PageRenderTime 43ms CodeModel.GetById 14ms RepoModel.GetById 0ms app.codeStats 0ms

/infusions/shoutbox_panel/shoutbox_panel.php

https://gitlab.com/php-fusion/PHP-Fusion
PHP | 200 lines | 180 code | 0 blank | 20 comment | 92 complexity | ed627311736aedc48e9d771d0d47101e MD5 | raw file
Possible License(s): AGPL-3.0, LGPL-2.1, Apache-2.0 
    

  1. <?php

    2. 

  2. /*-------------------------------------------------------+

    3. 

  3. | PHP-Fusion Content Management System

    4. 

  4. | Copyright (C) PHP-Fusion Inc

    5. 

  5. | http://www.php-fusion.co.uk/

    6. 

  6. +--------------------------------------------------------+

    7. 

  7. | Filename: shoutbox_panel.php

    8. 

  8. | Author: Nick Jones (Digitanium)

    9. 

  9. +--------------------------------------------------------+

    10. 

  10. | This program is released as free software under the

    11. 

  11. | Affero GPL license. You can redistribute it and/or

    12. 

  12. | modify it under the terms of this license which you

    13. 

  13. | can read by viewing the included agpl.txt or online

    14. 

  14. | at www.gnu.org/licenses/agpl.html. Removal of this

    15. 

  15. | copyright header is strictly prohibited without

    16. 

  16. | written permission from the original author(s).

    17. 

  17. +--------------------------------------------------------*/

    18. 

  18. if (!defined("IN_FUSION")) {

    19. 

  19. 	die("Access Denied");

    20. 

  20. }

    21. 

  21. include_once INFUSIONS."shoutbox_panel/infusion_db.php";

    22. 

  22. include_once INCLUDES."infusions_include.php";

    23. 

  23. // Check if a locale file is available that match the selected locale.

    24. 

  24. if (file_exists(INFUSIONS."shoutbox_panel/locale/".LANGUAGE.".php")) {

    25. 

  25. 	// Load the locale file matching selection.

    26. 

  26. 	include INFUSIONS."shoutbox_panel/locale/".LANGUAGE.".php";

    27. 

  27. } else {

    28. 

  28. 	// Load the default locale file.

    29. 

  29. 	include INFUSIONS."shoutbox_panel/locale/English.php";

    30. 

  30. }

    31. 

  31. $shout_settings = get_settings("shoutbox_panel");

    32. 

  32. $link = FUSION_SELF.(FUSION_QUERY ? "?".FUSION_QUERY : "");

    33. 

  33. $link = preg_replace("^(&amp;|\?)s_action=(edit|delete)&amp;shout_id=\d*^", "", $link);

    34. 

  34. $sep = stristr($link, "?") ? "&amp;" : "?";

    35. 

  35. $shout_link = "";

    36. 

  36. $shout_message = "";

    37. 

  37. if (iMEMBER && (isset($_GET['s_action']) && $_GET['s_action'] == "delete") && (isset($_GET['shout_id']) && isnum($_GET['shout_id']))) {

    38. 

  38. 	if ((iADMIN && checkrights("S")) || (iMEMBER && dbcount("(shout_id)", DB_SHOUTBOX, "shout_id='".$_GET['shout_id']."' AND shout_name='".$userdata['user_id']."'"))) {

    39. 

  39. 		$result = dbquery("DELETE FROM ".DB_SHOUTBOX." WHERE shout_id='".$_GET['shout_id']."'".(iADMIN ? "" : " AND shout_name='".$userdata['user_id']."'"));

    40. 

  40. 	}

    41. 

  41. 	redirect($link);

    42. 

  42. }

    43. 

  43. if (!function_exists("sbwrap")) {

    44. 

  44. 	function sbwrap($text) {

    45. 

  45. 		global $locale;

    46. 

  46. 		$i = 0;

    47. 

  47. 		$tags = 0;

    48. 

  48. 		$chars = 0;

    49. 

  49. 		$res = "";

    50. 

  50. 		$str_len = strlen($text);

    51. 

  51. 		for ($i = 0; $i < $str_len; $i++) {

    52. 

  52. 			$chr = mb_substr($text, $i, 1, $locale['charset']);

    53. 

  53. 			if ($chr == "<") {

    54. 

  54. 				if (mb_substr($text, ($i+1), 6, $locale['charset']) == "a href" || mb_substr($text, ($i+1), 3, $locale['charset']) == "img") {

    55. 

  55. 					$chr = " ".$chr;

    56. 

  56. 					$chars = 0;

    57. 

  57. 				}

    58. 

  58. 				$tags++;

    59. 

  59. 			} elseif ($chr == "&") {

    60. 

  60. 				if (mb_substr($text, ($i+1), 5, $locale['charset']) == "quot;") {

    61. 

  61. 					$chars = $chars-5;

    62. 

  62. 				} elseif (mb_substr($text, ($i+1), 4, $locale['charset']) == "amp;" || mb_substr($text, ($i+1), 4, $locale['charset']) == "#39;" || mb_substr($text, ($i+1), 4, $locale['charset']) == "#92;") {

    63. 

  63. 					$chars = $chars-4;

    64. 

  64. 				} elseif (mb_substr($text, ($i+1), 3, $locale['charset']) == "lt;" || mb_substr($text, ($i+1), 3, $locale['charset']) == "gt;") {

    65. 

  65. 					$chars = $chars-3;

    66. 

  66. 				}

    67. 

  67. 			} elseif ($chr == ">") {

    68. 

  68. 				$tags--;

    69. 

  69. 			} elseif ($chr == " ") {

    70. 

  70. 				$chars = 0;

    71. 

  71. 			} elseif (!$tags) {

    72. 

  72. 				$chars++;

    73. 

  73. 			}

    74. 

  74. 			if (!$tags && $chars == 18) {

    75. 

  75. 				$chr .= "<br />";

    76. 

  76. 				$chars = 0;

    77. 

  77. 			}

    78. 

  78. 			$res .= $chr;

    79. 

  79. 		}

    80. 

  80. 		return $res;

    81. 

  81. 	}

    82. 

  82. }

    83. 

  83. openside($locale['SB_title']);

    84. 

  84. if (iMEMBER || $shout_settings['guest_shouts'] == "1") {

    85. 

  85. 	include_once INCLUDES."bbcode_include.php";

    86. 

  86. 	if (isset($_POST['post_shout'])) {

    87. 

  87. 		$flood = FALSE;

    88. 

  88. 		if (iMEMBER) {

    89. 

  89. 			$shout_name = $userdata['user_id'];

    90. 

  90. 		} elseif ($shout_settings['guest_shouts'] == "1") {

    91. 

  91. 			$shout_name = trim(stripinput($_POST['shout_name']));

    92. 

  92. 			$shout_name = preg_replace("(^[+0-9\s]*)", "", $shout_name);

    93. 

  93. 			if (isnum($shout_name)) {

    94. 

  94. 				$shout_name = "";

    95. 

  95. 			}

    96. 

  96. 			include_once INCLUDES."captchas/securimage/securimage.php";

    97. 

  97. 			$securimage = new Securimage();

    98. 

  98. 			if (!isset($_POST['sb_captcha_code']) || $securimage->check($_POST['sb_captcha_code']) == FALSE) {

    99. 

  99. 				redirect($link);

    100. 

  100. 			}

    101. 

  101. 		}

    102. 

  102. 		$shout_message = str_replace("\n", " ", $_POST['shout_message']);

    103. 

  103. 		$shout_message = preg_replace("/^(.{255}).*$/", "$1", $shout_message);

    104. 

  104. 		$shout_message = trim(stripinput(censorwords($shout_message)));

    105. 

  105. 		if (iMEMBER && (isset($_GET['s_action']) && $_GET['s_action'] == "edit") && (isset($_GET['shout_id']) && isnum($_GET['shout_id']))) {

    106. 

  106. 			$comment_updated = FALSE;

    107. 

  107. 			if ((iADMIN && checkrights("S")) || (iMEMBER && dbcount("(shout_id)", DB_SHOUTBOX, "shout_id='".$_GET['shout_id']."' AND shout_name='".$userdata['user_id']."'"))) {

    108. 

  108. 				if ($shout_message) {

    109. 

  109. 					$result = dbquery("UPDATE ".DB_SHOUTBOX." SET shout_message='$shout_message' WHERE shout_id='".$_GET['shout_id']."'".(iADMIN ? "" : " AND shout_name='".$userdata['user_id']."'"));

    110. 

  110. 				}

    111. 

  111. 			}

    112. 

  112. 			redirect($link);

    113. 

  113. 		} elseif ($shout_name && $shout_message) {

    114. 

  114. 			require_once INCLUDES."flood_include.php";

    115. 

  115. 			if (!flood_control("shout_datestamp", DB_SHOUTBOX, "shout_ip='".USER_IP."'")) {

    116. 

  116. 				$result = dbquery("INSERT INTO ".DB_SHOUTBOX." (shout_name, shout_message, shout_datestamp, shout_ip, shout_ip_type, shout_hidden".(multilang_table("SB") ? ", shout_language)" : ")")." VALUES ('$shout_name', '$shout_message', '".time()."', '".USER_IP."', '".USER_IP_TYPE."', '0'".(multilang_table("SB") ? ", '".LANGUAGE."')" : ")"));

    117. 

  117. 			}

    118. 

  118. 		}

    119. 

  119. 		redirect($link);

    120. 

  120. 	}

    121. 

  121. 	if (iMEMBER && (isset($_GET['s_action']) && $_GET['s_action'] == "edit") && (isset($_GET['shout_id']) && isnum($_GET['shout_id']))) {

    122. 

  122. 		$esresult = dbquery("SELECT ts.shout_id, ts.shout_name, ts.shout_message, tu.user_id, tu.user_name

    123. 

  123. 			FROM ".DB_SHOUTBOX." ts

    124. 

  124. 			LEFT JOIN ".DB_USERS." tu ON ts.shout_name=tu.user_id

    125. 

  125. 			".(multilang_table("SB") ? "WHERE shout_language='".LANGUAGE."' AND" : "WHERE")." ts.shout_id='".$_GET['shout_id']."'");

    126. 

  126. 		if (dbrows($esresult)) {

    127. 

  127. 			$esdata = dbarray($esresult);

    128. 

  128. 			if ((iADMIN && checkrights("S")) || (iMEMBER && $esdata['shout_name'] == $userdata['user_id'] && isset($esdata['user_name']))) {

    129. 

  129. 				if ((isset($_GET['s_action']) && $_GET['s_action'] == "edit") && (isset($_GET['shout_id']) && isnum($_GET['shout_id']))) {

    130. 

  130. 					$edit_url = $sep."s_action=edit&amp;shout_id=".$esdata['shout_id'];

    131. 

  131. 				} else {

    132. 

  132. 					$edit_url = "";

    133. 

  133. 				}

    134. 

  134. 				$shout_link = $link.$edit_url;

    135. 

  135. 				$shout_message = $esdata['shout_message'];

    136. 

  136. 			}

    137. 

  137. 		} else {

    138. 

  138. 			$shout_link = $link;

    139. 

  139. 			$shout_message = "";

    140. 

  140. 		}

    141. 

  141. 	} else {

    142. 

  142. 		$shout_link = $link;

    143. 

  143. 		$shout_message = "";

    144. 

  144. 	}

    145. 

  145. 	echo "<a id='edit_shout' name='edit_shout'></a>\n";

    146. 

  146. 	echo openform('shout_form', 'post', $shout_link, array('notice' => 0, 'max_tokens' => 1));

    147. 

  147. 	if (iGUEST) {

    148. 

  148. 		echo $locale['SB_name']."<br />\n";

    149. 

  149. 		echo "<input type='text' name='shout_name' value='' class='textbox' maxlength='30' style='width:140px' /><br />\n";

    150. 

  150. 		echo $locale['SB_message']."<br />\n";

    151. 

  151. 	}

    152. 

  152. 	echo display_bbcodes("150px;", "shout_message", "shout_form", "smiley|b|u|url|color")."\n";

    153. 

  153. 	echo form_textarea('shout_message', '', $shout_message);

    154. 

  154. 	if (iGUEST) {

    155. 

  155. 		echo $locale['SB_validation_code']."<br />\n";

    156. 

  156. 		echo "<img id='sb_captcha' src='".INCLUDES."captchas/securimage/securimage_show.php' alt='' /><br />\n";

    157. 

  157. 		echo "<a href='".INCLUDES."captchas/securimage/securimage_play.php'><img src='".INCLUDES."captchas/securimage/images/audio_icon.gif' alt='' class='tbl-border' style='margin-bottom:1px' /></a>\n";

    158. 

  158. 		echo "<a href='#' onclick=\"document.getElementById('sb_captcha').src = '".INCLUDES."captchas/securimage/securimage_show.php?sid=' + Math.random(); return false\"><img src='".INCLUDES."captchas/securimage/images/refresh.gif' alt='' class='tbl-border' /></a><br />\n";

    159. 

  159. 		echo $locale['SB_enter_validation_code']."<br />\n<input type='text' name='sb_captcha_code' class='textbox' style='width:100px' /><br />\n";

    160. 

  160. 	}

    161. 

  161. 	echo form_button('post_shout', $locale['SB_shout'], $locale['SB_shout'], array('class' => 'btn-block btn-primary button',

    162. 

  162. 																								 'icon' => "entypo icomment"));

    163. 

  163. 	echo closeform();

    164. 

  164. } else {

    165. 

  165. 	echo "<div style='text-align:center'>".$locale['SB_login_req']."</div><br />\n";

    166. 

  166. }

    167. 

  167. $numrows = dbcount("(shout_id)", DB_SHOUTBOX, "shout_hidden='0'");

    168. 

  168. $result = dbquery("SELECT ts.shout_id, ts.shout_name, ts.shout_message, ts.shout_datestamp, tu.user_id, tu.user_name, tu.user_status, tu.user_avatar

    169. 

  169. 	FROM ".DB_SHOUTBOX." ts

    170. 

  170. 	LEFT JOIN ".DB_USERS." tu ON ts.shout_name=tu.user_id

    171. 

  171. 	".(multilang_table("SB") ? "WHERE shout_language='".LANGUAGE."' AND" : "WHERE")." shout_hidden='0'

    172. 

  172. 	ORDER BY ts.shout_datestamp DESC LIMIT 0,".$shout_settings['visible_shouts']);

    173. 

  173. if (dbrows($result)) {

    174. 

  174. 	$i = 0;

    175. 

  175. 	while ($data = dbarray($result)) {

    176. 

  176. 		echo "<div class='display-block shoutboxwrapper clearfix' style='width:100%;'>\n";

    177. 

  177. 		echo "<div class='shoutboxavatar pull-left m-r-10 m-t-5'>\n";

    178. 

  178. 		echo display_avatar($data, '50px');

    179. 

  179. 		echo "</div>\n";

    180. 

  180. 		if ((iADMIN && checkrights("S")) || (iMEMBER && $data['shout_name'] == $userdata['user_id'] && isset($data['user_name']))) {

    181. 

  181. 			echo "<div class='pull-right btn-group'>\n";

    182. 

  182. 			echo "<a class='btn btn-default btn-xs' title='".$locale['SB_edit']."' href='".$link.$sep."s_action=edit&amp;shout_id=".$data['shout_id']."#edit_shout"."' class='side'><i class='entypo pencil'></i></a>\n"; //

    183. 

  183. 			echo "<a class='btn btn-default btn-xs' title='".$locale['SB_delete']."' href='".$link.$sep."s_action=delete&amp;shout_id=".$data['shout_id']."' onclick=\"return confirm('".$locale['SB_warning_shout']."');\" class='side'><i class='entypo trash'></i></a>\n"; //

    184. 

  184. 			echo "</div>\n";

    185. 

  185. 		}

    186. 

  186. 		echo "<div class='shoutboxname'>\n";

    187. 

  187. 		echo ($data['user_name']) ? "<span class='side'>".profile_link($data['shout_name'], $data['user_name'], $data['user_status'])."</span>\n" : $data['shout_name']."\n";

    188. 

  188. 		echo "</div>\n";

    189. 

  189. 		echo "<div class='shoutboxdate'>".timer($data['shout_datestamp'])."</div>\n"; //".showdate("forumdate", $data['shout_datestamp'])."</div>";

    190. 

  190. 		echo "<div class='shoutbox'>".sbwrap(parseubb(parsesmileys($data['shout_message']), "b|i|u|url|color"))."</div>\n";

    191. 

  191. 		//if ($i != $numrows) { echo "<br />\n"; }

    192. 

  192. 		echo "</div>\n";

    193. 

  193. 	}

    194. 

  194. 	if ($numrows > $shout_settings['visible_shouts']) {

    195. 

  195. 		echo "<div style='text-align:center'>\n<a href='".INFUSIONS."shoutbox_panel/shoutbox_archive.php' class='side'>".$locale['SB_archive']."</a>\n</div>\n";

    196. 

  196. 	}

    197. 

  197. } else {

    198. 

  198. 	echo "<div>".$locale['SB_no_msgs']."</div>\n";

    199. 

  199. }

    200. 

  200. closeside();

    201. 

  201.