function ModifyProfile2()
{
global $txt, $modSettings;
global $cookiename, $context;
global $sourcedir, $scripturl, $db_prefix;
global $ID_MEMBER, $user_info;
global $context, $newpassemail, $user_profile, $validationCode;
loadLanguage('Profile');
/* Set allowed sub-actions.
The format of $sa_allowed is as follows:
$sa_allowed = array(
'sub-action' => array(permission_array_for_editing_OWN_profile, permission_array_for_editing_ANY_profile, session_validation_method[, require_password]),
...
);
*/
$sa_allowed = array('account' => array(array('manage_membergroups', 'profile_identity_any', 'profile_identity_own'), array('manage_membergroups', 'profile_identity_any'), 'post', true), 'forumProfile' => array(array('profile_extra_any', 'profile_extra_own'), array('profile_extra_any'), 'post'), 'theme' => array(array('profile_extra_any', 'profile_extra_own'), array('profile_extra_any'), 'post'), 'notification' => array(array('profile_extra_any', 'profile_extra_own'), array('profile_extra_any'), 'post'), 'pmprefs' => array(array('profile_extra_any', 'profile_extra_own'), array('profile_extra_any'), 'post'), 'deleteAccount' => array(array('profile_remove_any', 'profile_remove_own'), array('profile_remove_any'), 'post', true), 'activateAccount' => array(array(), array('moderate_forum'), 'get'));
// Is the current sub-action allowed?
if (empty($_REQUEST['sa']) || !isset($sa_allowed[$_REQUEST['sa']])) {
fatal_lang_error(453, false);
}
checkSession($sa_allowed[$_REQUEST['sa']][2]);
// Start with no updates and no errors.
$profile_vars = array();
$post_errors = array();
// Normally, don't send an email.
$newpassemail = false;
// Clean up the POST variables.
$_POST = htmltrim__recursive($_POST);
$_POST = stripslashes__recursive($_POST);
$_POST = htmlspecialchars__recursive($_POST);
$_POST = addslashes__recursive($_POST);
// Search for the member being edited and put the information in $user_profile.
$memberResult = loadMemberData((int) $_REQUEST['userID'], false, 'profile');
if (!is_array($memberResult)) {
fatal_lang_error(453, false);
}
list($memID) = $memberResult;
// Are you modifying your own, or someone else's?
if ($ID_MEMBER == $memID) {
$context['user']['is_owner'] = true;
} else {
$context['user']['is_owner'] = false;
validateSession();
}
// Check profile editing permissions.
isAllowedTo($sa_allowed[$_REQUEST['sa']][$context['user']['is_owner'] ? 0 : 1]);
// If this is yours, check the password.
if ($context['user']['is_owner'] && !empty($sa_allowed[$_REQUEST['sa']][3])) {
// You didn't even enter a password!
if (trim($_POST['oldpasswrd']) == '') {
$post_errors[] = 'no_password';
}
// Since the password got modified due to all the $_POST cleaning, lets undo it so we can get the correct password
$_POST['oldpasswrd'] = addslashes(un_htmlspecialchars(stripslashes($_POST['oldpasswrd'])));
// Does the integration want to check passwords?
$good_password = false;
if (isset($modSettings['integrate_verify_password']) && function_exists($modSettings['integrate_verify_password'])) {
if (call_user_func($modSettings['integrate_verify_password'], $user_profile[$memID]['memberName'], $_POST['oldpasswrd'], false) === true) {
$good_password = true;
}
}
// Bad password!!!
if (!$good_password && $user_info['passwd'] != sha1(strtolower($user_profile[$memID]['memberName']) . $_POST['oldpasswrd'])) {
$post_errors[] = 'bad_password';
}
}
// No need for the sub action array.
unset($sa_allowed);
// If the user is an admin - see if they are resetting someones username.
if ($user_info['is_admin'] && isset($_POST['memberName'])) {
// We'll need this...
require_once $sourcedir . '/Subs-Auth.php';
// Do the reset... this will send them an email too.
resetPassword($memID, $_POST['memberName']);
}
// Change the IP address in the database.
if ($context['user']['is_owner']) {
$profile_vars['memberIP'] = "'{$user_info['ip']}'";
}
// Now call the sub-action function...
if (isset($_POST['sa']) && $_POST['sa'] == 'deleteAccount') {
deleteAccount2($profile_vars, $post_errors, $memID);
if (empty($post_errors)) {
redirectexit();
}
} else {
saveProfileChanges($profile_vars, $post_errors, $memID);
}
// There was a problem, let them try to re-enter.
if (!empty($post_errors)) {
// Load the language file so we can give a nice explanation of the errors.
loadLanguage('Errors');
$context['post_errors'] = $post_errors;
$_REQUEST['sa'] = $_POST['sa'];
$_REQUEST['u'] = $memID;
return ModifyProfile($post_errors);
}
if (!empty($profile_vars)) {
// If we've changed the password, notify any integration that may be listening in.
if (isset($profile_vars['passwd']) && isset($modSettings['integrate_reset_pass']) && function_exists($modSettings['integrate_reset_pass'])) {
call_user_func($modSettings['integrate_reset_pass'], $user_profile[$memID]['memberName'], $user_profile[$memID]['memberName'], $_POST['passwrd1']);
}
updateMemberData($memID, $profile_vars);
}
// What if this is the newest member?
if ($modSettings['latestMember'] == $memID) {
updateStats('member');
} elseif (isset($profile_vars['realName'])) {
updateSettings(array('memberlist_updated' => time()));
}
// If the member changed his/her birthdate, update calendar statistics.
if (isset($profile_vars['birthdate']) || isset($profile_vars['realName'])) {
updateStats('calendar');
}
// Send an email?
if ($newpassemail) {
require_once $sourcedir . '/Subs-Post.php';
// Send off the email.
sendmail($_POST['emailAddress'], $txt['activate_reactivate_title'] . ' ' . $context['forum_name'], "{$txt['activate_reactivate_mail']}\n\n" . "{$scripturl}?action=activate;u={$memID};code={$validationCode}\n\n" . "{$txt['activate_code']}: {$validationCode}\n\n" . $txt[130]);
// Log the user out.
db_query("\n\t\t\tDELETE FROM {$db_prefix}log_online\n\t\t\tWHERE ID_MEMBER = {$memID}", __FILE__, __LINE__);
$_SESSION['log_time'] = 0;
$_SESSION['login_' . $cookiename] = serialize(array(0, '', 0));
if (isset($_COOKIE[$cookiename])) {
$_COOKIE[$cookiename] = '';
}
loadUserSettings();
$context['user']['is_logged'] = false;
$context['user']['is_guest'] = true;
// Send them to the done-with-registration-login screen.
loadTemplate('Register');
$context += array('page_title' => &$txt[79], 'sub_template' => 'after', 'description' => &$txt['activate_changed_email']);
return;
} elseif ($context['user']['is_owner']) {
// Log them back in.
if (isset($_POST['passwrd1']) && $_POST['passwrd1'] != '') {
require_once $sourcedir . '/Subs-Auth.php';
setLoginCookie(60 * $modSettings['cookieTime'], $memID, sha1(sha1(strtolower($user_profile[$memID]['memberName']) . un_htmlspecialchars(stripslashes($_POST['passwrd1']))) . $user_profile[$memID]['passwordSalt']));
}
loadUserSettings();
writeLog();
}
// Back to same subaction page..
redirectexit('action=profile;u=' . $memID . ';sa=' . $_REQUEST['sa'], isset($_POST['passwrd1']) && $context['server']['needs_login_fix'] || $context['browser']['is_ie'] && isset($_FILES['attachment']));
}
function mob_update_email($rpcmsg)
{
global $txt, $modSettings;
global $cookiename, $context;
global $sourcedir, $scripturl, $db_prefix;
global $ID_MEMBER, $user_info;
global $newpassemail, $user_profile, $validationCode;
loadLanguage('Profile');
// Start with no updates and no errors.
$profile_vars = array();
$post_errors = array();
$_POST['oldpasswrd'] = $rpcmsg->getParam(0) ? $rpcmsg->getScalarValParam(0) : '';
$_POST['emailAddress'] = $rpcmsg->getParam(1) ? $rpcmsg->getScalarValParam(1) : '';
// Clean up the POST variables.
$_POST = htmltrim__recursive($_POST);
$_POST = stripslashes__recursive($_POST);
$_POST = htmlspecialchars__recursive($_POST);
$_POST = addslashes__recursive($_POST);
$memberResult = loadMemberData($ID_MEMBER, false, 'profile');
if (!is_array($memberResult)) {
fatal_lang_error(453, false);
}
$memID = $ID_MEMBER;
$newpassemail = false;
$context['user']['is_owner'] = true;
isAllowedTo(array('manage_membergroups', 'profile_identity_any', 'profile_identity_own'));
// You didn't even enter a password!
if (trim($_POST['oldpasswrd']) == '') {
fatal_error($txt['profile_error_no_password']);
}
// This block is only concerned with email address validation..
if (strtolower($_POST['emailAddress']) != strtolower($user_profile[$memID]['emailAddress'])) {
$_POST['emailAddress'] = strtr($_POST['emailAddress'], array(''' => '\\\''));
// Prepare the new password, or check if they want to change their own.
if (!empty($modSettings['send_validation_onChange']) && !allowedTo('moderate_forum')) {
require_once $sourcedir . '/Subs-Members.php';
$validationCode = generateValidationCode();
$profile_vars['validation_code'] = '\'' . $validationCode . '\'';
$profile_vars['is_activated'] = '2';
$newpassemail = true;
}
// Check the name and email for validity.
if (trim($_POST['emailAddress']) == '') {
fatal_error($txt['profile_error_no_email']);
}
if (preg_match('~^[0-9A-Za-z=_+\\-/][0-9A-Za-z=_\'+\\-/\\.]*@[\\w\\-]+(\\.[\\w\\-]+)*(\\.[\\w]{2,6})$~', stripslashes($_POST['emailAddress'])) == 0) {
fatal_error($txt['profile_error_bad_email']);
}
// Email addresses should be and stay unique.
$request = db_query("\n SELECT ID_MEMBER\n FROM {$db_prefix}members\n WHERE ID_MEMBER != {$memID}\n AND emailAddress = '{$_POST['emailAddress']}'\n LIMIT 1", __FILE__, __LINE__);
if (mysql_num_rows($request) > 0) {
fatal_error($txt['profile_error_email_taken']);
}
mysql_free_result($request);
$profile_vars['emailAddress'] = '\'' . $_POST['emailAddress'] . '\'';
}
if (!empty($profile_vars)) {
updateMemberData($memID, $profile_vars);
}
// Send an email?
if ($newpassemail) {
require_once $sourcedir . '/Subs-Post.php';
// Send off the email.
sendmail($_POST['emailAddress'], $txt['activate_reactivate_title'] . ' ' . $context['forum_name'], "{$txt['activate_reactivate_mail']}\n\n" . "{$scripturl}?action=activate;u={$memID};code={$validationCode}\n\n" . "{$txt['activate_code']}: {$validationCode}\n\n" . $txt[130]);
// Log the user out.
db_query("\n DELETE FROM {$db_prefix}log_online\n WHERE ID_MEMBER = {$memID}", __FILE__, __LINE__);
$_SESSION['log_time'] = 0;
$_SESSION['login_' . $cookiename] = serialize(array(0, '', 0));
}
$response = array('result' => new xmlrpcval(true, 'boolean'), 'result_text' => new xmlrpcval('', 'base64'));
return new xmlrpcresp(new xmlrpcval($response, 'struct'));
}
function ViewMemberlist()
{
global $txt, $scripturl, $db_prefix, $context, $modSettings, $sourcedir;
// Set the current sub action.
$context['sub_action'] = $_REQUEST['sa'];
// Are we performing a delete?
if (isset($_POST['delete_members']) && !empty($_POST['delete']) && allowedTo('profile_remove_any')) {
checkSession();
// Clean the input.
foreach ($_POST['delete'] as $key => $value) {
$_POST['delete'][$key] = (int) $value;
}
// Delete all the selected members.
require_once $sourcedir . '/Subs-Members.php';
deleteMembers($_POST['delete']);
}
// Build a search for a specific group or post group.
if ($context['sub_action'] === 'query') {
if (isset($_GET['group'])) {
$_POST['membergroups'] = array(array((int) $_GET['group']), array((int) $_GET['group']));
} elseif (isset($_GET['pgroup'])) {
$_POST['postgroups'] = array((int) $_GET['pgroup']);
}
}
if ($context['sub_action'] == 'query' && !empty($_REQUEST['params']) && empty($_POST)) {
$search_params = base64_decode(stripslashes($_REQUEST['params']));
$_POST += addslashes__recursive(@unserialize($search_params));
}
// Check input after a member search has been submitted.
if ($context['sub_action'] == 'query') {
// Retrieving the membergroups and postgroups.
$context['membergroups'] = array(array('id' => 0, 'name' => $txt['membergroups_members'], 'can_be_additional' => false));
$context['postgroups'] = array();
$request = db_query("\n\t\t\tSELECT ID_GROUP, groupName, minPosts\n\t\t\tFROM {$db_prefix}membergroups\n\t\t\tWHERE ID_GROUP != 3\n\t\t\tORDER BY minPosts, IF(ID_GROUP < 4, ID_GROUP, 4), groupName", __FILE__, __LINE__);
while ($row = mysql_fetch_assoc($request)) {
if ($row['minPosts'] == -1) {
$context['membergroups'][] = array('id' => $row['ID_GROUP'], 'name' => $row['groupName'], 'can_be_additional' => true);
} else {
$context['postgroups'][] = array('id' => $row['ID_GROUP'], 'name' => $row['groupName']);
}
}
mysql_free_result($request);
// Some data about the form fields and how they are linked to the database.
$params = array('mem_id' => array('db_fields' => array('ID_MEMBER'), 'type' => 'int', 'range' => true), 'age' => array('db_fields' => array('birthdate'), 'type' => 'age', 'range' => true), 'posts' => array('db_fields' => array('posts'), 'type' => 'int', 'range' => true), 'reg_date' => array('db_fields' => array('dateRegistered'), 'type' => 'date', 'range' => true), 'last_online' => array('db_fields' => array('lastLogin'), 'type' => 'date', 'range' => true), 'gender' => array('db_fields' => array('gender'), 'type' => 'checkbox', 'values' => array('0', '1', '2')), 'activated' => array('db_fields' => array('IF(is_activated IN (1, 11), 1, 0)'), 'type' => 'checkbox', 'values' => array('0', '1')), 'membername' => array('db_fields' => array('memberName', 'realName'), 'type' => 'string'), 'email' => array('db_fields' => array('emailAddress'), 'type' => 'string'), 'website' => array('db_fields' => array('websiteTitle', 'websiteUrl'), 'type' => 'string'), 'location' => array('db_fields' => array('location'), 'type' => 'string'), 'ip' => array('db_fields' => array('memberIP'), 'type' => 'string'), 'messenger' => array('db_fields' => array('ICQ', 'AIM', 'YIM', 'MSN'), 'type' => 'string'));
$range_trans = array('--' => '<', '-' => '<=', '=' => '=', '+' => '>=', '++' => '>');
// !!! Validate a little more.
// Loop through every field of the form.
$query_parts = array();
foreach ($params as $param_name => $param_info) {
// Not filled in?
if (!isset($_POST[$param_name]) || $_POST[$param_name] == '') {
continue;
}
// Make sure numeric values are really numeric.
if (in_array($param_info['type'], array('int', 'age'))) {
$_POST[$param_name] = (int) $_POST[$param_name];
} elseif ($param_info['type'] == 'date') {
// Check if this date format is valid.
if (preg_match('/^\\d{4}-\\d{1,2}-\\d{1,2}$/', $_POST[$param_name]) == 0) {
continue;
}
$_POST[$param_name] = strtotime($_POST[$param_name]);
}
// Those values that are in some kind of range (<, <=, =, >=, >).
if (!empty($param_info['range'])) {
// Default to '=', just in case...
if (empty($range_trans[$_POST['types'][$param_name]])) {
$_POST['types'][$param_name] = '=';
}
// Handle special case 'age'.
if ($param_info['type'] == 'age') {
// All people that were born between $lowerlimit and $upperlimit are currently the specified age.
$datearray = getdate(forum_time());
$upperlimit = sprintf('%04d-%02d-%02d', $datearray['year'] - $_POST[$param_name], $datearray['mon'], $datearray['mday']);
$lowerlimit = sprintf('%04d-%02d-%02d', $datearray['year'] - $_POST[$param_name] - 1, $datearray['mon'], $datearray['mday']);
if (in_array($_POST['types'][$param_name], array('-', '--', '='))) {
$query_parts[] = "{$param_info['db_fields'][0]} > '" . ($_POST['types'][$param_name] == '--' ? $upperlimit : $lowerlimit) . "'";
}
if (in_array($_POST['types'][$param_name], array('+', '++', '='))) {
$query_parts[] = "{$param_info['db_fields'][0]} <= '" . ($_POST['types'][$param_name] == '++' ? $lowerlimit : $upperlimit) . "'";
// Make sure that members that didn't set their birth year are not queried.
$query_parts[] = "{$param_info['db_fields'][0]} > '0000-12-31'";
}
} elseif ($param_info['type'] == 'date' && $_POST['types'][$param_name] == '=') {
$query_parts[] = $param_info['db_fields'][0] . ' > ' . $_POST[$param_name] . ' AND ' . $param_info['db_fields'][0] . ' < ' . ($_POST[$param_name] + 86400);
} else {
$query_parts[] = $param_info['db_fields'][0] . ' ' . $range_trans[$_POST['types'][$param_name]] . ' ' . $_POST[$param_name];
}
} elseif ($param_info['type'] == 'checkbox') {
// Each checkbox or no checkbox at all is checked -> ignore.
if (!is_array($_POST[$param_name]) || count($_POST[$param_name]) == 0 || count($_POST[$param_name]) == count($param_info['values'])) {
continue;
}
$query_parts[] = "{$param_info['db_fields'][0]} IN ('" . implode("', '", $_POST[$param_name]) . "')";
} else {
// Replace the wildcard characters ('*' and '?') into MySQL ones.
$_POST[$param_name] = strtolower(addslashes(strtr($_POST[$param_name], array('%' => '\\%', '_' => '\\_', '*' => '%', '?' => '_'))));
$query_parts[] = '(' . implode(" LIKE '%{$_POST[$param_name]}%' OR ", $param_info['db_fields']) . " LIKE '%{$_POST[$param_name]}%')";
}
}
// Set up the membergroup query part.
$mg_query_parts = array();
// Primary membergroups, but only if at least was was not selected.
if (!empty($_POST['membergroups'][1]) && count($context['membergroups']) != count($_POST['membergroups'][1])) {
$mg_query_parts[] = "ID_GROUP IN (" . implode(", ", $_POST['membergroups'][1]) . ")";
}
// Additional membergroups (these are only relevant if not all primary groups where selected!).
if (!empty($_POST['membergroups'][2]) && (empty($_POST['membergroups'][1]) || count($context['membergroups']) != count($_POST['membergroups'][1]))) {
foreach ($_POST['membergroups'][2] as $mg) {
$mg_query_parts[] = "FIND_IN_SET(" . (int) $mg . ", additionalGroups)";
}
}
// Combine the one or two membergroup parts into one query part linked with an OR.
if (!empty($mg_query_parts)) {
$query_parts[] = '(' . implode(' OR ', $mg_query_parts) . ')';
}
// Get all selected post count related membergroups.
if (!empty($_POST['postgroups']) && count($_POST['postgroups']) != count($context['postgroups'])) {
$query_parts[] = "ID_POST_GROUP IN (" . implode(", ", $_POST['postgroups']) . ")";
}
// Construct the where part of the query.
$where = empty($query_parts) ? '1' : implode('
AND ', $query_parts);
$search_params = base64_encode(serialize(stripslashes__recursive($_POST)));
} else {
$search_params = null;
}
// Construct the additional URL part with the query info in it.
$context['params_url'] = $context['sub_action'] == 'query' ? ';sa=query;params=' . $search_params : '';
// Get the title and sub template ready..
$context['page_title'] = $txt[9];
$context['sub_template'] = 'view_members';
// Determine whether to show the 'delete members' checkboxes.
$context['can_delete_members'] = allowedTo('profile_remove_any');
// All the columns they have to pick from...
$context['columns'] = array('ID_MEMBER' => array('label' => $txt['member_id']), 'memberName' => array('label' => $txt[35]), 'realName' => array('label' => $txt['display_name']), 'emailAddress' => array('label' => $txt['email_address']), 'memberIP' => array('label' => $txt['ip_address']), 'lastLogin' => array('label' => $txt['viewmembers_online']), 'posts' => array('label' => $txt[26]));
// Default sort column to 'memberName' if the current one is unknown or not set.
if (!isset($_REQUEST['sort']) || !isset($context['columns'][$_REQUEST['sort']])) {
$_REQUEST['sort'] = 'memberName';
}
// Provide extra information about each column - the link, whether it's selected, etc.
foreach ($context['columns'] as $col => $dummy) {
$context['columns'][$col]['href'] = $scripturl . '?action=viewmembers' . $context['params_url'] . ';sort=' . $col . ';start=0';
if (!isset($_REQUEST['desc']) && $col == $_REQUEST['sort']) {
$context['columns'][$col]['href'] .= ';desc';
}
$context['columns'][$col]['link'] = '<a href="' . $context['columns'][$col]['href'] . '">' . $context['columns'][$col]['label'] . '</a>';
$context['columns'][$col]['selected'] = $_REQUEST['sort'] == $col;
}
$context['sort_by'] = $_REQUEST['sort'];
$context['sort_direction'] = !isset($_REQUEST['desc']) ? 'down' : 'up';
// Calculate the number of results.
if (empty($where) or $where == '1') {
$num_members = $modSettings['totalMembers'];
} else {
$request = db_query("\n\t\t\tSELECT COUNT(*)\n\t\t\tFROM {$db_prefix}members\n\t\t\tWHERE {$where}", __FILE__, __LINE__);
list($num_members) = mysql_fetch_row($request);
mysql_free_result($request);
}
// Construct the page links.
$context['page_index'] = constructPageIndex($scripturl . '?action=viewmembers' . $context['params_url'] . ';sort=' . $_REQUEST['sort'] . (isset($_REQUEST['desc']) ? ';desc' : ''), $_REQUEST['start'], $num_members, $modSettings['defaultMaxMembers']);
$context['start'] = (int) $_REQUEST['start'];
$request = db_query("\n\t\tSELECT ID_MEMBER, memberName, realName, emailAddress, memberIP, lastLogin, posts, is_activated\n\t\tFROM {$db_prefix}members" . ($context['sub_action'] == 'query' && !empty($where) ? "\n\t\tWHERE {$where}" : '') . "\n\t\tORDER BY {$_REQUEST['sort']}" . (!isset($_REQUEST['desc']) ? '' : ' DESC') . "\n\t\tLIMIT {$context['start']}, {$modSettings['defaultMaxMembers']}", __FILE__, __LINE__);
while ($row = mysql_fetch_assoc($request)) {
// Calculate number of days since last online.
if (empty($row['lastLogin'])) {
$difference = $txt['never'];
} else {
// Today or some time ago?
$difference = jeffsdatediff($row['lastLogin']);
if (empty($difference)) {
$difference = $txt['viewmembers_today'];
} elseif ($difference == 1) {
$difference .= ' ' . $txt['viewmembers_day_ago'];
} else {
$difference .= ' ' . $txt['viewmembers_days_ago'];
}
}
// Show it in italics if they're not activated...
if ($row['is_activated'] % 10 != 1) {
$difference = '<i title="' . $txt['not_activated'] . '">' . $difference . '</i>';
}
$context['members'][] = array('id' => $row['ID_MEMBER'], 'username' => $row['memberName'], 'name' => $row['realName'], 'email' => $row['emailAddress'], 'ip' => $row['memberIP'], 'last_active' => $difference, 'is_activated' => $row['is_activated'] % 10 == 1, 'posts' => $row['posts'], 'href' => $scripturl . '?action=profile;u=' . $row['ID_MEMBER'], 'link' => '<a href="' . $scripturl . '?action=profile;u=' . $row['ID_MEMBER'] . '">' . $row['realName'] . '</a>');
}
mysql_free_result($request);
}
function addslashes__recursive($var, $level = 0)
{
if (!is_array($var)) {
return addslashes($var);
}
// Reindex the array with slashes.
$new_var = array();
// Add slashes to every element, even the indexes!
foreach ($var as $k => $v) {
$new_var[addslashes($k)] = $level > 25 ? null : addslashes__recursive($v, $level + 1);
}
return $new_var;
}
function method_get_participated_topic()
{
global $context, $mobdb, $mobsettings, $modSettings, $user_info, $sourcedir;
// Guest?
if ($user_info['is_guest']) {
createErrorResponse(21);
}
// Get the username
$username = base64_decode($context['mob_request']['params'][0][0]);
if (empty($username)) {
createErrorResponse(8);
}
require_once $sourcedir . '/Subs-Auth.php';
######## Added by Sean##############
$username = htmltrim__recursive($username);
$username = stripslashes__recursive($username);
$username = htmlspecialchars__recursive($username);
$username = addslashes__recursive($username);
##################################################################
// Does this user exist?
$members = findMembers($username);
if (empty($members)) {
createErrorResponse(8);
}
$id_member = array_keys($members);
$member = $members[$id_member[0]];
if (empty($member)) {
createErrorResponse(8);
}
// Do we have start num defined?
if (isset($context['mob_request']['params'][1])) {
$start_num = (int) $context['mob_request']['params'][1][0];
}
// Do we have last number defined?
if (isset($context['mob_request']['params'][2])) {
$last_num = (int) $context['mob_request']['params'][2][0];
}
// Perform some start/last num checks
if (isset($start_num) && isset($last_num)) {
if ($start_num > $last_num) {
createErrorResponse(3);
} elseif ($last_num - $start_num > 50) {
$last_num = $start_num + 50;
}
}
// Default number of topics per page
$topics_per_page = 20;
// Generate the limit clause
$limit = '';
if (!isset($start_num) && !isset($last_num)) {
$start_num = 0;
$limit = $topics_per_page;
} elseif (isset($start_num) && !isset($last_num)) {
$limit = $topics_per_page;
} elseif (isset($start_num) && isset($last_num)) {
$limit = $last_num - $start_num + 1;
} elseif (empty($start_num) && empty($last_num)) {
$start_num = 0;
$limit = $topics_per_page;
}
// Get the count
$mobdb->query('
SELECT t.ID_TOPIC
FROM {db_prefix}messages AS m
INNER JOIN {db_prefix}topics AS t ON (m.ID_TOPIC = t.ID_TOPIC)
INNER JOIN {db_prefix}boards AS b ON (b.ID_BOARD = t.ID_BOARD)
WHERE {query_see_board}
AND m.ID_MEMBER = {int:member}
GROUP BY t.ID_TOPIC
ORDER BY t.ID_TOPIC DESC', array('member' => $id_member[0]));
$tids = array();
while ($row = $mobdb->fetch_assoc()) {
$tids[] = $row['ID_TOPIC'];
}
$mobdb->free_result();
$count = count($tids);
if ($limit + $start_num > $count) {
$limit = $count - $start_num;
}
$tids = array_slice($tids, $start_num, $limit);
$topics = array();
if (count($tids)) {
// Grab the topics
$mobdb->query('
SELECT t.ID_TOPIC AS id_topic, t.isSticky AS is_sticky, t.locked, fm.subject AS topic_title, t.numViews AS views, t.numReplies AS replies,
IFNULL(mem.ID_MEMBER, 0) AS id_member, mem.realName, mem.memberName, mem.avatar, IFNULL(a.ID_ATTACH, 0) AS id_attach, a.filename, a.attachmentType AS attachment_type,
IFNULL(lm.posterTime, fm.posterTime) AS last_message_time, ' . ($user_info['is_guest'] ? '0' : 'ln.ID_TOPIC AS is_notify, IFNULL(lt.ID_MSG, IFNULL(lmr.ID_MSG, -1)) + 1') . ' AS new_from,
IFNULL(lm.body, fm.body) AS body, lm.ID_MSG_MODIFIED AS id_msg_modified, b.name AS board_name, b.ID_BOARD AS id_board
FROM {db_prefix}messages AS m
INNER JOIN {db_prefix}topics AS t ON (m.ID_TOPIC = t.ID_TOPIC)
INNER JOIN {db_prefix}messages AS fm ON (t.ID_FIRST_MSG = fm.ID_MSG)
INNER JOIN {db_prefix}boards AS b ON (b.ID_BOARD = t.ID_BOARD)
LEFT JOIN {db_prefix}messages AS lm ON (t.ID_LAST_MSG = lm.ID_MSG)
LEFT JOIN {db_prefix}members AS mem ON (lm.ID_MEMBER = mem.ID_MEMBER)' . ($user_info['is_guest'] ? '' : '
LEFT JOIN {db_prefix}log_topics AS lt ON (lt.ID_TOPIC = t.ID_TOPIC AND lt.ID_MEMBER = {int:current_member})
LEFT JOIN {db_prefix}log_notify AS ln ON ((ln.ID_TOPIC = t.ID_TOPIC OR ln.ID_BOARD = t.ID_BOARD) AND ln.ID_MEMBER = {int:current_member})
LEFT JOIN {db_prefix}log_mark_read AS lmr ON (lmr.ID_BOARD = t.ID_BOARD AND lmr.ID_MEMBER = {int:current_member})') . '
LEFT JOIN {db_prefix}attachments AS a ON (a.ID_MEMBER = mem.ID_MEMBER)
WHERE {query_see_board}
AND m.ID_MEMBER = {int:member} AND t.ID_TOPIC IN ({array_int:topic_ids})
ORDER BY lm.posterTime DESC', array('current_member' => $user_info['id'], 'member' => $id_member[0], 'topic_ids' => $tids));
while ($row = $mobdb->fetch_assoc()) {
// Add stuff to the array
$topics[$row['id_topic']] = array('id' => $row['id_topic'], 'title' => processSubject($row['topic_title']), 'short_msg' => processShortContent($row['body']), 'replies' => $row['replies'], 'views' => $row['views'], 'poster' => array('id' => $row['id_member'], 'username' => $row['memberName'], 'post_name' => $row['realName'], 'avatar' => get_avatar($row)), 'is_new' => $user_info['is_guest'] ? 0 : $row['new_from'] <= $row['id_msg_modified'], 'board' => $row['id_board'], 'board_name' => $row['board_name'], 'post_time' => mobiquo_time($row['last_message_time']), 'is_marked_notify' => !empty($row['is_notify']), 'is_locked' => !empty($row['locked']));
}
$mobdb->free_result();
}
// LAME!
outputRPCSubscribedTopics($topics, $count);
}
function SendMailing()
{
global $txt, $db_prefix, $sourcedir, $context;
global $scripturl, $modSettings, $user_info;
checkSession();
require_once $sourcedir . '/Subs-Post.php';
// How many to send at once?
$num_at_once = 60;
// Get all the receivers.
$addressed = array_unique(explode(';', stripslashes($_POST['emails'])));
$cleanlist = array();
foreach ($addressed as $curmem) {
$curmem = trim($curmem);
if ($curmem != '') {
$cleanlist[$curmem] = $curmem;
}
}
$context['emails'] = implode(';', $cleanlist);
$context['subject'] = htmlspecialchars(stripslashes($_POST['subject']));
$context['message'] = htmlspecialchars(stripslashes($_POST['message']));
$context['send_html'] = !empty($_POST['send_html']) ? '1' : '0';
$context['parse_html'] = !empty($_POST['parse_html']) ? '1' : '0';
$context['start'] = isset($_REQUEST['start']) ? $_REQUEST['start'] : 0;
$send_list = array();
$i = 0;
foreach ($cleanlist as $email) {
if (++$i <= $context['start']) {
continue;
}
if ($i > $context['start'] + $num_at_once) {
break;
}
$send_list[$email] = $email;
}
$context['start'] += $num_at_once;
$context['percentage_done'] = round($context['start'] * 100 / count($cleanlist), 2);
// Prepare the message for HTML.
if (!empty($_POST['send_html']) && !empty($_POST['parse_html'])) {
$_POST['message'] = str_replace(array("\n", ' '), array("<br />\n", ' '), stripslashes($_POST['message']));
} else {
$_POST['message'] = stripslashes($_POST['message']);
}
// Use the default time format.
$user_info['time_format'] = $modSettings['time_format'];
$variables = array('{$board_url}', '{$current_time}', '{$latest_member.link}', '{$latest_member.id}', '{$latest_member.name}');
// Replace in all the standard things.
$_POST['message'] = str_replace($variables, array(!empty($_POST['send_html']) ? '<a href="' . $scripturl . '">' . $scripturl . '</a>' : $scripturl, timeformat(forum_time(), false), !empty($_POST['send_html']) ? '<a href="' . $scripturl . '?action=profile;u=' . $modSettings['latestMember'] . '">' . $modSettings['latestRealName'] . '</a>' : $modSettings['latestRealName'], $modSettings['latestMember'], $modSettings['latestRealName']), $_POST['message']);
$_POST['subject'] = str_replace($variables, array($scripturl, timeformat(forum_time(), false), $modSettings['latestRealName'], $modSettings['latestMember'], $modSettings['latestRealName']), stripslashes($_POST['subject']));
$from_member = array('{$member.email}', '{$member.link}', '{$member.id}', '{$member.name}');
// This is here to prevent spam filters from tagging this as spam.
if (!empty($_POST['send_html']) && preg_match('~\\<html~i', $_POST['message']) == 0) {
if (preg_match('~\\<body~i', $_POST['message']) == 0) {
$_POST['message'] = '<html><head><title>' . $_POST['subject'] . '</title></head>' . "\n" . '<body>' . $_POST['message'] . '</body></html>';
} else {
$_POST['message'] = '<html>' . $_POST['message'] . '</html>';
}
}
$result = db_query("\n\t\tSELECT realName, memberName, ID_MEMBER, emailAddress\n\t\tFROM {$db_prefix}members\n\t\tWHERE emailAddress IN ('" . implode("', '", addslashes__recursive($send_list)) . "')\n\t\t\tAND is_activated = 1", __FILE__, __LINE__);
while ($row = mysql_fetch_assoc($result)) {
unset($send_list[$row['emailAddress']]);
$to_member = array($row['emailAddress'], !empty($_POST['send_html']) ? '<a href="' . $scripturl . '?action=profile;u=' . $row['ID_MEMBER'] . '">' . $row['realName'] . '</a>' : $scripturl . '?action=profile;u=' . $row['ID_MEMBER'], $row['ID_MEMBER'], $row['realName']);
// Send the actual email off, replacing the member dependent variables.
sendmail($row['emailAddress'], str_replace($from_member, $to_member, addslashes($_POST['subject'])), str_replace($from_member, $to_member, addslashes($_POST['message'])), null, null, !empty($_POST['send_html']));
}
mysql_free_result($result);
// Send the emails to people who weren't members....
if (!empty($send_list)) {
foreach ($send_list as $email) {
$to_member = array($email, !empty($_POST['send_html']) ? '<a href="mailto:' . $email . '">' . $email . '</a>' : $email, '??', $email);
sendmail($email, str_replace($from_member, $to_member, addslashes($_POST['subject'])), str_replace($from_member, $to_member, addslashes($_POST['message'])), null, null, !empty($_POST['send_html']));
}
}
// Still more to do?
if (count($cleanlist) > $context['start']) {
$context['page_title'] = $txt[6];
$context['sub_template'] = 'email_members_send';
return;
}
redirectexit('action=admin');
}
