From f309e4037c11197e4392e402992882358e4678c7 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Fri, 6 Sep 2013 23:09:18 +1000
Subject: Better and faster basic flood prevention, while merging it into
 $config['filters'].

---
 inc/config.php | 177 +++++++++++++++++++++++++++++++++++++--------------------
 1 file changed, 114 insertions(+), 63 deletions(-)

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index e8b65967..81cae233 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -168,13 +168,6 @@
  * ====================
  */
 
-	// Minimum time between between each post by the same IP address.
-	$config['flood_time'] = 10;
-	// Minimum time between between each post with the exact same content AND same IP address.
-	$config['flood_time_ip'] = 120;
-	// Same as above but by a different IP address. (Same content, not necessarily same IP address.)
-	$config['flood_time_same'] = 30;
-
 	/*
 	 * To further prevent spam and abuse, you can use DNS blacklists (DNSBL). A DNSBL is a list of IP
 	 * addresses published through the Internet Domain Name Service (DNS) either as a zone file that can be
@@ -283,6 +276,118 @@
 	$config['recaptcha_public'] = '6LcXTcUSAAAAAKBxyFWIt2SO8jwx4W7wcSMRoN3f';
 	$config['recaptcha_private'] = '6LcXTcUSAAAAAOGVbVdhmEM1_SyRF4xTKe8jbzf_';
 
+	/*
+	 * Custom filters detect certain posts and reject/ban accordingly. They are made up of a condition and an
+	 * action (for when ALL conditions are met). As every single post has to be put through each filter,
+	 * having hundreds probably isn't ideal as it could slow things down.
+	 *
+	 * By default, the custom filters array is populated with basic flood prevention conditions. This
+	 * includes forcing users to wait at least 5 seconds between posts. To disable (or amend) these flood
+	 * prevention settings, you will need to empty the $config['filters'] array first. You can do so by
+	 * adding "$config['filters'] = array();" to inc/instance-config.php. Basic flood prevention used to be
+	 * controlled solely by config variables such as $config['flood_time'] and $config['flood_time_ip'], and
+	 * it still is, as long as you leave the relevant $config['filters'] intact. These old config variables
+	 * still exist for backwards-compatability and general convenience.
+	 *
+	 * Read more: http://tinyboard.org/docs/index.php?p=Config/Filters
+	 */
+
+	// Minimum time between between each post by the same IP address.
+	$config['flood_time'] = 10;
+	// Minimum time between between each post with the exact same content AND same IP address.
+	$config['flood_time_ip'] = 120;
+	// Same as above but by a different IP address. (Same content, not necessarily same IP address.)
+	$config['flood_time_same'] = 30;
+
+	// Minimum time between posts by the same IP address (all boards).
+	$config['filters'][] = array(
+		'condition' => array(
+			'flood-match' => array('ip'), // Only match IP address
+			'flood-time' => &$config['flood_time'] // 10 seconds minimum
+		),
+		'action' => 'reject',
+		'message' => &$config['error']['flood']
+	);
+
+	// Minimum time between posts by the same IP address with the same text.
+	$config['filters'][] = array(
+		'condition' => array(
+			'flood-match' => array('ip', 'body'), // Match IP address and post body
+			'flood-time' => &$config['flood_time_ip'] // 2 minutes minimum
+		),
+		'action' => 'reject',
+		'message' => &$config['error']['flood']
+	);
+
+	// Minimum time between posts with the same text. (Same content, but not always the same IP address.)
+	$config['filters'][] = array(
+		'condition' => array(
+			'flood-match' => array('body'), // Match IP address and post body
+			'flood-time' => &$config['flood_time_same'] // 30 seconds minimum
+		),
+		'action' => 'reject',
+		'message' => &$config['error']['flood']
+	);
+
+	// Example: Minimum time between posts with the same file hash.
+	// $config['filters'][] = array(
+	// 	'condition' => array(
+	// 		'flood-match' => array('file'), // Match file hash
+	// 		'flood-time' => 60 * 2 // 2 minutes minimum
+	// 	),
+	// 	'action' => 'reject',
+	// 	'message' => &$config['error']['flood']
+	// );
+
+	// An example of blocking an imaginary known spammer, who keeps posting a reply with the name "surgeon",
+	// ending his posts with "regards, the surgeon" or similar.
+	// $config['filters'][] = array(
+	// 	'condition' => array(
+	// 		'name' => '/^surgeon$/',
+	// 		'body' => '/regards,\s+(the )?surgeon$/i',
+	// 		'OP' => false
+	// 	),
+	// 	'action' => 'reject',
+	// 	'message' => 'Go away, spammer.'
+	// );
+
+	// Same as above, but issuing a 3-hour ban instead of just reject the post.
+	// $config['filters'][] = array(
+	// 	'condition' => array(
+	// 		'name' => '/^surgeon$/',
+	// 		'body' => '/regards,\s+(the )?surgeon$/i',
+	// 		'OP' => false
+	// 	),
+	// 	'action' => 'ban',
+	// 	'expires' => 60 * 60 * 3, // 3 hours
+	// 	'reason' => 'Go away, spammer.'
+	// );
+
+	// PHP 5.3+ (anonymous functions)
+	// There is also a "custom" condition, making the possibilities of this feature pretty much endless.
+	// This is a bad example, because there is already a "name" condition built-in.
+	// $config['filters'][] = array(
+	// 	'condition' => array(
+	// 		'body' => '/h$/i',
+	// 		'OP' => false,
+	// 		'custom' => function($post) {
+	// 			if($post['name'] == 'Anonymous')
+	// 				return true;
+	// 			else
+	// 				return false;
+	// 		}
+	// 	),
+	// 	'action' => 'reject'
+	// );
+	
+	// Filter flood prevention conditions ("flood-match") depend on a table which contains a cache of recent
+	// posts across all boards. This table is automatically purged of older posts, determining the maximum
+	// "age" by looking at each filter. However, when determining the maximum age, Tinyboard does not look
+	// outside the current board. This means that if you have a special flood condition for a specific board
+	// (contained in a board configuration file) which has a flood-time greater than any of those in the
+	// global configuration, you need to set the following variable to the maximum flood-time condition value.
+	// $config['flood_cache'] = 60 * 60 * 24; // 24 hours
+
 /*
  * ====================
  *  Post settings
@@ -401,57 +506,6 @@
 	// Require users to see the ban page at least once for a ban even if it has since expired.
 	$config['require_ban_view'] = true;
 
-	/*
-	* Custom filters detect certain posts and reject/ban accordingly. They are made up of a 
-	* condition and an action (for when ALL conditions are met). As every single post has to
-	* be put through each filter, having hundreds probably isn’t ideal as it could slow things down.
-	*
-	* Read more: http://tinyboard.org/docs/index.php?p=Config/Filters
-	* 
-	* This used to be named $config['flood_filters'] (still exists as an alias).
-	*/
-
-	// An example of blocking an imaginary known spammer, who keeps posting a reply with the name "surgeon",
-	// ending his posts with "regards, the surgeon" or similar.
-	// $config['filters'][] = array(
-	// 	'condition' => array(
-	// 		'name' => '/^surgeon$/',
-	// 		'body' => '/regards,\s+(the )?surgeon$/i',
-	// 		'OP' => false
-	// 	),
-	// 	'action' => 'reject',
-	// 	'message' => 'Go away, spammer.'
-	// );
-
-	// Same as above, but issuing a 3-hour ban instead of just reject the post.
-	// $config['filters'][] = array(
-	// 	'condition' => array(
-	// 		'name' => '/^surgeon$/',
-	// 		'body' => '/regards,\s+(the )?surgeon$/i',
-	// 		'OP' => false
-	// 	),
-	// 	'action' => 'ban',
-	// 	'expires' => 60 * 60 * 3, // 3 hours
-	// 	'reason' => 'Go away, spammer.'
-	// );
-
-	// PHP 5.3+ (anonymous functions)
-	// There is also a "custom" condition, making the possibilities of this feature pretty much endless.
-	// This is a bad example, because there is already a "name" condition built-in.
-	// $config['filters'][] = array(
-	// 	'condition' => array(
-	// 		'body' => '/h$/i',
-	// 		'OP' => false,
-	// 		'custom' => function($post) {
-	// 			if($post['name'] == 'Anonymous')
-	// 				return true;
-	// 			else
-	// 				return false;
-	// 		}
-	// 	),
-	// 	'action' => 'reject'
-	// );
-
 /*
  * ====================
  *  Markup settings
@@ -593,10 +647,6 @@
 	// that as a thumbnail instead of resizing/redrawing.
 	$config['minimum_copy_resize'] = false;
 
-	// Image hashing function. There's really no reason to change this.
-	// sha1_file, md5_file, etc. You can also define your own similar function.
-	$config['file_hash'] = 'sha1_file';
-
 	// Maximum image upload size in bytes.
 	$config['max_filesize'] = 10 * 1024 * 1024; // 10MB
 	// Maximum image dimensions.
@@ -1156,7 +1206,8 @@
 	// Post bypass unoriginal content check on robot-enabled boards
 	$config['mod']['postunoriginal'] = ADMIN;
 	// Bypass flood check
-	$config['mod']['flood'] = ADMIN;
+	$config['mod']['bypass_filters'] = ADMIN;
+	$config['mod']['flood'] = &$config['mod']['bypass_filters'];
 	// Raw HTML posting
 	$config['mod']['rawhtml'] = ADMIN;
 
-- 
cgit v1.3


From e9ccc5d72d121859c8a766bd64a87d45d42f62a2 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sat, 7 Sep 2013 12:40:35 +1000
Subject: Optionally EXPLAIN all SQL queries when in debug mode

---
 inc/config.php   |  2 ++
 inc/database.php | 17 +++++++++++++++--
 2 files changed, 17 insertions(+), 2 deletions(-)

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index 81cae233..43550dc3 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -44,6 +44,8 @@
 	$config['debug'] = false;
 	// For development purposes. Displays (and "dies" on) all errors and warnings. Turn on with the above.
 	$config['verbose_errors'] = true;
+	// EXPLAIN all SQL queries (when in debug mode).
+	$config['debug_explain'] = false;
 
 	// Directory where temporary files will be created.
 	$config['tmp'] = sys_get_temp_dir();
diff --git a/inc/database.php b/inc/database.php
index d2f1af04..2c60015a 100644
--- a/inc/database.php
+++ b/inc/database.php
@@ -7,21 +7,29 @@
 defined('TINYBOARD') or exit;
 
 class PreparedQueryDebug {
-	protected $query;
+	protected $query, $explain_query = false;
 	
 	public function __construct($query) {
-		global $pdo;
+		global $pdo, $config;
 		$query = preg_replace("/[\n\t]+/", ' ', $query);
 		
 		$this->query = $pdo->prepare($query);
+		if ($config['debug'] && $config['debug_explain'] && preg_match('/^(SELECT|INSERT|UPDATE|DELETE) /', $query))
+			$this->explain_query = $pdo->prepare("EXPLAIN $query");
 	}
 	public function __call($function, $args) {
 		global $config, $debug;
 		
 		if ($config['debug'] && $function == 'execute') {
+			if ($this->explain_query) {
+				$this->explain_query->execute() or error(db_error($explain_query));
+			}
 			$start = microtime(true);
 		}
 		
+		if ($this->explain_query && $function == 'bindValue')
+			call_user_func_array(array($this->explain_query, $function), $args);
+		
 		$return = call_user_func_array(array($this->query, $function), $args);
 		
 		if ($config['debug'] && $function == 'execute') {
@@ -29,6 +37,7 @@ class PreparedQueryDebug {
 			$debug['sql'][] = array(
 				'query' => $this->query->queryString,
 				'rows' => $this->query->rowCount(),
+				'explain' => $this->explain_query ? $this->explain_query->fetchAll(PDO::FETCH_ASSOC) : null,
 				'time' => '~' . round($time * 1000, 2) . 'ms'
 			);
 			$debug['time']['db_queries'] += $time;
@@ -118,6 +127,9 @@ function query($query) {
 	sql_open();
 	
 	if ($config['debug']) {
+		if ($config['debug_explain'] && preg_match('/^(SELECT|INSERT|UPDATE|DELETE) /', $query)) {
+			$explain = $pdo->query("EXPLAIN $query") or error(db_error());
+		}
 		$start = microtime(true);
 		$query = $pdo->query($query);
 		if (!$query)
@@ -126,6 +138,7 @@ function query($query) {
 		$debug['sql'][] = array(
 			'query' => $query->queryString,
 			'rows' => $query->rowCount(),
+			'explain' => isset($explain) ? $explain->fetchAll(PDO::FETCH_ASSOC) : null,
 			'time' => '~' . round($time * 1000, 2) . 'ms'
 		);
 		$debug['time']['db_queries'] += $time;
-- 
cgit v1.3


From b7f16dee0f4554f5e607e50f773af6852e716513 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sat, 7 Sep 2013 12:58:23 +1000
Subject: Add ! syntax (NOT) to filters. Don't throttle duplicate post bodies
 when they are empty

---
 inc/config.php  | 7 ++++---
 inc/filters.php | 9 ++++++---
 2 files changed, 10 insertions(+), 6 deletions(-)

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index 43550dc3..9f231e30 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -305,7 +305,7 @@
 	$config['filters'][] = array(
 		'condition' => array(
 			'flood-match' => array('ip'), // Only match IP address
-			'flood-time' => &$config['flood_time'] // 10 seconds minimum
+			'flood-time' => &$config['flood_time']
 		),
 		'action' => 'reject',
 		'message' => &$config['error']['flood']
@@ -315,7 +315,8 @@
 	$config['filters'][] = array(
 		'condition' => array(
 			'flood-match' => array('ip', 'body'), // Match IP address and post body
-			'flood-time' => &$config['flood_time_ip'] // 2 minutes minimum
+			'flood-time' => &$config['flood_time_ip'],
+			'!body' => '/^$/', // Post body is NOT empty
 		),
 		'action' => 'reject',
 		'message' => &$config['error']['flood']
@@ -325,7 +326,7 @@
 	$config['filters'][] = array(
 		'condition' => array(
 			'flood-match' => array('body'), // Match IP address and post body
-			'flood-time' => &$config['flood_time_same'] // 30 seconds minimum
+			'flood-time' => &$config['flood_time_same']
 		),
 		'action' => 'reject',
 		'message' => &$config['error']['flood']
diff --git a/inc/filters.php b/inc/filters.php
index 27b167ea..5c934532 100644
--- a/inc/filters.php
+++ b/inc/filters.php
@@ -168,11 +168,14 @@ class Filter {
 	
 	public function check(array $post) {
 		foreach ($this->condition as $condition => $value) {
-			if (!$this->match($post, $condition, $value))
+			if ($condition[0] == '!') {
+				$NOT = true;
+				$condition = substr($condition, 1);
+			} else $NOT = false;
+			
+			if ($this->match($post, $condition, $value) == $NOT)
 				return false;
 		}
-		
-		/* match */
 		return true;
 	}
 }
-- 
cgit v1.3


From a13571cdade07802fcf8c72cb0924cf455032a12 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 8 Sep 2013 14:59:43 +1000
Subject: Comment mistake

---
 inc/config.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index 9f231e30..0cdbe709 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -325,7 +325,7 @@
 	// Minimum time between posts with the same text. (Same content, but not always the same IP address.)
 	$config['filters'][] = array(
 		'condition' => array(
-			'flood-match' => array('body'), // Match IP address and post body
+			'flood-match' => array('body'), // Match only post body
 			'flood-time' => &$config['flood_time_same']
 		),
 		'action' => 'reject',
-- 
cgit v1.3


From d4cf4c7afb975cead41768c9e0d1960a46183409 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 8 Sep 2013 15:07:55 +1000
Subject: flood-count condition

---
 inc/config.php  | 19 ++++++++++++++++---
 inc/filters.php |  8 ++++++++
 2 files changed, 24 insertions(+), 3 deletions(-)

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index 0cdbe709..0eac92b6 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -342,7 +342,20 @@
 	// 	'message' => &$config['error']['flood']
 	// );
 
-	// An example of blocking an imaginary known spammer, who keeps posting a reply with the name "surgeon",
+	// Example: Use the "flood-count" condition to only match if the user has made at least two posts with
+	// the same content and IP address in the past 2 minutes.
+	// $config['filters'][] = array(
+	// 	'condition' => array(
+	// 		'flood-match' => array('ip', 'body'), // Match IP address and post body
+	// 		'flood-time' => 60 * 2, // 2 minutes
+	// 		'flood-count' => 2 // At least two recent posts
+	// 	),
+	// 	'!body' => '/^$/',
+	// 	'action' => 'reject',
+	// 	'message' => &$config['error']['flood']
+	// );
+
+	// Example: Blocking an imaginary known spammer, who keeps posting a reply with the name "surgeon",
 	// ending his posts with "regards, the surgeon" or similar.
 	// $config['filters'][] = array(
 	// 	'condition' => array(
@@ -354,7 +367,7 @@
 	// 	'message' => 'Go away, spammer.'
 	// );
 
-	// Same as above, but issuing a 3-hour ban instead of just reject the post.
+	// Example: Same as above, but issuing a 3-hour ban instead of just reject the post.
 	// $config['filters'][] = array(
 	// 	'condition' => array(
 	// 		'name' => '/^surgeon$/',
@@ -366,7 +379,7 @@
 	// 	'reason' => 'Go away, spammer.'
 	// );
 
-	// PHP 5.3+ (anonymous functions)
+	// Example: PHP 5.3+ (anonymous functions)
 	// There is also a "custom" condition, making the possibilities of this feature pretty much endless.
 	// This is a bad example, because there is already a "name" condition built-in.
 	// $config['filters'][] = array(
diff --git a/inc/filters.php b/inc/filters.php
index d2802264..d5353afb 100644
--- a/inc/filters.php
+++ b/inc/filters.php
@@ -73,6 +73,14 @@ class Filter {
 					}
 				}
 				return false;
+			case 'flood-count':
+				$count = 0;
+				foreach ($this->flood_check as $flood_post) {
+					if (time() - $flood_post['time'] <= $this->condition['flood-time']) {
+						++$count;
+					}
+				}
+				return $count >= $match;
 			case 'name':
 				return preg_match($match, $post['name']);
 			case 'trip':
-- 
cgit v1.3


From 9a846d5ad5838d4db824623d9916d6b4e34c29ee Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 8 Sep 2013 17:01:55 +1000
Subject: Use Unicode in antispam stuff

---
 inc/anti-bot.php | 42 +++++++++++++++++++++++++++++-------------
 inc/config.php   |  3 +++
 2 files changed, 32 insertions(+), 13 deletions(-)

(limited to 'inc/config.php')

diff --git a/inc/anti-bot.php b/inc/anti-bot.php
index dbe87e2b..59f5351f 100644
--- a/inc/anti-bot.php
+++ b/inc/anti-bot.php
@@ -11,14 +11,19 @@ $hidden_inputs_twig = array();
 class AntiBot {
 	public $salt, $inputs = array(), $index = 0;
 	
-	public static function randomString($length, $uppercase = false, $special_chars = false) {
+	public static function randomString($length, $uppercase = false, $special_chars = false, $unicode_chars = false) {
 		$chars = 'abcdefghijklmnopqrstuvwxyz0123456789';
 		if ($uppercase)
 			$chars .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
 		if ($special_chars)
 			$chars .= ' ~!@#$%^&*()_+,./;\'[]\\{}|:<>?=-` ';
+		if ($unicode_chars) {
+			$len = strlen($chars) / 10;
+			for ($n = 0; $n < $len; $n++)
+				$chars .= mb_convert_encoding('&#' . mt_rand(0x2600, 0x26FF) . ';', 'UTF-8', 'HTML-ENTITIES');
+		}
 		
-		$chars = str_split($chars);
+		$chars = preg_split('//u', $chars, -1, PREG_SPLIT_NO_EMPTY);
 		
 		$ch = array();
 		
@@ -41,10 +46,10 @@ class AntiBot {
 	}
 	
 	public static function make_confusing($string) {
-		$chars = str_split($string);
+		$chars = preg_split('//u', $string, -1, PREG_SPLIT_NO_EMPTY);
 		
 		foreach ($chars as &$c) {
-			if (rand(0, 2) != 0)
+			if (mt_rand(0, 3) != 0)
 				$c = utf8tohtml($c);
 			else
 				$c = mb_encode_numericentity($c, array(0, 0xffff, 0, 0xffff), 'UTF-8');
@@ -65,13 +70,13 @@ class AntiBot {
 		
 		shuffle($config['spam']['hidden_input_names']);
 		
-		$input_count = rand($config['spam']['hidden_inputs_min'], $config['spam']['hidden_inputs_max']);
+		$input_count = mt_rand($config['spam']['hidden_inputs_min'], $config['spam']['hidden_inputs_max']);
 		$hidden_input_names_x = 0;
 		
 		for ($x = 0; $x < $input_count ; $x++) {
-			if ($hidden_input_names_x === false || rand(0, 2) == 0) {
+			if ($hidden_input_names_x === false || mt_rand(0, 2) == 0) {
 				// Use an obscure name
-				$name = $this->randomString(rand(10, 40));
+				$name = $this->randomString(mt_rand(10, 40), false, false, $config['spam']['unicode']);
 			} else {
 				// Use a pre-defined confusing name
 				$name = $config['spam']['hidden_input_names'][$hidden_input_names_x++];
@@ -79,25 +84,33 @@ class AntiBot {
 					$hidden_input_names_x = false;
 			}
 			
-			if (rand(0, 2) == 0) {
+			if (mt_rand(0, 2) == 0) {
 				// Value must be null
 				$this->inputs[$name] = '';
-			} elseif (rand(0, 4) == 0) {
+			} elseif (mt_rand(0, 4) == 0) {
 				// Numeric value
-				$this->inputs[$name] = (string)rand(0, 100);
+				$this->inputs[$name] = (string)mt_rand(0, 100000);
 			} else {
 				// Obscure value
-				$this->inputs[$name] = $this->randomString(rand(5, 100), true, true);
+				$this->inputs[$name] = $this->randomString(mt_rand(5, 100), true, true, $config['spam']['unicode']);
 			}
 		}
 	}
 	
+	public static function space() {
+		if (mt_rand(0, 3) != 0)
+			return ' ';
+		return str_repeat(' ', mt_rand(1, 3));
+	}
+	
 	public function html($count = false) {
 		global $config;
 		
 		$elements = array(
 			'<input type="hidden" name="%name%" value="%value%">',
 			'<input type="hidden" value="%value%" name="%name%">',
+			'<input name="%name%" value="%value%" type="hidden">',
+			'<input value="%value%" name="%name%" type="hidden">',
 			'<input style="display:none" type="text" name="%name%" value="%value%">',
 			'<input style="display:none" type="text" value="%value%" name="%name%">',
 			'<span style="display:none"><input type="text" name="%name%" value="%value%"></span>',
@@ -110,7 +123,7 @@ class AntiBot {
 		$html = '';
 		
 		if ($count === false) {
-			$count = rand(1, count($this->inputs) / 15);
+			$count = mt_rand(1, abs(count($this->inputs) / 15) + 1);
 		}
 		
 		if ($count === true) {
@@ -125,6 +138,9 @@ class AntiBot {
 			$element = false;
 			while (!$element) {
 				$element = $elements[array_rand($elements)];
+				$element = str_replace(' ', self::space(), $element);
+				if (mt_rand(0, 5) == 0)
+					$element = str_replace('>', self::space() . '>', $element);
 				if (strpos($element, 'textarea') !== false && $value == '') {
 					// There have been some issues with mobile web browsers and empty <textarea>'s.
 					$element = false;
@@ -133,7 +149,7 @@ class AntiBot {
 			
 			$element = str_replace('%name%', utf8tohtml($name), $element);
 			
-			if (rand(0, 2) == 0)
+			if (mt_rand(0, 2) == 0)
 				$value = $this->make_confusing($value);
 			else
 				$value = utf8tohtml($value);
diff --git a/inc/config.php b/inc/config.php
index 0eac92b6..84222009 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -232,6 +232,9 @@
 
 	// How soon after regeneration do hashes expire (in seconds)?
 	$config['spam']['hidden_inputs_expire'] = 60 * 60 * 3; // three hours
+	
+	// Whether to use Unicode characters in hidden input names and values.
+	$config['spam']['unicode'] = true;
 
 	// These are fields used to confuse the bots. Make sure they aren't actually used by Tinyboard, or it won't work.
 	$config['spam']['hidden_input_names'] = array(
-- 
cgit v1.3


From eea4e42609e319b38f14bca9f31cc3327ffaf175 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Mon, 9 Sep 2013 01:33:51 +1000
Subject: Add ability to create custom user/permissions groups

---
 inc/config.php                   | 34 ++++++++++++++++++--------------
 inc/functions.php                |  9 +++++++++
 inc/mod/config-editor.php        | 11 ++++++-----
 inc/mod/pages.php                | 42 ++++++++++++++++++++++++++++++----------
 install.php                      |  7 ++++++-
 install.sql                      |  4 ++--
 templates/mod/config-editor.html |  9 +++++----
 templates/mod/user.html          | 20 +++++++------------
 templates/mod/users.html         | 11 ++++++-----
 9 files changed, 93 insertions(+), 54 deletions(-)

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index 84222009..897c8a42 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1162,18 +1162,28 @@
  * ====================
  */
 
-	// Probably best not to change these:
-	if (!defined('JANITOR')) {
-		define('JANITOR',	0,	true);
-		define('MOD',		1,	true);
-		define('ADMIN',		2,	true);
-		define('DISABLED',	3,	true);
-	}
+	// Probably best not to change this unless you are smart enough to figure out what you're doing. If you
+	// decide to change it, remember that it is impossible to redefinite/overwrite groups; you may only add
+	// new ones.
+	$config['mod']['groups'] = array(
+		10	=> 'Janitor',
+		20	=> 'Mod',
+		30	=> 'Admin',
+		// 98	=> 'God',
+		99	=> 'Disabled'
+	);
+
+	// If you add stuff to the above, you'll need to call this function immediately after.
+	define_groups();
+
+	// Example: Adding a new permissions group.
+	// $config['mod']['groups'][0] = 'NearlyPowerless';
+	// define_groups();
 
 	// Capcode permissions.
 	$config['mod']['capcode'] = array(
 	//	JANITOR		=> array('Janitor'),
-		MOD			=> array('Mod'),
+		MOD		=> array('Mod'),
 		ADMIN		=> true
 	);
 
@@ -1312,18 +1322,14 @@
 	$config['mod']['edit_config'] = ADMIN;
 
 	// Config editor permissions
-	$config['mod']['config'] = array(
-		JANITOR => false,
-		MOD => false,
-		ADMIN => false,
-		DISABLED => false,
-	);
+	$config['mod']['config'] = array();
 
 	// Disable the following configuration variables from being changed via ?/config. The following default
 	// banned variables are considered somewhat dangerous.
 	$config['mod']['config'][DISABLED] = array(
 		'mod>config',
 		'mod>config_editor_php',
+		'mod>groups',
 		'convert_args',
 		'db>password',
 	);
diff --git a/inc/functions.php b/inc/functions.php
index 819a935b..e5e33449 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -265,6 +265,15 @@ function verbose_error_handler($errno, $errstr, $errfile, $errline) {
 	));
 }
 
+function define_groups() {
+	global $config;
+
+	foreach ($config['mod']['groups'] as $group_value => $group_name)
+		defined($group_name) or define($group_name, $group_value, true);
+	
+	ksort($config['mod']['groups']);
+}
+
 function create_antibot($board, $thread = null) {
 	require_once dirname(__FILE__) . '/anti-bot.php';
 
diff --git a/inc/mod/config-editor.php b/inc/mod/config-editor.php
index 3f15ebe5..4493fd2b 100644
--- a/inc/mod/config-editor.php
+++ b/inc/mod/config-editor.php
@@ -3,7 +3,7 @@
 function permission_to_edit_config_var($varname) {
 	global $config, $mod;
 
-	if (is_array($config['mod']['config'][DISABLED])) {
+	if (isset($config['mod']['config'][DISABLED])) {
 		foreach ($config['mod']['config'][DISABLED] as $disabled_var_name) {
 			$disabled_var_name = explode('>', $disabled_var_name);
 			if (count($disabled_var_name) == 1)
@@ -14,10 +14,11 @@ function permission_to_edit_config_var($varname) {
 	}
 	
 	$allow_only = false;
-	// for ($perm = (int)$mod['type']; $perm >= JANITOR; $perm --) {
-	for ($perm = JANITOR; $perm <= (int)$mod['type']; $perm ++) {
+	foreach ($config['mod']['groups'] as $perm => $perm_name) {
+		if ($perm > $mod['type'])
+			break;
 		$allow_only = false;
-		if (is_array($config['mod']['config'][$perm])) {
+		if (isset($config['mod']['config'][$perm]) && is_array($config['mod']['config'][$perm])) {
 			foreach ($config['mod']['config'][$perm] as $perm_var_name) {
 				if ($perm_var_name == '!') {
 					$allow_only = true;
@@ -92,7 +93,7 @@ function config_vars() {
 				continue; // This is just an alias.
 			if (!preg_match('/^array|\[\]|function/', $var['default']) && !preg_match('/^Example: /', trim(implode(' ', $var['comment'])))) {
 				$syntax_error = true;
-				$temp = eval('$syntax_error = false;return ' . $var['default'] . ';');
+				$temp = eval('$syntax_error = false;return @' . $var['default'] . ';');
 				if ($syntax_error && $temp === false) {
 					error('Error parsing config.php (line ' . $line_no . ')!', null, $var);
 				} elseif (!isset($temp)) {
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index 5e45cdae..af8f7466 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -1674,11 +1674,39 @@ function mod_user_promote($uid, $action) {
 	if (!hasPermission($config['mod']['promoteusers']))
 		error($config['error']['noaccess']);
 	
-	$query = prepare("UPDATE ``mods`` SET `type` = `type` " . ($action == 'promote' ? "+1 WHERE `type` < " . (int)ADMIN : "-1 WHERE `type` > " . (int)JANITOR) . " AND `id` = :id");
+	$query = prepare("SELECT `type`, `username` FROM ``mods`` WHERE `id` = :id");
 	$query->bindValue(':id', $uid);
 	$query->execute() or error(db_error($query));
 	
-	modLog(($action == 'promote' ? 'Promoted' : 'Demoted') . " user #{$uid}");
+	if (!$mod = $query->fetch(PDO::FETCH_ASSOC))
+		error($config['error']['404']);
+	
+	$new_group = false;
+	
+	$groups = $config['mod']['groups'];
+	if ($action == 'demote')
+		$groups = array_reverse($groups, true);
+	
+	foreach ($groups as $group_value => $group_name) {
+		if ($action == 'promote' && $group_value > $mod['type']) {
+			$new_group = $group_value;
+			break;
+		} elseif ($action == 'demote' && $group_value < $mod['type']) {
+			$new_group = $group_value;
+			break;
+		}
+	}
+	
+	if ($new_group === false || $new_group == DISABLED)
+		error(_('Impossible to promote/demote user.'));
+	
+	$query = prepare("UPDATE ``mods`` SET `type` = :group_value WHERE `id` = :id");
+	$query->bindValue(':id', $uid);
+	$query->bindValue(':group_value', $new_group);
+	$query->execute() or error(db_error($query));
+	
+	modLog(($action == 'promote' ? 'Promoted' : 'Demoted') . ' user "' .
+		utf8tohtml($mod['username']) . '" to ' . $config['mod']['groups'][$new_group]);
 	
 	header('Location: ?/users', true, $config['redirect_http']);
 }
@@ -2069,14 +2097,8 @@ function mod_config($board_config = false) {
 				
 				
 				$config_append .= ' = ';
-				if (@$var['permissions'] && in_array($value, array(JANITOR, MOD, ADMIN, DISABLED))) {
-					$perm_array = array(
-						JANITOR => 'JANITOR',
-						MOD => 'MOD',
-						ADMIN => 'ADMIN',
-						DISABLED => 'DISABLED'
-					);
-					$config_append .= $perm_array[$value];
+				if (@$var['permissions'] && isset($config['mod']['groups'][$value])) {
+					$config_append .= $config['mod']['groups'][$value];
 				} else {
 					$config_append .= var_export($value, true);
 				}
diff --git a/install.php b/install.php
index 45244b90..639a90c9 100644
--- a/install.php
+++ b/install.php
@@ -1,7 +1,7 @@
 <?php
 
 // Installation/upgrade file	
-define('VERSION', 'v0.9.6-dev-19');
+define('VERSION', 'v0.9.6-dev-20');
 
 require 'inc/functions.php';
 
@@ -407,6 +407,11 @@ if (file_exists($config['has_installed'])) {
 				  KEY `filehash` (`filehash`),
 				  KEY `time` (`time`)
 				) ENGINE=MyISAM DEFAULT CHARSET=ascii COLLATE=ascii_bin AUTO_INCREMENT=1 ;") or error(db_error());
+		case 'v0.9.6-dev-19':
+			query("UPDATE ``mods`` SET `type` = 10 WHERE `type` = 0") or error(db_error());
+			query("UPDATE ``mods`` SET `type` = 20 WHERE `type` = 1") or error(db_error());
+			query("UPDATE ``mods`` SET `type` = 30 WHERE `type` = 2") or error(db_error());
+			query("ALTER TABLE ``mods`` CHANGE `type`  `type` smallint(1) NOT NULL") or error(db_error());
 		case false:
 			// Update version number
 			file_write($config['has_installed'], VERSION);
diff --git a/install.sql b/install.sql
index 25c0a0f1..1e7a5011 100644
--- a/install.sql
+++ b/install.sql
@@ -131,7 +131,7 @@ CREATE TABLE IF NOT EXISTS `mods` (
   `username` varchar(30) NOT NULL,
   `password` char(64) CHARACTER SET ascii NOT NULL COMMENT 'SHA256',
   `salt` char(32) CHARACTER SET ascii NOT NULL,
-  `type` smallint(1) NOT NULL COMMENT '0: janitor, 1: mod, 2: admin',
+  `type` smallint(2) NOT NULL,
   `boards` text CHARACTER SET utf8 NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `id` (`id`,`username`)
@@ -142,7 +142,7 @@ CREATE TABLE IF NOT EXISTS `mods` (
 --
 
 INSERT INTO `mods` VALUES
-(1, 'admin', 'cedad442efeef7112fed0f50b011b2b9bf83f6898082f995f69dd7865ca19fb7', '4a44c6c55df862ae901b413feecb0d49', 2, '*');
+(1, 'admin', 'cedad442efeef7112fed0f50b011b2b9bf83f6898082f995f69dd7865ca19fb7', '4a44c6c55df862ae901b413feecb0d49', 20, '*');
 
 -- --------------------------------------------------------
 
diff --git a/templates/mod/config-editor.html b/templates/mod/config-editor.html
index a43f8cf7..4f4cba93 100644
--- a/templates/mod/config-editor.html
+++ b/templates/mod/config-editor.html
@@ -42,10 +42,11 @@
 						<input name="{{ name }}" type="text" value="{{ var.value|e }}">
 					{% elseif var.permissions %}
 						<select name="{{ name }}">
-							<option value="{{ constant('JANITOR') }}"{% if var.value == constant('JANITOR')%} selected{% endif %}>JANITOR</option>
-							<option value="{{ constant('MOD') }}"{% if var.value == constant('MOD')%} selected{% endif %}>MOD</option>
-							<option value="{{ constant('ADMIN') }}"{% if var.value == constant('ADMIN')%} selected{% endif %}>ADMIN</option>
-							<option value="{{ constant('DISABLED') }}"{% if var.value == constant('DISABLED')%} selected{% endif %}>DISABLED</option>
+							{% for group_value, group_name in config.mod.groups %}
+								<option value="{{ group_value }}"{% if var.value == group_value %} selected{% endif %}>
+									{{ group_name }}
+								</option>
+							{% endfor %}
 						</select>
 					{% elseif var.type == 'integer' %}
 						<input name="{{ name }}" type="number" value="{{ var.value|e }}">
diff --git a/templates/mod/user.html b/templates/mod/user.html
index 1bb297af..89240824 100644
--- a/templates/mod/user.html
+++ b/templates/mod/user.html
@@ -28,21 +28,15 @@
 		</tr>
 		{% if new %}
 			<tr>
-				<th>{% trans 'Class' %}</th>
+				<th>{% trans 'Group' %}</th>
 				<td>
 					<ul style="padding:5px 8px;list-style:none">
-						<li>
-							<input type="radio" name="type" id="janitor" value="{{ constant('JANITOR') }}"> 
-							<label for="janitor">{% trans 'Janitor' %}</label>
-						</li>
-						<li>
-							<input type="radio" name="type" id="mod" value="{{ constant('MOD') }}" checked> 
-							<label for="mod">{% trans 'Mod' %}</label>
-						</li>
-						<li>
-							<input type="radio" name="type" id="admin" value="{{ constant('Admin') }}"> 
-							<label for="admin">{% trans 'Admin' %}</label>
-						</li>
+						{% for group_value, group_name in config.mod.groups if group_name != 'Disabled' %}
+							<li>
+								<input type="radio" name="type" id="group_{{ group_name }}" value="{{ group_value }}"> 
+								<label for="group_{{ group_name }}">{% trans group_name %}</label>
+							</li>
+						{% endfor %}
 					</ul>
 				</td>
 			</tr>
diff --git a/templates/mod/users.html b/templates/mod/users.html
index fbd43b32..984c48e1 100644
--- a/templates/mod/users.html
+++ b/templates/mod/users.html
@@ -15,9 +15,10 @@
 			<td><small>{{ user.id }}</small></td>
 			<td>{{ user.username|e }}</td>
 			<td>
-				{% if user.type == constant('JANITOR') %}{% trans 'Janitor' %}
-				{% elseif user.type == constant('MOD') %}{% trans 'Mod' %}
-				{% elseif user.type == constant('ADMIN') %}{% trans 'Admin' %}
+				{% if config.mod.groups[user.type] %}
+					{{ config.mod.groups[user.type] }}
+				{% else %}
+					<em>{% trans 'Unknown' %}</em> ({{ user.type }})
 				{% endif %}
 			</td>
 			<td>
@@ -46,10 +47,10 @@
 				</td>
 			{% endif %}
 			<td>
-				{% if mod|hasPermission(config.mod.promoteusers) and user.type < constant('ADMIN') %}
+				{% if mod|hasPermission(config.mod.promoteusers) and user.type < constant(config.mod.groups[0:-1]|last) %}
 					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/promote" title="{% trans 'Promote' %}">&#9650;</a> 
 				{% endif %}
-				{% if mod|hasPermission(config.mod.promoteusers) and user.type > constant('JANITOR') %}
+				{% if mod|hasPermission(config.mod.promoteusers) and user.type > constant(config.mod.groups|first) %}
 					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/demote" title="{% trans 'Demote' %}">&#9660;</a> 
 				{% endif %}
 				{% if mod|hasPermission(config.mod.modlog) %}
-- 
cgit v1.3


From c4a6116722f7798967a8424cb47aad2a319e7a9c Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 15 Sep 2013 00:42:20 +1000
Subject: Optionally show page navigation bar at the top too.

---
 inc/config.php        |  6 ++++++
 stylesheets/style.css |  4 ++++
 templates/index.html  | 22 ++++++++++++++++++++--
 3 files changed, 30 insertions(+), 2 deletions(-)

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index 897c8a42..90e66a2c 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -797,6 +797,12 @@
 	// Whether or not to put brackets around the whole board list
 	$config['boardlist_wrap_bracket'] = true;
 
+	// Show page navigation links at the top as well.
+	$config['page_nav_top'] = false;
+
+	// Show "Catalog" link in page navigation. Use with the Catalog theme.
+	// $config['catalog_link'] = 'catalog.html';
+
 	// Board categories. Only used in the "Categories" theme.
 	// $config['categories'] = array(
 	// 	'Group Name' => array('a', 'b', 'c'),
diff --git a/stylesheets/style.css b/stylesheets/style.css
index c1725e35..10ddb8e8 100644
--- a/stylesheets/style.css
+++ b/stylesheets/style.css
@@ -319,6 +319,10 @@ div.pages {
 	border-right: 1px solid #B7C5D9;
 	border-bottom: 1px solid #B7C5D9;
 }
+div.pages.top {
+	display: inline-block;
+	padding: 4px 8px;
+}
 div.pages a.selected {
 	color: black;
 	font-weight: bolder;
diff --git a/templates/index.html b/templates/index.html
index d5e6cd18..0b4fed8d 100644
--- a/templates/index.html
+++ b/templates/index.html
@@ -25,6 +25,17 @@
 	
 	{% include 'post_form.html' %}
 	
+	{% if config.page_nav_top %}
+		<div class="pages top">
+			{% for page in pages %}
+			 [<a {% if page.selected %}class="selected"{% endif %}{% if not page.selected %}href="{{ page.link }}"{% endif %}>{{ page.num }}</a>]{% if loop.last %} {% endif %}
+			{% endfor %} {{ btn.next }}
+			{% if config.catalog_link %}
+				 | <a href="{{ config.root }}{{ board.dir }}{{ config.catalog_link }}">Catalog</a>
+			{% endif %}
+		</div>
+	{% endif %}
+	
 	{% if config.global_message %}<hr /><div class="blotter">{{ config.global_message }}</div>{% endif %}
 	<hr />
 	<form name="postcontrols" action="{{ config.post_url }}" method="post">
@@ -33,9 +44,16 @@
 	{{ body }}
 	{% include 'report_delete.html' %}
 	</form>
-	<div class="pages">{{ btn.prev }} {% for page in pages %}
+	
+	<div class="pages">
+		{{ btn.prev }} {% for page in pages %}
 		 [<a {% if page.selected %}class="selected"{% endif %}{% if not page.selected %}href="{{ page.link }}"{% endif %}>{{ page.num }}</a>]{% if loop.last %} {% endif %}
-	{% endfor %} {{ btn.next }}</div>
+		{% endfor %} {{ btn.next }}
+		{% if config.catalog_link %}
+			 | <a href="{{ config.root }}{{ board.dir }}{{ config.catalog_link }}">Catalog</a>
+		{% endif %}
+	</div>
+	
 	{{ boardlist.bottom }}
 	<footer>
 		<p class="unimportant" style="margin-top:20px;text-align:center;">Powered by <a href="http://tinyboard.org/">Tinyboard</a> {{ config.version }} | <a href="http://tinyboard.org/">Tinyboard</a> Copyright &copy; 2010-2013 Tinyboard Development Group</p>
-- 
cgit v1.3


From 32c999346f3a4919f527df7465e5989afba6e7bc Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 15 Sep 2013 05:46:08 +1000
Subject: Remove $config['url_regex'];

---
 inc/config.php    | 3 ---
 inc/functions.php | 2 +-
 post.php          | 2 +-
 3 files changed, 2 insertions(+), 5 deletions(-)

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index 90e66a2c..e1929766 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1444,6 +1444,3 @@
 	// is the absolute maximum, because MySQL cannot handle table names greater than 64 characters.
 	$config['board_regex'] = '[0-9a-zA-Z$_\x{0080}-\x{FFFF}]{1,58}';
 
-	// Regex for URLs.
-	$config['url_regex'] = '@^(?i)\b((?:[a-z][\w-]+:(?:/{1,3}|[a-z0-9%])|www\d{0,3}[.]|[a-z0-9.\-]+[.][a-z]{2,4}/)(?:[^\s()<>]+|\(([^\s()<>]+|(\([^\s()<>]+\)))*\))+(?:\(([^\s()<>]+|(\([^\s()<>]+\)))*\)|[^\s`!()\[\]{};:\'".,<>?«»“”‘’]))$@';
-
diff --git a/inc/functions.php b/inc/functions.php
index 5a95c851..377607fb 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -94,7 +94,7 @@ function loadConfig() {
 	if (!isset($config['referer_match']))
 		if (isset($_SERVER['HTTP_HOST'])) {
 			$config['referer_match'] = '/^' .
-				(preg_match($config['url_regex'], $config['root']) ? '' :
+				(preg_match('@^https?:@//', $config['root']) ? '' :
 					'https?:\/\/' . $_SERVER['HTTP_HOST']) .
 					preg_quote($config['root'], '/') .
 				'(' .
diff --git a/post.php b/post.php
index 2a5f65c6..fc23b47b 100644
--- a/post.php
+++ b/post.php
@@ -273,7 +273,7 @@ if (isset($_POST['delete'])) {
 	
 	if ($config['allow_upload_by_url'] && isset($_POST['file_url']) && !empty($_POST['file_url'])) {
 		$post['file_url'] = $_POST['file_url'];
-		if (!preg_match($config['url_regex'], $post['file_url']))
+		if (!preg_match('@^https?:@//', $post['file_url']))
 			error($config['error']['invalidimg']);
 		
 		if (mb_strpos($post['file_url'], '?') !== false)
-- 
cgit v1.3


From 00833eeafd6e0f71390504ac10ddf86bbaceb39f Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 15 Sep 2013 14:03:27 +1000
Subject: js/ajax.js: post with ajax

---
 inc/config.php    |  1 +
 inc/display.php   |  8 +++++
 js/ajax.js        | 93 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 js/quick-reply.js |  9 +++++-
 post.php          | 10 +++++-
 5 files changed, 119 insertions(+), 2 deletions(-)
 create mode 100644 js/ajax.js

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index e1929766..e6856341 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -272,6 +272,7 @@
 		'quick-reply',
 		'page',
 		'file_url',
+		'json_response',
 	);
 
 	// Enable reCaptcha to make spam even harder. Rarely necessary.
diff --git a/inc/display.php b/inc/display.php
index e2646c60..7cd69134 100644
--- a/inc/display.php
+++ b/inc/display.php
@@ -74,6 +74,14 @@ function error($message, $priority = true, $debug_stuff = false) {
 		$debug_stuff = array_combine(array('SQLSTATE', 'Error code', 'Error message'), $db_error);
 	}
 	
+	// Is there a reason to disable this?
+	if (isset($_POST['json_response'])) {
+		header('Content-Type: text/json; charset=utf-8');
+		die(json_encode(array(
+			'error' => $message
+		)));
+	}
+	
 	die(Element('page.html', array(
 		'config' => $config,
 		'title' => _('Error'),
diff --git a/js/ajax.js b/js/ajax.js
new file mode 100644
index 00000000..d29f8fc7
--- /dev/null
+++ b/js/ajax.js
@@ -0,0 +1,93 @@
+/*
+ * ajax.js
+ * https://github.com/savetheinternet/Tinyboard/blob/master/js/ajax.js
+ *
+ * Released under the MIT license
+ * Copyright (c) 2013 Michael Save <savetheinternet@tinyboard.org>
+ *
+ * Usage:
+ *   $config['additional_javascript'][] = 'js/jquery.min.js';
+ *   $config['additional_javascript'][] = 'js/ajax.js';
+ *
+ */
+
+$(window).ready(function() {
+	var setup_form = function($form) {
+		$form.submit(function() {
+			var form = this;
+			var submit_txt = $(this).find('input[type="submit"]').val();
+			if (typeof FormData == 'undefined')
+				return true;
+			
+			var formData = new FormData(this);
+			formData.append('json_response', '1');
+
+			var updateProgress = function(e) {
+				$(form).find('input[type="submit"]').val(_('Posting... (#%)').replace('#', Math.round(e.position / e.total * 100)));
+			};
+
+			$.ajax({
+				url: this.action,
+				type: 'POST',
+				xhr: function() {
+					var xhr = $.ajaxSettings.xhr();
+					if(xhr.upload) {
+						xhr.upload.addEventListener('progress', updateProgress, false);
+					}
+					return xhr;
+				},
+				success: function(post_response) {
+					if (post_response.error) {
+						alert(post_response.error);
+						$(form).find('input[type="submit"]').val(submit_txt);
+						$(form).find('input[type="submit"]').removeAttr('disabled');
+					} else if (post_response.redirect && post_response.id) {
+						$.ajax({
+							url: post_response.redirect,
+							success: function(data) {
+								console.log(data);
+								$(data).find('div.post.reply').each(function() {
+									var id = $(this).attr('id');
+									if($('#' + id).length == 0) {
+										$(this).insertAfter($('div.post:last').next()).after('<br class="clear">');
+										$(document).trigger('new_post', this);
+									}
+								});
+								highlightReply(post_response.id);
+								document.location = '#' + post_response.id;
+								
+								$(form).find('input[type="submit"]').val(submit_txt);
+								$(form).find('input[type="submit"]').removeAttr('disabled');
+							}
+						}, 'html');
+						
+						$(form).find('input[type="submit"]').val('Posted...');
+					} else {
+						alert(_('An unknown error occured when posting!'));
+						$(form).find('input[type="submit"]').val(submit_txt);
+						$(form).find('input[type="submit"]').removeAttr('disabled');
+					}
+				},
+				error: function(xhr, status, er) {
+					// An error occured
+					// TODO
+					console.log('Error');
+				},
+				// Form data
+				data: formData,
+				cache: false,
+				contentType: false,
+				processData: false
+			}, 'html');
+			
+			$(form).find('input[type="submit"]').val(_('Posting...'));
+			$(form).find('input[type="submit"]').attr('disabled', true);
+			
+			return false;
+		});
+	};
+	setup_form($('form[name="post"]'));
+	$(window).on('quick-reply', function(e, quickForm) {
+		setup_form($('form#quick-reply'));
+	});
+});
diff --git a/js/quick-reply.js b/js/quick-reply.js
index 824286f6..5f81f51e 100644
--- a/js/quick-reply.js
+++ b/js/quick-reply.js
@@ -123,6 +123,9 @@ var show_quick_reply = function(){
 			}
 
 			// Move anti-spam nonsense and remove <th>
+			$th.contents().filter(function() {
+				return this.nodeType == 3; // Node.TEXT_NODE
+			}).remove();
 			$th.contents().appendTo($dummyStuff);
 			$th.remove();
 
@@ -180,7 +183,9 @@ var show_quick_reply = function(){
 	});
 	
 	$postForm.find('textarea[name="body"]').removeAttr('id').removeAttr('cols').attr('placeholder', _('Comment'));
-	
+
+	$postForm.find('textarea:not([name="body"]),input[type="hidden"]').appendTo($dummyStuff);
+
 	$postForm.find('br').remove();
 	$postForm.find('table').prepend('<tr><th colspan="2">' + _('Quick Reply') + '</th></tr>');
 	
@@ -232,6 +237,8 @@ var show_quick_reply = function(){
 	}
 
 	$postForm.show();
+	$(window).trigger('quick-reply');
+	
 	$origPostForm = $('form[name="post"]');
 
 	$(window).ready(function() {
diff --git a/post.php b/post.php
index 1fe3b35f..0bc26f46 100644
--- a/post.php
+++ b/post.php
@@ -743,7 +743,15 @@ if (isset($_POST['delete'])) {
 	else
 		rebuildThemes('post', $board['uri']);
 	
-	header('Location: ' . $redirect, true, $config['redirect_http']);
+	if (!isset($_POST['json_response'])) {
+		header('Location: ' . $redirect, true, $config['redirect_http']);
+	} else {
+		header('Content-Type: text/json; charset=utf-8');
+		echo json_encode(array(
+			'redirect' => $redirect,
+			'id' => $id
+		));
+	}
 } else {
 	if (!file_exists($config['has_installed'])) {
 		header('Location: install.php', true, $config['redirect_http']);
-- 
cgit v1.3


From 3e57bb04d7b8fc62761c0fa50b4d062701b1a82a Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Tue, 17 Sep 2013 09:15:24 +1000
Subject: Begin upgrade to much better bans table. DO NOT PULL YET; It won't
 work.

---
 inc/config.php              | 12 +-----
 inc/database.php            |  2 +-
 inc/filters.php             | 44 +++-----------------
 inc/functions.php           | 66 +++++++++---------------------
 inc/mod/ban.php             | 99 +--------------------------------------------
 inc/mod/config-editor.php   |  6 +++
 inc/mod/pages.php           | 64 +++++++----------------------
 install.php                 | 57 +++++++++++++++++++++++++-
 js/ajax.js                  | 21 ++++++++--
 templates/banned.html       |  2 +-
 templates/mod/ban_list.html | 12 +++---
 templates/mod/view_ip.html  |  4 +-
 12 files changed, 132 insertions(+), 257 deletions(-)

(limited to 'inc/config.php')

diff --git a/inc/config.php b/inc/config.php
index e6856341..d7bb8ecc 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1052,8 +1052,8 @@
  * ====================
  */
 
-	// Limit how many bans can be removed via the ban list. Set to -1 for no limit.
-	$config['mod']['unban_limit'] = -1;
+	// Limit how many bans can be removed via the ban list. Set to false (or zero) for no limit.
+	$config['mod']['unban_limit'] = false;
 
 	// Whether or not to lock moderator sessions to IP addresses. This makes cookie theft ineffective.
 	$config['mod']['lock_ip'] = true;
@@ -1098,14 +1098,6 @@
 	//	'color:red;font-weight:bold' // Change tripcode style; optional
 	//);
 
-	// Enable IP range bans (eg. "127.*.0.1", "127.0.0.*", and "12*.0.0.1" all match "127.0.0.1"). Puts a
-	// little more load on the database
-	$config['ban_range'] = true;
-
-	// Enable CDIR netmask bans (eg. "10.0.0.0/8" for 10.0.0.0.0 - 10.255.255.255). Useful for stopping
-	// persistent spammers and ban evaders. Again, a little more database load.
-	$config['ban_cidr'] = true;
-
 	// How often (minimum) to purge the ban list of expired bans (which have been seen). Only works when
 	//  $config['cache'] is enabled and working.
 	$config['purge_bans'] = 60 * 60 * 12; // 12 hours
diff --git a/inc/database.php b/inc/database.php
index 861d4c1e..84a050f2 100644
--- a/inc/database.php
+++ b/inc/database.php
@@ -22,7 +22,7 @@ class PreparedQueryDebug {
 		
 		if ($config['debug'] && $function == 'execute') {
 			if ($this->explain_query) {
-				$this->explain_query->execute() or error(db_error($explain_query));
+				$this->explain_query->execute() or error(db_error($this->explain_query));
 			}
 			$start = microtime(true);
 		}
diff --git a/inc/filters.php b/inc/filters.php
index aa6f9025..f06154ba 100644
--- a/inc/filters.php
+++ b/inc/filters.php
@@ -120,47 +120,13 @@ class Filter {
 				if (!isset($this->reason))
 					error('The ban action requires a reason.');
 				
-				$reason = $this->reason;
+				$this->expires = isset($this->expires) ? $this->expires : false;
+				$this->reject = isset($this->reject) ? $this->reject : true;
+				$this->all_boards = isset($this->all_boards) ? $this->all_boards : false;
 				
-				if (isset($this->expires))
-					$expires = time() + $this->expires;
-				else
-					$expires = 0; // Ban indefinitely
+				Bans::new_ban($_SERVER['REMOTE_ADDR'], $this->reason, $this->expires, $this->all_boards ? false : $board['uri'], -1);
 				
-				if (isset($this->reject))
-					$reject = $this->reject;
-				else
-					$reject = true;
-				
-				if (isset($this->all_boards))
-					$all_boards = $this->all_boards;
-				else
-					$all_boards = false;
-				
-				$query = prepare("INSERT INTO ``bans`` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board, 0)");
-				$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
-				$query->bindValue(':mod', -1);
-				$query->bindValue(':set', time());
-				
-				if ($expires)
-					$query->bindValue(':expires', $expires);
-				else
-					$query->bindValue(':expires', null, PDO::PARAM_NULL);
-				
-				if ($reason)
-					$query->bindValue(':reason', $reason);
-				else
-					$query->bindValue(':reason', null, PDO::PARAM_NULL);
-				
-				
-				if ($all_boards)
-					$query->bindValue(':board', null, PDO::PARAM_NULL);
-				else
-					$query->bindValue(':board', $board['uri']);
-				
-				$query->execute() or error(db_error($query));
-				
-				if ($reject) {
+				if ($this->reject) {
 					if (isset($this->message))
 						error($message);
 					
diff --git a/inc/functions.php b/inc/functions.php
index 4cbd8625..f7421f68 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -18,6 +18,7 @@ require_once 'inc/template.php';
 require_once 'inc/database.php';
 require_once 'inc/events.php';
 require_once 'inc/api.php';
+require_once 'inc/bans.php';
 require_once 'inc/lib/gettext/gettext.inc';
 
 // the user is not currently logged in as a moderator
@@ -619,9 +620,7 @@ function displayBan($ban) {
 	global $config;
 
 	if (!$ban['seen']) {
-		$query = prepare("UPDATE ``bans`` SET `seen` = 1 WHERE `id` = :id");
-		$query->bindValue(':id', $ban['id'], PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
+		Bans::seen($ban['id']);
 	}
 
 	$ban['ip'] = $_SERVER['REMOTE_ADDR'];
@@ -650,62 +649,37 @@ function checkBan($board = false) {
 	if (event('check-ban', $board))
 		return true;
 	
-	$query_where = array();
-	// Simple ban
-	$query_where[] = "`ip` = :ip";
-	// Range ban
-	if ($config['ban_range'])
-		$query_where[] = ":ip LIKE REPLACE(REPLACE(`ip`, '%', '!%'), '*', '%') ESCAPE '!'";
-	// Subnet mask ban
-	if ($config['ban_cidr'] && !isIPv6())
-		$query_where[] = "(					
-			`ip` REGEXP '^(\[0-9]+\.\[0-9]+\.\[0-9]+\.\[0-9]+\)\/(\[0-9]+)$'
-				AND
-			:iplong >= INET_ATON(SUBSTRING_INDEX(`ip`, '/', 1))
-				AND
-			:iplong < INET_ATON(SUBSTRING_INDEX(`ip`, '/', 1)) + POW(2, 32 - SUBSTRING_INDEX(`ip`, '/', -1))
-		)";
-	
-	$query = prepare('SELECT * FROM ``bans`` WHERE (`board` IS NULL' . ($board ? ' OR `board` = :board' : '') .
-		') AND (' . implode(' OR ', $query_where) . ') ORDER BY `expires` IS NULL, `expires` DESC');
-	if ($board)
-		$query->bindValue(':board', $board);
-	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
-	if ($config['ban_cidr'] && !isIPv6())
-		$query->bindValue(':iplong', ip2long($_SERVER['REMOTE_ADDR']));
-	$query->execute() or error(db_error($query));
+	$bans = Bans::find($_SERVER['REMOTE_ADDR'], $board);
 	
-	while ($ban = $query->fetch(PDO::FETCH_ASSOC)) {
+	foreach ($bans as &$ban) {
 		if ($ban['expires'] && $ban['expires'] < time()) {
-			// Ban expired
-			$query = prepare("DELETE FROM ``bans`` WHERE `id` = :id");
-			$query->bindValue(':id', $ban['id'], PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-
+			Bans::delete($ban['id']);
 			if ($config['require_ban_view'] && !$ban['seen']) {
-				displayBan($ban);
+				if (!isset($_POST['json_response'])) {
+					displayBan($ban);
+				} else {
+					header('Content-Type: text/json');
+					die(json_encode(array('error' => true, 'banned' => true)));
+				}
 			}
 		} else {
-			displayBan($ban);
+			if (!isset($_POST['json_response'])) {
+				displayBan($ban);
+			} else {
+				header('Content-Type: text/json');
+				die(json_encode(array('error' => true, 'banned' => true)));
+			}
 		}
 	}
 
-	// I'm not sure where else to put this. It doesn't really matter where; it just needs to be called every now and then to keep the ban list tidy.
-	purge_bans();
-}
-
-// No reason to keep expired bans in the database (except those that haven't been viewed yet)
-function purge_bans() {
-	global $config;
-	
+	// I'm not sure where else to put this. It doesn't really matter where; it just needs to be called every
+	// now and then to keep the ban list tidy.
 	if ($config['cache']['enabled'] && $last_time_purged = cache::get('purged_bans_last')) {
 		if (time() - $last_time_purged < $config['purge_bans'] )
 			return;
 	}
 	
-	$query = prepare("DELETE FROM ``bans`` WHERE `expires` IS NOT NULL AND `expires` < :time AND `seen` = 1");
-	$query->bindValue(':time', time());
-	$query->execute() or error(db_error($query));
+	Bans::purge();
 	
 	if ($config['cache']['enabled'])
 		cache::set('purged_bans_last', time());
diff --git a/inc/mod/ban.php b/inc/mod/ban.php
index 71173326..82260585 100644
--- a/inc/mod/ban.php
+++ b/inc/mod/ban.php
@@ -4,102 +4,7 @@
  *  Copyright (c) 2010-2013 Tinyboard Development Group
  */
 
-if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) {
-	// You cannot request this file directly.
-	exit;
-}
+defined('TINYBOARD') or exit;
 
-function parse_time($str) {
-	if (empty($str))
-		return false;
-	
-	if (($time = @strtotime($str)) !== false)
-		return $time;
-	
-	if (!preg_match('/^((\d+)\s?ye?a?r?s?)?\s?+((\d+)\s?mon?t?h?s?)?\s?+((\d+)\s?we?e?k?s?)?\s?+((\d+)\s?da?y?s?)?((\d+)\s?ho?u?r?s?)?\s?+((\d+)\s?mi?n?u?t?e?s?)?\s?+((\d+)\s?se?c?o?n?d?s?)?$/', $str, $matches))
-		return false;
-	
-	$expire = 0;
-	
-	if (isset($matches[2])) {
-		// Years
-		$expire += $matches[2]*60*60*24*365;
-	}
-	if (isset($matches[4])) {
-		// Months
-		$expire += $matches[4]*60*60*24*30;
-	}
-	if (isset($matches[6])) {
-		// Weeks
-		$expire += $matches[6]*60*60*24*7;
-	}
-	if (isset($matches[8])) {
-		// Days
-		$expire += $matches[8]*60*60*24;
-	}
-	if (isset($matches[10])) {
-		// Hours
-		$expire += $matches[10]*60*60;
-	}
-	if (isset($matches[12])) {
-		// Minutes
-		$expire += $matches[12]*60;
-	}
-	if (isset($matches[14])) {
-		// Seconds
-		$expire += $matches[14];
-	}
-	
-	return time() + $expire;
-}
-
-function ban($mask, $reason, $length, $board) {
-	global $mod, $pdo;
-	
-	$query = prepare("INSERT INTO ``bans`` VALUES (NULL, :ip, :mod, :time, :expires, :reason, :board, 0)");
-	$query->bindValue(':ip', $mask);
-	$query->bindValue(':mod', $mod['id']);
-	$query->bindValue(':time', time());
-	if ($reason !== '') {
-		$reason = escape_markup_modifiers($reason);
-		markup($reason);
-		$query->bindValue(':reason', $reason);
-	} else
-		$query->bindValue(':reason', null, PDO::PARAM_NULL);
-	
-	if ($length > 0)
-		$query->bindValue(':expires', $length);
-	else
-		$query->bindValue(':expires', null, PDO::PARAM_NULL);
-	
-	if ($board)
-		$query->bindValue(':board', $board);
-	else
-		$query->bindValue(':board', null, PDO::PARAM_NULL);
-	
-	$query->execute() or error(db_error($query));
-	
-	modLog('Created a new ' .
-		($length > 0 ? preg_replace('/^(\d+) (\w+?)s?$/', '$1-$2', until($length)) : 'permanent') .
-		' ban on ' .
-		($board ? '/' . $board . '/' : 'all boards') .
-		' for ' .
-		(filter_var($mask, FILTER_VALIDATE_IP) !== false ? "<a href=\"?/IP/$mask\">$mask</a>" : utf8tohtml($mask)) .
-		' (<small>#' . $pdo->lastInsertId() . '</small>)' .
-		' with ' . ($reason ? 'reason: ' . utf8tohtml($reason) . '' : 'no reason'));
-}
-
-function unban($id) {
-	$query = prepare("SELECT `ip` FROM ``bans`` WHERE `id` = :id");
-	$query->bindValue(':id', $id);
-	$query->execute() or error(db_error($query));
-	$mask = $query->fetchColumn();
-		
-	$query = prepare("DELETE FROM ``bans`` WHERE `id` = :id");
-	$query->bindValue(':id', $id);
-	$query->execute() or error(db_error($query));
-	
-	if ($mask)
-		modLog("Removed ban #{$id} for " . (filter_var($mask, FILTER_VALIDATE_IP) !== false ? "<a href=\"?/IP/$mask\">$mask</a>" : utf8tohtml($mask)));
-}
 
+// This file is no longer used.
diff --git a/inc/mod/config-editor.php b/inc/mod/config-editor.php
index 4493fd2b..0f6dbc9a 100644
--- a/inc/mod/config-editor.php
+++ b/inc/mod/config-editor.php
@@ -1,5 +1,11 @@
 <?php
 
+/*
+ *  Copyright (c) 2010-2013 Tinyboard Development Group
+ */
+
+defined('TINYBOARD') or exit;
+
 function permission_to_edit_config_var($varname) {
 	global $config, $mod;
 
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index 69cb046d..0b9c92a1 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -289,7 +289,7 @@ function mod_search($type, $search_query_escaped, $page_no = 1) {
 	}
 	
 	if ($type == 'bans') {
-		$query = 'SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE ' . $sql_like . ' ORDER BY (`expires` IS NOT NULL AND `expires` < UNIX_TIMESTAMP()), `set` DESC';
+		$query = 'SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE ' . $sql_like . ' ORDER BY (`expires` IS NOT NULL AND `expires` < UNIX_TIMESTAMP()), `created` DESC';
 		$sql_table = 'bans';
 		if (!hasPermission($config['mod']['view_banlist']))
 			error($config['error']['noaccess']);
@@ -740,9 +740,7 @@ function mod_page_ip($ip) {
 		if (!hasPermission($config['mod']['unban']))
 			error($config['error']['noaccess']);
 		
-		require_once 'inc/mod/ban.php';
-		
-		unban($_POST['ban_id']);
+		Bans::delete($_POST['ban_id'], true);
 		
 		header('Location: ?/IP/' . $ip . '#bans', true, $config['redirect_http']);
 		return;
@@ -801,10 +799,7 @@ function mod_page_ip($ip) {
 	$args['token'] = make_secure_link_token('ban');
 	
 	if (hasPermission($config['mod']['view_ban'])) {
-		$query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `ip` = :ip ORDER BY `set` DESC");
-		$query->bindValue(':ip', $ip);
-		$query->execute() or error(db_error($query));
-		$args['bans'] = $query->fetchAll(PDO::FETCH_ASSOC);
+		$args['bans'] = Bans::find($ip, false, true);
 	}
 	
 	if (hasPermission($config['mod']['view_notes'])) {
@@ -839,7 +834,7 @@ function mod_ban() {
 	
 	require_once 'inc/mod/ban.php';
 	
-	ban($_POST['ip'], $_POST['reason'], parse_time($_POST['length']), $_POST['board'] == '*' ? false : $_POST['board']);
+	Bans::new_ban($_POST['ip'], $_POST['reason'], $_POST['length'], $_POST['board'] == '*' ? false : $_POST['board']);
 	
 	if (isset($_POST['redirect']))
 		header('Location: ' . $_POST['redirect'], true, $config['redirect_http']);
@@ -865,58 +860,27 @@ function mod_bans($page_no = 1) {
 			if (preg_match('/^ban_(\d+)$/', $name, $match))
 				$unban[] = $match[1];
 		}
-		if (isset($config['mod']['unban_limit'])){
-		if (count($unban) <= $config['mod']['unban_limit'] || $config['mod']['unban_limit'] == -1){ 
-		if (!empty($unban)) {
-			query('DELETE FROM ``bans`` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error());
+		if (isset($config['mod']['unban_limit']) && $config['mod']['unban_limit'] && count($unban) > $config['mod']['unban_limit'])
+			error(sprintf($config['error']['toomanyunban'], $config['mod']['unban_limit'], count($unban)));
 		
-			foreach ($unban as $id) {
-				modLog("Removed ban #{$id}");
-			}
+		foreach ($unban as $id) {
+			Bans::delete($id, true);
 		}
-		} else {
-		error(sprintf($config['error']['toomanyunban'], $config['mod']['unban_limit'], count($unban) ));
-		}
-		
-	} else {
-		
-			if (!empty($unban)) {
-			query('DELETE FROM ``bans`` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error());
-		
-			foreach ($unban as $id) {
-				modLog("Removed ban #{$id}");
-			}
-		}	
-		
-	}
 		header('Location: ?/bans', true, $config['redirect_http']);
+		return;
 	}
 	
-	if ($config['mod']['view_banexpired']) {
-		$query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC LIMIT :offset, :limit");
-	} else {
-		// Filter out expired bans
-		$query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` INNER JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC LIMIT :offset, :limit");
-	}
-	$query->bindValue(':time', time(), PDO::PARAM_INT);
-	$query->bindValue(':limit', $config['mod']['banlist_page'], PDO::PARAM_INT);
-	$query->bindValue(':offset', ($page_no - 1) * $config['mod']['banlist_page'], PDO::PARAM_INT);
-	$query->execute() or error(db_error($query));
-	$bans = $query->fetchAll(PDO::FETCH_ASSOC);
+	$bans = Bans::list_all(($page_no - 1) * $config['mod']['banlist_page'], $config['mod']['banlist_page']);
 	
 	if (empty($bans) && $page_no > 1)
 		error($config['error']['404']);
 	
-	$query = prepare("SELECT COUNT(*) FROM ``bans``");
-	$query->execute() or error(db_error($query));
-	$count = $query->fetchColumn();
-	
 	foreach ($bans as &$ban) {
-		if (filter_var($ban['ip'], FILTER_VALIDATE_IP) !== false)
-			$ban['real_ip'] = true;
+		if (filter_var($ban['mask'], FILTER_VALIDATE_IP) !== false)
+			$ban['single_addr'] = true;
 	}
 	
-	mod_page(_('Ban list'), 'mod/ban_list.html', array('bans' => $bans, 'count' => $count));
+	mod_page(_('Ban list'), 'mod/ban_list.html', array('bans' => $bans, 'count' => Bans::count()));
 }
 
 
@@ -1217,7 +1181,7 @@ function mod_ban_post($board, $delete, $post, $token = false) {
 		if (isset($_POST['ip']))
 			$ip = $_POST['ip'];
 		
-		ban($ip, $_POST['reason'], parse_time($_POST['length']), $_POST['board'] == '*' ? false : $_POST['board']);
+		Bans::new_ban($_POST['ip'], $_POST['reason'], $_POST['length'], $_POST['board'] == '*' ? false : $_POST['board']);
 		
 		if (isset($_POST['public_message'], $_POST['message'])) {
 			// public ban message
diff --git a/install.php b/install.php
index 639a90c9..69be6300 100644
--- a/install.php
+++ b/install.php
@@ -1,7 +1,7 @@
 <?php
 
 // Installation/upgrade file	
-define('VERSION', 'v0.9.6-dev-20');
+define('VERSION', 'v0.9.6-dev-21');
 
 require 'inc/functions.php';
 
@@ -412,6 +412,61 @@ if (file_exists($config['has_installed'])) {
 			query("UPDATE ``mods`` SET `type` = 20 WHERE `type` = 1") or error(db_error());
 			query("UPDATE ``mods`` SET `type` = 30 WHERE `type` = 2") or error(db_error());
 			query("ALTER TABLE ``mods`` CHANGE `type`  `type` smallint(1) NOT NULL") or error(db_error());
+		case 'v0.9.6-dev-20':
+			query("CREATE TABLE IF NOT EXISTS `bans_new_temp` (
+				`id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+				`ipstart` varbinary(16) NOT NULL,
+				`ipend` varbinary(16) DEFAULT NULL,
+				`created` int(10) unsigned NOT NULL,
+				`expires` int(10) unsigned DEFAULT NULL,
+				`board` varchar(58) DEFAULT NULL,
+				`creator` int(10) NOT NULL,
+				`reason` text,
+				`seen` tinyint(1) NOT NULL,
+				`post` blob,
+				PRIMARY KEY (`id`),
+				KEY `expires` (`expires`),
+				KEY `ipstart` (`ipstart`,`ipend`)
+				) ENGINE=MyISAM  DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=1") or error(db_error());
+			$listquery = query("SELECT * FROM ``bans`` ORDER BY `id`") or error(db_error());
+			while ($ban = $listquery->fetch(PDO::FETCH_ASSOC)) {
+				$query = prepare("INSERT INTO ``bans_new_temp`` VALUES 
+					(NULL, :ipstart, :ipend, :created, :expires, :board, :creator, :reason, :seen, NULL)");
+				
+				$range = Bans::parse_range($ban['ip']);
+				if ($range === false) {
+					// Invalid retard ban; just skip it.
+					continue;
+				}
+				
+				$query->bindValue(':ipstart', $range[0]);
+				if ($range[1] !== false && $range[1] != $range[0])
+					$query->bindValue(':ipend', $range[1]);
+				else
+					$query->bindValue(':ipend', null, PDO::PARAM_NULL);
+				
+				$query->bindValue(':created', $ban['set']);
+				
+				if ($ban['expires'])
+					$query->bindValue(':expires', $ban['expires']);
+				else
+					$query->bindValue(':expires', null, PDO::PARAM_NULL);
+				
+				if ($ban['board'])
+					$query->bindValue(':board', $ban['board']);
+				else
+					$query->bindValue(':board', null, PDO::PARAM_NULL);
+				
+				$query->bindValue(':creator', $ban['mod']);
+				
+				if ($ban['reason'])
+					$query->bindValue(':reason', $ban['reason']);
+				else
+					$query->bindValue(':reason', null, PDO::PARAM_NULL);
+				
+				$query->bindValue(':seen', $ban['seen']);
+				$query->execute() or error(db_error($query));
+			}
 		case false:
 			// Update version number
 			file_write($config['has_installed'], VERSION);
diff --git a/js/ajax.js b/js/ajax.js
index a063890b..74cfe9c0 100644
--- a/js/ajax.js
+++ b/js/ajax.js
@@ -43,9 +43,23 @@ $(window).ready(function() {
 				},
 				success: function(post_response) {
 					if (post_response.error) {
-						alert(post_response.error);
-						$(form).find('input[type="submit"]').val(submit_txt);
-						$(form).find('input[type="submit"]').removeAttr('disabled');
+						if (post_response.banned) {
+							// You are banned. Must post the form normally so the user can see the ban message.
+							do_not_ajax = true;
+							$(form).find('input[type="submit"]').each(function() {
+								var $replacement = $('<input type="hidden">');
+								$replacement.attr('name', $(this).attr('name'));
+								$replacement.val(submit_txt);
+								$(this)
+									.after($replacement)
+									.replaceWith($('<input type="button">').val(submit_txt));
+							});
+							$(form).submit();
+						} else {
+							alert(post_response.error);
+							$(form).find('input[type="submit"]').val(submit_txt);
+							$(form).find('input[type="submit"]').removeAttr('disabled');
+						}
 					} else if (post_response.redirect && post_response.id) {
 						if (!$(form).find('input[name="thread"]').length) {
 							document.location = post_response.redirect;
@@ -84,7 +98,6 @@ $(window).ready(function() {
 				},
 				error: function(xhr, status, er) {
 					// An error occured
-					// TODO
 					do_not_ajax = true;
 					$(form).find('input[type="submit"]').each(function() {
 						var $replacement = $('<input type="hidden">');
diff --git a/templates/banned.html b/templates/banned.html
index a4498cf5..065d61e2 100644
--- a/templates/banned.html
+++ b/templates/banned.html
@@ -30,7 +30,7 @@
 	{% endif %}
 	<p>
 		{% trans %}Your ban was filed on{% endtrans %} 
-			<strong>{{ ban.set|date(config.ban_date) }}</strong> {% trans %}and{% endtrans %} <span id="expires">
+			<strong>{{ ban.created|date(config.ban_date) }}</strong> {% trans %}and{% endtrans %} <span id="expires">
 		{% if ban.expires and time() >= ban.expires %}
 			{% trans %} has since expired. Refresh the page to continue.{%  endtrans %}
 		{% elseif ban.expires %}
diff --git a/templates/mod/ban_list.html b/templates/mod/ban_list.html
index f8826ade..83674544 100644
--- a/templates/mod/ban_list.html
+++ b/templates/mod/ban_list.html
@@ -17,10 +17,10 @@
 				<tr{% if ban.expires != 0 and ban.expires < time() %} style="text-decoration:line-through"{% endif %}>
 					<td style="white-space: nowrap">
 						<input type="checkbox" name="ban_{{ ban.id }}"> 
-						{% if ban.real_ip %}
-							<a href="?/IP/{{ ban.ip }}">{{ ban.ip }}</a>
+						{% if ban.single_addr %}
+							<a href="?/IP/{{ ban.mask }}">{{ ban.mask }}</a>
 						{% else %}
-							{{ ban.ip|e }}
+							{{ ban.mask }}
 						{% endif %}
 					</td>
 					<td>
@@ -38,8 +38,8 @@
 						{% endif %}					
 					</td>
 					<td style="white-space: nowrap">
-						<span title="{{ ban.set|date(config.post_date) }}">
-							{{ ban.set|ago }} ago
+						<span title="{{ ban.created|date(config.post_date) }}">
+							{{ ban.created|ago }} ago
 						</span>
 					</td>
 					<td style="white-space: nowrap">
@@ -77,7 +77,7 @@
 							
 								{% endif %}
 							{% endif %}
-						{% elseif ban.mod == -1 %}
+						{% elseif ban.creator == -1 %}
 							<em>system</em>
 						{% else %}
 							<em>{% trans 'deleted?' %}</em>
diff --git a/templates/mod/view_ip.html b/templates/mod/view_ip.html
index e2dad7af..f73c5d5a 100644
--- a/templates/mod/view_ip.html
+++ b/templates/mod/view_ip.html
@@ -100,7 +100,7 @@
 					</tr>
 					<tr>
 						<th>{% trans 'IP' %}</th>
-						<td>{{ ban.ip }}</td>
+						<td>{{ ban.mask }}</td>
 					</tr>
 					<tr>
 						<th>{% trans 'Reason' %}</th>
@@ -124,7 +124,7 @@
 					</tr>
 					<tr>
 						<th>{% trans 'Set' %}</th>
-						<td>{{ ban.set|date(config.post_date) }}</td>
+						<td>{{ ban.created|date(config.post_date) }}</td>
 					</tr>
 					<tr>
 						<th>{% trans 'Expires' %}</th>
-- 
cgit v1.3