diff options
Diffstat (limited to 'post.php')
| -rw-r--r-- | post.php | 365 |
1 files changed, 181 insertions, 184 deletions
@@ -1,11 +1,12 @@ -<?php +<?php require 'inc/functions.php'; require 'inc/display.php'; + require 'inc/config.php'; if (file_exists('inc/instance-config.php')) { require 'inc/instance-config.php'; } - require 'inc/config.php'; require 'inc/template.php'; + require 'inc/database.php'; require 'inc/user.php'; // Fix for magic quotes @@ -19,14 +20,77 @@ $_POST = strip_array($_POST); } - if(isset($_POST['post'])) { + if(isset($_POST['delete'])) { + // Delete + + if( !isset($_POST['board']) || + !isset($_POST['password']) + ) + error($config['error']['bot']); + + $password = $_POST['password']; + + if(empty($password)) + error($config['error']['invalidpassword']); + + $delete = Array(); + foreach($_POST as $post => $value) { + if(preg_match('/^delete_(\d+)$/', $post, $m)) { + $delete[] = (int)$m[1]; + } + } + + sql_open(); + + // Check if banned + checkBan(); + + if($config['block_tor'] && isTor()) + error($config['error']['tor']); + + // Check if board exists + if(!openBoard($_POST['board'])) + error($config['error']['noboard']); + + if(empty($delete)) + error($config['error']['nodelete']); + + foreach($delete as &$id) { + $query = prepare(sprintf("SELECT `password` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $id, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($post = $query->fetch()) { + if(!empty($password) && $post['password'] != $password) + error($config['error']['invalidpassword']); + + if(isset($_POST['file'])) { + // Delete just the file + deleteFile($id); + } else { + // Delete entire post + deletePost($id); + } + } + } + + buildIndex(); + + sql_close(); + + $is_mod = isset($_POST['mod']) && $_POST['mod']; + $root = $is_mod ? $config['root'] . $config['file_mod'] . '?/' : $config['root']; + + header('Location: ' . $root . $board['dir'] . $config['file_index'], true, $config['redirect_http']); + + } elseif(isset($_POST['post'])) { if( !isset($_POST['name']) || !isset($_POST['email']) || !isset($_POST['subject']) || !isset($_POST['body']) || !isset($_POST['board']) || !isset($_POST['password']) - ) error(ERROR_BOT); + ) error($config['error']['bot']); $post = Array('board' => $_POST['board']); @@ -35,13 +99,13 @@ $post['thread'] = round($_POST['thread']); } else $OP = true; - if(!(($OP && $_POST['post'] == BUTTON_NEWTOPIC) || - (!$OP && $_POST['post'] == BUTTON_REPLY))) - error(ERROR_BOT); + if(!(($OP && $_POST['post'] == $config['button_newtopic']) || + (!$OP && $_POST['post'] == $config['button_reply']))) + error($config['error']['bot']); // Check the referrer if($OP) { - if(!isset($_SERVER['HTTP_REFERER']) || !preg_match(URL_MATCH, $_SERVER['HTTP_REFERER'])) error(ERROR_BOT); + if(!isset($_SERVER['HTTP_REFERER']) || !preg_match($config['url_match'], $_SERVER['HTTP_REFERER'])) error($config['error']['bot']); } // TODO: Since we're now using static HTML files, we can't give them cookies on their first page view @@ -49,7 +113,7 @@ /* // Check if he has a valid cookie. - if(!$user['valid']) error(ERROR_BOT); + if(!$user['valid']) error($config['error']['bot']); // Check how long he has been here. if(time()-$user['appeared']<LURKTIME) error(ERROR_LURK); @@ -58,18 +122,28 @@ // Open database connection sql_open(); + // Check if banned + checkBan(); + + if($config['block_tor'] && isTor()) + error($config['error']['tor']); + // Check if board exists if(!openBoard($post['board'])) - error(ERROR_NOBOARD); + error($config['error']['noboard']); + + //if(ROBOT_ENABLE && $board['uri'] == ROBOT_BOARD && ROBOT_MUTE) { + // checkMute(); + //} //Check if thread exists if(!$OP && !threadExists($post['thread'])) - error(ERROR_NONEXISTANT); - + error($config['error']['nonexistant']); + // Check for a file if($OP) { if(!isset($_FILES['file']['tmp_name']) || empty($_FILES['file']['tmp_name'])) - error(ERROR_NOIMAGE); + error($config['error']['noimage']); } $post['name'] = (!empty($_POST['name'])?$_POST['name']:'Anonymous'); @@ -77,16 +151,52 @@ $post['email'] = utf8tohtml($_POST['email']); $post['body'] = $_POST['body']; $post['password'] = $_POST['password']; - $post['filename'] = $_FILES['file']['name']; + $post['filename'] = get_magic_quotes_gpc() ? stripslashes($_FILES['file']['name']) : $_FILES['file']['name']; $post['has_file'] = $OP || !empty($_FILES['file']['tmp_name']); + $post['mod'] = isset($_POST['mod']) && $_POST['mod']; + + if(empty($post['body']) && $config['force_body']) + error($config['error']['tooshortbody']); + + if($post['mod']) { + require 'inc/mod.php'; + if(!$mod) { + // Liar. You're not a mod. + error($config['error']['notamod']); + } + + $post['sticky'] = $OP && isset($_POST['sticky']); + $post['locked'] = $OP && isset($_POST['lock']); + $post['raw'] = isset($_POST['raw']); + + if($post['sticky'] && $mod['type'] < $config['mod']['sticky']) error($config['error']['noaccess']); + if($post['locked'] && $mod['type'] < $config['mod']['lock']) error($config['error']['noaccess']); + if($post['raw'] && $mod['type'] < $config['mod']['rawhtml']) error($config['error']['noaccess']); + } + + // Check if thread is locked + // but allow mods to post + if(!$OP && (!$mod || $mod['type'] < $config['mod']['postinlocked'])) { + if(threadLocked($post['thread'])) + error($config['error']['locked']); + } if($post['has_file']) { $size = $_FILES['file']['size']; - if($size > MAX_FILESIZE) - error(sprintf3(ERR_FILESIZE, array( + if($size > $config['max_filesize']) + error(sprintf3($config['error']['filesize'], array( 'sz'=>commaize($size), 'filesz'=>commaize($size), - 'maxsz'=>commaize(MAX_FILESIZE)))); + 'maxsz'=>commaize($config['max_filesize'])))); + } + + if($mod && $mod['type'] >= MOD && preg_match('/^((.+) )?## (.+)$/', $post['name'], $match)) { + if(($mod['type'] == MOD && $match[3] == 'Mod') || $mod['type'] >= ADMIN) { + $post['mod_tag'] = $match[3]; + $post['name'] = !empty($match[2])?$match[2]:'Anonymous'; + } + } else { + $post['mod_tag'] = false; } $trip = generate_tripcode($post['name']); @@ -100,40 +210,37 @@ if($post['has_file']) { $post['extension'] = strtolower(substr($post['filename'], strrpos($post['filename'], '.') + 1)); - $post['file_id'] = rand(0, 1000000000); - $post['file'] = $board['dir'] . DIR_IMG . $post['file_id'] . '.' . $post['extension']; - $post['thumb'] = $board['dir'] . DIR_THUMB . $post['file_id'] . '.png'; - $post['zip'] = $OP && $post['has_file'] && ALLOW_ZIP && $post['extension'] == 'zip' ? $post['file'] : false; - if(!($post['zip'] || in_array($post['extension'], $allowed_ext))) error(ERROR_FILEEXT); + $post['file_id'] = time() . rand(100, 999); + $post['file'] = $board['dir'] . $config['dir']['img'] . $post['file_id'] . '.' . $post['extension']; + $post['thumb'] = $board['dir'] . $config['dir']['thumb'] . $post['file_id'] . '.png'; } // Check string lengths - if(strlen($post['name']) > 25) error(sprintf(ERROR_TOOLONG, 'name')); - if(strlen($post['email']) > 30) error(sprintf(ERROR_TOOLONG, 'email')); - if(strlen($post['subject']) > 40) error(sprintf(ERROR_TOOLONG, 'subject')); - if(strlen($post['body']) > MAX_BODY) error(ERROR_TOOLONGBODY); - if(!(!$OP && $post['has_file']) && strlen($post['body']) < 1) error(ERROR_TOOSHORTBODY); - if(strlen($post['password']) > 20) error(sprintf(ERROR_TOOLONG, 'password')); + if(strlen($post['name']) > 50) error(sprintf($config['error']['toolong'], 'name')); + if(strlen($post['email']) > 30) error(sprintf($config['error']['toolong'], 'email')); + if(strlen($post['subject']) > 40) error(sprintf($config['error']['toolong'], 'subject')); + if(!$mod && strlen($post['body']) > $config['max_body']) error($config['error']['toolongbody']); + if(!(!$OP && $post['has_file']) && strlen($post['body']) < 1) error($config['error']['tooshortbody']); + if(strlen($post['password']) > 20) error(sprintf($config['error']['toolong'], 'password')); + + if($post['mod_tag']) + $post['trip'] .= ' <a class="nametag">## ' . $post['mod_tag'] . '</a>'; + + $post['body_nomarkup'] = $post['body']; - markup($post['body']); + if(!($mod && $post['raw'])) + markup($post['body']); + + // Check for a flood + if(checkFlood($post)) { + error($config['error']['flood']); + } if($post['has_file']) { // Just trim the filename if it's too long if(strlen($post['filename']) > 30) $post['filename'] = substr($post['filename'], 0, 27).'…'; // Move the uploaded file - if(!@move_uploaded_file($_FILES['file']['tmp_name'], $post['file'])) error(ERROR_NOMOVE); - - if($post['zip']) { - // Validate ZIP file - if(is_resource($zip = zip_open($post['zip']))) - // TODO: Check if it's not empty and has at least one (valid) image - zip_close($zip); - else - error(ERR_INVALIDZIP); - - $post['file'] = ZIP_IMAGE; - $post['extension'] = strtolower(substr($post['file'], strrpos($post['file'], '.') + 1)); - } + if(!@move_uploaded_file($_FILES['file']['tmp_name'], $post['file'])) error($config['error']['nomove']); $size = @getimagesize($post['file']); $post['width'] = $size[0]; @@ -142,189 +249,79 @@ // Check if the image is valid if($post['width'] < 1 || $post['height'] < 1) { unlink($post['file']); - error(ERR_INVALIDIMG); + error($config['error']['invalidimg']); } - if($post['width'] > MAX_WIDTH || $post['height'] > MAX_HEIGHT) { + if($post['width'] > $config['max_width'] || $post['height'] > $config['max_height']) { unlink($post['file']); - error(ERR_MAXSIZE); + error($config['error']['maxsize']); } - $post['filehash'] = md5_file($post['file']); + $post['filehash'] = $config['file_hash']($post['file']); $post['filesize'] = filesize($post['file']); $image = createimage($post['extension'], $post['file']); - if(REDRAW_IMAGE && !$post['zip']) { - switch($post['extension']) { - case 'jpg': - case 'jpeg': - imagejpeg($image, $post['file'], JPEG_QUALITY); - break; - case 'png': - imagepng($image, $post['file'], 7); - break; - case 'gif': - if(REDRAW_GIF) - imagegif($image, $post['file']); - break; - case 'bmp': - imagebmp($image, $post['file']); - break; - default: - error('Unknwon file extension.'); - } - } - // Create a thumbnail - $thumb = resize($image, $post['width'], $post['height'], $post['thumb'], THUMB_WIDTH, THUMB_HEIGHT); + $thumb = resize($image, $post['width'], $post['height'], $post['thumb'], $config['thumb_width'], $config['thumb_height']); $post['thumbwidth'] = $thumb['width']; $post['thumbheight'] = $thumb['height']; } + /* + if(!($mod && $mod['type'] >= $config['mod']['postunoriginal']) && ROBOT_ENABLE && $board['uri'] == ROBOT_BOARD && checkRobot($post['body_nomarkup'])) { + if(ROBOT_MUTE) { + error(sprintf($config['error']['muted'], mute())); + } else { + error($config['error']['unoriginal']); + } + } + */ + // Remove DIR_* before inserting them into the database. if($post['has_file']) { - $post['file'] = substr_replace($post['file'], '', 0, strlen($board['dir'] . DIR_IMG)); - $post['thumb'] = substr_replace($post['thumb'], '', 0, strlen($board['dir'] . DIR_THUMB)); + $post['file'] = substr_replace($post['file'], '', 0, strlen($board['dir'] . $config['dir']['img'])); + $post['thumb'] = substr_replace($post['thumb'], '', 0, strlen($board['dir'] . $config['dir']['thumb'])); } // Todo: Validate some more, remove messy code, allow more specific configuration - - // MySQLify - mysql_safe_array($post); - $id = post($post, $OP); - if($post['has_file'] && $post['zip']) { - // Open ZIP - $zip = zip_open($post['zip']); - // Read files - while($entry = zip_read($zip)) { - $filename = basename(zip_entry_name($entry)); - $extension = strtolower(substr($filename, strrpos($filename, '.') + 1)); - - if(in_array($extension, $allowed_ext)) { - if (zip_entry_open($zip, $entry, 'r')) { - // Fake post - $dump_post = Array( - 'subject' => $post['subject'], - 'email' => $post['email'], - 'name' => $post['name'], - 'trip' => $post['trip'], - 'body' => '', - 'thread' => $id, - 'password' => '', - 'has_file' => true, - 'file_id' => rand(0, 1000000000), - 'filename' => $filename - ); - - $dump_post['file'] = $board['dir'] . DIR_IMG . $dump_post['file_id'] . '.' . $extension; - $dump_post['thumb'] = $board['dir'] . DIR_THUMB . $dump_post['file_id'] . '.png'; - - // Extract the image from the ZIP - $fp = fopen($dump_post['file'], 'w+'); - fwrite($fp, zip_entry_read($entry, zip_entry_filesize($entry))); - fclose($fp); - - $size = @getimagesize($dump_post['file']); - $dump_post['width'] = $size[0]; - $dump_post['height'] = $size[1]; - - // Check if the image is valid - if($dump_post['width'] < 1 || $dump_post['height'] < 1) { - unlink($dump_post['file']); - } else { - if($dump_post['width'] > MAX_WIDTH || $dump_post['height'] > MAX_HEIGHT) { - unlink($dump_post['file']); - error(ERR_MAXSIZE); - } else { - $dump_post['filehash'] = md5_file($dump_post['file']); - $dump_post['filesize'] = filesize($dump_post['file']); - - $image = createimage($extension, $dump_post['file']); - - $success = true; - if(REDRAW_IMAGE) { - switch($extension) { - case 'jpg': - case 'jpeg': - imagejpeg($image, $dump_post['file'], JPEG_QUALITY); - break; - case 'png': - imagepng($image, $dump_post['file'], 7); - break; - case 'gif': - if(REDRAW_GIF) - imagegif($image, $dump_post['file']); - break; - case 'bmp': - imagebmp($image, $dump_post['file']); - break; - default: - $success = false; - } - } - - - // Create a thumbnail - $thumb = resize($image, $dump_post['width'], $dump_post['height'], $dump_post['thumb'], THUMB_WIDTH, THUMB_HEIGHT); - - $dump_post['thumbwidth'] = $thumb['width']; - $dump_post['thumbheight'] = $thumb['height']; - - // Remove DIR_* before inserting them into the database. - $dump_post['file'] = substr_replace($dump_post['file'], '', 0, strlen($board['dir'] . DIR_IMG)); - $dump_post['thumb'] = substr_replace($dump_post['thumb'], '', 0, strlen($board['dir'] . DIR_THUMB)); - - // Create the post - post($dump_post, false); - } - } - - // Close the ZIP - zip_entry_close($entry); - } - } - } - zip_close($zip); - unlink($post['zip']); - } - buildThread(($OP?$id:$post['thread'])); - if(!$OP) { - mysql_query( - sprintf("UPDATE `posts` SET `bump` = '%d' WHERE `id` = '%s' AND `thread` IS NULL", - time(), - $post['thread'] - ), $sql) or error(mysql_error($sql)); + if(!$OP && strtolower($post['email']) != 'sage' && ($config['reply_limit'] == 0 || numPosts($post['thread']) < $config['reply_limit'])) { + bumpThread($post['thread']); } + if($OP) + clean(); + buildIndex(); sql_close(); - if(ALWAYS_NOKO || $noko) { - header('Location: ' . ROOT . $board['dir'] . DIR_RES . ($OP?$id:$post['thread']) . '.html' . (!$OP?'#'.$id:''), true, 302); + $root = $post['mod'] ? $config['root'] . $config['file_mod'] . '?/' : $config['root']; + + if($config['always_noko'] || $noko) { + header('Location: ' . $root . $board['dir'] . $config['dir']['res'] . ($OP?$id:$post['thread']) . '.html' . (!$OP?'#'.$id:''), true, $config['redirect_http']); } else { - header('Location: ' . ROOT . $board['dir'] . FILE_INDEX, true, 302); + header('Location: ' . $root . $board['dir'] . $config['file_index'], true, $config['redirect_http']); } exit; } else { - if(!file_exists(HAS_INSTALLED)) { + if(!file_exists($config['has_installed'])) { sql_open(); // Build all boards - $boards_res = mysql_query('SELECT * FROM `boards`', $sql) or error(mysql_error($sql)); - while($_board = mysql_fetch_array($boards_res)) { + $boards = listBoards(); + foreach($boards as &$_board) { setupBoard($_board); buildIndex(); } sql_close(); - touch(HAS_INSTALLED, 0777); + touch($config['has_installed'], 0777); die(Element('page.html', Array( 'index'=>ROOT, @@ -336,7 +333,7 @@ } else { // They opened post.php in their browser manually. // Possible TODO: Redirect back to homepage. - error(ERROR_NOPOST); + error($config['error']['nopost']); } } ?> |