/
postcards.php
331 lines (296 loc) · 16.7 KB
/
postcards.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
<?php
/**************************************************************************
* *
* 4images - A Web Based Image Gallery Management System *
* ---------------------------------------------------------------- *
* *
* File: postcards.php *
* Copyright: (C) 2002-2012 Jan Sorgalla *
* Email: jan@4homepages.de *
* Web: http://www.4homepages.de *
* Scriptversion: 1.7.11 *
* *
* Never released without support from: Nicky (http://www.nicky.net) *
* *
**************************************************************************
* *
* Dieses Script ist KEINE Freeware. Bitte lesen Sie die Lizenz- *
* bedingungen (Lizenz.txt) für weitere Informationen. *
* --------------------------------------------------------------- *
* This script is NOT freeware! Please read the Copyright Notice *
* (Licence.txt) for further information. *
* *
*************************************************************************/
define('GET_CACHES', 1);
define('ROOT_PATH', './');
define('MAIN_SCRIPT', __FILE__);
include(ROOT_PATH.'global.php');
require(ROOT_PATH.'includes/sessions.php');
$user_access = get_permission();
if (isset($HTTP_GET_VARS[URL_POSTCARD_ID]) || isset($HTTP_POST_VARS[URL_POSTCARD_ID])) {
$postcard_id = (isset($HTTP_GET_VARS[URL_POSTCARD_ID])) ? trim($HTTP_GET_VARS[URL_POSTCARD_ID]) : trim($HTTP_POST_VARS[URL_POSTCARD_ID]);
}
else {
$postcard_id = 0;
}
if ($action == "") {
$action = ($postcard_id) ? "showcard" : "createcard";
}
if (isset($HTTP_GET_VARS['modifycard']) || isset($HTTP_POST_VARS['modifycard'])) {
$action = "modifycard";
}
$main_template = ($action == "createcard" || $action == "modifycard") ? "postcard_create" : (($action == "previewcard") ? "postcard_create" : "postcard_send");
include(ROOT_PATH.'includes/page_header.php');
$sendprocess = 0;
if ($action != "showcard") {
$sql = "SELECT i.cat_id, i.image_name, i.image_media_file, i.image_thumb_file, c.cat_name".get_user_table_field(", u.", "user_name")."
FROM (".IMAGES_TABLE." i, ".CATEGORIES_TABLE." c)
LEFT JOIN ".USERS_TABLE." u ON (".get_user_table_field("u.", "user_id")." = i.user_id)
WHERE i.image_id = $image_id";
$image_row = $site_db->query_firstrow($sql);
if (!$image_row) {
redirect($url);
}
$cat_id = $image_row['cat_id'];
$image_row['user_name'] = $image_row[$user_table_fields['user_name']];
if (!check_permission("auth_viewcat", $cat_id) || !check_permission("auth_viewimage", $cat_id) || !check_permission("auth_sendpostcard", $cat_id)) {
redirect($url);
}
}
if ($action == "sendcard") {
$expiry = time() - 60 * 60 * 24 * POSTCARD_EXPIRY;
$sql = "DELETE FROM ".POSTCARDS_TABLE."
WHERE (postcard_date < $expiry)";
$site_db->query($sql);
$bg_color = un_htmlspecialchars(trim($HTTP_POST_VARS['bg_color']));
$border_color = un_htmlspecialchars(trim($HTTP_POST_VARS['border_color']));
$font_color = un_htmlspecialchars(trim($HTTP_POST_VARS['font_color']));
$font_face = un_htmlspecialchars(trim($HTTP_POST_VARS['font_face']));
$sender_name = un_htmlspecialchars(trim($HTTP_POST_VARS['sender_name']));
$sender_email = un_htmlspecialchars(trim($HTTP_POST_VARS['sender_email']));
$recipient_name = un_htmlspecialchars(trim($HTTP_POST_VARS['recipient_name']));
$recipient_email = un_htmlspecialchars(trim($HTTP_POST_VARS['recipient_email']));
$headline = un_htmlspecialchars(trim($HTTP_POST_VARS['headline']));
$message = un_htmlspecialchars(trim($HTTP_POST_VARS['message']));
$message = strip_tags($message);
$captcha = (isset($HTTP_POST_VARS['captcha'])) ? un_htmlspecialchars(trim($HTTP_POST_VARS['captcha'])) : "";
$back_url = (!empty($HTTP_POST_VARS['back_url'])) ? un_htmlspecialchars(stripslashes(trim($HTTP_POST_VARS['back_url']))) : $site_sess->url(ROOT_PATH."index.php", "&");
$postcard_id = get_random_key(POSTCARDS_TABLE, "postcard_id");
$current_time = time();
if ($captcha_enable_postcards && !captcha_validate($captcha)) {
$msg .= (($msg != "") ? "<br />" : "").$lang['captcha_required'];
$action = "previewcard";
$main_template = "postcard_preview";
} else {
$sql = "INSERT INTO ".POSTCARDS_TABLE."
(postcard_id, image_id, postcard_date, postcard_bg_color, postcard_border_color, postcard_font_color, postcard_font_face, postcard_sender_name, postcard_sender_email, postcard_recipient_name, postcard_recipient_email, postcard_headline, postcard_message)
VALUES
('$postcard_id', $image_id, $current_time, '$bg_color', '$border_color', '$font_color', '$font_face', '$sender_name', '$sender_email', '$recipient_name', '$recipient_email', '$headline', '$message')";
$result = $site_db->query($sql);
if ($result) {
$postcard_url = $script_url."/postcards.php?".URL_POSTCARD_ID."=".$postcard_id;
include(ROOT_PATH.'includes/email.php');
$site_email = new Email();
$site_email->set_to(stripslashes($recipient_email));
$site_email->set_from(stripslashes($sender_email), stripslashes($sender_name));
$site_email->set_subject($lang['send_postcard_emailsubject']);
$site_email->register_vars(array(
"sender_name" => stripslashes($sender_name),
"sender_email" => stripslashes($sender_email),
"recipient_name" => stripslashes($recipient_name),
"postcard_url" => stripslashes($postcard_url),
"postcard_send_date" => format_date($config['date_format']." ".$config['time_format'], $current_time),
"site_name" => $config['site_name']
));
$site_email->set_body("postcard_message", $config['language_dir']);
$site_email->send_email();
$msg .= $lang['send_postcard_success'];
$msg .= "<br /><a href=\"".$back_url."\">".$lang['back_to_gallery']."</a>";
$action = "showcard";
}
else {
$msg = $lang['general_error'];
$action = "previewcard";
$main_template = "postcard_preview";
}
}
}
if ($action == "showcard") {
$expiry = time() - 60 * 60 * 24 * POSTCARD_EXPIRY;
$sql = "DELETE FROM ".POSTCARDS_TABLE."
WHERE (postcard_date < $expiry)";
$site_db->query($sql);
if (!$postcard_id){
redirect("index.php");
}
else {
$sql = "SELECT p.postcard_id, p.image_id, p.postcard_date, p.postcard_bg_color, p.postcard_border_color, p.postcard_font_color, p.postcard_font_face, p.postcard_sender_name, p.postcard_sender_email, p.postcard_recipient_name, p.postcard_recipient_email, p.postcard_headline, p.postcard_message, i.image_name, i.cat_id, i.image_media_file, i.image_thumb_file
FROM (".POSTCARDS_TABLE." p, ".IMAGES_TABLE." i)
WHERE p.postcard_id = '$postcard_id' AND p.image_id = i.image_id";
$image_row = $site_db->query_firstrow($sql);
if (!$image_row) {
show_error_page($lang['invalid_postcard_id']);
}
else {
$image = get_media_code($image_row['image_media_file'], $image_row['image_id'], $image_row['cat_id'], $image_row['image_name'], $mode, 1);
$thumbnail = get_thumbnail_code($image_row['image_media_file'], $image_row['image_thumb_file'], $image_row['image_id'], $image_row['cat_id'], $image_row['image_name'], $mode);
$image_name_link = "<a href=\"".$site_sess->url(ROOT_PATH."details.php?".URL_IMAGE_ID."=".$image_row['image_id'])."\">".format_text($image_row['image_name'])."</a>";
$site_template->register_vars(array(
"image" => $image,
"thumbnail" => $thumbnail,
"image_name_link" => $image_name_link,
"bg_color" => format_text($image_row['postcard_bg_color'], 2),
"border_color" => format_text($image_row['postcard_border_color'], 2),
"font_color" => format_text($image_row['postcard_font_color'], 2),
"font_face" => format_text($image_row['postcard_font_face'], 2),
"sender_name" => format_text($image_row['postcard_sender_name'], 2),
"sender_email" => format_text($image_row['postcard_sender_email'], 2),
"recipient_name" => format_text($image_row['postcard_recipient_name'], 2),
"recipient_email" => format_text($image_row['postcard_recipient_email'], 2),
"headline" => format_text($image_row['postcard_headline'], 2),
"message" => format_text($image_row['postcard_message'], 0)
));
}
}
}
if ($action == "previewcard") {
$error = 0;
$bg_color = un_htmlspecialchars(trim($HTTP_POST_VARS['bg_color']));
$border_color = un_htmlspecialchars(trim($HTTP_POST_VARS['border_color']));
$font_color = un_htmlspecialchars(trim($HTTP_POST_VARS['font_color']));
$font_face = un_htmlspecialchars(trim($HTTP_POST_VARS['font_face']));
$sender_name = un_htmlspecialchars(trim($HTTP_POST_VARS['sender_name']));
$sender_email = un_htmlspecialchars(trim($HTTP_POST_VARS['sender_email']));
$recipient_name = un_htmlspecialchars(trim($HTTP_POST_VARS['recipient_name']));
$recipient_email = un_htmlspecialchars(trim($HTTP_POST_VARS['recipient_email']));
$headline = un_htmlspecialchars(trim($HTTP_POST_VARS['headline']));
$message = un_htmlspecialchars(trim($HTTP_POST_VARS['message']));
$back_url = (!empty($HTTP_POST_VARS['back_url'])) ? un_htmlspecialchars(stripslashes(trim($HTTP_POST_VARS['back_url']))) : $site_sess->url(ROOT_PATH."index.php", "&");
if ($sender_name == "" || $sender_email == "" || $recipient_name == "" || $recipient_email == "" || $headline == "" || $message == "") {
$msg .= $lang['lostfield_error'];
$error = 1;
}
if (($sender_email != "" && !check_email($sender_email)) || ($recipient_email != "" && !check_email($recipient_email))) {
$msg .= (($msg != "") ? "<br />" : "").$lang['invalid_email_format'];
$error = 1;
}
if (!$error) {
$main_template = "postcard_preview";
$image = get_media_code($image_row['image_media_file'], $image_id, $cat_id, $image_row['image_name'], $mode, 1);
$thumbnail = get_thumbnail_code($image_row['image_media_file'], $image_row['image_thumb_file'], $image_id, $cat_id, $image_row['image_name'], $mode);
$site_template->register_vars(array(
"image" => $image,
"thumbnail" => $thumbnail,
"image_name" => format_text($image_row['image_name']),
"url_postcard" => $site_sess->url(ROOT_PATH."postcards.php?".URL_IMAGE_ID."=".$image_id),
"bg_color" => format_text(stripslashes($bg_color), 2),
"border_color" => format_text(stripslashes($border_color), 2),
"font_color" => format_text(stripslashes($font_color), 2),
"font_face" => format_text(stripslashes($font_face), 2),
"sender_name" => format_text(stripslashes($sender_name), 2),
"sender_email" => format_text(stripslashes($sender_email), 2),
"recipient_name" => format_text(stripslashes($recipient_name), 2),
"recipient_email" => format_text(stripslashes($recipient_email), 2),
"headline" => format_text(stripslashes($headline), 2),
"message" => format_text(stripslashes($message), 0),
"message_hidden" => format_text(stripslashes($message), 2),
"image_id" => $image_id,
"lang_sender" => $lang['sender'],
"lang_recipient" => $lang['recipient'],
"lang_edit_postcard" => $lang['edit_postcard'],
"lang_send_postcard" => $lang['send_postcard'],
"back_url" => format_text($back_url),
"lang_captcha" => $lang['captcha'],
"lang_captcha_desc" => $lang['captcha_desc'],
"captcha_postcards" => (bool)$captcha_enable_postcards
));
}
else {
$action = "createcard";
$main_template = "postcard_create";
$sendprocess = 1;
}
}
if ($action == "createcard" || $action == "modifycard") {
if (!$sendprocess) {
$bg_color = "";
$border_color = "";
$font_color = "";
$font_face = "";
$sender_name = ($user_info['user_level'] != GUEST) ? $user_info['user_name'] : "";
$sender_email = ($user_info['user_level'] != GUEST) ? $user_info['user_email'] : "";
$recipient_name = "";
$recipient_email = "";
$headline = "";
$message = "";
}
if ($action == "modifycard") {
$bg_color = un_htmlspecialchars(trim($HTTP_POST_VARS['bg_color']));
$border_color = un_htmlspecialchars(trim($HTTP_POST_VARS['border_color']));
$font_color = un_htmlspecialchars(trim($HTTP_POST_VARS['font_color']));
$font_face = un_htmlspecialchars(trim($HTTP_POST_VARS['font_face']));
$sender_name = un_htmlspecialchars(trim($HTTP_POST_VARS['sender_name']));
$sender_email = un_htmlspecialchars(trim($HTTP_POST_VARS['sender_email']));
$recipient_name = un_htmlspecialchars(trim($HTTP_POST_VARS['recipient_name']));
$recipient_email = un_htmlspecialchars(trim($HTTP_POST_VARS['recipient_email']));
$headline = un_htmlspecialchars(trim($HTTP_POST_VARS['headline']));
$message = un_htmlspecialchars(trim($HTTP_POST_VARS['message']));
$message = strip_tags($message);
}
$image = get_media_code($image_row['image_media_file'], $image_id, $cat_id, $image_row['image_name'], $mode, 1);
$thumbnail = get_thumbnail_code($image_row['image_media_file'], $image_row['image_thumb_file'], $image_id, $cat_id, $image_row['image_name'], $mode);
$site_template->register_vars(array(
"image" => $image,
"thumbnail" => $thumbnail,
"image_name" => format_text($image_row['image_name']),
"lang_bg_color" => $lang['bg_color'],
"bg_color" => $bg_color,
"lang_border_color" => $lang['border_color'],
"border_color" => $border_color,
"lang_font_color" => $lang['font_color'],
"font_color" => $font_color,
"lang_font_face" => $lang['font_face'],
"font_face" => $font_face,
"image_id" => $image_id,
"lang_sender" => $lang['sender'],
"lang_recipient" => $lang['recipient'],
"lang_email" => $lang['email'],
"lang_name" => $lang['name'],
"lang_headline" => $lang['headline'],
"lang_message" => $lang['message'],
"lang_preview_postcard" => $lang['preview_postcard'],
"url_postcard" => $site_sess->url(ROOT_PATH."postcards.php?".URL_IMAGE_ID."=".$image_id),
"sender_name" => format_text(stripslashes($sender_name), 2),
"sender_email" => format_text(stripslashes($sender_email), 2),
"recipient_name" => format_text(stripslashes($recipient_name), 2),
"recipient_email" => format_text(stripslashes($recipient_email), 2),
"headline" => format_text(stripslashes($headline), 2),
"message" => format_text(stripslashes($message), 2),
"lang_send_postcard" => $lang['send_postcard'],
"back_url" => format_text(stripslashes($url), 2)
));
}
//-----------------------------------------------------
//--- Clickstream -------------------------------------
//-----------------------------------------------------
$clickstream = "<span class=\"clickstream\"><a href=\"".$site_sess->url(ROOT_PATH."index.php")."\" class=\"clickstream\">".$lang['home']."</a>".$config['category_separator'];
if ($mode == "lightbox" && !empty($user_info['lightbox_image_ids'])) {
$clickstream .= "<a href=\"".$site_sess->url(ROOT_PATH."lightbox.php")."\" class=\"clickstream\">".$lang['lightbox']."</a>".$config['category_separator']."<a href=\"".$site_sess->url(ROOT_PATH."details.php?".URL_IMAGE_ID."=".$image_id."&mode=".$mode)."\" class=\"clickstream\">".$image_row['image_name']."</a>".$config['category_separator'];
}
elseif ($mode == "search" && !empty($session_info['search_id'])) {
$clickstream .= "<a href=\"".$site_sess->url(ROOT_PATH."search.php?show_result=1")."\" class=\"clickstream\">".$lang['search']."</a>".$config['category_separator']."<a href=\"".$site_sess->url(ROOT_PATH."details.php?".URL_IMAGE_ID."=".$image_id."&mode=".$mode)."\" class=\"clickstream\">".$image_row['image_name']."</a>".$config['category_separator'];
}
else {
$clickstream .= get_category_path($cat_id, 1).$config['category_separator']."<a href=\"".$site_sess->url(ROOT_PATH."details.php?".URL_IMAGE_ID."=".$image_id)."\" class=\"clickstream\">".$image_row['image_name']."</a>".$config['category_separator'];
}
$clickstream .= $lang['send_postcard']."</span>";
//-----------------------------------------------------
//--- Print Out ---------------------------------------
//-----------------------------------------------------
$site_template->register_vars(array(
"msg" => $msg,
"clickstream" => $clickstream,
));
$site_template->print_template($site_template->parse_template($main_template));
include(ROOT_PATH.'includes/page_footer.php');
?>