From c9423a2c34a5b93bf9cf2c506acca713781e60b6 Mon Sep 17 00:00:00 2001 From: Michael Save Date: Thu, 12 Apr 2012 02:49:22 +1000 Subject: large cleanup --- mod.php | 5506 +++++++++++++++++++++++++++++++-------------------------------- 1 file changed, 2753 insertions(+), 2753 deletions(-) (limited to 'mod.php') diff --git a/mod.php b/mod.php index a51ac227..d4b55655 100644 --- a/mod.php +++ b/mod.php @@ -1,838 +1,753 @@ str_replace('%s', '(\w{1,8})', preg_quote($config['board_path'], '/')), + 'page' => str_replace('%d', '(\d+)', preg_quote($config['file_page'], '/')), + 'img' => preg_quote($config['dir']['img'], '/'), + 'thumb' => preg_quote($config['dir']['thumb'], '/'), + 'res' => preg_quote($config['dir']['res'], '/'), + 'index' => preg_quote($config['file_index'], '/') + ); - // If not logged in - if(!$mod) { - if(isset($_POST['login'])) { - // Check if inputs are set and not empty - if( !isset($_POST['username']) || - !isset($_POST['password']) || - empty($_POST['username']) || - empty($_POST['password']) - ) loginForm($config['error']['invalid'], $_POST['username'], '?' . $query); + if(preg_match('/^\/?$/', $query)) { + // Dashboard + $fieldset = array( + 'Boards' => '', + 'Noticeboard' => '', + 'Administration' => '', + 'Themes' => '', + 'Search' => '', + 'Update' => '', + 'Logout' => '' + ); + + // Boards + $fieldset['Boards'] .= ulBoards(); + + if(hasPermission($config['mod']['noticeboard'])) { + if(!$config['cache']['enabled'] || !($fieldset['Noticeboard'] = cache::get('noticeboard_preview'))) { + $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); + $query->bindValue(':limit', $config['mod']['noticeboard_dashboard'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $fieldset['Noticeboard'] .= '
  • '; - if(!login($_POST['username'], $_POST['password'])) { - if($config['syslog']) - _syslog(LOG_WARNING, 'Unauthorized login attempt!'); - loginForm($config['error']['invalid'], $_POST['username'], '?' . $query); + $_body = ''; + while($notice = $query->fetch()) { + $_body .= '
  • ' . + ($notice['subject'] ? + $notice['subject'] + : + '' . _('no subject') . '' + ) . + ' — by ' . + (isset($notice['username']) ? + utf8tohtml($notice['username']) + : '???') . + ' at ' . + strftime($config['post_date'], $notice['time']) . + '
    • '; + } + if(!empty($_body)) { + $fieldset['Noticeboard'] .= '
  • '; + } + if($config['cache']['enabled']) + cache::set('noticeboard_preview', $fieldset['Noticeboard']); } - modLog("Logged in."); - - // Login successful - // Set cookies - setCookies(); - - // Redirect - if(isset($_POST['redirect'])) - header('Location: ' . $_POST['redirect'], true, $config['redirect_http']); - else - header('Location: ?' . $config['mod']['default'], true, $config['redirect_http']); - } else { - loginForm(false, false, '?' . $query); + $fieldset['Noticeboard'] .= '' . _('View all entries') . '
    • '; + + $query = prepare("SELECT COUNT(*) AS `count` FROM `pms` WHERE `to` = :id AND `unread` = 1"); + $query->bindValue(':id', $mod['id']); + $query->execute() or error(db_error($query)); + $count = $query->fetch(); + $count = $count['count']; + + $fieldset['Noticeboard'] .= '
  • ' . _('PM Inbox') . + ($count > 0 + ? + ' (' . $count . ' unread)' + : '') . + '
    • '; + + $fieldset['Noticeboard'] .= '
  • ' . _('News') . '
    • '; } - } else { - // Redirect (for index pages) - if(count($_GET) == 2 && isset($_GET['status']) && isset($_GET['r'])) { - header('Location: ' . $_GET['r'], true, $_GET['status']); - exit; + + + if(hasPermission($config['mod']['reports'])) { + $fieldset['Administration'] .= '
  • ' . _('Report queue') . '
    • '; + } + if(hasPermission($config['mod']['view_banlist'])) { + $fieldset['Administration'] .= '
  • ' . _('Ban list') . '
    • '; + } + if(hasPermission($config['mod']['manageusers'])) { + $fieldset['Administration'] .= '
  • ' . _('Manage users') . '
    • '; + } elseif(hasPermission($config['mod']['change_password'])) { + $fieldset['Administration'] .= '
  • ' . _('Change own password') . '
    • '; + } + if(hasPermission($config['mod']['modlog'])) { + $fieldset['Administration'] .= '
  • ' . _('Moderation log') . '
    • '; + } + if(hasPermission($config['mod']['rebuild'])) { + $fieldset['Administration'] .= '
  • ' . _('Rebuild static files') . '
    • '; + } + if(hasPermission($config['mod']['rebuild']) && $config['cache']['enabled']) { + $fieldset['Administration'] .= '
  • ' . _('Clear cache') . '
    • '; + } + if(hasPermission($config['mod']['show_config'])) { + $fieldset['Administration'] .= '
  • ' . _('Show configuration') . '
    • '; } - // A sort of "cache" - // Stops calling preg_quote and str_replace when not needed; only does it once - $regex = Array( - 'board' => str_replace('%s', '(\w{1,8})', preg_quote($config['board_path'], '/')), - 'page' => str_replace('%d', '(\d+)', preg_quote($config['file_page'], '/')), - 'img' => preg_quote($config['dir']['img'], '/'), - 'thumb' => preg_quote($config['dir']['thumb'], '/'), - 'res' => preg_quote($config['dir']['res'], '/'), - 'index' => preg_quote($config['file_index'], '/') - ); + if(hasPermission($config['mod']['themes'])) { + $fieldset['Themes'] .= '
  • ' . _('Manage themes') . '
    • '; + } - if(preg_match('/^\/?$/', $query)) { - // Dashboard - $fieldset = Array( - 'Boards' => '', - 'Noticeboard' => '', - 'Administration' => '', - 'Themes' => '', - 'Search' => '', - 'Update' => '', - 'Logout' => '' - ); - - // Boards - $fieldset['Boards'] .= ulBoards(); - - if(hasPermission($config['mod']['noticeboard'])) { - if(!$config['cache']['enabled'] || !($fieldset['Noticeboard'] = cache::get('noticeboard_preview'))) { - $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); - $query->bindValue(':limit', $config['mod']['noticeboard_dashboard'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - $fieldset['Noticeboard'] .= '
  • '; + if(hasPermission($config['mod']['search'])) { + $fieldset['Search'] .= '
  • ' . + ' ' . + '' . + '' . + '
    ' . + '

    ' . _('(Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)') . '

    ' . + '
    • '; + } + + if($mod['type'] >= ADMIN && $config['check_updates']) { + if(!$config['version']) + error(_('Could not find current version! (Check .installed)')); + if(isset($_COOKIE['update'])) { + $latest = unserialize($_COOKIE['update']); + } else { + $ctx = stream_context_create(array( + 'http' => array( + 'timeout' => 3 + ) + ) + ); - $_body = ''; - while($notice = $query->fetch()) { - $_body .= '
  • ' . - ($notice['subject'] ? - $notice['subject'] - : - '' . _('no subject') . '' - ) . - ' — by ' . - (isset($notice['username']) ? - utf8tohtml($notice['username']) - : '???') . - ' at ' . - strftime($config['post_date'], $notice['time']) . - '
    • '; - } - if(!empty($_body)) { - $fieldset['Noticeboard'] .= '
  • '; + if($code = @file_get_contents('http://tinyboard.org/version.txt', 0, $ctx)) { + eval($code); + if(preg_match('/v(\d+)\.(\d)\.(\d+)(-dev.+)?$/', $config['version'], $m)) { + $current = array( + 'massive' => (int)$m[1], + 'major' => (int)$m[2], + 'minor' => (int)$m[3] + ); + if(isset($m[4])) { + // Development versions are always ahead in the versioning numbers + $current['minor'] --; + } } - if($config['cache']['enabled']) - cache::set('noticeboard_preview', $fieldset['Noticeboard']); + // Check if it's newer + if( $latest['massive'] > $current['massive'] || + $latest['major'] > $current['major'] || + ($latest['massive'] == $current['massive'] && + $latest['major'] == $current['major'] && + $latest['minor'] > $current['minor'] + )) { + $latest = $latest; + } else $latest = false; + } else { + // Couldn't get latest version + // TODO: Display some sort of warning message + $latest = false; } - $fieldset['Noticeboard'] .= '' . _('View all entries') . '
    • '; - - $query = prepare("SELECT COUNT(*) AS `count` FROM `pms` WHERE `to` = :id AND `unread` = 1"); - $query->bindValue(':id', $mod['id']); - $query->execute() or error(db_error($query)); - $count = $query->fetch(); - $count = $count['count']; + + setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true); + } - $fieldset['Noticeboard'] .= '
  • ' . _('PM Inbox') . - ($count > 0 - ? - ' (' . $count . ' unread)' - : '') . - '
    • '; + if($latest) { + $fieldset['Update'] .= + '
  • A newer version of Tinyboard (v' . + $latest['massive'] . '.' . + $latest['major'] . '.' . + $latest['minor'] . + ') is available! See http://tinyboard.org/ for upgrade instructions.
    • '; + } + } + + $fieldset['Logout'] .= '
  • ' . _('Logout') . '
    • '; + + // TODO: Statistics, etc, in the dashboard. + + $body = ''; + foreach($fieldset as $title => $data) { + if($data) + $body .= '
    ' . _($title) . '
    '; + } + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Dashboard'), + 'body'=>$body, + '__mod'=>true + )); + } elseif(preg_match('/^\/logout$/', $query)) { + destroyCookies(); + + header('Location: ?/', true, $config['redirect_http']); + } elseif(preg_match('/^\/confirm\/(.+)$/', $query, $matches)) { + $uri = &$matches[1]; + + $body = '

    ' . + 'Are you sure you want to do that?' . + 'We were unable to serve a confirmation dialog for ' . + '?/' . utf8tohtml($uri) . '' . + ', probably due to Javascript being disabled.' . + '

    ' . + '

    Confirm

    '; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Confirm', + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/upgrade$/', $query)) { + if($mod['type'] != ADMIN) + error($config['error']['noaccess']); + + if(is_dir('.git')) { + // use git instead - $fieldset['Noticeboard'] .= '
  • ' . _('News') . '
    • '; + $body = '

    git pull

    '; + $body .= '

    ' . str_replace("\n", '
    ', shell_exec('git pull')) . '

    '; + $body .= '
    '; + echo Element('page.html', array( + 'config' => $config, + 'title' => 'Upgraded', + 'body' => $body + )); + exit; + } + + if(!extension_loaded('curl')) + error('You need the cURL PHP extension to do that.'); + + if(!class_exists('ZipArchive')) + error('You need the ZipArchive class to do that.'); + + if(!in_array('zip', stream_get_wrappers())) + error('You need the zip:// stream wrapper to do that.'); + + $temp = tempnam($config['tmp'], 'tinyboard'); + + $fp = fopen($temp, 'w+'); + + $curl = curl_init(); + curl_setopt($curl, CURLOPT_URL, 'https://github.com/savetheinternet/Tinyboard/zipball/master'); + curl_setopt($curl, CURLOPT_FAILONERROR, true); + curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true); + curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, true); + curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2); + curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 5); + curl_setopt($curl, CURLOPT_TIMEOUT, 45); + curl_setopt($curl, CURLOPT_FILE, $fp); + curl_setopt($curl, CURLOPT_WRITEHEADER, $header = tmpfile()); + curl_setopt($curl, CURLOPT_HEADER, true); + + curl_exec($curl); + + if(curl_errno($curl)) + error('Failed downloading newest revision: ' . curl_error($curl)); + + curl_close($curl); + + fflush($fp); + fclose($fp); + + fseek($header, 0); + $version = false; + while($line = fgets($header)) { + if(preg_match('/^Content-Disposition: attachment; filename=savetheinternet-Tinyboard-(.+)\.zip\s?$/', $line, $m)) { + $version = $m[1]; } + } + fclose($header); + + $zip = new ZipArchive(); + if(!$zip->open($temp)) + error('Could not make sense of the ZIP archive.'); + + $version = preg_replace('/^savetheinternet-Tinyboard-(\w+)\//', '$1', $dir = $zip->getNameIndex(0)); + + $errors = array(); + for($i = 1; $i < $zip->numFiles; $i++) { + $filename = str_replace($dir, '', $zip->getNameIndex($i)); + if($filename == 'inc/instance-config.php') + continue; // don't override config - if(hasPermission($config['mod']['reports'])) { - $fieldset['Administration'] .= '
  • ' . _('Report queue') . '
    • '; - } - if(hasPermission($config['mod']['view_banlist'])) { - $fieldset['Administration'] .= '
  • ' . _('Ban list') . '
    • '; - } - if(hasPermission($config['mod']['manageusers'])) { - $fieldset['Administration'] .= '
  • ' . _('Manage users') . '
    • '; - } elseif(hasPermission($config['mod']['change_password'])) { - $fieldset['Administration'] .= '
  • ' . _('Change own password') . '
    • '; + // are we able to write here? + if(!((file_exists($filename) && is_writable($filename)) || (!file_exists($filename) && is_writable(dirname($filename))))) { + // nope + $errors[] = 'Cannot write to ' . $filename . '!'; } - if(hasPermission($config['mod']['modlog'])) { - $fieldset['Administration'] .= '
  • ' . _('Moderation log') . '
    • '; - } - if(hasPermission($config['mod']['rebuild'])) { - $fieldset['Administration'] .= '
  • ' . _('Rebuild static files') . '
    • '; - } - if(hasPermission($config['mod']['rebuild']) && $config['cache']['enabled']) { - $fieldset['Administration'] .= '
  • ' . _('Clear cache') . '
    • '; - } - if(hasPermission($config['mod']['show_config'])) { - $fieldset['Administration'] .= '
  • ' . _('Show configuration') . '
    • '; - } - - if(hasPermission($config['mod']['themes'])) { - $fieldset['Themes'] .= '
  • ' . _('Manage themes') . '
    • '; + } + + $zip->close(); + + if($errors) { + $body = '

    Error(s) upgrading

    Tinyboard can not self-upgrade until the following is fixed:

    Please fix the above errors and refresh to try again.

    '; - if(hasPermission($config['mod']['search'])) { - $fieldset['Search'] .= '
  • ' . - ' ' . - '' . - '' . - '
    ' . - '

    ' . _('(Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)') . '

    ' . - '
    • '; - } + unlink($temp); - if($mod['type'] >= ADMIN && $config['check_updates']) { - if(!$config['version']) - error(_('Could not find current version! (Check .installed)')); - if(isset($_COOKIE['update'])) { - $latest = unserialize($_COOKIE['update']); - } else { - $ctx = stream_context_create(array( - 'http' => array( - 'timeout' => 3 - ) - ) - ); - - if($code = @file_get_contents('http://tinyboard.org/version.txt', 0, $ctx)) { - eval($code); - if(preg_match('/v(\d+)\.(\d)\.(\d+)(-dev.+)?$/', $config['version'], $m)) { - $current = Array( - 'massive' => (int)$m[1], - 'major' => (int)$m[2], - 'minor' => (int)$m[3] - ); - if(isset($m[4])) { - // Development versions are always ahead in the versioning numbers - $current['minor'] --; + echo Element('page.html', array( + 'config' => $config, + 'title' => 'Error(s) upgrading', + 'body' => $body + )); + exit; + } + + // For some reason, reading the ZIP entries in PHP doesn't seem to work very well. + // Use shell instead. + shell_exec('TEMP_DIR=$(mktemp -d); unzip -q ' . escapeshellarg($temp) . ' -d $TEMP_DIR -x "' . escapeshellarg($dir) . 'inc/instance-config.php"; mv -v $TEMP_DIR/' . escapeshellarg($dir) . '* "' . getcwd() . '"; rm -rf $TEMP_DIR'); + + unlink($temp); + + echo Element('page.html', array( + 'config' => $config, + 'title' => 'Upgraded', + 'body' => '

    Upgrading seems to have gone okay. You are now at revision ' . $version . '.

    ' + )); + } elseif(preg_match('/^\/log(\/(\d+))?$/', $query, $match)) { + if(!hasPermission($config['mod']['modlog'])) error($config['error']['noaccess']); + + $page = isset($match[2]) ? $match[2] : 1; + + $boards = array(); + $_boards = listBoards(); + foreach($_boards as &$_b) { + $boards[$_b['id']] = $_b['uri']; + } + + $query = prepare("SELECT `mod` as `id`, `username`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY `time` DESC LIMIT :offset, :limit"); + $query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT); + $query->bindValue(':offset', ($page - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if(!$query->rowCount()) { + $body = '

    (Nothing to display.)

    '; + } else { + $body = '' . + '' . + '' . + '' . + '' . + '' . + '' . + ''; + while($log = $query->fetch()) { + $log_id = 'log_' . md5($log['text']); + + if($config['cache']['enabled'] && $_log = cache::get($log_id)) + $log['text'] = $_log; + else { + + $log['text'] = utf8tohtml($log['text']); + $log['text'] = preg_replace('/(\d+\.\d+\.\d+\.\d+)/', '$1', $log['text']); + + if(isset($boards[$log['board']])) { + if(preg_match('/post #(\d+)/', $log['text'], $match)) { + $post_query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $boards[$log['board']])); + $post_query->bindValue(':id', $match[1], PDO::PARAM_INT); + $post_query->execute() or error(db_error($query)); + + if($post = $post_query->fetch()) { + $log['text'] = preg_replace('/post (#(\d+))/', + 'post $1', $log['text']); + } else { + $log['text'] = preg_replace('/post (#(\d+))/', 'post $1', $log['text']); } + + if($config['cache']['enabled']) + cache::set($log_id, $log['text']); } - // Check if it's newer - if( $latest['massive'] > $current['massive'] || - $latest['major'] > $current['major'] || - ($latest['massive'] == $current['massive'] && - $latest['major'] == $current['major'] && - $latest['minor'] > $current['minor'] - )) { - $latest = $latest; - } else $latest = false; - } else { - // Couldn't get latest version - // TODO: Display some sort of warning message - $latest = false; } - - - setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true); } - if($latest) { - $fieldset['Update'] .= - '
  • A newer version of Tinyboard (v' . - $latest['massive'] . '.' . - $latest['major'] . '.' . - $latest['minor'] . - ') is available! See http://tinyboard.org/ for upgrade instructions.
    • '; - } + $body .= '' . + '' . + '' . + '' . + '' + : 'deleted?') + : '-') . + '' . + ''; } + + $body .= '
    ' . _('User') . '' . _('IP address') . '' . _('Ago') . '' . _('Board') . '' . _('Action') . '
    ' . + ($log['username'] ? + '' . $log['username'] . '' + : '' . ($log['id'] < 0 ? 'system' : 'deleted?') . '') . + '' . ($log['id'] < 0 ? '–' : '' . $log['ip'] . '') . '' . ago($log['time']) . '' . + ($log['board'] ? + (isset($boards[$log['board']]) ? + '' . sprintf($config['board_abbreviation'], $boards[$log['board']]) . '' . $log['text'] . '
    '; - $fieldset['Logout'] .= '
  • ' . _('Logout') . '
    • '; - - // TODO: Statistics, etc, in the dashboard. + $query = prepare("SELECT COUNT(*) AS `count` FROM `modlogs`"); + $query->execute() or error(db_error($query)); + $count = $query->fetch(); - $body = ''; - foreach($fieldset as $title => $data) { - if($data) - $body .= '
    ' . _($title) . '
    '; + $body .= '

    '; + for($x = 0; $x < $count['count'] / $config['mod']['modlog_page']; $x ++) { + $body .= '[' . ($x + 1) . '] '; } + $body .= '

    '; + } + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Moderation log'), + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/themes\/none$/', $query, $match)) { + if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); + + // Clearsettings + query("TRUNCATE TABLE `theme_settings`") or error(db_error()); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'No theme', + 'body'=>'

    Successfully uninstalled all themes.

    ' . + '

    Go back to themes.

    ', + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/themes\/([\w\-]+)\/rebuild$/', $query, $match)) { + if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); + + rebuildTheme($match[1], 'all'); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Rebuilt', + 'body'=>'

    Successfully rebuilt the ' . $match[1] . ' theme.

    ' . + '

    Go back to themes.

    ', + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/themes\/(\w+)\/uninstall$/', $query, $match)) { + if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); + + $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query->bindValue(':theme', $match[1]); + $query->execute() or error(db_error($query)); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Uninstalled', + 'body'=>'

    Successfully uninstalled the ' . $match[1] . ' theme.

    ' . + '

    Go back to themes.

    ', + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/themes(\/([\w\-]+))?$/', $query, $match)) { + if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); + + if(!is_dir($config['dir']['themes'])) + error(_('Themes directory doesn\'t exist!')); + if(!$dir = opendir($config['dir']['themes'])) + error(_('Cannot open themes directory; check permissions.')); + + if(isset($match[2])) { + $_theme = &$match[2]; - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>_('Dashboard'), - 'body'=>$body, - '__mod'=>true - )); - } elseif(preg_match('/^\/logout$/', $query)) { - destroyCookies(); - - header('Location: ?/', true, $config['redirect_http']); - } elseif(preg_match('/^\/confirm\/(.+)$/', $query, $matches)) { - $uri = &$matches[1]; - - $body = '

    ' . - 'Are you sure you want to do that?' . - 'We were unable to serve a confirmation dialog for ' . - '?/' . utf8tohtml($uri) . '' . - ', probably due to Javascript being disabled.' . - '

    ' . - '

    Confirm

    '; - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Confirm', - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/upgrade$/', $query)) { - if($mod['type'] != ADMIN) - error($config['error']['noaccess']); - - if(is_dir('.git')) { - // use git instead - - $body = '

    git pull

    '; - $body .= '

    ' . str_replace("\n", '
    ', shell_exec('git pull')) . '

    '; - $body .= '
    '; - echo Element('page.html', Array( - 'config' => $config, - 'title' => 'Upgraded', - 'body' => $body - )); - exit; + if(!$theme = loadThemeConfig($_theme)) { + error($config['error']['invalidtheme']); } - if(!extension_loaded('curl')) - error('You need the cURL PHP extension to do that.'); - - if(!class_exists('ZipArchive')) - error('You need the ZipArchive class to do that.'); - - if(!in_array('zip', stream_get_wrappers())) - error('You need the zip:// stream wrapper to do that.'); - - $temp = tempnam($config['tmp'], 'tinyboard'); - - $fp = fopen($temp, 'w+'); - - $curl = curl_init(); - curl_setopt($curl, CURLOPT_URL, 'https://github.com/savetheinternet/Tinyboard/zipball/master'); - curl_setopt($curl, CURLOPT_FAILONERROR, true); - curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true); - curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, true); - curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2); - curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 5); - curl_setopt($curl, CURLOPT_TIMEOUT, 45); - curl_setopt($curl, CURLOPT_FILE, $fp); - curl_setopt($curl, CURLOPT_WRITEHEADER, $header = tmpfile()); - curl_setopt($curl, CURLOPT_HEADER, true); - - curl_exec($curl); - - if(curl_errno($curl)) - error('Failed downloading newest revision: ' . curl_error($curl)); - - curl_close($curl); - - fflush($fp); - fclose($fp); - - fseek($header, 0); - $version = false; - while($line = fgets($header)) { - if(preg_match('/^Content-Disposition: attachment; filename=savetheinternet-Tinyboard-(.+)\.zip\s?$/', $line, $m)) { - $version = $m[1]; + if(isset($_POST['install'])) { + // Check if everything is submitted + foreach($theme['config'] as &$c) { + if(!isset($_POST[$c['name']]) && $c['type'] != 'checkbox') + error(sprintf($config['error']['required'], $c['title'])); } - } - fclose($header); - - $zip = new ZipArchive(); - if(!$zip->open($temp)) - error('Could not make sense of the ZIP archive.'); - - $version = preg_replace('/^savetheinternet-Tinyboard-(\w+)\//', '$1', $dir = $zip->getNameIndex(0)); - - $errors = Array(); - for($i = 1; $i < $zip->numFiles; $i++) { - $filename = str_replace($dir, '', $zip->getNameIndex($i)); - if($filename == 'inc/instance-config.php') - continue; // don't override config + // Clear previous settings + $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); + $query->bindValue(':theme', $_theme); + $query->execute() or error(db_error($query)); + + foreach($theme['config'] as &$c) { + $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, :name, :value)"); + $query->bindValue(':theme', $_theme); + $query->bindValue(':name', $c['name']); + $query->bindValue(':value', $_POST[$c['name']]); + $query->execute() or error(db_error($query)); + } + + $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, NULL, NULL)"); + $query->bindValue(':theme', $_theme); + $query->execute() or error(db_error($query)); - // are we able to write here? - if(!((file_exists($filename) && is_writable($filename)) || (!file_exists($filename) && is_writable(dirname($filename))))) { - // nope - $errors[] = 'Cannot write to ' . $filename . '!'; + $result = true; + $body = ''; + if(isset($theme['install_callback'])) { + $ret = $theme['install_callback'](themeSettings($_theme)); + if($ret && !empty($ret)) { + if(is_array($ret) && count($ret) == 2) { + $result = $ret[0]; + $ret = $ret[1]; + } + $body .= '
    ' . $ret . '
    '; + } } - } - - $zip->close(); - - if($errors) { - $body = '

    Error(s) upgrading

    Tinyboard can not self-upgrade until the following is fixed:

    Please fix the above errors and refresh to try again.

    '; - unlink($temp); + $body .= '

    Go back to themes.

    '; - echo Element('page.html', Array( - 'config' => $config, - 'title' => 'Error(s) upgrading', - 'body' => $body - )); - exit; - } - - // For some reason, reading the ZIP entries in PHP doesn't seem to work very well. - // Use shell instead. - shell_exec('TEMP_DIR=$(mktemp -d); unzip -q ' . escapeshellarg($temp) . ' -d $TEMP_DIR -x "' . escapeshellarg($dir) . 'inc/instance-config.php"; mv -v $TEMP_DIR/' . escapeshellarg($dir) . '* "' . getcwd() . '"; rm -rf $TEMP_DIR'); - - unlink($temp); - - echo Element('page.html', Array( - 'config' => $config, - 'title' => 'Upgraded', - 'body' => '

    Upgrading seems to have gone okay. You are now at revision ' . $version . '.

    ' - )); - } elseif(preg_match('/^\/log(\/(\d+))?$/', $query, $match)) { - if(!hasPermission($config['mod']['modlog'])) error($config['error']['noaccess']); - - $page = isset($match[2]) ? $match[2] : 1; - - $boards = Array(); - $_boards = listBoards(); - foreach($_boards as &$_b) { - $boards[$_b['id']] = $_b['uri']; - } - - $query = prepare("SELECT `mod` as `id`, `username`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY `time` DESC LIMIT :offset, :limit"); - $query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT); - $query->bindValue(':offset', ($page - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if(!$query->rowCount()) { - $body = '

    (Nothing to display.)

    '; + // Build themes + rebuildThemes('all'); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>($result ? 'Installed "' . utf8tohtml($theme['name']) . '"' : 'Installation failed!'), + 'body'=>$body, + 'mod'=>true + ) + ); } else { - $body = '' . - '' . - '' . - '' . - '' . - '' . - '' . - ''; - while($log = $query->fetch()) { - $log_id = 'log_' . md5($log['text']); - - if($config['cache']['enabled'] && $_log = cache::get($log_id)) - $log['text'] = $_log; - else { - - $log['text'] = utf8tohtml($log['text']); - $log['text'] = preg_replace('/(\d+\.\d+\.\d+\.\d+)/', '$1', $log['text']); + $body = ''; + + if(!isset($theme['config']) || empty($theme['config'])) { + $body .= '

    (No configuration required.)

    '; + } else { + $settings = themeSettings($_theme); - if(isset($boards[$log['board']])) { - if(preg_match('/post #(\d+)/', $log['text'], $match)) { - $post_query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $boards[$log['board']])); - $post_query->bindValue(':id', $match[1], PDO::PARAM_INT); - $post_query->execute() or error(db_error($query)); - - if($post = $post_query->fetch()) { - $log['text'] = preg_replace('/post (#(\d+))/', - 'post $1', $log['text']); - } else { - $log['text'] = preg_replace('/post (#(\d+))/', 'post $1', $log['text']); - } - - if($config['cache']['enabled']) - cache::set($log_id, $log['text']); - } + $body .= '
    ' . _('User') . '' . _('IP address') . '' . _('Ago') . '' . _('Board') . '' . _('Action') . '
    '; + foreach($theme['config'] as &$c) { + $body .= ''; } - - $body .= '' . - '' . - '' . - '' . - '' - : 'deleted?') - : '-') . - '' . - ''; + $body .= '
    ' . $c['title'] . ''; + switch($c['type']) { + case 'text': + default: + $body .= ''; } + if(isset($c['comment'])) + $body .= ' ' . $c['comment'] . ''; + $body .= '
    ' . - ($log['username'] ? - '' . $log['username'] . '' - : '' . ($log['id'] < 0 ? 'system' : 'deleted?') . '') . - '' . ($log['id'] < 0 ? '–' : '' . $log['ip'] . '') . '' . ago($log['time']) . '' . - ($log['board'] ? - (isset($boards[$log['board']]) ? - '' . sprintf($config['board_abbreviation'], $boards[$log['board']]) . '' . $log['text'] . '
    '; } - - $body .= ''; - $query = prepare("SELECT COUNT(*) AS `count` FROM `modlogs`"); - $query->execute() or error(db_error($query)); - $count = $query->fetch(); + $body .= '

    '; - $body .= '

    '; - for($x = 0; $x < $count['count'] / $config['mod']['modlog_page']; $x ++) { - $body .= '[' . ($x + 1) . '] '; - } - $body .= '

    '; + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Installing "' . utf8tohtml($theme['name']) . '"', + 'body'=>$body, + 'mod'=>true + ) + ); } + } else { - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>_('Moderation log'), - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/themes\/none$/', $query, $match)) { - if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); - - // Clearsettings - query("TRUNCATE TABLE `theme_settings`") or error(db_error()); - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'No theme', - 'body'=>'

    Successfully uninstalled all themes.

    ' . - '

    Go back to themes.

    ', - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/themes\/([\w\-]+)\/rebuild$/', $query, $match)) { - if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); - - rebuildTheme($match[1], 'all'); - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Rebuilt', - 'body'=>'

    Successfully rebuilt the ' . $match[1] . ' theme.

    ' . - '

    Go back to themes.

    ', - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/themes\/(\w+)\/uninstall$/', $query, $match)) { - if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); - - $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); - $query->bindValue(':theme', $match[1]); - $query->execute() or error(db_error($query)); - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Uninstalled', - 'body'=>'

    Successfully uninstalled the ' . $match[1] . ' theme.

    ' . - '

    Go back to themes.

    ', - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/themes(\/([\w\-]+))?$/', $query, $match)) { - if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']); - - if(!is_dir($config['dir']['themes'])) - error(_('Themes directory doesn\'t exist!')); - if(!$dir = opendir($config['dir']['themes'])) - error(_('Cannot open themes directory; check permissions.')); + $themes_in_use = array(); + $query = query("SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error()); + while($theme = $query->fetch()) { + $themes_in_use[$theme['theme']] = true; + } - if(isset($match[2])) { - $_theme = &$match[2]; - - if(!$theme = loadThemeConfig($_theme)) { - error($config['error']['invalidtheme']); - } - - if(isset($_POST['install'])) { - // Check if everything is submitted - foreach($theme['config'] as &$c) { - if(!isset($_POST[$c['name']]) && $c['type'] != 'checkbox') - error(sprintf($config['error']['required'], $c['title'])); - } - - // Clear previous settings - $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); - $query->bindValue(':theme', $_theme); - $query->execute() or error(db_error($query)); - - foreach($theme['config'] as &$c) { - $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, :name, :value)"); - $query->bindValue(':theme', $_theme); - $query->bindValue(':name', $c['name']); - $query->bindValue(':value', $_POST[$c['name']]); - $query->execute() or error(db_error($query)); - } - - $query = prepare("INSERT INTO `theme_settings` VALUES(:theme, NULL, NULL)"); - $query->bindValue(':theme', $_theme); - $query->execute() or error(db_error($query)); - - $result = true; - $body = ''; - if(isset($theme['install_callback'])) { - $ret = $theme['install_callback'](themeSettings($_theme)); - if($ret && !empty($ret)) { - if(is_array($ret) && count($ret) == 2) { - $result = $ret[0]; - $ret = $ret[1]; - } - $body .= '
    ' . $ret . '
    '; - } - } - - if($result) { - $body .= '

    Successfully installed and built theme.

    '; - } else { - // install failed - $query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme"); - $query->bindValue(':theme', $_theme); - $query->execute() or error(db_error($query)); - } - - $body .= '

    Go back to themes.

    '; - - // Build themes - rebuildThemes('all'); - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>($result ? 'Installed "' . utf8tohtml($theme['name']) . '"' : 'Installation failed!'), - 'body'=>$body, - 'mod'=>true - ) - ); - } else { - $body = '
    '; - - if(!isset($theme['config']) || empty($theme['config'])) { - $body .= '

    (No configuration required.)

    '; - } else { - $settings = themeSettings($_theme); - - $body .= ''; - foreach($theme['config'] as &$c) { - $body .= ''; - } - $body .= '
    ' . $c['title'] . ''; - switch($c['type']) { - case 'text': - default: - $body .= ''; - } - if(isset($c['comment'])) - $body .= ' ' . $c['comment'] . ''; - $body .= '
    '; - } - - $body .= '

    '; - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Installing "' . utf8tohtml($theme['name']) . '"', - 'body'=>$body, - 'mod'=>true - ) - ); - } - } else { - - $themes_in_use = Array(); - $query = query("SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error()); - while($theme = $query->fetch()) { - $themes_in_use[$theme['theme']] = true; - } - - // Scan directory for themes - $themes = Array(); - while($file = readdir($dir)) { - if($file[0] != '.' && is_dir($config['dir']['themes'] . '/' . $file)) { - $themes[] = $file; - } - } - closedir($dir); - - $body = ''; - if(empty($themes)) { - $body = '

    (No themes installed.)

    '; - } else { - $body .= ''; - foreach($themes as &$_theme) { - $theme = loadThemeConfig($_theme); - - markup($theme['description']); - - $body .= '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - ''; - } - $body .= '
    ' . _('Name') . '' . utf8tohtml($theme['name']) . '
    ' . _('Version') . '' . utf8tohtml($theme['version']) . '
    ' . _('Description') . '' . $theme['description'] . '
    ' . _('Thumbnail') . '
    ' . _('Actions') . '
    '; + // Scan directory for themes + $themes = array(); + while($file = readdir($dir)) { + if($file[0] != '.' && is_dir($config['dir']['themes'] . '/' . $file)) { + $themes[] = $file; } - - if(!empty($themes_in_use)) - $body .= '

    ' . _('Uninstall all themes.') . '

    '; - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>_('Manage themes'), - 'body'=>$body, - 'mod'=>true - ) - ); } - } elseif(preg_match('/^\/noticeboard\/delete\/(\d+)$/', $query, $match)) { - if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']); - - $query = prepare("DELETE FROM `noticeboard` WHERE `id` = :id"); - $query->bindValue(':id', $match[1], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if($config['cache']['enabled']) - cache::delete('noticeboard_preview'); - - header('Location: ?/noticeboard', true, $config['redirect_http']); - } elseif(preg_match('/^\/noticeboard$/', $query)) { - if(!hasPermission($config['mod']['noticeboard'])) error($config['error']['noaccess']); + closedir($dir); $body = ''; - - if(hasPermission($config['mod']['noticeboard_post']) && isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) { - $query = prepare("INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)"); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - $query->bindvalue(':time', time(), PDO::PARAM_INT); - $query->bindValue(':subject', utf8tohtml($_POST['subject'])); - - markup($_POST['body']); - $query->bindValue(':body', $_POST['body']); - $query->execute() or error(db_error($query)); + if(empty($themes)) { + $body = '

    (No themes installed.)

    '; + } else { + $body .= ''; + foreach($themes as &$_theme) { + $theme = loadThemeConfig($_theme); - if($config['cache']['enabled']) - cache::delete('noticeboard_preview'); + markup($theme['description']); - header('Location: ?/noticeboard#' . $pdo->lastInsertId(), true, $config['redirect_http']); - } else { - - if(hasPermission($config['mod']['noticeboard_post'])) { - $body .= '
    New post
    ' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '
    ' . $mod['username'] . '
    ' . _('Subject') . '
    ' . _('Body') . '
    ' . - ''; - } - - $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); - $query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - while($notice = $query->fetch()) { - $body .= '
    ' . - (hasPermission($config['mod']['noticeboard_delete']) ? - '[delete]' - : '') . - '

    ' . - ($notice['subject'] ? - $notice['subject'] - : - '' . _('no subject') . '' - ) . - ' — by ' . - (isset($notice['username']) ? - utf8tohtml($notice['username']) - : - '???' - ) . - ' at ' . - strftime($config['post_date'], $notice['time']) . - '

    ' . $notice['body'] . '

    '; + $body .= '' . + '' . _('Name') . '' . + '' . utf8tohtml($theme['name']) . '' . + '' . + '' . + '' . _('Version') . '' . + '' . utf8tohtml($theme['version']) . '' . + '' . + '' . + '' . _('Description') . '' . + '' . $theme['description'] . '' . + '' . + '' . + '' . _('Thumbnail') . '' . + '' . + '' . + '' . + '' . _('Actions') . '' . + '' . + '' . + '
    '; } - - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>_('Noticeboard'), - 'body'=>$body, - 'mod'=>true - ) - ); + $body .= ''; } - } elseif(preg_match('/^\/news\/delete\/(\d+)$/', $query, $match)) { - if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']); - - $query = prepare("DELETE FROM `news` WHERE `id` = :id"); - $query->bindValue(':id', $match[1], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - rebuildThemes('news'); - header('Location: ?/news', true, $config['redirect_http']); - } elseif(preg_match('/^\/news$/', $query)) { - $body = ''; + if(!empty($themes_in_use)) + $body .= '

    ' . _('Uninstall all themes.') . '

    '; - if(hasPermission($config['mod']['news'])) { - if(isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) { - $query = prepare("INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)"); - - if(isset($_POST['name']) && hasPermission($config['mod']['news_custom'])) - $name = &$_POST['name']; - else - $name = &$mod['username']; - - $query->bindValue(':name', utf8tohtml($name), PDO::PARAM_INT); - $query->bindvalue(':time', time(), PDO::PARAM_INT); - $query->bindValue(':subject', utf8tohtml($_POST['subject'])); - - markup($_POST['body']); - $query->bindValue(':body', $_POST['body']); - $query->execute() or error(db_error($query)); - - rebuildThemes('news'); - } + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Manage themes'), + 'body'=>$body, + 'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/noticeboard\/delete\/(\d+)$/', $query, $match)) { + if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']); + + $query = prepare("DELETE FROM `noticeboard` WHERE `id` = :id"); + $query->bindValue(':id', $match[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($config['cache']['enabled']) + cache::delete('noticeboard_preview'); + + header('Location: ?/noticeboard', true, $config['redirect_http']); + } elseif(preg_match('/^\/noticeboard$/', $query)) { + if(!hasPermission($config['mod']['noticeboard'])) error($config['error']['noaccess']); + + $body = ''; + + if(hasPermission($config['mod']['noticeboard_post']) && isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) { + $query = prepare("INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)"); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + $query->bindvalue(':time', time(), PDO::PARAM_INT); + $query->bindValue(':subject', utf8tohtml($_POST['subject'])); + + markup($_POST['body']); + $query->bindValue(':body', $_POST['body']); + $query->execute() or error(db_error($query)); + + if($config['cache']['enabled']) + cache::delete('noticeboard_preview'); + header('Location: ?/noticeboard#' . $pdo->lastInsertId(), true, $config['redirect_http']); + } else { + + if(hasPermission($config['mod']['noticeboard_post'])) { $body .= '
    New post
    ' . '' . - '' . - (hasPermission($config['mod']['news_custom']) ? - '' - : - '') . + '' . + '' . '' . '' . '' . @@ -840,572 +755,695 @@ '' . '' . '' . - '' . + '' . '
    ' . _('Name') . '' . $mod['username'] . '' . $mod['username'] . '
    ' . _('Subject') . '' . _('Body') . '
    ' . '
    '; } - $query = prepare("SELECT * FROM `news` ORDER BY `id` DESC LIMIT :limit"); + $query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit"); $query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); - while($news = $query->fetch()) { + while($notice = $query->fetch()) { $body .= '
    ' . - (hasPermission($config['mod']['news_delete']) ? - '[delete]' + (hasPermission($config['mod']['noticeboard_delete']) ? + '[delete]' : '') . - '

    ' . - ($news['subject'] ? - $news['subject'] + '

    ' . + ($notice['subject'] ? + $notice['subject'] : '' . _('no subject') . '' ) . ' — by ' . - $news['name'] . + (isset($notice['username']) ? + utf8tohtml($notice['username']) + : + '???' + ) . ' at ' . - strftime($config['post_date'], $news['time']) . - '

    ' . $news['body'] . '

    '; + strftime($config['post_date'], $notice['time']) . + '

    ' . $notice['body'] . '

    '; } - - - echo Element('page.html', Array( + + + echo Element('page.html', array( 'config'=>$config, - 'title'=>_('News'), + 'title'=>_('Noticeboard'), 'body'=>$body, 'mod'=>true ) ); - } elseif(preg_match('/^\/inbox\/readall$/', $query, $match)) { - $query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `to` = :id"); - $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); + } + } elseif(preg_match('/^\/news\/delete\/(\d+)$/', $query, $match)) { + if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']); + + $query = prepare("DELETE FROM `news` WHERE `id` = :id"); + $query->bindValue(':id', $match[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + rebuildThemes('news'); + + header('Location: ?/news', true, $config['redirect_http']); + } elseif(preg_match('/^\/news$/', $query)) { + $body = ''; + + if(hasPermission($config['mod']['news'])) { + if(isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) { + $query = prepare("INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)"); + + if(isset($_POST['name']) && hasPermission($config['mod']['news_custom'])) + $name = &$_POST['name']; + else + $name = &$mod['username']; + + $query->bindValue(':name', utf8tohtml($name), PDO::PARAM_INT); + $query->bindvalue(':time', time(), PDO::PARAM_INT); + $query->bindValue(':subject', utf8tohtml($_POST['subject'])); + + markup($_POST['body']); + $query->bindValue(':body', $_POST['body']); + $query->execute() or error(db_error($query)); + + rebuildThemes('news'); + } - modLog('Marked all PMs as read'); + $body .= '
    New post
    ' . + '' . + '' . + (hasPermission($config['mod']['news_custom']) ? + '' + : + '') . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '
    ' . _('Name') . '' . $mod['username'] . '
    ' . _('Subject') . '
    ' . _('Body') . '
    ' . + '
    '; + } + + $query = prepare("SELECT * FROM `news` ORDER BY `id` DESC LIMIT :limit"); + $query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + while($news = $query->fetch()) { + $body .= '
    ' . + (hasPermission($config['mod']['news_delete']) ? + '[delete]' + : '') . + '

    ' . + ($news['subject'] ? + $news['subject'] + : + '' . _('no subject') . '' + ) . + ' — by ' . + $news['name'] . + ' at ' . + strftime($config['post_date'], $news['time']) . + '

    ' . $news['body'] . '

    '; + } + + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('News'), + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/inbox\/readall$/', $query, $match)) { + $query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `to` = :id"); + $query->bindValue(':id', $mod['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + modLog('Marked all PMs as read'); + + header('Location: ?/inbox', true, $config['redirect_http']); + } elseif(preg_match('/^\/inbox$/', $query, $match)) { + $query = prepare("SELECT `unread`,`pms`.`id`, `time`, `sender`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC"); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($query->rowCount() == 0) { + $body = '

    (' . _('No private messages for you.') . ')

    '; + } else { + $unread_pms = 0; + + $body = ''; + while($pm = $query->fetch()) { + $body .= '' . + '' . + '' . + '' . + '' . + ''; + + if($pm['unread']) + $unread_pms++; + } + $body .= '
    IDFromDateMessage snippet
    ' . $pm['id'] . '' . + ($pm['username'] ? + '' . $pm['username'] . '' + : 'deleted?') . + '' . strftime($config['post_date'], $pm['time']) . '' . pm_snippet($pm['message']) . '
    '; - header('Location: ?/inbox', true, $config['redirect_http']); - } elseif(preg_match('/^\/inbox$/', $query, $match)) { - $query = prepare("SELECT `unread`,`pms`.`id`, `time`, `sender`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC"); + if($unread_pms) { + $body = '

    (Mark all as read)

    ' . $body; + } + } + + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('PM Inbox') . ' (' . ($query->rowCount() == 0 ? _('empty') : $unread_pms . ' ' . _('unread')) . ')', + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/PM\/(\d+)$/', $query, $match)) { + $id = &$match[1]; + + if(hasPermission($config['mod']['master_pm'])) { + $query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id"); + } else { + $query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id AND `to` = :mod"); $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + } + + $query->bindValue(':id', $id, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if(!$pm = $query->fetch()) { + // Mod doesn't exist + error($config['error']['404']); + } + + if(isset($_POST['delete'])) { + $query = prepare("DELETE FROM `pms` WHERE `id` = :id"); + $query->bindValue(':id', $id, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - if($query->rowCount() == 0) { - $body = '

    (' . _('No private messages for you.') . ')

    '; - } else { - $unread_pms = 0; - - $body = ''; - while($pm = $query->fetch()) { - $body .= '' . - '' . - '' . - '' . - '' . - ''; - - if($pm['unread']) - $unread_pms++; - } - $body .= '
    IDFromDateMessage snippet
    ' . $pm['id'] . '' . - ($pm['username'] ? - '' . $pm['username'] . '' - : 'deleted?') . - '' . strftime($config['post_date'], $pm['time']) . '' . pm_snippet($pm['message']) . '
    '; + modLog('Deleted a PM'); + + header('Location: ?/inbox', true, $config['redirect_http']); + } else { + if($pm['unread']) { + $query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `id` = :id"); + $query->bindValue(':id', $id, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + modLog('Read a PM'); + } + + if($pm['to'] != $mod['id']) { + $query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id"); + $query->bindValue(':id', $pm['to'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); - if($unread_pms) { - $body = '

    (Mark all as read)

    ' . $body; + if($_mod = $query->fetch()) { + $__to = &$_mod['username']; + } else { + $__to = false; } } + $body = '
    ' . + + '' . + + (isset($__to) ? + '' + : '') . + + '' . + + '' . + + '
    From' . + (!$pm['username'] ? + '???' + : + '' . utf8tohtml($pm['username']) . '' + ) . + '
    To' . + ($__to === false ? + '???' + : + '' . utf8tohtml($__to) . '' + ) . + '
    Date ' . strftime($config['post_date'], $pm['time']) . '
    Message ' . $pm['message'] . '
    ' . - echo Element('page.html', Array( + '

    ' . + + '
    ' . + + '

    Reply with quote

    '; + + echo Element('page.html', array( 'config'=>$config, - 'title'=>_('PM Inbox') . ' (' . ($query->rowCount() == 0 ? _('empty') : $unread_pms . ' ' . _('unread')) . ')', + 'title'=>'Private message', 'body'=>$body, 'mod'=>true ) ); - } elseif(preg_match('/^\/PM\/(\d+)$/', $query, $match)) { - $id = &$match[1]; + } + } elseif(preg_match('/^\/new_PM\/(\d+)(\/(\d+))?$/', $query, $match)) { + if(!hasPermission($config['mod']['create_pm'])) error($config['error']['noaccess']); + + $to = &$match[1]; + + $query = prepare("SELECT `username`,`id` FROM `mods` WHERE `id` = :id"); + $query->bindValue(':id', $to, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if(!$to = $query->fetch()) { + // Mod doesn't exist + error($config['error']['404']); + } + + if(isset($_POST['message'])) { + // Post message + $message = &$_POST['message']; - if(hasPermission($config['mod']['master_pm'])) { - $query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id"); - } else { - $query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id AND `to` = :mod"); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - } + if(empty($message)) + error($config['error']['tooshort_body']); - $query->bindValue(':id', $id, PDO::PARAM_INT); + markup($message); + + $query = prepare("INSERT INTO `pms` VALUES (NULL, :sender, :to, :message, :time, 1)"); + $query->bindValue(':sender', $mod['id'], PDO::PARAM_INT); + $query->bindValue(':to', $to['id'], PDO::PARAM_INT); + $query->bindValue(':message', $message); + $query->bindValue(':time', time(), PDO::PARAM_INT); $query->execute() or error(db_error($query)); - if(!$pm = $query->fetch()) { - // Mod doesn't exist - error($config['error']['404']); - } + modLog('Sent a PM to ' . $to['username']); - if(isset($_POST['delete'])) { - $query = prepare("DELETE FROM `pms` WHERE `id` = :id"); - $query->bindValue(':id', $id, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - modLog('Deleted a PM'); + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'PM sent', + 'body'=>'

    Message sent successfully to ' . utf8tohtml($to['username']) . '.

    ', + 'mod'=>true + ) + ); + } else { + $value = ''; + if(isset($match[3])) { + $reply = &$match[3]; - header('Location: ?/inbox', true, $config['redirect_http']); - } else { - if($pm['unread']) { - $query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `id` = :id"); - $query->bindValue(':id', $id, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - modLog('Read a PM'); + $query = prepare("SELECT `message` FROM `pms` WHERE `sender` = :sender AND `to` = :mod AND `id` = :id"); + $query->bindValue(':sender', $to['id'], PDO::PARAM_INT); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + $query->bindValue(':id', $reply, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + if($pm = $query->fetch()) { + $value = quote($pm['message']); } + } + + + $body = '
    ' . + + '' . + + '' . + + '' . + + '
    To' . + (hasPermission($config['mod']['editusers']) ? + '' . utf8tohtml($to['username']) . '' : + utf8tohtml($to['username']) + ) . + '
    Message
    ' . + + '

    ' . + + '
    '; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'New PM for ' . utf8tohtml($to['username']), + 'body'=>$body, + 'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/search$/', $query)) { + if(!hasPermission($config['mod']['search'])) error($config['error']['noaccess']); + + $body = '

    Search

    ' . + '

    ' . + '' . + '' . + '

    ' . + '

    (Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)

    ' . + '
    '; + + if(isset($_POST['search']) && !empty($_POST['search'])) { + $phrase = &$_POST['search']; + $_body = ''; + + $filters = array(); + + function search_filters($m) { + global $filters; + $name = $m[2]; + $value = isset($m[4]) ? $m[4] : $m[3]; - if($pm['to'] != $mod['id']) { - $query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id"); - $query->bindValue(':id', $pm['to'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if($_mod = $query->fetch()) { - $__to = &$_mod['username']; - } else { - $__to = false; - } - } - - $body = '
    ' . - - '' . - - (isset($__to) ? - '' - : '') . - - '' . - - '' . - - '
    From' . - (!$pm['username'] ? - '???' - : - '' . utf8tohtml($pm['username']) . '' - ) . - '
    To' . - ($__to === false ? - '???' - : - '' . utf8tohtml($__to) . '' - ) . - '
    Date ' . strftime($config['post_date'], $pm['time']) . '
    Message ' . $pm['message'] . '
    ' . - - '

    ' . - - '
    ' . + if(!in_array($name, array('id', 'thread', 'subject', 'email', 'name', 'trip', 'capcode', 'filename', 'filehash', 'ip'))) { + // unknown filter + return $m[0]; + } - '

    Reply with quote

    '; + $filters[$name] = $value; - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Private message', - 'body'=>$body, - 'mod'=>true - ) - ); + return $m[1]; } - } elseif(preg_match('/^\/new_PM\/(\d+)(\/(\d+))?$/', $query, $match)) { - if(!hasPermission($config['mod']['create_pm'])) error($config['error']['noaccess']); - $to = &$match[1]; + $phrase = trim(preg_replace_callback('/(^|\s)(\w+):("(.*)?"|[^\s]*)/', 'search_filters', $phrase)); - $query = prepare("SELECT `username`,`id` FROM `mods` WHERE `id` = :id"); - $query->bindValue(':id', $to, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); + // Escape escape character + $phrase = str_replace('!', '!!', $phrase); - if(!$to = $query->fetch()) { - // Mod doesn't exist - error($config['error']['404']); + // Remove SQL wildcard + $phrase = str_replace('%', '!%', $phrase); + + // Use asterisk as wildcard to suit convention + $phrase = str_replace('*', '%', $phrase); + + $like = ''; + $match = array(); + + // Find exact phrases + if(preg_match_all('/"(.+?)"/', $phrase, $m)) { + foreach($m[1] as &$quote) { + $phrase = str_replace("\"{$quote}\"", '', $phrase); + $match[] = $pdo->quote($quote); + } } - if(isset($_POST['message'])) { - // Post message - $message = &$_POST['message']; - - if(empty($message)) - error($config['error']['tooshort_body']); - - markup($message); + $words = explode(' ', $phrase); + foreach($words as &$word) { + if(empty($word)) + continue; + $match[] = $pdo->quote($word); + } + + $like = ''; + foreach($match as &$phrase) { + if(!empty($like)) + $like .= ' AND '; + $phrase = preg_replace('/^\'(.+)\'$/', '\'%$1%\'', $phrase); + $like .= '`body` LIKE ' . $phrase . ' ESCAPE \'!\''; + } + + foreach($filters as $name => $value) { + if(!empty($like)) + $like .= ' AND '; + $like .= '`' . $name . '` = '. $pdo->quote($value); + } + + $like = str_replace('%', '%%', $like); + + $boards = listBoards(); + foreach($boards as &$_b) { + openBoard($_b['uri']); - $query = prepare("INSERT INTO `pms` VALUES (NULL, :sender, :to, :message, :time, 1)"); - $query->bindValue(':sender', $mod['id'], PDO::PARAM_INT); - $query->bindValue(':to', $to['id'], PDO::PARAM_INT); - $query->bindValue(':message', $message); - $query->bindValue(':time', time(), PDO::PARAM_INT); + $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE " . $like . " ORDER BY `time` DESC LIMIT :limit", $board['uri'])); + $query->bindValue(':limit', $config['mod']['search_results'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); - modLog('Sent a PM to ' . $to['username']); - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'PM sent', - 'body'=>'

    Message sent successfully to ' . utf8tohtml($to['username']) . '.

    ', - 'mod'=>true - ) - ); - } else { - $value = ''; - if(isset($match[3])) { - $reply = &$match[3]; - - $query = prepare("SELECT `message` FROM `pms` WHERE `sender` = :sender AND `to` = :mod AND `id` = :id"); - $query->bindValue(':sender', $to['id'], PDO::PARAM_INT); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - $query->bindValue(':id', $reply, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - if($pm = $query->fetch()) { - $value = quote($pm['message']); + $temp = ''; + while($post = $query->fetch()) { + if(!$post['thread']) { + $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); + } else { + $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); } + $temp .= $po->build(true) . '
    '; } - - $body = '
    ' . - - '' . - - '' . - '

    ' . + '' . - ''; + '' . - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'New PM for ' . utf8tohtml($to['username']), - 'body'=>$body, - 'mod'=>true - ) - ); + ''; + } + + $body .= '
    To' . - (hasPermission($config['mod']['editusers']) ? - '' . utf8tohtml($to['username']) . '' : - utf8tohtml($to['username']) - ) . + if(!empty($temp)) + $_body .= '
    ' . $query->rowCount() . ' result' . ($query->rowCount() != 1 ? 's' : '') . ' on ' . + sprintf($config['board_abbreviation'], $board['uri']) . ' - ' . $board['title'] . + '' . $temp . '
    '; + } + + $body .= '
    '; + if(!empty($_body)) + $body .= $_body; + else + $body .= '

    (No results.)

    '; + } + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Search', + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/users$/', $query)) { + if(!hasPermission($config['mod']['manageusers'])) error($config['error']['noaccess']); + + $body = ''; + + $query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error()); + while($_mod = $query->fetch()) { + $type = $_mod['type'] == JANITOR ? 'Janitor' : ($_mod['type'] == MOD ? 'Mod' : 'Admin'); + + $_mod['boards'] = explode(',', $_mod['boards']); + foreach($_mod['boards'] as &$_board) { + if($_board != '*') + $_board = '/' . $_board . '/'; + } + + $body .= '' . + '' . - '' . + '' . - '
    ' . _('ID') . '' . _('Username') . '' . _('Type') . '' . _('Boards') . '' . _('Last action') . '…
    ' . + $_mod['id'] . '
    Message' . + utf8tohtml($_mod['username']) . + '
    ' . + '    		' . + $type . + '' . + implode(', ', $_mod['boards']) . + '' . + ($_mod['last'] ? + (hasPermission($config['mod']['modlog']) ? + '' . ago($_mod['last']) . '' + : ago($_mod['last'])) + : 'never') . + '' . + (hasPermission($config['mod']['promoteusers']) ? + ($_mod['type'] != ADMIN ? + 'â–²' + :'') . + ($_mod['type'] != JANITOR ? + 'â–¼' + :'') + : '' + ) . + (hasPermission($config['mod']['editusers']) || + (hasPermission($config['mod']['change_password']) && $_mod['id'] == $mod['id'])? + '[edit]' + : '' ) . + (hasPermission($config['mod']['create_pm']) ? + '[PM]' + : '' ) . + '
    '; + + if(hasPermission($config['mod']['createusers'])) { + $body .= '

    ' . _('Create new user') . '

    '; + } + + $body .= ''; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Manage users'), + 'body'=>$body + ,'mod'=>true + ) + ); + } elseif(preg_match('/^\/users\/new$/', $query)) { + if(!hasPermission($config['mod']['createusers'])) error($config['error']['noaccess']); + + if(isset($_POST['username']) && isset($_POST['password'])) { + if(!isset($_POST['type'])) { + error(sprintf($config['error']['required'], 'type')); } - } elseif(preg_match('/^\/search$/', $query)) { - if(!hasPermission($config['mod']['search'])) error($config['error']['noaccess']); - - $body = '

    Search

    ' . - '

    ' . - '' . - '' . - '

    ' . - '

    (Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)

    ' . - '
    '; - if(isset($_POST['search']) && !empty($_POST['search'])) { - $phrase = &$_POST['search']; - $_body = ''; - - $filters = Array(); - - function search_filters($m) { - global $filters; - $name = $m[2]; - $value = isset($m[4]) ? $m[4] : $m[3]; - - if(!in_array($name, Array('id', 'thread', 'subject', 'email', 'name', 'trip', 'capcode', 'filename', 'filehash', 'ip'))) { - // unknown filter - return $m[0]; - } - - $filters[$name] = $value; - - return $m[1]; - } - - $phrase = trim(preg_replace_callback('/(^|\s)(\w+):("(.*)?"|[^\s]*)/', 'search_filters', $phrase)); - - // Escape escape character - $phrase = str_replace('!', '!!', $phrase); - - // Remove SQL wildcard - $phrase = str_replace('%', '!%', $phrase); - - // Use asterisk as wildcard to suit convention - $phrase = str_replace('*', '%', $phrase); - - $like = ''; - $match = Array(); - - // Find exact phrases - if(preg_match_all('/"(.+?)"/', $phrase, $m)) { - foreach($m[1] as &$quote) { - $phrase = str_replace("\"{$quote}\"", '', $phrase); - $match[] = $pdo->quote($quote); - } - } - - $words = explode(' ', $phrase); - foreach($words as &$word) { - if(empty($word)) - continue; - $match[] = $pdo->quote($word); - } - - $like = ''; - foreach($match as &$phrase) { - if(!empty($like)) - $like .= ' AND '; - $phrase = preg_replace('/^\'(.+)\'$/', '\'%$1%\'', $phrase); - $like .= '`body` LIKE ' . $phrase . ' ESCAPE \'!\''; - } - - foreach($filters as $name => $value) { - if(!empty($like)) - $like .= ' AND '; - $like .= '`' . $name . '` = '. $pdo->quote($value); - } - - $like = str_replace('%', '%%', $like); - - $boards = listBoards(); - foreach($boards as &$_b) { - openBoard($_b['uri']); - - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE " . $like . " ORDER BY `time` DESC LIMIT :limit", $board['uri'])); - $query->bindValue(':limit', $config['mod']['search_results'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - $temp = ''; - while($post = $query->fetch()) { - if(!$post['thread']) { - $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); - } else { - $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); - } - $temp .= $po->build(true) . '
    '; - } - - if(!empty($temp)) - $_body .= '
    ' . $query->rowCount() . ' result' . ($query->rowCount() != 1 ? 's' : '') . ' on ' . - sprintf($config['board_abbreviation'], $board['uri']) . ' - ' . $board['title'] . - '' . $temp . '
    '; - } - - $body .= '
    '; - if(!empty($_body)) - $body .= $_body; - else - $body .= '

    (No results.)

    '; + if($_POST['type'] != ADMIN && $_POST['type'] != MOD && $_POST['type'] != JANITOR) { + error(sprintf($config['error']['invalidfield'], 'type')); } - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Search', - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/users$/', $query)) { - if(!hasPermission($config['mod']['manageusers'])) error($config['error']['noaccess']); - $body = '
    '; + // Check if already exists + $query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username"); + $query->bindValue(':username', $_POST['username']); + $query->execute() or error(db_error($query)); - $query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error()); - while($_mod = $query->fetch()) { - $type = $_mod['type'] == JANITOR ? 'Janitor' : ($_mod['type'] == MOD ? 'Mod' : 'Admin'); - - $_mod['boards'] = explode(',', $_mod['boards']); - foreach($_mod['boards'] as &$_board) { - if($_board != '*') - $_board = '/' . $_board . '/'; - } - - $body .= '' . - '' . - - '' . - - '' . - - '' . - - '' . - - ''; + if($_mod = $query->fetch()) { + error(sprintf($config['error']['modexists'], $_mod['id'])); } - $body .= '
    ' . _('ID') . '' . _('Username') . '' . _('Type') . '' . _('Boards') . '' . _('Last action') . '…
    ' . - $_mod['id'] . - '' . - utf8tohtml($_mod['username']) . - '' . - $type . - '' . - implode(', ', $_mod['boards']) . - '' . - ($_mod['last'] ? - (hasPermission($config['mod']['modlog']) ? - '' . ago($_mod['last']) . '' - : ago($_mod['last'])) - : 'never') . - '' . - (hasPermission($config['mod']['promoteusers']) ? - ($_mod['type'] != ADMIN ? - 'â–²' - :'') . - ($_mod['type'] != JANITOR ? - 'â–¼' - :'') - : '' - ) . - (hasPermission($config['mod']['editusers']) || - (hasPermission($config['mod']['change_password']) && $_mod['id'] == $mod['id'])? - '[edit]' - : '' ) . - (hasPermission($config['mod']['create_pm']) ? - '[PM]' - : '' ) . - '
    '; + $boards = array(); + foreach($_POST as $name => $null) { + if(preg_match('/^board_(.+)$/', $name, $m)) + $boards[] = $m[1]; + } + $boards = implode(',', $boards); + + $query = prepare("INSERT INTO `mods` VALUES (NULL, :username, :password, :type, :boards)"); + $query->bindValue(':username', $_POST['username']); + $query->bindValue(':password', sha1($_POST['password'])); + $query->bindValue(':type', $_POST['type'], PDO::PARAM_INT); + $query->bindValue(':boards', $boards); + $query->execute() or error(db_error($query)); - if(hasPermission($config['mod']['createusers'])) { - $body .= '

    ' . _('Create new user') . '

    '; + modLog('Create a new user: "' . $_POST['username'] . '"'); + header('Location: ?/users', true, $config['redirect_http']); + } else { + + $__boards = '
      '; + $boards = array_merge( + array(array('uri' => '*', 'title' => 'All') + ), listBoards()); + foreach($boards as &$_board) { + $__boards .= '
    • ' . + '' . + '' . + '
      • '; } + + $body = '
      New user' . - $body .= ''; + // Begin form + '
      ' . - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>_('Manage users'), - 'body'=>$body - ,'mod'=>true - ) - ); - } elseif(preg_match('/^\/users\/new$/', $query)) { - if(!hasPermission($config['mod']['createusers'])) error($config['error']['noaccess']); + '' . - if(isset($_POST['username']) && isset($_POST['password'])) { - if(!isset($_POST['type'])) { - error(sprintf($config['error']['required'], 'type')); - } - - if($_POST['type'] != ADMIN && $_POST['type'] != MOD && $_POST['type'] != JANITOR) { - error(sprintf($config['error']['invalidfield'], 'type')); - } + '' . + '' . + '' . + '' . + '
      Username
      Password
      Type' . + '
      ' . + '
      ' . + '
      ' . + '
      Boards' . $__boards . '
      ' . + + '' . + + // End form + '
      '; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'New user', + 'body'=>$body + ,'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/users\/(\d+)(\/(promote|demote|delete))?$/', $query, $matches)) { + $modID = &$matches[1]; + + if(isset($matches[2])) { + if($matches[3] == 'delete') { + if(!hasPermission($config['mod']['deleteusers'])) error($config['error']['noaccess']); - // Check if already exists - $query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username"); - $query->bindValue(':username', $_POST['username']); + $query = prepare("DELETE FROM `mods` WHERE `id` = :id"); + $query->bindValue(':id', $modID, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - if($_mod = $query->fetch()) { - error(sprintf($config['error']['modexists'], $_mod['id'])); - } + modLog('Deleted user #' . $modID); + } else { + // Promote/demote + if(!hasPermission($config['mod']['promoteusers'])) error($config['error']['noaccess']); - $boards = Array(); - foreach($_POST as $name => $null) { - if(preg_match('/^board_(.+)$/', $name, $m)) - $boards[] = $m[1]; + if($matches[3] == 'promote') { + $query = prepare("UPDATE `mods` SET `type` = `type` + 1 WHERE `type` != :admin AND `id` = :id"); + $query->bindValue(':admin', ADMIN, PDO::PARAM_INT); + } else { + $query = prepare("UPDATE `mods` SET `type` = `type` - 1 WHERE `type` != :janitor AND `id` = :id"); + $query->bindValue(':janitor', JANITOR, PDO::PARAM_INT); } - $boards = implode(',', $boards); - $query = prepare("INSERT INTO `mods` VALUES (NULL, :username, :password, :type, :boards)"); - $query->bindValue(':username', $_POST['username']); - $query->bindValue(':password', sha1($_POST['password'])); - $query->bindValue(':type', $_POST['type'], PDO::PARAM_INT); - $query->bindValue(':boards', $boards); + $query->bindValue(':id', $modID, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - - modLog('Create a new user: "' . $_POST['username'] . '"'); - header('Location: ?/users', true, $config['redirect_http']); - } else { + } + header('Location: ?/users', true, $config['redirect_http']); + } else { + // Edit user + if(!hasPermission($config['mod']['editusers']) && !hasPermission($config['mod']['change_password'])) + error($config['error']['noaccess']); - $__boards = '
        '; - $boards = array_merge( - Array(Array('uri' => '*', 'title' => 'All') - ), listBoards()); - foreach($boards as &$_board) { - $__boards .= '
      • ' . - '' . - '' . - '
        • '; - } + $query = prepare("SELECT * FROM `mods` WHERE `id` = :id"); + $query->bindValue(':id', $modID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); - $body = '
        New user' . - - // Begin form - '
        ' . - - '' . - - '' . - '' . - '' . - '' . - '
        Username
        Password
        Type' . - '
        ' . - '
        ' . - '
        ' . - '
        Boards' . $__boards . '
        ' . - - '' . - - // End form - '
        '; - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'New user', - 'body'=>$body - ,'mod'=>true - ) - ); - } - } elseif(preg_match('/^\/users\/(\d+)(\/(promote|demote|delete))?$/', $query, $matches)) { - $modID = &$matches[1]; + if(!$_mod = $query->fetch()) { + error($config['error']['404']); + } - if(isset($matches[2])) { - if($matches[3] == 'delete') { - if(!hasPermission($config['mod']['deleteusers'])) error($config['error']['noaccess']); + if(!hasPermission($config['mod']['editusers']) && !(hasPermission($config['mod']['change_password']) && $mod['id'] == $_mod['id'] && $change_password_only = true)) + error($config['error']['noaccess']); + + if((isset($_POST['username']) && isset($_POST['password'])) || (isset($change_password_only) && isset($_POST['password']))) { + if(!isset($change_password_only)) { + $boards = array(); + foreach($_POST as $name => $null) { + if(preg_match('/^board_(.+)$/', $name, $m)) + $boards[] = $m[1]; + } + $boards = implode(',', $boards); - $query = prepare("DELETE FROM `mods` WHERE `id` = :id"); + $query = prepare("UPDATE `mods` SET `username` = :username, `boards` = :boards WHERE `id` = :id"); + $query->bindValue(':username', $_POST['username'], PDO::PARAM_STR); + $query->bindValue(':boards', $boards, PDO::PARAM_STR); $query->bindValue(':id', $modID, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - - modLog('Deleted user #' . $modID); + modLog('Edited login details for user "' . $_mod['username'] . '"'); } else { - // Promote/demote - if(!hasPermission($config['mod']['promoteusers'])) error($config['error']['noaccess']); - - if($matches[3] == 'promote') { - $query = prepare("UPDATE `mods` SET `type` = `type` + 1 WHERE `type` != :admin AND `id` = :id"); - $query->bindValue(':admin', ADMIN, PDO::PARAM_INT); - } else { - $query = prepare("UPDATE `mods` SET `type` = `type` - 1 WHERE `type` != :janitor AND `id` = :id"); - $query->bindValue(':janitor', JANITOR, PDO::PARAM_INT); - } - + modLog('Changed own password'); + } + if(!empty($_POST['password'])) { + $query = prepare("UPDATE `mods` SET `password` = :password WHERE `id` = :id"); + $query->bindValue(':password', sha1($_POST['password'])); $query->bindValue(':id', $modID, PDO::PARAM_INT); $query->execute() or error(db_error($query)); } - header('Location: ?/users', true, $config['redirect_http']); - } else { - // Edit user - if(!hasPermission($config['mod']['editusers']) && !hasPermission($config['mod']['change_password'])) - error($config['error']['noaccess']); + // Refresh $query = prepare("SELECT * FROM `mods` WHERE `id` = :id"); $query->bindValue(':id', $modID, PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -1414,262 +1452,269 @@ error($config['error']['404']); } - if(!hasPermission($config['mod']['editusers']) && !(hasPermission($config['mod']['change_password']) && $mod['id'] == $_mod['id'] && $change_password_only = true)) - error($config['error']['noaccess']); - - if((isset($_POST['username']) && isset($_POST['password'])) || (isset($change_password_only) && isset($_POST['password']))) { - if(!isset($change_password_only)) { - $boards = Array(); - foreach($_POST as $name => $null) { - if(preg_match('/^board_(.+)$/', $name, $m)) - $boards[] = $m[1]; - } - $boards = implode(',', $boards); - - $query = prepare("UPDATE `mods` SET `username` = :username, `boards` = :boards WHERE `id` = :id"); - $query->bindValue(':username', $_POST['username'], PDO::PARAM_STR); - $query->bindValue(':boards', $boards, PDO::PARAM_STR); - $query->bindValue(':id', $modID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - modLog('Edited login details for user "' . $_mod['username'] . '"'); - } else { - modLog('Changed own password'); - } - if(!empty($_POST['password'])) { - $query = prepare("UPDATE `mods` SET `password` = :password WHERE `id` = :id"); - $query->bindValue(':password', sha1($_POST['password'])); - $query->bindValue(':id', $modID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } - - // Refresh - $query = prepare("SELECT * FROM `mods` WHERE `id` = :id"); - $query->bindValue(':id', $modID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if(!$_mod = $query->fetch()) { - error($config['error']['404']); - } + if($_mod['id'] == $mod['id']) { + // Changed own password. Update cookies - if($_mod['id'] == $mod['id']) { - // Changed own password. Update cookies - - if(!login($_mod['username'], $_mod['password'], false, true)) - error(_('Could not re-login after changing password. (?)')); - - setCookies(); - } + if(!login($_mod['username'], $_mod['password'], false, true)) + error(_('Could not re-login after changing password. (?)')); - if(hasPermission($config['mod']['manageusers'])) - header('Location: ?/users', true, $config['redirect_http']); - else - header('Location: ?/', true, $config['redirect_http']); - exit; - } - - $__boards = '
          '; - $boards = array_merge( - Array(Array('uri' => '*', 'title' => 'All') - ), listBoards()); - - $_mod['boards'] = explode(',', $_mod['boards']); - foreach($boards as &$_board) { - $__boards .= '
        • ' . - ' ' . - '' . - '
          • '; + setCookies(); } - $__boards .= '
        '; - - $body = '
        Edit user' . - - // Begin form - '
        ' . - - '' . - '' . - '' . - - (isset($change_password_only) ? '' : - '' - ) . - - '
        Username' . - - (isset($change_password_only) ? - utf8tohtml($_mod['username']) - : '') . - - '
        Password (new; optional)
        Boards' . $__boards . '
        ' . - - '' . - - // End form - '
        ' . - - // Delete button - (hasPermission($config['mod']['deleteusers']) ? - '

        Delete user

        ' - :'') . - - '
        '; - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Edit user', - 'body'=>$body - ,'mod'=>true - ) - ); + if(hasPermission($config['mod']['manageusers'])) + header('Location: ?/users', true, $config['redirect_http']); + else + header('Location: ?/', true, $config['redirect_http']); + exit; } - } elseif(preg_match('/^\/reports$/', $query)) { - if(!hasPermission($config['mod']['reports'])) error($config['error']['noaccess']); - $body = ''; - $reports = 0; + $__boards = '
          '; + $boards = array_merge( + array(array('uri' => '*', 'title' => 'All') + ), listBoards()); - $query = prepare("SELECT `reports`.*, `boards`.`uri` FROM `reports` INNER JOIN `boards` ON `board` = `boards`.`id` ORDER BY `time` DESC LIMIT :limit"); - $query->bindValue(':limit', $config['mod']['recent_reports'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); + $_mod['boards'] = explode(',', $_mod['boards']); + foreach($boards as &$_board) { + $__boards .= '
        • ' . + ' ' . + '' . + '
          • '; + } + $__boards .= '
        '; + + $body = '
        Edit user' . + + // Begin form + '
        ' . + + '' . + + '' . + '' . + + (isset($change_password_only) ? '' : + '' + ) . + + '
        Username' . - while($report = $query->fetch()) { - $p_query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `id` = :id", $report['uri'])); + (isset($change_password_only) ? + utf8tohtml($_mod['username']) + : '') . + + '
        Password (new; optional)
        Boards' . $__boards . '
        ' . + + '' . + + // End form + '
        ' . + + // Delete button + (hasPermission($config['mod']['deleteusers']) ? + '

        Delete user

        ' + :'') . + + '
        '; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Edit user', + 'body'=>$body + ,'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/reports$/', $query)) { + if(!hasPermission($config['mod']['reports'])) error($config['error']['noaccess']); + + $body = ''; + $reports = 0; + + $query = prepare("SELECT `reports`.*, `boards`.`uri` FROM `reports` INNER JOIN `boards` ON `board` = `boards`.`id` ORDER BY `time` DESC LIMIT :limit"); + $query->bindValue(':limit', $config['mod']['recent_reports'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + while($report = $query->fetch()) { + $p_query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `id` = :id", $report['uri'])); + $p_query->bindValue(':id', $report['post'], PDO::PARAM_INT); + $p_query->execute() or error(db_error($query)); + + if(!$post = $p_query->fetch()) { + // Invalid report (post has since been deleted) + $p_query = prepare("DELETE FROM `reports` WHERE `post` = :id"); $p_query->bindValue(':id', $report['post'], PDO::PARAM_INT); $p_query->execute() or error(db_error($query)); - - if(!$post = $p_query->fetch()) { - // Invalid report (post has since been deleted) - $p_query = prepare("DELETE FROM `reports` WHERE `post` = :id"); - $p_query->bindValue(':id', $report['post'], PDO::PARAM_INT); - $p_query->execute() or error(db_error($query)); - continue; - } - - $reports++; - openBoard($report['uri']); - - if(!$post['thread']) { - $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); - } else { - $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); - } - - $append_html = - '
        ' . - '
        ' . - 'Board: ' . sprintf($config['board_abbreviation'], $report['uri']) . '
        ' . - 'Reason: ' . $report['reason'] . '
        ' . - 'Report date: ' . strftime($config['post_date'], $report['time']) . '
        ' . - (hasPermission($config['mod']['show_ip']) ? - 'Reported by: ' . $report['ip'] . '
        ' - : '') . - '
        ' . - (hasPermission($config['mod']['report_dismiss']) ? - 'Dismiss | ' : '') . - (hasPermission($config['mod']['report_dismiss_ip']) ? - 'Dismiss+' : '') . - '
        '; - - // Bug fix for https://github.com/savetheinternet/Tinyboard/issues/21 - $po->body = truncate($po->body, $po->link(), $config['body_truncate'] - substr_count($append_html, '
        ')); - - if(mb_strlen($po->body) + mb_strlen($append_html) > $config['body_truncate_char']) { - // still too long. temporarily increase limit in the config - $__old_body_truncate_char = $config['body_truncate_char']; - $config['body_truncate_char'] = mb_strlen($po->body) + mb_strlen($append_html); - } - - $po->body .= $append_html; - - $body .= $po->build(true) . '
        '; - - if(isset($__old_body_truncate_char)) - $config['body_truncate_char'] = $__old_body_truncate_char; + continue; } - $query = query("SELECT COUNT(`id`) AS `count` FROM `reports`") or error(db_error()); - $count = $query->fetch(); + $reports++; + openBoard($report['uri']); + + if(!$post['thread']) { + $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); + } else { + $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); + } - $body .= '

        Showing ' . - ($reports == $count['count'] ? 'all ' . $reports . ' reports' : $reports . ' of ' . $count['count'] . ' reports') . '.

        '; + $append_html = + '
        ' . + '
        ' . + 'Board: ' . sprintf($config['board_abbreviation'], $report['uri']) . '
        ' . + 'Reason: ' . $report['reason'] . '
        ' . + 'Report date: ' . strftime($config['post_date'], $report['time']) . '
        ' . + (hasPermission($config['mod']['show_ip']) ? + 'Reported by: ' . $report['ip'] . '
        ' + : '') . + '
        ' . + (hasPermission($config['mod']['report_dismiss']) ? + 'Dismiss | ' : '') . + (hasPermission($config['mod']['report_dismiss_ip']) ? + 'Dismiss+' : '') . + '
        '; - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>_('Report queue') . ' (' . $count['count'] . ')', - 'body'=>$body, - 'mod'=>true - )); - } elseif(preg_match('/^\/reports\/(\d+)\/dismiss(\/all)?$/', $query, $matches)) { - if(isset($matches[2]) && $matches[2] == '/all') { - if(!hasPermission($config['mod']['report_dismiss_ip'])) error($config['error']['noaccess']); - - $query = prepare("SELECT `ip` FROM `reports` WHERE `id` = :id"); - $query->bindValue(':id', $matches[1], PDO::PARAM_INT); + // Bug fix for https://github.com/savetheinternet/Tinyboard/issues/21 + $po->body = truncate($po->body, $po->link(), $config['body_truncate'] - substr_count($append_html, '
        ')); + + if(mb_strlen($po->body) + mb_strlen($append_html) > $config['body_truncate_char']) { + // still too long. temporarily increase limit in the config + $__old_body_truncate_char = $config['body_truncate_char']; + $config['body_truncate_char'] = mb_strlen($po->body) + mb_strlen($append_html); + } + + $po->body .= $append_html; + + $body .= $po->build(true) . '
        '; + + if(isset($__old_body_truncate_char)) + $config['body_truncate_char'] = $__old_body_truncate_char; + } + + $query = query("SELECT COUNT(`id`) AS `count` FROM `reports`") or error(db_error()); + $count = $query->fetch(); + + $body .= '

        Showing ' . + ($reports == $count['count'] ? 'all ' . $reports . ' reports' : $reports . ' of ' . $count['count'] . ' reports') . '.

        '; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Report queue') . ' (' . $count['count'] . ')', + 'body'=>$body, + 'mod'=>true + )); + } elseif(preg_match('/^\/reports\/(\d+)\/dismiss(\/all)?$/', $query, $matches)) { + if(isset($matches[2]) && $matches[2] == '/all') { + if(!hasPermission($config['mod']['report_dismiss_ip'])) error($config['error']['noaccess']); + + $query = prepare("SELECT `ip` FROM `reports` WHERE `id` = :id"); + $query->bindValue(':id', $matches[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($report = $query->fetch()) { + $query = prepare("DELETE FROM `reports` WHERE `ip` = :ip"); + $query->bindValue(':ip', $report['ip'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); - if($report = $query->fetch()) { - $query = prepare("DELETE FROM `reports` WHERE `ip` = :ip"); - $query->bindValue(':ip', $report['ip'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - modLog('Dismissed all reports by ' . $report['ip']); - } - } else { - if(!hasPermission($config['mod']['report_dismiss'])) error($config['error']['noaccess']); + modLog('Dismissed all reports by ' . $report['ip']); + } + } else { + if(!hasPermission($config['mod']['report_dismiss'])) error($config['error']['noaccess']); + + $query = prepare("SELECT `post`, `board` FROM `reports` WHERE `id` = :id"); + $query->bindValue(':id', $matches[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($report = $query->fetch()) { + modLog('Dismissed a report for post #' . $report['post'], $report['board']); - $query = prepare("SELECT `post`, `board` FROM `reports` WHERE `id` = :id"); - $query->bindValue(':id', $matches[1], PDO::PARAM_INT); + $query = prepare("DELETE FROM `reports` WHERE `post` = :post AND `board` = :board"); + $query->bindValue(':board', $report['board'], PDO::PARAM_INT); + $query->bindValue(':post', $report['post'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); - - if($report = $query->fetch()) { - modLog('Dismissed a report for post #' . $report['post'], $report['board']); - - $query = prepare("DELETE FROM `reports` WHERE `post` = :post AND `board` = :board"); - $query->bindValue(':board', $report['board'], PDO::PARAM_INT); - $query->bindValue(':post', $report['post'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); + } + } + + // Redirect + header('Location: ?/reports', true, $config['redirect_http']); + } elseif(preg_match('/^\/board\/(\w+)(\/delete)?$/', $query, $matches)) { + if(!hasPermission($config['mod']['manageboards'])) error($config['error']['noaccess']); + + if(!openBoard($matches[1])) + error($config['error']['noboard']); + + if(isset($matches[2]) && $matches[2] == '/delete') { + if(!hasPermission($config['mod']['deleteboard'])) error($config['error']['noaccess']); + // Delete board + + modLog('Deleted board ' . sprintf($config['board_abbreviation'], $board['uri'])); + + // Delete entire board directory + rrmdir($board['uri'] . '/'); + + // Delete posting table + $query = query(sprintf("DROP TABLE IF EXISTS `posts_%s`", $board['uri'])) or error(db_error()); + + // Clear reports + $query = prepare("DELETE FROM `reports` WHERE `board` = :id"); + $query->bindValue(':id', $board['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + // Delete from table + $query = prepare("DELETE FROM `boards` WHERE `id` = :id"); + $query->bindValue(':id', $board['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($config['cache']['enabled']) { + cache::delete('board_' . $board['uri']); + cache::delete('all_boards'); + } + + $query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board"); + $query->bindValue(':board', $board['uri']); + $query->execute() or error(db_error($query)); + while($cite = $query->fetch()) { + if($board['uri'] != $cite['board']) { + if(!isset($tmp_board)) + $tmp_board = $board; + openBoard($cite['board']); + rebuildPost($cite['post']); } } - // Redirect - header('Location: ?/reports', true, $config['redirect_http']); - } elseif(preg_match('/^\/board\/(\w+)(\/delete)?$/', $query, $matches)) { - if(!hasPermission($config['mod']['manageboards'])) error($config['error']['noaccess']); + if(isset($tmp_board)) + $board = $tmp_board; - if(!openBoard($matches[1])) - error($config['error']['noboard']); + $query = prepare("DELETE FROM `cites` WHERE `board` = :board OR `target_board` = :board"); + $query->bindValue(':board', $board['uri']); + $query->execute() or error(db_error($query)); - if(isset($matches[2]) && $matches[2] == '/delete') { - if(!hasPermission($config['mod']['deleteboard'])) error($config['error']['noaccess']); - // Delete board - - modLog('Deleted board ' . sprintf($config['board_abbreviation'], $board['uri'])); - - // Delete entire board directory - rrmdir($board['uri'] . '/'); - - // Delete posting table - $query = query(sprintf("DROP TABLE IF EXISTS `posts_%s`", $board['uri'])) or error(db_error()); + $_board = $board; + + rebuildThemes('boards'); + + $board = $_board; + + header('Location: ?/', true, $config['redirect_http']); + } else { + if(isset($_POST['title']) && isset($_POST['subtitle'])) { + $query = prepare("UPDATE `boards` SET `title` = :title, `subtitle` = :subtitle WHERE `id` = :id"); + $query->bindValue(':title', utf8tohtml($_POST['title'], true)); - // Clear reports - $query = prepare("DELETE FROM `reports` WHERE `board` = :id"); - $query->bindValue(':id', $board['id'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); + if(!empty($_POST['subtitle'])) + $query->bindValue(':subtitle', utf8tohtml($_POST['subtitle'], true)); + else + $query->bindValue(':subtitle', null, PDO::PARAM_NULL); - // Delete from table - $query = prepare("DELETE FROM `boards` WHERE `id` = :id"); $query->bindValue(':id', $board['id'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); @@ -1678,1452 +1723,1407 @@ cache::delete('all_boards'); } - $query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board"); - $query->bindValue(':board', $board['uri']); - $query->execute() or error(db_error($query)); - while($cite = $query->fetch()) { - if($board['uri'] != $cite['board']) { - if(!isset($tmp_board)) - $tmp_board = $board; - openBoard($cite['board']); - rebuildPost($cite['post']); - } - } - - if(isset($tmp_board)) - $board = $tmp_board; - - $query = prepare("DELETE FROM `cites` WHERE `board` = :board OR `target_board` = :board"); - $query->bindValue(':board', $board['uri']); - $query->execute() or error(db_error($query)); - $_board = $board; rebuildThemes('boards'); $board = $_board; - header('Location: ?/', true, $config['redirect_http']); - } else { - if(isset($_POST['title']) && isset($_POST['subtitle'])) { - $query = prepare("UPDATE `boards` SET `title` = :title, `subtitle` = :subtitle WHERE `id` = :id"); - $query->bindValue(':title', utf8tohtml($_POST['title'], true)); - - if(!empty($_POST['subtitle'])) - $query->bindValue(':subtitle', utf8tohtml($_POST['subtitle'], true)); - else - $query->bindValue(':subtitle', null, PDO::PARAM_NULL); - - $query->bindValue(':id', $board['id'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - if($config['cache']['enabled']) { - cache::delete('board_' . $board['uri']); - cache::delete('all_boards'); - } - - $_board = $board; - - rebuildThemes('boards'); - - $board = $_board; - - openBoard($board['uri']); + openBoard($board['uri']); + } + + $body = + '
        ' . + sprintf($config['board_abbreviation'], $board['uri']) . '' . + ' - ' . $board['name'] . '' . + + // Begin form + '
        ' . + + '' . + + '' . + '' . + '' . + + '
        URI' . $board['uri'] . '
        Title
        Subtitle
        ' . + + '' . + + // End form + '
        ' . + + // Delete button + (hasPermission($config['mod']['deleteboard']) ? + '

        Delete board

        ' + :'') . + + '
        '; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Manage – ' . sprintf($config['board_abbreviation'], $board['uri']), + 'body'=>$body, + 'mod'=>true + )); + } + } elseif(preg_match('/^\/bans$/', $query)) { + if(!hasPermission($config['mod']['view_banlist'])) error($config['error']['noaccess']); + + if(isset($_POST['unban'])) { + if(!hasPermission($config['mod']['unban'])) error($config['error']['noaccess']); + + foreach($_POST as $post => $value) { + if(preg_match('/^ban_(\d+)$/', $post, $m)) { + removeBan($m[1]); } + } + } + if(hasPermission($config['mod']['view_banexpired'])) { + $query = prepare("SELECT `bans`.*, `username`, `uri` FROM `bans` LEFT JOIN `boards` ON `boards`.`id` = `board` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC"); + $query->bindValue(':time', time(), PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } else { + // Filter out expired bans + $query = prepare("SELECT `bans`.*, `username`, `uri` FROM `bans` LEFT JOIN `boards` ON `boards`.`id` = `board` INNER JOIN `mods` ON `mod` = `mods`.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC"); + $query->bindValue(':time', time(), PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } + + if($query->rowCount() < 1) { + $body = '

        (There are no active bans.)

        '; + } else { + $body = '
        '; + $body .= ''; + + while($ban = $query->fetch()) { + $body .= + '' . - $body = - '
        ' . - sprintf($config['board_abbreviation'], $board['uri']) . '' . - ' - ' . $board['name'] . '' . - - // Begin form - '' . - - '
        ' . _('IP address') . '' . _('Reason') . '' . _('Board') . '' . _('Set') . '' . _('Expires') . '' . _('Staff') . '
        ' . - - '' . - '' . - '' . + '
        URI' . $board['uri'] . '
        Title
        Subtitle
        ' . - '
        ' . + // Checkbox + ' ' . - '' . + // IP address + (preg_match('/^(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $ban['ip']) ? + ''. $ban['ip'] . '' + : utf8tohtml($ban['ip'])) . - // End form - '
        ' . + '' . - // Delete button - (hasPermission($config['mod']['deleteboard']) ? - '

        Delete board

        ' - :'') . + // Reason + '' . ($ban['reason'] ? $ban['reason'] : '-') . '' . - ''; - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Manage – ' . sprintf($config['board_abbreviation'], $board['uri']), - 'body'=>$body, - 'mod'=>true - )); - } - } elseif(preg_match('/^\/bans$/', $query)) { - if(!hasPermission($config['mod']['view_banlist'])) error($config['error']['noaccess']); - - if(isset($_POST['unban'])) { - if(!hasPermission($config['mod']['unban'])) error($config['error']['noaccess']); + '' . + (isset($ban['uri']) ? + sprintf($config['board_abbreviation'], $ban['uri']) + : + '' . _('all boards') . '' + ) . '' . - foreach($_POST as $post => $value) { - if(preg_match('/^ban_(\d+)$/', $post, $m)) { - removeBan($m[1]); - } - } - } - if(hasPermission($config['mod']['view_banexpired'])) { - $query = prepare("SELECT `bans`.*, `username`, `uri` FROM `bans` LEFT JOIN `boards` ON `boards`.`id` = `board` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC"); - $query->bindValue(':time', time(), PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } else { - // Filter out expired bans - $query = prepare("SELECT `bans`.*, `username`, `uri` FROM `bans` LEFT JOIN `boards` ON `boards`.`id` = `board` INNER JOIN `mods` ON `mod` = `mods`.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC"); - $query->bindValue(':time', time(), PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } - - if($query->rowCount() < 1) { - $body = '

        (There are no active bans.)

        '; - } else { - $body = '
        '; - $body .= ''; + // Set + '' . - while($ban = $query->fetch()) { - $body .= - '' . - - '' . - - // Reason - '' . - - - '' . - - // Set - '' . - - // Expires - '' . - - // Staff - '' . + + // Staff + '' . - - ''; - } - - $body .= '
        ' . _('IP address') . '' . _('Reason') . '' . _('Board') . '' . _('Set') . '' . _('Expires') . '' . _('Staff') . '
        ' . strftime($config['post_date'], $ban['set']) . '' . - - // Checkbox - ' ' . - - // IP address - (preg_match('/^(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $ban['ip']) ? - ''. $ban['ip'] . '' - : utf8tohtml($ban['ip'])) . - - '' . ($ban['reason'] ? $ban['reason'] : '-') . '' . - (isset($ban['uri']) ? - sprintf($config['board_abbreviation'], $ban['uri']) + // Expires + '' . + ($ban['expires'] == 0 ? + 'Never' : - '' . _('all boards') . '' - ) . '' . strftime($config['post_date'], $ban['set']) . '' . - ($ban['expires'] == 0 ? - 'Never' - : - strftime($config['post_date'], $ban['expires']) - ) . - '' . - (isset($ban['username']) ? - (!hasPermission($config['mod']['view_banstaff']) ? - ($config['mod']['view_banquestionmark'] ? - '?' - : - ($ban['type'] == JANITOR ? 'Janitor' : - ($ban['type'] == MOD ? 'Mod' : - ($ban['type'] == ADMIN ? 'Admin' : - '?'))) - ) + strftime($config['post_date'], $ban['expires']) + ) . + '' . + (isset($ban['username']) ? + (!hasPermission($config['mod']['view_banstaff']) ? + ($config['mod']['view_banquestionmark'] ? + '?' : - utf8tohtml($ban['username']) + ($ban['type'] == JANITOR ? 'Janitor' : + ($ban['type'] == MOD ? 'Mod' : + ($ban['type'] == ADMIN ? 'Admin' : + '?'))) ) : - 'deleted?' - ) . - '
        ' . - - (hasPermission($config['mod']['unban']) ? - '

        ' - : '') . + utf8tohtml($ban['username']) + ) + : + 'deleted?' + ) . + '' . - '
        '; - } - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>_('Ban list'), - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/flush$/', $query)) { - if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']); - if(!$config['cache']['enabled']) error(_('Cache is not enabled.')); - - if(cache::flush()) { - $body = 'Successfully invalidated all items in cache.'; - modLog('Cleared cache'); - } else { - $body = 'An error occured while trying to flush cache.'; + ''; } - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Flushed', - 'body'=>'

        ' . $body . '

        ', - 'mod'=>true - )); - } elseif(preg_match('/^\/rebuild$/', $query)) { - if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']); - - set_time_limit($config['mod']['rebuild_timelimit']); + $body .= '' . - $body = '

        Rebuilding…

        '; + (hasPermission($config['mod']['unban']) ? + '

        ' + : '') . - $body .= 'Clearing template cache…
        '; - $twig = new Twig_Environment($loader, Array( - 'cache' => "{$config['dir']['template']}/cache" - )); - $twig->clearCacheFiles(); + ''; + } + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Ban list'), + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/flush$/', $query)) { + if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']); + if(!$config['cache']['enabled']) error(_('Cache is not enabled.')); + + if(cache::flush()) { + $body = 'Successfully invalidated all items in cache.'; + modLog('Cleared cache'); + } else { + $body = 'An error occured while trying to flush cache.'; + } + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Flushed', + 'body'=>'

        ' . $body . '

        ', + 'mod'=>true + )); + } elseif(preg_match('/^\/rebuild$/', $query)) { + if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']); + + set_time_limit($config['mod']['rebuild_timelimit']); - $body .= 'Regenerating theme files…
        '; - rebuildThemes('all'); + $body = '

        Rebuilding…

        '; + + $body .= 'Clearing template cache…
        '; + $twig = new Twig_Environment($loader, array( + 'cache' => "{$config['dir']['template']}/cache" + )); + $twig->clearCacheFiles(); + + $body .= 'Regenerating theme files…
        '; + rebuildThemes('all'); + + $body .= 'Generating Javascript file…
        '; + buildJavascript(); + + $main_js = $config['file_script']; + + $boards = listBoards(); + + foreach($boards as &$board) { + $body .= "Opening board /{$board['uri']}/
        "; + openBoard($board['uri']); - $body .= 'Generating Javascript file…
        '; - buildJavascript(); + $body .= 'Creating index pages
        '; + buildIndex(); - $main_js = $config['file_script']; + if($config['file_script'] != $main_js) { + // different javascript file + $body .= 'Generating Javascript file…
        '; + buildJavascript(); + } - $boards = listBoards(); + $query = query(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); + while($post = $query->fetch()) { + $body .= "Rebuilding #{$post['id']}
        "; + buildThread($post['id']); + } + } + $body .= 'Complete!

        '; + + unset($board); + modLog('Rebuilt everything'); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'Rebuilt', + 'body'=>$body, + 'mod'=>true + )); + } elseif(preg_match('/^\/config\/edit$/', $query)) { + if(!hasPermission($config['mod']['edit_config'])) + error($config['error']['noaccess']); + + // TODO: display "unset variables" + // $config_file = file_get_contents('inc/config.php'); + // preg_match_all('/\$config\[\'(\w+)\']/', $config_file, $matches); + // $config_variables = array_unique($matches[1]); + + $body = '
        ' . _('Configuration') . '
        '; + + $var_force_string = array('blotter'); + $var_system = array('version'); + + if(isset($_POST['save_changes'])) { + $config_append = ''; - foreach($boards as &$board) { - $body .= "Opening board /{$board['uri']}/
        "; - openBoard($board['uri']); + foreach($config as $name => $original_value) { + if(in_array($name, $var_system)) + continue; + $type = gettype($original_value); + if($type == 'array' || $type == 'NULL') + continue; - $body .= 'Creating index pages
        '; - buildIndex(); + if($type == 'boolean' && in_array($name, $var_force_string)) + $type = 'string'; - if($config['file_script'] != $main_js) { - // different javascript file - $body .= 'Generating Javascript file…
        '; - buildJavascript(); - } + if(!isset($_POST[$name]) && $type != 'boolean') + continue; - $query = query(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error()); - while($post = $query->fetch()) { - $body .= "Rebuilding #{$post['id']}
        "; - buildThread($post['id']); - } - } - $body .= 'Complete!

        '; - - unset($board); - modLog('Rebuilt everything'); - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Rebuilt', - 'body'=>$body, - 'mod'=>true - )); - } elseif(preg_match('/^\/config\/edit$/', $query)) { - if(!hasPermission($config['mod']['edit_config'])) - error($config['error']['noaccess']); - - // TODO: display "unset variables" - // $config_file = file_get_contents('inc/config.php'); - // preg_match_all('/\$config\[\'(\w+)\']/', $config_file, $matches); - // $config_variables = array_unique($matches[1]); - - $body = '
        ' . _('Configuration') . '
        '; - - $var_force_string = Array('blotter'); - $var_system = Array('version'); - - if(isset($_POST['save_changes'])) { - $config_append = ''; + if($type == 'boolean') + $value = isset($_POST[$name]); + else + $value = $_POST[$name]; - foreach($config as $name => $original_value) { - if(in_array($name, $var_system)) - continue; - $type = gettype($original_value); - if($type == 'array' || $type == 'NULL') - continue; - - if($type == 'boolean' && in_array($name, $var_force_string)) - $type = 'string'; - - if(!isset($_POST[$name]) && $type != 'boolean') - continue; - + if($value != $original_value) { + // value has been changed + $config_append .= "\$config['" . addslashes($name) . "'] = "; if($type == 'boolean') - $value = isset($_POST[$name]); - else - $value = $_POST[$name]; - - if($value != $original_value) { - // value has been changed - $config_append .= "\$config['" . addslashes($name) . "'] = "; - if($type == 'boolean') - $config_append .= $value ? 'true' : 'false'; - elseif($type == 'integer') - $config_append .= (int)$value; - elseif($type == 'string') - $config_append .= '\'' . addslashes($value) . '\''; - $config_append .= ";\n"; - } - } - - if(!empty($config_append)) { - $config_append = "\n// Changes made via web editor by \"" . $mod['username'] . "\" @ " . date('r') . ":\n" . $config_append . "\n"; - if(@file_put_contents('inc/instance-config.php', $config_append, FILE_APPEND)) { - header('Location: ?/config' . $b['uri'], true, $config['redirect_http']); - exit; - } else { - $config_append = htmlentities($config_append); - - if($config['minify_html']) - $config_append = str_replace("\n", ' ', $config_append); - $page = Array(); - $page['title'] = 'Cannot write to file!'; - $page['config'] = $config; - $page['body'] = ' -

        Tinyboard could not write to inc/instance-config.php with the ammended configuration, probably due to a permissions error.

        -

        You may proceed with these changes manually by copying and pasting the following code to the bottom of inc/instance-config.php:

        - - '; - echo Element('page.html', $page); - exit; - } + $config_append .= $value ? 'true' : 'false'; + elseif($type == 'integer') + $config_append .= (int)$value; + elseif($type == 'string') + $config_append .= '\'' . addslashes($value) . '\''; + $config_append .= ";\n"; } } - foreach($config as $name => $value) { - $body .= ''; - - $body .= ''; - $type = gettype($value); - if($type == 'array') { - $body .= ''; + if(!empty($config_append)) { + $config_append = "\n// Changes made via web editor by \"" . $mod['username'] . "\" @ " . date('r') . ":\n" . $config_append . "\n"; + if(@file_put_contents('inc/instance-config.php', $config_append, FILE_APPEND)) { + header('Location: ?/config' . $b['uri'], true, $config['redirect_http']); + exit; } else { - if($type == 'string' || $type == 'integer') { - $body .= ''; - } elseif($type == 'boolean') { - if(in_array($name, $var_force_string)) - $body .= ''; - else - $body .= ''; - } else { - $body .= ''; - } + $config_append = htmlentities($config_append); + + if($config['minify_html']) + $config_append = str_replace("\n", ' ', $config_append); + $page = array(); + $page['title'] = 'Cannot write to file!'; + $page['config'] = $config; + $page['body'] = ' +

        Tinyboard could not write to inc/instance-config.php with the ammended configuration, probably due to a permissions error.

        +

        You may proceed with these changes manually by copying and pasting the following code to the bottom of inc/instance-config.php:

        + + '; + echo Element('page.html', $page); + exit; } - - $body .= ''; } + } + + foreach($config as $name => $value) { + $body .= ''; - $body .= '
        ' . utf8tohtml($name) . '[edit]' . '' . utf8tohtml($value) . '
        '; - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>_('Configuration'), - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/config$/', $query)) { - if(!hasPermission($config['mod']['show_config'])) - error($config['error']['noaccess']); - - // Show instance-config.php + $body .= '' . utf8tohtml($name) . ''; + $type = gettype($value); + if($type == 'array') { + $body .= '[edit]' . ''; + } else { + if($type == 'string' || $type == 'integer') { + $body .= ''; + } elseif($type == 'boolean') { + if(in_array($name, $var_force_string)) + $body .= ''; + else + $body .= ''; + } else { + $body .= '' . utf8tohtml($value) . ''; + } + } - $data = ''; + $body .= ''; + } + + $body .= '
        '; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Configuration'), + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/config$/', $query)) { + if(!hasPermission($config['mod']['show_config'])) + error($config['error']['noaccess']); + + // Show instance-config.php + + $data = ''; + + function do_array_part($array, $prefix = '') { + global $data, $config; - function do_array_part($array, $prefix = '') { - global $data, $config; - - foreach($array as $name => $value) { - if(is_array($value)) { - do_array_part($value, $prefix . $name . ' → '); - } else { - if($config['mod']['never_reveal_password'] && $prefix == 'db → ' && $name == 'password') { - $value = 'hidden'; - } elseif(gettype($value) == 'boolean') { - $value = $value ? 'On' : 'Off'; - } elseif(gettype($value) == 'string') { - if(empty($value)) - $value = 'empty'; - else - $value = '' . utf8tohtml(substr($value, 0, 110) . (mb_strlen($value) > 110 ? '…' : '')) . ''; - } elseif(gettype($value) == 'integer') { - $value = '' . $value . ''; - } elseif(is_object($value) && get_class($value) == 'Closure') { - $value = '[callback]'; - } - - $data .= - '' . - $prefix . (gettype($name) == 'integer' ? '[]' : utf8tohtml($name)) . - '' . - $value . - ''; - } + foreach($array as $name => $value) { + if(is_array($value)) { + do_array_part($value, $prefix . $name . ' → '); + } else { + if($config['mod']['never_reveal_password'] && $prefix == 'db → ' && $name == 'password') { + $value = 'hidden'; + } elseif(gettype($value) == 'boolean') { + $value = $value ? 'On' : 'Off'; + } elseif(gettype($value) == 'string') { + if(empty($value)) + $value = 'empty'; + else + $value = '' . utf8tohtml(substr($value, 0, 110) . (mb_strlen($value) > 110 ? '…' : '')) . ''; + } elseif(gettype($value) == 'integer') { + $value = '' . $value . ''; + } elseif(is_object($value) && get_class($value) == 'Closure') { + $value = '[callback]'; + } + + $data .= + '' . + $prefix . (gettype($name) == 'integer' ? '[]' : utf8tohtml($name)) . + '' . + $value . + ''; } } + } + + do_array_part($config); + + + $body = (hasPermission($config['mod']['edit_config']) ? + '

        ' . + '[Edit using web editor]' : '') . + '

        ' . _('Configuration') . '' . $data . '
        '; + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>_('Configuration'), + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/new$/', $query)) { + if(!hasPermission($config['mod']['newboard'])) error($config['error']['noaccess']); + + // New board + $body = ''; + + if(isset($_POST['new_board'])) { + // Create new board + if( !isset($_POST['uri']) || + !isset($_POST['title']) || + !isset($_POST['subtitle']) + ) error($config['error']['missedafield']); + + $b = array( + 'uri' => $_POST['uri'], + 'title' => $_POST['title'], + 'subtitle' => $_POST['subtitle'] + ); - do_array_part($config); - + // HTML characters + $b['title'] = utf8tohtml($b['title'], true); + $b['subtitle'] = utf8tohtml($b['subtitle'], true); - $body = (hasPermission($config['mod']['edit_config']) ? - '

        ' . - '[Edit using web editor]' : '') . - '

        ' . _('Configuration') . '' . $data . '
        '; + // Check required fields + if(empty($b['uri'])) + error(sprintf($config['error']['required'], 'URI')); + if(empty($b['title'])) + error(sprintf($config['error']['required'], 'title')); - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>_('Configuration'), - 'body'=>$body, - 'mod'=>true - ) - ); - } elseif(preg_match('/^\/new$/', $query)) { - if(!hasPermission($config['mod']['newboard'])) error($config['error']['noaccess']); + if(!preg_match('/^\w+$/', $b['uri'])) + error(sprintf($config['error']['invalidfield'], 'URI')); - // New board - $body = ''; + if(openBoard($b['uri'])) { + unset($board); + error(sprintf($config['error']['boardexists'], sprintf($config['board_abbreviation'], $b['uri']))); + } - if(isset($_POST['new_board'])) { - // Create new board - if( !isset($_POST['uri']) || - !isset($_POST['title']) || - !isset($_POST['subtitle']) - ) error($config['error']['missedafield']); - - $b = Array( - 'uri' => $_POST['uri'], - 'title' => $_POST['title'], - 'subtitle' => $_POST['subtitle'] - ); - - // HTML characters - $b['title'] = utf8tohtml($b['title'], true); - $b['subtitle'] = utf8tohtml($b['subtitle'], true); - - // Check required fields - if(empty($b['uri'])) - error(sprintf($config['error']['required'], 'URI')); - if(empty($b['title'])) - error(sprintf($config['error']['required'], 'title')); - - if(!preg_match('/^\w+$/', $b['uri'])) - error(sprintf($config['error']['invalidfield'], 'URI')); - - if(openBoard($b['uri'])) { - unset($board); - error(sprintf($config['error']['boardexists'], sprintf($config['board_abbreviation'], $b['uri']))); - } - - $query = prepare("INSERT INTO `boards` VALUES (NULL, :uri, :title, :subtitle)"); - $query->bindValue(':uri', $b['uri']); - $query->bindValue(':title', $b['title']); - if(!empty($b['subtitle'])) { - $query->bindValue(':subtitle', $b['subtitle']); - } else { - $query->bindValue(':subtitle', null, PDO::PARAM_NULL); - } - $query->execute() or error(db_error($query)); - - // Record the action - modLog("Created a new board: {$b['title']}"); - - // Open the board - openBoard($b['uri']) or error(_("Couldn't open board after creation.")); - - // Create the posts table - query(Element('posts.sql', Array('board' => $board['uri']))) or error(db_error()); - - if($config['cache']['enabled']) - cache::delete('all_boards'); - - // Build the board - buildIndex(); - - rebuildThemes('boards'); - - header('Location: ?/board/' . $b['uri'], true, $config['redirect_http']); + $query = prepare("INSERT INTO `boards` VALUES (NULL, :uri, :title, :subtitle)"); + $query->bindValue(':uri', $b['uri']); + $query->bindValue(':title', $b['title']); + if(!empty($b['subtitle'])) { + $query->bindValue(':subtitle', $b['subtitle']); } else { - - $body .= form_newBoard(); - - // TODO: Statistics, etc, in the dashboard. - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'New board', - 'body'=>$body, - 'mod'=>true - ) - ); + $query->bindValue(':subtitle', null, PDO::PARAM_NULL); } - } elseif(preg_match('/^\/' . $regex['board'] . '(' . $regex['index'] . '|' . $regex['page'] . ')?$/', $query, $matches)) { - // Board index - - $boardName = &$matches[1]; + $query->execute() or error(db_error($query)); - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); + // Record the action + modLog("Created a new board: {$b['title']}"); - $page_no = empty($matches[2]) || $matches[2] == $config['file_index'] ? 1 : $matches[2]; + // Open the board + openBoard($b['uri']) or error(_("Couldn't open board after creation.")); - if(!$page = index($page_no, $mod)) { - error($config['error']['404']); - } + // Create the posts table + query(Element('posts.sql', array('board' => $board['uri']))) or error(db_error()); - $page['pages'] = getPages(true); - $page['pages'][$page_no-1]['selected'] = true; - $page['btn'] = getPageButtons($page['pages'], true); - $page['mod'] = true; + if($config['cache']['enabled']) + cache::delete('all_boards'); - echo Element('index.html', $page); - } elseif(preg_match('/^\/' . $regex['board'] . $regex['res'] . $regex['page'] . '$/', $query, $matches)) { - // View thread + // Build the board + buildIndex(); - $boardName = &$matches[1]; - $thread = &$matches[2]; - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); + rebuildThemes('boards'); - $page = buildThread($thread, true, $mod); + header('Location: ?/board/' . $b['uri'], true, $config['redirect_http']); + } else { - echo $page; - } elseif(preg_match('/^\/' . $regex['board'] . 'edit\/(\d+)$/', $query, $matches)) { - // Edit post body + $body .= form_newBoard(); - $boardName = &$matches[1]; + // TODO: Statistics, etc, in the dashboard. - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'New board', + 'body'=>$body, + 'mod'=>true + ) + ); + } + } elseif(preg_match('/^\/' . $regex['board'] . '(' . $regex['index'] . '|' . $regex['page'] . ')?$/', $query, $matches)) { + // Board index + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + $page_no = empty($matches[2]) || $matches[2] == $config['file_index'] ? 1 : $matches[2]; + + if(!$page = index($page_no, $mod)) { + error($config['error']['404']); + } + + $page['pages'] = getPages(true); + $page['pages'][$page_no-1]['selected'] = true; + $page['btn'] = getPageButtons($page['pages'], true); + $page['mod'] = true; + + echo Element('index.html', $page); + } elseif(preg_match('/^\/' . $regex['board'] . $regex['res'] . $regex['page'] . '$/', $query, $matches)) { + // View thread + + $boardName = &$matches[1]; + $thread = &$matches[2]; + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + $page = buildThread($thread, true, $mod); + + echo $page; + } elseif(preg_match('/^\/' . $regex['board'] . 'edit\/(\d+)$/', $query, $matches)) { + // Edit post body + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['editpost'], $boardName)) error($config['error']['noaccess']); + + $postID = &$matches[2]; + + $query = prepare(sprintf("SELECT `body_nomarkup`, `name`, `subject`, `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $post = $query->fetch() or error($config['error']['invalidpost']); + + if(isset($_POST['submit']) && isset($_POST['body']) && isset($_POST['subject'])) { + if(mb_strlen($_POST['subject']) > 100) + error(sprintf($config['error']['toolong'], 'subject')); - if(!hasPermission($config['mod']['editpost'], $boardName)) error($config['error']['noaccess']); + $body = $_POST['body']; + $body_nomarkup = $body; - $postID = &$matches[2]; + wordfilters($body); + $tracked_cites = markup($body, true); - $query = prepare(sprintf("SELECT `body_nomarkup`, `name`, `subject`, `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query = prepare("DELETE FROM `cites` WHERE `board` = :board AND `post` = :post"); + $query->bindValue(':board', $board['uri']); + $query->bindValue(':post', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + $query = prepare(sprintf("UPDATE `posts_%s` SET `body` = :body, `body_nomarkup` = :body_nomarkup, `subject` = :subject WHERE `id` = :id", $board['uri'])); $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->bindValue(':body', $body); + $query->bindValue(':body_nomarkup', $body_nomarkup); + $query->bindValue(':subject', utf8tohtml($_POST['subject'])); $query->execute() or error(db_error($query)); - $post = $query->fetch() or error($config['error']['invalidpost']); - - if(isset($_POST['submit']) && isset($_POST['body']) && isset($_POST['subject'])) { - if(mb_strlen($_POST['subject']) > 100) - error(sprintf($config['error']['toolong'], 'subject')); - - $body = $_POST['body']; - $body_nomarkup = $body; - - wordfilters($body); - $tracked_cites = markup($body, true); - - $query = prepare("DELETE FROM `cites` WHERE `board` = :board AND `post` = :post"); - $query->bindValue(':board', $board['uri']); - $query->bindValue(':post', $postID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - $query = prepare(sprintf("UPDATE `posts_%s` SET `body` = :body, `body_nomarkup` = :body_nomarkup, `subject` = :subject WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $postID, PDO::PARAM_INT); - $query->bindValue(':body', $body); - $query->bindValue(':body_nomarkup', $body_nomarkup); - $query->bindValue(':subject', utf8tohtml($_POST['subject'])); - $query->execute() or error(db_error($query)); - - if(isset($tracked_cites)) { - foreach($tracked_cites as $cite) { - $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); - $query->bindValue(':board', $board['uri']); - $query->bindValue(':post', $postID, PDO::PARAM_INT); - $query->bindValue(':target_board',$cite[0]); - $query->bindValue(':target', $cite[1], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } + if(isset($tracked_cites)) { + foreach($tracked_cites as $cite) { + $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); + $query->bindValue(':board', $board['uri']); + $query->bindValue(':post', $postID, PDO::PARAM_INT); + $query->bindValue(':target_board',$cite[0]); + $query->bindValue(':target', $cite[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); } - - // Record the action - modLog("Edited post #{$postID}"); - - buildThread($post['thread'] ? $post['thread'] : $postID); - - // Rebuild board - buildIndex(); - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - exit; } - - $post['body_nomarkup'] = utf8tohtml($post['body_nomarkup']); - - if($config['minify_html']) - $post['body_nomarkup'] = str_replace("\n", ' ', $post['body_nomarkup']); - - $body = '
        ' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '
        Name' . utf8tohtml($post['name']) . '
        Subject' . - '' . - '' . - '
        Body' . - '' . - '
        ' . - '
        '; - - echo Element('page.html', Array( - 'config' => $config, - 'body' => $body, - 'title' => 'Edit Post #' . $postID - )); - } elseif(preg_match('/^\/' . $regex['board'] . 'deletefile\/(\d+)$/', $query, $matches)) { - // Delete file from post - - $boardName = &$matches[1]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['deletefile'], $boardName)) error($config['error']['noaccess']); - - $post = &$matches[2]; - - // Delete post - deleteFile($post); - + // Record the action - modLog("Removed file from post #{$post}"); + modLog("Edited post #{$postID}"); + + buildThread($post['thread'] ? $post['thread'] : $postID); // Rebuild board buildIndex(); - + // Redirect header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/' . $regex['board'] . 'delete\/(\d+)$/', $query, $matches)) { - // Delete post - - $boardName = &$matches[1]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['delete'], $boardName)) error($config['error']['noaccess']); - - $post = &$matches[2]; - - // Delete post - deletePost($post); - + exit; + } + + $post['body_nomarkup'] = utf8tohtml($post['body_nomarkup']); + + if($config['minify_html']) + $post['body_nomarkup'] = str_replace("\n", ' ', $post['body_nomarkup']); + + $body = '
        ' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '
        Name' . utf8tohtml($post['name']) . '
        Subject' . + '' . + '' . + '
        Body' . + '' . + '
        ' . + '
        '; + + echo Element('page.html', array( + 'config' => $config, + 'body' => $body, + 'title' => 'Edit Post #' . $postID + )); + } elseif(preg_match('/^\/' . $regex['board'] . 'deletefile\/(\d+)$/', $query, $matches)) { + // Delete file from post + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['deletefile'], $boardName)) error($config['error']['noaccess']); + + $post = &$matches[2]; + + // Delete post + deleteFile($post); + + // Record the action + modLog("Removed file from post #{$post}"); + + // Rebuild board + buildIndex(); + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/' . $regex['board'] . 'delete\/(\d+)$/', $query, $matches)) { + // Delete post + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['delete'], $boardName)) error($config['error']['noaccess']); + + $post = &$matches[2]; + + // Delete post + deletePost($post); + + // Record the action + modLog("Deleted post #{$post}"); + + // Rebuild board + buildIndex(); + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/' . $regex['board'] . '(un)?sticky\/(\d+)$/', $query, $matches)) { + // Add/remove sticky + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['sticky'], $boardName)) error($config['error']['noaccess']); + + $post = &$matches[3]; + + $query = prepare(sprintf("UPDATE `posts_%s` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + + if($matches[2] == 'un') { + // Record the action + modLog("Unstickied post #{$post}"); + $query->bindValue(':sticky', 0, PDO::PARAM_INT); + } else { // Record the action - modLog("Deleted post #{$post}"); + modLog("Stickied post #{$post}"); + $query->bindValue(':sticky', 1, PDO::PARAM_INT); + } + + $query->execute() or error(db_error($query)); + + buildIndex(); + buildThread($post); + + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/' . $regex['board'] . '(un)?lock\/(\d+)$/', $query, $matches)) { + // Lock/Unlock + + $boardName = &$matches[1]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['lock'], $boardName)) error($config['error']['noaccess']); + + $post = &$matches[3]; + + $query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + + if($matches[2] == 'un') { + // Record the action + modLog("Unlocked post #{$post}"); + $query->bindValue(':locked', 0, PDO::PARAM_INT); + } else { + // Record the action + modLog("Locked post #{$post}"); + $query->bindValue(':locked', 1, PDO::PARAM_INT); + } + + $query->execute() or error(db_error($query)); + + buildIndex(); + buildThread($post); + + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/' . $regex['board'] . 'bump(un)?lock\/(\d+)$/', $query, $matches)) { + // Lock/Unlock + + $boardName = &$matches[1]; + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['bumplock'], $boardName)) error($config['error']['noaccess']); + + $post = &$matches[3]; + + $query = prepare(sprintf("UPDATE `posts_%s` SET `sage` = :bumplocked WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + + if($matches[2] == 'un') { + // Record the action + modLog("Unbumplocked post #{$post}"); + $query->bindValue(':bumplocked', 0, PDO::PARAM_INT); + } else { + // Record the action + modLog("Bumplocked post #{$post}"); + $query->bindValue(':bumplocked', 1, PDO::PARAM_INT); + } + + $query->execute() or error(db_error($query)); + + buildIndex(); + buildThread($post); + + + // Redirect + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/' . $regex['board'] . 'deletebyip\/(\d+)(\/global)?$/', $query, $matches)) { + // Delete all posts by an IP + + $boardName = &$matches[1]; + $post = &$matches[2]; + $global = isset($matches[3]) && $matches[3] == '/global'; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + $query = prepare(sprintf("SELECT `ip` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $post); + $query->execute() or error(db_error($query)); + + if(!$post = $query->fetch()) + error($config['error']['invalidpost']); + + $ip = $post['ip']; + + if($global) + $boards = listBoards(); + else + $boards = array(array('uri' => $board['uri'])); + + $query = ''; + foreach($boards as $_board) { + $query .= sprintf("SELECT `id`, '%s' AS `board` FROM `posts_%s` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']); + } + $query = preg_replace('/UNION ALL $/', '', $query); + + $query = prepare($query); + $query->bindValue(':ip', $ip); + $query->execute() or error(db_error($query)); + + if($query->rowCount() < 1) + error($config['error']['invalidpost']); + + $boards = array(); + while($post = $query->fetch()) { + openBoard($post['board']); + $boards[] = $post['board']; - // Rebuild board + deletePost($post['id'], false); + } + + foreach($boards as &$_board) { + openBoard($_board); buildIndex(); - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/' . $regex['board'] . '(un)?sticky\/(\d+)$/', $query, $matches)) { - // Add/remove sticky - - $boardName = &$matches[1]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['sticky'], $boardName)) error($config['error']['noaccess']); - - $post = &$matches[3]; - - $query = prepare(sprintf("UPDATE `posts_%s` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - - if($matches[2] == 'un') { - // Record the action - modLog("Unstickied post #{$post}"); - $query->bindValue(':sticky', 0, PDO::PARAM_INT); - } else { - // Record the action - modLog("Stickied post #{$post}"); - $query->bindValue(':sticky', 1, PDO::PARAM_INT); + } + + // Record the action + modLog("Deleted all posts by IP address: {$ip}"); + + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + } elseif(preg_match('/^\/ban$/', $query)) { + if(!hasPermission($config['mod']['ban'])) error($config['error']['noaccess']); + // Ban page + + if(isset($_POST['new_ban'])) { + if( !isset($_POST['ip']) || + !isset($_POST['reason']) || + !isset($_POST['length']) || + !isset($_POST['board_id']) + ) error($config['error']['missedafield']); + + // Check required fields + if(empty($_POST['ip'])) + error(sprintf($config['error']['required'], 'IP address')); + + $query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board)"); + + // 1yr2hrs30mins + // 1y2h30m + $expire = 0; + if(preg_match('/^((\d+)\s?ye?a?r?s?)?\s?+((\d+)\s?mon?t?h?s?)?\s?+((\d+)\s?we?e?k?s?)?\s?+((\d+)\s?da?y?s?)?((\d+)\s?ho?u?r?s?)?\s?+((\d+)\s?mi?n?u?t?e?s?)?\s?+((\d+)\s?se?c?o?n?d?s?)?$/', $_POST['length'], $m)) { + if(isset($m[2])) { + // Years + $expire += $m[2]*60*60*24*365; + } + if(isset($m[4])) { + // Months + $expire += $m[4]*60*60*24*30; + } + if(isset($m[6])) { + // Weeks + $expire += $m[6]*60*60*24*7; + } + if(isset($m[8])) { + // Days + $expire += $m[8]*60*60*24; + } + if(isset($m[10])) { + // Hours + $expire += $m[10]*60*60; + } + if(isset($m[12])) { + // Minutes + $expire += $m[12]*60; + } + if(isset($m[14])) { + // Seconds + $expire += $m[14]; + } } - - $query->execute() or error(db_error($query)); - - buildIndex(); - buildThread($post); - - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/' . $regex['board'] . '(un)?lock\/(\d+)$/', $query, $matches)) { - // Lock/Unlock - - $boardName = &$matches[1]; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['lock'], $boardName)) error($config['error']['noaccess']); - - $post = &$matches[3]; - - $query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - - if($matches[2] == 'un') { - // Record the action - modLog("Unlocked post #{$post}"); - $query->bindValue(':locked', 0, PDO::PARAM_INT); + if($expire) { + $query->bindValue(':expires', time()+$expire, PDO::PARAM_INT); } else { - // Record the action - modLog("Locked post #{$post}"); - $query->bindValue(':locked', 1, PDO::PARAM_INT); + // Never expire + $query->bindValue(':expires', null, PDO::PARAM_NULL); } - $query->execute() or error(db_error($query)); - - buildIndex(); - buildThread($post); - - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/' . $regex['board'] . 'bump(un)?lock\/(\d+)$/', $query, $matches)) { - // Lock/Unlock - - $boardName = &$matches[1]; - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['bumplock'], $boardName)) error($config['error']['noaccess']); + $query->bindValue(':ip', $_POST['ip'], PDO::PARAM_STR); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + $query->bindValue(':set', time(), PDO::PARAM_INT); - $post = &$matches[3]; - $query = prepare(sprintf("UPDATE `posts_%s` SET `sage` = :bumplocked WHERE `id` = :id AND `thread` IS NULL", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - if($matches[2] == 'un') { - // Record the action - modLog("Unbumplocked post #{$post}"); - $query->bindValue(':bumplocked', 0, PDO::PARAM_INT); + if(!empty($_POST['reason'])) { + $reason = $_POST['reason']; + markup($reason); + $query->bindValue(':reason', $reason, PDO::PARAM_STR); } else { - // Record the action - modLog("Bumplocked post #{$post}"); - $query->bindValue(':bumplocked', 1, PDO::PARAM_INT); - } - - $query->execute() or error(db_error($query)); - - buildIndex(); - buildThread($post); - - - // Redirect - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/' . $regex['board'] . 'deletebyip\/(\d+)(\/global)?$/', $query, $matches)) { - // Delete all posts by an IP - - $boardName = &$matches[1]; - $post = &$matches[2]; - $global = isset($matches[3]) && $matches[3] == '/global'; - - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - $query = prepare(sprintf("SELECT `ip` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $post); - $query->execute() or error(db_error($query)); - - if(!$post = $query->fetch()) - error($config['error']['invalidpost']); - - $ip = $post['ip']; - - if($global) - $boards = listBoards(); - else - $boards = Array(Array('uri' => $board['uri'])); - - $query = ''; - foreach($boards as $_board) { - $query .= sprintf("SELECT `id`, '%s' AS `board` FROM `posts_%s` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']); - } - $query = preg_replace('/UNION ALL $/', '', $query); - - $query = prepare($query); - $query->bindValue(':ip', $ip); - $query->execute() or error(db_error($query)); - - if($query->rowCount() < 1) - error($config['error']['invalidpost']); - - $boards = Array(); - while($post = $query->fetch()) { - openBoard($post['board']); - $boards[] = $post['board']; - - deletePost($post['id'], false); + $query->bindValue(':reason', null, PDO::PARAM_NULL); } - foreach($boards as &$_board) { - openBoard($_board); - buildIndex(); - } - - // Record the action - modLog("Deleted all posts by IP address: {$ip}"); - - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - } elseif(preg_match('/^\/ban$/', $query)) { - if(!hasPermission($config['mod']['ban'])) error($config['error']['noaccess']); - // Ban page - - if(isset($_POST['new_ban'])) { - if( !isset($_POST['ip']) || - !isset($_POST['reason']) || - !isset($_POST['length']) || - !isset($_POST['board_id']) - ) error($config['error']['missedafield']); - - // Check required fields - if(empty($_POST['ip'])) - error(sprintf($config['error']['required'], 'IP address')); - - $query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board)"); - - // 1yr2hrs30mins - // 1y2h30m - $expire = 0; - if(preg_match('/^((\d+)\s?ye?a?r?s?)?\s?+((\d+)\s?mon?t?h?s?)?\s?+((\d+)\s?we?e?k?s?)?\s?+((\d+)\s?da?y?s?)?((\d+)\s?ho?u?r?s?)?\s?+((\d+)\s?mi?n?u?t?e?s?)?\s?+((\d+)\s?se?c?o?n?d?s?)?$/', $_POST['length'], $m)) { - if(isset($m[2])) { - // Years - $expire += $m[2]*60*60*24*365; - } - if(isset($m[4])) { - // Months - $expire += $m[4]*60*60*24*30; - } - if(isset($m[6])) { - // Weeks - $expire += $m[6]*60*60*24*7; - } - if(isset($m[8])) { - // Days - $expire += $m[8]*60*60*24; - } - if(isset($m[10])) { - // Hours - $expire += $m[10]*60*60; - } - if(isset($m[12])) { - // Minutes - $expire += $m[12]*60; - } - if(isset($m[14])) { - // Seconds - $expire += $m[14]; - } - } - if($expire) { - $query->bindValue(':expires', time()+$expire, PDO::PARAM_INT); - } else { - // Never expire - $query->bindValue(':expires', null, PDO::PARAM_NULL); - } - - $query->bindValue(':ip', $_POST['ip'], PDO::PARAM_STR); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - $query->bindValue(':set', time(), PDO::PARAM_INT); - - - - if(!empty($_POST['reason'])) { - $reason = $_POST['reason']; - markup($reason); - $query->bindValue(':reason', $reason, PDO::PARAM_STR); - } else { - $query->bindValue(':reason', null, PDO::PARAM_NULL); - } + if($_POST['board_id'] < 0) { + $query->bindValue(':board', null, PDO::PARAM_NULL); + } else { + $query->bindValue(':board', (int)$_POST['board_id'], PDO::PARAM_INT); + } + + // Record the action + modLog('Created a ' . ($expire ? $expire . ' second' : 'permanent') . " ban for {$_POST['ip']} with " . (!empty($_POST['reason']) ? "reason \"${reason}\"" : 'no reason')); + + $query->execute() or error(db_error($query)); + + if(isset($_POST['board'])) + openBoard($_POST['board']); + + // Delete too + if(isset($_POST['delete']) && isset($_POST['board']) && hasPermission($config['mod']['delete'], $_POST['board'])) { + $post = round($_POST['delete']); - if($_POST['board_id'] < 0) { - $query->bindValue(':board', null, PDO::PARAM_NULL); - } else { - $query->bindValue(':board', (int)$_POST['board_id'], PDO::PARAM_INT); - } + deletePost($post); // Record the action - modLog('Created a ' . ($expire ? $expire . ' second' : 'permanent') . " ban for {$_POST['ip']} with " . (!empty($_POST['reason']) ? "reason \"${reason}\"" : 'no reason')); + modLog("Deleted post #{$post}"); - $query->execute() or error(db_error($query)); + // Rebuild board + buildIndex(); + } + + if(hasPermission($config['mod']['public_ban']) && isset($_POST['post']) && isset($_POST['board']) && isset($_POST['public_message']) && isset($_POST['message'])) { + $post = round($_POST['post']); - if(isset($_POST['board'])) - openBoard($_POST['board']); + $query = prepare(sprintf("UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + $query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message']))); + $query->execute() or error(db_error($query)); - // Delete too - if(isset($_POST['delete']) && isset($_POST['board']) && hasPermission($config['mod']['delete'], $_POST['board'])) { - $post = round($_POST['delete']); - - deletePost($post); - - // Record the action - modLog("Deleted post #{$post}"); - - // Rebuild board - buildIndex(); - } + // Rebuild thread + $query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + $thread = $query->fetch(); + if($thread['thread']) + buildThread($thread['thread']); + else + buildThread($post); - if(hasPermission($config['mod']['public_ban']) && isset($_POST['post']) && isset($_POST['board']) && isset($_POST['public_message']) && isset($_POST['message'])) { - $post = round($_POST['post']); - - $query = prepare(sprintf("UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - $query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message']))); - $query->execute() or error(db_error($query)); - - // Rebuild thread - $query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - $thread = $query->fetch(); - if($thread['thread']) - buildThread($thread['thread']); - else - buildThread($post); - - // Rebuild board - buildIndex(); - - // Record the action - modLog("Attached a public ban message for post #{$post}: " . $_POST['message']); - } + // Rebuild board + buildIndex(); - // Redirect - if(isset($_POST['continue'])) - header('Location: ' . $_POST['continue'], true, $config['redirect_http']); - elseif(isset($board)) - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); - else - header('Location: ?/', true, $config['redirect_http']); + // Record the action + modLog("Attached a public ban message for post #{$post}: " . $_POST['message']); } - } elseif(preg_match('/^\/' . $regex['board'] . 'move\/(\d+)$/', $query, $matches)) { - $boardName = &$matches[1]; - $postID = $matches[2]; + // Redirect + if(isset($_POST['continue'])) + header('Location: ' . $_POST['continue'], true, $config['redirect_http']); + elseif(isset($board)) + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']); + else + header('Location: ?/', true, $config['redirect_http']); + } + } elseif(preg_match('/^\/' . $regex['board'] . 'move\/(\d+)$/', $query, $matches)) { + + $boardName = &$matches[1]; + $postID = $matches[2]; + + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['move'], $boardName)) error($config['error']['noaccess']); + + if(isset($_POST['board'])) { + $targetBoard = $_POST['board']; + $shadow = isset($_POST['shadow']); - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); + if($targetBoard == $boardName) + error(_("Target and source board are the same.")); - if(!hasPermission($config['mod']['move'], $boardName)) error($config['error']['noaccess']); + // copy() if leaving a shadow thread behind. otherwise, rename(). + $clone = $shadow ? 'copy' : 'rename'; - if(isset($_POST['board'])) { - $targetBoard = $_POST['board']; - $shadow = isset($_POST['shadow']); - - if($targetBoard == $boardName) - error(_("Target and source board are the same.")); - - // copy() if leaving a shadow thread behind. otherwise, rename(). - $clone = $shadow ? 'copy' : 'rename'; + $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` IS NULL AND `id` = :id", $board['uri'])); + $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + if(!$post = $query->fetch()) { + error($config['error']['nonexistant']); + } + $post['op'] = true; + + if($post['file']) { + $post['has_file'] = true; + $post['width'] = &$post['filewidth']; + $post['height'] = &$post['fileheight']; - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` IS NULL AND `id` = :id", $board['uri'])); - $query->bindValue(':id', $postID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - if(!$post = $query->fetch()) { - error($config['error']['nonexistant']); - } - $post['op'] = true; + $file_src = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']; + $file_thumb = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']; + } else $post['has_file'] = false; + + // allow thread to keep its same traits (stickied, locked, etc.) + $post['mod'] = true; + + if(!openBoard($targetBoard)) + error($config['error']['noboard']); + + $newID = post($post); + + if($post['has_file']) { + $clone($file_src, sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']); + $clone($file_thumb, sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']); + } + + // move replies too... + openBoard($boardName); + + $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id`", $board['uri'])); + $query->bindValue(':id', $postID, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + $replies = array(); + while($post = $query->fetch()) { + $post['mod'] = true; + $post['thread'] = $newID; if($post['file']) { $post['has_file'] = true; $post['width'] = &$post['filewidth']; $post['height'] = &$post['fileheight']; - $file_src = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']; - $file_thumb = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']; + $post['file_src'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']; + $post['file_thumb'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']; } else $post['has_file'] = false; - // allow thread to keep its same traits (stickied, locked, etc.) - $post['mod'] = true; - - if(!openBoard($targetBoard)) - error($config['error']['noboard']); + $replies[] = $post; + } + + $newIDs = array($postID => $newID); + + openBoard($targetBoard); + foreach($replies as &$post) { + $query = prepare("SELECT `target` FROM `cites` WHERE `target_board` = :board AND `board` = :board AND `post` = :post"); + $query->bindValue(':board', $boardName); + $query->bindValue(':post', $post['id'], PDO::PARAM_INT); + $query->execute() or error(db_error($qurey)); + while($cite = $query->fetch(PDO::FETCH_ASSOC)) { + if(isset($newIDs[$cite['target']])) { + $post['body_nomarkup'] = preg_replace( + '/(>>(>\/' . preg_quote($boardName, '/') . '\/)?)' . preg_quote($cite['target'], '/') . '/', + '>>' . $newIDs[$cite['target']], + $post['body_nomarkup']); + + $post['body'] = $post['body_nomarkup']; + } + } + $post['op'] = false; + $post['tracked_cites'] = markup($post['body'], true); - $newID = post($post); + $newIDs[$post['id']] = $newPostID = post($post); if($post['has_file']) { - $clone($file_src, sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']); - $clone($file_thumb, sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']); + $clone($post['file_src'], sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']); + $clone($post['file_thumb'], sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']); } - // move replies too... - openBoard($boardName); - - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id`", $board['uri'])); + foreach($post['tracked_cites'] as $cite) { + $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); + $query->bindValue(':board', $board['uri']); + $query->bindValue(':post', $newPostID, PDO::PARAM_INT); + $query->bindValue(':target_board',$cite[0]); + $query->bindValue(':target', $cite[1], PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + } + } + + // build thread + buildThread($newID); + buildIndex(); + + // trigger themes + rebuildThemes('post'); + + openBoard($boardName); + + if($shadow) { + // lock thread + $query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = 1 WHERE `id` = :id", $board['uri'])); $query->bindValue(':id', $postID, PDO::PARAM_INT); $query->execute() or error(db_error($query)); - $replies = Array(); - while($post = $query->fetch()) { - $post['mod'] = true; - $post['thread'] = $newID; - - if($post['file']) { - $post['has_file'] = true; - $post['width'] = &$post['filewidth']; - $post['height'] = &$post['fileheight']; - - $post['file_src'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']; - $post['file_thumb'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']; - } else $post['has_file'] = false; - - $replies[] = $post; - } + $post = array( + 'mod' => true, + 'subject' => '', + 'email' => '', + 'name' => $config['mod']['shadow_name'], + 'capcode' => $config['mod']['shadow_capcode'], + 'trip' => '', + 'body' => sprintf($config['mod']['shadow_mesage'], '>>>/' . $targetBoard . '/' . $newID), + 'password' => '', + 'has_file' => false, + // attach to original thread + 'thread' => $postID, + 'op' => false + ); - $newIDs = Array($postID => $newID); + markup($post['body']); - openBoard($targetBoard); - foreach($replies as &$post) { - $query = prepare("SELECT `target` FROM `cites` WHERE `target_board` = :board AND `board` = :board AND `post` = :post"); - $query->bindValue(':board', $boardName); - $query->bindValue(':post', $post['id'], PDO::PARAM_INT); - $query->execute() or error(db_error($qurey)); - while($cite = $query->fetch(PDO::FETCH_ASSOC)) { - if(isset($newIDs[$cite['target']])) { - $post['body_nomarkup'] = preg_replace( - '/(>>(>\/' . preg_quote($boardName, '/') . '\/)?)' . preg_quote($cite['target'], '/') . '/', - '>>' . $newIDs[$cite['target']], - $post['body_nomarkup']); - - $post['body'] = $post['body_nomarkup']; - } - } - $post['op'] = false; - $post['tracked_cites'] = markup($post['body'], true); - - $newIDs[$post['id']] = $newPostID = post($post); - - if($post['has_file']) { - $clone($post['file_src'], sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']); - $clone($post['file_thumb'], sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']); - } - - foreach($post['tracked_cites'] as $cite) { - $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); - $query->bindValue(':board', $board['uri']); - $query->bindValue(':post', $newPostID, PDO::PARAM_INT); - $query->bindValue(':target_board',$cite[0]); - $query->bindValue(':target', $cite[1], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - } - } + $botID = post($post); + buildThread($postID); - // build thread - buildThread($newID); + header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['dir']['res'] . sprintf($config['file_page'], $postID) . '#' . $botID, true, $config['redirect_http']); + } else { + deletePost($postID); buildIndex(); - // trigger themes - rebuildThemes('post'); - - openBoard($boardName); - - if($shadow) { - // lock thread - $query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = 1 WHERE `id` = :id", $board['uri'])); - $query->bindValue(':id', $postID, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - $post = Array( - 'mod' => true, - 'subject' => '', - 'email' => '', - 'name' => $config['mod']['shadow_name'], - 'capcode' => $config['mod']['shadow_capcode'], - 'trip' => '', - 'body' => sprintf($config['mod']['shadow_mesage'], '>>>/' . $targetBoard . '/' . $newID), - 'password' => '', - 'has_file' => false, - // attach to original thread - 'thread' => $postID, - 'op' => false - ); - - markup($post['body']); - - $botID = post($post); - buildThread($postID); - - header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['dir']['res'] . sprintf($config['file_page'], $postID) . '#' . $botID, true, $config['redirect_http']); - } else { - deletePost($postID); - buildIndex(); - - openBoard($targetBoard); - header('Location: ?/' . sprintf($config['board_path'], $board['uri']) . $config['dir']['res'] . sprintf($config['file_page'], $newID), true, $config['redirect_http']); - } - } else { - - $body = '
        Move thread' . - '
        ' . - '' - ; - - $boards = listBoards(); - if(count($boards) <= 1) - error(_('No board to move to; there is only one.')); - - $__boards = ''; - foreach($boards as &$_board) { - if($_board['uri'] == $board['uri']) - continue; - $__boards .= '
      • ' . - '' . - '' . - '
        • '; - } - - $body .= '' . - '' . - '' . - '' . - - '' . - '' . - '' . - '' . - - '' . - '' . - '' . - '' . - - '' . - '' . - '' . - '' . - '
        Thread ID
        ' . - '' . - ' (locks thread; replies to it with a link.)' . - '
        Target board
          ' . $__boards . '
        ' . - '
        '; - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'Move #' . $postID, - 'body'=>$body, - 'mod'=>true - ) - ); + openBoard($targetBoard); + header('Location: ?/' . sprintf($config['board_path'], $board['uri']) . $config['dir']['res'] . sprintf($config['file_page'], $newID), true, $config['redirect_http']); } - } elseif(preg_match('/^\/' . $regex['board'] . 'ban(&delete)?\/(\d+)$/', $query, $matches)) { - - // Ban by post - - $boardName = &$matches[1]; - // Open board - if(!openBoard($boardName)) - error($config['error']['noboard']); - - if(!hasPermission($config['mod']['ban'], $boardName)) error($config['error']['noaccess']); - - $delete = isset($matches[2]) && $matches[2] == '&delete'; - if($delete && !hasPermission($config['mod']['delete'], $boardName)) error($config['error']['noaccess']); - - $post = $matches[3]; - - $query = prepare(sprintf("SELECT `ip`,`id` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri'])); - $query->bindValue(':id', $post, PDO::PARAM_INT); - $query->execute() or error(db_error($query)); + } else { + + $body = '
        Move thread' . + '
        ' . + '' + ; + + $boards = listBoards(); + if(count($boards) <= 1) + error(_('No board to move to; there is only one.')); - if($query->rowCount() < 1) { - error($config['error']['invalidpost']); + $__boards = ''; + foreach($boards as &$_board) { + if($_board['uri'] == $board['uri']) + continue; + $__boards .= '
      • ' . + '' . + '' . + '
        • '; } - $post = $query->fetch(); - - $body = form_newBan($post['ip'], null, '?/' . sprintf($config['board_path'], $board['uri']) . $config['file_index'], $post['id'], $boardName, !$delete); - - echo Element('page.html', Array( + $body .= '' . + '' . + '' . + '' . + + '' . + '' . + '' . + '' . + + '' . + '' . + '' . + '' . + + '' . + '' . + '' . + '' . + '
        Thread ID
        ' . + '' . + ' (locks thread; replies to it with a link.)' . + '
        Target board
          ' . $__boards . '
        ' . + '
        '; + + echo Element('page.html', array( 'config'=>$config, - 'title'=>'New ban', + 'title'=>'Move #' . $postID, 'body'=>$body, 'mod'=>true ) ); - } elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')\/deletenote\/(?P\d+)$/', $query, $matches)) { - if(!hasPermission($config['mod']['remove_notes'])) error($config['error']['noaccess']); - - $ip = $matches[1]; - $id = $matches['id']; + } + } elseif(preg_match('/^\/' . $regex['board'] . 'ban(&delete)?\/(\d+)$/', $query, $matches)) { + + // Ban by post + + $boardName = &$matches[1]; + // Open board + if(!openBoard($boardName)) + error($config['error']['noboard']); + + if(!hasPermission($config['mod']['ban'], $boardName)) error($config['error']['noaccess']); + + $delete = isset($matches[2]) && $matches[2] == '&delete'; + if($delete && !hasPermission($config['mod']['delete'], $boardName)) error($config['error']['noaccess']); + + $post = $matches[3]; + + $query = prepare(sprintf("SELECT `ip`,`id` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri'])); + $query->bindValue(':id', $post, PDO::PARAM_INT); + $query->execute() or error(db_error($query)); + + if($query->rowCount() < 1) { + error($config['error']['invalidpost']); + } + + $post = $query->fetch(); + + $body = form_newBan($post['ip'], null, '?/' . sprintf($config['board_path'], $board['uri']) . $config['file_index'], $post['id'], $boardName, !$delete); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'New ban', + 'body'=>$body, + 'mod'=>true + ) + ); + } elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')\/deletenote\/(?P\d+)$/', $query, $matches)) { + if(!hasPermission($config['mod']['remove_notes'])) error($config['error']['noaccess']); + + $ip = $matches[1]; + $id = $matches['id']; - $query = prepare("DELETE FROM `ip_notes` WHERE `ip` = :ip AND `id` = :id"); + $query = prepare("DELETE FROM `ip_notes` WHERE `ip` = :ip AND `id` = :id"); + $query->bindValue(':ip', $ip); + $query->bindValue(':id', $id); + $query->execute() or error(db_error($query)); + + header('Location: ?/IP/' . $ip, true, $config['redirect_http']); + } elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $query, $matches)) { + // View information on an IP address + + $ip = $matches[1]; + $host = $config['mod']['dns_lookup'] ? rDNS($ip) : false; + + if(hasPermission($config['mod']['unban']) && isset($_POST['unban']) && isset($_POST['ban_id'])) { + removeBan($_POST['ban_id']); + header('Location: ?/IP/' . $ip, true, $config['redirect_http']); + } elseif(hasPermission($config['mod']['create_notes']) && isset($_POST['note'])) { + $query = prepare("INSERT INTO `ip_notes` VALUES(NULL, :ip, :mod, :time, :body)"); $query->bindValue(':ip', $ip); - $query->bindValue(':id', $id); + $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); + $query->bindValue(':time', time(), PDO::PARAM_INT); + markup($_POST['note']); + $query->bindValue(':body', $_POST['note']); $query->execute() or error(db_error($query)); header('Location: ?/IP/' . $ip, true, $config['redirect_http']); - } elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $query, $matches)) { - // View information on an IP address - - $ip = $matches[1]; - $host = $config['mod']['dns_lookup'] ? rDNS($ip) : false; + } else { + $body = ''; + $boards = listBoards(); + foreach($boards as &$_board) { + openBoard($_board['uri']); - if(hasPermission($config['mod']['unban']) && isset($_POST['unban']) && isset($_POST['ban_id'])) { - removeBan($_POST['ban_id']); - header('Location: ?/IP/' . $ip, true, $config['redirect_http']); - } elseif(hasPermission($config['mod']['create_notes']) && isset($_POST['note'])) { - $query = prepare("INSERT INTO `ip_notes` VALUES(NULL, :ip, :mod, :time, :body)"); + $temp = ''; + $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `time` DESC LIMIT :limit", $_board['uri'])); $query->bindValue(':ip', $ip); - $query->bindValue(':mod', $mod['id'], PDO::PARAM_INT); - $query->bindValue(':time', time(), PDO::PARAM_INT); - markup($_POST['note']); - $query->bindValue(':body', $_POST['note']); + $query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT); $query->execute() or error(db_error($query)); - - header('Location: ?/IP/' . $ip, true, $config['redirect_http']); - } else { - $body = ''; - $boards = listBoards(); - foreach($boards as &$_board) { - openBoard($_board['uri']); - - $temp = ''; - $query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `time` DESC LIMIT :limit", $_board['uri'])); - $query->bindValue(':ip', $ip); - $query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT); - $query->execute() or error(db_error($query)); - - while($post = $query->fetch()) { - if(!$post['thread']) { - $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); - } else { - $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); - } - $temp .= $po->build(true) . '
        '; + + while($post = $query->fetch()) { + if(!$post['thread']) { + $po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false); + } else { + $po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod); } - - if(!empty($temp)) - $body .= '
        Last ' . $query->rowCount() . ' posts on ' . - sprintf($config['board_abbreviation'], $_board['uri']) . ' - ' . $_board['title'] . - '' . $temp . '
        '; + $temp .= $po->build(true) . '
        '; } - if(hasPermission($config['mod']['view_notes'])) { - $query = prepare("SELECT * FROM `ip_notes` WHERE `ip` = :ip ORDER BY `id` DESC"); - $query->bindValue(':ip', $ip); - $query->execute() or error(db_error($query)); - - if($query->rowCount() > 0 || hasPermission($config['mod']['create_notes'])) { - $body .= '
        ' . - $query->rowCount() . ' note' . ($query->rowCount() == 1 ?'' : 's') . ' on record' . - ''; - if($query->rowCount() > 0) { - $body .= '' . - '' . - (hasPermission($config['mod']['remove_notes']) ? '' : '') . - ''; - while($note = $query->fetch()) { - - if($note['mod']) { - $_query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id"); - $_query->bindValue(':id', $note['mod']); - $_query->execute() or error(db_error($_query)); - if($_mod = $_query->fetch()) { - $staff = '' . utf8tohtml($_mod['username']) . ''; - } else { - $staff = '???'; - } + if(!empty($temp)) + $body .= '
        Last ' . $query->rowCount() . ' posts on ' . + sprintf($config['board_abbreviation'], $_board['uri']) . ' - ' . $_board['title'] . + '' . $temp . '
        '; + } + + if(hasPermission($config['mod']['view_notes'])) { + $query = prepare("SELECT * FROM `ip_notes` WHERE `ip` = :ip ORDER BY `id` DESC"); + $query->bindValue(':ip', $ip); + $query->execute() or error(db_error($query)); + + if($query->rowCount() > 0 || hasPermission($config['mod']['create_notes'])) { + $body .= '
        ' . + $query->rowCount() . ' note' . ($query->rowCount() == 1 ?'' : 's') . ' on record' . + ''; + if($query->rowCount() > 0) { + $body .= '
        StaffNoteDateActions
        ' . + '' . + (hasPermission($config['mod']['remove_notes']) ? '' : '') . + ''; + while($note = $query->fetch()) { + + if($note['mod']) { + $_query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id"); + $_query->bindValue(':id', $note['mod']); + $_query->execute() or error(db_error($_query)); + if($_mod = $_query->fetch()) { + $staff = '' . utf8tohtml($_mod['username']) . ''; } else { - $staff = 'system'; + $staff = '???'; } - $body .= '' . - '' . - (hasPermission($config['mod']['remove_notes']) ? - '' - : '') . - ''; + } else { + $staff = 'system'; } - $body .= '
        StaffNoteDateActions
        ' . - $staff . - '' . - $note['body'] . - '' . - strftime($config['post_date'], $note['time']) . - '[delete]
        '; + $body .= '' . + '' . + $staff . + '' . + $note['body'] . + '' . + strftime($config['post_date'], $note['time']) . + '' . + (hasPermission($config['mod']['remove_notes']) ? + '[delete]' + : '') . + ''; } - - if(hasPermission($config['mod']['create_notes'])) { - $body .= '
        ' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '' . - '
        Staff' . $mod['username'] . '
        ' . - '
        '; - } - - $body .= '
        '; + $body .= ''; } + + if(hasPermission($config['mod']['create_notes'])) { + $body .= '
        ' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '' . + '
        Staff' . $mod['username'] . '
        ' . + '
        '; + } + + $body .= ''; } + } + + if(hasPermission($config['mod']['view_ban'])) { + $query = prepare("SELECT `bans`.*, `username`, `uri` FROM `bans` LEFT JOIN `boards` ON `boards`.`id` = `board` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip"); + $query->bindValue(':ip', $ip); + $query->execute() or error(db_error($query)); - if(hasPermission($config['mod']['view_ban'])) { - $query = prepare("SELECT `bans`.*, `username`, `uri` FROM `bans` LEFT JOIN `boards` ON `boards`.`id` = `board` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip"); - $query->bindValue(':ip', $ip); - $query->execute() or error(db_error($query)); + if($query->rowCount() > 0) { + $body .= '
        Ban' . ($query->rowCount() == 1 ? '' : 's') . ' on record'; - if($query->rowCount() > 0) { - $body .= '
        Ban' . ($query->rowCount() == 1 ? '' : 's') . ' on record'; + while($ban = $query->fetch()) { + $body .= '
        ' . + '' . - while($ban = $query->fetch()) { - $body .= '' . - '
        Status' . + ($config['mod']['view_banexpired'] && $ban['expires'] != 0 && $ban['expires'] < time() ? + 'Expired' + : 'Active') . + '
        ' . - - // IP - '' . - - // Reason - '' . - - // Board - '' . + + // Reason + '' . + + // Board + '' . + + // Set + '' . + + // Expires + '' . - - // Set - '' . - - // Expires - '' . - - // Staff - '' . + + // Staff + '
        Status' . - ($config['mod']['view_banexpired'] && $ban['expires'] != 0 && $ban['expires'] < time() ? - 'Expired' - : 'Active') . - '
        IP' . $ban['ip'] . '
        Reason' . $ban['reason'] . '
        Board' . - (isset($ban['board']) ? - (isset($ban['uri']) ? - sprintf($config['board_abbreviation'], $ban['uri']) - : - 'deleted?' - ) + // IP + '
        IP' . $ban['ip'] . '
        Reason' . $ban['reason'] . '
        Board' . + (isset($ban['board']) ? + (isset($ban['uri']) ? + sprintf($config['board_abbreviation'], $ban['uri']) + : + 'deleted?' + ) + : + '' . _('all boards') . '' + ) . + '
        Set' . strftime($config['post_date'], $ban['set']) . '
        Expires' . + ($ban['expires'] == 0 ? + 'Never' : - '' . _('all boards') . '' + strftime($config['post_date'], $ban['expires']) ) . - '
        Set' . strftime($config['post_date'], $ban['set']) . '
        Expires' . - ($ban['expires'] == 0 ? - 'Never' - : - strftime($config['post_date'], $ban['expires']) - ) . - '
        Staff' . - (isset($ban['username']) ? - (!hasPermission($config['mod']['view_banstaff']) ? - ($config['mod']['view_banquestionmark'] ? - '?' - : - ($ban['type'] == JANITOR ? 'Janitor' : - ($ban['type'] == MOD ? 'Mod' : - ($ban['type'] == ADMIN ? 'Admin' : - '?'))) - ) + '
        Staff' . + (isset($ban['username']) ? + (!hasPermission($config['mod']['view_banstaff']) ? + ($config['mod']['view_banquestionmark'] ? + '?' : - utf8tohtml($ban['username']) + ($ban['type'] == JANITOR ? 'Janitor' : + ($ban['type'] == MOD ? 'Mod' : + ($ban['type'] == ADMIN ? 'Admin' : + '?'))) ) - : 'deleted?' - ) . - '
        ' . - - '' . - - '
        '; - } + : + utf8tohtml($ban['username']) + ) + : 'deleted?' + ) . + '' . - $body .= '
        '; + '' . + ''; } + + $body .= '
        '; + } - - if(hasPermission($config['mod']['ip_banform'])) - $body .= form_newBan($ip, null, '?/IP/' . $ip); - - echo Element('page.html', Array( - 'config'=>$config, - 'title'=>'IP: ' . $ip, - 'subtitle' => $host, - 'body'=>$body, - 'mod'=>true - ) - ); } - } else { - error($config['error']['404']); + + if(hasPermission($config['mod']['ip_banform'])) + $body .= form_newBan($ip, null, '?/IP/' . $ip); + + echo Element('page.html', array( + 'config'=>$config, + 'title'=>'IP: ' . $ip, + 'subtitle' => $host, + 'body'=>$body, + 'mod'=>true + ) + ); } + } else { + error($config['error']['404']); } +} -?> -- cgit v1.3