => (int)$m[1], - 'major' => (int)$m[2], - 'minor' => (int)$m[3] - ); - if(isset($m[4])) { - // Development versions are always ahead in the versioning numbers - $current['minor'] --; - } - } - // Check if it's newer - if( $latest['massive'] > $current['massive'] || - $latest['major'] > $current['major'] || - ($latest['massive'] == $current['massive'] && - $latest['major'] == $current['major'] && - $latest['minor'] > $current['minor'] - )) { - $latest = $latest; - } else $latest = false; - } else { - // Couldn't get latest version - // TODO: Display some sort of warning message - $latest = false; - } - - - setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true); - } - - if($latest) { - $fieldset['Update'] .= - '<li>A newer version of Tinyboard (<strong>v' . - $latest['massive'] . '.' . - $latest['major'] . '.' . - $latest['minor'] . - '</strong>) is available! See <a href="http://tinyboard.org">http://tinyboard.org/</a> for upgrade instructions.</li>'; - } - } - - $fieldset['Logout'] .= '<li><a href="?/logout">' . _('Logout') . '</a></li>'; - - // TODO: Statistics, etc, in the dashboard. - - $body = ''; - foreach($fieldset as $title => $data) { - if($data) - $body .= '<fieldset><legend>' . _($title) . '</legend><ul>' . $data . '</ul></fieldset>'; - } - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('Dashboard'), - 'body'=>$body, - '__mod'=>true - )); - } elseif(preg_match('/^\/logout$/', $query)) { - destroyCookies(); - - header('Location: ?/', true, $config['redirect_http']); - } elseif(preg_match('/^\/confirm\/(.+)$/', $query, $matches)) { - $uri = &$matches[1]; - - $body = '<p style="text-align:center">' . - '<span class="heading" style="margin-bottom:6px">Are you sure you want to do that?</span>' . - 'We were unable to serve a confirmation dialog for ' . - '<strong>?/' . utf8tohtml($uri) . '</strong>' . - ', probably due to Javascript being disabled.' . - '</p>' . - '<p style="text-align:center"><a style="margin:block;font-size:150%;font-weight:bold" href="?/' . utf8tohtml($uri) . '">Confirm</a></p>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Confirm', - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/upgrade$/', $query)) { - if($mod['type'] != ADMIN) - error($config['error']['noaccess']); - - if(is_dir('.git')) { - // use git instead - - $body = '<div class="ban"><h2>git pull</h2>'; - $body .= '<p>' . str_replace("\n", '<br/>', shell_exec('git pull')) . '</p>'; - $body .= '</div>'; - echo Element('page.html', array( - 'config' => $config, - 'title' => 'Upgraded', - 'body' => $body - )); - exit; - } - - if(!extension_loaded('curl')) - error('You need the cURL PHP extension to do that.'); - - if(!class_exists('ZipArchive')) - error('You need <a href="http://php.net/manual/en/class.ziparchive.php">the ZipArchive class</a> to do that.'); - - if(!in_array('zip', stream_get_wrappers())) - error('You need the zip:// stream wrapper to do that.'); - - $temp = tempnam($config['tmp'], 'tinyboard'); - - $fp = fopen($temp, 'w+'); - - $curl = curl_init(); - curl_setopt($curl, CURLOPT_URL, 'https://github.com/savetheinternet/Tinyboard/zipball/master'); - curl_setopt($curl, CURLOPT_FAILONERROR, true); - curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true); - curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, true); - curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2); - curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 5); - curl_setopt($curl, CURLOPT_TIMEOUT, 45); - curl_setopt($curl, CURLOPT_FILE, $fp); - curl_setopt($curl, CURLOPT_WRITEHEADER, $header = tmpfile()); - curl_setopt($curl, CURLOPT_HEADER, true); - - curl_exec($curl); - - if(curl_errno($curl)) - error('Failed downloading newest revision: ' . curl_error($curl)); - - curl_close($curl); - - fflush($fp); - fclose($fp); - - fseek($header, 0); - $version = false; - while($line = fgets($header)) { - if(preg_match('/^Content-Disposition: attachment; filename=savetheinternet-Tinyboard-(.+)\.zip\s?$/', $line, $m)) { - $version = $m[1]; - } - } - fclose($header); - - $zip = new ZipArchive(); - if(!$zip->open($temp)) - error('Could not make sense of the ZIP archive.'); - - $version = preg_replace('/^savetheinternet-Tinyboard-(\w+)\//', '$1', $dir = $zip->getNameIndex(0)); - - $errors = array(); - for($i = 1; $i < $zip->numFiles; $i++) { - $filename = str_replace($dir, '', $zip->getNameIndex($i)); - - if($filename == 'inc/instance-config.php') - continue; // don't override config - - // are we able to write here? - if(!((file_exists($filename) && is_writable($filename)) || (!file_exists($filename) && is_writable(dirname($filename))))) { - // nope - $errors[] = 'Cannot write to ' . $filename . '!'; - } - } - - $zip->close(); - - if($errors) { - $body = '<div class="ban"><h2>Error(s) upgrading</h2><p>Tinyboard can not self-upgrade until the following is fixed:</p><ul>'; - foreach($errors as $error) { - $body .= '<li>' . $error . '</li>'; - } - $body .= '</ul><p>Please fix the above errors and refresh to try again.</p></div>'; - - unlink($temp); - - echo Element('page.html', array( - 'config' => $config, - 'title' => 'Error(s) upgrading', - 'body' => $body - )); - exit; - } - - // For some reason, reading the ZIP entries in PHP doesn't seem to work very well. - // Use shell instead. - shell_exec('TEMP_DIR=$(mktemp -d); unzip -q ' . escapeshellarg($temp) . ' -d $TEMP_DIR -x "' . escapeshellarg($dir) . 'inc/instance-config.php"; mv -v $TEMP_DIR/' . escapeshellarg($dir) . '* "' . getcwd() . '"; rm -rf $TEMP_DIR'); - - unlink($temp); - - echo Element('page.html', array( - 'config' => $config, - 'title' => 'Upgraded', - 'body' => '<p style="text-align:center">Upgrading seems to have gone okay. You are now at revision <strong>' . $version . '</strong>.</p>' - )); - } elseif(preg_match('/^\/log(\/(\d+))?$/', $query, $match)) { - if(!hasPermission($config['mod']['modlog'])) error($config['error']['noaccess']); - - $page = isset($match[2]) ? $match[2] : 1; - - $query = prepare("SELECT `mod` as `id`, `username`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY `time` DESC LIMIT :offset, :limit"); - $query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT); - $query->bindValue(':offset', ($page - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if(!$query->rowCount()) { - $body = '<p class="unimportant" style="text-align:center">(Nothing to display.)</p>'; - } else { - $body = '<table class="modlog">' . - '<tr>' . - '<th>' . _('User') . '</th>' . - '<th>' . _('IP address') . '</th>' . - '<th>' . _('Ago') . '</th>' . - '<th>' . _('Board') . '</th>' . - '<th>' . _('Action') . '</th>' . - '</tr>'; - while($log = $query->fetch()) { - $log_id = 'log_' . md5($log['text']); - - if($config['cache']['enabled'] && $_log = cache::get($log_id)) - $log['text'] = $_log; - else { - - $log['text'] = utf8tohtml($log['text']); - $log['text'] = preg_replace('/(\d+\.\d+\.\d+\.\d+)/', '<a href="?/IP/$1">$1</a>', $log['text']); - - if(isset($log['board'])) { - if(preg_match('/post #(\d+)/', $log['text'], $match)) { - $post_query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $log['board'])); - $post_query->bindValue(':id', $match[1], PDO::PARAM_INT); - $post_query->execute() or error(db_error($query)); - - if($post = $post_query->fetch()) { - $log['text'] = preg_replace('/post (#(\d+))/', - 'post <a href="' . - '?/' . - sprintf($config['board_path'], $log['board']) . - $config['dir']['res'] . - ($post['thread'] ? - sprintf($config['file_page'], $post['thread']) . '#' . $match[1] - : sprintf($config['file_page'], $match[1])) . - '">$1</a>', $log['text']); - } else { - $log['text'] = preg_replace('/post (#(\d+))/', 'post <s>$1</s>', $log['text']); - } - - if($config['cache']['enabled']) - cache::set($log_id, $log['text']); - } - } - } - - $body .= '<tr>' . - '<td class="minimal">' . - ($log['username'] ? - '<a href="?/new_PM/' . $log['id'] . '">' . $log['username'] . '</a>' - : '<em>' . ($log['id'] < 0 ? 'system' : 'deleted?') . '</em>') . - '</td>' . - '<td class="minimal">' . ($log['id'] < 0 ? '–' : '<a href="?/IP/' . $log['ip'] . '">' . $log['ip'] . '</a>') . '</td>' . - '<td class="minimal">' . ago($log['time']) . '</td>' . - '<td class="minimal">' . - ($log['board'] ? - '<a href="?/' . sprintf($config['board_path'], $log['board']) . $config['file_index'] . '">' . sprintf($config['board_abbreviation'], $log['board']) . '</a></td>' - : '-') . - '<td>' . $log['text'] . '</td>' . - '</tr>'; - } - - $body .= '</table>'; - - $query = prepare("SELECT COUNT(*) AS `count` FROM `modlogs`"); - $query->execute() or error(db_error($query)); - $count = $query->fetch(); - - $body .= '<p class="unimportant" style="text-align:center;word-wrap:break-word">'; - for($x = 0; $x < $count['count'] / $config['mod']['modlog_page']; $x ++) { - $body .= '<a href="?/log/' . ($x+1) . '">[' . ($x + 1) . ']</a> '; - } - $body .= '</p>'; - } - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('Moderation log'), - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/themes\/none$/', $query, $match)) { - if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); - - // Clearsettings - query("TRUNCATE TABLE `theme_settings`") or error(db_error()); - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'No theme', - 'body'=>'<p style="text-align:center">Successfully uninstalled all themes.</p>' . - '<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>', - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/themes\/([\w\-]+)\/rebuild$/', $query, $match)) { - if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); - - rebuildTheme($match[1], 'all'); - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Rebuilt', - 'body'=>'<p style="text-align:center">Successfully rebuilt the <strong>' . $match[1] . '</strong> theme.</p>' . - '<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>', - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/themes\/(\w+)\/uninstall$/', $query, $match)) { - if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); - - $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); - $query->bindValue(':theme', $match[1]); - $query->execute() or error(db_error($query)); - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Uninstalled', - 'body'=>'<p style="text-align:center">Successfully uninstalled the <strong>' . $match[1] . '</strong> theme.</p>' . - '<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>', - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/themes(\/([\w\-]+))?$/', $query, $match)) { - if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); - - if(!is_dir($config['dir']['themes'])) - error(_('Themes directory doesn\'t exist!')); - if(!$dir = opendir($config['dir']['themes'])) - error(_('Cannot open themes directory; check permissions.')); - - if(isset($match[2])) { - $_theme = &$match[2]; - - if(!$theme = loadThemeConfig($_theme)) { - error($config['error']['invalidtheme']); - } - - if(isset($_POST['install'])) { - // Check if everything is submitted - foreach($theme['config'] as &$c) { - if(!isset($_POST[$c['name']]) && $c['type'] != 'checkbox') - error(sprintf($config['error']['required'], $c['title'])); - } - - // Clear previous settings - $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); - $query->bindValue(':theme', $_theme); - $query->execute() or error(db_error($query)); - - foreach($theme['config'] as &$c) { - $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, :name, :value)"); - $query->bindValue(':theme', $_theme); - $query->bindValue(':name', $c['name']); - $query->bindValue(':value', $_POST[$c['name']]); - $query->execute() or error(db_error($query)); - } - - $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, NULL, NULL)"); - $query->bindValue(':theme', $_theme); - $query->execute() or error(db_error($query)); - - $result = true; - $body = ''; - if(isset($theme['install_callback'])) { - $ret = $theme['install_callback'](themeSettings($_theme)); - if($ret && !empty($ret)) { - if(is_array($ret) && count($ret) == 2) { - $result = $ret[0]; - $ret = $ret[1]; - } - $body .= '<div style="border:1px dashed maroon;padding:20px;margin:auto;max-width:800px">' . $ret . '</div>'; - } - } - - if($result) { - $body .= '<p style="text-align:center">Successfully installed and built theme.</p>'; - } else { - // install failed - $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); - $query->bindValue(':theme', $_theme); - $query->execute() or error(db_error($query)); - } - - $body .= '<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>'; - - // Build themes - rebuildThemes('all'); - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>($result ? 'Installed "' . utf8tohtml($theme['name']) . '"' : 'Installation failed!'), - 'body'=>$body, - 'mod'=>true - ) - ); - } else { - $body = '<form action="" method="post">'; - - if(!isset($theme['config']) || empty($theme['config'])) { - $body .= '<p style="text-align:center" class="unimportant">(No configuration required.)</p>'; - } else { - $settings = themeSettings($_theme); - - $body .= '<table>'; - foreach($theme['config'] as &$c) { - $body .= '<tr><th>' . $c['title'] . '</th><td>'; - switch($c['type']) { - case 'text': - default: - $body .= '<input type="text" name="' . utf8tohtml($c['name']) . '" ' . - (isset($settings[$c['name']]) ? - ' value="' . utf8tohtml($settings[$c['name']]) . '" ' - : - (isset($c['default']) ? - 'value="' . utf8tohtml($c['default']) . '" ' - : '') - ) . - (isset($c['size']) ? 'size="' . (int)$c['size'] . '" ' :'') . - '/>'; - } - if(isset($c['comment'])) - $body .= ' <span class="unimportant">' . $c['comment'] . '</span>'; - $body .= '</td></tr>'; - } - $body .= '</table>'; - } - - $body .= '<p style="text-align:center"><input name="install" type="submit" value="Install theme" /></p></form>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Installing "' . utf8tohtml($theme['name']) . '"', - 'body'=>$body, - 'mod'=>true - ) - ); - } - } else { - - $themes_in_use = array(); - $query = query("SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error()); - while($theme = $query->fetch()) { - $themes_in_use[$theme['theme']] = true; - } - - // Scan directory for themes - $themes = array(); - while($file = readdir($dir)) { - if($file[0] != '.' && is_dir($config['dir']['themes'] . '/' . $file)) { - $themes[] = $file; - } - } - closedir($dir); - - $body = ''; - if(empty($themes)) { - $body = '<p style="text-align:center" class="unimportant">(No themes installed.)</p>'; - } else { - $body .= '<table class="modlog">'; - foreach($themes as &$_theme) { - $theme = loadThemeConfig($_theme); - - markup($theme['description']); - - $body .= '<tr>' . - '<th class="minimal">' . _('Name') . '</th>' . - '<td>' . utf8tohtml($theme['name']) . '</td>' . - '</tr>' . - '<tr>' . - '<th class="minimal">' . _('Version') . '</th>' . - '<td>' . utf8tohtml($theme['version']) . '</td>' . - '</tr>' . - '<tr>' . - '<th class="minimal">' . _('Description') . '</th>' . - '<td>' . $theme['description'] . '</td>' . - '</tr>' . - '<tr>' . - '<th class="minimal">' . _('Thumbnail') . '</th>' . - '<td><img style="float:none;margin:4px' . - (isset($themes_in_use[$_theme]) ? - ';border:2px solid red;padding:4px' - : '') . - '" src="' . $config['dir']['themes_uri'] . '/' . $_theme . '/thumb.png" /></td>' . - '</tr>' . - '<tr>' . - '<th class="minimal">' . _('Actions') . '</th>' . - '<td><ul style="padding:0 20px">' . - '<li><a title="' . _('Use theme') . '" href="?/themes/' . $_theme . '">' . - (isset($themes_in_use[$_theme]) ? _('Reconfigure') : _('Install')) . - '</a></li>' . - (isset($themes_in_use[$_theme]) ? - '<li><a href="?/themes/' . $_theme . '/rebuild">' . _('Rebuild') . '</a></li>' . - '<li><a href="?/themes/' . $_theme . '/uninstall">' . _('Uninstall') . '</a></li>' - : - '') . - '</ul></td>' . - '</tr>' . - '<tr style="height:40px"><td colspan="2"><hr/></td></tr>'; - } - $body .= '</table>'; - } - - if(!empty($themes_in_use)) - $body .= '<p style="text-align:center"><a href="?/themes/none">' . _('Uninstall all themes.') . '</a></p>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('Manage themes'), - 'body'=>$body, - 'mod'=>true - ) - ); - } - } elseif(preg_match('/^\/noticeboard\/delete\/(\d+)$/', $query, $match)) { - if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']); - - $query = prepare("DELETE FROM `noticeboard` WHERE `id` = :id"); - $query->bindValue(':id', $match[1], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if($config['cache']['enabled']) - cache::delete('noticeboard_preview'); - - header('Location: ?/noticeboard', true, $config['redirect_http']); - } elseif(preg_match('/^\/noticeboard$/', $query)) { - if(!hasPermission($config['mod']['noticeboard'])) error($config['error']['noaccess']); - - $body = ''; - - if(hasPermission($config['mod']['noticeboard_post']) && isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) { - $query = prepare("INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)"); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - $query->bindvalue(':time', time(), PDO::PARAM_INT); - $query->bindValue(':subject', utf8tohtml($_POST['subject'])); - - markup($_POST['body']); - $query->bindValue(':body', $_POST['body']); - $query->execute() or error(db_error($query)); - - if($config['cache']['enabled']) - cache::delete('noticeboard_preview'); - - header('Location: ?/noticeboard#' . $pdo->lastInsertId(), true, $config['redirect_http']); - } else { - - if(hasPermission($config['mod']['noticeboard_post'])) { - $body .= '<fieldset><legend>New post</legend><form style="display:inline" action="" method="post"><table>' . - '<tr>' . - '<th><label for="subject">' . _('Name') . '</label></th>' . - '<td>' . $mod['username'] . '</td>' . - '</tr><tr>' . - '<th>' . _('Subject') . '</th>' . - '<td><input type="text" size="55" name="subject" id="subject" /></td>' . - '</tr><tr>' . - '<th>' . _('Body') . '</th>' . - '<td><textarea name="body" style="width:100%;height:100px"></textarea></td>' . - '</tr><tr>' . - '<td></td><td><input type="submit" value="' . _('Post to noticeboard') . '" /></td>' . - '</tr></table>' . - '</form></fieldset>'; - } - - $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); - $query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - while($notice = $query->fetch()) { - $body .= '<div class="ban">' . - (hasPermission($config['mod']['noticeboard_delete']) ? - '<span style="float:right;padding:2px"><a class="unimportant" href="?/noticeboard/delete/' . $notice['id'] . '">[delete]</a></span>' - : '') . - '<h2 id="' . $notice['id'] . '">' . - ($notice['subject'] ? - $notice['subject'] - : - '<em>' . _('no subject') . '</em>' - ) . - '<span class="unimportant"> — by ' . - (isset($notice['username']) ? - utf8tohtml($notice['username']) - : - '<em>???</em>' - ) . - ' at ' . - strftime($config['post_date'], $notice['time']) . - '</span></h2><p>' . $notice['body'] . '</p></div>'; - } - - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('Noticeboard'), - 'body'=>$body, - 'mod'=>true - ) - ); - } - } elseif(preg_match('/^\/news\/delete\/(\d+)$/', $query, $match)) { - if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']); - - $query = prepare("DELETE FROM `news` WHERE `id` = :id"); - $query->bindValue(':id', $match[1], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - rebuildThemes('news'); - - header('Location: ?/news', true, $config['redirect_http']); - } elseif(preg_match('/^\/news$/', $query)) { - $body = ''; - - if(hasPermission($config['mod']['news'])) { - if(isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) { - $query = prepare("INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)"); - - if(isset($_POST['name']) && hasPermission($config['mod']['news_custom'])) - $name = &$_POST['name']; - else - $name = &$mod['username']; - - $query->bindValue(':name', utf8tohtml($name), PDO::PARAM_INT); - $query->bindvalue(':time', time(), PDO::PARAM_INT); - $query->bindValue(':subject', utf8tohtml($_POST['subject'])); - - markup($_POST['body']); - $query->bindValue(':body', $_POST['body']); - $query->execute() or error(db_error($query)); - - rebuildThemes('news'); - } - - $body .= '<fieldset><legend>New post</legend><form style="display:inline" action="" method="post"><table>' . - '<tr>' . - '<th>' . _('Name') . '</th>' . - (hasPermission($config['mod']['news_custom']) ? - '<td><input type="text" size="55" name="name" id="name" value="' . utf8tohtml($mod['username']) . '" /></td>' - : - '<td>' . $mod['username'] . '</td>') . - '</tr><tr>' . - '<th>' . _('Subject') . '</th>' . - '<td><input type="text" size="55" name="subject" id="subject" /></td>' . - '</tr><tr>' . - '<th>' . _('Body') . '</th>' . - '<td><textarea name="body" style="width:100%;height:100px"></textarea></td>' . - '</tr><tr>' . - '<td></td><td><input type="submit" value="' . _('Post to news') . '" /></td>' . - '</tr></table>' . - '</form></fieldset>'; - } - - $query = prepare("SELECT * FROM `news` ORDER BY `id` DESC LIMIT :limit"); - $query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - while($news = $query->fetch()) { - $body .= '<div class="ban">' . - (hasPermission($config['mod']['news_delete']) ? - '<span style="float:right;padding:2px"><a class="unimportant" href="?/news/delete/' . $news['id'] . '">[delete]</a></span>' - : '') . - '<h2 id="' . $news['id'] . '">' . - ($news['subject'] ? - $news['subject'] - : - '<em>' . _('no subject') . '</em>' - ) . - '<span class="unimportant"> — by ' . - $news['name'] . - ' at ' . - strftime($config['post_date'], $news['time']) . - '</span></h2><p>' . $news['body'] . '</p></div>'; - } - - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('News'), - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/inbox\/readall$/', $query, $match)) { - $query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `to` = :id"); - $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - modLog('Marked all PMs as read'); - - header('Location: ?/inbox', true, $config['redirect_http']); - } elseif(preg_match('/^\/inbox$/', $query, $match)) { - $query = prepare("SELECT `unread`,`pms`.`id`, `time`, `sender`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC"); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if($query->rowCount() == 0) { - $body = '<p style="text-align:center" class="unimportant">(' . _('No private messages for you.') . ')</p>'; - } else { - $unread_pms = 0; - - $body = '<table class="modlog"><tr><th>ID</th><th>From</th><th>Date</th><th>Message snippet</th></tr>'; - while($pm = $query->fetch()) { - $body .= '<tr' . ($pm['unread'] ? ' style="font-weight:bold"' : '') . '>' . - '<td class="minimal"><a href="?/PM/' . $pm['id'] . '">' . $pm['id'] . '</a></td>' . - '<td class="minimal">' . - ($pm['username'] ? - '<a href="?/new_PM/' . $pm['sender'] . '">' . $pm['username'] . '</a>' - : '<em>deleted?</em>') . - '</td>' . - '<td class="minimal">' . strftime($config['post_date'], $pm['time']) . '</td>' . - '<td><a href="?/PM/' . $pm['id'] . '">' . pm_snippet($pm['message']) . '</a></td>' . - '</tr>'; - - if($pm['unread']) - $unread_pms++; - } - $body .= '</table>'; - - if($unread_pms) { - $body = '<p style="text-align:center" class="unimportant">(<a href="?/inbox/readall">Mark all as read</a>)</p>' . $body; - } - } - - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('PM Inbox') . ' (' . ($query->rowCount() == 0 ? _('empty') : $unread_pms . ' ' . _('unread')) . ')', - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/PM\/(\d+)$/', $query, $match)) { - $id = &$match[1]; - - if(hasPermission($config['mod']['master_pm'])) { - $query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id"); - } else { - $query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id AND `to` = :mod"); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - } - - $query->bindValue(':id', $id, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if(!$pm = $query->fetch()) { - // Mod doesn't exist - error($config['error']['404']); - } - - if(isset($_POST['delete'])) { - $query = prepare("DELETE FROM `pms` WHERE `id` = :id"); - $query->bindValue(':id', $id, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - modLog('Deleted a PM'); - - header('Location: ?/inbox', true, $config['redirect_http']); - } else { - if($pm['unread']) { - $query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `id` = :id"); - $query->bindValue(':id', $id, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - modLog('Read a PM'); - } - - if($pm['to'] != $mod['id']) { - $query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id"); - $query->bindValue(':id', $pm['to'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if($_mod = $query->fetch()) { - $__to = &$_mod['username']; - } else { - $__to = false; - } - } - - $body = '<form action="" method="post" style="margin:0"><table>' . - - '<th>From</th><td>' . - (!$pm['username'] ? - '<em>???</em>' - : - '<a href="?/new_PM/' . $pm['sender'] . '">' . utf8tohtml($pm['username']) . '</a>' - ) . - '</td></tr>' . - - (isset($__to) ? - '<th>To</th><td>' . - ($__to === false ? - '<em>???</em>' - : - '<a href="?/new_PM/' . $pm['to'] . '">' . utf8tohtml($__to) . '</a>' - ) . - '</td></tr>' - : '') . - - '<tr><th>Date</th><td> ' . strftime($config['post_date'], $pm['time']) . '</td></tr>' . - - '<tr><th>Message</th><td> ' . $pm['message'] . '</td></tr>' . - - '</table>' . - - '<p style="text-align:center"><input type="submit" name="delete" value="Delete forever" /></p>' . - - '</form>' . - - '<p style="text-align:center"><a href="?/new_PM/' . $pm['sender'] . '/' . $pm['id'] . '">Reply with quote</a></p>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Private message', - 'body'=>$body, - 'mod'=>true - ) - ); - } - } elseif(preg_match('/^\/new_PM\/(\d+)(\/(\d+))?$/', $query, $match)) { - if(!hasPermission($config['mod']['create_pm'])) error($config['error']['noaccess']); - - $to = &$match[1]; - - $query = prepare("SELECT `username`,`id` FROM `mods` WHERE `id` = :id"); - $query->bindValue(':id', $to, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if(!$to = $query->fetch()) { - // Mod doesn't exist - error($config['error']['404']); - } - - if(isset($_POST['message'])) { - // Post message - $message = &$_POST['message']; - - if(empty($message)) - error($config['error']['tooshort_body']); - - markup($message); - - $query = prepare("INSERT INTO `pms` VALUES (NULL, :sender, :to, :message, :time, 1)"); - $query->bindValue(':sender', $mod['id'], PDO::PARAM_INT); - $query->bindValue(':to', $to['id'], PDO::PARAM_INT); - $query->bindValue(':message', $message); - $query->bindValue(':time', time(), PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - modLog('Sent a PM to ' . $to['username']); - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'PM sent', - 'body'=>'<p style="text-align:center">Message sent successfully to ' . utf8tohtml($to['username']) . '.</p>', - 'mod'=>true - ) - ); - } else { - $value = ''; - if(isset($match[3])) { - $reply = &$match[3]; - - $query = prepare("SELECT `message` FROM `pms` WHERE `sender` = :sender AND `to` = :mod AND `id` = :id"); - $query->bindValue(':sender', $to['id'], PDO::PARAM_INT); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - $query->bindValue(':id', $reply, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - if($pm = $query->fetch()) { - $value = quote($pm['message']); - } - } - - - $body = '<form action="" method="post">' . - - '<table>' . - - '<tr><th>To</th><td>' . - (hasPermission($config['mod']['editusers']) ? - '<a href="?/users/' . $to['id'] . '">' . utf8tohtml($to['username']) . '</a>' : - utf8tohtml($to['username']) - ) . - '</td>' . - - '<tr><th>Message</th><td><textarea name="message" rows="10" cols="40">' . $value . '</textarea></td>' . - - '</table>' . - - '<p style="text-align:center"><input type="submit" value="Send message" /></p>' . - - '</form>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'New PM for ' . utf8tohtml($to['username']), - 'body'=>$body, - 'mod'=>true - ) - ); - } - } elseif(preg_match('/^\/search$/', $query)) { - if(!hasPermission($config['mod']['search'])) error($config['error']['noaccess']); - - $body = '<div class="ban"><h2>Search</h2><form style="display:inline" action="?/search" method="post">' . - '<p><label style="display:inline" for="search">Phrase:</label> ' . - '<input id="search" name="search" type="text" size="35" ' . - (isset($_POST['search']) ? 'value="' . str_replace('"', '"', utf8tohtml($_POST['search'])) . '" ' : '') . - '/>' . - '<input type="submit" value="Search" />' . - '</p></form>' . - '<p><span class="unimportant">(Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)</span></p>' . - '</div>'; - - if(isset($_POST['search']) && !empty($_POST['search'])) { - $phrase = &$_POST['search']; - $_body = ''; - - $filters = array(); - - function search_filters($m) { - global $filters; - $name = $m[2]; - $value = isset($m[4]) ? $m[4] : $m[3]; - - if(!in_array($name, array('id', 'thread', 'subject', 'email', 'name', 'trip', 'capcode', 'filename', 'filehash', 'ip'))) { - // unknown filter - return $m[0]; - } - - $filters[$name] = $value; - - return $m[1]; - } - - $phrase = trim(preg_replace_callback('/(^|\s)(\w+):("(.*)?"|[^\s]*)/', 'search_filters', $phrase)); - - // Escape escape character - $phrase = str_replace('!', '!!', $phrase); - - // Remove SQL wildcard - $phrase = str_replace('%', '!%', $phrase); - - // Use asterisk as wildcard to suit convention - $phrase = str_replace('*', '%', $phrase); - - $like = ''; - $match = array(); - - // Find exact phrases - if(preg_match_all('/"(.+?)"/', $phrase, $m)) { - foreach($m[1] as &$quote) { - $phrase = str_replace("\"{$quote}\"", '', $phrase); - $match[] = $pdo->quote($quote); - } - } - - $words = explode(' ', $phrase); - foreach($words as &$word) { - if(empty($word)) - continue; - $match[] = $pdo->quote($word); - } - - $like = ''; - foreach($match as &$phrase) { - if(!empty($like)) - $like .= ' AND '; - $phrase = preg_replace('/^\'(.+)\'$/', '\'%$1%\'', $phrase); - $like .= '`body` LIKE ' . $phrase . ' ESCAPE \'!\''; - } - - foreach($filters as $name => $value) { - if(!empty($like)) - $like .= ' AND '; - $like .= '`' . $name . '` = '. $pdo->quote($value); - } - - $like = str_replace('%', '%%', $like); - - $boards = listBoards(); - foreach($boards as &$_b) { - openBoard($_b['uri']); - - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE " . $like . " ORDER BY `time` DESC LIMIT :limit", $board['uri'])); - $query->bindValue(':limit', $config['mod']['search_results'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - $temp = ''; - while($post = $query->fetch()) { - if(!$post['thread']) { - $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); - } else { - $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); - } - $temp .= $po->build(true) . '<hr/>'; - } - - if(!empty($temp)) - $_body .= '<fieldset><legend>' . $query->rowCount() . ' result' . ($query->rowCount() != 1 ? 's' : '') . ' on <a href="?/' . - sprintf($config['board_path'], $board['uri']) . $config['file_index'] . - '">' . - sprintf($config['board_abbreviation'], $board['uri']) . ' - ' . $board['title'] . - '</a></legend>' . $temp . '</fieldset>'; - } - - $body .= '<hr/>'; - if(!empty($_body)) - $body .= $_body; - else - $body .= '<p style="text-align:center" class="unimportant">(No results.)</p>'; - } - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Search', - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/users$/', $query)) { - if(!hasPermission($config['mod']['manageusers'])) error($config['error']['noaccess']); - - $body = '<form action="" method="post"><table class="modlog" style="width:auto"><tr><th>' . _('ID') . '</th><th>' . _('Username') . '</th><th>' . _('Type') . '</th><th>' . _('Boards') . '</th><th>' . _('Last action') . '</th><th>…</th></tr>'; - - $query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error()); - while($_mod = $query->fetch()) { - $type = $_mod['type'] == JANITOR ? 'Janitor' : ($_mod['type'] == MOD ? 'Mod' : 'Admin'); - - $_mod['boards'] = explode(',', $_mod['boards']); - foreach($_mod['boards'] as &$_board) { - if($_board != '*') - $_board = '/' . $_board . '/'; - } - - $body .= '<tr>' . - '<td>' . - $_mod['id'] . - '</td>' . - - '<td>' . - utf8tohtml($_mod['username']) . - '</td>' . - - '<td>' . - $type . - '</td>' . - - '<td>' . - implode(', ', $_mod['boards']) . - '</td>' . - - '<td>' . - ($_mod['last'] ? - (hasPermission($config['mod']['modlog']) ? - '<span title="' . str_replace('"', '"', utf8tohtml($_mod['action'])) . '">' . ago($_mod['last']) . '</span>' - : ago($_mod['last'])) - : '<em>never</em>') . - '</td>' . - - '<td style="white-space:nowrap">' . - (hasPermission($config['mod']['promoteusers']) ? - ($_mod['type'] != ADMIN ? - '<a style="float:left;text-decoration:none" href="?/users/' . $_mod['id'] . '/promote" title="Promote">▲</a>' - :'') . - ($_mod['type'] != JANITOR ? - '<a style="float:left;text-decoration:none" href="?/users/' . $_mod['id'] . '/demote" title="Demote">▼</a>' - :'') - : '' - ) . - (hasPermission($config['mod']['editusers']) || - (hasPermission($config['mod']['change_password']) && $_mod['id'] == $mod['id'])? - '<a class="unimportant" style="margin-left:5px;float:right" href="?/users/' . $_mod['id'] . '">[edit]</a>' - : '' ) . - (hasPermission($config['mod']['create_pm']) ? - '<a class="unimportant" style="margin-left:5px;float:right" href="?/new_PM/' . $_mod['id'] . '">[PM]</a>' - : '' ) . - '</td></tr>'; - } - - $body .= '</table>'; - - if(hasPermission($config['mod']['createusers'])) { - $body .= '<p style="text-align:center"><a href="?/users/new">' . _('Create new user') . '</a></p>'; - } - - $body .= '</form>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('Manage users'), - 'body'=>$body - ,'mod'=>true - ) - ); - } elseif(preg_match('/^\/users\/new$/', $query)) { - if(!hasPermission($config['mod']['createusers'])) error($config['error']['noaccess']); - - if(isset($_POST['username']) && isset($_POST['password'])) { - if(!isset($_POST['type'])) { - error(sprintf($config['error']['required'], 'type')); - } - - if($_POST['type'] != ADMIN && $_POST['type'] != MOD && $_POST['type'] != JANITOR) { - error(sprintf($config['error']['invalidfield'], 'type')); - } - - // Check if already exists - $query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username"); - $query->bindValue(':username', $_POST['username']); - $query->execute() or error(db_error($query)); - - if($_mod = $query->fetch()) { - error(sprintf($config['error']['modexists'], $_mod['id'])); - } - - $boards = array(); - foreach($_POST as $name => $null) { - if(preg_match('/^board_(.+)$/', $name, $m)) - $boards[] = $m[1]; - } - $boards = implode(',', $boards); - - $query = prepare("INSERT INTO `mods` VALUES (NULL, :username, :password, :type, :boards)"); - $query->bindValue(':username', $_POST['username']); - $query->bindValue(':password', sha1($_POST['password'])); - $query->bindValue(':type', $_POST['type'], PDO::PARAM_INT); - $query->bindValue(':boards', $boards); - $query->execute() or error(db_error($query)); - - modLog('Create a new user: "' . $_POST['username'] . '"'); - header('Location: ?/users', true, $config['redirect_http']); - } else { - - $__boards = '<ul style="list-style:none;padding:2px 5px">'; - $boards = array_merge( - array(array('uri' => '*', 'title' => 'All') - ), listBoards()); - foreach($boards as &$_board) { - $__boards .= '<li>' . - '<input type="checkbox" name="board_' . $_board['uri'] . '" id="board_' . $_board['uri'] . '">' . - '<label style="display:inline" for="board_' . $_board['uri'] . '"> ' . - ($_board['uri'] == '*' ? - '<em>"*"</em>' - : - sprintf($config['board_abbreviation'], $_board['uri']) - ) . - ' - ' . $_board['title'] . - '</label>' . - '</li>'; - } - - $body = '<fieldset><legend>New user</legend>' . - - // Begin form - '<form style="text-align:center" action="" method="post">' . - - '<table>' . - - '<tr><th>Username</th><td><input size="20" maxlength="30" type="text" name="username" value="" autocomplete="off" /></td></tr>' . - '<tr><th>Password</th><td><input size="20" maxlength="30" type="password" name="password" value="" autocomplete="off" /></td></tr>' . - '<tr><th>Type</th><td>' . - '<div><label for="janitor">Janitor</label> <input type="radio" id="janitor" name="type" value="' . JANITOR . '" /></div>' . - '<div><label for="mod">Mod</label> <input type="radio" id="mod" name="type" value="' . MOD . '" /></div>' . - '<div><label for="admin">Admin</label> <input type="radio" id="admin" name="type" value="' . ADMIN . '" /></div>' . - '</td></tr>' . - '<tr><th>Boards</th><td>' . $__boards . '</td></tr>' . - '</table>' . - - '<input style="margin-top:10px" type="submit" value="Create user" />' . - - // End form - '</form></fieldset>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'New user', - 'body'=>$body - ,'mod'=>true - ) - ); - } - } elseif(preg_match('/^\/users\/(\d+)(\/(promote|demote|delete))?$/', $query, $matches)) { - $modID = &$matches[1]; - - if(isset($matches[2])) { - if($matches[3] == 'delete') { - if(!hasPermission($config['mod']['deleteusers'])) error($config['error']['noaccess']); - - $query = prepare("DELETE FROM `mods` WHERE `id` = :id"); - $query->bindValue(':id', $modID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - modLog('Deleted user #' . $modID); - } else { - // Promote/demote - if(!hasPermission($config['mod']['promoteusers'])) error($config['error']['noaccess']); - - if($matches[3] == 'promote') { - $query = prepare("UPDATE `mods` SET `type` = `type` + 1 WHERE `type` != :admin AND `id` = :id"); - $query->bindValue(':admin', ADMIN, PDO::PARAM_INT); - } else { - $query = prepare("UPDATE `mods` SET `type` = `type` - 1 WHERE `type` != :janitor AND `id` = :id"); - $query->bindValue(':janitor', JANITOR, PDO::PARAM_INT); - } - - $query->bindValue(':id', $modID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } - header('Location: ?/users', true, $config['redirect_http']); - } else { - // Edit user - if(!hasPermission($config['mod']['editusers']) && !hasPermission($config['mod']['change_password'])) - error($config['error']['noaccess']); - - $query = prepare("SELECT * FROM `mods` WHERE `id` = :id"); - $query->bindValue(':id', $modID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if(!$_mod = $query->fetch()) { - error($config['error']['404']); - } - - if(!hasPermission($config['mod']['editusers']) && !(hasPermission($config['mod']['change_password']) && $mod['id'] == $_mod['id'] && $change_password_only = true)) - error($config['error']['noaccess']); - - if((isset($_POST['username']) && isset($_POST['password'])) || (isset($change_password_only) && isset($_POST['password']))) { - if(!isset($change_password_only)) { - $boards = array(); - foreach($_POST as $name => $null) { - if(preg_match('/^board_(.+)$/', $name, $m)) - $boards[] = $m[1]; - } - $boards = implode(',', $boards); - - $query = prepare("UPDATE `mods` SET `username` = :username, `boards` = :boards WHERE `id` = :id"); - $query->bindValue(':username', $_POST['username'], PDO::PARAM_STR); - $query->bindValue(':boards', $boards, PDO::PARAM_STR); - $query->bindValue(':id', $modID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - modLog('Edited login details for user "' . $_mod['username'] . '"'); - } else { - modLog('Changed own password'); - } - if(!empty($_POST['password'])) { - $query = prepare("UPDATE `mods` SET `password` = :password WHERE `id` = :id"); - $query->bindValue(':password', sha1($_POST['password'])); - $query->bindValue(':id', $modID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } - - // Refresh - $query = prepare("SELECT * FROM `mods` WHERE `id` = :id"); - $query->bindValue(':id', $modID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if(!$_mod = $query->fetch()) { - error($config['error']['404']); - } - - if($_mod['id'] == $mod['id']) { - // Changed own password. Update cookies - - if(!login($_mod['username'], $_mod['password'], false, true)) - error(_('Could not re-login after changing password. (?)')); - - setCookies(); - } - - if(hasPermission($config['mod']['manageusers'])) - header('Location: ?/users', true, $config['redirect_http']); - else - header('Location: ?/', true, $config['redirect_http']); - exit; - } - - $__boards = '<ul style="list-style:none;padding:2px 5px">'; - $boards = array_merge( - array(array('uri' => '*', 'title' => 'All') - ), listBoards()); - - $_mod['boards'] = explode(',', $_mod['boards']); - foreach($boards as &$_board) { - $__boards .= '<li>' . - '<input type="checkbox" name="board_' . $_board['uri'] . '" id="board_' . $_board['uri'] . '"' . - (in_array($_board['uri'], $_mod['boards']) ? - ' checked="checked"' - : '') . - '/> ' . - '<label style="display:inline" for="board_' . $_board['uri'] . '">' . - ($_board['uri'] == '*' ? - '<em>"*"</em>' - : - sprintf($config['board_abbreviation'], $_board['uri']) - ) . - ' - ' . $_board['title'] . - '</label>' . - '</li>'; - } - $__boards .= '</ul>'; - - $body = '<fieldset><legend>Edit user</legend>' . - - // Begin form - '<form style="text-align:center" action="" method="post">' . - - '<table>' . - - '<tr><th>Username</th><td>' . - - (isset($change_password_only) ? - utf8tohtml($_mod['username']) - : '<input size="20" maxlength="30" type="text" name="username" value="' . utf8tohtml($_mod['username']) . '" autocomplete="off" />') . - - '</td></tr>' . - '<tr><th>Password <span class="unimportant">(new; optional)</span></th><td><input size="20" maxlength="30" type="password" name="password" value="" autocomplete="off" /></td></tr>' . - - (isset($change_password_only) ? '' : - '<tr><th>Boards</th><td>' . $__boards . '</td></tr>' - ) . - - '</table>' . - - '<input type="submit" value="Save changes" />' . - - // End form - '</form> ' . - - // Delete button - (hasPermission($config['mod']['deleteusers']) ? - '<p style="text-align:center"><a href="?/users/' . $_mod['id'] . '/delete">Delete user</a></p>' - :'') . - - '</fieldset>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Edit user', - 'body'=>$body - ,'mod'=>true - ) - ); - } - } elseif(preg_match('/^\/reports$/', $query)) { - if(!hasPermission($config['mod']['reports'])) error($config['error']['noaccess']); - - $body = ''; - $reports = 0; - - $query = prepare("SELECT * FROM `reports` ORDER BY `time` DESC LIMIT :limit"); - $query->bindValue(':limit', $config['mod']['recent_reports'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - while($report = $query->fetch()) { - $p_query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `id` = :id", $report['board'])); - $p_query->bindValue(':id', $report['post'], PDO::PARAM_INT); - $p_query->execute() or error(db_error($p_query)); - - if(!$post = $p_query->fetch()) { - // Invalid report (post has since been deleted) - $p_query = prepare("DELETE FROM `reports` WHERE `post` = :id AND `board` = :board"); - $p_query->bindValue(':id', $report['post'], PDO::PARAM_INT); - $p_query->bindValue(':board', $report['board']); - $p_query->execute() or error(db_error($p_query)); - continue; - } - - $reports++; - openBoard($report['board']); - - if(!$post['thread']) { - $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); - } else { - $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); - } - - $append_html = - '<div class="report">' . - '<hr/>' . - 'Board: <a href="?/' . $report['board'] . '/' . $config['file_index'] . '">' . sprintf($config['board_abbreviation'], $report['board']) . '</a><br/>' . - 'Reason: ' . $report['reason'] . '<br/>' . - 'Report date: ' . strftime($config['post_date'], $report['time']) . '<br/>' . - (hasPermission($config['mod']['show_ip']) ? - 'Reported by: <a href="?/IP/' . $report['ip'] . '">' . $report['ip'] . '</a><br/>' - : '') . - '<hr/>' . - (hasPermission($config['mod']['report_dismiss']) ? - '<a title="Discard abuse report" href="?/reports/' . $report['id'] . '/dismiss">Dismiss</a> | ' : '') . - (hasPermission($config['mod']['report_dismiss_ip']) ? - '<a title="Discard all abuse reports by this user" href="?/reports/' . $report['id'] . '/dismiss/all">Dismiss+</a>' : '') . - '</div>'; - - // Bug fix for https://github.com/savetheinternet/Tinyboard/issues/21 - $po->body = truncate($po->body, $po->link(), $config['body_truncate'] - substr_count($append_html, '<br/>')); - - if(mb_strlen($po->body) + mb_strlen($append_html) > $config['body_truncate_char']) { - // still too long. temporarily increase limit in the config - $__old_body_truncate_char = $config['body_truncate_char']; - $config['body_truncate_char'] = mb_strlen($po->body) + mb_strlen($append_html); - } - - $po->body .= $append_html; - - $body .= $po->build(true) . '<hr/>'; - - if(isset($__old_body_truncate_char)) - $config['body_truncate_char'] = $__old_body_truncate_char; - } - - $query = query("SELECT COUNT(`id`) AS `count` FROM `reports`") or error(db_error()); - $count = $query->fetch(); - - $body .= '<p class="unimportant" style="text-align:center">Showing ' . - ($reports == $count['count'] ? 'all ' . $reports . ' reports' : $reports . ' of ' . $count['count'] . ' reports') . '.</p>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('Report queue') . ' (' . $count['count'] . ')', - 'body'=>$body, - 'mod'=>true - )); - } elseif(preg_match('/^\/reports\/(\d+)\/dismiss(\/all)?$/', $query, $matches)) { - if(isset($matches[2]) && $matches[2] == '/all') { - if(!hasPermission($config['mod']['report_dismiss_ip'])) error($config['error']['noaccess']); - - $query = prepare("SELECT `ip` FROM `reports` WHERE `id` = :id"); - $query->bindValue(':id', $matches[1], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if($report = $query->fetch()) { - $query = prepare("DELETE FROM `reports` WHERE `ip` = :ip"); - $query->bindValue(':ip', $report['ip'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - modLog('Dismissed all reports by ' . $report['ip']); - } - } else { - if(!hasPermission($config['mod']['report_dismiss'])) error($config['error']['noaccess']); - - $query = prepare("SELECT `post`, `board` FROM `reports` WHERE `id` = :id"); - $query->bindValue(':id', $matches[1], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if($report = $query->fetch()) { - modLog('Dismissed a report for post #' . $report['post'], $report['board']); - - $query = prepare("DELETE FROM `reports` WHERE `post` = :post AND `board` = :board"); - $query->bindValue(':board', $report['board'], PDO::PARAM_INT); - $query->bindValue(':post', $report['post'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } - } - - // Redirect - header('Location: ?/reports', true, $config['redirect_http']); - } elseif(preg_match('/^\/(\w+)\/edit(\/delete)?$/', $query, $matches)) { - if(!hasPermission($config['mod']['manageboards'])) error($config['error']['noaccess']); - - if(!openBoard($matches[1])) - error($config['error']['noboard']); - - if(isset($matches[2]) && $matches[2] == '/delete') { - if(!hasPermission($config['mod']['deleteboard'])) error($config['error']['noaccess']); - // Delete board - - modLog('Deleted board ' . sprintf($config['board_abbreviation'], $board['uri'])); - - // Delete entire board directory - rrmdir($board['uri'] . '/'); - - // Delete posting table - $query = query(sprintf("DROP TABLE IF EXISTS `posts_%s`", $board['uri'])) or error(db_error()); - - // Clear reports - $query = prepare("DELETE FROM `reports` WHERE `board` = :id"); - $query->bindValue(':id', $board['uri'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - // Delete from table - $query = prepare("DELETE FROM `boards` WHERE `uri` = :uri"); - $query->bindValue(':uri', $board['uri'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if($config['cache']['enabled']) { - cache::delete('board_' . $board['uri']); - cache::delete('all_boards'); - } - - $query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board"); - $query->bindValue(':board', $board['uri']); - $query->execute() or error(db_error($query)); - while($cite = $query->fetch()) { - if($board['uri'] != $cite['board']) { - if(!isset($tmp_board)) - $tmp_board = $board; - openBoard($cite['board']); - rebuildPost($cite['post']); - } - } - - if(isset($tmp_board)) - $board = $tmp_board; - - $query = prepare("DELETE FROM `cites` WHERE `board` = :board OR `target_board` = :board"); - $query->bindValue(':board', $board['uri']); - $query->execute() or error(db_error($query)); - - $query = prepare("DELETE FROM `antispam` WHERE `board` = :board"); - $query->bindValue(':board', $board['uri']); - $query->execute() or error(db_error($query)); - - $_board = $board; - - rebuildThemes('boards'); - - $board = $_board; - - header('Location: ?/', true, $config['redirect_http']); - } else { - if(isset($_POST['title']) && isset($_POST['subtitle'])) { - $query = prepare("UPDATE `boards` SET `title` = :title, `subtitle` = :subtitle WHERE `uri` = :uri"); - $query->bindValue(':title', utf8tohtml($_POST['title'], true)); - - if(!empty($_POST['subtitle'])) - $query->bindValue(':subtitle', utf8tohtml($_POST['subtitle'], true)); - else - $query->bindValue(':subtitle', null, PDO::PARAM_NULL); - - $query->bindValue(':uri', $board['uri']); - $query->execute() or error(db_error($query)); - - if($config['cache']['enabled']) { - cache::delete('board_' . $board['uri']); - cache::delete('all_boards'); - } - - $_board = $board; - - rebuildThemes('boards'); - - $board = $_board; - - openBoard($board['uri']); - } - - $body = - '<fieldset><legend><a href="?/' . - $board['uri'] . '/' . $config['file_index'] . '">' . - sprintf($config['board_abbreviation'], $board['uri']) . '</a>' . - ' - ' . $board['name'] . '</legend>' . - - // Begin form - '<form style="text-align:center" action="" method="post">' . - - '<table>' . - - '<tr><th>URI</th><td>' . $board['uri'] . '</td>' . - '<tr><th>Title</th><td><input size="20" type="text" name="title" value="' . $board['name'] . '" /></td></tr>' . - '<tr><th>Subtitle</th><td><input size="20" type="text" name="subtitle" value="' . - (isset($board['title']) ? $board['title'] : '') . '" /></td></tr>' . - - '</table>' . - - '<input type="submit" value="Update" />' . - - // End form - '</form> ' . - - // Delete button - (hasPermission($config['mod']['deleteboard']) ? - '<p style="text-align:center"><a href="?/' . $board['uri'] . '/edit/delete">Delete board</a></p>' - :'') . - - '</fieldset>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Manage – ' . sprintf($config['board_abbreviation'], $board['uri']), - 'body'=>$body, - 'mod'=>true - )); - } - } elseif(preg_match('/^\/bans$/', $query)) { - if(!hasPermission($config['mod']['view_banlist'])) error($config['error']['noaccess']); - - if(isset($_POST['unban'])) { - if(!hasPermission($config['mod']['unban'])) error($config['error']['noaccess']); - - foreach($_POST as $post => $value) { - if(preg_match('/^ban_(\d+)$/', $post, $m)) { - removeBan($m[1]); - } - } - } - if(hasPermission($config['mod']['view_banexpired'])) { - $query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC"); - $query->bindValue(':time', time(), PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } else { - // Filter out expired bans - $query = prepare("SELECT `bans`.*, `username` FROM `bans` INNER JOIN `mods` ON `mod` = `mods`.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC"); - $query->bindValue(':time', time(), PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } - - if($query->rowCount() < 1) { - $body = '<p style="text-align:center" class="unimportant">(There are no active bans.)</p>'; - } else { - $body = '<form action="" method="post">'; - $body .= '<table><tr><th>' . _('IP address') . '</th><th>' . _('Reason') . '</th><th>' . _('Board') . '</th><th>' . _('Set') . '</th><th>' . _('Expires') . '</th><th>' . _('Staff') . '</th></tr>'; - - while($ban = $query->fetch()) { - $body .= - '<tr' . - ($config['mod']['view_banexpired'] && $ban['expires'] != 0 && $ban['expires'] < time() ? - ' style="text-decoration:line-through"' - :'') . - '>' . - - '<td style="white-space: nowrap">' . - - // Checkbox - '<input type="checkbox" name="ban_' . $ban['id'] . '" id="ban_' . $ban['id'] . '" /> ' . - - // IP address - (preg_match('/^(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $ban['ip']) ? - '<a href="?/IP/' . - $ban['ip'] . - '">'. $ban['ip'] . '</a>' - : utf8tohtml($ban['ip'])) . - - '</td>' . - - // Reason - '<td>' . ($ban['reason'] ? $ban['reason'] : '<em>-</em>') . '</td>' . - - - '<td style="white-space: nowrap">' . - (isset($ban['board']) ? - sprintf($config['board_abbreviation'], $ban['board']) - : - '<em>' . _('all boards') . '</em>' - ) . '</td>' . - - // Set - '<td style="white-space: nowrap">' . strftime($config['post_date'], $ban['set']) . '</td>' . - - // Expires - '<td style="white-space: nowrap">' . - ($ban['expires'] == 0 ? - '<em>Never</em>' - : - strftime($config['post_date'], $ban['expires']) - ) . - '</td>' . - - // Staff - '<td>' . - (isset($ban['username']) ? - (!hasPermission($config['mod']['view_banstaff']) ? - ($config['mod']['view_banquestionmark'] ? - '?' - : - ($ban['type'] == JANITOR ? 'Janitor' : - ($ban['type'] == MOD ? 'Mod' : - ($ban['type'] == ADMIN ? 'Admin' : - '?'))) - ) - : - utf8tohtml($ban['username']) - ) - : - '<em>deleted?</em>' - ) . - '</td>' . - - '</tr>'; - } - - $body .= '</table>' . - - (hasPermission($config['mod']['unban']) ? - '<p style="text-align:center"><input name="unban" type="submit" value="Unban selected" /></p>' - : '') . - - '</form>'; - } - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('Ban list'), - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/flush$/', $query)) { - if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']); - if(!$config['cache']['enabled']) error(_('Cache is not enabled.')); - - if(cache::flush()) { - $body = 'Successfully invalidated all items in cache.'; - modLog('Cleared cache'); - } else { - $body = 'An error occured while trying to flush cache.'; - } - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Flushed', - 'body'=>'<p style="text-align:center">' . $body . '</p>', - 'mod'=>true - )); - } elseif(preg_match('/^\/rebuild$/', $query)) { - if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']); - - set_time_limit($config['mod']['rebuild_timelimit']); - - $body = '<div class="ban"><h2>Rebuilding…</h2><p>'; - - $body .= 'Clearing template cache…<br/>'; - - load_twig(); - $twig->clearCacheFiles(); + '/noticeboard' => 'noticeboard', // view noticeboard + '/noticeboard/(\d+)' => 'noticeboard', // view noticeboard + '/noticeboard/delete/(\d+)' => 'noticeboard_delete',// delete from noticeboard + '/log' => 'log', // modlog + '/log/(\d+)' => 'log', // modlog + '/news' => 'news', // view news + '/news/(\d+)' => 'news', // view news + '/news/delete/(\d+)' => 'news_delete', // delete from news - $body .= 'Regenerating theme files…<br/>'; - rebuildThemes('all'); - - $body .= 'Generating Javascript file…<br/>'; - buildJavascript(); - - $main_js = $config['file_script']; - - $boards = listBoards(); - - foreach($boards as &$board) { - $body .= "<strong style=\"display:inline-block;margin: 15px 0 2px 0;\">Opening board /{$board['uri']}/</strong><br/>"; - openBoard($board['uri']); - - $body .= 'Creating index pages<br/>'; - buildIndex(); - - if($config['file_script'] != $main_js) { - // different javascript file - $body .= 'Generating Javascript file…<br/>'; - buildJavascript(); - } - - $query = query(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); - while($post = $query->fetch()) { - $body .= "Rebuilding #{$post['id']}<br/>"; - buildThread($post['id']); - } - } - $body .= 'Complete!</p></div>'; - - unset($board); - modLog('Rebuilt everything'); - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Rebuilt', - 'body'=>$body, - 'mod'=>true - )); - } elseif(preg_match('/^\/config\/edit$/', $query)) { - if(!hasPermission($config['mod']['edit_config'])) - error($config['error']['noaccess']); - - // TODO: display "unset variables" - // $config_file = file_get_contents('inc/config.php'); - // preg_match_all('/\$config\[\'(\w+)\']/', $config_file, $matches); - // $config_variables = array_unique($matches[1]); - - $body = '<fieldset><legend>' . _('Configuration') . '</legend><form action="" method="post"><table style="width:100%">'; - - $var_force_string = array('blotter'); - $var_system = array('version'); - - if(isset($_POST['save_changes'])) { - $config_append = ''; - - foreach($config as $name => $original_value) { - if(in_array($name, $var_system)) - continue; - $type = gettype($original_value); - if($type == 'array' || $type == 'NULL') - continue; - - if($type == 'boolean' && in_array($name, $var_force_string)) - $type = 'string'; - - if(!isset($_POST[$name]) && $type != 'boolean') - continue; - - if($type == 'boolean') - $value = isset($_POST[$name]); - else - $value = $_POST[$name]; - - if($value != $original_value) { - // value has been changed - $config_append .= "\$config['" . addslashes($name) . "'] = "; - if($type == 'boolean') - $config_append .= $value ? 'true' : 'false'; - elseif($type == 'integer') - $config_append .= (int)$value; - elseif($type == 'string') - $config_append .= '\'' . addslashes($value) . '\''; - $config_append .= ";\n"; - } - } - - if(!empty($config_append)) { - $config_append = "\n// Changes made via web editor by \"" . $mod['username'] . "\" @ " . date('r') . ":\n" . $config_append . "\n"; - if(@file_put_contents('inc/instance-config.php', $config_append, FILE_APPEND)) { - header('Location: ?/config' . $b['uri'], true, $config['redirect_http']); - exit; - } else { - $config_append = htmlentities($config_append); - - if($config['minify_html']) - $config_append = str_replace("\n", '
', $config_append); - $page = array(); - $page['title'] = 'Cannot write to file!'; - $page['config'] = $config; - $page['body'] = ' - <p>Tinyboard could not write to <strong>inc/instance-config.php</strong> with the ammended configuration, probably due to a permissions error.</p> - <p>You may proceed with these changes manually by copying and pasting the following code to the bottom of <strong>inc/instance-config.php</strong>:</p> - <textarea style="width:700px;height:370px;margin:auto;display:block;background:white;color:black" readonly>' . $config_append . '</textarea> - '; - echo Element('page.html', $page); - exit; - } - } - } - - foreach($config as $name => $value) { - $body .= '<tr>'; - - $body .= '<th style="text-align:left" class="minimal">' . utf8tohtml($name) . '</th>'; - $type = gettype($value); - if($type == 'array') { - $body .= '<td><a href="?/config/edit/' . utf8tohtml($name) . '">[edit]' . '</a></td>'; - } else { - if($type == 'string' || $type == 'integer') { - $body .= '<td><input style="width:100%" type="text" name="' .utf8tohtml($name) . '" value="'. str_replace('"', '"', utf8tohtml($value)) . '"' . - (in_array($name, $var_system) ? ' readonly="readonly"' : '') . '></td>'; - } elseif($type == 'boolean') { - if(in_array($name, $var_force_string)) - $body .= '<td><input style="width:100%" type="text" name="' . utf8tohtml($name) . '" value=""></td>'; - else - $body .= '<td><input type="checkbox" name="' . utf8tohtml($name) . '" ' . ($value ? 'checked' : '') . '></td>'; - } else { - $body .= '<td>' . utf8tohtml($value) . '</td>'; - } - } - - $body .= '</tr>'; - } - - $body .= '</table><div style="text-align:center"><input name="save_changes" type="submit" value="Save changes"></div></form></fieldset>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('Configuration'), - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/config$/', $query)) { - if(!hasPermission($config['mod']['show_config'])) - error($config['error']['noaccess']); - - // Show instance-config.php - - $data = ''; - - function do_array_part($array, $prefix = '') { - global $data, $config; - - foreach($array as $name => $value) { - if(is_array($value)) { - do_array_part($value, $prefix . $name . ' → '); - } else { - if($config['mod']['never_reveal_password'] && $prefix == 'db → ' && $name == 'password') { - $value = '<em>hidden</em>'; - } elseif(gettype($value) == 'boolean') { - $value = $value ? '<span style="color:green;">On</span>' : '<span style="color:red;">Off</span>'; - } elseif(gettype($value) == 'string') { - if(empty($value)) - $value = '<em>empty</em>'; - else - $value = '<span style="color:maroon;">' . utf8tohtml(substr($value, 0, 110) . (mb_strlen($value) > 110 ? '…' : '')) . '</span>'; - } elseif(gettype($value) == 'integer') { - $value = '<span style="color:black;">' . $value . '</span>'; - } elseif(is_object($value) && get_class($value) == 'Closure') { - $value = '[callback]'; - } - - $data .= - '<tr><th style="text-align:left;">' . - $prefix . (gettype($name) == 'integer' ? '[]' : utf8tohtml($name)) . - '</th><td>' . - $value . - '</td></tr>'; - } - } - } - - do_array_part($config); - - - $body = (hasPermission($config['mod']['edit_config']) ? - '<p style="text-align:center" class="unimportant">' . - '<a href="?/config/edit">[Edit using web editor]</a>' : '') . - '<fieldset><legend>' . _('Configuration') . '</legend><table>' . $data . '</table></fieldset>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>_('Configuration'), - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/new$/', $query)) { - if(!hasPermission($config['mod']['newboard'])) error($config['error']['noaccess']); - - // New board - $body = ''; - - if(isset($_POST['new_board'])) { - // Create new board - if( !isset($_POST['uri']) || - !isset($_POST['title']) || - !isset($_POST['subtitle']) - ) error($config['error']['missedafield']); - - $b = array( - 'uri' => $_POST['uri'], - 'title' => $_POST['title'], - 'subtitle' => $_POST['subtitle'] - ); - - // HTML characters - $b['title'] = utf8tohtml($b['title'], true); - $b['subtitle'] = utf8tohtml($b['subtitle'], true); - - // Check required fields - if(empty($b['uri'])) - error(sprintf($config['error']['required'], 'URI')); - if(empty($b['title'])) - error(sprintf($config['error']['required'], 'title')); - - if(!preg_match('/^\w+$/', $b['uri'])) - error(sprintf($config['error']['invalidfield'], 'URI')); - - if(openBoard($b['uri'])) { - unset($board); - error(sprintf($config['error']['boardexists'], sprintf($config['board_abbreviation'], $b['uri']))); - } - - $query = prepare("INSERT INTO `boards` VALUES (:uri, :title, :subtitle)"); - $query->bindValue(':uri', $b['uri']); - $query->bindValue(':title', $b['title']); - if(!empty($b['subtitle'])) { - $query->bindValue(':subtitle', $b['subtitle']); - } else { - $query->bindValue(':subtitle', null, PDO::PARAM_NULL); - } - $query->execute() or error(db_error($query)); - - // Record the action - modLog("Created a new board: {$b['title']}"); - - // Open the board - openBoard($b['uri']) or error(_("Couldn't open board after creation.")); - - // Create the posts table - query(Element('posts.sql', array('board' => $board['uri']))) or error(db_error()); - - if($config['cache']['enabled']) - cache::delete('all_boards'); - - // Build the board - buildIndex(); - - rebuildThemes('boards'); - - header('Location: ?/' . $b['uri'] . '/' . $config['file_index'], true, $config['redirect_http']); - } else { - - $body .= form_newBoard(); - - // TODO: Statistics, etc, in the dashboard. - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'New board', - 'body'=>$body, - 'mod'=>true - ) - ); - } - } elseif(preg_match('/^\/' . $regex['board'] . '(' . $regex['index'] . '|' . $regex['page'] . ')?$/', $query, $matches)) { - // Board index - - $boardName = &$matches[1]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - $page_no = empty($matches[2]) || $matches[2] == $config['file_index'] ? 1 : $matches[2]; - - if(!$page = index($page_no, $mod)) { - error($config['error']['404']); - } - - $page['pages'] = getPages(true); - $page['pages'][$page_no-1]['selected'] = true; - $page['btn'] = getPageButtons($page['pages'], true); - $page['mod'] = true; - echo Element('index.html', $page); - } elseif(preg_match('/^\/' . $regex['board'] . $regex['res'] . $regex['page'] . '$/', $query, $matches)) { - // View thread - - $boardName = &$matches[1]; - $thread = &$matches[2]; - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - $page = buildThread($thread, true, $mod); - - echo $page; - } elseif(preg_match('/^\/' . $regex['board'] . 'edit\/(\d+)$/', $query, $matches)) { - // Edit post body - - $boardName = &$matches[1]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['editpost'], $boardName)) error($config['error']['noaccess']); - - $postID = &$matches[2]; - - $query = prepare(sprintf("SELECT `body_nomarkup`, `name`, `subject`, `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $postID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - $post = $query->fetch() or error($config['error']['invalidpost']); - - if(isset($_POST['submit']) && isset($_POST['body']) && isset($_POST['subject'])) { - if(mb_strlen($_POST['subject']) > 100) - error(sprintf($config['error']['toolong'], 'subject')); - - $body = $_POST['body']; - $body_nomarkup = $body; - - wordfilters($body); - $tracked_cites = markup($body, true); - - $query = prepare("DELETE FROM `cites` WHERE `board` = :board AND `post` = :post"); - $query->bindValue(':board', $board['uri']); - $query->bindValue(':post', $postID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - $query = prepare(sprintf("UPDATE `posts_%s` SET `body` = :body, `body_nomarkup` = :body_nomarkup, `subject` = :subject WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $postID, PDO::PARAM_INT); - $query->bindValue(':body', $body); - $query->bindValue(':body_nomarkup', $body_nomarkup); - $query->bindValue(':subject', utf8tohtml($_POST['subject'])); - $query->execute() or error(db_error($query)); - - if(isset($tracked_cites)) { - foreach($tracked_cites as $cite) { - $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); - $query->bindValue(':board', $board['uri']); - $query->bindValue(':post', $postID, PDO::PARAM_INT); - $query->bindValue(':target_board',$cite[0]); - $query->bindValue(':target', $cite[1], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } - } + '/edit/(\w+)' => 'edit_board', // edit board details + '/new-board' => 'new_board', // create a new board - // Record the action - modLog("Edited post #{$postID}"); - - buildThread($post['thread'] ? $post['thread'] : $postID); - - // Rebuild board - buildIndex(); - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - exit; - } - - $post['body_nomarkup'] = utf8tohtml($post['body_nomarkup']); - - if($config['minify_html']) - $post['body_nomarkup'] = str_replace("\n", '
', $post['body_nomarkup']); - - $body = '<form name="post" action="" method="post">' . - '<table>' . - '<tr>' . - '<th>Name</th>' . - '<td>' . utf8tohtml($post['name']) . '</td>' . - '</tr>' . - '<tr>' . - '<th>Subject</th>' . - '<td>' . - '<input style="float:left;" type="text" name="subject" size="25" maxlength="50" value="' . str_replace('"', '"', $post['subject']) . '"/>' . - '<input style="margin-left:2px;" type="submit" name="submit" value="Edit Post"/>' . - '</td>' . - '</tr>' . - '<tr>' . - '<th>Body</th>' . - '<td>' . - '<textarea name="body" rows="8" cols="38">' . - $post['body_nomarkup'] . - '</textarea>' . - '</td>' . - '</tr>' . - '</table>' . - '</form>'; - - echo Element('page.html', array( - 'config' => $config, - 'body' => $body, - 'title' => 'Edit Post #' . $postID - )); - } elseif(preg_match('/^\/' . $regex['board'] . 'deletefile\/(\d+)$/', $query, $matches)) { - // Delete file from post - - $boardName = &$matches[1]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['deletefile'], $boardName)) error($config['error']['noaccess']); - - $post = &$matches[2]; - - // Delete post - deleteFile($post); - - // Record the action - modLog("Removed file from post #{$post}"); - - // Rebuild board - buildIndex(); - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/' . $regex['board'] . 'delete\/(\d+)$/', $query, $matches)) { - // Delete post - - $boardName = &$matches[1]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['delete'], $boardName)) - error($config['error']['noaccess']); - - $post = &$matches[2]; - - // Delete post - deletePost($post); - - // Record the action - modLog("Deleted post #{$post}"); - - // Rebuild board - buildIndex(); - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/' . $regex['board'] . '(un)?sticky\/(\d+)$/', $query, $matches)) { - // Add/remove sticky - - $boardName = &$matches[1]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['sticky'], $boardName)) error($config['error']['noaccess']); - - $post = &$matches[3]; - - $query = prepare(sprintf("UPDATE `posts_%s` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - - if($matches[2] == 'un') { - // Record the action - modLog("Unstickied post #{$post}"); - $query->bindValue(':sticky', 0, PDO::PARAM_INT); - } else { - // Record the action - modLog("Stickied post #{$post}"); - $query->bindValue(':sticky', 1, PDO::PARAM_INT); - } - - $query->execute() or error(db_error($query)); - - buildIndex(); - buildThread($post); - - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/' . $regex['board'] . '(un)?lock\/(\d+)$/', $query, $matches)) { - // Lock/Unlock - - $boardName = &$matches[1]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['lock'], $boardName)) error($config['error']['noaccess']); - - $post = &$matches[3]; - - $query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - - if($matches[2] == 'un') { - // Record the action - modLog("Unlocked post #{$post}"); - $query->bindValue(':locked', 0, PDO::PARAM_INT); - } else { - // Record the action - modLog("Locked post #{$post}"); - $query->bindValue(':locked', 1, PDO::PARAM_INT); - } - - $query->execute() or error(db_error($query)); - - buildIndex(); - buildThread($post); - - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/' . $regex['board'] . 'bump(un)?lock\/(\d+)$/', $query, $matches)) { - // Lock/Unlock - - $boardName = &$matches[1]; - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['bumplock'], $boardName)) error($config['error']['noaccess']); - - $post = &$matches[3]; - - $query = prepare(sprintf("UPDATE `posts_%s` SET `sage` = :bumplocked WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - - if($matches[2] == 'un') { - // Record the action - modLog("Unbumplocked post #{$post}"); - $query->bindValue(':bumplocked', 0, PDO::PARAM_INT); - } else { - // Record the action - modLog("Bumplocked post #{$post}"); - $query->bindValue(':bumplocked', 1, PDO::PARAM_INT); - } - - $query->execute() or error(db_error($query)); - - buildIndex(); - buildThread($post); - - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/' . $regex['board'] . 'deletebyip\/(\d+)(\/global)?$/', $query, $matches)) { - // Delete all posts by an IP - - $boardName = &$matches[1]; - $post = &$matches[2]; - $global = isset($matches[3]) && $matches[3] == '/global'; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - $query = prepare(sprintf("SELECT `ip` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $post); - $query->execute() or error(db_error($query)); - - if(!$post = $query->fetch()) - error($config['error']['invalidpost']); - - $ip = $post['ip']; - - if($global) - $boards = listBoards(); - else - $boards = array(array('uri' => $board['uri'])); - - $query = ''; - foreach($boards as $_board) { - $query .= sprintf("SELECT `id`, '%s' AS `board` FROM `posts_%s` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']); - } - $query = preg_replace('/UNION ALL $/', '', $query); - - $query = prepare($query); - $query->bindValue(':ip', $ip); - $query->execute() or error(db_error($query)); - - if($query->rowCount() < 1) - error($config['error']['invalidpost']); - - $boards = array(); - while($post = $query->fetch()) { - openBoard($post['board']); - $boards[] = $post['board']; - - deletePost($post['id'], false); - } - - foreach($boards as &$_board) { - openBoard($_board); - buildIndex(); - } - - // Record the action - modLog("Deleted all posts by IP address: {$ip}"); - - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/ban$/', $query)) { - if(!hasPermission($config['mod']['ban'])) error($config['error']['noaccess']); - // Ban page + '/rebuild' => 'rebuild', // rebuild static files + '/reports' => 'reports', // report queue + '/reports/(\d+)/dismiss(all)?' => 'report_dismiss', // dismiss a report + + '/ban' => 'ban', // new ban + '/IP/([\w.:]+)' => 'ip', // view ip address + '/IP/([\w.:]+)/remove_note/(\d+)' => 'ip_remove_note', // remove note from ip address + '/bans' => 'bans', // ban list + '/bans/(\d+)' => 'bans', // ban list + + '/(\w+)/delete/(\d+)' => 'delete', // delete post + '/(\w+)/ban(&delete)?/(\d+)' => 'ban_post', // ban poster + '/(\w+)/deletefile/(\d+)' => 'deletefile', // delete file from post + '/(\w+)/deletebyip/(\d+)(/global)?' => 'deletebyip', // delete all posts by IP address + '/(\w+)/(un)?lock/(\d+)' => 'lock', // lock thread + '/(\w+)/(un)?sticky/(\d+)' => 'sticky', // sticky thread + '/(\w+)/bump(un)?lock/(\d+)' => 'bumplock', // "bumplock" thread + '/(\w+)/move/(\d+)' => 'move', // move thread + + '/themes' => 'themes_list', // manage themes + '/themes/(\w+)' => 'theme_configure', // configure/reconfigure theme + '/themes/(\w+)/rebuild' => 'theme_rebuild', // rebuild theme + '/themes/(\w+)/uninstall' => 'theme_uninstall', // uninstall theme + + '/config' => 'config', // config editor + + // these pages aren't listed in the dashboard without $config['debug'] + '/debug/antispam' => 'debug_antispam', + + // This should always be at the end: + '/(\w+)/' => 'view_board', + '/(\w+)/' . preg_quote($config['file_index'], '!') => 'view_board', + '/(\w+)/' . str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!')) => 'view_board', + '/(\w+)/' . preg_quote($config['dir']['res'], '!') . + str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!')) => 'view_thread', +); + + + +if (!$mod) { + $pages = array('!!' => 'login'); +} elseif (isset($_GET['status'], $_GET['r'])) { + header('Location: ' . $_GET['r'], true, (int)$_GET['status']); + exit; +} + +if (isset($config['mod']['custom_pages'])) { + $pages = array_merge($pages, $config['mod']['custom_pages']); +} + +$new_pages = array(); +foreach ($pages as $key => $callback) { + $new_pages[@$key[0] == '!' ? $key : "!^$key$!"] = $callback; +} +$pages = $new_pages; + +foreach ($pages as $uri => $handler) { + if (preg_match($uri, $query, $matches)) { + $matches = array_slice($matches, 1); - if(isset($_POST['new_ban'])) { - if( !isset($_POST['ip']) || - !isset($_POST['reason']) || - !isset($_POST['length']) - ) error($config['error']['missedafield']); - - // Check required fields - if(empty($_POST['ip'])) - error(sprintf($config['error']['required'], 'IP address')); - - $query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board)"); - - // 1yr2hrs30mins - // 1y2h30m - $expire = 0; - if(preg_match('/^((\d+)\s?ye?a?r?s?)?\s?+((\d+)\s?mon?t?h?s?)?\s?+((\d+)\s?we?e?k?s?)?\s?+((\d+)\s?da?y?s?)?((\d+)\s?ho?u?r?s?)?\s?+((\d+)\s?mi?n?u?t?e?s?)?\s?+((\d+)\s?se?c?o?n?d?s?)?$/', $_POST['length'], $m)) { - if(isset($m[2])) { - // Years - $expire += $m[2]*60*60*24*365; - } - if(isset($m[4])) { - // Months - $expire += $m[4]*60*60*24*30; - } - if(isset($m[6])) { - // Weeks - $expire += $m[6]*60*60*24*7; - } - if(isset($m[8])) { - // Days - $expire += $m[8]*60*60*24; - } - if(isset($m[10])) { - // Hours - $expire += $m[10]*60*60; - } - if(isset($m[12])) { - // Minutes - $expire += $m[12]*60; - } - if(isset($m[14])) { - // Seconds - $expire += $m[14]; - } - } - if($expire) { - $query->bindValue(':expires', time()+$expire, PDO::PARAM_INT); - } else { - // Never expire - $query->bindValue(':expires', null, PDO::PARAM_NULL); - } - - $query->bindValue(':ip', $_POST['ip'], PDO::PARAM_STR); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - $query->bindValue(':set', time(), PDO::PARAM_INT); - - - - if(!empty($_POST['reason'])) { - $reason = $_POST['reason']; - markup($reason); - $query->bindValue(':reason', $reason, PDO::PARAM_STR); - } else { - $query->bindValue(':reason', null, PDO::PARAM_NULL); - } - - if($_POST['board'] == '') { - $query->bindValue(':board', null, PDO::PARAM_NULL); - } else { - $query->bindValue(':board', $_POST['board'], PDO::PARAM_INT); - } - - // Record the action - modLog('Created a ' . ($expire ? $expire . ' second' : 'permanent') . " ban for {$_POST['ip']} with " . (!empty($_POST['reason']) ? "reason \"${reason}\"" : 'no reason')); - - $query->execute() or error(db_error($query)); - - if(isset($_POST['board'])) - openBoard($_POST['board']); - - // Delete too - if(isset($_POST['delete']) && isset($_POST['board']) && hasPermission($config['mod']['delete'], $_POST['board'])) { - $post = round($_POST['delete']); - - deletePost($post); - - // Record the action - modLog("Deleted post #{$post}"); - - // Rebuild board - buildIndex(); - } - - if(hasPermission($config['mod']['public_ban']) && isset($_POST['post']) && isset($_POST['board']) && isset($_POST['public_message']) && isset($_POST['message'])) { - $post = round($_POST['post']); - - $query = prepare(sprintf("UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - $query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message']))); - $query->execute() or error(db_error($query)); - - // Rebuild thread - $query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - $thread = $query->fetch(); - if($thread['thread']) - buildThread($thread['thread']); - else - buildThread($post); - - // Rebuild board - buildIndex(); - - // Record the action - modLog("Attached a public ban message for post #{$post}: " . $_POST['message']); - } - - // Redirect - if(isset($_POST['continue'])) - header('Location: ' . $_POST['continue'], true, $config['redirect_http']); - elseif(isset($board)) - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - else - header('Location: ?/', true, $config['redirect_http']); + if ($config['debug']) { + $debug['mod_page'] = array( + 'req' => $query, + 'match' => $uri, + 'handler' => $handler + ); } - } elseif(preg_match('/^\/' . $regex['board'] . 'move\/(\d+)$/', $query, $matches)) { - - $boardName = &$matches[1]; - $postID = $matches[2]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - if(!hasPermission($config['mod']['move'], $boardName)) error($config['error']['noaccess']); - - if(isset($_POST['board'])) { - $targetBoard = $_POST['board']; - $shadow = isset($_POST['shadow']); - - if($targetBoard == $boardName) - error(_("Target and source board are the same.")); - - // copy() if leaving a shadow thread behind. otherwise, rename(). - $clone = $shadow ? 'copy' : 'rename'; - - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` IS NULL AND `id` = :id", $board['uri'])); - $query->bindValue(':id', $postID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - if(!$post = $query->fetch()) { - error($config['error']['nonexistant']); - } - $post['op'] = true; - - if($post['file']) { - $post['has_file'] = true; - $post['width'] = &$post['filewidth']; - $post['height'] = &$post['fileheight']; - - $file_src = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']; - $file_thumb = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']; - } else $post['has_file'] = false; - - // allow thread to keep its same traits (stickied, locked, etc.) - $post['mod'] = true; - - if(!openBoard($targetBoard)) - error($config['error']['noboard']); - - $newID = post($post); - - if($post['has_file']) { - $clone($file_src, sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']); - $clone($file_thumb, sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']); - } - - // move replies too... - openBoard($boardName); - - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id`", $board['uri'])); - $query->bindValue(':id', $postID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - $replies = array(); - while($post = $query->fetch()) { - $post['mod'] = true; - $post['thread'] = $newID; - - if($post['file']) { - $post['has_file'] = true; - $post['width'] = &$post['filewidth']; - $post['height'] = &$post['fileheight']; - - $post['file_src'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']; - $post['file_thumb'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']; - } else $post['has_file'] = false; - - $replies[] = $post; - } - - $newIDs = array($postID => $newID); - - openBoard($targetBoard); - foreach($replies as &$post) { - $query = prepare("SELECT `target` FROM `cites` WHERE `target_board` = :board AND `board` = :board AND `post` = :post"); - $query->bindValue(':board', $boardName); - $query->bindValue(':post', $post['id'], PDO::PARAM_INT); - $query->execute() or error(db_error($qurey)); - while($cite = $query->fetch(PDO::FETCH_ASSOC)) { - if(isset($newIDs[$cite['target']])) { - $post['body_nomarkup'] = preg_replace( - '/(>>(>\/' . preg_quote($boardName, '/') . '\/)?)' . preg_quote($cite['target'], '/') . '/', - '>>' . $newIDs[$cite['target']], - $post['body_nomarkup']); - - $post['body'] = $post['body_nomarkup']; - } - } - $post['op'] = false; - $post['tracked_cites'] = markup($post['body'], true); - - $newIDs[$post['id']] = $newPostID = post($post); - - if($post['has_file']) { - $clone($post['file_src'], sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']); - $clone($post['file_thumb'], sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']); - } - - foreach($post['tracked_cites'] as $cite) { - $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); - $query->bindValue(':board', $board['uri']); - $query->bindValue(':post', $newPostID, PDO::PARAM_INT); - $query->bindValue(':target_board',$cite[0]); - $query->bindValue(':target', $cite[1], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } - } - - // build thread - buildThread($newID); - buildIndex(); - - // trigger themes - rebuildThemes('post'); - - openBoard($boardName); - - if($shadow) { - // lock thread - $query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = 1 WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $postID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - $post = array( - 'mod' => true, - 'subject' => '', - 'email' => '', - 'name' => $config['mod']['shadow_name'], - 'capcode' => $config['mod']['shadow_capcode'], - 'trip' => '', - 'body' => sprintf($config['mod']['shadow_mesage'], '>>>/' . $targetBoard . '/' . $newID), - 'password' => '', - 'has_file' => false, - // attach to original thread - 'thread' => $postID, - 'op' => false - ); - - markup($post['body']); - - $botID = post($post); - buildThread($postID); - - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['dir']['res'] . sprintf($config['file_page'], $postID) . '#' . $botID, true, $config['redirect_http']); + if (is_string($handler)) { + if ($handler[0] == ':') { + header('Location: ' . substr($handler, 1), true, $config['redirect_http']); + } elseif (is_callable("mod_page_$handler")) { + call_user_func_array("mod_page_$handler", $matches); + } elseif (is_callable("mod_$handler")) { + call_user_func_array("mod_$handler", $matches); } else { - deletePost($postID); - buildIndex(); - - openBoard($targetBoard); - header('Location: ?/' . sprintf($config['board_path'], $board['uri']) . $config['dir']['res'] . sprintf($config['file_page'], $newID), true, $config['redirect_http']); + error("Mod page '$handler' not found!"); } + } elseif (is_callable($handler)) { + call_user_func_array($handler, $matches); } else { - - $body = '<fieldset><legend>Move thread</legend>' . - '<form action="?/' . $boardName . '/move/' . $postID . '" method="post">' . - '<table>' - ; - - $boards = listBoards(); - if(count($boards) <= 1) - error(_('No board to move to; there is only one.')); - - $__boards = ''; - foreach($boards as &$_board) { - if($_board['uri'] == $board['uri']) - continue; - $__boards .= '<li>' . - '<input type="radio" name="board" id="board_' . $_board['uri'] . '" value="' . $_board['uri'] . '">' . - '<label style="display:inline" for="board_' . $_board['uri'] . '"> ' . - sprintf($config['board_abbreviation'], $_board['uri']) . - ' - ' . $_board['title'] . - '</label>' . - '</li>'; - } - - $body .= '<tr>' . - '<th>Thread ID</th>' . - '<td><input type="text" size="7" value="' . $postID . '" disabled /></td>' . - '</tr>' . - - '<tr>' . - '<th><label for="message">Leave shadow thread</label></th>' . - '<td>' . - '<input type="checkbox" id="shadow" name="shadow" checked/>' . - ' <span class="unimportant">(locks thread; replies to it with a link.)</span>' . - '</td>' . - '</tr>' . - - '<tr>' . - '<th>Target board</th>' . - '<td><ul style="list-style:none;padding:2px 5px">' . $__boards . '</tl></td>' . - '</tr>' . - - '<tr>' . - '<td></td>' . - '<td><input type="submit" value="Move thread" /></td>' . - '</tr>' . - '</table>' . - '</form></fieldset>'; - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'Move #' . $postID, - 'body'=>$body, - 'mod'=>true - ) - ); - } - } elseif(preg_match('/^\/' . $regex['board'] . 'ban(&delete)?\/(\d+)$/', $query, $matches)) { - - // Ban by post - - $boardName = &$matches[1]; - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['ban'], $boardName)) error($config['error']['noaccess']); - - $delete = isset($matches[2]) && $matches[2] == '&delete'; - if($delete && !hasPermission($config['mod']['delete'], $boardName)) error($config['error']['noaccess']); - - $post = $matches[3]; - - $query = prepare(sprintf("SELECT `ip`,`id` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if($query->rowCount() < 1) { - error($config['error']['invalidpost']); + error("Mod page '$handler' not a string, and not callable!"); } - - $post = $query->fetch(); - - $body = form_newBan($post['ip'], null, '?/' . sprintf($config['board_path'], $board['uri']) . $config['file_index'], $post['id'], $boardName, !$delete); - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'New ban', - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')\/deletenote\/(?P<id>\d+)$/', $query, $matches)) { - if(!hasPermission($config['mod']['remove_notes'])) error($config['error']['noaccess']); - - $ip = $matches[1]; - $id = $matches['id']; - - $query = prepare("DELETE FROM `ip_notes` WHERE `ip` = :ip AND `id` = :id"); - $query->bindValue(':ip', $ip); - $query->bindValue(':id', $id); - $query->execute() or error(db_error($query)); - - header('Location: ?/IP/' . $ip, true, $config['redirect_http']); - } elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $query, $matches)) { - // View information on an IP address - - $ip = $matches[1]; - $host = $config['mod']['dns_lookup'] ? rDNS($ip) : false; - if(hasPermission($config['mod']['unban']) && isset($_POST['unban']) && isset($_POST['ban_id'])) { - removeBan($_POST['ban_id']); - header('Location: ?/IP/' . $ip, true, $config['redirect_http']); - } elseif(hasPermission($config['mod']['create_notes']) && isset($_POST['note'])) { - $query = prepare("INSERT INTO `ip_notes` VALUES(NULL, :ip, :mod, :time, :body)"); - $query->bindValue(':ip', $ip); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - $query->bindValue(':time', time(), PDO::PARAM_INT); - markup($_POST['note']); - $query->bindValue(':body', $_POST['note']); - $query->execute() or error(db_error($query)); - - header('Location: ?/IP/' . $ip, true, $config['redirect_http']); - } else { - $body = ''; - $boards = listBoards(); - foreach($boards as &$_board) { - openBoard($_board['uri']); - - $temp = ''; - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `time` DESC LIMIT :limit", $_board['uri'])); - $query->bindValue(':ip', $ip); - $query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - while($post = $query->fetch()) { - if(!$post['thread']) { - $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); - } else { - $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); - } - $temp .= $po->build(true) . '<hr/>'; - } - - if(!empty($temp)) - $body .= '<fieldset><legend>Last ' . $query->rowCount() . ' posts on <a href="?/' . - sprintf($config['board_path'], $_board['uri']) . $config['file_index'] . - '">' . - sprintf($config['board_abbreviation'], $_board['uri']) . ' - ' . $_board['title'] . - '</a></legend>' . $temp . '</fieldset>'; - } - - if(hasPermission($config['mod']['view_notes'])) { - $query = prepare("SELECT * FROM `ip_notes` WHERE `ip` = :ip ORDER BY `id` DESC"); - $query->bindValue(':ip', $ip); - $query->execute() or error(db_error($query)); - - if($query->rowCount() > 0 || hasPermission($config['mod']['create_notes'])) { - $body .= '<fieldset><legend>' . - $query->rowCount() . ' note' . ($query->rowCount() == 1 ?'' : 's') . ' on record' . - '</legend>'; - if($query->rowCount() > 0) { - $body .= '<table class="modlog">' . - '<tr><th>Staff</th><th>Note</th><th>Date</th>' . - (hasPermission($config['mod']['remove_notes']) ? '<th>Actions</th>' : '') . - '</td>'; - while($note = $query->fetch()) { - - if($note['mod']) { - $_query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id"); - $_query->bindValue(':id', $note['mod']); - $_query->execute() or error(db_error($_query)); - if($_mod = $_query->fetch()) { - $staff = '<a href="?/new_PM/' . $note['mod'] . '">' . utf8tohtml($_mod['username']) . '</a>'; - } else { - $staff = '<em>???</em>'; - } - } else { - $staff = '<em>system</em>'; - } - $body .= '<tr>' . - '<td class="minimal">' . - $staff . - '</td><td>' . - $note['body'] . - '</td><td class="minimal">' . - strftime($config['post_date'], $note['time']) . - '</td>' . - (hasPermission($config['mod']['remove_notes']) ? - '<td class="minimal"><a class="unimportant" href="?/IP/' . $ip . '/deletenote/' . $note['id'] . '">[delete]</a></td>' - : '') . - '</tr>'; - } - $body .= '</table>'; - } - - if(hasPermission($config['mod']['create_notes'])) { - $body .= '<form action="" method="post" style="text-align:center;margin:0">' . - '<table>' . - '<tr>' . - '<th>Staff</th>' . - '<td>' . $mod['username'] . '</td>' . - '</tr>' . - '<tr>' . - '<th><label for="note">Note</label></th>' . - '<td><textarea id="note" name="note" rows="5" cols="30"></textarea></td>' . - '</tr>' . - '<tr>' . - '<td></td>' . - '<td><input type="submit" value="New note" /></td>' . - '</tr>' . - '</table>' . - '</form>'; - } - - $body .= '</fieldset>'; - } - } - - if(hasPermission($config['mod']['view_ban'])) { - $query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip"); - $query->bindValue(':ip', $ip); - $query->execute() or error(db_error($query)); - - if($query->rowCount() > 0) { - $body .= '<fieldset><legend>Ban' . ($query->rowCount() == 1 ? '' : 's') . ' on record</legend>'; - - while($ban = $query->fetch()) { - $body .= '<form action="" method="post" style="text-align:center">' . - '<table style="width:400px;margin-bottom:10px;border-bottom:1px solid #ddd;padding:5px"><tr><th>Status</th><td>' . - ($config['mod']['view_banexpired'] && $ban['expires'] != 0 && $ban['expires'] < time() ? - 'Expired' - : 'Active') . - '</td></tr>' . - - // IP - '<tr><th>IP</th><td>' . $ban['ip'] . '</td></tr>' . - - // Reason - '<tr><th>Reason</th><td>' . $ban['reason'] . '</td></tr>' . - - // Board - '<tr><th>Board</th><td>' . - (isset($ban['board']) ? - sprintf($config['board_abbreviation'], $ban['board']) - : - '<em>' . _('all boards') . '</em>' - ) . - '</td></tr>' . - - // Set - '<tr><th>Set</th><td>' . strftime($config['post_date'], $ban['set']) . '</td></tr>' . - - // Expires - '<tr><th>Expires</th><td>' . - ($ban['expires'] == 0 ? - '<em>Never</em>' - : - strftime($config['post_date'], $ban['expires']) - ) . - '</td></tr>' . - - // Staff - '<tr><th>Staff</th><td>' . - (isset($ban['username']) ? - (!hasPermission($config['mod']['view_banstaff']) ? - ($config['mod']['view_banquestionmark'] ? - '?' - : - ($ban['type'] == JANITOR ? 'Janitor' : - ($ban['type'] == MOD ? 'Mod' : - ($ban['type'] == ADMIN ? 'Admin' : - '?'))) - ) - : - utf8tohtml($ban['username']) - ) - : '<em>deleted?</em>' - ) . - '</td></tr></table>' . - - '<input type="hidden" name="ban_id" value="' . $ban['id'] . '" />' . - - '<input type="submit" name="unban" value="Remove ban" ' . - (!hasPermission($config['mod']['unban']) ? 'disabled' : '') . - '/></form>'; - } - - $body .= '</fieldset>'; - - } - } - - if(hasPermission($config['mod']['ip_banform'])) - $body .= form_newBan($ip, null, '?/IP/' . $ip); - - echo Element('page.html', array( - 'config'=>$config, - 'title'=>'IP: ' . $ip, - 'subtitle' => $host, - 'body'=>$body, - 'mod'=>true - ) - ); - } - } else { - error($config['error']['404']); + exit; } } +error($config['error']['404']); + @@ -281,7 +281,7 @@ if (isset($_POST['delete'])) { $post['name'] = $_POST['name'] != '' ? $_POST['name'] : $config['anonymous']; $post['subject'] = $_POST['subject']; - $post['email'] = utf8tohtml($_POST['email']); + $post['email'] = str_replace(' ', '%20', htmlspecialchars($_POST['email'])); $post['body'] = $_POST['body']; $post['password'] = $_POST['password']; $post['has_file'] = !isset($post['embed']) && (($post['op'] && !isset($post['no_longer_require_an_image_for_op']) && $config['force_image_op']) || (isset($_FILES['file']) && $_FILES['file']['tmp_name'] != '')); @@ -313,13 +313,23 @@ if (isset($_POST['delete'])) { ))); } - if ($mod && $mod['type'] >= MOD && preg_match('/^((.+) )?## (.+)$/', $post['name'], $match)) { - if (($mod['type'] == MOD && $match[3] == 'Mod') || $mod['type'] >= ADMIN) { - $post['capcode'] = utf8tohtml($match[3]); - $post['name'] = $match[2] != '' ? $match[2] : $config['anonymous']; + + $post['capcode'] = false; + + if ($mod && preg_match('/^((.+) )?## (.+)$/', $post['name'], $matches)) { + $name = $matches[2] != '' ? $matches[2] : $config['anonymous']; + $cap = $matches[3]; + + if (isset($config['mod']['capcode'][$mod['type']])) { + if ( $config['mod']['capcode'][$mod['type']] === true || + (is_array($config['mod']['capcode'][$mod['type']]) && + in_array($cap, $config['mod']['capcode'][$mod['type']]) + )) { + + $post['capcode'] = utf8tohtml($cap); + $post['name'] = $name; + } } - } else { - $post['capcode'] = false; } $trip = generate_tripcode($post['name']); @@ -527,7 +537,11 @@ if (isset($_POST['delete'])) { } $post = (array)$post; - $id = post($post); + $post['id'] = $id = post($post); + + if (isset($post['antispam_hash'])) { + incrementSpamHash($post['antispam_hash']); + } if (isset($post['antispam_hash'])) { incrementSpamHash($post['antispam_hash']); diff --git a/stylesheets/style.css b/stylesheets/style.css index a262eb35..80042bd6 100644 --- a/stylesheets/style.css +++ b/stylesheets/style.css @@ -70,15 +70,18 @@ form table input { } input[type="text"], input[type="password"], textarea { border: 1px solid #a9a9a9; - text-indent: 0px; + text-indent: 0; text-shadow: none; text-transform: none; word-spacing: normal; } form table tr td { text-align: left; - margin: 0px; - padding: 0px; + margin: 0; + padding: 0; +} +form table.mod tr td { + padding: 2px; } form table tr th { text-align: left; @@ -104,7 +107,7 @@ form table tr td div label { } p.fileinfo { display: block; - margin: 0px; + margin: 0; padding-right: 7em; } div.banner { @@ -263,11 +266,11 @@ span.heading { color: #AF0A0F; font-size: 11pt; font-weight: bold; - display: block; } span.spoiler { background: black; color: black; + padding: 0px 1px; } div.post.reply p.body span.spoiler a { color: black; @@ -328,7 +331,7 @@ div.pages form input { hr { border: none; border-top: 1px solid #B7C5D9; - height: 0px; + height: 0; clear: left; } div.boardlist { @@ -351,7 +354,7 @@ table.modlog { } table.modlog tr td { text-align: left; - margin: 0px; + margin: 0; padding: 4px 15px 0 0; } table.modlog tr th { @@ -385,19 +388,15 @@ div.blotter { font-weight: bold; text-align: center; } - -/* Uboachan stuff */ -div.styles-sidebar { - text-align: center; - padding-bottom: 0px; -} -div.styles-sidebar a { - margin: 0 5px; +table.mod.config-editor { + font-size: 9pt; + width: 100%; } -div.styles-sidebar a.selected { - text-decoration: none; +table.mod.config-editor td { + text-align: left; + padding: 5px; + border-bottom: 1px solid #98e; } -.category { - background: #98E; - color: black; +table.mod.config-editor input[type="text"] { + width: 98%; } diff --git a/templates/generic_page.html b/templates/generic_page.html new file mode 100644 index 00000000..e834aad0 --- /dev/null +++ b/templates/generic_page.html @@ -0,0 +1,71 @@ +<!doctype html> +<html> +<head> + {% block head %} + <link rel="stylesheet" media="screen" href="{{ config.url_stylesheet }}"> + {% if config.url_favicon %}<link rel="shortcut icon" href="{{ config.url_favicon }}">{% endif %} + <title>{{ board.url }} - {{ board.name }}</title> + <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> + <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=yes"> + {% if config.meta_keywords %}<meta name="keywords" content="{{ config.meta_keywords }}">{% endif %} + {% if config.default_stylesheet.1 != '' %}<link rel="stylesheet" type="text/css" id="stylesheet" href="{{ config.uri_stylesheets }}{{ config.default_stylesheet.1 }}">{% endif %} + {% if not nojavascript %} + <script type="text/javascript" src="{{ config.url_javascript }}"></script> + {% if not config.additional_javascript_compile %} + {% for javascript in config.additional_javascript %}<script type="text/javascript" src="{{ config.additional_javascript_url }}{{ javascript }}"></script>{% endfor %} + {% endif %} + {% endif %} + {% if config.recaptcha %}<style type="text/css">{% raw %} + .recaptcha_image_cell { + background: none !important; + } + table.recaptchatable { + border: none !important; + } + #recaptcha_logo, #recaptcha_tagline { + display: none; + float: right; + } + .recaptchatable a { + display: block; + } + {% endraw %}</style>{% endif %} + {% endblock %} +</head> +<body> + {{ boardlist.top }} + {% if pm %}<div class="top_notice">You have <a href="?/PM/{{ pm.id }}">an unread PM</a>{% if pm.waiting > 0 %}, plus {{ pm.waiting }} more waiting{% endif %}.</div><hr />{% endif %} + {% if config.url_banner %}<img class="banner" src="{{ config.url_banner }}" {% if config.banner_width or config.banner_height %}style="{% if config.banner_width %}width:{{ config.banner_width }}px{% endif %};{% if config.banner_width %}height:{{ config.banner_height }}px{% endif %}" {% endif %}alt="" />{% endif %} + <header> + <h1>{{ board.url }} - {{ board.name }}</h1> + <div class="subtitle"> + {% if board.title %} + {{ board.title|e }} + {% endif %} + {% if mod %}<p><a href="?/">{% trans %}Return to dashboard{% endtrans %}</a></p>{% endif %} + </div> + </header> + + {% include 'post_form.html' %} + + {% if config.blotter %}<hr /><div class="blotter">{{ config.blotter }}</div>{% endif %} + <hr /> + <form name="postcontrols" action="{{ config.post_url }}" method="post"> + <input type="hidden" name="board" value="{{ board.uri }}" /> + {% if mod %}<input type="hidden" name="mod" value="1" />{% endif %} + {{ body }} + {% include 'report_delete.html' %} + </form> + <div class="pages">{{ btn.prev }} {% for page in pages %} + [<a {% if page.selected %}class="selected"{% endif %}{% if not page.selected %}href="{{ page.link }}"{% endif %}>{{ page.num }}</a>]{% if loop.last %} {% endif %} + {% endfor %} {{ btn.next }}</div> + {{ boardlist.bottom }} + <footer> + <p class="unimportant" style="margin-top:20px;text-align:center;">Powered by <a href="http://tinyboard.org/">Tinyboard</a> {{ config.version }} | <a href="http://tinyboard.org/">Tinyboard</a> Copyright © 2010-2012 Tinyboard Development Group</p> + {% for footer in config.footer %}<p class="unimportant" style="text-align:center;">{{ footer }}</p>{% endfor %} + </footer> + <script type="text/javascript">{% raw %} + ready(); + {% endraw %}</script> +</body> +</html> diff --git a/templates/index.html b/templates/index.html index e0fa6fe0..a28724a1 100644 --- a/templates/index.html +++ b/templates/index.html @@ -1,11 +1,11 @@ <!doctype html>
<html>
<head>
+ <meta charset="utf-8">
<link rel="stylesheet" media="screen" href="{{ config.url_stylesheet }}">
{% if config.url_favicon %}<link rel="shortcut icon" href="{{ config.url_favicon }}">{% endif %}
<title>{{ board.url }} - {{ board.name }}</title>
- <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
- <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=yes">
+ <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">
{% if config.meta_keywords %}<meta name="keywords" content="{{ config.meta_keywords }}">{% endif %}
{% if config.default_stylesheet.1 != '' %}<link rel="stylesheet" type="text/css" id="stylesheet" href="{{ config.uri_stylesheets }}{{ config.default_stylesheet.1 }}">{% endif %}
{% if not nojavascript %}
@@ -35,10 +35,10 @@ {% if pm %}<div class="top_notice">You have <a href="?/PM/{{ pm.id }}">an unread PM</a>{% if pm.waiting > 0 %}, plus {{ pm.waiting }} more waiting{% endif %}.</div><hr />{% endif %}
{% if config.url_banner %}<img class="banner" src="{{ config.url_banner }}" {% if config.banner_width or config.banner_height %}style="{% if config.banner_width %}width:{{ config.banner_width }}px{% endif %};{% if config.banner_width %}height:{{ config.banner_height }}px{% endif %}" {% endif %}alt="" />{% endif %}
<header>
- <h1>{{ board.url }} - {{ board.name }}</h1>
+ <h1>{{ board.url }} - {{ board.title|e }}</h1>
<div class="subtitle">
- {% if board.title %}
- {{ board.title }}
+ {% if board.subtitle %}
+ {{ board.subtitle|e }}
{% endif %}
{% if mod %}<p><a href="?/">{% trans %}Return to dashboard{% endtrans %}</a></p>{% endif %}
</div>
diff --git a/templates/mod/ban_form.html b/templates/mod/ban_form.html new file mode 100644 index 00000000..5d5f2b81 --- /dev/null +++ b/templates/mod/ban_form.html @@ -0,0 +1,91 @@ +{% if post and board %} + {% set action = '?/' ~ board ~ '/ban/' ~ post %} +{% else %} + {% set action = '?/ban' %} +{% endif %} + +<form action="{{ action }}" method="post"> + {% if redirect %} + <input type="hidden" name="redirect" value="{{ redirect|e }}"> + {% endif %} + {% if post and board %} + <input type="hidden" name="delete" value="{% if delete %}1{% else %}0{% endif %}"> + {% endif %} + + <table> + + <tr> + <th> + <label for="ip">{% trans 'IP' %} <span class="unimportant">{% trans '(or subnet)' %}</span></label> + </th> + <td> + {% if not hide_ip %} + <input type="text" name="ip" id="ip" size="30" maxlength="40" value="{{ ip }}"> + {% else %} + <em>{% trans 'hidden' %}</em> + {% endif %} + </td> + </tr> + <tr> + <th> + <label for="reason">{% trans 'Reason' %}</label> + </th> + <td> + <textarea name="reason" id="reason" rows="5" cols="30">{{ reason|e }}</textarea> + </td> + </tr> + {% if post and board and not delete %} + <tr> + <th> + <label for="reason">{% trans 'Message' %}</label> + </th> + <td> + <input type="checkbox" id="public_message" name="public_message"> + <input type="text" name="message" id="message" size="35" maxlength="200" value="{{ config.mod.default_ban_message|e }}"> + <span class="unimportant">({% trans 'public; attached to post' %})</span> + <script type="text/javascript"> + document.getElementById('message').disabled = true; + document.getElementById('public_message').onchange = function() { + document.getElementById('message').disabled = !this.checked; + } + </script> + </td> + </tr> + {% endif %} + <tr> + <th> + <label for="length">{% trans 'Length' %}</label> + </th> + <td> + <input type="text" name="length" id="length" size="20" maxlength="40"> + <span class="unimportant">(eg. "2d1h30m" or "2 days")</span></td> + </tr> + <tr> + <th>{% trans 'Board' %}</th> + <td> + <ul style="list-style:none;padding:2px 5px"> + <li> + <input type="radio" name="board" value="*" id="ban-allboards" checked> + <label style="display:inline" for="ban-allboards"> + <em>{% trans 'all boards' %}</em> + </label> + </li> + + {% for board in boards %} + <li> + <input type="radio" name="board" value="{{ board.uri }}" id="ban-board-{{ board.uri }}"> + <label style="display:inline" for="ban-board-{{ board.uri }}"> + {{ config.board_abbreviation|sprintf(board.uri) }} - {{ board.title|e }} + </label> + </li> + {% endfor %} + </ul> + </td> + </tr> + <tr> + <td></td> + <td><input name="new_ban" type="submit" value="{% trans 'New Ban' %}"></td> + </tr> + </table> +</form> + diff --git a/templates/mod/ban_list.html b/templates/mod/ban_list.html new file mode 100644 index 00000000..2edb9cdf --- /dev/null +++ b/templates/mod/ban_list.html @@ -0,0 +1,95 @@ +{% if bans|count == 0 %} + <p style="text-align:center" class="unimportant">({% trans 'There are no active bans.' %})</p> +{% else %} + <form action="" method="post"> + <table class="mod" style="width:100%"> + <tr> + <th>{% trans 'IP address/mask' %}</th> + <th>{% trans 'Reason' %}</th> + <th>{% trans 'Board' %}</th> + <th>{% trans 'Set' %}</th> + <th>{% trans 'Duration' %}</th> + <th>{% trans 'Expires' %}</th> + <th>{% trans 'Staff' %}</th> + </tr> + {% for ban in bans %} + <tr{% if ban.expires != 0 and ban.expires < time() %} style="text-decoration:line-through"{% endif %}> + <td style="white-space: nowrap"> + <input type="checkbox" name="ban_{{ ban.id }}"> + {% if ban.real_ip %} + <a href="?/IP/{{ ban.ip }}">{{ ban.ip }}</a> + {% else %} + {{ ban.ip|e }} + {% endif %} + </td> + <td> + {% if ban.reason %} + {{ ban.reason }} + {% else %} + - + {% endif %} + </td> + <td style="white-space: nowrap"> + {% if ban.board %} + {{ config.board_abbreviation|sprintf(ban.board) }} + {% else %} + <em>{% trans 'all boards' %}</em> + {% endif %} + </td> + <td style="white-space: nowrap"> + <span title="{{ ban.set|date(config.post_date) }}"> + {{ ban.set|ago }} ago + </span> + </td> + <td style="white-space: nowrap"> + {% if ban.expires == 0 %} + - + {% else %} + {{ (ban.expires - ban.set + time()) | until }} + {% endif %} + </td> + <td style="white-space: nowrap"> + {% if ban.expires == 0 %} + <em>{% trans 'never' %}</em> + {% else %} + {{ ban.expires|date(config.post_date) }} + {% if ban.expires > time() %} + <small>(in {{ ban.expires|until }})</small> + {% endif %} + {% endif %} + </td> + <td> + {% if ban.username %} + {% if mod|hasPermission(config.mod.view_banstaff) %} + <a href="?/new_PM/{{ ban.username|e }}">{{ ban.username|e }}</a> + {% else %} + {% if mod|hasPermission(config.mod.view_banquestionmark) %} + <em>?</em> + {% else %} + + {% endif %} + {% endif %} + {% elseif ban.mod == -1 %} + <em>system</em> + {% else %} + <em>{% trans 'deleted?' %}</em> + {% endif %} + </td> + </tr> + {% endfor %} + </table> + + <p style="text-align:center"> + <input type="submit" name="unban" value="{% trans 'Unban selected' %}"> + </p> + </form> +{% endif %} + +{% if count > bans|count %} + <p class="unimportant" style="text-align:center;word-wrap:break-word"> + {% for i in range(0, (count - 1) / config.mod.modlog_page) %} + <a href="?/bans/{{ i + 1 }}">[{{ i + 1 }}]</a> + {% endfor %} + </p> +{% endif %} + diff --git a/templates/mod/board.html b/templates/mod/board.html new file mode 100644 index 00000000..0775e421 --- /dev/null +++ b/templates/mod/board.html @@ -0,0 +1,44 @@ +{% if new %} + {% set action = '?/new-board' %} +{% else %} + {% set action = '?/edit/' ~ board.uri %} +{% endif %} + +<form action="{{ action }}" method="post"> + <table> + <tr> + <th>{% trans 'URI' %}</th> + <td> + {% if not new %} + {{ config.board_abbreviation|sprintf(board.uri) }} + {% else %} + /<input size="10" maxlength="255" type="text" name="uri" autocomplete="off">/ + {% endif %} + </td> + </tr> + <tr> + <th>{% trans 'Title' %}</th> + <td> + <input size="25" type="text" name="title" value="{{ board.title|e }}" autocomplete="off"> + </td> + </tr> + <tr> + <th>{% trans 'Subtitle' %}</th> + <td> + <input size="25" type="text" name="subtitle" value="{{ board.subtitle|e }}" autocomplete="off"> + </td> + </tr> + </table> + + <ul style="padding:0;text-align:center;list-style:none"> + {% if new %} + <li><input type="submit" value="{% trans 'Create board' %}"></li> + {% else %} + <li><input type="submit" value="{% trans 'Save changes' %}"></li> + {% if mod|hasPermission(config.mod.deleteboard) %} + <li><input name="delete" onclick="return confirm('Are you sure you want to permanently delete this board?');" type="submit" value="{% trans 'Delete board' %}"></li> + {% endif %} + {% endif %} + </ul> +</form> + diff --git a/templates/mod/config-editor.html b/templates/mod/config-editor.html new file mode 100644 index 00000000..ec7213bb --- /dev/null +++ b/templates/mod/config-editor.html @@ -0,0 +1,56 @@ +<form method="post" action=""> + <table class="mod config-editor"> + <tr> + <th class="minimal">Name</th> + <th>Value</th> + <th class="minimal">Type</th> + <th>Description</th> + </tr> + {% for var in conf if var.type != 'array' %} + {% if var.name|count == 1 %} + {% set name = 'cf_' ~ var.name %} + {% else %} + {% set name = 'cf_' ~ var.name|join('/') %} + {% endif %} + + <tr> + <th class="minimal"> + {% if var.name|count == 1 %} + {{ var.name }} + {% else %} + {{ var.name|join(' → ') }} + {% endif %} + </th> + + <td> + {% if var.type == 'string' %} + <input name="{{ name }}" type="text" value="{{ var.value|e }}"> + {% elseif var.type == 'integer' %} + <input name="{{ name }}" type="number" value="{{ var.value|e }}"> + {% elseif var.type == 'boolean' %} + <input name="{{ name }}" type="checkbox" {% if var.value %}checked{% endif %}> + {% else %} + ? + {% endif %} + + {% if var.type == 'integer' or var.type == 'boolean' %} + <small>Default: <code>{{ var.default }}</code></small> + {% endif %} + </td> + + <td class="minimal"> + {{ var.type|e }} + </td> + + <td> + {{ var.comment|join('<br>') }} + </td> + </tr> + {% endfor %} + </table> + + <ul style="padding:0;text-align:center;list-style:none"> + <li><input name="save" type="submit" value="{% trans 'Save changes' %}"></li> + </ul> +</form> + diff --git a/templates/mod/confirm.html b/templates/mod/confirm.html new file mode 100644 index 00000000..6dc4d66a --- /dev/null +++ b/templates/mod/confirm.html @@ -0,0 +1,7 @@ +<p style="text-align:center;font-size:1.1em"> + {% trans 'Are you sure you want to do that?' %} <a href="?/{{ request }}">{% trans 'Click to proceed to' %} ?/{{ request }}</a>. +</p> +<p class="unimportant" style="text-align:center"> + {% trans 'You are seeing this message because we were unable to serve a confirmation dialog, probably due to Javascript being disabled.' %} +</p> + diff --git a/templates/mod/dashboard.html b/templates/mod/dashboard.html new file mode 100644 index 00000000..30742dc1 --- /dev/null +++ b/templates/mod/dashboard.html @@ -0,0 +1,139 @@ +<fieldset> + <legend>{% trans 'Boards' %}</legend> + + <ul> + {% for board in boards %} + <li> + <a href="?/{{ config.board_path|sprintf(board.uri) }}{{ config.file_index }}">{{ config.board_abbreviation|sprintf(board.uri) }}</a> + - + {{ board.title|e }} + {% if board.subtitle %} + <small>— {{ board.subtitle|e }}</small> + {% endif %} + {% if mod|hasPermission(config.mod.manageboards) %} + <a href="?/edit/{{ board.uri }}"><small>[{% trans 'edit' %}]</small></a> + {% endif %} + </li> + {% endfor %} + + {% if mod|hasPermission(config.mod.newboard) %} + <li style="margin-top:15px"><a href="?/new-board"><strong>{% trans 'Create new board' %}</strong></a></li> + {% endif %} + </ul> +</fieldset> + +<fieldset> + <legend>{% trans 'Messages' %}</legend> + <ul> + {% if mod|hasPermission(config.mod.noticeboard) %} + {% if noticeboard|count > 0 %} + <li> + {% trans 'Noticeboard' %}: + <ul> + {% for post in noticeboard %} + <li> + <a href="?/noticeboard#{{ post.id }}"> + {% if post.subject %} + {{ post.subject|e }} + {% else %} + <em>{% trans 'no subject' %}</em> + {% endif %} + </a> + <small class="unimportant"> + — by + {% if post.username %} + {{ post.username|e }} + {% else %} + <em>deleted?</em> + {% endif %} + at + {{ post.time|date(config.post_date) }} + </small> + </li> + {% endfor %} + </ul> + </li> + {% endif %} + <li><a href="?/noticeboard">{% trans 'View all entries' %}</a></li> + {% endif %} + <li><a href="?/news">{% trans 'News' %}</a></li> + <li> + <a href="?/inbox"> + {% trans 'PM inbox' %} + {% if unread_pms > 0 %}<strong>{%endif %}({{ unread_pms }} unread){% if unread_pms > 0 %}</strong>{%endif %} + </a> + </li> + </ul> +</fieldset> + +<fieldset> + <legend>{% trans 'Administration' %}</legend> + + <ul> + {% if mod|hasPermission(config.mod.reports) %} + <li> + {% if reports > 0 %}<strong>{% endif %} + <a href="?/reports">{% trans 'Report queue' %} ({{ reports }})</a> + {% if reports > 0 %}</strong>{% endif %} + </li> + {% endif %} + {% if mod|hasPermission(config.mod.view_banlist) %} + <li><a href="?/bans">{% trans 'Ban list' %}</a></li> + {% endif %} + {% if mod|hasPermission(config.mod.manageusers) %} + <li><a href="?/users">{% trans 'Manage users' %}</a></li> + {% elseif mod|hasPermission(config.mod.change_password) %} + <li><a href="?/users/{{ mod.id }}">{% trans 'Change password' %}</a></li> + {% endif %} + {% if mod|hasPermission(config.mod.themes) %} + <li><a href="?/themes">{% trans 'Manage themes' %}</a></li> + {% endif %} + {% if mod|hasPermission(config.mod.modlog) %} + <li><a href="?/log">{% trans 'Moderation log' %}</a></li> + {% endif %} + {% if mod|hasPermission(config.mod.rebuild) %} + <li><a href="?/rebuild">{% trans 'Rebuild' %}</a></li> + {% endif %} + {% if mod|hasPermission(config.mod.show_config) %} + <li><a href="?/config">{% trans 'Configuration' %}</a></li> + {% endif %} + + </ul> +</fieldset> + +<fieldset> + <legend>{% trans 'Search' %}</legend> + + {# TODO #} +</fieldset> + +{% if config.debug %} + <fieldset> + <legend>{% trans 'Debug' %}</legend> + <ul> + <li><a href="?/debug/antispam">{% trans 'Anti-spam' %}</a></li> + </ul> + </fieldset> +{% endif %} + +{% if newer_release %} + <fieldset> + <legend>Update</legend> + <ul> + <li> + A newer version of Tinyboard + (<strong>v{{ newer_release.massive }}.{{ newer_release.major }}.{{ newer_release.minor }}</strong>) is available! + See <a href="http://tinyboard.org">http://tinyboard.org/</a> for upgrade instructions. + </li> + </ul> + </fieldset> +{% endif %} + +<fieldset> + <legend>{% trans 'User account' %}</legend> + + <ul> + <li><a href="?/logout">{% trans 'Logout' %}</a></li> + </ul> +</fieldset> + diff --git a/templates/mod/debug/antispam.html b/templates/mod/debug/antispam.html new file mode 100644 index 00000000..a846bc17 --- /dev/null +++ b/templates/mod/debug/antispam.html @@ -0,0 +1,65 @@ +<p style="text-align:center"> + Most used (in active): +</p> +<table class="modlog" style="width:700px;margin:auto"> + <tr> + <th>Board</th> + <th>Thread</th> + <th>Hash (SHA1)</th> + <th>Created</th> + <th>Expires</th> + <th>Passed</th> + </tr> + {% for hash in top %} + <tr> + <td>{{ config.board_abbreviation|sprintf(hash.board) }}</td> + <td> + {% if hash.thread %} + {{ hash.thread }} + {% else %} + - + {% endif %}</td> + <td> + <small><code>{{ hash.hash }}</code></small> + </td> + <td> + <span title="{{ hash.created|date(config.post_date) }}">{{ hash.created|ago }} ago</span> + </td> + <td> + {% if hash.expires %} + <span title="{{ hash.expires|date(config.post_date) }}"> + {{ hash.expires|until }} + </span> + {% else %} + - + {% endif %} + </td> + <td>{{ hash.passed }}</td> + </tr> + {% endfor %} +</table> +<p style="text-align:center"> + Total: <strong>{{ total }}</strong> (<strong>{{ expiring }}</strong> set to expire) +</p> + +<form method="post" action="?/debug/antispam"> + <table class="modlog" style="width:1%;white-space:nowrap;margin:auto"> + <tr> + <th>Board</th> + <th>Thread</th> + <th></th> + </tr> + <tr> + <td> + <input type="text" name="board" style="width:90px" value="{{ board }}"> + </td> + <td> + <input type="text" name="thread" style="width:90px" value="{{ thread }}"> + </td> + <td> + <input type="submit" name="filter" value="Filter"> + <input type="submit" name="purge" value="Purge"> + </td> + </tr> + </table> +</form> diff --git a/templates/mod/inbox.html b/templates/mod/inbox.html new file mode 100644 index 00000000..97afe446 --- /dev/null +++ b/templates/mod/inbox.html @@ -0,0 +1,36 @@ +{% if messages|count == 0 %} + <p style="text-align:center" class="unimportant">({% trans 'No private messages for you.' %})</p> +{% else %} + <table class="modlog"> + <tr> + <th>{% trans 'ID' %}</th> + <th>{% trans 'From' %}</th> + <th>{% trans 'Date' %}</th> + <th>{% trans 'Message snippet' %}</th> + </tr> + {% for message in messages %} + <tr{% if message.unread %} style="font-weight:bold"{% endif %}> + <td class="minimal"> + <a href="?/PM/{{ message.id }}"> + {{ message.id }} + </a> + </td> + <td class="minimal"> + {% if message.username %} + <a href="?/new_PM/{{ message.username|e }}">{{ message.username|e }}</a> + {% else %} + <em>{% trans 'deleted?' %}</em> + {% endif %} + </td> + <td class="minimal"> + {{ message.time|date(config.post_date) }} + </td> + <td> + <a href="?/PM/{{ message.id }}"> + {{ message.snippet }} + </a> + </td> + </tr> + {% endfor %} + </table> +{% endif %} diff --git a/templates/mod/log.html b/templates/mod/log.html new file mode 100644 index 00000000..dca1b2d0 --- /dev/null +++ b/templates/mod/log.html @@ -0,0 +1,47 @@ +<table class="modlog"> + <tr> + <th>{% trans 'Staff' %}</th> + <th>{% trans 'IP address' %}</th> + <th>{% trans 'Time' %}</th> + <th>{% trans 'Board' %}</th> + <th>{% trans 'Action' %}</th> + </tr> + {% for log in logs %} + <tr> + <td class="minimal"> + {% if log.username %} + <a href="?/new_PM/{{ log.username|e }}">{{ log.username|e }}</a> + {% elseif log.mod == -1 %} + <em>system</em> + {% else %} + <em>{% trans 'deleted?' %}</em> + {% endif %} + </td> + <td class="minimal"> + <a href="?/IP/{{ log.ip }}">{{ log.ip }}</a> + </td> + <td class="minimal"> + <span title="{{ log.time|date(config.post_date) }}">{{ log.time|ago }}</span> + </td> + <td class="minimal"> + {% if log.board %} + <a href="?/{{ config.board_path|sprintf(log.board) }}{{ config.file_index }}">{{ config.board_abbreviation|sprintf(log.board) }}</a> + {% else %} + - + {% endif %} + </td> + <td> + {{ log.text }} + </td> + </tr> + {% endfor %} +</table> + +{% if count > logs|count %} + <p class="unimportant" style="text-align:center;word-wrap:break-word"> + {% for i in range(0, (count - 1) / config.mod.modlog_page) %} + <a href="?/log/{{ i + 1 }}">[{{ i + 1 }}]</a> + {% endfor %} + </p> +{% endif %} + diff --git a/templates/login.html b/templates/mod/login.html index 709bad86..43a28d56 100644 --- a/templates/login.html +++ b/templates/mod/login.html @@ -1,18 +1,17 @@ {% if error %}<h2 style="text-align:center">{{ error }}</h2>{% endif %}
<form action="" method="post">
-{% if redirect %}<input type="hidden" name="redirect" value="{{ redirect }}" />{% endif %}
<table style="margin-top:25px;">
<tr>
<th>
- {% trans %}Username{% endtrans %}
+ {% trans 'Username' %}
</th>
<td>
- <input type="text" name="username" size="20" maxlength="30" value="{{ username }}">
+ <input type="text" name="username" size="20" maxlength="30" value="{{ username|e }}">
</td>
</tr>
<tr>
<th>
- {% trans %}Password{% endtrans %}
+ {% trans 'Password' %}
</th>
<td>
<input type="password" name="password" size="20" maxlength="30" value="">
diff --git a/templates/mod/move.html b/templates/mod/move.html new file mode 100644 index 00000000..802903b2 --- /dev/null +++ b/templates/mod/move.html @@ -0,0 +1,41 @@ +<form action="?/{{ board }}/move/{{ post }}" method="post"> + <table> + <tr> + <th> + {% trans 'Thread ID' %} + </th> + <td> + >>>{{ config.board_abbreviation|sprintf(board) }}{{ post }} + </td> + </tr> + <tr> + <th> + {% trans 'Leave shadow thread' %} + </th> + <td> + <input type="checkbox" name="shadow" checked> + <span class="unimportant">({% trans 'locks thread; replies to it with a link.' %})</span> + </td> + </tr> + <tr> + <th>{% trans 'Target board' %}</th> + <td> + <ul style="list-style:none;padding:0"> + {% for targetboard in boards if targetboard.uri != board %} + <li> + <input type="radio" name="board" value="{{ targetboard.uri }}" id="ban-board-{{ targetboard.uri }}"> + <label style="display:inline" for="ban-board-{{ targetboard.uri }}"> + {{ config.board_abbreviation|sprintf(targetboard.uri) }} - {{ targetboard.title|e }} + </label> + </li> + {% endfor %} + </ul> + </td> + </tr> + </table> + + <ul style="padding:0;text-align:center;list-style:none"> + <li><input type="submit" value="{% trans 'Move thread' %}"></li> + </ul> +</form> + diff --git a/templates/mod/new_pm.html b/templates/mod/new_pm.html new file mode 100644 index 00000000..3fd78ac6 --- /dev/null +++ b/templates/mod/new_pm.html @@ -0,0 +1,18 @@ +<form action="?/new_PM/{{ username|e }}" method="post"> + <table> + <tr> + <th>To</th> + {% if mod|hasPermission(config.mod.editusers) %} + <td><a href="?/users/{{ id }}">{{ username|e }}</a></td> + {% else %} + <td>{{ username|e }}</td> + {% endif %} + </tr> + <tr> + <th>Message</th> + <td><textarea name="message" rows="10" cols="40">{{ message }}</textarea></td> + </tr> + </table> + + <p style="text-align:center"><input type="submit" value="{% trans 'Send message' %}"></p> +</form> diff --git a/templates/mod/news.html b/templates/mod/news.html new file mode 100644 index 00000000..b6c35798 --- /dev/null +++ b/templates/mod/news.html @@ -0,0 +1,70 @@ +{% if mod|hasPermission(config.mod.news) %} + <fieldset> + <legend>{% trans 'New post' %}</legend> + <form style="margin:0" action="" method="post"> + <table> + <tr> + <th> + {% if mod|hasPermission(config.mod.news_custom) %} + <label for="name">{% trans 'Name' %}</label> + {% else %} + {% trans 'Name' %} + {% endif %} + </th> + <td> + {% if mod|hasPermission(config.mod.news_custom) %} + <input type="text" size="55" name="name" id="name" value="{{ mod.username|e }}"> + {% else %} + {{ mod.username|e }} + {% endif %} + </td> + </tr> + <tr> + <th><label for="subject">{% trans 'Subject' %}</label></th> + <td><input type="text" size="55" name="subject" id="subject"></td> + </tr> + <tr> + <th><label for="body">{% trans 'Body' %}</label></th> + <td><textarea name="body" id="body" style="width:100%;height:100px"></textarea></td> + </tr> + </table> + <p style="text-align:center"> + <input type="submit" value="{% trans 'Post news entry' %}"> + </p> + </form> + </fieldset> +{% endif %} + +{% for post in news %} + <div class="ban"> + {% if mod|hasPermission(config.mod.news_delete) %} + <span style="float:right;padding:2px"> + <a class="unimportant" href="?/news/delete/{{ post.id }}">[{% trans 'delete' %}]</a> + </span> + {% endif %} + <h2 id="{{ post.id }}"> + <small class="unimportant"> + <a href="#{{ post.id }}">#</a> + </small> + {% if post.subject %} + {{ post.subject|e }} + {% else %} + <em>{% trans 'no subject' %}</em> + {% endif %} + <small class="unimportant"> + — {% trans 'by' %} {{ post.name }} {% trans 'at' %} {{ notice.time|date(config.post_date) }} + </small> + </h2> + <p> + {{ post.body }} + </p> + </div> +{% endfor %} + +{% if count > news|count %} + <p class="unimportant" style="text-align:center;word-wrap:break-word"> + {% for i in range(0, (count - 1) / config.mod.news_page) %} + <a href="?/news/{{ i + 1 }}">[{{ i + 1 }}]</a> + {% endfor %} + </p> +{% endif %} diff --git a/templates/mod/noticeboard.html b/templates/mod/noticeboard.html new file mode 100644 index 00000000..463b8430 --- /dev/null +++ b/templates/mod/noticeboard.html @@ -0,0 +1,65 @@ +{% if mod|hasPermission(config.mod.noticeboard_post) %} + <fieldset> + <legend>{% trans 'New post' %}</legend> + <form style="margin:0" action="" method="post"> + <table> + <tr> + <th>{% trans 'Name' %}</th> + <td>{{ mod.username|e }}</td> + </tr> + <tr> + <th><label for="subject">{% trans 'Subject' %}</label></th> + <td><input type="text" size="55" name="subject" id="subject" /></td> + </tr> + <tr> + <th>{% trans 'Body' %}</th> + <td><textarea name="body" style="width:100%;height:100px"></textarea></td> + </tr> + </table> + <p style="text-align:center"> + <input type="submit" value="{% trans 'Post to noticeboard' %}" /> + </p> + </form> + </fieldset> +{% endif %} + +{% for post in noticeboard %} + <div class="ban"> + {% if mod|hasPermission(config.mod.noticeboard_delete) %} + <span style="float:right;padding:2px"> + <a class="unimportant" href="?/noticeboard/delete/{{ post.id }}">[{% trans 'delete' %}]</a> + </span> + {% endif %} + <h2 id="{{ post.id }}"> + <small class="unimportant"> + <a href="#{{ post.id }}">#</a> + </small> + {% if post.subject %} + {{ post.subject|e }} + {% else %} + <em>{% trans 'no subject' %}</em> + {% endif %} + <small class="unimportant"> + — {% trans 'by' %} + {% if post.username %} + {{ post.username|e }} + {% else %} + <em>{% trans 'deleted?' %}</em> + {% endif %} + {% trans 'at' %} + {{ post.time|date(config.post_date) }} + </small> + </h2> + <p> + {{ post.body }} + </p> + </div> +{% endfor %} + +{% if count > noticeboard|count %} + <p class="unimportant" style="text-align:center;word-wrap:break-word"> + {% for i in range(0, (count - 1) / config.mod.noticeboard_page) %} + <a href="?/noticeboard/{{ i + 1 }}">[{{ i + 1 }}]</a> + {% endfor %} + </p> +{% endif %} diff --git a/templates/mod/pm.html b/templates/mod/pm.html new file mode 100644 index 00000000..c62cae58 --- /dev/null +++ b/templates/mod/pm.html @@ -0,0 +1,44 @@ +<form action="" method="post"> + <table> + <tr> + <th>{% trans 'From' %}</th> + {% if username %} + <td><a href="?/new_PM/{{ username|e }}">{{ username|e }}</a></td> + {% else %} + <td><em>{% trans 'deleted?' %}</em></td> + {% endif %} + </tr> + {% if to != mod.id %} + <tr> + <th>To</th> + {% if to_username %} + <td><a href="?/new_PM/{{ to_username|e }}">{{ to_username|e }}</a></td> + {% else %} + <td><em>{% trans 'deleted?' %}</em></td> + {% endif %} + </tr> + {% endif %} + <tr> + <th>{% trans 'Date' %}</th> + <td>{{ time|date(config.post_date) }} <small>({{ time|ago }} ago)</small></td> + + </tr> + <tr> + <th>{% trans 'Message' %}</th> + <td>{{ message }}</td> + </tr> + </table> + + <ul style="list-style:none;text-align:center;padding:0"> + <li style="padding:5px 0"> + <input type="submit" name="delete" value="{% trans 'Delete forever' %}"> + </li> + {% if mod|hasPermission(config.mod.create_pm) %} + <li style="padding:5px 0"> + <a href="?/PM/{{ id }}/reply"> + {% trans 'Reply with quote' %} + </a> + </li> + {% endif %} + </ul> +</form> diff --git a/templates/mod/rebuild.html b/templates/mod/rebuild.html new file mode 100644 index 00000000..7c6b28ba --- /dev/null +++ b/templates/mod/rebuild.html @@ -0,0 +1,71 @@ +<form style="width:300px;margin:auto" action="?/rebuild" method="post"> + <ul id="rebuild"> + <li style="margin-bottom:8px"> + <input type="checkbox" name="rebuild_all" id="rebuild_all" onchange="toggleall(this.checked)"> + <label for="rebuild_all"><strong>{% trans 'Toggle all' %}</strong></label> + <script> + function toggleall(val) { + /* TODO: something more suitable for all browsers? */ + var elements = document.getElementById('rebuild').querySelectorAll('input'); + for (i in elements) { + elements[i].checked = val; + } + } + </script> + </li> + <li> + <input type="checkbox" name="rebuild_cache" id="rebuild_cache" checked> + <label for="rebuild_cache">{% trans 'Flush cache' %}</label> + </li> + <li> + <input type="checkbox" name="rebuild_javascript" id="rebuild_javascript" checked> + <label for="rebuild_javascript">{% trans 'Rebuild Javascript' %}</label> + </li> + <li> + <input type="checkbox" name="rebuild_index" id="rebuild_index" checked> + <label for="rebuild_index">{% trans 'Rebuild index pages' %}</label> + </li> + <li> + <input type="checkbox" name="rebuild_thread" id="rebuild_thread" checked> + <label for="rebuild_thread">{% trans 'Rebuild thread pages' %}</label> + </li> + <li> + <input type="checkbox" name="rebuild_themes" id="rebuild_themes" checked> + <label for="rebuild_themes">{% trans 'Rebuild themes' %}</label> + </li> + <li> + <input type="checkbox" name="rebuild_posts" id="rebuild_posts"> + <label for="rebuild_posts">{% trans 'Rebuild replies' %}</label> + </li> + </ul> + + <hr> + + <ul id="boards"> + <li style="margin-bottom:8px"> + <input type="checkbox" name="boards_all" id="boards_all" onchange="toggleallboards(this.checked)" checked> + <label for="boards_all"><strong>{% trans 'All boards' %}</strong></label> + <script> + function toggleallboards(val) { + /* TODO: something more suitable for all browsers? */ + var elements = document.getElementById('boards').querySelectorAll('input'); + for (i in elements) { + elements[i].checked = val; + } + } + </script> + </li> + {% for board in boards %} + <li> + <input type="checkbox" name="board_{{ board.uri }}" id="board-{{ board.uri }}" checked> + <label for="board-{{ board.uri }}"> + {{ config.board_abbreviation|sprintf(board.uri) }} - {{ board.title|e }} + </label> + </li> + {% endfor %} + </ul> + + <p style="text-align:center"> + <input type="submit" value="{% trans 'Rebuild' %}" name="rebuild"> + </p> +</form> diff --git a/templates/mod/rebuilt.html b/templates/mod/rebuilt.html new file mode 100644 index 00000000..57d16fff --- /dev/null +++ b/templates/mod/rebuilt.html @@ -0,0 +1,12 @@ +<div class="ban"> + <h2>{% trans 'Rebuilt' %}</h2> + <ul> + {% for log in logs %} + <li>{{ log }}</li> + {% endfor %} + </ul> + <p> + <a href="?/rebuild">{% trans 'Go back and rebuild again' %}</a>. + </p> +</div> + diff --git a/templates/mod/report.html b/templates/mod/report.html new file mode 100644 index 00000000..9c8463ed --- /dev/null +++ b/templates/mod/report.html @@ -0,0 +1,26 @@ +<div class="report"> + <hr> + {% trans 'Board' %}: <a href="?/{{ report.board }}/{{ config.file_index }}">{{ config.board_abbreviation|sprintf(report.board) }}</a> + <br> + {% trans 'Reason' %}: {{ report.reason }} + <br> + {% trans 'Report date' %}: {{ report.time|date(config.post_date) }} + <br> + {% if mod|hasPermission(config.mod.show_ip, report.board) %} + {% trans 'Reported by' %}: <a href="?/IP/{{ report.ip }}">{{ report.ip }}</a> + <br> + {% endif %} + {% if mod|hasPermission(config.mod.report_dismiss, report.board) or mod|hasPermission(config.mod.report_dismiss_ip, report.board) %} + <hr> + {% if mod|hasPermission(config.mod.report_dismiss, report.board) %} + <a title="{% trans 'Discard abuse report' %}" href="?/reports/{{ report.id }}/dismiss">Dismiss</a> + {% endif %} + {% if mod|hasPermission(config.mod.report_dismiss_ip, report.board) %} + {% if mod|hasPermission(config.mod.report_dismiss, report.board) %} + | + {% endif %} + <a title="{% trans 'Discard all abuse reports by this IP address' %}" href="?/reports/{{ report.id }}/dismissall">Dismiss+</a> + {% endif %} + {% endif %} +</div> + diff --git a/templates/mod/reports.html b/templates/mod/reports.html new file mode 100644 index 00000000..26bceacc --- /dev/null +++ b/templates/mod/reports.html @@ -0,0 +1,6 @@ +{% if reports %} + {{ reports }} +{% else %} + <p style="text-align:center" class="unimportant">({% trans 'There are no reports.' %})</p> +{% endif %} + diff --git a/templates/mod/theme_config.html b/templates/mod/theme_config.html new file mode 100644 index 00000000..2dbb8397 --- /dev/null +++ b/templates/mod/theme_config.html @@ -0,0 +1,27 @@ +<form action="" method="post"> + {% if not config %} + <p style="text-align:center" class="unimportant">(No configuration required.)</p> + {% else %} + <table> + {% for conf in theme.config %} + <tr> + <th>{{ conf.title }}</th> + <td> + <input type="text" name="{{ conf.name }}" + {% if settings[conf.name] %}value="{{ settings[conf.name] }}"{% else %}{% if conf.default %}value="{{ conf.default }}"{% endif %}{% endif %} + {% if conf.size %} + size="{{ conf.size }}" + {% endif %} + /> + {% if conf.comment %} + <span class="unimportant">{{ conf.comment }}</span> + {% endif %} + </td> + </tr> + {% endfor %} + </table> + {% endif %} + <p style="text-align:center"> + <input name="install" type="submit" value="{% trans 'Install theme' %}" /> + </p> +</form> diff --git a/templates/mod/theme_installed.html b/templates/mod/theme_installed.html new file mode 100644 index 00000000..e6beec10 --- /dev/null +++ b/templates/mod/theme_installed.html @@ -0,0 +1,9 @@ +{% if message %} + <div style="border:1px dashed maroon;padding:20px;margin:auto;max-width:800px">{{ message }}</div> +{% endif %} + +{% if result %} + <p style="text-align:center">{% trans 'Successfully installed and built theme.' %}</p> +{% endif %} + +<p style="text-align:center"><a href="?/themes">{% trans 'Go back to themes' %}</a>.</p> diff --git a/templates/mod/theme_rebuilt.html b/templates/mod/theme_rebuilt.html new file mode 100644 index 00000000..b366e7a6 --- /dev/null +++ b/templates/mod/theme_rebuilt.html @@ -0,0 +1,2 @@ +<p style="text-align:center">{{ 'Successfully rebuilt the <strong>%s</strong> theme.'|trans|sprintf(theme_name) }}</p> +<p style="text-align:center"><a href="?/themes">{% trans 'Go back to themes' %}</a>.</p> diff --git a/templates/mod/themes.html b/templates/mod/themes.html new file mode 100644 index 00000000..b596826d --- /dev/null +++ b/templates/mod/themes.html @@ -0,0 +1,40 @@ +{% if themes|count == 0 %} + <p style="text-align:center" class="unimportant">({% trans 'There are no themes available.' %})</p> +{% else %} + <table class="modlog"> + {% for theme_name, theme in themes %} + <tr> + <th class="minimal">{% trans 'Name' %}</th> + <td>{{ theme.name }}</td> + </tr> + <tr> + <th class="minimal">{% trans 'Version' %}</th> + <td>{{ theme.version }}</td> + </tr> + <tr> + <th class="minimal">{% trans 'Description' %}</th> + <td>{{ theme.description }}</td> + </tr> + <tr> + <th class="minimal">{% trans 'Thumbnail' %}</th> + <td> + <img style="float:none;margin:4px{% if theme_name in themes_in_use %};border:2px solid red;padding:4px{% endif %}" src="{{ config.dir.themes_uri }}/{{ theme_name }}/thumb.png" /> + </td> + </tr> + <tr> + <th class="minimal">{% trans 'Actions' %}</th> + <td><ul style="padding:0 20px"> + <li><a title=" {% trans 'Use theme' %}" href="?/themes/{{ theme_name }}"> + {% if theme_name in themes_in_use %}{% trans 'Reconfigure' %}{% else %}{% trans 'Install' %}{% endif %} + </a></li> + {% if theme_name in themes_in_use %} + <li><a href="?/themes/{{ theme_name }}/rebuild">{% trans 'Rebuild' %}</a></li> + <li><a href="?/themes/{{ theme_name }}/uninstall" onclick="return confirm('Are you sure you want to uninstall this theme?');">{% trans 'Uninstall' %}</a></li> + {% endif %} + </ul></td> + </tr> + <tr style="height:40px"><td colspan="2"><hr/></td></tr> + </tr> + {% endfor %} + </table> +{% endif %} diff --git a/templates/mod/user.html b/templates/mod/user.html new file mode 100644 index 00000000..3c4b89cf --- /dev/null +++ b/templates/mod/user.html @@ -0,0 +1,125 @@ +{% if new %} + {% set action = '?/users/new' %} +{% else %} + {% set action = '?/users/' ~ user.id %} +{% endif %} + +<form action="{{ action }}" method="post"> + <table> + <tr> + <th>{% trans 'Username' %}</th> + <td> + {% if new or mod|hasPermission(config.mod.editusers) %} + <input size="20" maxlength="30" type="text" name="username" value="{{ user.username|e }}" autocomplete="off"> + {% else %} + {{ user.username|e }} + {% endif %} + </td> + </tr> + <tr> + <th>{% trans 'Password' %}{% if not new %} <small style="font-weight:normal">({% trans 'new; optional' %})</small>{% endif %}</th> + <td> + {% if new or (mod|hasPermission(config.mod.editusers) or (mod|hasPermission(config.mod.change_password) and user.id == mod.id)) %} + <input size="20" maxlength="30" type="password" name="password" value="" autocomplete="off"> + {% else %} + - + {% endif %} + </td> + </tr> + {% if new %} + <tr> + <th>{% trans 'Class' %}</th> + <td> + <ul style="padding:5px 8px;list-style:none"> + <li> + <input type="radio" name="type" id="janitor" value="{{ constant('JANITOR') }}"> + <label for="janitor">{% trans 'Janitor' %}</label> + </li> + <li> + <input type="radio" name="type" id="mod" value="{{ constant('MOD') }}" checked> + <label for="mod">{% trans 'Mod' %}</label> + </li> + <li> + <input type="radio" name="type" id="admin" value="{{ constant('Admin') }}"> + <label for="admin">{% trans 'Admin' %}</label> + </li> + </ul> + </td> + </tr> + {% endif %} + <tr> + <th>{% trans 'Boards' %}</th> + <td> + <ul style="padding:0 5px;list-style:none"> + <li> + <input type="checkbox" id="allboards" name="allboards" + {% if '*' in user.boards %} checked{% endif %} + {% if not mod|hasPermission(config.mod.editusers) %} + disabled + {% endif %} + > + <label for="allboards">"*" - {% trans 'All boards' %}</label> + </li> + {% for board in boards %} + <li> + <input type="checkbox" id="board_{{ board.uri }}" name="board_{{ board.uri }}" + {% if board.uri in user.boards %} checked{% endif %} + {% if not mod|hasPermission(config.mod.editusers) %} + disabled + {% endif %} + > + <label for="board_{{ board.uri }}"> + {{ config.board_abbreviation|sprintf(board.uri) }} + - + {{ board.title|e }} + </label> + </li> + {% endfor %} + </ul> + </td> + </tr> + </table> + + <ul style="padding:0;text-align:center;list-style:none"> + {% if new %} + <li><input type="submit" value="{% trans 'Create user' %}"></li> + {% else %} + <li><input type="submit" value="{% trans 'Save changes' %}"></li> + {% if mod|hasPermission(config.mod.deleteusers) %} + <li><input name="delete" onclick="return confirm('Are you sure you want to permanently delete this user?');" type="submit" value="{% trans 'Delete user' %}"></li> + {% endif %} + {% endif %} + </ul> +</form> + +{% if logs|count > 0 %} + <table class="modlog" style="width:600px"> + <tr> + <th>{% trans 'IP address' %}</th> + <th>{% trans 'Time' %}</th> + <th>{% trans 'Board' %}</th> + <th>{% trans 'Action' %}</th> + </tr> + {% for log in logs %} + <tr> + <td class="minimal"> + <a href="?/IP/{{ log.ip }}">{{ log.ip }}</a> + </td> + <td class="minimal"> + <span title="{{ log.time|date(config.post_date) }}">{{ log.time|ago }}</span> + </td> + <td class="minimal"> + {% if log.board %} + <a href="?/{{ config.board_path|sprintf(log.board) }}{{ config.file_index }}">{{ config.board_abbreviation|sprintf(log.board) }}</a> + {% else %} + - + {% endif %} + </td> + <td> + {{ log.text }} + </td> + </tr> + {% endfor %} + </table> +{% endif %} + diff --git a/templates/mod/users.html b/templates/mod/users.html new file mode 100644 index 00000000..6ea6248f --- /dev/null +++ b/templates/mod/users.html @@ -0,0 +1,71 @@ +<table class="modlog" style="width:auto"> + <tr> + <th>{% trans 'ID' %}</th> + <th>{% trans 'Username' %}</th> + <th>{% trans 'Type' %}</th> + <th>{% trans 'Boards' %}</th> + {% if mod|hasPermission(config.mod.modlog) %} + <th>{% trans 'Last action' %}</th> + {% endif %} + <th>…</th> + </tr> + + {% for user in users %} + <tr> + <td><small>{{ user.id }}</small></td> + <td>{{ user.username|e }}</td> + <td> + {% if user.type == constant('JANITOR') %}{% trans 'Janitor' %} + {% elseif user.type == constant('MOD') %}{% trans 'Mod' %} + {% elseif user.type == constant('ADMIN') %}{% trans 'Admin' %} + {% endif %} + </td> + <td> + {% if user.boards == '' %} + <em>{% trans 'none' %}</em> + {% elseif user.boards == '*' %} + <em>{% trans 'all boards' %}</em> + {% else %} + {# This is really messy, but IMO it beats doing it in PHP. #} + {% set boards = user.boards|split(',') %} + {% set _boards = [] %} + {% for board in boards %} + {% set _boards = _boards|push(board == '*' ? '*' : config.board_abbreviation|sprintf(board)) %} + {% endfor %} + {% set _boards = _boards|sort %} + {{ _boards|join(', ') }} + {% endif %} + </td> + {% if mod|hasPermission(config.mod.modlog) %} + <td> + {% if user.last %} + <span title="{{ user.action|e }}">{{ user.last|ago }}</span> + {% else %} + <em>{% trans 'never' %}</em> + {% endif %} + </td> + {% endif %} + <td> + {% if mod|hasPermission(config.mod.promoteusers) and user.type < constant('ADMIN') %} + <a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/promote" title="{% trans 'Promote' %}">▲</a> + {% endif %} + {% if mod|hasPermission(config.mod.promoteusers) and user.type > constant('JANITOR') %} + <a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/demote" title="{% trans 'Demote' %}">▼</a> + {% endif %} + {% if mod|hasPermission(config.mod.editusers) or (mod|hasPermission(config.mod.change_password) and mod.id == user.id) %} + <a class="unimportant" style="margin-left:5px;float:right" href="?/users/{{ user.id }}">[{% trans 'edit' %}]</a> + {% endif %} + {% if mod|hasPermission(config.mod.create_pm) %} + <a class="unimportant" style="margin-left:5px;float:right" href="?/new_PM/{{ user.username|e }}">[{% trans 'PM' %}]</a> + {% endif %} + </td> + </tr> + {% endfor %} +</table> + +{% if mod|hasPermission(config.mod.createusers) %} + <p style="text-align:center"> + <a href="?/users/new">Create a new user</a> + </p> +{% endif %} + diff --git a/templates/mod/view_ip.html b/templates/mod/view_ip.html new file mode 100644 index 00000000..c49880ae --- /dev/null +++ b/templates/mod/view_ip.html @@ -0,0 +1,163 @@ +{% for board_posts in posts %} + <fieldset> + <legend> + <a href="?/{{ config.board_path|sprintf(board_posts.board.uri) }}{{ config.file_index }}"> + {{ config.board_abbreviation|sprintf(board_posts.board.uri) }} + - + {{ board_posts.board.title|e }} + </a> + </legend> + {{ board_posts.posts|join('<hr>') }} + </fieldset> +{% endfor %} + +{% if mod|hasPermission(config.mod.view_notes) %} + <fieldset id="notes"> + <legend> + {% set notes_on_record = 'note' ~ (notes|count != 1 ? 's' : '') ~ ' on record' %} + <legend>{{ notes|count }} {% trans notes_on_record %}</legend> + </legend> + + {% if notes|count > 0 %} + <table class="modlog"> + <tr> + <th>{% trans 'Staff' %}</th> + <th>{% trans 'Note' %}</th> + <th>{% trans 'Date' %}</th> + {% if mod|hasPermission(config.mod.remove_notes) %} + <th>{% trans 'Actions' %}</th> + {% endif %} + </tr> + {% for note in notes %} + <tr> + <td class="minimal"> + {% if note.username %} + <a href="?/new_PM/{{ note.username|e }}">{{ note.username|e }}</a> + {% else %} + <em>{% trans 'deleted?' %}</em> + {% endif %} + </td> + <td> + {{ note.body }} + </td> + <td class="minimal"> + {{ note.time|date(config.post_date) }} + </td> + {% if mod|hasPermission(config.mod.remove_notes) %} + <td class="minimal"> + <a href="?/IP/{{ ip }}/remove_note/{{ note.id }}"> + <small>[{% trans 'remove' %}]</small> + </a> + </td> + {% endif %} + </tr> + {% endfor %} + </table> + {% endif %} + + {% if mod|hasPermission(config.mod.create_notes) %} + <form action="" method="post" style="margin:0"> + <table> + <tr> + <th>{% trans 'Staff' %}</th> + <td>{{ mod.username|e }}</td> + </tr> + <tr> + <th> + <label for="note">{% trans 'Note' %}</label> + </th> + <td> + <textarea id="note" name="note" rows="5" cols="30"></textarea> + </td> + </tr> + <tr> + <td></td> + <td><input type="submit" value="{% trans 'New note' %}"></td> + </tr> + </table> + </form> + {% endif %} + </fieldset> +{% endif %} + +{% if bans|count > 0 and mod|hasPermission(config.mod.view_ban) %} + <fieldset id="bans"> + {% set bans_on_record = 'ban' ~ (bans|count != 1 ? 's' : '') ~ ' on record' %} + <legend>{{ bans|count }} {% trans bans_on_record %}</legend> + + {% for ban in bans %} + <form action="" method="post" style="text-align:center"> + <table style="width:400px;margin-bottom:10px;border-bottom:1px solid #ddd;padding:5px"> + <tr> + <th>{% trans 'Status' %}</th> + <td> + {% if config.mod.view_banexpired and ban.expires != 0 and ban.expires < time() %} + {% trans 'Expired' %} + {% else %} + {% trans 'Active' %} + {% endif %} + </td> + </tr> + <tr> + <th>{% trans 'IP' %}</th> + <td>{{ ban.ip }}</td> + </tr> + <tr> + <th>{% trans 'Reason' %}</th> + <td> + {% if ban.reason %} + {{ ban.reason }} + {% else %} + <em>{% trans 'no reason' %}</em> + {% endif %} + </td> + </tr> + <tr> + <th>{% trans 'Board' %}</th> + <td> + {% if ban.board %} + {{ config.board_abbreviation|sprintf(ban.board) }} + {% else %} + <em>{% trans 'all boards' %}</em> + {% endif %} + </td> + </tr> + <tr> + <th>{% trans 'Set' %}</th> + <td>{{ ban.set|date(config.post_date) }}</td> + </tr> + <tr> + <th>{% trans 'Expires' %}</th> + <td> + {% if ban.expires %} + {{ ban.expires|date(config.post_date) }} + {% else %} + <em>{% trans 'never' %}</em> + {% endif %} + </td> + </tr> + <tr> + <th>{% trans 'Staff' %}</th> + <td> + {% if ban.username %} + {{ ban.username|e }} + {% else %} + <em>{% trans 'deleted?' %}</em> + {% endif %} + </td> + </tr> + </table> + <input type="hidden" name="ban_id" value="{{ ban.id }}"> + <input type="submit" name="unban" value="{% trans 'Remove ban' %}"> + </form> + {% endfor %} + </fieldset> +{% endif %} + +{% if mod|hasPermission(config.mod.ban) %} + <fieldset> + <legend>{% trans 'New ban' %}</legend> + {% set redirect = '?/IP/' ~ ip ~ '#bans' %} + {% include 'mod/ban_form.html' %} + </fieldset> +{% endif %} diff --git a/templates/page.html b/templates/page.html index 0b15d815..0f59e6b1 100644 --- a/templates/page.html +++ b/templates/page.html @@ -1,11 +1,11 @@ <!doctype html>
<html>
<head>
+ <meta charset="utf-8">
<link rel="stylesheet" media="screen" href="{{ config.url_stylesheet }}">
{% if config.url_favicon %}<link rel="shortcut icon" href="{{ config.url_favicon }}">{% endif %}
<title>{{ title }}</title>
- <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
- <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=yes">
+ <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">
{% if config.default_stylesheet.1 != '' %}<link rel="stylesheet" type="text/css" id="stylesheet" href="{{ config.uri_stylesheets }}{{ config.default_stylesheet.1 }}">{% endif %}
{% if not nojavascript %}<script type="text/javascript" src="{{ config.url_javascript }}"></script>{% endif %}
</head>
@@ -17,7 +17,7 @@ {% if subtitle %}
{{ subtitle }}
{% endif %}
- {% if mod %}<p><a href="?/">{% trans %}Return to dashboard{% endtrans %}</a></p>{% endif %}
+ {% if mod and not hide_dashboard_link %}<p><a href="?/">{% trans %}Return to dashboard{% endtrans %}</a></p>{% endif %}
</div>
</header>
{{ body }}
diff --git a/templates/themes/basic/info.php b/templates/themes/basic/info.php index b782a6d4..0b8ba98b 100644 --- a/templates/themes/basic/info.php +++ b/templates/themes/basic/info.php @@ -44,9 +44,9 @@ $theme['build_function'] = 'basic_build'; $theme['install_callback'] = 'build_install'; - if(!function_exists('build_install')) { + if (!function_exists('build_install')) { function build_install($settings) { - if(!is_numeric($settings['no_recent']) || $settings['no_recent'] < 0) + if (!is_numeric($settings['no_recent']) || $settings['no_recent'] < 0) return Array(false, '<strong>' . utf8tohtml($settings['no_recent']) . '</strong> is not a non-negative integer.'); } } diff --git a/templates/themes/basic/theme.php b/templates/themes/basic/theme.php index a07dc7ec..806a331a 100644 --- a/templates/themes/basic/theme.php +++ b/templates/themes/basic/theme.php @@ -15,7 +15,7 @@ public static function build($action, $settings) { global $config; - if($action == 'all' || $action == 'news') + if ($action == 'all' || $action == 'news') file_write($config['dir']['home'] . $settings['file'], Basic::homepage($settings)); } diff --git a/templates/themes/categories/info.php b/templates/themes/categories/info.php index 5ae3d296..62d8f6bb 100644 --- a/templates/themes/categories/info.php +++ b/templates/themes/categories/info.php @@ -54,11 +54,11 @@ Requires $config[\'categories\'].'; $theme['build_function'] = 'categories_build'; $theme['install_callback'] = 'categories_install'; - if(!function_exists('categories_install')) { + if (!function_exists('categories_install')) { function categories_install($settings) { global $config; - if(!isset($config['categories'])) { + if (!isset($config['categories'])) { return Array(false, '<h2>Prerequisites not met!</h2>' . 'This theme requires $config[\'boards\'] and $config[\'categories\'] to be set.'); } diff --git a/templates/themes/categories/sidebar.html b/templates/themes/categories/sidebar.html index a4bc28ae..856930ab 100644 --- a/templates/themes/categories/sidebar.html +++ b/templates/themes/categories/sidebar.html @@ -31,7 +31,7 @@ </legend> {% for board in boards %} <li> - <a href="{{ board.uri }}">{{ board.title }}</a> + <a href="{{ board.uri }}">{{ board.title|e }}</a> </li> {% endfor %} </fieldset> diff --git a/templates/themes/categories/theme.php b/templates/themes/categories/theme.php index 648034e7..11fcbbaf 100644 --- a/templates/themes/categories/theme.php +++ b/templates/themes/categories/theme.php @@ -15,13 +15,13 @@ public static function build($action, $settings) { global $config; - if($action == 'all') + if ($action == 'all') file_write($config['dir']['home'] . $settings['file_main'], Categories::homepage($settings)); - if($action == 'all' || $action == 'boards') + if ($action == 'all' || $action == 'boards') file_write($config['dir']['home'] . $settings['file_sidebar'], Categories::sidebar($settings)); - if($action == 'all' || $action == 'news') + if ($action == 'all' || $action == 'news') file_write($config['dir']['home'] . $settings['file_news'], Categories::news($settings)); } @@ -52,10 +52,10 @@ $categories = $config['categories']; - foreach($categories as &$boards) { - foreach($boards as &$board) { + foreach ($categories as &$boards) { + foreach ($boards as &$board) { $title = boardTitle($board); - if(!$title) + if (!$title) $title = $board; // board doesn't exist, but for some reason you want to display it anyway $board = Array('title' => $title, 'uri' => sprintf($config['board_path'], $board)); } diff --git a/templates/themes/frameset/sidebar.html b/templates/themes/frameset/sidebar.html index 457ecec8..40e2d719 100644 --- a/templates/themes/frameset/sidebar.html +++ b/templates/themes/frameset/sidebar.html @@ -30,7 +30,7 @@ {% for board in boards %} <li> <a href="{{ config.board_path|sprintf(board.uri) }}"> - {{ board.title }} + {{ board.title|e }} </a> </li> {% endfor %} diff --git a/templates/themes/frameset/theme.php b/templates/themes/frameset/theme.php index f3e1b139..015eebaf 100644 --- a/templates/themes/frameset/theme.php +++ b/templates/themes/frameset/theme.php @@ -15,13 +15,13 @@ public static function build($action, $settings) { global $config; - if($action == 'all') + if ($action == 'all') file_write($config['dir']['home'] . $settings['file_main'], Frameset::homepage($settings)); - if($action == 'all' || $action == 'boards') + if ($action == 'all' || $action == 'boards') file_write($config['dir']['home'] . $settings['file_sidebar'], Frameset::sidebar($settings)); - if($action == 'all' || $action == 'news') + if ($action == 'all' || $action == 'news') file_write($config['dir']['home'] . $settings['file_news'], Frameset::news($settings)); } diff --git a/templates/themes/recent/info.php b/templates/themes/recent/info.php index 83d7477a..d4cf1029 100644 --- a/templates/themes/recent/info.php +++ b/templates/themes/recent/info.php @@ -60,11 +60,11 @@ $theme['build_function'] = 'recentposts_build'; $theme['install_callback'] = 'recentposts_install'; - if(!function_exists('recentposts_install')) { + if (!function_exists('recentposts_install')) { function recentposts_install($settings) { - if(!is_numeric($settings['limit_images']) || $settings['limit_images'] < 0) + if (!is_numeric($settings['limit_images']) || $settings['limit_images'] < 0) return Array(false, '<strong>' . utf8tohtml($settings['limit_images']) . '</strong> is not a non-negative integer.'); - if(!is_numeric($settings['limit_posts']) || $settings['limit_posts'] < 0) + if (!is_numeric($settings['limit_posts']) || $settings['limit_posts'] < 0) return Array(false, '<strong>' . utf8tohtml($settings['limit_posts']) . '</strong> is not a non-negative integer.'); } } diff --git a/templates/themes/recent/theme.php b/templates/themes/recent/theme.php index 13a5546f..986fac6a 100644 --- a/templates/themes/recent/theme.php +++ b/templates/themes/recent/theme.php @@ -17,13 +17,13 @@ public function build($action, $settings) { global $config, $_theme; - if($action == 'all') { + if ($action == 'all') { copy('templates/themes/recent/recent.css', $config['dir']['home'] . $settings['css']); } $this->excluded = explode(' ', $settings['exclude']); - if($action == 'all' || $action == 'post') + if ($action == 'all' || $action == 'post') file_write($config['dir']['home'] . $settings['html'], $this->homepage($settings)); } @@ -38,15 +38,15 @@ $boards = listBoards(); $query = ''; - foreach($boards as &$_board) { - if(in_array($_board['uri'], $this->excluded)) + foreach ($boards as &$_board) { + if (in_array($_board['uri'], $this->excluded)) continue; $query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` WHERE `file` IS NOT NULL AND `file` != 'deleted' AND `thumb` != 'spoiler' UNION ALL ", $_board['uri'], $_board['uri']); } $query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_images'], $query); $query = query($query) or error(db_error()); - while($post = $query->fetch()) { + while ($post = $query->fetch()) { openBoard($post['board']); // board settings won't be available in the template file, so generate links now @@ -58,15 +58,15 @@ $query = ''; - foreach($boards as &$_board) { - if(in_array($_board['uri'], $this->excluded)) + foreach ($boards as &$_board) { + if (in_array($_board['uri'], $this->excluded)) continue; $query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` UNION ALL ", $_board['uri'], $_board['uri']); } $query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_posts'], $query); $query = query($query) or error(db_error()); - while($post = $query->fetch()) { + while ($post = $query->fetch()) { openBoard($post['board']); $post['link'] = $config['root'] . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], ($post['thread'] ? $post['thread'] : $post['id'])) . '#' . $post['id']; @@ -78,8 +78,8 @@ // Total posts $query = 'SELECT SUM(`top`) AS `count` FROM ('; - foreach($boards as &$_board) { - if(in_array($_board['uri'], $this->excluded)) + foreach ($boards as &$_board) { + if (in_array($_board['uri'], $this->excluded)) continue; $query .= sprintf("SELECT MAX(`id`) AS `top` FROM `posts_%s` UNION ALL ", $_board['uri']); } @@ -90,8 +90,8 @@ // Unique IPs $query = 'SELECT COUNT(DISTINCT(`ip`)) AS `count` FROM ('; - foreach($boards as &$_board) { - if(in_array($_board['uri'], $this->excluded)) + foreach ($boards as &$_board) { + if (in_array($_board['uri'], $this->excluded)) continue; $query .= sprintf("SELECT `ip` FROM `posts_%s` UNION ALL ", $_board['uri']); } @@ -102,8 +102,8 @@ // Active content $query = 'SELECT SUM(`filesize`) AS `count` FROM ('; - foreach($boards as &$_board) { - if(in_array($_board['uri'], $this->excluded)) + foreach ($boards as &$_board) { + if (in_array($_board['uri'], $this->excluded)) continue; $query .= sprintf("SELECT `filesize` FROM `posts_%s` UNION ALL ", $_board['uri']); } diff --git a/templates/themes/rrdtool/info.php b/templates/themes/rrdtool/info.php index 73658a22..46a20587 100644 --- a/templates/themes/rrdtool/info.php +++ b/templates/themes/rrdtool/info.php @@ -28,7 +28,7 @@ $__boards = listBoards(); $__default_boards = Array(); - foreach($__boards as $__board) + foreach ($__boards as $__board) $__default_boards[] = $__board['uri']; $theme['config'][] = Array( @@ -83,31 +83,31 @@ ); $theme['install_callback'] = 'rrdtool_install'; - if(!function_exists('rrdtool_install')) { + if (!function_exists('rrdtool_install')) { function rrdtool_install($settings) { global $config; - if(!is_numeric($settings['interval']) || $settings['interval'] < 1 || $settings['interval'] > 86400) + if (!is_numeric($settings['interval']) || $settings['interval'] < 1 || $settings['interval'] > 86400) return Array(false, 'Invalid interval: <strong>' . $settings['interval'] . '</strong>. Must be an integer greater than 1 and less than 86400.'); - if(!is_numeric($settings['width']) || $settings['width'] < 1) + if (!is_numeric($settings['width']) || $settings['width'] < 1) return Array(false, 'Invalid width: <strong>' . $settings['width'] . '</strong>!'); - if(!is_numeric($settings['height']) || $settings['height'] < 1) + if (!is_numeric($settings['height']) || $settings['height'] < 1) return Array(false, 'Invalid height: <strong>' . $settings['height'] . '</strong>!'); - if(!in_array($settings['rate'], Array('second', 'minute', 'day', 'hour', 'week', 'month', 'year'))) + if (!in_array($settings['rate'], Array('second', 'minute', 'day', 'hour', 'week', 'month', 'year'))) return Array(false, 'Invalid rate: <strong>' . $settings['rate'] . '</strong>!'); $job = '*/' . $settings['interval'] . ' * * * * php -q ' . str_replace('\\', '/', dirname(__FILE__)) . '/cron.php' . PHP_EOL; - if(function_exists('system')) { + if (function_exists('system')) { $crontab = tempnam($config['tmp'], 'tinyboard-rrdtool'); file_write($crontab, $job); @system('crontab ' . escapeshellarg($crontab), $ret); unlink($crontab); - if($ret === 0) + if ($ret === 0) return ''; // it seems to install okay? } diff --git a/templates/themes/rrdtool/theme.php b/templates/themes/rrdtool/theme.php index 20a00e76..eed2ac9a 100644 --- a/templates/themes/rrdtool/theme.php +++ b/templates/themes/rrdtool/theme.php @@ -17,7 +17,7 @@ public function build($action, $settings) { global $config, $_theme, $argv; - if(!$settings) { + if (!$settings) { error('This theme is not currently installed.'); } @@ -26,18 +26,18 @@ // exclude boards from the "combined" graph $this->combined_exclude = Array(); - if($action == 'cron') { - if(!file_exists($settings['path'])) + if ($action == 'cron') { + if (!file_exists($settings['path'])) mkdir($settings['path']); - if(!file_exists($settings['images'])) + if (!file_exists($settings['images'])) mkdir($settings['images']); - foreach($this->boards as &$board) { + foreach ($this->boards as &$board) { $file = $settings['path'] . '/' . $board . '.rrd'; - if(!file_exists($file)) { + if (!file_exists($file)) { // Create graph - if(!rrd_create($file, Array( + if (!rrd_create($file, Array( '-s 60', 'DS:posts:COUNTER:86400:0:10000', @@ -59,22 +59,22 @@ } // debug just the graphing (not updating) with the --debug switch - if(!isset($argv[1]) || $argv[1] != '--debug') { + if (!isset($argv[1]) || $argv[1] != '--debug') { // Update graph $query = query(sprintf("SELECT MAX(`id`) AS `count` FROM `posts_%s`", $board)); $count = $query->fetch(); $count = $count['count']; - if(!rrd_update($file, Array( + if (!rrd_update($file, Array( '-t', 'posts', 'N:' . $count))) error('RRDtool failed: ' . htmlentities(rrd_error())); } - foreach($this->spans as &$span) { + foreach ($this->spans as &$span) { // Graph graph - if(!rrd_graph($settings['images'] . '/' . $board . '-' . $span . '.png', Array( + if (!rrd_graph($settings['images'] . '/' . $board . '-' . $span . '.png', Array( '-s -1' . $span, '-t Posts on ' . sprintf($config['board_abbreviation'], $board) .' this ' . $span, '--lazy', @@ -105,7 +105,7 @@ } // combined graph - foreach($this->spans as &$span) { + foreach ($this->spans as &$span) { $options = Array( '-s -1' . $span, '-t Posts this ' . $span, @@ -129,8 +129,8 @@ $c = 1; $cc = 0; $red = 2; - foreach($this->boards as &$board) { - if(in_array($board, $this->combined_exclude)) + foreach ($this->boards as &$board) { + if (in_array($board, $this->combined_exclude)) continue; $color = str_pad(dechex($red*85), 2, '0', STR_PAD_LEFT) . str_pad(dechex($green*85), 2, '0', STR_PAD_LEFT) . @@ -147,31 +147,35 @@ sprintf($config['board_abbreviation'], $board); // Randomize colors using this horrible undocumented algorithm I threw together while debugging - if($c == 0) + if ($c == 0) $red++; - elseif($c == 1) + elseif ($c == 1) $green++; - elseif($c == 2) + elseif ($c == 2) $blue++; - elseif($c == 3) + elseif ($c == 3) $green--; - elseif($c == 4) + elseif ($c == 4) $red--; $cc++; - if($cc > 2) { + if ($cc > 2) { $c++; $cc = 0; } - if($c>4) $c = 0; + if ($c > 4) + $c = 0; - if($red>3) $red = 0; - if($green>3) $green = 0; - if($blue>3) $blue = 0; + if ($red > 3) + $red = 0; + if ($green > 3) + $green = 0; + if ($blue > 3) + $blue = 0; } $options[] = 'HRULE:0#000000'; - if(!rrd_graph($settings['images'] . '/combined-' . $span . '.png', $options)) + if (!rrd_graph($settings['images'] . '/combined-' . $span . '.png', $options)) error('RRDtool failed: ' . htmlentities(rrd_error())); } } diff --git a/templates/thread.html b/templates/thread.html index ac6bc609..e7c65f9b 100644 --- a/templates/thread.html +++ b/templates/thread.html @@ -1,11 +1,11 @@ <!doctype html>
<html>
<head>
+ <meta charset="utf-8">
<link rel="stylesheet" media="screen" href="{{ config.url_stylesheet }}">
{% if config.url_favicon %}<link rel="shortcut icon" href="{{ config.url_favicon }}">{% endif %}
<title>{{ board.url }} - {{ board.name }}</title>
- <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
- <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=yes">
+ <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">
{% if config.meta_keywords %}<meta name="keywords" content="{{ config.meta_keywords }}">{% endif %}
{% if config.default_stylesheet.1 != '' %}<link rel="stylesheet" type="text/css" id="stylesheet" href="{{ config.uri_stylesheets }}{{ config.default_stylesheet.1 }}">{% endif %}
{% if not nojavascript %}
@@ -29,17 +29,16 @@ display: block;
}
{% endraw %}</style>{% endif %}
-
</head>
<body>
{{ boardlist.top }}
{% if pm %}<div class="top_notice">You have <a href="?/PM/{{ pm.id }}">an unread PM</a>{% if pm.waiting > 0 %}, plus {{ pm.waiting }} more waiting{% endif %}.</div><hr />{% endif %}
{% if config.url_banner %}<img class="banner" src="{{ config.url_banner }}" {% if config.banner_width or config.banner_height %}style="{% if config.banner_width %}width:{{ config.banner_width }}px{% endif %};{% if config.banner_width %}height:{{ config.banner_height }}px{% endif %}" {% endif %}alt="" />{% endif %}
<header>
- <h1>{{ board.url }} - {{ board.name }}</h1>
+ <h1>{{ board.url }} - {{ board.title|e }}</h1>
<div class="subtitle">
- {% if board.title %}
- {{ board.title }}
+ {% if board.subtitle %}
+ {{ board.subtitle|e }}
{% endif %}
{% if mod %}<p><a href="?/">{% trans %}Return to dashboard{% endtrans %}</a></p>{% endif %}
</div>
|