function cs_error($file, $message, $log_only = 0) { global $cs_logs; $remote_ip = cs_getip(); if (!empty($cs_logs['save_errors'])) { $log = $file . "\n" . $message . "\n"; $log .= isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] . "\n" : "unknown\n"; $log .= isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] . "\n" : "unknown\n"; $log .= !empty($remote_ip) ? $remote_ip . "\n" : "unknown\n"; $log .= isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] . "\n" : "unknown\n"; cs_log('errors', $log); } if (empty($log_only)) { $cs_logs['errors'] .= 'Error: ' . $file . ' -> ' . $message . "\n"; } }
function cs_captchacheck($input, $mini = 0) { if (!extension_loaded('gd')) { return true; } $ip = cs_getip(); $timeout = cs_time() - 900; $string = empty($mini) ? cs_sql_escape($input) : 'mini_' . cs_sql_escape($input); $cond = 'captcha_ip = \'' . cs_sql_escape($ip) . '\' AND '; $cond .= 'captcha_time > \'' . $timeout . '\' AND '; $cond .= 'captcha_string = \'' . $string . '\''; $hash_db = cs_sql_select(__FILE__, 'captcha', 'captcha_id', $cond); if (empty($hash_db)) { return false; } cs_sql_delete(__FILE__, 'captcha', $hash_db['captcha_id']); return true; }
<?php // ClanSphere 2010 - www.clansphere.net // $Id$ $cs_lang = cs_translate('votes'); $users_id = $account['users_id']; $users_ip = cs_getip(); $time = cs_time(); $mod = 'votes'; $votes_error = ''; $votes_form = 1; $votes_access = $account['access_votes']; global $cs_db; $type = $cs_db['type']; unset($cs_db); $from = 'votes'; $select = 'votes_id, votes_question, votes_election, votes_several'; $where = "votes_access <= '" . $votes_access . "' AND votes_start <= '" . $time . "' AND votes_end >= '" . $time . "'"; $sort = in_array($type, array('mysql', 'mysqli')) ? '{random}' : 'votes_end ASC'; $cs_votes = cs_sql_select(__FILE__, $from, $select, $where, $sort); $votes_loop = count($cs_votes); $votes_id = $cs_votes['votes_id']; if (!empty($votes_loop)) { $where = "voted_mod = 'votes' AND voted_fid = '" . $votes_id . "' AND voted_ip = '" . cs_sql_escape($users_ip) . "'"; if ($users_id > 0) { $where = "voted_mod = 'votes' AND voted_fid = '" . $votes_id . "' AND users_id = '" . $users_id . "'"; } $checkit_userip = cs_sql_count(__FILE__, 'voted', $where); } if (!empty($checkit_userip)) { $votes_error++;
} else { $data['if']['reg_mail'] = 0; } echo cs_subtemplate(__FILE__, $data, 'users', 'register_code'); } else { echo cs_subtemplate(__FILE__, $data, 'users', 'register_mail'); } } else { $code_id = generate_code(30); // 30 Zeichen lang $register['users_key'] = $code_id; $active = empty($op_users['def_register']) ? $register['users_active'] = 1 : ($register['users_active'] = 0); $def_timezone = empty($cs_main['def_timezone']) ? 0 : $cs_main['def_timezone']; $def_dstime = empty($cs_main['def_dstime']) ? 0 : $cs_main['def_dstime']; create_user(2, $register['nick'], $register['password'], $register['lang'], $register['email'], 'fam', $def_timezone, $def_dstime, $register['newsletter'], $active, 20, $register['users_key']); $ip = cs_getip(); if (!empty($register['send_mail']) or !empty($op_users['def_register']) or $op_users['def_register'] == '2') { $content = $cs_lang['mail_reg_start'] . $cs_lang['mail_reg_nick'] . $register['nick']; $content .= $cs_lang['mail_reg_password'] . $register['password']; $content .= $cs_lang['mail_reg_ip'] . $ip; if (!empty($op_users['def_register'])) { $content .= "\n" . $cs_lang['mail_key'] . ': '; $content .= $cs_main['php_self']['website'] . str_replace('&', '&', cs_url('users', 'activate', 'key=' . $register['users_key'] . '&email=' . $register['email'])); } $content .= $cs_lang['mail_reg_ask'] . $cs_contact['def_mail'] . $cs_lang['mail_reg_end']; cs_mail($register['email'], $cs_lang['mail_reg_head'], $content); } $data['lang']['head'] = $cs_lang['register']; $data['link']['continue'] = cs_url('users', 'login'); $data['lang']['success'] = !empty($op_users['def_register']) ? $cs_lang['done2'] : $cs_lang['done']; echo cs_subtemplate(__FILE__, $data, 'users', 'done');
<?php // ClanSphere 2010 - www.clansphere.net // $Id$ $cs_lang = cs_translate('shoutbox'); $captcha = extension_loaded('gd') ? 1 : 0; if (isset($_POST['submit'])) { $opt = cs_sql_option(__FILE__, 'shoutbox'); $cs_shout['shoutbox_ip'] = cs_getip(); $cs_shout['shoutbox_name'] = trim($_POST['sh_nick']); $cs_shout['shoutbox_text'] = !empty($_POST['sh_text']) ? $_POST['sh_text'] : ''; $cs_shout['shoutbox_date'] = cs_time(); # do not use htmlspecialchars with charset here due to website $uri = empty($_POST['uri']) ? '' : htmlspecialchars($_POST['uri'], ENT_QUOTES); if (!empty($_POST['sh_text2'])) { $cs_shout['shoutbox_text'] = $_POST['sh_text2']; } $error = ''; if ($cs_shout['shoutbox_name'] == 'Nick' or empty($cs_shout['shoutbox_name'])) { $error .= cs_html_br(1) . '- ' . $cs_lang['no_name']; $cs_shout['shoutbox_name'] = ''; } if (empty($cs_shout['shoutbox_text'])) { $error .= cs_html_br(1) . ' ' . $cs_lang['no_text']; } if (strlen($cs_shout['shoutbox_text']) > $opt['max_text']) { $signs = strlen($cs_shout['shoutbox_text']) - $opt['max_text']; $error .= cs_html_br(1) . '- ' . sprintf($cs_lang['too_long'], $signs); } if (empty($account['users_id']) && !cs_captchacheck($_POST['captcha'], 1)) { $error .= cs_html_br(1) . ' ' . $cs_lang['captcha_false'] . cs_html_br(1);
function cs_commments_create($com_fid, $mod, $action, $quote_id, $mod_name, $close = 0, $more = 'id') { $cs_lang = cs_translate('comments'); global $account, $cs_main; settype($com_fid, 'integer'); settype($quote_id, 'integer'); settype($close, 'integer'); $data['head']['mod'] = $mod_name; $data['if']['preview'] = FALSE; $data['if']['guest'] = FALSE; #guest $data['if']['captcha'] = FALSE; #guest $guestnick = ''; $op_comments = cs_sql_option(__FILE__, 'comments'); if (!empty($account['users_id']) or !empty($op_comments['allow_unreg'])) { if (!empty($quote_id)) { $cells = 'users_id, comments_text, comments_time, comments_fid, comments_guestnick'; $cs_com = cs_sql_select(__FILE__, 'comments', $cells, "comments_id = '" . $quote_id . "'"); $com_fid = $cs_com['comments_fid']; if (!empty($cs_com['users_id'])) { $cs_users = cs_sql_select(__FILE__, 'users', 'users_nick', "users_id = '" . $cs_com['users_id'] . "'"); $url = cs_url('users', 'view', 'id=' . $cs_com['users_id']); $text = cs_date('unix', $cs_com['comments_time'], 1) . ' - [url=' . $url . ']'; $text .= $cs_users['users_nick'] . "[/url]:\r\n[quote]" . $cs_com['comments_text'] . '[/quote]'; } else { //if guest $text = cs_date('unix', $cs_com['comments_time'], 1) . ' - '; $text .= $cs_com['comments_guestnick'] . ":\r\n[quote]" . $cs_com['comments_text'] . '[/quote]'; } } elseif (isset($_POST['submit']) or isset($_POST['preview']) or isset($_POST['advanced'])) { $text = $_POST['comments_text']; $find = "comments_mod = '" . cs_sql_escape($mod) . "' AND comments_fid = " . (int) $com_fid; $last_from = cs_sql_select(__FILE__, 'comments', 'users_id, comments_ip', $find, 'comments_id DESC'); $ip = cs_getip(); $error = ''; if (empty($account['users_id'])) { $guestnick = $_POST['comments_guestnick']; if (empty($guestnick)) { $error .= $cs_lang['no_guestnick'] . cs_html_br(1); } else { $op_users = cs_sql_option(__FILE__, 'users'); $nick2 = str_replace(' ', '', $guestnick); $nickchars = strlen($nick2); if ($nickchars < $op_users['min_letters']) { $error .= sprintf($cs_lang['short_guestnick'], $op_users['min_letters']) . cs_html_br(1); } $search_nick = cs_sql_count(__FILE__, 'users', "users_nick = '" . cs_sql_escape($guestnick) . "'"); if (!empty($search_nick)) { $error .= $cs_lang['nick_exists'] . cs_html_br(1); } } if (!cs_captchacheck($_POST['captcha'])) { $error .= $cs_lang['captcha_false'] . cs_html_br(1); } if ($ip == $last_from['comments_ip']) { $error .= $cs_lang['last_own'] . cs_html_br(1); } $where = "comments_ip = '" . cs_sql_escape($ip) . "'"; } else { if ($account['users_id'] == $last_from['users_id']) { $error .= $cs_lang['last_own'] . cs_html_br(1); } $where = "users_id = " . (int) $account['users_id']; } if (empty($text)) { $error .= $cs_lang['no_text'] . cs_html_br(1); } $and_mod = " AND comments_mod = '" . cs_sql_escape($mod) . "'"; $flood = cs_sql_select(__FILE__, 'comments', 'comments_time', $where . $and_mod, 'comments_time DESC'); $maxtime = $flood['comments_time'] + $cs_main['def_flood']; if ($maxtime > cs_time()) { $diff = $maxtime - cs_time(); $error .= sprintf($cs_lang['flood_on'], $diff); } if (!empty($close)) { $error .= $cs_lang['closed'] . cs_html_br(1); } } else { $text = ''; } if (!isset($_POST['submit']) and !isset($_POST['preview'])) { $data['head']['body'] = $cs_lang['body_com_create']; } elseif (!empty($error)) { $data['head']['body'] = $error; } elseif (isset($_POST['preview'])) { $data['head']['body'] = $cs_lang['preview']; } if (isset($_POST['preview']) and empty($error)) { $data['if']['preview'] = true; $userid = $account['users_id']; if (!empty($userid)) { $data['if']['guest_prev'] = FALSE; $data['if']['user_prev'] = TRUE; $select = 'users_nick, users_laston, users_place, users_country, users_active, users_invisible, users_delete'; $cs_user = cs_sql_select(__FILE__, 'users', $select, "users_id = '" . $userid . "'"); $user = cs_secure($cs_user['users_nick']); $url = 'symbols/countries/' . $cs_user['users_country'] . '.png'; $data['prev']['flag'] = cs_html_img($url, 11, 16); $data['prev']['user'] = cs_user($userid, $cs_user['users_nick'], $cs_user['users_active'], $cs_user['users_delete']); $data['prev']['status'] = cs_userstatus($cs_user['users_laston'], $cs_user['users_invisible']); $data['prev']['laston'] = empty($cs_user['users_invisible']) ? '--' : cs_date('unix', $cs_user['users_laston']); $place = empty($cs_user['users_place']) ? '-' : $cs_user['users_place']; $data['prev']['place'] = cs_secure($place); $who = "users_id = " . (int) $userid; $count_com[$userid] = cs_sql_count(__FILE__, 'comments', $who); $data['prev']['posts'] = $count_com[$userid]; } else { $data['if']['guest_prev'] = TRUE; $data['if']['user_prev'] = FALSE; $data['prev']['guestnick'] = cs_secure($guestnick); } $opt = "comments_mod = '" . cs_sql_escape($mod) . "' AND comments_fid = " . (int) $com_fid; $count_com = cs_sql_count(__FILE__, 'comments', $opt); $data['prev']['count_com'] = $count_com + 1; $data['prev']['date'] = cs_date('unix', cs_time(), 1); $data['prev']['text'] = cs_secure($text, 1, 1); } if (!empty($error) or isset($_POST['preview']) or !isset($_POST['submit'])) { $data['com']['form_name'] = $mod . '_com_create'; $data['com']['form_url'] = cs_url($mod, 'com_create'); $data['com']['smileys'] = cs_abcode_smileys('comments_text'); $data['com']['abcode'] = cs_abcode_features('comments_text'); // if guest if (empty($account['users_id'])) { $data['if']['guest'] = TRUE; $data['com']['guestnick'] = $guestnick; if (extension_loaded('gd')) { $data['if']['captcha'] = TRUE; $data['captcha']['img'] = cs_html_img('mods/captcha/generate.php?time=' . cs_time()); } } $data['com']['text'] = $text; $data['com']['fid'] = $com_fid; echo cs_subtemplate(__FILE__, $data, 'comments', 'com_create'); require_once 'mods/comments/functions.php'; $com_where = "comments_mod = '" . cs_sql_escape($mod) . "' AND comments_fid = " . (int) $com_fid; $count = cs_sql_count(__FILE__, 'comments', $com_where); cs_comments_view($com_fid, $mod, 'com_create', $count, false, 5); } elseif (empty($quote_id)) { $opt = "comments_mod = '" . cs_sql_escape($mod) . "' AND comments_fid = " . (int) $com_fid; $count_com = cs_sql_count(__FILE__, 'comments', $opt); $start = floor($count_com / $account['users_limit']) * $account['users_limit']; $user_ip = cs_getip(); $com_cells = array('users_id', 'comments_fid', 'comments_mod', 'comments_ip', 'comments_time', 'comments_text', 'comments_guestnick'); $com_save = array($account['users_id'], $com_fid, $mod, $user_ip, cs_time(), $text, $guestnick); cs_sql_insert(__FILE__, 'comments', $com_cells, $com_save); $more_action = $more . '=' . $com_fid . '&start=' . $start . '#com' . ++$count_com; cs_redirect($cs_lang['create_done'], $mod, $action, $more_action); } } else { cs_redirect('', 'errors', '403'); } }
$cs_votes_tpl = array(); $cs_votes_tpl['head']['mod'] = $cs_lang['mod_name']; $cs_votes_tpl['head']['action'] = $cs_lang['head_list']; $cs_votes_tpl['head']['body'] = $cs_lang['body_list']; $cs_votes_tpl['lang']['vote_archive'] = $cs_lang['vote_archiv']; echo cs_subtemplate(__FILE__, $cs_votes_tpl, 'votes', 'view_head'); if (empty($_REQUEST['where'])) { cs_redirect($cs_lang['no_id'], 'votes', 'list'); } else { $cs_votes_id = empty($_REQUEST['where']) ? $_GET['id'] : $_REQUEST['where']; settype($cs_votes_id, 'integer'); $from = 'votes'; $select = 'votes_access, votes_question, votes_election, votes_close, votes_end, votes_several'; $cs_votes = cs_sql_select(__FILE__, $from, $select, "votes_id = '" . $cs_votes_id . "'"); $votes_access = $cs_votes['votes_access']; $cs_votes_save['voted_ip'] = cs_getip(); $cs_votes_save['users_id'] = $account['users_id']; $user_id = $account['access_votes']; $votes_form = '1'; if ($votes_access > $user_id) { cs_redirect($cs_lang['no_access'], 'votes', 'list'); } else { $from = 'voted'; $select = 'voted_id, users_id, voted_ip, voted_answer, voted_fid'; $where = "voted_mod = 'votes' AND voted_fid = '" . $cs_votes_id . "'"; $cs_voted = cs_sql_select(__FILE__, $from, $select, $where, '', '0', '0'); $voted_loop = count($cs_voted); if (isset($_POST['submit'])) { if (!empty($voted_loop)) { $where = "voted_mod = 'votes' AND voted_fid = '" . $cs_votes_id . "' AND voted_ip = '" . cs_sql_escape($cs_votes_save['voted_ip']) . "'"; if ($cs_votes_save['users_id'] > 0) {
$data['if']['com_form'] = FALSE; } else { $data['if']['com_form'] = TRUE; } echo cs_subtemplate(__FILE__, $data, 'board', 'com_create'); } else { $opt = "comments_mod = 'board' AND comments_fid = " . (int) $fid; $count_com = cs_sql_count(__FILE__, 'comments', $opt); $options = cs_sql_option(__FILE__, 'board'); if ($options['sort'] == 'DESC') { $start = 0; } else { $start = floor($count_com / $account['users_limit']) * $account['users_limit']; $count_com = $count_com % $account['users_limit']; } $user_ip = cs_getip(); $users_id = $account['users_id']; $time = cs_time(); $com_cells = array('users_id', 'comments_fid', 'comments_mod', 'comments_ip', 'comments_time', 'comments_text'); $com_save = array($users_id, $fid, 'board', $user_ip, $time, $text); cs_sql_insert(__FILE__, 'comments', $com_cells, $com_save); $idnow = cs_sql_insertid(__FILE__); $thread_cells = array('threads_last_time', 'threads_last_user'); $thread_save = array(cs_time(), $account['users_id']); cs_sql_update(__FILE__, 'threads', $thread_cells, $thread_save, $fid); for ($run = 0; $run < $run_loop_files; $run++) { $num = $run + 1; $files_cells = array('users_id', 'threads_id', 'comments_id', 'boardfiles_time', 'boardfiles_name'); $files_save = array($users_id, $fid, $idnow, cs_time(), $file_name[$num]); cs_sql_insert(__FILE__, 'boardfiles', $files_cells, $files_save); $files_select_new_id = cs_sql_insertid(__FILE__);
// $Id$ $cs_lang = cs_translate('gallery'); $cs_post = cs_post('where,folders_id'); $cs_get = cs_get('where,folders_id'); $data = array(); $gid = empty($cs_get['where']) ? 0 : $cs_get['where']; if (!empty($cs_post['where'])) { $gid = $cs_post['where']; } $folder_id = empty($cs_get['folders_id']) ? 0 : $cs_get['folders_id']; if (!empty($cs_post['folders_id'])) { $folder_id = $cs_post['folders_id']; } require_once 'mods/gallery/functions.php'; $time = cs_time(); $voted_ip = cs_getip(); $exp = extension_loaded('gd'); $option = cs_sql_option(__FILE__, 'gallery'); $id = empty($gid) ? $folder_id : $gid; $select = 'gallery_id, gallery_name, gallery_titel, gallery_description, '; $select .= 'gallery_time, gallery_vote, gallery_count, folders_id, users_id'; $where = 'gallery_id = ' . $id . ' AND gallery_status = 1 AND gallery_access <=' . $account['access_gallery']; $cs_gallery = cs_sql_select(__FILE__, 'gallery', $select, $where); $gallery_loop = count($cs_gallery); if (empty($gallery_loop)) { $data['head']['error'] = cs_link($cs_lang['mod_name'], 'gallery', 'list') . ' - ' . $cs_lang['head_view']; echo cs_subtemplate(__FILE__, $data, 'gallery', 'error'); } else { $select = 'folders_id, folders_name, folders_picture, folders_text, sub_id, folders_advanced'; $where = "folders_mod = 'gallery' AND folders_id = " . (int) $cs_gallery['folders_id']; $cs_folders = cs_sql_select(__FILE__, 'folders', $select, $where);
<?php // ClanSphere 2010 - www.clansphere.net // $Id$ global $cs_main, $account; if (!empty($account['access_count'])) { $time = cs_time(); $ip = empty($login['mode']) ? cs_getip() : $_SESSION['users_ip']; if (!isset($_SESSION['count_id']) or !isset($_SESSION['count_last'])) { $fetch_me = cs_sql_select(__FILE__, 'count', 'count_id, count_time', "count_ip = '" . cs_sql_escape($ip) . "'", 'count_id DESC'); $_SESSION['count_id'] = $fetch_me['count_id']; $_SESSION['count_time'] = $fetch_me['count_time']; $_SESSION['count_last'] = $fetch_me['count_time']; } else { $fetch_me = array(); $fetch_me['count_id'] = $_SESSION['count_id']; $fetch_me['count_time'] = $_SESSION['count_time']; } $time_lock = isset($fetch_me['count_time']) ? $fetch_me['count_time'] + 43200 : 0; $_SESSION['count_time'] = $time; if ($time > $_SESSION['count_last'] + 30) { if ($time < $time_lock) { $counter_cells = array('count_time', 'count_location'); $counter_content = array($time, $cs_main['mod'] . '/' . $cs_main['action']); cs_sql_update(__FILE__, 'count', $counter_cells, $counter_content, $fetch_me['count_id'], 0, 0); } else { $counter_cells = array('count_ip', 'count_time', 'count_location'); $counter_save = array($ip, $time, $cs_main['mod'] . '/' . $cs_main['action']); cs_sql_insert(__FILE__, 'count', $counter_cells, $counter_save); $_SESSION['count_id'] = cs_sql_insertid(__FILE__); }
$account['users_ajax'] = 0; } } if (isset($_COOKIE['cs_userid'])) { # refresh cookie lifetime after a while if (isset($_COOKIE['cs_cookiehash']) and isset($_COOKIE['cs_cookietime']) and $_COOKIE['cs_cookietime'] < $cs_main['cookie']['lifetime'] - 43200) { cs_login_cookies($_COOKIE['cs_userid'], $_COOKIE['cs_cookiehash']); } # empty old and bad cookie data if (empty($_COOKIE['cs_cookiehash']) or $_COOKIE['cs_cookiehash'] != $account['users_cookiehash']) { cs_login_cookies(); } } $time = cs_time(); if (!empty($account['users_id'])) { if ($_SESSION['users_ip'] != cs_getip() or $_SESSION['users_agent'] != $user_agent) { session_destroy(); $login['mode'] = FALSE; } elseif ($cs_main['mod'] == 'users' and $cs_main['action'] == 'logout') { cs_login_cookies(); session_destroy(); $login['mode'] = FALSE; } elseif ($time > $account['users_laston'] + 30) { $cells = array('users_laston'); $content = array($time); cs_sql_update(__FILE__, 'users', $cells, $content, $account['users_id'], 0, 0); } } else { $account = array('access_id' => 1, 'users_id' => 0, 'users_lang' => $cs_main['def_lang'], 'users_limit' => $cs_main['data_limit'], 'users_timezone' => $cs_main['def_timezone'], 'users_dstime' => $cs_main['def_dstime'], 'access_clansphere' => 0); } $gma = cs_sql_select(__FILE__, 'access', '*', 'access_id = ' . (int) $account['access_id'], 0, 0, 1, 'access_' . $account['access_id']);
$advanced = empty($cs_cat['folders_advanced']) ? '0,0,0,0' : $cs_cat['folders_advanced']; $advanced = explode(",", $advanced); if ($account['access_usersgallery'] < $cs_cat['folders_access']) { $data['if']['error'] = TRUE; $data['if']['view'] = FALSE; $detail = 0; } $usersgallery_id = $cs_gallery[$move]['usersgallery_id']; $where = 'voted_fid = "' . $usersgallery_id . '" AND voted_mod = \'usersgallery\''; $cs_voted = cs_sql_select(__FILE__, 'voted', 'users_id, voted_answer', $where, '', 0, 0); $voted_loop = count($cs_voted); $voted['voted_fid'] = !empty($_POST['voted_fid']) ? $_POST['voted_fid'] : 0; $voted['users_id'] = !empty($account['users_id']) ? $account['users_id'] : 0; $voted['voted_answer'] = !empty($_POST['voted_answer']) ? $_POST['voted_answer'] : 0; $voted['voted_time'] = cs_time(); $voted['voted_ip'] = cs_getip(); $voted['voted_mod'] = 'usersgallery'; $check_user_voted = 0; for ($run = 0; $run < $voted_loop; $run++) { if ($cs_voted[$run]['users_id'] == $account['users_id']) { $check_user_voted++; } } if (empty($check_user_voted)) { if (isset($_POST['submit'])) { $votes_cells = array_keys($voted); $votes_save = array_values($voted); cs_sql_insert(__FILE__, 'voted', $votes_cells, $votes_save); } } $head = cs_link($cs_lang['mod_name'], 'usersgallery', 'users', 'id=' . $id) . ' - ';