Beispiel #1
0
function Post()
{
    global $txt, $scripturl, $topic, $db_prefix, $modSettings, $board, $ID_MEMBER;
    global $user_info, $sc, $board_info, $context, $settings, $sourcedir;
    global $options, $func, $language;
    loadLanguage('Post');
    $context['show_spellchecking'] = !empty($modSettings['enableSpellChecking']) && function_exists('pspell_new');
    // You can't reply with a poll... hacker.
    if (isset($_REQUEST['poll']) && !empty($topic) && !isset($_REQUEST['msg'])) {
        unset($_REQUEST['poll']);
    }
    // Posting an event?
    $context['make_event'] = isset($_REQUEST['calendar']);
    // You must be posting to *some* board.
    if (empty($board) && !$context['make_event']) {
        fatal_lang_error('smf232', false);
    }
    require_once $sourcedir . '/Subs-Post.php';
    if (isset($_REQUEST['xml'])) {
        $context['sub_template'] = 'post';
        // Just in case of an earlier error...
        $context['preview_message'] = '';
        $context['preview_subject'] = '';
    }
    // Check if it's locked.  It isn't locked if no topic is specified.
    if (!empty($topic)) {
        $request = db_query("\n\t\t\tSELECT\n\t\t\t\tt.locked, IFNULL(ln.ID_TOPIC, 0) AS notify, t.isSticky, t.ID_POLL, t.numReplies, mf.ID_MEMBER,\n\t\t\t\tt.ID_FIRST_MSG, mf.subject, GREATEST(ml.posterTime, ml.modifiedTime) AS lastPostTime\n\t\t\tFROM {$db_prefix}topics AS t\n\t\t\t\tLEFT JOIN {$db_prefix}log_notify AS ln ON (ln.ID_TOPIC = t.ID_TOPIC AND ln.ID_MEMBER = {$ID_MEMBER})\n\t\t\t\tLEFT JOIN {$db_prefix}messages AS mf ON (mf.ID_MSG = t.ID_FIRST_MSG)\n\t\t\t\tLEFT JOIN {$db_prefix}messages AS ml ON (ml.ID_MSG = t.ID_LAST_MSG)\n\t\t\tWHERE t.ID_TOPIC = {$topic}\n\t\t\tLIMIT 1", __FILE__, __LINE__);
        list($locked, $context['notify'], $sticky, $pollID, $context['num_replies'], $ID_MEMBER_POSTER, $ID_FIRST_MSG, $first_subject, $lastPostTime) = mysql_fetch_row($request);
        mysql_free_result($request);
        // If this topic already has a poll, they sure can't add another.
        if (isset($_REQUEST['poll']) && $pollID > 0) {
            unset($_REQUEST['poll']);
        }
        if (empty($_REQUEST['msg'])) {
            if ($user_info['is_guest'] && !allowedTo('post_reply_any')) {
                is_not_guest();
            }
            if ($ID_MEMBER_POSTER != $ID_MEMBER) {
                isAllowedTo('post_reply_any');
            } elseif (!allowedTo('post_reply_any')) {
                isAllowedTo('post_reply_own');
            }
        }
        $context['can_lock'] = allowedTo('lock_any') || $ID_MEMBER == $ID_MEMBER_POSTER && allowedTo('lock_own');
        $context['can_sticky'] = allowedTo('make_sticky') && !empty($modSettings['enableStickyTopics']);
        $context['notify'] = !empty($context['notify']);
        $context['sticky'] = isset($_REQUEST['sticky']) ? !empty($_REQUEST['sticky']) : $sticky;
    } else {
        if ((!$context['make_event'] || !empty($board)) && (!isset($_REQUEST['poll']) || $modSettings['pollMode'] != '1')) {
            isAllowedTo('post_new');
        }
        $locked = 0;
        // !!! These won't work if you're making an event.
        $context['can_lock'] = allowedTo(array('lock_any', 'lock_own'));
        $context['can_sticky'] = allowedTo('make_sticky') && !empty($modSettings['enableStickyTopics']);
        $context['notify'] = !empty($context['notify']);
        $context['sticky'] = !empty($_REQUEST['sticky']);
    }
    // !!! These won't work if you're posting an event!
    $context['can_notify'] = allowedTo('mark_any_notify');
    $context['can_move'] = allowedTo('move_any');
    $context['can_announce'] = allowedTo('announce_topic');
    $context['locked'] = !empty($locked) || !empty($_REQUEST['lock']);
    // An array to hold all the attachments for this topic.
    $context['current_attachments'] = array();
    // Don't allow a post if it's locked and you aren't all powerful.
    if ($locked && !allowedTo('moderate_board')) {
        fatal_lang_error(90, false);
    }
    // Check the users permissions - is the user allowed to add or post a poll?
    if (isset($_REQUEST['poll']) && $modSettings['pollMode'] == '1') {
        // New topic, new poll.
        if (empty($topic)) {
            isAllowedTo('poll_post');
        } elseif ($ID_MEMBER == $ID_MEMBER_POSTER && !allowedTo('poll_add_any')) {
            isAllowedTo('poll_add_own');
        } else {
            isAllowedTo('poll_add_any');
        }
        // Set up the poll options.
        $context['poll_options'] = array('max_votes' => empty($_POST['poll_max_votes']) ? '1' : max(1, $_POST['poll_max_votes']), 'hide' => empty($_POST['poll_hide']) ? 0 : $_POST['poll_hide'], 'expire' => !isset($_POST['poll_expire']) ? '' : $_POST['poll_expire'], 'change_vote' => isset($_POST['poll_change_vote']));
        // Make all five poll choices empty.
        $context['choices'] = array(array('id' => 0, 'number' => 1, 'label' => '', 'is_last' => false), array('id' => 1, 'number' => 2, 'label' => '', 'is_last' => false), array('id' => 2, 'number' => 3, 'label' => '', 'is_last' => false), array('id' => 3, 'number' => 4, 'label' => '', 'is_last' => false), array('id' => 4, 'number' => 5, 'label' => '', 'is_last' => true));
    }
    if ($context['make_event']) {
        // They might want to pick a board.
        if (!isset($context['current_board'])) {
            $context['current_board'] = 0;
        }
        // Start loading up the event info.
        $context['event'] = array();
        $context['event']['title'] = isset($_REQUEST['evtitle']) ? htmlspecialchars(stripslashes($_REQUEST['evtitle'])) : '';
        $context['event']['id'] = isset($_REQUEST['eventid']) ? (int) $_REQUEST['eventid'] : -1;
        $context['event']['new'] = $context['event']['id'] == -1;
        // Permissions check!
        isAllowedTo('calendar_post');
        // Editing an event?  (but NOT previewing!?)
        if (!$context['event']['new'] && !isset($_REQUEST['subject'])) {
            // If the user doesn't have permission to edit the post in this topic, redirect them.
            if ($ID_MEMBER_POSTER != $ID_MEMBER || !allowedTo('modify_own') && !allowedTo('modify_any')) {
                require_once $sourcedir . '/Calendar.php';
                return CalendarPost();
            }
            // Get the current event information.
            $request = db_query("\n\t\t\t\tSELECT\n\t\t\t\t\tID_MEMBER, title, MONTH(startDate) AS month, DAYOFMONTH(startDate) AS day,\n\t\t\t\t\tYEAR(startDate) AS year, (TO_DAYS(endDate) - TO_DAYS(startDate)) AS span\n\t\t\t\tFROM {$db_prefix}calendar\n\t\t\t\tWHERE ID_EVENT = " . $context['event']['id'] . "\n\t\t\t\tLIMIT 1", __FILE__, __LINE__);
            $row = mysql_fetch_assoc($request);
            mysql_free_result($request);
            // Make sure the user is allowed to edit this event.
            if ($row['ID_MEMBER'] != $ID_MEMBER) {
                isAllowedTo('calendar_edit_any');
            } elseif (!allowedTo('calendar_edit_any')) {
                isAllowedTo('calendar_edit_own');
            }
            $context['event']['month'] = $row['month'];
            $context['event']['day'] = $row['day'];
            $context['event']['year'] = $row['year'];
            $context['event']['title'] = $row['title'];
            $context['event']['span'] = $row['span'] + 1;
        } else {
            $today = getdate();
            // You must have a month and year specified!
            if (!isset($_REQUEST['month'])) {
                $_REQUEST['month'] = $today['mon'];
            }
            if (!isset($_REQUEST['year'])) {
                $_REQUEST['year'] = $today['year'];
            }
            $context['event']['month'] = (int) $_REQUEST['month'];
            $context['event']['year'] = (int) $_REQUEST['year'];
            $context['event']['day'] = isset($_REQUEST['day']) ? $_REQUEST['day'] : ($_REQUEST['month'] == $today['mon'] ? $today['mday'] : 0);
            $context['event']['span'] = isset($_REQUEST['span']) ? $_REQUEST['span'] : 1;
            // Make sure the year and month are in the valid range.
            if ($context['event']['month'] < 1 || $context['event']['month'] > 12) {
                fatal_lang_error('calendar1', false);
            }
            if ($context['event']['year'] < $modSettings['cal_minyear'] || $context['event']['year'] > $modSettings['cal_maxyear']) {
                fatal_lang_error('calendar2', false);
            }
            // Get a list of boards they can post in.
            $boards = boardsAllowedTo('post_new');
            if (empty($boards)) {
                fatal_lang_error('cannot_post_new');
            }
            $request = db_query("\n\t\t\t\tSELECT c.name AS catName, c.ID_CAT, b.ID_BOARD, b.name AS boardName, b.childLevel\n\t\t\t\tFROM {$db_prefix}boards AS b\n\t\t\t\t\tLEFT JOIN {$db_prefix}categories AS c ON (c.ID_CAT = b.ID_CAT)\n\t\t\t\tWHERE {$user_info['query_see_board']}" . (in_array(0, $boards) ? '' : "\n\t\t\t\t\tAND b.ID_BOARD IN (" . implode(', ', $boards) . ")"), __FILE__, __LINE__);
            $context['event']['boards'] = array();
            while ($row = mysql_fetch_assoc($request)) {
                $context['event']['boards'][] = array('id' => $row['ID_BOARD'], 'name' => $row['boardName'], 'childLevel' => $row['childLevel'], 'prefix' => str_repeat('&nbsp;', $row['childLevel'] * 3), 'cat' => array('id' => $row['ID_CAT'], 'name' => $row['catName']));
            }
            mysql_free_result($request);
        }
        // Find the last day of the month.
        $context['event']['last_day'] = (int) strftime('%d', mktime(0, 0, 0, $context['event']['month'] == 12 ? 1 : $context['event']['month'] + 1, 0, $context['event']['month'] == 12 ? $context['event']['year'] + 1 : $context['event']['year']));
        $context['event']['board'] = !empty($board) ? $board : $modSettings['cal_defaultboard'];
    }
    if (empty($context['post_errors'])) {
        $context['post_errors'] = array();
    }
    // See if any new replies have come along.
    if (empty($_REQUEST['msg']) && !empty($topic)) {
        if (empty($options['no_new_reply_warning']) && isset($_REQUEST['num_replies'])) {
            $newReplies = $context['num_replies'] > $_REQUEST['num_replies'] ? $context['num_replies'] - $_REQUEST['num_replies'] : 0;
            if (!empty($newReplies)) {
                if ($newReplies == 1) {
                    $txt['error_new_reply'] = isset($_GET['num_replies']) ? $txt['error_new_reply_reading'] : $txt['error_new_reply'];
                } else {
                    $txt['error_new_replies'] = sprintf(isset($_GET['num_replies']) ? $txt['error_new_replies_reading'] : $txt['error_new_replies'], $newReplies);
                }
                // If they've come from the display page then we treat the error differently....
                if (isset($_GET['num_replies'])) {
                    $newRepliesError = $newReplies;
                } else {
                    $context['post_error'][$newReplies == 1 ? 'new_reply' : 'new_replies'] = true;
                }
                $modSettings['topicSummaryPosts'] = $newReplies > $modSettings['topicSummaryPosts'] ? max($modSettings['topicSummaryPosts'], 5) : $modSettings['topicSummaryPosts'];
            }
        }
        // Check whether this is a really old post being bumped...
        if (!empty($modSettings['oldTopicDays']) && $lastPostTime + $modSettings['oldTopicDays'] * 86400 < time() && empty($sticky) && !isset($_REQUEST['subject'])) {
            $oldTopicError = true;
        }
    }
    // Get a response prefix (like 'Re:') in the default forum language.
    if (!isset($context['response_prefix']) && !($context['response_prefix'] = cache_get_data('response_prefix'))) {
        if ($language === $user_info['language']) {
            $context['response_prefix'] = $txt['response_prefix'];
        } else {
            loadLanguage('index', $language, false);
            $context['response_prefix'] = $txt['response_prefix'];
            loadLanguage('index');
        }
        cache_put_data('response_prefix', $context['response_prefix'], 600);
    }
    // Previewing, modifying, or posting?
    if (isset($_REQUEST['message']) || !empty($context['post_error'])) {
        // Validate inputs.
        if (empty($context['post_error'])) {
            if ($func['htmltrim']($_REQUEST['subject']) == '') {
                $context['post_error']['no_subject'] = true;
            }
            if ($func['htmltrim']($_REQUEST['message']) == '') {
                $context['post_error']['no_message'] = true;
            }
            if (!empty($modSettings['max_messageLength']) && $func['strlen']($_REQUEST['message']) > $modSettings['max_messageLength']) {
                $context['post_error']['long_message'] = true;
            }
            // Are you... a guest?
            if ($user_info['is_guest']) {
                $_REQUEST['guestname'] = !isset($_REQUEST['guestname']) ? '' : trim($_REQUEST['guestname']);
                $_REQUEST['email'] = !isset($_REQUEST['email']) ? '' : trim($_REQUEST['email']);
                // Validate the name and email.
                if (!isset($_REQUEST['guestname']) || trim(strtr($_REQUEST['guestname'], '_', ' ')) == '') {
                    $context['post_error']['no_name'] = true;
                } elseif ($func['strlen']($_REQUEST['guestname']) > 25) {
                    $context['post_error']['long_name'] = true;
                } else {
                    require_once $sourcedir . '/Subs-Members.php';
                    if (isReservedName(htmlspecialchars($_REQUEST['guestname']), 0, true, false)) {
                        $context['post_error']['bad_name'] = true;
                    }
                }
                if (empty($modSettings['guest_post_no_email'])) {
                    if (!isset($_REQUEST['email']) || $_REQUEST['email'] == '') {
                        $context['post_error']['no_email'] = true;
                    } elseif (preg_match('~^[0-9A-Za-z=_+\\-/][0-9A-Za-z=_\'+\\-/\\.]*@[\\w\\-]+(\\.[\\w\\-]+)*(\\.[\\w]{2,6})$~', stripslashes($_REQUEST['email'])) == 0) {
                        $context['post_error']['bad_email'] = true;
                    }
                }
            }
            // This is self explanatory - got any questions?
            if (isset($_REQUEST['question']) && trim($_REQUEST['question']) == '') {
                $context['post_error']['no_question'] = true;
            }
            // This means they didn't click Post and get an error.
            $really_previewing = true;
        } else {
            if (!isset($_REQUEST['subject'])) {
                $_REQUEST['subject'] = '';
            }
            if (!isset($_REQUEST['message'])) {
                $_REQUEST['message'] = '';
            }
            if (!isset($_REQUEST['icon'])) {
                $_REQUEST['icon'] = 'xx';
            }
            $really_previewing = false;
        }
        // Set up the inputs for the form.
        $form_subject = strtr($func['htmlspecialchars'](stripslashes($_REQUEST['subject'])), array("\r" => '', "\n" => '', "\t" => ''));
        $form_message = $func['htmlspecialchars'](stripslashes($_REQUEST['message']), ENT_QUOTES);
        // Make sure the subject isn't too long - taking into account special characters.
        if ($func['strlen']($form_subject) > 100) {
            $form_subject = $func['substr']($form_subject, 0, 100);
        }
        // Have we inadvertently trimmed off the subject of useful information?
        if ($func['htmltrim']($form_subject) === '') {
            $context['post_error']['no_subject'] = true;
        }
        // Any errors occurred?
        if (!empty($context['post_error'])) {
            loadLanguage('Errors');
            $context['error_type'] = 'minor';
            $context['post_error']['messages'] = array();
            foreach ($context['post_error'] as $post_error => $dummy) {
                if ($post_error == 'messages') {
                    continue;
                }
                $context['post_error']['messages'][] = $txt['error_' . $post_error];
                // If it's not a minor error flag it as such.
                if (!in_array($post_error, array('new_reply', 'new_replies', 'old_topic'))) {
                    $context['error_type'] = 'serious';
                }
            }
        }
        if (isset($_REQUEST['poll'])) {
            $context['question'] = isset($_REQUEST['question']) ? $func['htmlspecialchars'](stripslashes(trim($_REQUEST['question']))) : '';
            $context['choices'] = array();
            $choice_id = 0;
            $_POST['options'] = empty($_POST['options']) ? array() : htmlspecialchars__recursive(stripslashes__recursive($_POST['options']));
            foreach ($_POST['options'] as $option) {
                if (trim($option) == '') {
                    continue;
                }
                $context['choices'][] = array('id' => $choice_id++, 'number' => $choice_id, 'label' => $option, 'is_last' => false);
            }
            if (count($context['choices']) < 2) {
                $context['choices'][] = array('id' => $choice_id++, 'number' => $choice_id, 'label' => '', 'is_last' => false);
                $context['choices'][] = array('id' => $choice_id++, 'number' => $choice_id, 'label' => '', 'is_last' => false);
            }
            $context['choices'][count($context['choices']) - 1]['is_last'] = true;
        }
        // Are you... a guest?
        if ($user_info['is_guest']) {
            $_REQUEST['guestname'] = !isset($_REQUEST['guestname']) ? '' : trim($_REQUEST['guestname']);
            $_REQUEST['email'] = !isset($_REQUEST['email']) ? '' : trim($_REQUEST['email']);
            $_REQUEST['guestname'] = htmlspecialchars($_REQUEST['guestname']);
            $context['name'] = $_REQUEST['guestname'];
            $_REQUEST['email'] = htmlspecialchars($_REQUEST['email']);
            $context['email'] = $_REQUEST['email'];
            $user_info['name'] = $_REQUEST['guestname'];
        }
        // Only show the preview stuff if they hit Preview.
        if ($really_previewing == true || isset($_REQUEST['xml'])) {
            // Set up the preview message and subject and censor them...
            $context['preview_message'] = $form_message;
            preparsecode($form_message, true);
            preparsecode($context['preview_message']);
            // Do all bulletin board code tags, with or without smileys.
            $context['preview_message'] = parse_bbc($context['preview_message'], isset($_REQUEST['ns']) ? 0 : 1);
            if ($form_subject != '') {
                $context['preview_subject'] = $form_subject;
                censorText($context['preview_subject']);
                censorText($context['preview_message']);
            } else {
                $context['preview_subject'] = '<i>' . $txt[24] . '</i>';
            }
            // Protect any CDATA blocks.
            if (isset($_REQUEST['xml'])) {
                $context['preview_message'] = strtr($context['preview_message'], array(']]>' => ']]]]><![CDATA[>'));
            }
        }
        // Set up the checkboxes.
        $context['notify'] = !empty($_REQUEST['notify']);
        $context['use_smileys'] = !isset($_REQUEST['ns']);
        $context['icon'] = isset($_REQUEST['icon']) ? preg_replace('~[\\./\\\\*\':"<>]~', '', $_REQUEST['icon']) : 'xx';
        // Set the destination action for submission.
        $context['destination'] = 'post2;start=' . $_REQUEST['start'] . (isset($_REQUEST['msg']) ? ';msg=' . $_REQUEST['msg'] . ';sesc=' . $sc : '') . (isset($_REQUEST['poll']) ? ';poll' : '');
        $context['submit_label'] = isset($_REQUEST['msg']) ? $txt[10] : $txt[105];
        // Previewing an edit?
        if (isset($_REQUEST['msg'])) {
            if (!empty($modSettings['attachmentEnable'])) {
                $request = db_query("\n\t\t\t\t\tSELECT IFNULL(size, -1) AS filesize, filename, ID_ATTACH\n\t\t\t\t\tFROM {$db_prefix}attachments\n\t\t\t\t\tWHERE ID_MSG = " . (int) $_REQUEST['msg'] . "\n\t\t\t\t\t\t AND attachmentType = 0", __FILE__, __LINE__);
                while ($row = mysql_fetch_assoc($request)) {
                    if ($row['filesize'] <= 0) {
                        continue;
                    }
                    $context['current_attachments'][] = array('name' => $row['filename'], 'id' => $row['ID_ATTACH']);
                }
                mysql_free_result($request);
            }
            // Allow moderators to change names....
            if (allowedTo('moderate_forum') && !empty($topic)) {
                $request = db_query("\n\t\t\t\t\tSELECT ID_MEMBER, posterName, posterEmail\n\t\t\t\t\tFROM {$db_prefix}messages\n\t\t\t\t\tWHERE ID_MSG = " . (int) $_REQUEST['msg'] . "\n\t\t\t\t\t\tAND ID_TOPIC = {$topic}\n\t\t\t\t\tLIMIT 1", __FILE__, __LINE__);
                $row = mysql_fetch_assoc($request);
                mysql_free_result($request);
                if (empty($row['ID_MEMBER'])) {
                    $context['name'] = htmlspecialchars($row['posterName']);
                    $context['email'] = htmlspecialchars($row['posterEmail']);
                }
            }
        }
        // No check is needed, since nothing is really posted.
        checkSubmitOnce('free');
    } elseif (isset($_REQUEST['msg'])) {
        checkSession('get');
        // Get the existing message.
        $request = db_query("\n\t\t\tSELECT\n\t\t\t\tm.ID_MEMBER, m.modifiedTime, m.smileysEnabled, m.body,\n\t\t\t\tm.posterName, m.posterEmail, m.subject, m.icon,\n\t\t\t\tIFNULL(a.size, -1) AS filesize, a.filename, a.ID_ATTACH,\n\t\t\t\tt.ID_MEMBER_STARTED AS ID_MEMBER_POSTER, m.posterTime\n\t\t\tFROM ({$db_prefix}messages AS m, {$db_prefix}topics AS t)\n\t\t\t\tLEFT JOIN {$db_prefix}attachments AS a ON (a.ID_MSG = m.ID_MSG AND a.attachmentType = 0)\n\t\t\tWHERE m.ID_MSG = " . (int) $_REQUEST['msg'] . "\n\t\t\t\tAND m.ID_TOPIC = {$topic}\n\t\t\t\tAND t.ID_TOPIC = {$topic}", __FILE__, __LINE__);
        // The message they were trying to edit was most likely deleted.
        // !!! Change this error message?
        if (mysql_num_rows($request) == 0) {
            fatal_lang_error('smf232', false);
        }
        $row = mysql_fetch_assoc($request);
        $attachment_stuff = array($row);
        while ($row2 = mysql_fetch_assoc($request)) {
            $attachment_stuff[] = $row2;
        }
        mysql_free_result($request);
        if ($row['ID_MEMBER'] == $ID_MEMBER && !allowedTo('modify_any')) {
            // Give an extra five minutes over the disable time threshold, so they can type.
            if (!empty($modSettings['edit_disable_time']) && $row['posterTime'] + ($modSettings['edit_disable_time'] + 5) * 60 < time()) {
                fatal_lang_error('modify_post_time_passed', false);
            } elseif ($row['ID_MEMBER_POSTER'] == $ID_MEMBER && !allowedTo('modify_own')) {
                isAllowedTo('modify_replies');
            } else {
                isAllowedTo('modify_own');
            }
        } elseif ($row['ID_MEMBER_POSTER'] == $ID_MEMBER && !allowedTo('modify_any')) {
            isAllowedTo('modify_replies');
        } else {
            isAllowedTo('modify_any');
        }
        // When was it last modified?
        if (!empty($row['modifiedTime'])) {
            $context['last_modified'] = timeformat($row['modifiedTime']);
        }
        // Get the stuff ready for the form.
        $form_subject = $row['subject'];
        $form_message = un_preparsecode($row['body']);
        censorText($form_message);
        censorText($form_subject);
        // Check the boxes that should be checked.
        $context['use_smileys'] = !empty($row['smileysEnabled']);
        $context['icon'] = $row['icon'];
        // Load up 'em attachments!
        foreach ($attachment_stuff as $attachment) {
            if ($attachment['filesize'] >= 0 && !empty($modSettings['attachmentEnable'])) {
                $context['current_attachments'][] = array('name' => $attachment['filename'], 'id' => $attachment['ID_ATTACH']);
            }
        }
        // Allow moderators to change names....
        if (allowedTo('moderate_forum') && empty($row['ID_MEMBER'])) {
            $context['name'] = htmlspecialchars($row['posterName']);
            $context['email'] = htmlspecialchars($row['posterEmail']);
        }
        // Set the destinaton.
        $context['destination'] = 'post2;start=' . $_REQUEST['start'] . ';msg=' . $_REQUEST['msg'] . ';sesc=' . $sc . (isset($_REQUEST['poll']) ? ';poll' : '');
        $context['submit_label'] = $txt[10];
    } else {
        // By default....
        $context['use_smileys'] = true;
        $context['icon'] = 'xx';
        if ($user_info['is_guest']) {
            $context['name'] = '';
            $context['email'] = '';
        }
        $context['destination'] = 'post2;start=' . $_REQUEST['start'] . (isset($_REQUEST['poll']) ? ';poll' : '');
        $context['submit_label'] = $txt[105];
        // Posting a quoted reply?
        if (!empty($topic) && !empty($_REQUEST['quote'])) {
            checkSession('get');
            // Make sure they _can_ quote this post, and if so get it.
            $request = db_query("\n\t\t\t\tSELECT m.subject, IFNULL(mem.realName, m.posterName) AS posterName, m.posterTime, m.body\n\t\t\t\tFROM ({$db_prefix}messages AS m, {$db_prefix}boards AS b)\n\t\t\t\t\tLEFT JOIN {$db_prefix}members AS mem ON (mem.ID_MEMBER = m.ID_MEMBER)\n\t\t\t\tWHERE m.ID_MSG = " . (int) $_REQUEST['quote'] . "\n\t\t\t\t\tAND b.ID_BOARD = m.ID_BOARD\n\t\t\t\t\tAND {$user_info['query_see_board']}\n\t\t\t\tLIMIT 1", __FILE__, __LINE__);
            if (mysql_num_rows($request) == 0) {
                fatal_lang_error('quoted_post_deleted', false);
            }
            list($form_subject, $mname, $mdate, $form_message) = mysql_fetch_row($request);
            mysql_free_result($request);
            // Add 'Re: ' to the front of the quoted subject.
            if (trim($context['response_prefix']) != '' && $func['strpos']($form_subject, trim($context['response_prefix'])) !== 0) {
                $form_subject = $context['response_prefix'] . $form_subject;
            }
            // Censor the message and subject.
            censorText($form_message);
            censorText($form_subject);
            $form_message = preg_replace('~<br(?: /)?' . '>~i', "\n", $form_message);
            // Remove any nested quotes, if necessary.
            if (!empty($modSettings['removeNestedQuotes'])) {
                $form_message = preg_replace(array('~\\n?\\[quote.*?\\].+?\\[/quote\\]\\n?~is', '~^\\n~', '~\\[/quote\\]~'), '', $form_message);
            }
            // Add a quote string on the front and end.
            $form_message = '[quote author=' . $mname . ' link=topic=' . $topic . '.msg' . (int) $_REQUEST['quote'] . '#msg' . (int) $_REQUEST['quote'] . ' date=' . $mdate . ']' . "\n" . $form_message . "\n" . '[/quote]';
        } elseif (!empty($topic) && empty($_REQUEST['quote'])) {
            // Get the first message's subject.
            $form_subject = $first_subject;
            // Add 'Re: ' to the front of the subject.
            if (trim($context['response_prefix']) != '' && $form_subject != '' && $func['strpos']($form_subject, trim($context['response_prefix'])) !== 0) {
                $form_subject = $context['response_prefix'] . $form_subject;
            }
            // Censor the subject.
            censorText($form_subject);
            $form_message = '';
        } else {
            $form_subject = isset($_GET['subject']) ? $_GET['subject'] : '';
            $form_message = '';
        }
    }
    // !!! This won't work if you're posting an event.
    if (allowedTo('post_attachment')) {
        if (empty($_SESSION['temp_attachments'])) {
            $_SESSION['temp_attachments'] = array();
        }
        // If this isn't a new post, check the current attachments.
        if (isset($_REQUEST['msg'])) {
            $request = db_query("\n\t\t\t\tSELECT COUNT(*), SUM(size)\n\t\t\t\tFROM {$db_prefix}attachments\n\t\t\t\tWHERE ID_MSG = " . (int) $_REQUEST['msg'] . "\n\t\t\t\t\tAND attachmentType = 0", __FILE__, __LINE__);
            list($quantity, $total_size) = mysql_fetch_row($request);
            mysql_free_result($request);
        } else {
            $quantity = 0;
            $total_size = 0;
        }
        $temp_start = 0;
        if (!empty($_SESSION['temp_attachments'])) {
            foreach ($_SESSION['temp_attachments'] as $attachID => $name) {
                $temp_start++;
                if (preg_match('~^post_tmp_' . $ID_MEMBER . '_\\d+$~', $attachID) == 0) {
                    unset($_SESSION['temp_attachments'][$attachID]);
                    continue;
                }
                if (!empty($_POST['attach_del']) && !in_array($attachID, $_POST['attach_del'])) {
                    $deleted_attachments = true;
                    unset($_SESSION['temp_attachments'][$attachID]);
                    @unlink($modSettings['attachmentUploadDir'] . '/' . $attachID);
                    continue;
                }
                $quantity++;
                $total_size += filesize($modSettings['attachmentUploadDir'] . '/' . $attachID);
                $context['current_attachments'][] = array('name' => getAttachmentFilename($name, false, true), 'id' => $attachID);
            }
        }
        if (!empty($_POST['attach_del'])) {
            $del_temp = array();
            foreach ($_POST['attach_del'] as $i => $dummy) {
                $del_temp[$i] = (int) $dummy;
            }
            foreach ($context['current_attachments'] as $k => $dummy) {
                if (!in_array($dummy['id'], $del_temp)) {
                    $context['current_attachments'][$k]['unchecked'] = true;
                    $deleted_attachments = !isset($deleted_attachments) || is_bool($deleted_attachments) ? 1 : $deleted_attachments + 1;
                    $quantity--;
                }
            }
        }
        if (!empty($_FILES['attachment'])) {
            foreach ($_FILES['attachment']['tmp_name'] as $n => $dummy) {
                if ($_FILES['attachment']['name'][$n] == '') {
                    continue;
                }
                if (!is_uploaded_file($_FILES['attachment']['tmp_name'][$n]) || @ini_get('open_basedir') == '' && !file_exists($_FILES['attachment']['tmp_name'][$n])) {
                    fatal_lang_error('smf124');
                }
                if (!empty($modSettings['attachmentSizeLimit']) && $_FILES['attachment']['size'][$n] > $modSettings['attachmentSizeLimit'] * 1024) {
                    fatal_lang_error('smf122', false, array($modSettings['attachmentSizeLimit']));
                }
                $quantity++;
                if (!empty($modSettings['attachmentNumPerPostLimit']) && $quantity > $modSettings['attachmentNumPerPostLimit']) {
                    fatal_lang_error('attachments_limit_per_post', false, array($modSettings['attachmentNumPerPostLimit']));
                }
                $total_size += $_FILES['attachment']['size'][$n];
                if (!empty($modSettings['attachmentPostLimit']) && $total_size > $modSettings['attachmentPostLimit'] * 1024) {
                    fatal_lang_error('smf122', false, array($modSettings['attachmentPostLimit']));
                }
                if (!empty($modSettings['attachmentCheckExtensions'])) {
                    if (!in_array(strtolower(substr(strrchr($_FILES['attachment']['name'][$n], '.'), 1)), explode(',', strtolower($modSettings['attachmentExtensions'])))) {
                        fatal_error($_FILES['attachment']['name'][$n] . '.<br />' . $txt['smf123'] . ' ' . $modSettings['attachmentExtensions'] . '.', false);
                    }
                }
                if (!empty($modSettings['attachmentDirSizeLimit'])) {
                    // Make sure the directory isn't full.
                    $dirSize = 0;
                    $dir = @opendir($modSettings['attachmentUploadDir']) or fatal_lang_error('smf115b');
                    while ($file = readdir($dir)) {
                        if (substr($file, 0, -1) == '.') {
                            continue;
                        }
                        if (preg_match('~^post_tmp_\\d+_\\d+$~', $file) != 0) {
                            // Temp file is more than 5 hours old!
                            if (filemtime($modSettings['attachmentUploadDir'] . '/' . $file) < time() - 18000) {
                                @unlink($modSettings['attachmentUploadDir'] . '/' . $file);
                            }
                            continue;
                        }
                        $dirSize += filesize($modSettings['attachmentUploadDir'] . '/' . $file);
                    }
                    closedir($dir);
                    // Too big!  Maybe you could zip it or something...
                    if ($_FILES['attachment']['size'][$n] + $dirSize > $modSettings['attachmentDirSizeLimit'] * 1024) {
                        fatal_lang_error('smf126');
                    }
                }
                if (!is_writable($modSettings['attachmentUploadDir'])) {
                    fatal_lang_error('attachments_no_write');
                }
                $attachID = 'post_tmp_' . $ID_MEMBER . '_' . $temp_start++;
                $_SESSION['temp_attachments'][$attachID] = stripslashes(basename($_FILES['attachment']['name'][$n]));
                $context['current_attachments'][] = array('name' => basename(stripslashes($_FILES['attachment']['name'][$n])), 'id' => $attachID);
                $destName = $modSettings['attachmentUploadDir'] . '/' . $attachID;
                if (!move_uploaded_file($_FILES['attachment']['tmp_name'][$n], $destName)) {
                    fatal_lang_error('smf124');
                }
                @chmod($destName, 0644);
            }
        }
    }
    // If we are coming here to make a reply, and someone has already replied... make a special warning message.
    if (isset($newRepliesError)) {
        $context['post_error']['messages'][] = $newRepliesError == 1 ? $txt['error_new_reply'] : $txt['error_new_replies'];
        $context['error_type'] = 'minor';
    }
    if (isset($oldTopicError)) {
        $context['post_error']['messages'][] = $txt['error_old_topic'];
        $context['error_type'] = 'minor';
    }
    // What are you doing?  Posting a poll, modifying, previewing, new post, or reply...
    if (isset($_REQUEST['poll'])) {
        $context['page_title'] = $txt['smf20'];
    } elseif ($context['make_event']) {
        $context['page_title'] = $context['event']['id'] == -1 ? $txt['calendar23'] : $txt['calendar20'];
    } elseif (isset($_REQUEST['msg'])) {
        $context['page_title'] = $txt[66];
    } elseif (isset($_REQUEST['subject'], $context['preview_subject'])) {
        $context['page_title'] = $txt[507] . ' - ' . strip_tags($context['preview_subject']);
    } elseif (empty($topic)) {
        $context['page_title'] = $txt[33];
    } else {
        $context['page_title'] = $txt[25];
    }
    // Build the link tree.
    if (empty($topic)) {
        $context['linktree'][] = array('name' => '<i>' . $txt[33] . '</i>');
    } else {
        $context['linktree'][] = array('url' => $scripturl . '?topic=' . $topic . '.' . $_REQUEST['start'], 'name' => $form_subject, 'extra_before' => '<span' . ($settings['linktree_inline'] ? ' class="smalltext"' : '') . '><b class="nav">' . $context['page_title'] . ' ( </b></span>', 'extra_after' => '<span' . ($settings['linktree_inline'] ? ' class="smalltext"' : '') . '><b class="nav"> )</b></span>');
    }
    // If they've unchecked an attachment, they may still want to attach that many more files, but don't allow more than num_allowed_attachments.
    // !!! This won't work if you're posting an event.
    $context['num_allowed_attachments'] = min($modSettings['attachmentNumPerPostLimit'] - count($context['current_attachments']) + (isset($deleted_attachments) ? $deleted_attachments : 0), $modSettings['attachmentNumPerPostLimit']);
    $context['can_post_attachment'] = !empty($modSettings['attachmentEnable']) && $modSettings['attachmentEnable'] == 1 && allowedTo('post_attachment') && $context['num_allowed_attachments'] > 0;
    $context['subject'] = addcslashes($form_subject, '"');
    $context['message'] = str_replace(array('"', '<', '>', '  '), array('&quot;', '&lt;', '&gt;', ' &nbsp;'), $form_message);
    $context['attached'] = '';
    $context['allowed_extensions'] = strtr($modSettings['attachmentExtensions'], array(',' => ', '));
    $context['make_poll'] = isset($_REQUEST['poll']);
    // Message icons - customized icons are off?
    if (empty($modSettings['messageIcons_enable'])) {
        $context['icons'] = array(array('value' => 'xx', 'name' => $txt[281]), array('value' => 'thumbup', 'name' => $txt[282]), array('value' => 'thumbdown', 'name' => $txt[283]), array('value' => 'exclamation', 'name' => $txt[284]), array('value' => 'question', 'name' => $txt[285]), array('value' => 'lamp', 'name' => $txt[286]), array('value' => 'smiley', 'name' => $txt[287]), array('value' => 'angry', 'name' => $txt[288]), array('value' => 'cheesy', 'name' => $txt[289]), array('value' => 'grin', 'name' => $txt[293]), array('value' => 'sad', 'name' => $txt[291]), array('value' => 'wink', 'name' => $txt[292]));
        foreach ($context['icons'] as $k => $dummy) {
            $context['icons'][$k]['url'] = $settings['images_url'] . '/post/' . $dummy['value'] . '.gif';
            $context['icons'][$k]['is_last'] = false;
        }
        $context['icon_url'] = $settings['images_url'] . '/post/' . $context['icon'] . '.gif';
    } else {
        // Regardless of what *should* exist, let's do this properly.
        $stable_icons = array('xx', 'thumbup', 'thumbdown', 'exclamation', 'question', 'lamp', 'smiley', 'angry', 'cheesy', 'grin', 'sad', 'wink', 'moved', 'recycled', 'wireless');
        $context['icon_sources'] = array();
        foreach ($stable_icons as $icon) {
            $context['icon_sources'][$icon] = 'images_url';
        }
        // Array for all icons that need to revert to the default theme!
        $context['javascript_icons'] = array();
        if (($temp = cache_get_data('posting_icons-' . $board, 480)) == null) {
            $request = db_query("\n\t\t\t\tSELECT title, filename\n\t\t\t\tFROM {$db_prefix}message_icons\n\t\t\t\tWHERE ID_BOARD IN (0, {$board})", __FILE__, __LINE__);
            $icon_data = array();
            while ($row = mysql_fetch_assoc($request)) {
                $icon_data[] = $row;
            }
            mysql_free_result($request);
            cache_put_data('posting_icons-' . $board, $icon_data, 480);
        } else {
            $icon_data = $temp;
        }
        $context['icons'] = array();
        foreach ($icon_data as $icon) {
            if (!isset($context['icon_sources'][$icon['filename']])) {
                $context['icon_sources'][$icon['filename']] = file_exists($settings['theme_dir'] . '/images/post/' . $icon['filename'] . '.gif') ? 'images_url' : 'default_images_url';
            }
            // If the icon exists only in the default theme, ensure the javascript popup respects this.
            if ($context['icon_sources'][$icon['filename']] == 'default_images_url') {
                $context['javascript_icons'][] = $icon['filename'];
            }
            $context['icons'][] = array('value' => $icon['filename'], 'name' => $icon['title'], 'url' => $settings[$context['icon_sources'][$icon['filename']]] . '/post/' . $icon['filename'] . '.gif', 'is_last' => false);
        }
        $context['icon_url'] = $settings[isset($context['icon_sources'][$context['icon']]) ? $context['icon_sources'][$context['icon']] : 'images_url'] . '/post/' . $context['icon'] . '.gif';
    }
    if (!empty($context['icons'])) {
        $context['icons'][count($context['icons']) - 1]['is_last'] = true;
    }
    $found = false;
    for ($i = 0, $n = count($context['icons']); $i < $n; $i++) {
        $context['icons'][$i]['selected'] = $context['icon'] == $context['icons'][$i]['value'];
        if ($context['icons'][$i]['selected']) {
            $found = true;
        }
    }
    if (!$found) {
        array_unshift($context['icons'], array('value' => $context['icon'], 'name' => $txt['current_icon'], 'url' => $context['icon_url'], 'is_last' => empty($context['icons']), 'selected' => true));
    }
    if (!empty($topic)) {
        getTopic();
    }
    $context['back_to_topic'] = isset($_REQUEST['goback']) || isset($_REQUEST['msg']) && !isset($_REQUEST['subject']);
    $context['show_additional_options'] = !empty($_POST['additional_options']) || !empty($_SESSION['temp_attachments']) || !empty($deleted_attachments);
    $context['is_new_topic'] = empty($topic);
    $context['is_new_post'] = !isset($_REQUEST['msg']);
    $context['is_first_post'] = $context['is_new_topic'] || isset($_REQUEST['msg']) && $_REQUEST['msg'] == $ID_FIRST_MSG;
    // Register this form in the session variables.
    checkSubmitOnce('register');
    // Finally, load the template.
    if (WIRELESS) {
        $context['sub_template'] = WIRELESS_PROTOCOL . '_post';
    } elseif (!isset($_REQUEST['xml'])) {
        loadTemplate('Post');
    }
}
Beispiel #2
0
function stripslashes__recursive($var, $level = 0)
{
    if (!is_array($var)) {
        return stripslashes($var);
    }
    // Reindex the array without slashes, this time.
    $new_var = array();
    // Strip the slashes from every element.
    foreach ($var as $k => $v) {
        $new_var[stripslashes($k)] = $level > 25 ? null : stripslashes__recursive($v, $level + 1);
    }
    return $new_var;
}
Beispiel #3
0
function ModifyProfile2()
{
    global $txt, $modSettings;
    global $cookiename, $context;
    global $sourcedir, $scripturl, $db_prefix;
    global $ID_MEMBER, $user_info;
    global $context, $newpassemail, $user_profile, $validationCode;
    loadLanguage('Profile');
    /* Set allowed sub-actions.
    
    	 The format of $sa_allowed is as follows:
    
    	$sa_allowed = array(
    		'sub-action' => array(permission_array_for_editing_OWN_profile, permission_array_for_editing_ANY_profile, session_validation_method[, require_password]),
    		...
    	);
    
    	*/
    $sa_allowed = array('account' => array(array('manage_membergroups', 'profile_identity_any', 'profile_identity_own'), array('manage_membergroups', 'profile_identity_any'), 'post', true), 'forumProfile' => array(array('profile_extra_any', 'profile_extra_own'), array('profile_extra_any'), 'post'), 'theme' => array(array('profile_extra_any', 'profile_extra_own'), array('profile_extra_any'), 'post'), 'notification' => array(array('profile_extra_any', 'profile_extra_own'), array('profile_extra_any'), 'post'), 'pmprefs' => array(array('profile_extra_any', 'profile_extra_own'), array('profile_extra_any'), 'post'), 'deleteAccount' => array(array('profile_remove_any', 'profile_remove_own'), array('profile_remove_any'), 'post', true), 'activateAccount' => array(array(), array('moderate_forum'), 'get'));
    // Is the current sub-action allowed?
    if (empty($_REQUEST['sa']) || !isset($sa_allowed[$_REQUEST['sa']])) {
        fatal_lang_error(453, false);
    }
    checkSession($sa_allowed[$_REQUEST['sa']][2]);
    // Start with no updates and no errors.
    $profile_vars = array();
    $post_errors = array();
    // Normally, don't send an email.
    $newpassemail = false;
    // Clean up the POST variables.
    $_POST = htmltrim__recursive($_POST);
    $_POST = stripslashes__recursive($_POST);
    $_POST = htmlspecialchars__recursive($_POST);
    $_POST = addslashes__recursive($_POST);
    // Search for the member being edited and put the information in $user_profile.
    $memberResult = loadMemberData((int) $_REQUEST['userID'], false, 'profile');
    if (!is_array($memberResult)) {
        fatal_lang_error(453, false);
    }
    list($memID) = $memberResult;
    // Are you modifying your own, or someone else's?
    if ($ID_MEMBER == $memID) {
        $context['user']['is_owner'] = true;
    } else {
        $context['user']['is_owner'] = false;
        validateSession();
    }
    // Check profile editing permissions.
    isAllowedTo($sa_allowed[$_REQUEST['sa']][$context['user']['is_owner'] ? 0 : 1]);
    // If this is yours, check the password.
    if ($context['user']['is_owner'] && !empty($sa_allowed[$_REQUEST['sa']][3])) {
        // You didn't even enter a password!
        if (trim($_POST['oldpasswrd']) == '') {
            $post_errors[] = 'no_password';
        }
        // Since the password got modified due to all the $_POST cleaning, lets undo it so we can get the correct password
        $_POST['oldpasswrd'] = addslashes(un_htmlspecialchars(stripslashes($_POST['oldpasswrd'])));
        // Does the integration want to check passwords?
        $good_password = false;
        if (isset($modSettings['integrate_verify_password']) && function_exists($modSettings['integrate_verify_password'])) {
            if (call_user_func($modSettings['integrate_verify_password'], $user_profile[$memID]['memberName'], $_POST['oldpasswrd'], false) === true) {
                $good_password = true;
            }
        }
        // Bad password!!!
        if (!$good_password && $user_info['passwd'] != sha1(strtolower($user_profile[$memID]['memberName']) . $_POST['oldpasswrd'])) {
            $post_errors[] = 'bad_password';
        }
    }
    // No need for the sub action array.
    unset($sa_allowed);
    // If the user is an admin - see if they are resetting someones username.
    if ($user_info['is_admin'] && isset($_POST['memberName'])) {
        // We'll need this...
        require_once $sourcedir . '/Subs-Auth.php';
        // Do the reset... this will send them an email too.
        resetPassword($memID, $_POST['memberName']);
    }
    // Change the IP address in the database.
    if ($context['user']['is_owner']) {
        $profile_vars['memberIP'] = "'{$user_info['ip']}'";
    }
    // Now call the sub-action function...
    if (isset($_POST['sa']) && $_POST['sa'] == 'deleteAccount') {
        deleteAccount2($profile_vars, $post_errors, $memID);
        if (empty($post_errors)) {
            redirectexit();
        }
    } else {
        saveProfileChanges($profile_vars, $post_errors, $memID);
    }
    // There was a problem, let them try to re-enter.
    if (!empty($post_errors)) {
        // Load the language file so we can give a nice explanation of the errors.
        loadLanguage('Errors');
        $context['post_errors'] = $post_errors;
        $_REQUEST['sa'] = $_POST['sa'];
        $_REQUEST['u'] = $memID;
        return ModifyProfile($post_errors);
    }
    if (!empty($profile_vars)) {
        // If we've changed the password, notify any integration that may be listening in.
        if (isset($profile_vars['passwd']) && isset($modSettings['integrate_reset_pass']) && function_exists($modSettings['integrate_reset_pass'])) {
            call_user_func($modSettings['integrate_reset_pass'], $user_profile[$memID]['memberName'], $user_profile[$memID]['memberName'], $_POST['passwrd1']);
        }
        updateMemberData($memID, $profile_vars);
    }
    // What if this is the newest member?
    if ($modSettings['latestMember'] == $memID) {
        updateStats('member');
    } elseif (isset($profile_vars['realName'])) {
        updateSettings(array('memberlist_updated' => time()));
    }
    // If the member changed his/her birthdate, update calendar statistics.
    if (isset($profile_vars['birthdate']) || isset($profile_vars['realName'])) {
        updateStats('calendar');
    }
    // Send an email?
    if ($newpassemail) {
        require_once $sourcedir . '/Subs-Post.php';
        // Send off the email.
        sendmail($_POST['emailAddress'], $txt['activate_reactivate_title'] . ' ' . $context['forum_name'], "{$txt['activate_reactivate_mail']}\n\n" . "{$scripturl}?action=activate;u={$memID};code={$validationCode}\n\n" . "{$txt['activate_code']}: {$validationCode}\n\n" . $txt[130]);
        // Log the user out.
        db_query("\n\t\t\tDELETE FROM {$db_prefix}log_online\n\t\t\tWHERE ID_MEMBER = {$memID}", __FILE__, __LINE__);
        $_SESSION['log_time'] = 0;
        $_SESSION['login_' . $cookiename] = serialize(array(0, '', 0));
        if (isset($_COOKIE[$cookiename])) {
            $_COOKIE[$cookiename] = '';
        }
        loadUserSettings();
        $context['user']['is_logged'] = false;
        $context['user']['is_guest'] = true;
        // Send them to the done-with-registration-login screen.
        loadTemplate('Register');
        $context += array('page_title' => &$txt[79], 'sub_template' => 'after', 'description' => &$txt['activate_changed_email']);
        return;
    } elseif ($context['user']['is_owner']) {
        // Log them back in.
        if (isset($_POST['passwrd1']) && $_POST['passwrd1'] != '') {
            require_once $sourcedir . '/Subs-Auth.php';
            setLoginCookie(60 * $modSettings['cookieTime'], $memID, sha1(sha1(strtolower($user_profile[$memID]['memberName']) . un_htmlspecialchars(stripslashes($_POST['passwrd1']))) . $user_profile[$memID]['passwordSalt']));
        }
        loadUserSettings();
        writeLog();
    }
    // Back to same subaction page..
    redirectexit('action=profile;u=' . $memID . ';sa=' . $_REQUEST['sa'], isset($_POST['passwrd1']) && $context['server']['needs_login_fix'] || $context['browser']['is_ie'] && isset($_FILES['attachment']));
}
Beispiel #4
0
function ModifyCoreSettings2()
{
    global $boarddir, $sc, $cookiename, $modSettings, $user_settings, $sourcedir;
    global $context;
    // Strip the slashes off of the post vars.
    foreach ($_POST as $key => $val) {
        $_POST[$key] = stripslashes__recursive($val);
    }
    // Fix the darn stupid cookiename! (more may not be allowed, but these for sure!)
    if (isset($_POST['cookiename'])) {
        $_POST['cookiename'] = preg_replace('~[,;\\s\\.$]+~' . ($context['utf8'] ? 'u' : ''), '', $_POST['cookiename']);
    }
    // Fix the forum's URL if necessary.
    if (substr($_POST['boardurl'], -10) == '/index.php') {
        $_POST['boardurl'] = substr($_POST['boardurl'], 0, -10);
    } elseif (substr($_POST['boardurl'], -1) == '/') {
        $_POST['boardurl'] = substr($_POST['boardurl'], 0, -1);
    }
    if (substr($_POST['boardurl'], 0, 7) != 'http://' && substr($_POST['boardurl'], 0, 7) != 'file://' && substr($_POST['boardurl'], 0, 8) != 'https://') {
        $_POST['boardurl'] = 'http://' . $_POST['boardurl'];
    }
    // Any passwords?
    $config_passwords = array('db_passwd');
    // All the strings to write.
    $config_strs = array('mtitle', 'mmessage', 'language', 'mbname', 'boardurl', 'cookiename', 'webmaster_email', 'db_name', 'db_user', 'db_server', 'db_prefix', 'boarddir', 'sourcedir');
    // All the numeric variables.
    $config_ints = array();
    // All the checkboxes.
    $config_bools = array('db_persist', 'db_error_send', 'maintenance');
    // Now sort everything into a big array, and figure out arrays and etc.
    $config_vars = array();
    foreach ($config_passwords as $config_var) {
        if (isset($_POST[$config_var][1]) && $_POST[$config_var][0] == $_POST[$config_var][1]) {
            $config_vars[$config_var] = '\'' . addcslashes($_POST[$config_var][0], "'\\") . '\'';
        }
    }
    foreach ($config_strs as $config_var) {
        if (isset($_POST[$config_var])) {
            $config_vars[$config_var] = '\'' . addcslashes($_POST[$config_var], "'\\") . '\'';
        }
    }
    foreach ($config_ints as $config_var) {
        if (isset($_POST[$config_var])) {
            $config_vars[$config_var] = (int) $_POST[$config_var];
        }
    }
    foreach ($config_bools as $key) {
        if (!empty($_POST[$key])) {
            $config_vars[$key] = '1';
        } else {
            $config_vars[$key] = '0';
        }
    }
    require_once $sourcedir . '/Admin.php';
    updateSettingsFile($config_vars);
    // If the cookie name was changed, reset the cookie.
    if (isset($config_vars['cookiename']) && $cookiename != $_POST['cookiename']) {
        include_once $sourcedir . '/Subs-Auth.php';
        $cookiename = $_POST['cookiename'];
        setLoginCookie(60 * $modSettings['cookieTime'], $user_settings['ID_MEMBER'], sha1($user_settings['passwd'] . $user_settings['passwordSalt']));
        redirectexit('action=serversettings;sa=core;sesc=' . $sc, $context['server']['needs_login_fix']);
    }
    redirectexit('action=serversettings;sa=core;sesc=' . $sc);
}
Beispiel #5
0
function mob_update_email($rpcmsg)
{
    global $txt, $modSettings;
    global $cookiename, $context;
    global $sourcedir, $scripturl, $db_prefix;
    global $ID_MEMBER, $user_info;
    global $newpassemail, $user_profile, $validationCode;
    loadLanguage('Profile');
    // Start with no updates and no errors.
    $profile_vars = array();
    $post_errors = array();
    $_POST['oldpasswrd'] = $rpcmsg->getParam(0) ? $rpcmsg->getScalarValParam(0) : '';
    $_POST['emailAddress'] = $rpcmsg->getParam(1) ? $rpcmsg->getScalarValParam(1) : '';
    // Clean up the POST variables.
    $_POST = htmltrim__recursive($_POST);
    $_POST = stripslashes__recursive($_POST);
    $_POST = htmlspecialchars__recursive($_POST);
    $_POST = addslashes__recursive($_POST);
    $memberResult = loadMemberData($ID_MEMBER, false, 'profile');
    if (!is_array($memberResult)) {
        fatal_lang_error(453, false);
    }
    $memID = $ID_MEMBER;
    $newpassemail = false;
    $context['user']['is_owner'] = true;
    isAllowedTo(array('manage_membergroups', 'profile_identity_any', 'profile_identity_own'));
    // You didn't even enter a password!
    if (trim($_POST['oldpasswrd']) == '') {
        fatal_error($txt['profile_error_no_password']);
    }
    // This block is only concerned with email address validation..
    if (strtolower($_POST['emailAddress']) != strtolower($user_profile[$memID]['emailAddress'])) {
        $_POST['emailAddress'] = strtr($_POST['emailAddress'], array('&#039;' => '\\\''));
        // Prepare the new password, or check if they want to change their own.
        if (!empty($modSettings['send_validation_onChange']) && !allowedTo('moderate_forum')) {
            require_once $sourcedir . '/Subs-Members.php';
            $validationCode = generateValidationCode();
            $profile_vars['validation_code'] = '\'' . $validationCode . '\'';
            $profile_vars['is_activated'] = '2';
            $newpassemail = true;
        }
        // Check the name and email for validity.
        if (trim($_POST['emailAddress']) == '') {
            fatal_error($txt['profile_error_no_email']);
        }
        if (preg_match('~^[0-9A-Za-z=_+\\-/][0-9A-Za-z=_\'+\\-/\\.]*@[\\w\\-]+(\\.[\\w\\-]+)*(\\.[\\w]{2,6})$~', stripslashes($_POST['emailAddress'])) == 0) {
            fatal_error($txt['profile_error_bad_email']);
        }
        // Email addresses should be and stay unique.
        $request = db_query("\n            SELECT ID_MEMBER\n            FROM {$db_prefix}members\n            WHERE ID_MEMBER != {$memID}\n                AND emailAddress = '{$_POST['emailAddress']}'\n            LIMIT 1", __FILE__, __LINE__);
        if (mysql_num_rows($request) > 0) {
            fatal_error($txt['profile_error_email_taken']);
        }
        mysql_free_result($request);
        $profile_vars['emailAddress'] = '\'' . $_POST['emailAddress'] . '\'';
    }
    if (!empty($profile_vars)) {
        updateMemberData($memID, $profile_vars);
    }
    // Send an email?
    if ($newpassemail) {
        require_once $sourcedir . '/Subs-Post.php';
        // Send off the email.
        sendmail($_POST['emailAddress'], $txt['activate_reactivate_title'] . ' ' . $context['forum_name'], "{$txt['activate_reactivate_mail']}\n\n" . "{$scripturl}?action=activate;u={$memID};code={$validationCode}\n\n" . "{$txt['activate_code']}: {$validationCode}\n\n" . $txt[130]);
        // Log the user out.
        db_query("\n            DELETE FROM {$db_prefix}log_online\n            WHERE ID_MEMBER = {$memID}", __FILE__, __LINE__);
        $_SESSION['log_time'] = 0;
        $_SESSION['login_' . $cookiename] = serialize(array(0, '', 0));
    }
    $response = array('result' => new xmlrpcval(true, 'boolean'), 'result_text' => new xmlrpcval('', 'base64'));
    return new xmlrpcresp(new xmlrpcval($response, 'struct'));
}
Beispiel #6
0
function ViewMemberlist()
{
    global $txt, $scripturl, $db_prefix, $context, $modSettings, $sourcedir;
    // Set the current sub action.
    $context['sub_action'] = $_REQUEST['sa'];
    // Are we performing a delete?
    if (isset($_POST['delete_members']) && !empty($_POST['delete']) && allowedTo('profile_remove_any')) {
        checkSession();
        // Clean the input.
        foreach ($_POST['delete'] as $key => $value) {
            $_POST['delete'][$key] = (int) $value;
        }
        // Delete all the selected members.
        require_once $sourcedir . '/Subs-Members.php';
        deleteMembers($_POST['delete']);
    }
    // Build a search for a specific group or post group.
    if ($context['sub_action'] === 'query') {
        if (isset($_GET['group'])) {
            $_POST['membergroups'] = array(array((int) $_GET['group']), array((int) $_GET['group']));
        } elseif (isset($_GET['pgroup'])) {
            $_POST['postgroups'] = array((int) $_GET['pgroup']);
        }
    }
    if ($context['sub_action'] == 'query' && !empty($_REQUEST['params']) && empty($_POST)) {
        $search_params = base64_decode(stripslashes($_REQUEST['params']));
        $_POST += addslashes__recursive(@unserialize($search_params));
    }
    // Check input after a member search has been submitted.
    if ($context['sub_action'] == 'query') {
        // Retrieving the membergroups and postgroups.
        $context['membergroups'] = array(array('id' => 0, 'name' => $txt['membergroups_members'], 'can_be_additional' => false));
        $context['postgroups'] = array();
        $request = db_query("\n\t\t\tSELECT ID_GROUP, groupName, minPosts\n\t\t\tFROM {$db_prefix}membergroups\n\t\t\tWHERE ID_GROUP != 3\n\t\t\tORDER BY minPosts, IF(ID_GROUP < 4, ID_GROUP, 4), groupName", __FILE__, __LINE__);
        while ($row = mysql_fetch_assoc($request)) {
            if ($row['minPosts'] == -1) {
                $context['membergroups'][] = array('id' => $row['ID_GROUP'], 'name' => $row['groupName'], 'can_be_additional' => true);
            } else {
                $context['postgroups'][] = array('id' => $row['ID_GROUP'], 'name' => $row['groupName']);
            }
        }
        mysql_free_result($request);
        // Some data about the form fields and how they are linked to the database.
        $params = array('mem_id' => array('db_fields' => array('ID_MEMBER'), 'type' => 'int', 'range' => true), 'age' => array('db_fields' => array('birthdate'), 'type' => 'age', 'range' => true), 'posts' => array('db_fields' => array('posts'), 'type' => 'int', 'range' => true), 'reg_date' => array('db_fields' => array('dateRegistered'), 'type' => 'date', 'range' => true), 'last_online' => array('db_fields' => array('lastLogin'), 'type' => 'date', 'range' => true), 'gender' => array('db_fields' => array('gender'), 'type' => 'checkbox', 'values' => array('0', '1', '2')), 'activated' => array('db_fields' => array('IF(is_activated IN (1, 11), 1, 0)'), 'type' => 'checkbox', 'values' => array('0', '1')), 'membername' => array('db_fields' => array('memberName', 'realName'), 'type' => 'string'), 'email' => array('db_fields' => array('emailAddress'), 'type' => 'string'), 'website' => array('db_fields' => array('websiteTitle', 'websiteUrl'), 'type' => 'string'), 'location' => array('db_fields' => array('location'), 'type' => 'string'), 'ip' => array('db_fields' => array('memberIP'), 'type' => 'string'), 'messenger' => array('db_fields' => array('ICQ', 'AIM', 'YIM', 'MSN'), 'type' => 'string'));
        $range_trans = array('--' => '<', '-' => '<=', '=' => '=', '+' => '>=', '++' => '>');
        // !!! Validate a little more.
        // Loop through every field of the form.
        $query_parts = array();
        foreach ($params as $param_name => $param_info) {
            // Not filled in?
            if (!isset($_POST[$param_name]) || $_POST[$param_name] == '') {
                continue;
            }
            // Make sure numeric values are really numeric.
            if (in_array($param_info['type'], array('int', 'age'))) {
                $_POST[$param_name] = (int) $_POST[$param_name];
            } elseif ($param_info['type'] == 'date') {
                // Check if this date format is valid.
                if (preg_match('/^\\d{4}-\\d{1,2}-\\d{1,2}$/', $_POST[$param_name]) == 0) {
                    continue;
                }
                $_POST[$param_name] = strtotime($_POST[$param_name]);
            }
            // Those values that are in some kind of range (<, <=, =, >=, >).
            if (!empty($param_info['range'])) {
                // Default to '=', just in case...
                if (empty($range_trans[$_POST['types'][$param_name]])) {
                    $_POST['types'][$param_name] = '=';
                }
                // Handle special case 'age'.
                if ($param_info['type'] == 'age') {
                    // All people that were born between $lowerlimit and $upperlimit are currently the specified age.
                    $datearray = getdate(forum_time());
                    $upperlimit = sprintf('%04d-%02d-%02d', $datearray['year'] - $_POST[$param_name], $datearray['mon'], $datearray['mday']);
                    $lowerlimit = sprintf('%04d-%02d-%02d', $datearray['year'] - $_POST[$param_name] - 1, $datearray['mon'], $datearray['mday']);
                    if (in_array($_POST['types'][$param_name], array('-', '--', '='))) {
                        $query_parts[] = "{$param_info['db_fields'][0]} > '" . ($_POST['types'][$param_name] == '--' ? $upperlimit : $lowerlimit) . "'";
                    }
                    if (in_array($_POST['types'][$param_name], array('+', '++', '='))) {
                        $query_parts[] = "{$param_info['db_fields'][0]} <= '" . ($_POST['types'][$param_name] == '++' ? $lowerlimit : $upperlimit) . "'";
                        // Make sure that members that didn't set their birth year are not queried.
                        $query_parts[] = "{$param_info['db_fields'][0]} > '0000-12-31'";
                    }
                } elseif ($param_info['type'] == 'date' && $_POST['types'][$param_name] == '=') {
                    $query_parts[] = $param_info['db_fields'][0] . ' > ' . $_POST[$param_name] . ' AND ' . $param_info['db_fields'][0] . ' < ' . ($_POST[$param_name] + 86400);
                } else {
                    $query_parts[] = $param_info['db_fields'][0] . ' ' . $range_trans[$_POST['types'][$param_name]] . ' ' . $_POST[$param_name];
                }
            } elseif ($param_info['type'] == 'checkbox') {
                // Each checkbox or no checkbox at all is checked -> ignore.
                if (!is_array($_POST[$param_name]) || count($_POST[$param_name]) == 0 || count($_POST[$param_name]) == count($param_info['values'])) {
                    continue;
                }
                $query_parts[] = "{$param_info['db_fields'][0]} IN ('" . implode("', '", $_POST[$param_name]) . "')";
            } else {
                // Replace the wildcard characters ('*' and '?') into MySQL ones.
                $_POST[$param_name] = strtolower(addslashes(strtr($_POST[$param_name], array('%' => '\\%', '_' => '\\_', '*' => '%', '?' => '_'))));
                $query_parts[] = '(' . implode(" LIKE '%{$_POST[$param_name]}%' OR ", $param_info['db_fields']) . " LIKE '%{$_POST[$param_name]}%')";
            }
        }
        // Set up the membergroup query part.
        $mg_query_parts = array();
        // Primary membergroups, but only if at least was was not selected.
        if (!empty($_POST['membergroups'][1]) && count($context['membergroups']) != count($_POST['membergroups'][1])) {
            $mg_query_parts[] = "ID_GROUP IN (" . implode(", ", $_POST['membergroups'][1]) . ")";
        }
        // Additional membergroups (these are only relevant if not all primary groups where selected!).
        if (!empty($_POST['membergroups'][2]) && (empty($_POST['membergroups'][1]) || count($context['membergroups']) != count($_POST['membergroups'][1]))) {
            foreach ($_POST['membergroups'][2] as $mg) {
                $mg_query_parts[] = "FIND_IN_SET(" . (int) $mg . ", additionalGroups)";
            }
        }
        // Combine the one or two membergroup parts into one query part linked with an OR.
        if (!empty($mg_query_parts)) {
            $query_parts[] = '(' . implode(' OR ', $mg_query_parts) . ')';
        }
        // Get all selected post count related membergroups.
        if (!empty($_POST['postgroups']) && count($_POST['postgroups']) != count($context['postgroups'])) {
            $query_parts[] = "ID_POST_GROUP IN (" . implode(", ", $_POST['postgroups']) . ")";
        }
        // Construct the where part of the query.
        $where = empty($query_parts) ? '1' : implode('
			AND ', $query_parts);
        $search_params = base64_encode(serialize(stripslashes__recursive($_POST)));
    } else {
        $search_params = null;
    }
    // Construct the additional URL part with the query info in it.
    $context['params_url'] = $context['sub_action'] == 'query' ? ';sa=query;params=' . $search_params : '';
    // Get the title and sub template ready..
    $context['page_title'] = $txt[9];
    $context['sub_template'] = 'view_members';
    // Determine whether to show the 'delete members' checkboxes.
    $context['can_delete_members'] = allowedTo('profile_remove_any');
    // All the columns they have to pick from...
    $context['columns'] = array('ID_MEMBER' => array('label' => $txt['member_id']), 'memberName' => array('label' => $txt[35]), 'realName' => array('label' => $txt['display_name']), 'emailAddress' => array('label' => $txt['email_address']), 'memberIP' => array('label' => $txt['ip_address']), 'lastLogin' => array('label' => $txt['viewmembers_online']), 'posts' => array('label' => $txt[26]));
    // Default sort column to 'memberName' if the current one is unknown or not set.
    if (!isset($_REQUEST['sort']) || !isset($context['columns'][$_REQUEST['sort']])) {
        $_REQUEST['sort'] = 'memberName';
    }
    // Provide extra information about each column - the link, whether it's selected, etc.
    foreach ($context['columns'] as $col => $dummy) {
        $context['columns'][$col]['href'] = $scripturl . '?action=viewmembers' . $context['params_url'] . ';sort=' . $col . ';start=0';
        if (!isset($_REQUEST['desc']) && $col == $_REQUEST['sort']) {
            $context['columns'][$col]['href'] .= ';desc';
        }
        $context['columns'][$col]['link'] = '<a href="' . $context['columns'][$col]['href'] . '">' . $context['columns'][$col]['label'] . '</a>';
        $context['columns'][$col]['selected'] = $_REQUEST['sort'] == $col;
    }
    $context['sort_by'] = $_REQUEST['sort'];
    $context['sort_direction'] = !isset($_REQUEST['desc']) ? 'down' : 'up';
    // Calculate the number of results.
    if (empty($where) or $where == '1') {
        $num_members = $modSettings['totalMembers'];
    } else {
        $request = db_query("\n\t\t\tSELECT COUNT(*)\n\t\t\tFROM {$db_prefix}members\n\t\t\tWHERE {$where}", __FILE__, __LINE__);
        list($num_members) = mysql_fetch_row($request);
        mysql_free_result($request);
    }
    // Construct the page links.
    $context['page_index'] = constructPageIndex($scripturl . '?action=viewmembers' . $context['params_url'] . ';sort=' . $_REQUEST['sort'] . (isset($_REQUEST['desc']) ? ';desc' : ''), $_REQUEST['start'], $num_members, $modSettings['defaultMaxMembers']);
    $context['start'] = (int) $_REQUEST['start'];
    $request = db_query("\n\t\tSELECT ID_MEMBER, memberName, realName, emailAddress, memberIP, lastLogin, posts, is_activated\n\t\tFROM {$db_prefix}members" . ($context['sub_action'] == 'query' && !empty($where) ? "\n\t\tWHERE {$where}" : '') . "\n\t\tORDER BY {$_REQUEST['sort']}" . (!isset($_REQUEST['desc']) ? '' : ' DESC') . "\n\t\tLIMIT {$context['start']}, {$modSettings['defaultMaxMembers']}", __FILE__, __LINE__);
    while ($row = mysql_fetch_assoc($request)) {
        // Calculate number of days since last online.
        if (empty($row['lastLogin'])) {
            $difference = $txt['never'];
        } else {
            // Today or some time ago?
            $difference = jeffsdatediff($row['lastLogin']);
            if (empty($difference)) {
                $difference = $txt['viewmembers_today'];
            } elseif ($difference == 1) {
                $difference .= ' ' . $txt['viewmembers_day_ago'];
            } else {
                $difference .= ' ' . $txt['viewmembers_days_ago'];
            }
        }
        // Show it in italics if they're not activated...
        if ($row['is_activated'] % 10 != 1) {
            $difference = '<i title="' . $txt['not_activated'] . '">' . $difference . '</i>';
        }
        $context['members'][] = array('id' => $row['ID_MEMBER'], 'username' => $row['memberName'], 'name' => $row['realName'], 'email' => $row['emailAddress'], 'ip' => $row['memberIP'], 'last_active' => $difference, 'is_activated' => $row['is_activated'] % 10 == 1, 'posts' => $row['posts'], 'href' => $scripturl . '?action=profile;u=' . $row['ID_MEMBER'], 'link' => '<a href="' . $scripturl . '?action=profile;u=' . $row['ID_MEMBER'] . '">' . $row['realName'] . '</a>');
    }
    mysql_free_result($request);
}
function method_get_participated_topic()
{
    global $context, $mobdb, $mobsettings, $modSettings, $user_info, $sourcedir;
    // Guest?
    if ($user_info['is_guest']) {
        createErrorResponse(21);
    }
    // Get the username
    $username = base64_decode($context['mob_request']['params'][0][0]);
    if (empty($username)) {
        createErrorResponse(8);
    }
    require_once $sourcedir . '/Subs-Auth.php';
    ######## Added by Sean##############
    $username = htmltrim__recursive($username);
    $username = stripslashes__recursive($username);
    $username = htmlspecialchars__recursive($username);
    $username = addslashes__recursive($username);
    ##################################################################
    // Does this user exist?
    $members = findMembers($username);
    if (empty($members)) {
        createErrorResponse(8);
    }
    $id_member = array_keys($members);
    $member = $members[$id_member[0]];
    if (empty($member)) {
        createErrorResponse(8);
    }
    // Do we have start num defined?
    if (isset($context['mob_request']['params'][1])) {
        $start_num = (int) $context['mob_request']['params'][1][0];
    }
    // Do we have last number defined?
    if (isset($context['mob_request']['params'][2])) {
        $last_num = (int) $context['mob_request']['params'][2][0];
    }
    // Perform some start/last num checks
    if (isset($start_num) && isset($last_num)) {
        if ($start_num > $last_num) {
            createErrorResponse(3);
        } elseif ($last_num - $start_num > 50) {
            $last_num = $start_num + 50;
        }
    }
    // Default number of topics per page
    $topics_per_page = 20;
    // Generate the limit clause
    $limit = '';
    if (!isset($start_num) && !isset($last_num)) {
        $start_num = 0;
        $limit = $topics_per_page;
    } elseif (isset($start_num) && !isset($last_num)) {
        $limit = $topics_per_page;
    } elseif (isset($start_num) && isset($last_num)) {
        $limit = $last_num - $start_num + 1;
    } elseif (empty($start_num) && empty($last_num)) {
        $start_num = 0;
        $limit = $topics_per_page;
    }
    // Get the count
    $mobdb->query('
        SELECT t.ID_TOPIC
        FROM {db_prefix}messages AS m
            INNER JOIN {db_prefix}topics AS t ON (m.ID_TOPIC = t.ID_TOPIC)
            INNER JOIN {db_prefix}boards AS b ON (b.ID_BOARD = t.ID_BOARD)
        WHERE {query_see_board}
            AND m.ID_MEMBER = {int:member}
        GROUP BY t.ID_TOPIC
        ORDER BY t.ID_TOPIC DESC', array('member' => $id_member[0]));
    $tids = array();
    while ($row = $mobdb->fetch_assoc()) {
        $tids[] = $row['ID_TOPIC'];
    }
    $mobdb->free_result();
    $count = count($tids);
    if ($limit + $start_num > $count) {
        $limit = $count - $start_num;
    }
    $tids = array_slice($tids, $start_num, $limit);
    $topics = array();
    if (count($tids)) {
        // Grab the topics
        $mobdb->query('
            SELECT t.ID_TOPIC AS id_topic, t.isSticky AS is_sticky, t.locked, fm.subject AS topic_title, t.numViews AS views, t.numReplies AS replies,
                    IFNULL(mem.ID_MEMBER, 0) AS id_member, mem.realName, mem.memberName, mem.avatar, IFNULL(a.ID_ATTACH, 0) AS id_attach, a.filename, a.attachmentType AS attachment_type,
                    IFNULL(lm.posterTime, fm.posterTime) AS last_message_time, ' . ($user_info['is_guest'] ? '0' : 'ln.ID_TOPIC AS is_notify, IFNULL(lt.ID_MSG, IFNULL(lmr.ID_MSG, -1)) + 1') . ' AS new_from,
                    IFNULL(lm.body, fm.body) AS body, lm.ID_MSG_MODIFIED AS id_msg_modified, b.name AS board_name, b.ID_BOARD AS id_board
            FROM {db_prefix}messages AS m
                INNER JOIN {db_prefix}topics AS t ON (m.ID_TOPIC = t.ID_TOPIC)
                INNER JOIN {db_prefix}messages AS fm ON (t.ID_FIRST_MSG = fm.ID_MSG)
                INNER JOIN {db_prefix}boards AS b ON (b.ID_BOARD = t.ID_BOARD)
                LEFT JOIN {db_prefix}messages AS lm ON (t.ID_LAST_MSG = lm.ID_MSG)
                LEFT JOIN {db_prefix}members AS mem ON (lm.ID_MEMBER = mem.ID_MEMBER)' . ($user_info['is_guest'] ? '' : '
                LEFT JOIN {db_prefix}log_topics AS lt ON (lt.ID_TOPIC = t.ID_TOPIC AND lt.ID_MEMBER = {int:current_member})
                LEFT JOIN {db_prefix}log_notify AS ln ON ((ln.ID_TOPIC = t.ID_TOPIC OR ln.ID_BOARD = t.ID_BOARD) AND ln.ID_MEMBER = {int:current_member})
                LEFT JOIN {db_prefix}log_mark_read AS lmr ON (lmr.ID_BOARD = t.ID_BOARD AND lmr.ID_MEMBER = {int:current_member})') . '
                LEFT JOIN {db_prefix}attachments AS a ON (a.ID_MEMBER = mem.ID_MEMBER)
            WHERE {query_see_board}
                AND m.ID_MEMBER = {int:member} AND t.ID_TOPIC IN ({array_int:topic_ids})
            ORDER BY lm.posterTime DESC', array('current_member' => $user_info['id'], 'member' => $id_member[0], 'topic_ids' => $tids));
        while ($row = $mobdb->fetch_assoc()) {
            // Add stuff to the array
            $topics[$row['id_topic']] = array('id' => $row['id_topic'], 'title' => processSubject($row['topic_title']), 'short_msg' => processShortContent($row['body']), 'replies' => $row['replies'], 'views' => $row['views'], 'poster' => array('id' => $row['id_member'], 'username' => $row['memberName'], 'post_name' => $row['realName'], 'avatar' => get_avatar($row)), 'is_new' => $user_info['is_guest'] ? 0 : $row['new_from'] <= $row['id_msg_modified'], 'board' => $row['id_board'], 'board_name' => $row['board_name'], 'post_time' => mobiquo_time($row['last_message_time']), 'is_marked_notify' => !empty($row['is_notify']), 'is_locked' => !empty($row['locked']));
        }
        $mobdb->free_result();
    }
    // LAME!
    outputRPCSubscribedTopics($topics, $count);
}