From dcf5d699bd6ce5770ebd515cc14219f3015dd63a Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Thu, 5 May 2016 08:21:21 +0200
Subject: simplify the md5 execution logic

---
 post.php | 44 ++++++++++++++++++++++----------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 729170a7..5c755a3c 100644
--- a/post.php
+++ b/post.php
@@ -572,7 +572,12 @@ if (isset($_POST['delete'])) {
 	
 	
 	if ($post['has_file']) {
-		$fnarray = array();
+		$md5cmd = false;
+		if ($config['bsd_md5'])  $md5cmd = 'md5 -r';
+		if ($config['gnu_md5'])  $md5cmd = 'md5sum';
+
+		$allhashes = '';
+
 		foreach ($post['files'] as $key => &$file) {
 			if ($post['op'] && $config['allowed_ext_op']) {
 				if (!in_array($file['extension'], $config['allowed_ext_op']))
@@ -586,34 +591,29 @@ if (isset($_POST['delete'])) {
 			// Truncate filename if it is too long
 			$file['filename'] = mb_substr($file['filename'], 0, $config['max_filename_len']);
 			
-			if (!isset($filenames)) {
-				$filenames = escapeshellarg($file['tmp_name']);
-			} else {
-				$filenames .= (' ' . escapeshellarg($file['tmp_name']));
-			}
-
-			$fnarray[] = $file['tmp_name'];
-
 			$upload = $file['tmp_name'];
 			
 			if (!is_readable($upload))
 				error($config['error']['nomove']);
+
+			if ($md5cmd) {
+				$output = shell_exec_error($md5cmd . " < " . escapeshellarg($upload));
+				$output = explode(' ', $output);
+				$hash = $output[0];
+			}
+			else {
+				$hash = md5_file($upload);
+			}
+
+			$file['hash'] = $hash;
+			$allhashes .= $hash;
 		}
-		
-		$md5cmd = $config['bsd_md5'] ? 'md5 -r' : 'md5sum';
 
-		if (!$config['php_md5'] && $output = shell_exec_error("cat $filenames | $md5cmd")) {
-			$explodedvar = explode(' ', $output);
-			$hash = $explodedvar[0];
+		if (count ($post['files']) == 1) {
 			$post['filehash'] = $hash;
-		} elseif ($config['max_images'] === 1) {
-			$post['filehash'] = md5_file($upload);
-		} else {
-			$str_to_hash = '';
-			foreach ($fnarray as $i => $f) {
-				$str_to_hash .= file_get_contents($f);
-			}
-			$post['filehash'] = md5($str_to_hash);
+		}
+		else {
+			$post['filehash'] = md5($allhashes);
 		}
 	}
 	
-- 
cgit v1.3


From c4b98e94cee5cb6bf89aea8dc36253ce754c6dcd Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Thu, 5 May 2016 10:17:14 +0200
Subject: [SECURITY] harden for imagetragick (we aren`t hit by the bug, but we
 were passing uncommon filetypes, like JPEG2000, directly to imagemagick)

---
 post.php | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 5c755a3c..dc303785 100644
--- a/post.php
+++ b/post.php
@@ -639,6 +639,9 @@ if (isset($_POST['delete'])) {
 			if (!$size = @getimagesize($file['tmp_name'])) {
 				error($config['error']['invalidimg']);
 			}
+			if (!in_array($size[2], array(IMAGETYPE_PNG, IMAGETYPE_GIF, IMAGETYPE_JPEG, IMAGETYPE_BMP))) {
+				error($config['error']['invalidimg']);
+			}
 			if ($size[0] > $config['max_width'] || $size[1] > $config['max_height']) {
 				error($config['error']['maxsize']);
 			}
-- 
cgit v1.3


From 4c827cf1059513aadf01c7f82284bc6ce4d0cd61 Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Thu, 5 May 2016 10:22:34 +0200
Subject: fix some nonsense

---
 post.php | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index dc303785..b41b4b63 100644
--- a/post.php
+++ b/post.php
@@ -625,12 +625,14 @@ if (isset($_POST['delete'])) {
 	
 	if ($post['has_file']) {	
 		foreach ($post['files'] as $key => &$file) {
-		if ($file['is_an_image'] && $config['ie_mime_type_detection'] !== false) {
-			// Check IE MIME type detection XSS exploit
-			$buffer = file_get_contents($upload, null, null, null, 255);
-			if (preg_match($config['ie_mime_type_detection'], $buffer)) {
-				undoImage($post);
-				error($config['error']['mime_exploit']);
+		if ($file['is_an_image']) {
+			if ($config['ie_mime_type_detection'] !== false) {
+				// Check IE MIME type detection XSS exploit
+				$buffer = file_get_contents($upload, null, null, null, 255);
+				if (preg_match($config['ie_mime_type_detection'], $buffer)) {
+					undoImage($post);
+					error($config['error']['mime_exploit']);
+				}
 			}
 			
 			require_once 'inc/image.php';
-- 
cgit v1.3


From 19b70663d7e786fca0425b53eb79412fd5987255 Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Thu, 5 May 2016 10:29:13 +0200
Subject: remove magic_quotes check; it`s 2016 after all

---
 mod.php  | 10 ----------
 post.php | 12 +-----------
 2 files changed, 1 insertion(+), 21 deletions(-)

(limited to 'post.php')

diff --git a/mod.php b/mod.php
index 5697e2b5..c005dcb5 100644
--- a/mod.php
+++ b/mod.php
@@ -12,16 +12,6 @@ require_once 'inc/mod/auth.php';
 if ($config['debug'])
 	$parse_start_time = microtime(true);
 
-// Fix for magic quotes
-if (get_magic_quotes_gpc()) {
-	function strip_array($var) {
-		return is_array($var) ? array_map('strip_array', $var) : stripslashes($var);
-	}
-	
-	$_GET = strip_array($_GET);
-	$_POST = strip_array($_POST);
-}
-
 $query = isset($_SERVER['QUERY_STRING']) ? rawurldecode($_SERVER['QUERY_STRING']) : '';
 
 $pages = array(
diff --git a/post.php b/post.php
index b41b4b63..04665177 100644
--- a/post.php
+++ b/post.php
@@ -7,16 +7,6 @@ require_once 'inc/functions.php';
 require_once 'inc/anti-bot.php';
 require_once 'inc/bans.php';
 
-// Fix for magic quotes
-if (get_magic_quotes_gpc()) {
-	function strip_array($var) {
-		return is_array($var) ? array_map('strip_array', $var) : stripslashes($var);
-	}
-	
-	$_GET = strip_array($_GET);
-	$_POST = strip_array($_POST);
-}
-
 if ((!isset($_POST['mod']) || !$_POST['mod']) && $config['board_locked']) {
     error("Board is locked");
 }
@@ -447,7 +437,7 @@ if (isset($_POST['delete'])) {
 		$i = 0;
 		foreach ($_FILES as $key => $file) {
 			if ($file['size'] && $file['tmp_name']) {
-				$file['filename'] = urldecode(get_magic_quotes_gpc() ? stripslashes($file['name']) : $file['name']);
+				$file['filename'] = urldecode($file['name']);
 				$file['extension'] = strtolower(mb_substr($file['filename'], mb_strrpos($file['filename'], '.') + 1));
 				if (isset($config['filename_func']))
 					$file['file_id'] = $config['filename_func']($file);
-- 
cgit v1.3


From 186ad5ca86ae2255bbe0d6846a390963d63ae9e9 Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Thu, 5 May 2016 10:53:44 +0200
Subject: bsd fixup

---
 post.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 5c755a3c..4c944178 100644
--- a/post.php
+++ b/post.php
@@ -573,7 +573,7 @@ if (isset($_POST['delete'])) {
 	
 	if ($post['has_file']) {
 		$md5cmd = false;
-		if ($config['bsd_md5'])  $md5cmd = 'md5 -r';
+		if ($config['bsd_md5'])  $md5cmd = '/sbin/md5 -r';
 		if ($config['gnu_md5'])  $md5cmd = 'md5sum';
 
 		$allhashes = '';
-- 
cgit v1.3


From 3eb755ee7e0ec65d91377e13f0faf06657035e5a Mon Sep 17 00:00:00 2001
From: 8chan <admin@8chan.co>
Date: Wed, 31 Dec 2014 22:35:21 -0800
Subject: Move login check in inc/mod/auth.php to a function

This allows pages like create.php to not include inc/mod/pages.php while still being able to use the mod auth functions (like generating salts and passwords)
---
 inc/mod/auth.php | 79 +++++++++++++++++++++++++++++++++-----------------------
 mod.php          |  2 ++
 post.php         |  1 +
 3 files changed, 49 insertions(+), 33 deletions(-)

(limited to 'post.php')

diff --git a/inc/mod/auth.php b/inc/mod/auth.php
index 7f98e8a9..8bfaea8f 100644
--- a/inc/mod/auth.php
+++ b/inc/mod/auth.php
@@ -146,39 +146,6 @@ function modLog($action, $_board=null) {
 		_syslog(LOG_INFO, '[mod/' . $mod['username'] . ']: ' . $action);
 }
 
-// Validate session
-
-if (isset($_COOKIE[$config['cookies']['mod']])) {
-	// Should be username:hash:salt
-	$cookie = explode(':', $_COOKIE[$config['cookies']['mod']]);
-	if (count($cookie) != 3) {
-		// Malformed cookies
-		destroyCookies();
-		mod_login();
-		exit;
-	}
-	
-	$query = prepare("SELECT `id`, `type`, `boards`, `password` FROM ``mods`` WHERE `username` = :username");
-	$query->bindValue(':username', $cookie[0]);
-	$query->execute() or error(db_error($query));
-	$user = $query->fetch(PDO::FETCH_ASSOC);
-	
-	// validate password hash
-	if ($cookie[1] !== mkhash($cookie[0], $user['password'], $cookie[2])) {
-		// Malformed cookies
-		destroyCookies();
-		mod_login();
-		exit;
-	}
-	
-	$mod = array(
-		'id' => $user['id'],
-		'type' => $user['type'],
-		'username' => $cookie[0],
-		'boards' => explode(',', $user['boards'])
-	);
-}
-
 function create_pm_header() {
 	global $mod, $config;
 	
@@ -212,4 +179,50 @@ function make_secure_link_token($uri) {
 	return substr(sha1($config['cookies']['salt'] . '-' . $uri . '-' . $mod['id']), 0, 8);
 }
 
+function check_login($prompt = false) {
+	global $config, $mod;
+	// Validate session
+	if (isset($_COOKIE[$config['cookies']['mod']])) {
+		// Should be username:hash:salt
+		$cookie = explode(':', $_COOKIE[$config['cookies']['mod']]);
+		if (count($cookie) != 3) {
+			// Malformed cookies
+			destroyCookies();
+			if ($prompt) mod_login();
+			exit;
+		}
+		
+		$query = prepare("SELECT `id`, `type`, `boards`, `password` FROM ``mods`` WHERE `username` = :username");
+		$query->bindValue(':username', $cookie[0]);
+		$query->execute() or error(db_error($query));
+		$user = $query->fetch(PDO::FETCH_ASSOC);
+		
+		// validate password hash
+		if ($cookie[1] !== mkhash($cookie[0], $user['password'], $cookie[2])) {
+			// Malformed cookies
+			destroyCookies();
+			if ($prompt) mod_login();
+			exit;
+		}
+		
+		$mod = array(
+			'id' => $user['id'],
+			'type' => $user['type'],
+			'username' => $cookie[0],
+			'boards' => explode(',', $user['boards'])
+		);
+	}
+
+	if ($config['debug'])
+		$parse_start_time = microtime(true);
 
+	// Fix for magic quotes
+	if (get_magic_quotes_gpc()) {
+		function strip_array($var) {
+			return is_array($var) ? array_map('strip_array', $var) : stripslashes($var);
+		}
+		
+		$_GET = strip_array($_GET);
+		$_POST = strip_array($_POST);
+	}
+}
diff --git a/mod.php b/mod.php
index c005dcb5..022f5408 100644
--- a/mod.php
+++ b/mod.php
@@ -12,6 +12,8 @@ require_once 'inc/mod/auth.php';
 if ($config['debug'])
 	$parse_start_time = microtime(true);
 
+check_login(true);
+
 $query = isset($_SERVER['QUERY_STRING']) ? rawurldecode($_SERVER['QUERY_STRING']) : '';
 
 $pages = array(
diff --git a/post.php b/post.php
index 6e893747..1c511f9c 100644
--- a/post.php
+++ b/post.php
@@ -216,6 +216,7 @@ if (isset($_POST['delete'])) {
 
 	if ($post['mod'] = isset($_POST['mod']) && $_POST['mod']) {
 		require 'inc/mod/auth.php';
+		check_login(false);
 		if (!$mod) {
 			// Liar. You're not a mod.
 			error($config['error']['notamod']);
-- 
cgit v1.3


From 8943bb0bb378b629e0b1cf34f66094eb61f8453e Mon Sep 17 00:00:00 2001
From: Fredrick Brennan <admin@8chan.co>
Date: Fri, 13 Mar 2015 12:45:57 +0800
Subject: Rewrite report system due to flooding

---
 inc/config.php                 |  3 +++
 js/fix-report-delete-submit.js | 15 ++++-----------
 post.php                       | 20 +++++++++++++++++++-
 templates/report.html          | 17 +++++++++++++++++
 4 files changed, 43 insertions(+), 12 deletions(-)
 create mode 100644 templates/report.html

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index b92c4ac0..ad659343 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1687,3 +1687,6 @@
 	// If set to 0, it won't upgrade hashes using old password encryption schema, only create new.
 	// You can set it to a higher value, to further migrate to other password hashing function.
 	$config['password_crypt_version'] = 1;
+
+	// Use CAPTCHA for reports?
+	$config['report_captcha'] = false;
diff --git a/js/fix-report-delete-submit.js b/js/fix-report-delete-submit.js
index 71c97f74..0b1ff840 100644
--- a/js/fix-report-delete-submit.js
+++ b/js/fix-report-delete-submit.js
@@ -43,19 +43,12 @@ Menu.onclick(function(e, $buf) {
 	var postId = $ele.find('.post_no').not('[id]').text();
 
 	$buf.find('#report_menu,#global_report_menu').click(function(e) {
-		$('#delete_'+postId).prop('checked', 'checked');
-		if ($(this).attr('id') === 'global_report_menu') {
-			header = "<div><h1>Attention!</h1><p>This form is only for reporting <strong>child pornography</strong>, <strong>bot spam</strong> and <strong>credit card numbers, social security numbers or banking information</strong>. DMCA requests and all other deletion requests <em>MUST</em> be sent via email to admin@8chan.co.</p><p>8chan is unmoderated and allows posts without collecting <em>ANY</em> information from the poster less the details of their post. Furthermore, all boards on 8chan are user created and not actively monitored by anyone but the board creator.</p><p>8chan has a small volunteer staff to handle this queue, please do not waste their time by filling it with nonsense! <em>If you made a report with this tool and the post was not deleted, <strong>do not make the report again!</strong> Email admin@8chan.co instead.</em> Abuse of the global report system could lead to address blocks against your IP from 8chan.</p><p>Again, 8chan's global volunteers <em>do not</em> handle board specific issues. You most likely want to click \"Report\" instead to reach the creator and volunteers he assigned to this board.</p>";
-			$('#global_report').prop('checked', 'checked');
+		if ($(this).attr('id') === "global_report_menu") {
+			var global = '&global';
 		} else {
-			header = "";
-			$('#global_report').prop('checked', '');
+			var global = '';
 		}
-		alert(header+"Enter reason below...<br/><input type='text' id='alert_reason'>", true, function(){
-			$('#reason').val($('#alert_reason').val());
-			$('input[name=report][type=submit]').click();
-		});
-
+		window.open(configRoot+'report.php?board='+board_name+'&post=delete_'+postId+global, "", (global?"width=600, height=575":"width=500, height=275"));
 	});
 });
 
diff --git a/post.php b/post.php
index 1c511f9c..3b4f3311 100644
--- a/post.php
+++ b/post.php
@@ -124,6 +124,23 @@ if (isset($_POST['delete'])) {
 	
 	if (count($report) > $config['report_limit'])
 		error($config['error']['toomanyreports']);
+
+	if ($config['report_captcha'] && !isset($_POST['captcha_text'], $_POST['captcha_cookie'])) {
+		error($config['error']['bot']);
+	}
+
+	if ($config['report_captcha']) {
+		$resp = file_get_contents($config['captcha']['provider_check'] . "?" . http_build_query([
+			'mode' => 'check',
+			'text' => $_POST['captcha_text'],
+			'extra' => $config['captcha']['extra'],
+			'cookie' => $_POST['captcha_cookie']
+		]));
+
+		if ($resp !== '1') {
+                        error($config['error']['captcha']);
+		}
+	}
 	
 	$reason = escape_markup_modifiers($_POST['reason']);
 	markup($reason);
@@ -153,7 +170,8 @@ if (isset($_POST['delete'])) {
 	$root = $is_mod ? $config['root'] . $config['file_mod'] . '?/' : $config['root'];
 	
 	if (!isset($_POST['json_response'])) {
-		header('Location: ' . $root . $board['dir'] . $config['file_index'], true, $config['redirect_http']);
+		$index = $root . $board['dir'] . $config['file_index'];
+		echo Element('page.html', array('config' => $config, 'body' => '<div style="text-align:center"><a href="javascript:window.close()">[ ' . _('Close window') ." ]</a> <a href='$index'>[ " . _('Return') . ' ]</a></div>', 'title' => _('Report submitted!')));
 	} else {
 		header('Content-Type: text/json');
 		echo json_encode(array('success' => true));
diff --git a/templates/report.html b/templates/report.html
new file mode 100644
index 00000000..291f9313
--- /dev/null
+++ b/templates/report.html
@@ -0,0 +1,17 @@
+<form action="{{ config.post_url }}" method="post" id="report_form">
+	<input type="hidden" name="board" value="{{ board.uri }}">
+	<input type="hidden" name="{{ post|e }}" value="1">
+	{% if global %}
+		<input type="hidden" name="global" value="1">
+		<div><h1>Attention!</h1><p>This form is only for reporting <strong>child pornography</strong>, <strong>bot spam</strong> and <strong>credit card numbers, social security numbers or banking information</strong>. DMCA requests and all other deletion requests <em>MUST</em> be sent via email to admin@8chan.co.</p><p>8chan is unmoderated and allows posts without collecting <em>ANY</em> information from the poster less the details of their post. Furthermore, all boards on 8chan are user created and not actively monitored by anyone but the board creator.</p><p>8chan has a small volunteer staff to handle this queue, please do not waste their time by filling it with nonsense! <em>If you made a report with this tool and the post was not deleted, <strong>do not make the report again!</strong> Email admin@8chan.co instead.</em> Abuse of the global report system could lead to address blocks against your IP from 8chan.</p><p>Again, 8chan's global volunteers <em>do not</em> handle board specific issues. You most likely want to click "Report" instead to reach the creator and volunteers he assigned to this board.</p>
+	{% endif %}
+	<p>{% trans %}Enter reason below...{% endtrans %}</p>
+	<input type="text" id="reason" name="reason">
+	{% if config.report_captcha %}
+		<p>{% trans %}To submit your report, please fill out the CAPTCHA below.{% endtrans %}</p>
+		{{ captcha['html'] }}<br/>
+		<input class="captcha_text" name="captcha_text" size="25" maxlength="6" autocomplete="off" type="text">
+		<input class="captcha_cookie" name="captcha_cookie" type="hidden" autocomplete="off" value="{{ captcha['cookie']|e }}"><br/>
+	{% endif %}
+	<input name="report" value="{% trans %}Submit{% endtrans %}" type="submit">
+</form>
-- 
cgit v1.3


From b476b660073adbe827836a7e7860b0fb3a061ff0 Mon Sep 17 00:00:00 2001
From: Fredrick Brennan <admin@8chan.co>
Date: Sun, 23 Aug 2015 09:04:37 +0800
Subject: [BUG] Image reject repost board option now also affects YT embeds

---
 inc/functions.php | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 post.php          | 28 +++++++++++++++++++++++++++-
 2 files changed, 74 insertions(+), 1 deletion(-)

(limited to 'post.php')

diff --git a/inc/functions.php b/inc/functions.php
index d28d018d..cbe0bc62 100755
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -2438,6 +2438,53 @@ function getPostByHashInThread($hash, $thread) {
 	return false;
 }
 
+function getPostByEmbed($embed) {
+	global $board, $config;
+	$matches = array();
+	foreach ($config['embedding'] as &$e) {
+		if (preg_match($e[0], $embed, $matches) && isset($matches[1]) && !empty($matches[1])) {
+			$embed = '%'.$matches[1].'%';
+			break;
+		}
+	}
+
+	if (!isset($embed)) return false;
+
+	$query = prepare(sprintf("SELECT `id`,`thread` FROM ``posts_%s`` WHERE `embed` LIKE :embed", $board['uri']));
+	$query->bindValue(':embed', $embed, PDO::PARAM_STR);
+	$query->execute() or error(db_error($query));
+
+	if ($post = $query->fetch(PDO::FETCH_ASSOC)) {
+		return $post;
+	}
+
+	return false;
+}
+
+function getPostByEmbedInThread($embed, $thread) {
+	global $board, $config;
+	$matches = array();
+	foreach ($config['embedding'] as &$e) {
+		if (preg_match($e[0], $embed, $matches) && isset($matches[1]) && !empty($matches[1])) {
+			$embed = '%'.$matches[1].'%';
+			break;
+		}
+	}
+
+	if (!isset($embed)) return false;
+
+	$query = prepare(sprintf("SELECT `id`,`thread` FROM ``posts_%s`` WHERE `embed` = :embed AND ( `thread` = :thread OR `id` = :thread )", $board['uri']));
+	$query->bindValue(':embed', $embed, PDO::PARAM_STR);
+	$query->bindValue(':thread', $thread, PDO::PARAM_INT);
+	$query->execute() or error(db_error($query));
+
+	if ($post = $query->fetch(PDO::FETCH_ASSOC)) {
+		return $post;
+	}
+
+	return false;
+}
+
 function undoImage(array $post) {
 	if (!$post['has_file'] || !isset($post['files']))
 		return;
diff --git a/post.php b/post.php
index 3b4f3311..06a9dc74 100644
--- a/post.php
+++ b/post.php
@@ -294,6 +294,32 @@ if (isset($_POST['delete'])) {
 		if (!isset($post['embed'])) {
 			error($config['error']['invalid_embed']);
 		}
+
+		if ($config['image_reject_repost']) {
+			if ($p = getPostByEmbed($post['embed'])) {
+				error(sprintf($config['error']['fileexists'], 
+					($post['mod'] ? $config['root'] . $config['file_mod'] . '?/' : $config['root']) .
+					($board['dir'] . $config['dir']['res'] .
+						($p['thread'] ?
+							$p['thread'] . '.html#' . $p['id']
+						:
+							$p['id'] . '.html'
+						))
+				));
+			}
+		} else if (!$post['op'] && $config['image_reject_repost_in_thread']) {
+			if ($p = getPostByEmbedInThread($post['embed'], $post['thread'])) {
+				error(sprintf($config['error']['fileexistsinthread'], 
+					($post['mod'] ? $config['root'] . $config['file_mod'] . '?/' : $config['root']) .
+					($board['dir'] . $config['dir']['res'] .
+						($p['thread'] ?
+							$p['thread'] . '.html#' . $p['id']
+						:
+							$p['id'] . '.html'
+						))
+				));
+			}
+		}
 	}
 	
 	if (!hasPermission($config['mod']['bypass_field_disable'], $board['uri'])) {
@@ -798,7 +824,7 @@ if (isset($_POST['delete'])) {
 				));
 			}
 		}
-		}
+	}
 	
 	if (!hasPermission($config['mod']['postunoriginal'], $board['uri']) && $config['robot_enable'] && checkRobot($post['body_nomarkup'])) {
 		undoImage($post);
-- 
cgit v1.3


From 7911c374e86ef8fa69c4545867b9d9d3de12d5c6 Mon Sep 17 00:00:00 2001
From: 8chan <admin@8chan.co>
Date: Wed, 25 Feb 2015 17:21:49 -0800
Subject: Public action logs commit (log.php)

Note: In a previous commit, I began making inc/mod/auth.php more modular with the check_login() function. Including it does NOT check mod login by default anymore like it does on vichan. You have to call check_login(). I've finally included it in inc/functions.php. If you have any custom pages that use inc/mod/auth.php, just including functions.php is enough now.

===================================
Also: backports 351375185e5 (early 404)
---
 inc/config.php         | 22 +++++++++++++++++-----
 inc/functions.php      | 22 ++++++++++++++++++++--
 inc/mod/auth.php       |  2 +-
 inc/mod/pages.php      | 36 ++++++++++++++++++++++++++++++++++++
 install.sql            |  1 +
 log.php                | 24 ++++++++++++++++++++++++
 mod.php                |  6 +++---
 post.php               |  5 +++--
 templates/mod/log.html | 16 ++++++++++++++--
 tools/inc/cli.php      |  1 -
 10 files changed, 119 insertions(+), 16 deletions(-)
 create mode 100644 log.php

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index a3087162..b6bc3b69 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -511,6 +511,13 @@
 	// The timeout for the above, in seconds.
 	$config['upload_by_url_timeout'] = 15;
 
+	// Enable early 404? With default settings, a thread would 404 if it was to leave page 3, if it had less
+	// than 3 replies.
+	$config['early_404'] = false;
+
+	$config['early_404_page'] = 3;
+	$config['early_404_replies'] = 5;
+
 	// A wordfilter (sometimes referred to as just a "filter" or "censor") automatically scans users’ posts
 	// as they are submitted and changes or censors particular words or phrases.
 
@@ -1537,25 +1544,30 @@
 
 /*
  * ====================
- *  Public post search
+ *  Public pages
  * ====================
  */
+
+	// Public post search settings
 	$config['search'] = array();
 
 	// Enable the search form
 	$config['search']['enable'] = false;
 
 	// Maximal number of queries per IP address per minutes
-    $config['search']['queries_per_minutes'] = Array(15, 2);
+	$config['search']['queries_per_minutes'] = Array(15, 2);
 
 	// Global maximal number of queries per minutes
-    $config['search']['queries_per_minutes_all'] = Array(50, 2);
+	$config['search']['queries_per_minutes_all'] = Array(50, 2);
 
 	// Limit of search results
-    $config['search']['search_limit'] = 100;
+	$config['search']['search_limit'] = 100;
 		
 	// Boards for searching
-    //$config['search']['boards'] = array('a', 'b', 'c', 'd', 'e');
+	//$config['search']['boards'] = array('a', 'b', 'c', 'd', 'e');
+
+	// Enable public logs? 0: NO, 1: YES, 2: YES, but drop names
+	$config['public_logs'] = 0;
 
 /*
  * ====================
diff --git a/inc/functions.php b/inc/functions.php
index 8f650828..378e40b3 100755
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -18,6 +18,7 @@ require_once 'inc/template.php';
 require_once 'inc/database.php';
 require_once 'inc/events.php';
 require_once 'inc/api.php';
+require_once 'inc/mod/auth.php';
 require_once 'inc/polyfill.php';
 
 if (!extension_loaded('gettext')) {
@@ -524,7 +525,8 @@ function setupBoard($array) {
 	$board = array(
 		'uri' => $array['uri'],
 		'title' => $array['title'],
-		'subtitle' => $array['subtitle']
+		'subtitle' => $array['subtitle'],
+		#'indexed' => $array['indexed'],
 	);
 
 	// older versions
@@ -1270,7 +1272,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) {
 	return true;
 }
 
-function clean() {
+function clean($pid = false) {
 	global $board, $config;
 	$offset = round($config['max_pages']*$config['threads_per_page']);
 
@@ -1281,6 +1283,22 @@ function clean() {
 	$query->execute() or error(db_error($query));
 	while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 		deletePost($post['id'], false, false);
+		if ($pid) modLog("Automatically deleting thread #{$post['id']} due to new thread #{$pid}");
+	}
+
+	// Bump off threads with X replies earlier, spam prevention method
+	if ($config['early_404']) {
+		$offset = round($config['early_404_page']*$config['threads_per_page']);
+		$query = prepare(sprintf("SELECT `id` AS `thread_id`, (SELECT COUNT(`id`) FROM ``posts_%s`` WHERE `thread` = `thread_id`) AS `reply_count` FROM ``posts_%s`` WHERE `thread` IS NULL ORDER BY `sticky` DESC, `bump` DESC LIMIT :offset, 9001", $board['uri'], $board['uri']));
+		$query->bindValue(':offset', $offset, PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
+			if ($post['reply_count'] < $config['early_404_replies']) {
+				deletePost($post['thread_id'], false, false);
+				if ($pid) modLog("Automatically deleting thread #{$post['thread_id']} due to new thread #{$pid} (early 404 is set, #{$post['thread_id']} had {$post['reply_count']} replies)");
+			}
+		}
 	}
 }
 
diff --git a/inc/mod/auth.php b/inc/mod/auth.php
index 009e93ad..42f34196 100644
--- a/inc/mod/auth.php
+++ b/inc/mod/auth.php
@@ -130,7 +130,7 @@ function destroyCookies() {
 function modLog($action, $_board=null) {
 	global $mod, $board, $config;
 	$query = prepare("INSERT INTO ``modlogs`` VALUES (:id, :ip, :board, :time, :text)");
-	$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
+	$query->bindValue(':id', (isset($mod['id']) ? $mod['id'] : -1), PDO::PARAM_INT);
 	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 	$query->bindValue(':time', time(), PDO::PARAM_INT);
 	$query->bindValue(':text', $action);
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index a90fbbd6..ca12eaf1 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -698,6 +698,42 @@ function mod_user_log($username, $page_no = 1) {
 	mod_page(_('Moderation log'), 'mod/log.html', array('logs' => $logs, 'count' => $count, 'username' => $username));
 }
 
+function mod_board_log($board, $page_no = 1, $hide_names = false, $public = false) {
+	global $config;
+	
+	if ($page_no < 1)
+		error($config['error']['404']);
+	
+	if (!hasPermission($config['mod']['mod_board_log'], $board) && !$public)
+		error($config['error']['noaccess']);
+	
+	$query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `board` = :board ORDER BY `time` DESC LIMIT :offset, :limit");
+	$query->bindValue(':board', $board);
+	$query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT);
+	$query->bindValue(':offset', ($page_no - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT);
+	$query->execute() or error(db_error($query));
+	$logs = $query->fetchAll(PDO::FETCH_ASSOC);
+	
+	if (empty($logs) && $page_no > 1)
+		error($config['error']['404']);
+
+	if (!hasPermission($config['mod']['show_ip'])) {
+		// Supports ipv4 only!
+		foreach ($logs as $i => &$log) {
+			$log['text'] = preg_replace_callback('/(?:<a href="\?\/IP\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}">)?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(?:<\/a>)?/', function($matches) {
+				return "xxxx";//less_ip($matches[1]);
+			}, $log['text']);
+		}
+	}
+	
+	$query = prepare("SELECT COUNT(*) FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `board` = :board");
+	$query->bindValue(':board', $board);
+	$query->execute() or error(db_error($query));
+	$count = $query->fetchColumn();
+	
+	mod_page(_('Board log'), 'mod/log.html', array('logs' => $logs, 'count' => $count, 'board' => $board, 'hide_names' => $hide_names, 'public' => $public));
+}
+
 function mod_view_board($boardName, $page_no = 1) {
 	global $config, $mod;
 	
diff --git a/install.sql b/install.sql
index 7e661450..024cb349 100644
--- a/install.sql
+++ b/install.sql
@@ -65,6 +65,7 @@ CREATE TABLE IF NOT EXISTS `boards` (
   `uri` varchar(58) CHARACTER SET utf8 NOT NULL,
   `title` tinytext NOT NULL,
   `subtitle` tinytext,
+  -- `indexed` boolean default true,
   PRIMARY KEY (`uri`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4;
 
diff --git a/log.php b/log.php
new file mode 100644
index 00000000..1a660c4c
--- /dev/null
+++ b/log.php
@@ -0,0 +1,24 @@
+<?php
+include 'inc/functions.php';
+include 'inc/mod/pages.php';
+
+if (!isset($_GET['board']) || !preg_match("/{$config['board_regex']}/u", $_GET['board'])) {
+	http_response_code(400);
+	error('Bad board.');
+}
+if (!openBoard($_GET['board'])) {
+	http_response_code(404);
+	error('No board.');
+}
+
+if ($config['public_logs'] == 0) error('This board has public logs disabled. Ask the board owner to enable it.');
+if ($config['public_logs'] == 1) $hide_names = false;
+if ($config['public_logs'] == 2) $hide_names = true;
+
+if (!isset($_GET['page'])) {
+	$page = 1;
+} else {
+	$page = (int)$_GET['page'];
+};
+
+mod_board_log($board['uri'], $page, $hide_names, true);
diff --git a/mod.php b/mod.php
index 022f5408..a6ff00cf 100644
--- a/mod.php
+++ b/mod.php
@@ -5,13 +5,13 @@
  */
 
 require_once 'inc/functions.php';
-require_once 'inc/bans.php';
-require_once 'inc/mod/pages.php';
-require_once 'inc/mod/auth.php';
 
 if ($config['debug'])
 	$parse_start_time = microtime(true);
 
+require_once 'inc/bans.php';
+require_once 'inc/mod/pages.php';
+
 check_login(true);
 
 $query = isset($_SERVER['QUERY_STRING']) ? rawurldecode($_SERVER['QUERY_STRING']) : '';
diff --git a/post.php b/post.php
index 06a9dc74..0d3292bb 100644
--- a/post.php
+++ b/post.php
@@ -70,9 +70,11 @@ if (isset($_POST['delete'])) {
 			if (isset($_POST['file'])) {
 				// Delete just the file
 				deleteFile($id);
+				modLog("User deleted file from his own post #$id");
 			} else {
 				// Delete entire post
 				deletePost($id);
+				modLog("User deleted his own post #$id");
 			}
 			
 			_syslog(LOG_INFO, 'Deleted post: ' .
@@ -233,7 +235,6 @@ if (isset($_POST['delete'])) {
 	checkBan($board['uri']);
 
 	if ($post['mod'] = isset($_POST['mod']) && $_POST['mod']) {
-		require 'inc/mod/auth.php';
 		check_login(false);
 		if (!$mod) {
 			// Liar. You're not a mod.
@@ -945,7 +946,7 @@ if (isset($_POST['delete'])) {
 		$build_pages = range(1, $config['max_pages']);
 	
 	if ($post['op'])
-		clean();
+		clean($pid);
 	
 	event('post-after', $post);
 	
diff --git a/templates/mod/log.html b/templates/mod/log.html
index 0aa3f110..a38b4af5 100644
--- a/templates/mod/log.html
+++ b/templates/mod/log.html
@@ -10,7 +10,15 @@
 		<tr>
 			<td class="minimal">
 				{% if log.username %}
-					<a href="?/log:{{ log.username|e }}">{{ log.username|e }}</a>
+					{% if hide_names %}
+						<em>hidden</em>
+					{% else %}
+						{% if not mod|hasPermission(config.mod.modlog) %}
+							<a href="?/new_PM/{{ log.username|e }}">{{ log.username|e }}</a>
+						{% else %}
+							<a href="?/log:{{ log.username|e }}">{{ log.username|e }}</a>
+						{% endif %}
+					{% endif %}
 				{% elseif log.mod == -1 %}
 					<em>system</em>
 				{% else %}
@@ -44,7 +52,11 @@
 {% if count > logs|count %}
 	<p class="unimportant" style="text-align:center;word-wrap:break-word">
 		{% for i in range(0, (count - 1) / config.mod.modlog_page) %}
-			<a href="?/log{% if username %}:{{ username }}{% endif %}/{{ i + 1 }}">[{{ i + 1 }}]</a> 
+			{% if public %}
+				<a href="?page={{ i + 1 }}&amp;board={{ board|url_encode }}">[{{ i + 1 }}]</a> 
+			{% else %}
+				<a href="?/log{% if username %}:{{ username }}{% elseif board %}:b:{{ board }}{% endif %}/{{ i + 1 }}">[{{ i + 1 }}]</a> 
+			{% endif %}
 		{% endfor %}
 	</p>
 {% endif %}
diff --git a/tools/inc/cli.php b/tools/inc/cli.php
index f3e8824f..95d51573 100644
--- a/tools/inc/cli.php
+++ b/tools/inc/cli.php
@@ -39,7 +39,6 @@ if(!getenv('TINYBOARD_PATH')) {
 putenv('TINYBOARD_PATH=' . getcwd());
 
 require 'inc/functions.php';
-require 'inc/mod/auth.php';
 
 $mod = Array(
 	'id' => -1,
-- 
cgit v1.3


From 505adffcdca1c1141b7b46f862b7939f2f4acf45 Mon Sep 17 00:00:00 2001
From: Fredrick Brennan <admin@8chan.co>
Date: Fri, 3 Apr 2015 14:56:28 +0800
Subject: Cyclical threads ♺
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 inc/api.php                       |  1 +
 inc/config.php                    |  5 +++++
 inc/functions.php                 |  8 +++++++-
 inc/mod/pages.php                 | 22 ++++++++++++++++++++++
 install.php                       |  7 ++++++-
 mod.php                           |  1 +
 post.php                          | 11 ++++++++++-
 templates/post/post_controls.html |  8 +++++++-
 templates/post_thread.html        | 13 ++++++++++---
 templates/posts.sql               |  1 +
 10 files changed, 70 insertions(+), 7 deletions(-)

(limited to 'post.php')

diff --git a/inc/api.php b/inc/api.php
index b2d8adec..b280c25b 100644
--- a/inc/api.php
+++ b/inc/api.php
@@ -32,6 +32,7 @@ class Api {
 			'images' => 'images',
 			'sticky' => 'sticky',
 			'locked' => 'locked',
+			'cycle' => 'cyclical',
 			'bump' => 'last_modified',
 			'embed' => 'embed',
 		);
diff --git a/inc/config.php b/inc/config.php
index 3fdb8d2f..82fdc882 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1245,6 +1245,8 @@
 	$config['mod']['link_bumpunlock'] = '[-Sage]';
 	$config['mod']['link_editpost'] = '[Edit]';
 	$config['mod']['link_move'] = '[Move]';
+	$config['mod']['link_cycle'] = '[Cycle]';
+	$config['mod']['link_uncycle'] = '[-Cycle]';
 
 	// Moderator capcodes.
 	$config['capcode'] = ' <span class="capcode">## %s</span>';
@@ -1388,6 +1390,9 @@
 	$config['mod']['deletebyip_global'] = ADMIN;
 	// Sticky a thread
 	$config['mod']['sticky'] = MOD;
+	// Cycle a thread
+	$config['mod']['cycle'] = MOD;
+	$config['cycle_limit'] = &$config['reply_limit'];
 	// Lock a thread
 	$config['mod']['lock'] = MOD;
 	// Post in a locked thread
diff --git a/inc/functions.php b/inc/functions.php
index e9692d56..1bd1f32f 100755
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1021,7 +1021,7 @@ function insertFloodPost(array $post) {
 
 function post(array $post) {
 	global $pdo, $board;
-	$query = prepare(sprintf("INSERT INTO ``posts_%s`` VALUES ( NULL, :thread, :subject, :email, :name, :trip, :capcode, :body, :body_nomarkup, :time, :time, :files, :num_files, :filehash, :password, :ip, :sticky, :locked, 0, :embed, :slug)", $board['uri']));
+	$query = prepare(sprintf("INSERT INTO ``posts_%s`` VALUES ( NULL, :thread, :subject, :email, :name, :trip, :capcode, :body, :body_nomarkup, :time, :time, :files, :num_files, :filehash, :password, :ip, :sticky, :locked, :cycle, 0, :embed, :slug)", $board['uri']));
 
 	// Basic stuff
 	if (!empty($post['subject'])) {
@@ -1061,6 +1061,12 @@ function post(array $post) {
 		$query->bindValue(':locked', false, PDO::PARAM_INT);
 	}
 
+	if ($post['op'] && $post['mod'] && isset($post['cycle']) && $post['cycle']) {
+		$query->bindValue(':cycle', true, PDO::PARAM_INT);
+	} else {
+		$query->bindValue(':cycle', false, PDO::PARAM_INT);
+	}
+
 	if ($post['mod'] && isset($post['capcode']) && $post['capcode']) {
 		$query->bindValue(':capcode', $post['capcode'], PDO::PARAM_INT);
 	} else {
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index 6d1e20b4..303fa3dd 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -1089,6 +1089,28 @@ function mod_sticky($board, $unsticky, $post) {
 	header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']);
 }
 
+function mod_cycle($board, $uncycle, $post) {
+	global $config;
+	
+	if (!openBoard($board))
+		error($config['error']['noboard']);
+	
+	if (!hasPermission($config['mod']['cycle'], $board))
+		error($config['error']['noaccess']);
+	
+	$query = prepare(sprintf('UPDATE ``posts_%s`` SET `cycle` = :cycle WHERE `id` = :id AND `thread` IS NULL', $board));
+	$query->bindValue(':id', $post);
+	$query->bindValue(':cycle', $uncycle ? 0 : 1);
+	$query->execute() or error(db_error($query));
+	if ($query->rowCount()) {
+		modLog(($uncycle ? 'Made not cyclical' : 'Made cyclical') . " thread #{$post}");
+		buildThread($post);
+		buildIndex();
+	}
+	
+	header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']);
+}
+
 function mod_bumplock($board, $unbumplock, $post) {
 	global $config;
 	
diff --git a/install.php b/install.php
index 5a6512ba..de4d3dd0 100644
--- a/install.php
+++ b/install.php
@@ -1,7 +1,7 @@
 <?php
 
 // Installation/upgrade file	
-define('VERSION', '5.1.1');
+define('VERSION', '5.1.2');
 
 require 'inc/functions.php';
 
@@ -570,6 +570,11 @@ if (file_exists($config['has_installed'])) {
 			  PRIMARY KEY (`id`),
 			  UNIQUE KEY `u_pages` (`name`,`board`)
 			) ENGINE=InnoDB DEFAULT CHARSET=utf8;') or error(db_error());
+		case '5.1.1':
+                        foreach ($boards as &$board) {
+                                query(sprintf("ALTER TABLE ``posts_%s`` ADD `cycle` int(1) NOT NULL AFTER `locked`", $board['uri'])) or error(db_error());
+                        }
+
 		case false:
 			// TODO: enhance Tinyboard -> vichan upgrade path.
 			query("CREATE TABLE IF NOT EXISTS ``search_queries`` (  `ip` varchar(39) NOT NULL,  `time` int(11) NOT NULL,  `query` text NOT NULL) ENGINE=MyISAM DEFAULT CHARSET=utf8;") or error(db_error());
diff --git a/mod.php b/mod.php
index fbe679ac..0378d55c 100644
--- a/mod.php
+++ b/mod.php
@@ -82,6 +82,7 @@ $pages = array(
 	'/(\%b)/deletebyip/(\d+)(/global)?'	=> 'secure deletebyip',		// delete all posts by IP address
 	'/(\%b)/(un)?lock/(\d+)'		=> 'secure lock',		// lock thread
 	'/(\%b)/(un)?sticky/(\d+)'		=> 'secure sticky',		// sticky thread
+	'/(\%b)/(un)?cycle/(\d+)'                         => 'secure cycle',          // cycle thread
 	'/(\%b)/bump(un)?lock/(\d+)'		=> 'secure bumplock',		// "bumplock" thread
 	
 	'/themes'				=> 'themes_list',		// manage themes
diff --git a/post.php b/post.php
index 0d3292bb..98aefe05 100644
--- a/post.php
+++ b/post.php
@@ -265,7 +265,7 @@ if (isset($_POST['delete'])) {
 	
 	//Check if thread exists
 	if (!$post['op']) {
-		$query = prepare(sprintf("SELECT `sticky`,`locked`,`sage`,`slug` FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri']));
+		$query = prepare(sprintf("SELECT `sticky`,`locked`,`cycle`,`sage`,`slug` FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri']));
 		$query->bindValue(':id', $post['thread'], PDO::PARAM_INT);
 		$query->execute() or error(db_error());
 		
@@ -867,6 +867,15 @@ if (isset($_POST['delete'])) {
 	$post['slug'] = slugify($post);
 	
 	insertFloodPost($post);
+
+	// Handle cyclical threads
+	if (!$post['op'] && isset($thread['cycle']) && $thread['cycle']) {
+		// Query is a bit weird due to "This version of MariaDB doesn't yet support 'LIMIT & IN/ALL/ANY/SOME subquery'" (MariaDB Ver 15.1 Distrib 10.0.17-MariaDB, for Linux (x86_64))
+		$query = prepare(sprintf('DELETE FROM ``posts_%s`` WHERE `thread` = :thread AND `id` NOT IN (SELECT `id` FROM (SELECT `id` FROM ``posts_%s`` WHERE `thread` = :thread ORDER BY `id` DESC LIMIT :limit) i)', $board['uri'], $board['uri']));
+		$query->bindValue(':thread', $post['thread']);
+		$query->bindValue(':limit', $config['cycle_limit'], PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+	}
 	
 	if (isset($post['antispam_hash'])) {
 		incrementSpamHash($post['antispam_hash']);
diff --git a/templates/post/post_controls.html b/templates/post/post_controls.html
index 99a8484c..60dc6fc4 100644
--- a/templates/post/post_controls.html
+++ b/templates/post/post_controls.html
@@ -41,7 +41,6 @@
 {% endif %}
 
 {% endif %}
-
 {% if mod|hasPermission(config.mod.move, board.uri) %}
 	{% if not post.thread %}
 		<a title="{% trans %}Move thread to another board{% endtrans %}" href="?/{{ board.dir }}move/{{ post.id }}">{{ config.mod.link_move }}</a>&nbsp;
@@ -49,6 +48,13 @@
 		<a title="{% trans %}Move reply to another board{% endtrans %}" href="?/{{ board.dir }}move_reply/{{ post.id }}">{{ config.mod.link_move }}</a>&nbsp;
 	{% endif %}
 {% endif %}
+{% if mod|hasPermission(config.mod.cycle, board.uri) %}
+	{% if post.cycle %}
+	<a title="{% trans %}Make thread not cycle{% endtrans %}" href="?/{{ secure_link(board.dir ~ 'uncycle/' ~ post.id) }}">{{ config.mod.link_uncycle }}</a>&nbsp;
+	{% else %}
+	<a title="{% trans %}Make thread cycle{% endtrans %}" href="?/{{ secure_link(board.dir ~ 'cycle/' ~ post.id) }}">{{ config.mod.link_cycle }}</a>&nbsp;
+	{% endif %}
+{% endif %}
 {% if mod|hasPermission(config.mod.editpost, board.uri) %}
 	<a title="{% trans %}Edit post{% endtrans %}" href="?/{{ board.dir }}edit{% if config.mod.raw_html_default %}_raw{% endif %}/{{ post.id }}">{{ config.mod.link_editpost }}</a>&nbsp;
 {% endif %}
diff --git a/templates/post_thread.html b/templates/post_thread.html
index 72ca2998..125d5f78 100644
--- a/templates/post_thread.html
+++ b/templates/post_thread.html
@@ -19,25 +19,32 @@
 	<a class="post_no" onclick="citeReply({{ post.id }})" href="{% if isnoko50 %}{{ post.link('q', '50') }}{% else %}{{ post.link('q') }}{% endif %}">{{ post.id }}</a>
 	{% if post.sticky %}
 		{% if config.font_awesome %}
-			<i class="fa fa-thumb-tack"></i>
+			<i class="fa fa-thumb-tack" title="Sticky"></i>
 		{% else %}
 			<img class="icon" title="Sticky" src="{{ config.image_sticky }}" alt="Sticky" />
 		{% endif %}
 	{% endif %}
 	{% if post.locked %}
 		{% if config.font_awesome %}
-			<i class="fa fa-lock"></i>
+			<i class="fa fa-lock" title="Locked"></i>
 		{% else %}
 			<img class="icon" title="Locked" src="{{ config.image_locked }}" alt="Locked" />
 		{% endif %}
 	{% endif %}
 	{% if post.bumplocked and (config.mod.view_bumplock < 0 or (post.mod and post.mod|hasPermission(config.mod.view_bumplock, board.uri))) %}
 		{% if config.font_awesome %}
-			<i class="fa fa-anchor"></i>
+			<i class="fa fa-anchor" title="Bumplocked"></i>
 		{% else %}
 			<img class="icon" title="Bumplocked" src="{{ config.image_bumplocked }}" alt="Bumplocked" />
 		{% endif %}
 	{% endif %}
+	{% if post.cycle %}
+		{% if config.font_awesome %}
+			<i class="fa fa-refresh" title="Cyclical"></i>
+		{% else %}
+			<img class="icon" title="Cyclical" src="{{ config.image_sticky }}" alt="Cyclical" />
+		{% endif %}
+	{% endif %}
 	{% if index %}
 		<a href="{{ post.root }}{{ board.dir }}{{ config.dir.res }}{{ link_for(post) }}">[{% trans %}Reply{% endtrans %}]</a>
 	{% endif %}
diff --git a/templates/posts.sql b/templates/posts.sql
index 6b2249ef..070e687b 100644
--- a/templates/posts.sql
+++ b/templates/posts.sql
@@ -17,6 +17,7 @@ CREATE TABLE IF NOT EXISTS ``posts_{{ board }}`` (
    `ip` varchar(39) CHARACTER SET ascii NOT NULL,
    `sticky` int(1) NOT NULL,
    `locked` int(1) NOT NULL,
+   `cycle` int(1) NOT NULL,
    `sage` int(1) NOT NULL,
    `embed` text,
    `slug` varchar(256) DEFAULT NULL,
-- 
cgit v1.3


From 644f227ab33f247dc82e0208fe2125d5d002f4f4 Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Sun, 8 May 2016 03:09:20 +0200
Subject: fix "Undefined variable: pid"; thanks fpdl and MrFreeman

---
 post.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 98aefe05..4ea08ce3 100644
--- a/post.php
+++ b/post.php
@@ -955,7 +955,7 @@ if (isset($_POST['delete'])) {
 		$build_pages = range(1, $config['max_pages']);
 	
 	if ($post['op'])
-		clean($pid);
+		clean($id);
 	
 	event('post-after', $post);
 	
-- 
cgit v1.3


From 8a46c7a0d54864d7f640e1972a23e78018368cc2 Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Thu, 9 Jun 2016 11:08:29 +0200
Subject: tesseract OCR support for spamfilters

---
 inc/config.php         | 13 +++++++++++++
 inc/functions.php      |  2 +-
 post.php               | 43 ++++++++++++++++++++++++++++++++++++++-----
 tmp/tesseract/.gitkeep |  0
 4 files changed, 52 insertions(+), 6 deletions(-)
 create mode 100644 tmp/tesseract/.gitkeep

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index 5926eb1d..ebe17572 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -824,6 +824,15 @@
 	// Set this to true if you're using Linux and you can execute `md5sum` binary.
 	$config['gnu_md5'] = false;
 
+	// Use Tesseract OCR to retrieve text from images, so you can use it as a spamfilter.
+	$config['tesseract_ocr'] = false;
+
+	// Tesseract parameters
+	$config['tesseract_params'] = '';
+
+	// Tesseract preprocess command
+	$config['tesseract_preprocess_command'] = 'convert -monochrome %s -';
+
 	// Number of posts in a "View Last X Posts" page
 	$config['noko50_count'] = 50;
 	// Number of posts a thread needs before it gets a "View Last X Posts" page.
@@ -1015,6 +1024,10 @@
 	// Minify Javascript using http://code.google.com/p/minify/.
 	$config['minify_js'] = false;
 
+	// Dispatch thumbnail loading and image configuration with JavaScript. It will need a certain javascript
+	// code to work.
+	$config['javascript_image_dispatch'] = false;
+
 /*
  * ====================
  *  Video embedding
diff --git a/inc/functions.php b/inc/functions.php
index 154386b0..5a8f6000 100755
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -2695,7 +2695,7 @@ function slugify($post) {
 	elseif (isset ($post['body_nomarkup']) && $post['body_nomarkup'])
 		$slug = $post['body_nomarkup'];
 	elseif (isset ($post['body']) && $post['body'])
-		$slug = strip_html($post['body']);
+		$slug = strip_tags($post['body']);
 
 	// Fix UTF-8 first
 	$slug = mb_convert_encoding($slug, "UTF-8", "UTF-8");
diff --git a/post.php b/post.php
index 4ea08ce3..bf723e01 100644
--- a/post.php
+++ b/post.php
@@ -652,14 +652,14 @@ if (isset($_POST['delete'])) {
 			$post['filehash'] = md5($allhashes);
 		}
 	}
-	
+
 	if (!hasPermission($config['mod']['bypass_filters'], $board['uri'])) {
-		require_once 'inc/filters.php';	
-		
+		require_once 'inc/filters.php';
+
 		do_filters($post);
 	}
-	
-	if ($post['has_file']) {	
+
+	if ($post['has_file']) {
 		foreach ($post['files'] as $key => &$file) {
 		if ($file['is_an_image']) {
 			if ($config['ie_mime_type_detection'] !== false) {
@@ -787,6 +787,34 @@ if (isset($_POST['delete'])) {
 			$file['thumbwidth'] = $size[0];
 			$file['thumbheight'] = $size[1];
 		}
+
+		if ($config['tesseract_ocr']) { // Let's OCR it!
+			$fname = $file['tmp_name'];
+
+			if ($file['height'] > 500 || $file['width'] > 500) {
+				$fname = $file['thumb'];
+			}
+
+			if ($fname == 'spoiler') { // We don't have that much CPU time, do we?
+			}
+			else {
+				$tmpname = "tmp/tesseract/".rand(0,10000000);
+
+				// Preprocess command is an ImageMagick b/w quantization
+				$error = shell_exec_error(sprintf($config['tesseract_preprocess_command'], escapeshellarg($fname)) . " | " .
+                                                          'tesseract stdin '.escapeshellarg($tmpname).' '.$config['tesseract_params']);
+				$tmpname .= ".txt";
+
+				$value = @file_get_contents($tmpname);
+				@unlink($tmpname);
+
+				if ($value && trim($value)) {
+					// This one has an effect, that the body is appended to a post body. So you can write a correct
+					// spamfilter.
+					$post['body_nomarkup'] .= "<tinyboard ocr image $key>".htmlspecialchars($value)."</tinyboard>";
+				}
+			}
+		}
 		
 		if (!isset($dont_copy_file) || !$dont_copy_file) {
 			if (isset($file['file_tmp'])) {
@@ -827,6 +855,11 @@ if (isset($_POST['delete'])) {
 		}
 	}
 	
+	// Do filters again if OCRing
+	if ($config['tesseract_ocr'] && !hasPermission($config['mod']['bypass_filters'], $board['uri'])) {
+		do_filters($post);
+	}
+
 	if (!hasPermission($config['mod']['postunoriginal'], $board['uri']) && $config['robot_enable'] && checkRobot($post['body_nomarkup'])) {
 		undoImage($post);
 		if ($config['robot_mute']) {
diff --git a/tmp/tesseract/.gitkeep b/tmp/tesseract/.gitkeep
new file mode 100644
index 00000000..e69de29b
-- 
cgit v1.3


From e230f1472cdd9fe5d416196d51e905eac22ce70e Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Fri, 10 Jun 2016 12:41:53 +0200
Subject: don`t ocr non-images

---
 post.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index bf723e01..383154fb 100644
--- a/post.php
+++ b/post.php
@@ -788,7 +788,7 @@ if (isset($_POST['delete'])) {
 			$file['thumbheight'] = $size[1];
 		}
 
-		if ($config['tesseract_ocr']) { // Let's OCR it!
+		if ($config['tesseract_ocr'] && $file['thumb'] != 'file') { // Let's OCR it!
 			$fname = $file['tmp_name'];
 
 			if ($file['height'] > 500 || $file['width'] > 500) {
-- 
cgit v1.3


From 11cecf8452d724b1a61e82292cff1cc16a5403e7 Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Tue, 21 Jun 2016 05:03:44 +0200
Subject: Revert "[BUG] Image reject repost board option now also affects YT
 embeds"

This reverts commit b476b660073adbe827836a7e7860b0fb3a061ff0.
---
 inc/functions.php | 47 -----------------------------------------------
 post.php          | 28 +---------------------------
 2 files changed, 1 insertion(+), 74 deletions(-)

(limited to 'post.php')

diff --git a/inc/functions.php b/inc/functions.php
index e576cf99..043d4de7 100755
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -2492,53 +2492,6 @@ function getPostByHashInThread($hash, $thread) {
 	return false;
 }
 
-function getPostByEmbed($embed) {
-	global $board, $config;
-	$matches = array();
-	foreach ($config['embedding'] as &$e) {
-		if (preg_match($e[0], $embed, $matches) && isset($matches[1]) && !empty($matches[1])) {
-			$embed = '%'.$matches[1].'%';
-			break;
-		}
-	}
-
-	if (!isset($embed)) return false;
-
-	$query = prepare(sprintf("SELECT `id`,`thread` FROM ``posts_%s`` WHERE `embed` LIKE :embed", $board['uri']));
-	$query->bindValue(':embed', $embed, PDO::PARAM_STR);
-	$query->execute() or error(db_error($query));
-
-	if ($post = $query->fetch(PDO::FETCH_ASSOC)) {
-		return $post;
-	}
-
-	return false;
-}
-
-function getPostByEmbedInThread($embed, $thread) {
-	global $board, $config;
-	$matches = array();
-	foreach ($config['embedding'] as &$e) {
-		if (preg_match($e[0], $embed, $matches) && isset($matches[1]) && !empty($matches[1])) {
-			$embed = '%'.$matches[1].'%';
-			break;
-		}
-	}
-
-	if (!isset($embed)) return false;
-
-	$query = prepare(sprintf("SELECT `id`,`thread` FROM ``posts_%s`` WHERE `embed` = :embed AND ( `thread` = :thread OR `id` = :thread )", $board['uri']));
-	$query->bindValue(':embed', $embed, PDO::PARAM_STR);
-	$query->bindValue(':thread', $thread, PDO::PARAM_INT);
-	$query->execute() or error(db_error($query));
-
-	if ($post = $query->fetch(PDO::FETCH_ASSOC)) {
-		return $post;
-	}
-
-	return false;
-}
-
 function undoImage(array $post) {
 	if (!$post['has_file'] || !isset($post['files']))
 		return;
diff --git a/post.php b/post.php
index 383154fb..aa1b8235 100644
--- a/post.php
+++ b/post.php
@@ -295,32 +295,6 @@ if (isset($_POST['delete'])) {
 		if (!isset($post['embed'])) {
 			error($config['error']['invalid_embed']);
 		}
-
-		if ($config['image_reject_repost']) {
-			if ($p = getPostByEmbed($post['embed'])) {
-				error(sprintf($config['error']['fileexists'], 
-					($post['mod'] ? $config['root'] . $config['file_mod'] . '?/' : $config['root']) .
-					($board['dir'] . $config['dir']['res'] .
-						($p['thread'] ?
-							$p['thread'] . '.html#' . $p['id']
-						:
-							$p['id'] . '.html'
-						))
-				));
-			}
-		} else if (!$post['op'] && $config['image_reject_repost_in_thread']) {
-			if ($p = getPostByEmbedInThread($post['embed'], $post['thread'])) {
-				error(sprintf($config['error']['fileexistsinthread'], 
-					($post['mod'] ? $config['root'] . $config['file_mod'] . '?/' : $config['root']) .
-					($board['dir'] . $config['dir']['res'] .
-						($p['thread'] ?
-							$p['thread'] . '.html#' . $p['id']
-						:
-							$p['id'] . '.html'
-						))
-				));
-			}
-		}
 	}
 	
 	if (!hasPermission($config['mod']['bypass_field_disable'], $board['uri'])) {
@@ -853,7 +827,7 @@ if (isset($_POST['delete'])) {
 				));
 			}
 		}
-	}
+		}
 	
 	// Do filters again if OCRing
 	if ($config['tesseract_ocr'] && !hasPermission($config['mod']['bypass_filters'], $board['uri'])) {
-- 
cgit v1.3


From a55760299c6777fc841a9990fa9b590b17663bb8 Mon Sep 17 00:00:00 2001
From: nekomiko482 <nekomiko482@yandex.ru>
Date: Thu, 7 Jul 2016 12:53:40 +0300
Subject: Fixes incompatibility with BSD's md5 output format.

fixes #190
---
 post.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index aa1b8235..753d2006 100644
--- a/post.php
+++ b/post.php
@@ -607,7 +607,7 @@ if (isset($_POST['delete'])) {
 				error($config['error']['nomove']);
 
 			if ($md5cmd) {
-				$output = shell_exec_error($md5cmd . " < " . escapeshellarg($upload));
+				$output = shell_exec_error($md5cmd . " " . escapeshellarg($upload));
 				$output = explode(' ', $output);
 				$hash = $output[0];
 			}
-- 
cgit v1.3


From 8548a4ff703acd5a77e4ce678eeb88e4261a1aa6 Mon Sep 17 00:00:00 2001
From: ptchan-foss <admin@ptchan.net>
Date: Fri, 12 Aug 2016 18:18:54 +0100
Subject: Fixed report syslog message

---
 post.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 753d2006..0f58dd4c 100644
--- a/post.php
+++ b/post.php
@@ -148,15 +148,15 @@ if (isset($_POST['delete'])) {
 	markup($reason);
 	
 	foreach ($report as &$id) {
-		$query = prepare(sprintf("SELECT `thread` FROM ``posts_%s`` WHERE `id` = :id", $board['uri']));
+		$query = prepare(sprintf("SELECT `id`, `thread` FROM ``posts_%s`` WHERE `id` = :id", $board['uri']));
 		$query->bindValue(':id', $id, PDO::PARAM_INT);
 		$query->execute() or error(db_error($query));
 		
-		$thread = $query->fetchColumn();
+		$post = $query->fetch(PDO::FETCH_ASSOC);
 		
 		if ($config['syslog'])
 			_syslog(LOG_INFO, 'Reported post: ' .
-				'/' . $board['dir'] . $config['dir']['res'] . link_for($post) . ($thread ? '#' . $id : '') .
+				'/' . $board['dir'] . $config['dir']['res'] . link_for($post) . ($post['thread'] ? '#' . $id : '') .
 				' for "' . $reason . '"'
 			);
 		$query = prepare("INSERT INTO ``reports`` VALUES (NULL, :time, :ip, :board, :post, :reason)");
-- 
cgit v1.3


From 5e335a8564a76f0449d47f0767b4baa8d2cb9e91 Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Sun, 14 Aug 2016 16:24:17 +0200
Subject: preliminary inbound nntpchan support

---
 inc/config.php |  17 +++
 install.php    |  15 ++-
 install.sql    |  19 +++
 post.php       | 359 +++++++++++++++++++++++++++++++++++++++++++--------------
 4 files changed, 322 insertions(+), 88 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index ebe17572..a8afdf7a 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1689,6 +1689,23 @@
 	// Example: Adding the pre-markup post body to the API as "com_nomarkup".
 	// $config['api']['extra_fields'] = array('body_nomarkup' => 'com_nomarkup');
 
+/*
+ * ==================
+ *  NNTPChan settings
+ * ==================
+ */
+
+	$config['nntpchan'] = array();
+
+	// Enable NNTPChan integration
+	$config['nntpchan']['enabled'] = false;
+
+	// NNTP server
+	$config['nntpchan']['server'] = "localhost:1119";
+
+	// Global dispatch array. Add your boards to it to enable them.
+	$config['nntpchan']['dispatch'] = array(); // 'overchan.test' => 'test'
+
 /*
  * ====================
  *  Other/uncategorized
diff --git a/install.php b/install.php
index de4d3dd0..6f1617a8 100644
--- a/install.php
+++ b/install.php
@@ -1,7 +1,7 @@
 <?php
 
 // Installation/upgrade file	
-define('VERSION', '5.1.2');
+define('VERSION', '5.1.3');
 
 require 'inc/functions.php';
 
@@ -574,6 +574,19 @@ if (file_exists($config['has_installed'])) {
                         foreach ($boards as &$board) {
                                 query(sprintf("ALTER TABLE ``posts_%s`` ADD `cycle` int(1) NOT NULL AFTER `locked`", $board['uri'])) or error(db_error());
                         }
+		case '5.1.2':
+			query('CREATE TABLE ``nntp_references`` (
+				  `board` varchar(60) NOT NULL,
+				  `id` int(11) unsigned NOT NULL,
+				  `message_id` varchar(255) CHARACTER SET ascii NOT NULL,
+				  `message_id_digest` varchar(40) CHARACTER SET ascii NOT NULL,
+				  `own` tinyint(1) NOT NULL,
+				  `headers` text,
+				  PRIMARY KEY (`message_id_digest`),
+				  UNIQUE KEY `message_id` (`message_id`),
+				  UNIQUE KEY `u_board_id` (`board`, `id`)
+				) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+			') or error(db_error());
 
 		case false:
 			// TODO: enhance Tinyboard -> vichan upgrade path.
diff --git a/install.sql b/install.sql
index bf9b92bf..3b390645 100644
--- a/install.sql
+++ b/install.sql
@@ -314,6 +314,25 @@ CREATE TABLE `pages` (
   UNIQUE KEY `u_pages` (`name`,`board`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4;
 
+-- --------------------------------------------------------
+
+--
+-- Table structure for table `nntp_references`
+--
+
+CREATE TABLE `nntp_references` (
+  `board` varchar(60) NOT NULL,
+  `id` int(11) unsigned NOT NULL,
+  `message_id` varchar(255) CHARACTER SET ascii NOT NULL,
+  `message_id_digest` varchar(40) CHARACTER SET ascii NOT NULL,
+  `own` tinyint(1) NOT NULL,
+  `headers` text,
+  PRIMARY KEY (`message_id_digest`),
+  UNIQUE KEY `message_id` (`message_id`),
+  UNIQUE KEY `u_board_id` (`board`, `id`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4;
+
+
 /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
 /*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
 /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
diff --git a/post.php b/post.php
index aa1b8235..4af09928 100644
--- a/post.php
+++ b/post.php
@@ -11,6 +11,160 @@ if ((!isset($_POST['mod']) || !$_POST['mod']) && $config['board_locked']) {
     error("Board is locked");
 }
 
+$dropped_post = false;
+
+if (isset($_GET['Newsgroups']) && $config['nntpchan']['enabled']) {
+	$_POST = array();
+	$_POST['json_response'] = true;
+
+	$headers = json_encode($_GET);
+
+	if (!isset ($_GET['Message-Id'])) {
+		if (!isset ($_GET['Message-ID'])) {
+			error("NNTPChan: No message ID");
+		}
+		else $msgid = $_GET['Message-ID'];
+	}
+	else $msgid = $_GET['Message-Id'];
+
+	$groups = preg_split("/,\s*/", $_GET['Newsgroups']);
+	if (count($groups) != 1) {
+		error("NNTPChan: Messages can go to only one newsgroup");
+	}
+	$group = $groups[0];
+
+	if (!isset($config['nntpchan']['dispatch'][$group])) {
+		error("NNTPChan: We don't synchronize $group");
+	}
+	$xboard = $config['nntpchan']['dispatch'][$group];
+
+	$ref = null;
+	if (isset ($_GET['References'])) {
+		$refs = preg_split("/,\s*/", $_GET['References']);
+
+		if (count($refs) > 1) {
+			error("NNTPChan: We don't support multiple references");
+		}
+
+		$ref = $refs[0];
+
+		$query = prepare("SELECT `board`,`id` FROM ``nntp_references`` WHERE `message_id` = :ref");
+                $query->bindValue(':ref', $ref);
+                $query->execute() or error(db_error($query));
+
+		$ary = $query->fetchAll(PDO::FETCH_ASSOC);
+
+		if (count($ary) == 0) {
+			error("NNTPChan: We don't have $ref that $msgid references");
+		}
+
+		$p_id = $ary[0]['id'];
+		$p_board = $ary[0]['board'];
+
+		if ($p_board != $xboard) {
+			error("NNTPChan: Cross board references not allowed. Tried to reference $p_board on $xboard");
+		}
+
+		$_POST['thread'] = $p_id;
+	}
+
+	$date = isset($_GET['Date']) ? strtotime($_GET['Date']) : time();
+
+	list($ct) = explode('; ', $_GET['Content-Type']);
+
+	$query = prepare("SELECT COUNT(*) AS `c` FROM ``nntp_references`` WHERE `message_id` = :msgid");
+	$query->bindValue(":msgid", $msgid);
+	$query->execute() or error(db_error($query));
+
+	$a = $query->fetch(PDO::FETCH_ASSOC);
+	if ($a['c'] > 0) {
+		error("NNTPChan: We already have this post. Post discarded.");
+	}
+
+	if ($ct == 'text/plain') {
+		$content = file_get_contents("php://input");
+	}
+	elseif ($ct == 'multipart/mixed' || $ct == 'multipart/form-data') {
+		_syslog(LOG_INFO, "MM: Files: ".print_r($GLOBALS, true));
+		$content = '';
+
+		$tmpfiles = $_FILES['attachment'];
+		foreach ($tmpfiles as $id => $file) {
+			if ($file['type'] == 'text/plain') {
+				$content .= file_get_contents($file['tmp_name']);
+				unset($_FILES['attachment'][$id]);
+			}
+			elseif ($file['type'] == 'message/rfc822') { // Signed message, ignore for now
+				unset($_FILES['attachment'][$id]);
+			}
+			else { // A real attachment :^)
+			}
+		}
+
+		$_FILES = $_FILES['attachment'];
+
+
+	}
+	else {
+		error("NNTPChan: Wrong mime type: $ct");
+	}
+
+	$_POST['subject'] = isset($_GET['Subject']) ? $_GET['Subject'] : '';
+	$_POST['board'] = $xboard;
+
+	if (isset ($_GET['From'])) {
+		list($name, $mail) = explode(" <", $_GET['From'], 2);
+		$mail = preg_replace('/>\s+$/', '', $mail);
+
+		$_POST['name'] = $name;
+		//$_POST['email'] = $mail;
+		$_POST['email'] = '';
+	}
+
+	if (isset ($_GET['X_Sage'])) {
+		$_POST['email'] = 'sage';
+	}
+
+	$content = preg_replace_callback('/>>([0-9a-fA-F]{6,})/', function($id) use ($xboard) {
+		$id = $id[1];
+
+		$query = prepare("SELECT `board`,`id` FROM ``nntp_references`` WHERE `message_id_digest` LIKE :rule");
+		$idx = $id . "%";
+                $query->bindValue(':rule', $idx);
+                $query->execute() or error(db_error($query));
+		
+		$ary = $query->fetchAll(PDO::FETCH_ASSOC);
+		if (count($ary) == 0) {
+			return ">>>>$id";
+		}
+		else {
+			$ret = array();
+			foreach ($ary as $v) {
+				if ($v['board'] != $xboard) {
+					$ret[] = ">>>/".$v['board']."/".$v['id'];
+				}
+				else {
+					$ret[] = ">>".$v['id'];
+				}
+			}
+			return implode($ret, ", ");
+		}
+	}, $content);
+
+	$_POST['body'] = $content;
+
+	$dropped_post = array(
+		'date' => $date,
+		'board' => $xboard,
+		'msgid' => $msgid,
+		'headers' => $headers,
+		'from_nntp' => true,
+	);
+}
+elseif (isset($_GET['Newsgroups'])) {
+	error("NNTPChan: NNTPChan support is disabled");
+}
+
 if (isset($_POST['delete'])) {
 	// Delete
 	
@@ -178,8 +332,8 @@ if (isset($_POST['delete'])) {
 		header('Content-Type: text/json');
 		echo json_encode(array('success' => true));
 	}
-} elseif (isset($_POST['post'])) {
-	if (!isset($_POST['body'], $_POST['board']))
+} elseif (isset($_POST['post']) || $dropped_post) {
+	if (!isset($_POST['body'], $_POST['board']) && !$dropped_post)
 		error($config['error']['bot']);
 
 	$post = array('board' => $_POST['board'], 'files' => array());
@@ -206,61 +360,67 @@ if (isset($_POST['delete'])) {
 	} else
 		$post['op'] = true;
 
-	// Check for CAPTCHA right after opening the board so the "return" link is in there
-	if ($config['recaptcha']) {
-		if (!isset($_POST['recaptcha_challenge_field']) || !isset($_POST['recaptcha_response_field']))
-			error($config['error']['bot']);
-		// Check what reCAPTCHA has to say...
-		$resp = recaptcha_check_answer($config['recaptcha_private'],
-			$_SERVER['REMOTE_ADDR'],
-			$_POST['recaptcha_challenge_field'],
-			$_POST['recaptcha_response_field']);
-		if (!$resp->is_valid) {
-			error($config['error']['captcha']);
+
+	if (!$dropped_post) {
+		// Check for CAPTCHA right after opening the board so the "return" link is in there
+		if ($config['recaptcha']) {
+			if (!isset($_POST['recaptcha_challenge_field']) || !isset($_POST['recaptcha_response_field']))
+				error($config['error']['bot']);	
+				// Check what reCAPTCHA has to say...
+				$resp = recaptcha_check_answer($config['recaptcha_private'],
+				$_SERVER['REMOTE_ADDR'],
+				$_POST['recaptcha_challenge_field'],
+				$_POST['recaptcha_response_field']);
+			if (!$resp->is_valid) {
+				error($config['error']['captcha']);
+			}
 		}
-	}
 
-	if (!(($post['op'] && $_POST['post'] == $config['button_newtopic']) ||
-		(!$post['op'] && $_POST['post'] == $config['button_reply'])))
-		error($config['error']['bot']);
+		if (!(($post['op'] && $_POST['post'] == $config['button_newtopic']) ||
+			(!$post['op'] && $_POST['post'] == $config['button_reply'])))
+			error($config['error']['bot']);
 	
-	// Check the referrer
-	if ($config['referer_match'] !== false &&
-		(!isset($_SERVER['HTTP_REFERER']) || !preg_match($config['referer_match'], rawurldecode($_SERVER['HTTP_REFERER']))))
-		error($config['error']['referer']);
+		// Check the referrer
+		if ($config['referer_match'] !== false &&
+			(!isset($_SERVER['HTTP_REFERER']) || !preg_match($config['referer_match'], rawurldecode($_SERVER['HTTP_REFERER']))))
+			error($config['error']['referer']);
 	
-	checkDNSBL();
+		checkDNSBL();
 		
-	// Check if banned
-	checkBan($board['uri']);
+		// Check if banned
+		checkBan($board['uri']);
 
-	if ($post['mod'] = isset($_POST['mod']) && $_POST['mod']) {
-		check_login(false);
-		if (!$mod) {
-			// Liar. You're not a mod.
-			error($config['error']['notamod']);
-		}
+		if ($post['mod'] = isset($_POST['mod']) && $_POST['mod']) {
+			check_login(false);
+			if (!$mod) {
+				// Liar. You're not a mod.
+				error($config['error']['notamod']);
+			}
 		
-		$post['sticky'] = $post['op'] && isset($_POST['sticky']);
-		$post['locked'] = $post['op'] && isset($_POST['lock']);
-		$post['raw'] = isset($_POST['raw']);
+			$post['sticky'] = $post['op'] && isset($_POST['sticky']);
+			$post['locked'] = $post['op'] && isset($_POST['lock']);
+			$post['raw'] = isset($_POST['raw']);
 		
-		if ($post['sticky'] && !hasPermission($config['mod']['sticky'], $board['uri']))
-			error($config['error']['noaccess']);
-		if ($post['locked'] && !hasPermission($config['mod']['lock'], $board['uri']))
-			error($config['error']['noaccess']);
-		if ($post['raw'] && !hasPermission($config['mod']['rawhtml'], $board['uri']))
-			error($config['error']['noaccess']);
-	}
+			if ($post['sticky'] && !hasPermission($config['mod']['sticky'], $board['uri']))
+				error($config['error']['noaccess']);
+			if ($post['locked'] && !hasPermission($config['mod']['lock'], $board['uri']))
+				error($config['error']['noaccess']);
+			if ($post['raw'] && !hasPermission($config['mod']['rawhtml'], $board['uri']))
+				error($config['error']['noaccess']);
+		}
+		
+		if (!$post['mod']) {
+			$post['antispam_hash'] = checkSpam(array($board['uri'], isset($post['thread']) ? $post['thread'] : ($config['try_smarter'] && isset($_POST['page']) ? 0 - (int)$_POST['page'] : null)));
+			if ($post['antispam_hash'] === true)
+				error($config['error']['spam']);
+		}
 	
-	if (!$post['mod']) {
-		$post['antispam_hash'] = checkSpam(array($board['uri'], isset($post['thread']) ? $post['thread'] : ($config['try_smarter'] && isset($_POST['page']) ? 0 - (int)$_POST['page'] : null)));
-		if ($post['antispam_hash'] === true)
-			error($config['error']['spam']);
+		if ($config['robot_enable'] && $config['robot_mute']) {
+			checkMute();
+		}
 	}
-	
-	if ($config['robot_enable'] && $config['robot_mute']) {
-		checkMute();
+	else {
+		$mod = $post['mod'] = false;
 	}
 	
 	//Check if thread exists
@@ -371,28 +531,36 @@ if (isset($_POST['delete'])) {
 	$post['email'] = str_replace(' ', '%20', htmlspecialchars($_POST['email']));
 	$post['body'] = $_POST['body'];
 	$post['password'] = $_POST['password'];
-	$post['has_file'] = (!isset($post['embed']) && (($post['op'] && !isset($post['no_longer_require_an_image_for_op']) && $config['force_image_op']) || !empty($_FILES['file']['name'])));
+	$post['has_file'] = (!isset($post['embed']) && (($post['op'] && !isset($post['no_longer_require_an_image_for_op']) && $config['force_image_op']) || count($_FILES) > 0));
 	
-	if (!($post['has_file'] || isset($post['embed'])) || (($post['op'] && $config['force_body_op']) || (!$post['op'] && $config['force_body']))) {
-		$stripped_whitespace = preg_replace('/[\s]/u', '', $post['body']);
-		if ($stripped_whitespace == '') {
-			error($config['error']['tooshort_body']);
+	if (!$dropped_post) {
+
+		if (!($post['has_file'] || isset($post['embed'])) || (($post['op'] && $config['force_body_op']) || (!$post['op'] && $config['force_body']))) {
+			$stripped_whitespace = preg_replace('/[\s]/u', '', $post['body']);
+			if ($stripped_whitespace == '') {
+				error($config['error']['tooshort_body']);
+			}
 		}
-	}
 	
-	if (!$post['op']) {
-		// Check if thread is locked
-		// but allow mods to post
-		if ($thread['locked'] && !hasPermission($config['mod']['postinlocked'], $board['uri']))
-			error($config['error']['locked']);
+		if (!$post['op']) {
+			// Check if thread is locked
+			// but allow mods to post
+			if ($thread['locked'] && !hasPermission($config['mod']['postinlocked'], $board['uri']))
+				error($config['error']['locked']);
 		
-		$numposts = numPosts($post['thread']);
+			$numposts = numPosts($post['thread']);
 		
-		if ($config['reply_hard_limit'] != 0 && $config['reply_hard_limit'] <= $numposts['replies'])
-			error($config['error']['reply_hard_limit']);
+			if ($config['reply_hard_limit'] != 0 && $config['reply_hard_limit'] <= $numposts['replies'])
+				error($config['error']['reply_hard_limit']);
 		
-		if ($post['has_file'] && $config['image_hard_limit'] != 0 && $config['image_hard_limit'] <= $numposts['images'])
-			error($config['error']['image_hard_limit']);
+			if ($post['has_file'] && $config['image_hard_limit'] != 0 && $config['image_hard_limit'] <= $numposts['images'])
+				error($config['error']['image_hard_limit']);
+		}
+	}
+	else {
+		if (!$post['op']) {
+                        $numposts = numPosts($post['thread']);
+		}
 	}
 		
 	if ($post['has_file']) {
@@ -442,7 +610,7 @@ if (isset($_POST['delete'])) {
 	
 	$trip = generate_tripcode($post['name']);
 	$post['name'] = $trip[0];
-	$post['trip'] = isset($trip[1]) ? $trip[1] : '';
+	$post['trip'] = isset($trip[1]) ? $trip[1] : ''; // XX: Dropped posts and tripcodes
 	
 	$noko = false;
 	if (strtolower($post['email']) == 'noko') {
@@ -477,15 +645,17 @@ if (isset($_POST['delete'])) {
 
 	if (empty($post['files'])) $post['has_file'] = false;
 
-	// Check for a file
-	if ($post['op'] && !isset($post['no_longer_require_an_image_for_op'])) {
-		if (!$post['has_file'] && $config['force_image_op'])
-			error($config['error']['noimage']);
-	}
+	if (!$dropped_post) {
+		// Check for a file
+		if ($post['op'] && !isset($post['no_longer_require_an_image_for_op'])) {
+			if (!$post['has_file'] && $config['force_image_op'])
+				error($config['error']['noimage']);
+		}
 
-	// Check for too many files
-	if (sizeof($post['files']) > $config['max_images'])
-		error($config['error']['toomanyimages']);
+		// Check for too many files
+		if (sizeof($post['files']) > $config['max_images'])
+			error($config['error']['toomanyimages']);
+	}
 
 	if ($config['strip_combining_chars']) {
 		$post['name'] = strip_combining_chars($post['name']);
@@ -494,18 +664,19 @@ if (isset($_POST['delete'])) {
 		$post['body'] = strip_combining_chars($post['body']);
 	}
 	
-	// Check string lengths
-	if (mb_strlen($post['name']) > 35)
-		error(sprintf($config['error']['toolong'], 'name'));	
-	if (mb_strlen($post['email']) > 40)
-		error(sprintf($config['error']['toolong'], 'email'));
-	if (mb_strlen($post['subject']) > 100)
-		error(sprintf($config['error']['toolong'], 'subject'));
-	if (!$mod && mb_strlen($post['body']) > $config['max_body'])
-		error($config['error']['toolong_body']);
-	if (mb_strlen($post['password']) > 20)
-		error(sprintf($config['error']['toolong'], 'password'));
-		
+	if (!$dropped_post) {
+		// Check string lengths
+		if (mb_strlen($post['name']) > 35)
+			error(sprintf($config['error']['toolong'], 'name'));	
+		if (mb_strlen($post['email']) > 40)
+			error(sprintf($config['error']['toolong'], 'email'));
+		if (mb_strlen($post['subject']) > 100)
+			error(sprintf($config['error']['toolong'], 'subject'));
+		if (!$mod && mb_strlen($post['body']) > $config['max_body'])
+			error($config['error']['toolong_body']);
+		if (mb_strlen($post['password']) > 20)
+			error(sprintf($config['error']['toolong'], 'password'));
+	}
 	wordfilters($post['body']);
 	
 	$post['body'] = escape_markup_modifiers($post['body']);
@@ -514,6 +685,7 @@ if (isset($_POST['delete'])) {
 		$post['body'] .= "\n<tinyboard raw html>1</tinyboard>";
 	}
 	
+	if (!$dropped_post)
 	if (($config['country_flags'] && !$config['allow_no_country']) || ($config['country_flags'] && $config['allow_no_country'] && !isset($_POST['no_country']))) {
 		require 'inc/lib/geoip/geoip.inc';
 		$gi=geoip\geoip_open('inc/lib/geoip/GeoIPv6.dat', GEOIP_STANDARD);
@@ -555,6 +727,7 @@ if (isset($_POST['delete'])) {
 		$post['body'] .= "\n<tinyboard tag>" . $_POST['tag'] . "</tinyboard>";
 	}
 
+	if (!$dropped_post)
         if ($config['proxy_save'] && isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
 		$proxy = preg_replace("/[^0-9a-fA-F.,: ]/", '', $_SERVER['HTTP_X_FORWARDED_FOR']);
 		$post['body'] .= "\n<tinyboard proxy>".$proxy."</tinyboard>";
@@ -627,7 +800,7 @@ if (isset($_POST['delete'])) {
 		}
 	}
 
-	if (!hasPermission($config['mod']['bypass_filters'], $board['uri'])) {
+	if (!hasPermission($config['mod']['bypass_filters'], $board['uri']) && !$dropped_post) {
 		require_once 'inc/filters.php';
 
 		do_filters($post);
@@ -830,11 +1003,11 @@ if (isset($_POST['delete'])) {
 		}
 	
 	// Do filters again if OCRing
-	if ($config['tesseract_ocr'] && !hasPermission($config['mod']['bypass_filters'], $board['uri'])) {
+	if ($config['tesseract_ocr'] && !hasPermission($config['mod']['bypass_filters'], $board['uri']) && !$dropped_post) {
 		do_filters($post);
 	}
 
-	if (!hasPermission($config['mod']['postunoriginal'], $board['uri']) && $config['robot_enable'] && checkRobot($post['body_nomarkup'])) {
+	if (!hasPermission($config['mod']['postunoriginal'], $board['uri']) && $config['robot_enable'] && checkRobot($post['body_nomarkup']) && !$dropped_post) {
 		undoImage($post);
 		if ($config['robot_mute']) {
 			error(sprintf($config['error']['muted'], mute()));
@@ -873,6 +1046,18 @@ if (isset($_POST['delete'])) {
 	$post['id'] = $id = post($post);
 	$post['slug'] = slugify($post);
 	
+
+	if ($dropped_post && $dropped_post['from_nntp']) {
+	        $query = prepare("INSERT INTO ``nntp_references`` (`board`, `id`, `message_id`, `message_id_digest`, `own`, `headers`) VALUES ".
+	                                                         "(:board , :id , :message_id , :message_id_digest , false, :headers)");
+
+		$query->bindValue(':board', $dropped_post['board']);
+		$query->bindValue(':id', $id);
+		$query->bindValue(':message_id', $dropped_post['msgid']);
+		$query->bindValue(':message_id_digest', sha1($dropped_post['msgid']));
+		$query->bindValue(':headers', $dropped_post['headers']);
+		$query->execute() or error(db_error($query));
+	}
 	insertFloodPost($post);
 
 	// Handle cyclical threads
-- 
cgit v1.3


From a779b96370d3353c8409d64b70c724fa783ad219 Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Mon, 15 Aug 2016 00:56:06 +0200
Subject: second iteration of nntpchan implementation

---
 inc/config.php            |  24 +++++++-
 inc/nntpchan/nntpchan.php | 149 ++++++++++++++++++++++++++++++++++++++++++++++
 inc/nntpchan/tests.php    |  30 ++++++++++
 post.php                  |  29 +++++++++
 4 files changed, 231 insertions(+), 1 deletion(-)
 create mode 100644 inc/nntpchan/nntpchan.php
 create mode 100644 inc/nntpchan/tests.php

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index a8afdf7a..bfb774a8 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1693,6 +1693,11 @@
  * ==================
  *  NNTPChan settings
  * ==================
+ */
+
+/*
+ * Please keep in mind that NNTPChan support in vichan isn't finished yet / is in an experimental
+ * state. Please join #nntpchan on Rizon in order to peer with someone.
  */
 
 	$config['nntpchan'] = array();
@@ -1703,9 +1708,26 @@
 	// NNTP server
 	$config['nntpchan']['server'] = "localhost:1119";
 
-	// Global dispatch array. Add your boards to it to enable them.
+	// Global dispatch array. Add your boards to it to enable them. Please make
+	// sure that this setting is set in a global context.
 	$config['nntpchan']['dispatch'] = array(); // 'overchan.test' => 'test'
 
+	// Trusted peer - an IP address of your NNTPChan instance. This peer will have
+	// increased capabilities, eg.: will evade spamfilter.
+	$config['nntpchan']['trusted_peer'] = '127.0.0.1';
+
+	// Salt for message ID generation. Keep it long and secure.
+	$config['nntpchan']['salt'] = 'change_me+please';
+
+	// A local message ID domain. Make sure to change it.
+	$config['nntpchan']['domain'] = 'example.vichan.net';
+
+	// An NNTPChan group name.
+	// Please set this setting in your board/config.php, not globally.
+	$config['nntpchan']['group'] = false; // eg. 'overchan.test'
+
+
+
 /*
  * ====================
  *  Other/uncategorized
diff --git a/inc/nntpchan/nntpchan.php b/inc/nntpchan/nntpchan.php
new file mode 100644
index 00000000..25215e94
--- /dev/null
+++ b/inc/nntpchan/nntpchan.php
@@ -0,0 +1,149 @@
+<?php
+/*
+ *  Copyright (c) 2016 vichan-devel
+ */
+
+defined('TINYBOARD') or exit;
+
+function gen_msgid($board, $id) {
+	global $config;
+
+	$b = preg_replace("/[^0-9a-zA-Z$]/", 'x', $board);
+	$salt = sha1($board . "|" . $id . "|" . $config['nntpchan']['salt']);
+	$salt = substr($salt, 0, 7);
+	$salt = base_convert($salt, 16, 36);
+
+	return "<$b.$id.$salt@".$config['nntpchan']['domain'].">";
+}
+
+
+function gen_nntp($headers, $files) {
+	if (count($files) == 0) {
+	}
+	else if (count($files) == 1 && $files[0]['type'] == 'text/plain') {
+		$content = $files[0]['text'] . "\r\n";
+		$headers['Content-Type'] = "text/plain; charset=UTF-8";
+	}
+	else {
+		$boundary = sha1($headers['Message-Id']);
+		$content = "";
+		$headers['Content-Type'] = "multipart/mixed; boundary=$boundary";
+		foreach ($files as $file) {
+			$content .= "--$boundary\r\n";
+			if (isset($file['name'])) {
+				$file['name'] = preg_replace('/[\r\n\0"]/', '', $file['name']);
+				$content .= "Content-Disposition: form-data; filename=\"$file[name]\"; name=\"attachment\"\r\n";
+			}
+			$type = explode('/', $file['type'])[0];
+			if ($type == 'text') {
+				$file['type'] .= '; charset=UTF-8';
+			}
+			$content .= "Content-Type: $file[type]\r\n";
+			if ($type != 'text' && $type != 'message') {
+				$file['text'] = base64_encode($file['text']);
+				$content .= "Content-Transfer-Encoding: base64\r\n";
+			}
+			$content .= "\r\n";
+			$content .= $file['text'];
+			$content .= "\r\n";
+		}
+		$content .= "--$boundary--\r\n";
+
+		$headers['Mime-Version'] = '1.0';
+	}
+	//$headers['Content-Length'] = strlen($content);
+	$headers['Date'] = date('r', $headers['Date']);
+	$out = "";
+	foreach ($headers as $id => $val) {
+		$val = str_replace("\n", "\n\t", $val);
+		$out .= "$id: $val\r\n";
+	}
+	$out .= "\r\n";
+	$out .= $content;
+	return $out;
+}
+
+function nntp_publish($msg, $id) {
+	$s = fsockopen("tcp://localhost:1119");
+	fgets($s);
+	fputs($s, "MODE STREAM\r\n");
+	fgets($s);
+	fputs($s, "TAKETHIS $id\r\n");
+	fputs($s, $msg);
+	fputs($s, "\r\n.\r\n");
+	fgets($s);
+	fclose($s);
+}
+
+function post2nntp($post, $msgid) {
+	global $config;
+
+	$headers = array();
+	$files = array();
+
+	$headers['Message-Id'] = $msgid;
+	$headers['Newsgroups'] = $config['nntpchan']['group'];
+	$headers['Date'] = time();
+	$headers['Subject'] = $post['subject'] ? $post['subject'] : "None";
+	$headers['From'] = $post['name'] . " <poster@" . $config['nntpchan']['domain'] . ">";
+
+	if ($post['email'] == 'sage') {
+		$headers['X-Sage'] = true;
+	}
+
+	if (!$post['op']) {
+		// Get muh parent
+		$query = prepare("SELECT `message_id` FROM ``nntp_references`` WHERE `board` = :board AND `id` = :id");
+		$query->bindValue(':board', $post['board']);
+		$query->bindValue(':id', $post['thread']);
+		$query->execute() or error(db_error($query));
+
+		if ($result = $query->fetch(PDO::FETCH_ASSOC)) {
+			$headers['References'] = $result['message_id'];
+		}
+		else {
+			return false; // We don't have OP. Discarding.
+		}
+        }
+
+	// Let's parse the body a bit.
+	$body = trim($post['body_nomarkup']);
+	$body = preg_replace('/\r?\n/', "\r\n", $body);
+	$body = preg_replace_callback('@>>(>/([a-zA-Z0-9_+-]+)/)?([0-9]+)@', function($o) use ($post) {
+		if ($o[1]) {
+			$board = $o[2];
+		}
+		else {
+			$board = $post['board'];
+		}
+		$id = $o[3];
+
+		$query = prepare("SELECT `message_id_digest` FROM ``nntp_references`` WHERE `board` = :board AND `id` = :id");
+                $query->bindValue(':board', $board);
+                $query->bindValue(':id', $id);
+                $query->execute() or error(db_error($query));
+
+                if ($result = $query->fetch(PDO::FETCH_ASSOC)) {
+			return ">>".substr($result['message_id_digest'], 0, 16);
+		}
+		else {
+			return $o[0]; // Should send URL imo
+		}
+	}, $body);
+	$body = preg_replace('/>>>>([0-9a-fA-F])+/', '>>\1', $body);
+
+
+	$files[] = array('type' => 'text/plain', 'text' => $body);
+
+	foreach ($post['files'] as $id => $file) {
+		$fc = array();
+
+		$fc['type'] = $file['type'];
+		$fc['text'] = file_get_contents($file['file_path']);
+		$fc['name'] = $file['name'];
+
+		$files[] = $fc;
+	}
+
+	return array($headers, $files);
+}
diff --git a/inc/nntpchan/tests.php b/inc/nntpchan/tests.php
new file mode 100644
index 00000000..a63789d7
--- /dev/null
+++ b/inc/nntpchan/tests.php
@@ -0,0 +1,30 @@
+<?php
+define('TINYBOARD', 'fuck yeah');
+require_once('nntpchan.php');
+
+
+die();
+
+$time = time();
+echo "\n@@@@ Thread:\n";
+echo $m0 = gennntp(["From" => "czaks <marcin@6irc.net>", "Message-Id" => "<1234.0000.".$time."@example.vichan.net>", "Newsgroups" => "overchan.test", "Date" => time(), "Subject" => "None"],
+[['type' => 'text/plain', 'text' => "THIS IS A NEW TEST THREAD"]]);
+echo "\n@@@@ Single msg:\n";
+echo $m1 = gennntp(["From" => "czaks <marcin@6irc.net>", "Message-Id" => "<1234.1234.".$time."@example.vichan.net>", "Newsgroups" => "overchan.test", "Date" => time(), "Subject" => "None", "References" => "<1234.0000.".$time."@example.vichan.net>"],
+[['type' => 'text/plain', 'text' => "hello world, with no image :("]]);
+echo "\n@@@@ Single msg and pseudoimage:\n";
+echo $m2 = gennntp(["From" => "czaks <marcin@6irc.net>", "Message-Id" => "<1234.2137.".$time."@example.vichan.net>", "Newsgroups" => "overchan.test", "Date" => time(), "Subject" => "None", "References" => "<1234.0000.".$time."@example.vichan.net>"],
+[['type' => 'text/plain', 'text' => "hello world, now with an image!"],
+ ['type' => 'image/gif', 'text' => base64_decode("R0lGODlhAQABAIAAAAUEBAAAACwAAAAAAQABAAACAkQBADs="), 'name' => "urgif.gif"]]);
+echo "\n@@@@ Single msg and two pseudoimages:\n";
+echo $m3 = gennntp(["From" => "czaks <marcin@6irc.net>", "Message-Id" => "<1234.1488.".$time."@example.vichan.net>", "Newsgroups" => "overchan.test", "Date" => time(), "Subject" => "None", "References" => "<1234.0000.".$time."@example.vichan.net>"],
+[['type' => 'text/plain', 'text' => "hello world, now WITH TWO IMAGES!!!"],
+ ['type' => 'image/gif', 'text' => base64_decode("R0lGODlhAQABAIAAAAUEBAAAACwAAAAAAQABAAACAkQBADs="), 'name' => "urgif.gif"],
+ ['type' => 'image/gif', 'text' => base64_decode("R0lGODlhAQABAIAAAAUEBAAAACwAAAAAAQABAAACAkQBADs="), 'name' => "urgif2.gif"]]);
+shoveitup($m0, "<1234.0000.".$time."@example.vichan.net>");
+sleep(1);
+shoveitup($m1, "<1234.1234.".$time."@example.vichan.net>");
+sleep(1);
+shoveitup($m2, "<1234.2137.".$time."@example.vichan.net>");
+shoveitup($m3, "<1234.1488.".$time."@example.vichan.net>");
+
diff --git a/post.php b/post.php
index 4590a534..1e4edcee 100644
--- a/post.php
+++ b/post.php
@@ -13,7 +13,12 @@ if ((!isset($_POST['mod']) || !$_POST['mod']) && $config['board_locked']) {
 
 $dropped_post = false;
 
+// Is it a post coming from NNTP? Let's extract it and pretend it's a normal post.
 if (isset($_GET['Newsgroups']) && $config['nntpchan']['enabled']) {
+	if ($_SERVER['REMOTE_ADDR'] != $config['nntpchan']['trusted_peer']) {
+		error("NNTPChan: Forbidden. $_SERVER[REMOTE_ADDR] is not a trusted peer");
+	}
+
 	$_POST = array();
 	$_POST['json_response'] = true;
 
@@ -1057,7 +1062,31 @@ if (isset($_POST['delete'])) {
 		$query->bindValue(':message_id_digest', sha1($dropped_post['msgid']));
 		$query->bindValue(':headers', $dropped_post['headers']);
 		$query->execute() or error(db_error($query));
+	}	// ^^^^^ For inbound posts  ^^^^^
+	elseif ($config['nntpchan']['enabled'] && $config['nntpchan']['group']) {
+		// vvvvv For outbound posts vvvvv
+
+		require_once('inc/nntpchan/nntpchan.php');
+		$msgid = gen_msgid($post['board'], $post['id']);
+
+		list($headers, $files) = post2nntp($post, $msgid);
+
+		$message = gen_nntp($headers, $files);
+
+	        $query = prepare("INSERT INTO ``nntp_references`` (`board`, `id`, `message_id`, `message_id_digest`, `own`, `headers`) VALUES ".
+	                                                         "(:board , :id , :message_id , :message_id_digest , true , :headers)");
+
+		$query->bindValue(':board', $post['board']);
+                $query->bindValue(':id', $post['id']);
+                $query->bindValue(':message_id', $msgid);
+                $query->bindValue(':message_id_digest', sha1($msgid));
+                $query->bindValue(':headers', json_encode($headers));
+                $query->execute() or error(db_error($query));
+
+		// Let's broadcast it!
+		nntp_publish($message, $msgid);
 	}
+
 	insertFloodPost($post);
 
 	// Handle cyclical threads
-- 
cgit v1.3


From a5e7b3da6f8ee764ab831d3c1b2df6c17a5e78ca Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Fri, 19 Aug 2016 23:15:08 +0200
Subject: nntpchan: work around php nonsense

---
 inc/nntpchan/nntpchan.php |  2 +-
 post.php                  | 29 +++++++++++++++++------------
 2 files changed, 18 insertions(+), 13 deletions(-)

(limited to 'post.php')

diff --git a/inc/nntpchan/nntpchan.php b/inc/nntpchan/nntpchan.php
index 25215e94..8a2fba44 100644
--- a/inc/nntpchan/nntpchan.php
+++ b/inc/nntpchan/nntpchan.php
@@ -124,7 +124,7 @@ function post2nntp($post, $msgid) {
                 $query->execute() or error(db_error($query));
 
                 if ($result = $query->fetch(PDO::FETCH_ASSOC)) {
-			return ">>".substr($result['message_id_digest'], 0, 16);
+			return ">>".substr($result['message_id_digest'], 0, 18);
 		}
 		else {
 			return $o[0]; // Should send URL imo
diff --git a/post.php b/post.php
index 1e4edcee..47c5f0ef 100644
--- a/post.php
+++ b/post.php
@@ -90,31 +90,36 @@ if (isset($_GET['Newsgroups']) && $config['nntpchan']['enabled']) {
 		$content = file_get_contents("php://input");
 	}
 	elseif ($ct == 'multipart/mixed' || $ct == 'multipart/form-data') {
-		_syslog(LOG_INFO, "MM: Files: ".print_r($GLOBALS, true));
+		_syslog(LOG_INFO, "MM: Files: ".print_r($GLOBALS, true)); // Debug
+
 		$content = '';
 
-		$tmpfiles = $_FILES['attachment'];
-		foreach ($tmpfiles as $id => $file) {
-			if ($file['type'] == 'text/plain') {
-				$content .= file_get_contents($file['tmp_name']);
-				unset($_FILES['attachment'][$id]);
+		$newfiles = array();
+		foreach ($_FILES['attachment']['error'] as $id => $error) {
+			if ($_FILES['attachment']['type'][$id] == 'text/plain') {
+				$content .= file_get_contents($_FILES['attachment']['tmp_name'][$id]);
 			}
-			elseif ($file['type'] == 'message/rfc822') { // Signed message, ignore for now
-				unset($_FILES['attachment'][$id]);
+			elseif ($_FILES['attachment']['type'][$id] == 'message/rfc822') { // Signed message, ignore for now
 			}
 			else { // A real attachment :^)
+				$file = array();
+				$file['name']     = $_FILES['attachment']['name'][$id];
+				$file['type']     = $_FILES['attachment']['type'][$id];
+				$file['size']     = $_FILES['attachment']['size'][$id];
+				$file['tmp_name'] = $_FILES['attachment']['tmp_name'][$id];
+				$file['error']    = $_FILES['attachment']['error'][$id];
+
+				$newfiles["file$id"] = $file;
 			}
 		}
 
-		$_FILES = $_FILES['attachment'];
-
-
+		$_FILES = $newfiles;
 	}
 	else {
 		error("NNTPChan: Wrong mime type: $ct");
 	}
 
-	$_POST['subject'] = isset($_GET['Subject']) ? $_GET['Subject'] : '';
+	$_POST['subject'] = isset($_GET['Subject']) ? ($_GET['Subject'] == 'None' ? '' : $_GET['Subject']) : '';
 	$_POST['board'] = $xboard;
 
 	if (isset ($_GET['From'])) {
-- 
cgit v1.3


From d09953da0750347f965dcdebd7a769fed98945ee Mon Sep 17 00:00:00 2001
From: Benjamin Southall <applemansigloo@gmail.com>
Date: Fri, 23 Sep 2016 22:44:48 +0900
Subject: ReportNotifier Slack notification support

---
 inc/config.php |  6 ++++++
 post.php       | 38 +++++++++++++++++++++++++++++++++++---
 2 files changed, 41 insertions(+), 3 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index 69b4bd3a..86ddd5aa 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1669,3 +1669,9 @@
 		'<a href="https://youtu.be/$2" target="_blank" class="file">'.
 		'<img style="width:360px;height:270px;" src="//img.youtube.com/vi/$2/0.jpg" class="post-image"/>'.
 		'</a></div>';
+
+        // Slack Report Notification
+        $config['slack'] = true;
+        $config['slack_channel'] = "reports";
+        $config['slack_incoming_webhook_endpoint'] = "https://hooks.slack.com/services/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";
+
diff --git a/post.php b/post.php
index 99ef4850..f2ed509f 100644
--- a/post.php
+++ b/post.php
@@ -141,15 +141,15 @@ if (isset($_POST['delete'])) {
 	markup($reason);
 	
 	foreach ($report as &$id) {
-		$query = prepare(sprintf("SELECT `thread` FROM ``posts_%s`` WHERE `id` = :id", $board['uri']));
+		$query = prepare(sprintf("SELECT `thread` , `body_nomarkup` FROM ``posts_%s`` WHERE `id` = :id", $board['uri']));
 		$query->bindValue(':id', $id, PDO::PARAM_INT);
 		$query->execute() or error(db_error($query));
 		
-		$thread = $query->fetchColumn();
+		$thread = $query->fetch(PDO::FETCH_ASSOC);
 		
 		if ($config['syslog'])
 			_syslog(LOG_INFO, 'Reported post: ' .
-				'/' . $board['dir'] . $config['dir']['res'] . link_for($post) . ($thread ? '#' . $id : '') .
+				'/' . $board['dir'] . $config['dir']['res'] . link_for($post) . ($thread['thread'] ? '#' . $id : '') .
 				' for "' . $reason . '"'
 			);
 		$query = prepare("INSERT INTO ``reports`` VALUES (NULL, :time, :ip, :board, :post, :reason)");
@@ -159,6 +159,38 @@ if (isset($_POST['delete'])) {
 		$query->bindValue(':post', $id, PDO::PARAM_INT);
 		$query->bindValue(':reason', $reason, PDO::PARAM_STR);
 		$query->execute() or error(db_error($query));
+                if ($config['slack'])
+                {
+                function slack($message, $room = "reports", $icon = ":no_entry_sign:") 
+			{
+			$room = ($room) ? $room : "reports";
+			$data = "payload=" . json_encode(array(
+			"channel"       =>  "#{$room}",
+			"text"          =>  urlencode($message),
+			"icon_emoji"    =>  $icon
+			));
+
+			// You can get your webhook endpoint from your Slack settings
+			// For some reason using the configuration key doesn't work 
+			//$ch = curl_init($config['slack_incoming_webhook_endpoint']);
+			$ch = curl_init("https://hooks.slack.com/services/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");
+			curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
+			curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
+			curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
+			curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+			$result = curl_exec($ch);
+			curl_close($ch);
+
+			return $result;
+			}
+		
+		$postcontent = mb_substr($thread['body_nomarkup'], 0, 120) . '...  _*(POST TRIMMED)*_';
+		$slackmessage = 'Post: <'  .$config['domain']  . "/mod.php?/" . $board['dir'] . $config['dir']['res'] .  ( $thread['thread'] ? $thread['thread'] : $id ) . ".html"  .  ($thread['thread'] ? '#' . $id : '') . '> \n Post Content: ' . $postcontent  . '\n Reason: ' . $reason . '\n';
+
+		$slackresult = slack($slackmessage, $config['slack_channel']); 
+		}
+
+
 	}
 	
 	$is_mod = isset($_POST['mod']) && $_POST['mod'];
-- 
cgit v1.3


From 59cc269cd70147a738318cc50da0b9d4691b6ce3 Mon Sep 17 00:00:00 2001
From: Benjamin Southall <applemansigloo@gmail.com>
Date: Fri, 23 Sep 2016 23:05:04 +0900
Subject: Change ReportNotifier SlackMessage format

---
 post.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index f2ed509f..045bec45 100644
--- a/post.php
+++ b/post.php
@@ -185,7 +185,7 @@ if (isset($_POST['delete'])) {
 			}
 		
 		$postcontent = mb_substr($thread['body_nomarkup'], 0, 120) . '...  _*(POST TRIMMED)*_';
-		$slackmessage = 'Post: <'  .$config['domain']  . "/mod.php?/" . $board['dir'] . $config['dir']['res'] .  ( $thread['thread'] ? $thread['thread'] : $id ) . ".html"  .  ($thread['thread'] ? '#' . $id : '') . '> \n Post Content: ' . $postcontent  . '\n Reason: ' . $reason . '\n';
+		$slackmessage = ' <'  .$config['domain']  . "/mod.php?/" . $board['dir'] . $config['dir']['res'] .  ( $thread['thread'] ? $thread['thread'] : $id ) . ".html"  .  ($thread['thread'] ? '#' . $id : '') . '>  \n ' . $reason. '\n ' . $postcontent . '\n';
 
 		$slackresult = slack($slackmessage, $config['slack_channel']); 
 		}
-- 
cgit v1.3


From 5af60d1e3324cf4c5d12a39b130de6343ed53382 Mon Sep 17 00:00:00 2001
From: Benjamin Southall <applemansigloo@gmail.com>
Date: Sat, 24 Sep 2016 12:52:08 +0900
Subject: Remove leading space from ReportNotifier Slack Message

---
 post.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 045bec45..718b2833 100644
--- a/post.php
+++ b/post.php
@@ -185,7 +185,7 @@ if (isset($_POST['delete'])) {
 			}
 		
 		$postcontent = mb_substr($thread['body_nomarkup'], 0, 120) . '...  _*(POST TRIMMED)*_';
-		$slackmessage = ' <'  .$config['domain']  . "/mod.php?/" . $board['dir'] . $config['dir']['res'] .  ( $thread['thread'] ? $thread['thread'] : $id ) . ".html"  .  ($thread['thread'] ? '#' . $id : '') . '>  \n ' . $reason. '\n ' . $postcontent . '\n';
+		$slackmessage = '<'  .$config['domain']  . "/mod.php?/" . $board['dir'] . $config['dir']['res'] .  ( $thread['thread'] ? $thread['thread'] : $id ) . ".html"  .  ($thread['thread'] ? '#' . $id : '') . '> \n ' . $reason . '\n ' . $postcontent . '\n';
 
 		$slackresult = slack($slackmessage, $config['slack_channel']); 
 		}
-- 
cgit v1.3


From ea9da7da611509fbe9c5f23867414242a443e3a8 Mon Sep 17 00:00:00 2001
From: Benjamin Southall <applemansigloo@gmail.com>
Date: Sun, 2 Oct 2016 01:15:34 +0900
Subject: Make slack report notifier, donate page, irc page and radio page use
 configuration variables instead of hard coding values.

---
 inc/config.php                      |   6 +-
 post.php                            |  52 +++++------
 stylesheets/progressbar.css         | 159 +++++++++++++++++++++++++++++++++
 templates/themes/donate/donate.html | 173 ++----------------------------------
 templates/themes/donate/info.php    |  33 ++++++-
 templates/themes/irc/info.php       |   7 +-
 templates/themes/irc/irc.html       |   4 +-
 templates/themes/irc/radio.html     |  29 ------
 templates/themes/radio/info.php     |   9 +-
 templates/themes/radio/radio.html   |   2 +-
 10 files changed, 244 insertions(+), 230 deletions(-)
 create mode 100644 stylesheets/progressbar.css
 delete mode 100644 templates/themes/irc/radio.html

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index dc65068f..0f2d40fc 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1811,9 +1811,9 @@
 		'</a></div>';
 
     // Slack Report Notification
-    $config['slack'] = true;
-    $config['slack_channel'] = "reports";
-    $config['slack_incoming_webhook_endpoint'] = "https://hooks.slack.com/services/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";
+    $config['slack'] = false;
+    $config['slack_channel'] = "";
+    $config['slack_incoming_webhook_endpoint'] = "https://hooks.slack.com/services/";
 
 	// Password hashing function
 	//
diff --git a/post.php b/post.php
index 070cbd88..84858bb2 100644
--- a/post.php
+++ b/post.php
@@ -342,36 +342,38 @@ if (isset($_POST['delete'])) {
 		$query->bindValue(':post', $id, PDO::PARAM_INT);
 		$query->bindValue(':reason', $reason, PDO::PARAM_STR);
 		$query->execute() or error(db_error($query));
-                if ($config['slack'])
-                {
-                function slack($message, $room = "reports", $icon = ":no_entry_sign:") 
-			{
-			$room = ($room) ? $room : "reports";
-			$data = "payload=" . json_encode(array(
-			"channel"       =>  "#{$room}",
-			"text"          =>  urlencode($message),
-			"icon_emoji"    =>  $icon
-			));
-
-			// You can get your webhook endpoint from your Slack settings
-			// For some reason using the configuration key doesn't work 
-			//$ch = curl_init($config['slack_incoming_webhook_endpoint']);
-			$ch = curl_init("https://hooks.slack.com/services/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");
-			curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
-			curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
-			curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
-			curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-			$result = curl_exec($ch);
-			curl_close($ch);
-
-			return $result;
-			}
+        
+        if ($config['slack'])
+        {
+            
+        function slack($message, $room = "reports", $icon = ":no_entry_sign:") 
+        {
+        $room = ($room) ? $room : "reports";
+        $data = "payload=" . json_encode(array(
+        "channel"       =>  "#{$room}",
+        "text"          =>  urlencode($message),
+        "icon_emoji"    =>  $icon
+        ));
+
+        // You can get your webhook endpoint from your Slack settings
+        // For some reason using the configuration key doesn't work 
+        $ch = curl_init($config['slack_incoming_webhook_endpoint']);
+        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
+        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
+        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+        $result = curl_exec($ch);
+        curl_close($ch);
+
+        return $result;
+        }
 		
 		$postcontent = mb_substr($thread['body_nomarkup'], 0, 120) . '...  _*(POST TRIMMED)*_';
 		$slackmessage = '<'  .$config['domain']  . "/mod.php?/" . $board['dir'] . $config['dir']['res'] .  ( $thread['thread'] ? $thread['thread'] : $id ) . ".html"  .  ($thread['thread'] ? '#' . $id : '') . '> \n ' . $reason . '\n ' . $postcontent . '\n';
 
 		$slackresult = slack($slackmessage, $config['slack_channel']); 
-		}
+        
+        }
 
 
 	}
diff --git a/stylesheets/progressbar.css b/stylesheets/progressbar.css
new file mode 100644
index 00000000..6083e72e
--- /dev/null
+++ b/stylesheets/progressbar.css
@@ -0,0 +1,159 @@
+	/*---------------------------*/			
+        .container {
+	margin: auto;
+	width : 50%;
+	}    
+        .progress-bar {
+            background-color: #1a1a1a;
+            height: 25px;
+            padding: 5px;
+            width: 350px;
+	    position: relative;
+            margin: 70px 0 20px 0;			
+            -moz-border-radius: 5px;
+			-webkit-border-radius: 5px;
+			border-radius: 5px;
+            -moz-box-shadow: 0 1px 5px #000 inset, 0 1px 0 #444;
+			-webkit-box-shadow: 0 1px 5px #000 inset, 0 1px 0 #444;
+			box-shadow: 0 1px 5px #000 inset, 0 1px 0 #444;           
+        }
+        
+        .progress-bar span {
+            display: inline-block;
+            height: 100%;
+			background-color: #777;
+            -moz-border-radius: 3px;
+			-webkit-border-radius: 3px;
+			border-radius: 3px;
+            -moz-box-shadow: 0 1px 0 rgba(255, 255, 255, .5) inset;
+			-webkit-box-shadow: 0 1px 0 rgba(255, 255, 255, .5) inset;
+			box-shadow: 0 1px 0 rgba(255, 255, 255, .5) inset;
+			-webkit-transition: width .4s ease-in-out;
+			-moz-transition: width .4s ease-in-out;
+			-ms-transition: width .4s ease-in-out;
+			-o-transition: width .4s ease-in-out;
+			transition:   width .4s ease-in-out;		
+        }
+		
+		
+        .blue span {
+            background-color: #34c2e3;   
+        }
+
+        .red span {
+			  background-color: #f42323;
+			  background-image: -webkit-gradient(linear, left top, left bottom, from(#f42323), to(#ff0000));
+			  background-image: -webkit-linear-gradient(top, #f42323, #ff0000);
+			  background-image: -moz-linear-gradient(top, #f42323, #ff0000);
+			  background-image: -ms-linear-gradient(top, #f42323, #ff0000);
+			  background-image: -o-linear-gradient(top, #f42323, #ff0000);
+			  background-image: linear-gradient(top, #f42323, #ff0000);  
+        }	
+
+        .green span {
+			  background-color: #a5df41;
+			  background-image: -webkit-gradient(linear, left top, left bottom, from(#a5df41), to(#4ca916));
+			  background-image: -webkit-linear-gradient(top, #a5df41, #4ca916);
+			  background-image: -moz-linear-gradient(top, #a5df41, #4ca916);
+			  background-image: -ms-linear-gradient(top, #a5df41, #4ca916);
+			  background-image: -o-linear-gradient(top, #a5df41, #4ca916);
+			  background-image: linear-gradient(top, #a5df41, #4ca916);  
+        }		
+		
+		/*---------------------------*/		
+		
+		.stripes span {
+            -webkit-background-size: 30px 30px;
+            -moz-background-size: 30px 30px;
+            background-size: 30px 30px;			
+			background-image: -webkit-gradient(linear, left top, right bottom,
+								color-stop(.25, rgba(255, 255, 255, .15)), color-stop(.25, transparent),
+								color-stop(.5, transparent), color-stop(.5, rgba(255, 255, 255, .15)),
+								color-stop(.75, rgba(255, 255, 255, .15)), color-stop(.75, transparent),
+								to(transparent));
+            background-image: -webkit-linear-gradient(135deg, rgba(255, 255, 255, .15) 25%, transparent 25%,
+                                transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%,
+                                transparent 75%, transparent);
+            background-image: -moz-linear-gradient(135deg, rgba(255, 255, 255, .15) 25%, transparent 25%,
+                                transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%,
+                                transparent 75%, transparent);
+            background-image: -ms-linear-gradient(135deg, rgba(255, 255, 255, .15) 25%, transparent 25%,
+                                transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%,
+                                transparent 75%, transparent);
+            background-image: -o-linear-gradient(135deg, rgba(255, 255, 255, .15) 25%, transparent 25%,
+                                transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%,
+                                transparent 75%, transparent);
+            background-image: linear-gradient(135deg, rgba(255, 255, 255, .15) 25%, transparent 25%,
+                                transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%,
+                                transparent 75%, transparent);            
+            
+            -webkit-animation: animate-stripes 3s linear infinite;
+            -moz-animation: animate-stripes 3s linear infinite;       		
+		}
+        
+	@-webkit-keyframes animate-stripes { 
+			0% {background-position: 0 0;} 100% {background-position: 60px 0;}
+        }
+        
+        
+        @-moz-keyframes animate-stripes {
+			0% {background-position: 0 0;} 100% {background-position: 60px 0;}
+        }
+		
+		/*---------------------------*/	 
+
+		.shine span {
+			position: relative;
+		}
+		
+		.shine span::after {
+			content: '';
+			opacity: 0;
+			position: absolute;
+			top: 0;
+			right: 0;
+			bottom: 0;
+			left: 0;
+			background: #fff;
+            -moz-border-radius: 3px;
+			-webkit-border-radius: 3px;
+			border-radius: 3px;			
+			
+            -webkit-animation: animate-shine 2s ease-out infinite;
+            -moz-animation: animate-shine 2s ease-out infinite; 			
+		}
+
+        @-webkit-keyframes animate-shine { 
+			0% {opacity: 0; width: 0;}
+			50% {opacity: .5;}
+			100% {opacity: 0; width: 95%;}
+        }
+        
+        
+        @-moz-keyframes animate-shine {
+			0% {opacity: 0; width: 0;}
+			50% {opacity: .5;}
+			100% {opacity: 0; width: 95%;}
+        }
+		.glow span {
+            -moz-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;
+			-webkit-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;
+			box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;
+			
+            -webkit-animation: animate-glow 1s ease-out infinite;
+            -moz-animation: animate-glow 1s ease-out infinite; 			
+		}
+
+		@-webkit-keyframes animate-glow {
+		 0% { -webkit-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;} 
+		 50% { -webkit-box-shadow: 0 5px 5px rgba(255, 255, 255, .3) inset, 0 -5px 5px rgba(255, 255, 255, .3) inset;} 
+		 100% { -webkit-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;}
+		 }
+
+		@-moz-keyframes animate-glow {
+		 0% { -moz-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;} 
+		 50% { -moz-box-shadow: 0 5px 5px rgba(255, 255, 255, .3) inset, 0 -5px 5px rgba(255, 255, 255, .3) inset;} 
+		 100% { -moz-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;}
+		 }
+
+
diff --git a/templates/themes/donate/donate.html b/templates/themes/donate/donate.html
index 551eea62..27f16747 100644
--- a/templates/themes/donate/donate.html
+++ b/templates/themes/donate/donate.html
@@ -7,167 +7,8 @@
     <link rel="shortcut icon" href="/favicon.png">
     <link rel="stylesheet" media="screen" href="/stylesheets/style.css"/>
     <link rel="stylesheet" media="screen" href="/stylesheets/dark.css"/>
+    <link rel="stylesheet" media="screen" href="/stylesheets/progressbar.css"/>
 	{% if config.font_awesome %}<link rel="stylesheet" href="{{ config.root }}{{ config.font_awesome_css }}">{% endif %}
-<style>
-	/*---------------------------*/			
-        .container {
-	margin: auto;
-	width : 50%;
-	}    
-        .progress-bar {
-            background-color: #1a1a1a;
-            height: 25px;
-            padding: 5px;
-            width: 350px;
-	    position: relative;
-            margin: 70px 0 20px 0;			
-            -moz-border-radius: 5px;
-			-webkit-border-radius: 5px;
-			border-radius: 5px;
-            -moz-box-shadow: 0 1px 5px #000 inset, 0 1px 0 #444;
-			-webkit-box-shadow: 0 1px 5px #000 inset, 0 1px 0 #444;
-			box-shadow: 0 1px 5px #000 inset, 0 1px 0 #444;           
-        }
-        
-        .progress-bar span {
-            display: inline-block;
-            height: 100%;
-			background-color: #777;
-            -moz-border-radius: 3px;
-			-webkit-border-radius: 3px;
-			border-radius: 3px;
-            -moz-box-shadow: 0 1px 0 rgba(255, 255, 255, .5) inset;
-			-webkit-box-shadow: 0 1px 0 rgba(255, 255, 255, .5) inset;
-			box-shadow: 0 1px 0 rgba(255, 255, 255, .5) inset;
-			-webkit-transition: width .4s ease-in-out;
-			-moz-transition: width .4s ease-in-out;
-			-ms-transition: width .4s ease-in-out;
-			-o-transition: width .4s ease-in-out;
-			transition:   width .4s ease-in-out;		
-        }
-		
-		
-        .blue span {
-            background-color: #34c2e3;   
-        }
-
-        .red span {
-			  background-color: #f42323;
-			  background-image: -webkit-gradient(linear, left top, left bottom, from(#f42323), to(#ff0000));
-			  background-image: -webkit-linear-gradient(top, #f42323, #ff0000);
-			  background-image: -moz-linear-gradient(top, #f42323, #ff0000);
-			  background-image: -ms-linear-gradient(top, #f42323, #ff0000);
-			  background-image: -o-linear-gradient(top, #f42323, #ff0000);
-			  background-image: linear-gradient(top, #f42323, #ff0000);  
-        }	
-
-        .green span {
-			  background-color: #a5df41;
-			  background-image: -webkit-gradient(linear, left top, left bottom, from(#a5df41), to(#4ca916));
-			  background-image: -webkit-linear-gradient(top, #a5df41, #4ca916);
-			  background-image: -moz-linear-gradient(top, #a5df41, #4ca916);
-			  background-image: -ms-linear-gradient(top, #a5df41, #4ca916);
-			  background-image: -o-linear-gradient(top, #a5df41, #4ca916);
-			  background-image: linear-gradient(top, #a5df41, #4ca916);  
-        }		
-		
-		/*---------------------------*/		
-		
-		.stripes span {
-            -webkit-background-size: 30px 30px;
-            -moz-background-size: 30px 30px;
-            background-size: 30px 30px;			
-			background-image: -webkit-gradient(linear, left top, right bottom,
-								color-stop(.25, rgba(255, 255, 255, .15)), color-stop(.25, transparent),
-								color-stop(.5, transparent), color-stop(.5, rgba(255, 255, 255, .15)),
-								color-stop(.75, rgba(255, 255, 255, .15)), color-stop(.75, transparent),
-								to(transparent));
-            background-image: -webkit-linear-gradient(135deg, rgba(255, 255, 255, .15) 25%, transparent 25%,
-                                transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%,
-                                transparent 75%, transparent);
-            background-image: -moz-linear-gradient(135deg, rgba(255, 255, 255, .15) 25%, transparent 25%,
-                                transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%,
-                                transparent 75%, transparent);
-            background-image: -ms-linear-gradient(135deg, rgba(255, 255, 255, .15) 25%, transparent 25%,
-                                transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%,
-                                transparent 75%, transparent);
-            background-image: -o-linear-gradient(135deg, rgba(255, 255, 255, .15) 25%, transparent 25%,
-                                transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%,
-                                transparent 75%, transparent);
-            background-image: linear-gradient(135deg, rgba(255, 255, 255, .15) 25%, transparent 25%,
-                                transparent 50%, rgba(255, 255, 255, .15) 50%, rgba(255, 255, 255, .15) 75%,
-                                transparent 75%, transparent);            
-            
-            -webkit-animation: animate-stripes 3s linear infinite;
-            -moz-animation: animate-stripes 3s linear infinite;       		
-		}
-        
-	@-webkit-keyframes animate-stripes { 
-			0% {background-position: 0 0;} 100% {background-position: 60px 0;}
-        }
-        
-        
-        @-moz-keyframes animate-stripes {
-			0% {background-position: 0 0;} 100% {background-position: 60px 0;}
-        }
-		
-		/*---------------------------*/	 
-
-		.shine span {
-			position: relative;
-		}
-		
-		.shine span::after {
-			content: '';
-			opacity: 0;
-			position: absolute;
-			top: 0;
-			right: 0;
-			bottom: 0;
-			left: 0;
-			background: #fff;
-            -moz-border-radius: 3px;
-			-webkit-border-radius: 3px;
-			border-radius: 3px;			
-			
-            -webkit-animation: animate-shine 2s ease-out infinite;
-            -moz-animation: animate-shine 2s ease-out infinite; 			
-		}
-
-        @-webkit-keyframes animate-shine { 
-			0% {opacity: 0; width: 0;}
-			50% {opacity: .5;}
-			100% {opacity: 0; width: 95%;}
-        }
-        
-        
-        @-moz-keyframes animate-shine {
-			0% {opacity: 0; width: 0;}
-			50% {opacity: .5;}
-			100% {opacity: 0; width: 95%;}
-        }
-		.glow span {
-            -moz-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;
-			-webkit-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;
-			box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;
-			
-            -webkit-animation: animate-glow 1s ease-out infinite;
-            -moz-animation: animate-glow 1s ease-out infinite; 			
-		}
-
-		@-webkit-keyframes animate-glow {
-		 0% { -webkit-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;} 
-		 50% { -webkit-box-shadow: 0 5px 5px rgba(255, 255, 255, .3) inset, 0 -5px 5px rgba(255, 255, 255, .3) inset;} 
-		 100% { -webkit-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;}
-		 }
-
-		@-moz-keyframes animate-glow {
-		 0% { -moz-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;} 
-		 50% { -moz-box-shadow: 0 5px 5px rgba(255, 255, 255, .3) inset, 0 -5px 5px rgba(255, 255, 255, .3) inset;} 
-		 100% { -moz-box-shadow: 0 5px 5px rgba(255, 255, 255, .7) inset, 0 -5px 5px rgba(255, 255, 255, .7) inset;}
-		 }
-
- </style>
   </head>
   <body>
     <div class="bar top">{{ boardlist.top }}</div>
@@ -181,7 +22,7 @@
 </center>
    <div class="ban">
       <h2>Thanks for donating</h2>
-      <p>The server costs $55 per month. If you buy stickers we get about 45-55% of whatever you spend. Historical donation records to the former owner are ForeverN2Dust is the top donator, giving about $3000. FOOFDOOF is #2 with $1000 and lots of cheap Chinese shit. Please specify what you'd like your money to go towards. If you don't want to buy stickers, but want to donate something else please either ask in /q/ or contact the Lainchan administration on IRC at #lainchan on Freenode.
+      <p>The server costs {{ settings.monthlyamount }} per month. If you buy stickers we get about 45-55% of whatever you spend. Historical donation records to the former owner are ForeverN2Dust is the top donator, giving about $3000. FOOFDOOF is #2 with $1000 and lots of cheap Chinese shit. Please specify what you'd like your money to go towards. If you don't want to buy stickers, but want to donate something else please either ask in /q/ or contact the Lainchan administration on IRC at #lainchan on Freenode.
         </p>
 
   <p><a href="https://www.stickermule.com/marketplace/tags/lainchan"> Buy stickers here</a>
@@ -189,16 +30,16 @@
 
 <p>Monthly Funding Progress Bar</p>
 
-<p>Cost per month $55</p>
+<p>Cost per month {{ settings.monthlyamount }}</p>
 
-<p>Funds from stickers $37.75</p>
+<p>Funds from stickers {{ settings.currentamount }} </p>
 
 <div class="container">
-<div class="progress-bar red glow">
-    <span style="width:14%;position:relative;left:36%; 
+    <div class="{{ settings.progressbarcssclass }}">
+        <span style="width:14%;position:relative;left:{{ settings.progressbarcssleft }}%; 
   "> </span>
 </div>
-<div id="value" style="position:relative;left:135px;top:-45px">$-19.25</div>
+<div id="value" style="position:relative;left:{{ settings.progressbartextcssleft }}px;top:-45px">{{ settings.currentprogress }}</div>
 </div>
 
     </div>
diff --git a/templates/themes/donate/info.php b/templates/themes/donate/info.php
index fa3f649b..2b618e89 100644
--- a/templates/themes/donate/info.php
+++ b/templates/themes/donate/info.php
@@ -17,7 +17,38 @@ $theme = array(
         array('title'   => 'File',
               'name'    => 'file',
               'type'    => 'text',
-              'default' => 'donate.html')),
+              'default' => 'donate.html'),
+
+        array('title'   => 'Monthly Amount',
+              'name'    => 'monthlyamount',
+              'type'    => 'text',
+              'default' => '$55'),
+          
+        array('title'   => 'Current Amount',
+              'name'    => 'currentamount',
+              'type'    => 'text',
+              'default' => '$0'),
+        
+        array('title'   => 'Current Progress',
+              'name'    => 'currentprogress',
+              'type'    => 'text',
+              'default' => '$0'),
+        
+        array('title'   => 'Progress Bar CSS class',
+              'name'    => 'progressbarcssclass',
+              'type'    => 'text',
+              'default' => 'progress-bar red glow'),
+        
+        array('title'   => 'Progress Bar CSS left',
+              'name'    => 'progressbarcssleft',
+              'type'    => 'text',
+              'default' => '36'),
+        
+        array('title'   => 'Progress Bar Text CSS left',
+              'name'    => 'progressbartextcssleft',
+              'type'    => 'text',
+              'default' => '135'),
+          ),
 
     'build_function'   => 'donate_build');
 ?>
diff --git a/templates/themes/irc/info.php b/templates/themes/irc/info.php
index 8b31b011..59ff4bd6 100644
--- a/templates/themes/irc/info.php
+++ b/templates/themes/irc/info.php
@@ -17,7 +17,12 @@ $theme = array(
         array('title'   => 'File',
               'name'    => 'file',
               'type'    => 'text',
-              'default' => 'irc.html')),
+              'default' => 'irc.html'),
+
+        array('title'   => 'Channel',
+              'name'    => 'channel',
+              'type'    => 'text',
+              'default' => 'lainchan')),
 
     'build_function'   => 'irc_build');
 ?>
diff --git a/templates/themes/irc/irc.html b/templates/themes/irc/irc.html
index 2828b6e0..1766f426 100644
--- a/templates/themes/irc/irc.html
+++ b/templates/themes/irc/irc.html
@@ -22,8 +22,8 @@
 
 
     <div class="ban" style="text-align: left!important;">
-    	<h2>Web Client - Point your own clients to #lainchan on irc.freenode.net.</h2>		
-	<iframe src="https://webchat.freenode.net?channels=%23lainchan&uio=MTE9MTMz98" width="766" height="400"></iframe>
+        <h2>Web Client - Point your own clients to #{{ settings.channel }} on irc.freenode.net.</h2>		
+        <iframe src="https://webchat.freenode.net?channels=%23{{ settings.channel }}&uio=MTE9MTMz98" width="766" height="400"></iframe>
     </div>
   </body>
 </html>
diff --git a/templates/themes/irc/radio.html b/templates/themes/irc/radio.html
deleted file mode 100644
index 7f84134b..00000000
--- a/templates/themes/irc/radio.html
+++ /dev/null
@@ -1,29 +0,0 @@
-{% filter remove_whitespace %}
-<!DOCTYPE html>
-<html>
-  <head>
-    <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
-    <title>{{ settings.title }}</title>
-    <link rel="shortcut icon" href="/favicon.png">
-    <link rel="stylesheet" media="screen" href="/stylesheets/style.css"/>
-    <link rel="stylesheet" media="screen" href="/stylesheets/dark.css"/>
-    <link rel="stylesheet" media="screen" href="/stylesheets/dark_irc.css"/>
-  </head>
-  <body>
-  	<div class="bar top">
-		{{ boardlist.top }}
-	</div>
-
-    <header>
-      <h1>{{ settings.title }}</h1>
-      <div class="subtitle">{{ settings.subtitle }}</div>
-    </header>
-
-
-    <div class="ban" style="text-align: left!important;">
-    	<h2>Web Client - Point your own clients to #lainchan on irc.freenode.net.</h2>		
-	<iframe src="https://webchat.freenode.net?channels=%23lainchan&uio=MTE9MTMz98" width="766" height="400"></iframe>
-    </div>
-  </body>
-</html>
-{% endfilter %}
diff --git a/templates/themes/radio/info.php b/templates/themes/radio/info.php
index d6679733..2ae31fbd 100644
--- a/templates/themes/radio/info.php
+++ b/templates/themes/radio/info.php
@@ -17,7 +17,12 @@ $theme = array(
         array('title'   => 'File',
               'name'    => 'file',
               'type'    => 'text',
-              'default' => 'radio.html')),
+              'default' => 'radio.html'),
+    
+        array('title'   => 'Radio Status URL',
+              'name'    => 'radiostatus',
+              'type'    => 'text',
+              'default' => '/radio_assets/status.xsl')),
 
     'build_function'   => 'radio_build');
-?>
\ No newline at end of file
+?>
diff --git a/templates/themes/radio/radio.html b/templates/themes/radio/radio.html
index b19d703a..3e16430e 100644
--- a/templates/themes/radio/radio.html
+++ b/templates/themes/radio/radio.html
@@ -16,7 +16,7 @@ $(document).ready(function(){
 });
 
 function check_status(){  
-$.get("/radio_assets/status.xsl", function(data){    
+$.get("{{ settings.radiostatus }}", function(data){    
 var el = $( '<div></div>' );   
 el.html(data);    
 var sd = el.find(".streamdata");  
-- 
cgit v1.3


From 5feae402cb55d49963bfd2c6f5a33d10690ecbc1 Mon Sep 17 00:00:00 2001
From: Benjamin Southall <applemansigloo@gmail.com>
Date: Wed, 14 Dec 2016 06:11:54 +0900
Subject: Changes to report notification callback to Slack HTTP endpoint

---
 post.php | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 84858bb2..bbd0c628 100644
--- a/post.php
+++ b/post.php
@@ -1147,6 +1147,37 @@ if (isset($_POST['delete'])) {
 		$query->bindValue(':thread', $post['thread']);
 		$query->bindValue(':limit', $config['cycle_limit'], PDO::PARAM_INT);
 		$query->execute() or error(db_error($query));
+                if ($config['slack'])
+                {
+                function slack($message, $room = "reports", $icon = ":no_entry_sign:") 
+			{
+			$room = ($room) ? $room : "reports";
+			$data = "payload=" . json_encode(array(
+			"channel"       =>  "#{$room}",
+			"text"          =>  urlencode($message),
+			"icon_emoji"    =>  $icon
+			));
+
+			// You can get your webhook endpoint from your Slack settings
+			// For some reason using the configuration key doesn't work 
+			$ch = curl_init($config['slack_incoming_webhook_endpoint']);
+			curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
+			curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
+			curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
+			curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+			$result = curl_exec($ch);
+			curl_close($ch);
+
+			return $result;
+			}
+		
+		$postcontent = mb_substr($thread['body_nomarkup'], 0, 120) . '...  _*(POST TRIMMED)*_';
+		$slackmessage = '<'  .$config['domain']  . "/mod.php?/" . $board['dir'] . $config['dir']['res'] .  ( $thread['thread'] ? $thread['thread'] : $id ) . ".html"  .  ($thread['thread'] ? '#' . $id : '') . '> \n ' . $reason . '\n ' . $postcontent . '\n';
+
+		$slackresult = slack($slackmessage, $config['slack_channel']); 
+		}
+
+
 	}
 	
 	if (isset($post['antispam_hash'])) {
-- 
cgit v1.3