Mercurial > hg > vamp-website

comparison forum/Sources/SendTopic.php @ 76:e3e11437ecea website

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Add forum code
author Chris Cannam
date Sun, 07 Jul 2013 11:25:48 +0200
parents
children
comparison
equal deleted inserted replaced
75:72f59aa7e503 76:e3e11437ecea
1 <?php
2
3 /**
4 * Simple Machines Forum (SMF)
5 *
6 * @package SMF
7 * @author Simple Machines http://www.simplemachines.org
8 * @copyright 2011 Simple Machines
9 * @license http://www.simplemachines.org/about/smf/license.php BSD
10 *
11 * @version 2.0
12 */
13
14 if (!defined('SMF'))
15 die('Hacking attempt...');
16
17 /* The functions in this file deal with sending topics to a friend or
18 moderator, and those functions are:
19
20 void SendTopic()
21 - sends information about a topic to a friend.
22 - uses the SendTopic template, with the main sub template.
23 - requires the send_topic permission.
24 - redirects back to the first page of the topic when done.
25 - is accessed via ?action=emailuser;sa=sendtopic.
26
27 void CustomEmail()
28 - send an email to the user - allow the sender to write the message.
29 - can either be passed a user ID as uid or a message id as msg.
30 - does not check permissions for a message ID as there is no information disclosed.
31
32 void ReportToModerator()
33 - gathers data from the user to report abuse to the moderator(s).
34 - uses the ReportToModerator template, main sub template.
35 - requires the report_any permission.
36 - uses ReportToModerator2() if post data was sent.
37 - accessed through ?action=reporttm.
38
39 void ReportToModerator2()
40 - sends off emails to all the moderators.
41 - sends to administrators and global moderators. (1 and 2)
42 - called by ReportToModerator(), and thus has the same permission
43 and setting requirements as it does.
44 - accessed through ?action=reporttm when posting.
45
46 */
47
48 // The main handling function for sending specialist (Or otherwise) emails to a user.
49 function EmailUser()
50 {
51 global $topic, $txt, $context, $scripturl, $sourcedir, $smcFunc;
52
53 // Don't index anything here.
54 $context['robot_no_index'] = true;
55
56 // Load the template.
57 loadTemplate('SendTopic');
58
59 $sub_actions = array(
60 'email' => 'CustomEmail',
61 'sendtopic' => 'SendTopic',
62 );
63
64 if (!isset($_GET['sa']) || !isset($sub_actions[$_GET['sa']]))
65 $_GET['sa'] = 'sendtopic';
66
67 $sub_actions[$_GET['sa']]();
68 }
69
70 // Send a topic to a friend.
71 function SendTopic()
72 {
73 global $topic, $txt, $context, $scripturl, $sourcedir, $smcFunc, $modSettings;
74
75 // Check permissions...
76 isAllowedTo('send_topic');
77
78 // We need at least a topic... go away if you don't have one.
79 if (empty($topic))
80 fatal_lang_error('not_a_topic', false);
81
82 // Get the topic's subject.
83 $request = $smcFunc['db_query']('', '
84 SELECT m.subject, t.approved
85 FROM {db_prefix}topics AS t
86 INNER JOIN {db_prefix}messages AS m ON (m.id_msg = t.id_first_msg)
87 WHERE t.id_topic = {int:current_topic}
88 LIMIT 1',
89 array(
90 'current_topic' => $topic,
91 )
92 );
93 if ($smcFunc['db_num_rows']($request) == 0)
94 fatal_lang_error('not_a_topic', false);
95 $row = $smcFunc['db_fetch_assoc']($request);
96 $smcFunc['db_free_result']($request);
97
98 // Can't send topic if its unapproved and using post moderation.
99 if ($modSettings['postmod_active'] && !$row['approved'])
100 fatal_lang_error('not_approved_topic', false);
101
102 // Censor the subject....
103 censorText($row['subject']);
104
105 // Sending yet, or just getting prepped?
106 if (empty($_POST['send']))
107 {
108 $context['page_title'] = sprintf($txt['sendtopic_title'], $row['subject']);
109 $context['start'] = $_REQUEST['start'];
110
111 return;
112 }
113
114 // Actually send the message...
115 checkSession();
116 spamProtection('sendtopc');
117
118 // This is needed for sendmail().
119 require_once($sourcedir . '/Subs-Post.php');
120
121 // Trim the names..
122 $_POST['y_name'] = trim($_POST['y_name']);
123 $_POST['r_name'] = trim($_POST['r_name']);
124
125 // Make sure they aren't playing "let's use a fake email".
126 if ($_POST['y_name'] == '_' || !isset($_POST['y_name']) || $_POST['y_name'] == '')
127 fatal_lang_error('no_name', false);
128 if (!isset($_POST['y_email']) || $_POST['y_email'] == '')
129 fatal_lang_error('no_email', false);
130 if (preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', $_POST['y_email']) == 0)
131 fatal_lang_error('email_invalid_character', false);
132
133 // The receiver should be valid to.
134 if ($_POST['r_name'] == '_' || !isset($_POST['r_name']) || $_POST['r_name'] == '')
135 fatal_lang_error('no_name', false);
136 if (!isset($_POST['r_email']) || $_POST['r_email'] == '')
137 fatal_lang_error('no_email', false);
138 if (preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', $_POST['r_email']) == 0)
139 fatal_lang_error('email_invalid_character', false);
140
141 // Emails don't like entities...
142 $row['subject'] = un_htmlspecialchars($row['subject']);
143
144 $replacements = array(
145 'TOPICSUBJECT' => $row['subject'],
146 'SENDERNAME' => $_POST['y_name'],
147 'RECPNAME' => $_POST['r_name'],
148 'TOPICLINK' => $scripturl . '?topic=' . $topic . '.0',
149 );
150
151 $emailtemplate = 'send_topic';
152
153 if (!empty($_POST['comment']))
154 {
155 $emailtemplate .= '_comment';
156 $replacements['COMMENT'] = $_POST['comment'];
157 }
158
159 $emaildata = loadEmailTemplate($emailtemplate, $replacements);
160 // And off we go!
161 sendmail($_POST['r_email'], $emaildata['subject'], $emaildata['body'], $_POST['y_email']);
162
163 // Back to the topic!
164 redirectexit('topic=' . $topic . '.0');
165 }
166
167 // Allow a user to send an email.
168 function CustomEmail()
169 {
170 global $context, $modSettings, $user_info, $smcFunc, $txt, $scripturl, $sourcedir;
171
172 // Can the user even see this information?
173 if ($user_info['is_guest'] && !empty($modSettings['guest_hideContacts']))
174 fatal_lang_error('no_access', false);
175
176 // Are we sending to a user?
177 $context['form_hidden_vars'] = array();
178 if (isset($_REQUEST['uid']))
179 {
180 $request = $smcFunc['db_query']('', '
181 SELECT email_address AS email, real_name AS name, id_member, hide_email
182 FROM {db_prefix}members
183 WHERE id_member = {int:id_member}',
184 array(
185 'id_member' => (int) $_REQUEST['uid'],
186 )
187 );
188
189 $context['form_hidden_vars']['uid'] = (int) $_REQUEST['uid'];
190 }
191 elseif (isset($_REQUEST['msg']))
192 {
193 $request = $smcFunc['db_query']('', '
194 SELECT IFNULL(mem.email_address, m.poster_email) AS email, IFNULL(mem.real_name, m.poster_name) AS name, IFNULL(mem.id_member, 0) AS id_member, hide_email
195 FROM {db_prefix}messages AS m
196 LEFT JOIN {db_prefix}members AS mem ON (mem.id_member = m.id_member)
197 WHERE m.id_msg = {int:id_msg}',
198 array(
199 'id_msg' => (int) $_REQUEST['msg'],
200 )
201 );
202
203 $context['form_hidden_vars']['msg'] = (int) $_REQUEST['msg'];
204 }
205
206 if (empty($request) || $smcFunc['db_num_rows']($request) == 0)
207 fatal_lang_error('cant_find_user_email');
208
209 $row = $smcFunc['db_fetch_assoc']($request);
210 $smcFunc['db_free_result']($request);
211
212 // Are you sure you got the address?
213 if (empty($row['email']))
214 fatal_lang_error('cant_find_user_email');
215
216 // Can they actually do this?
217 $context['show_email_address'] = showEmailAddress(!empty($row['hide_email']), $row['id_member']);
218 if ($context['show_email_address'] === 'no')
219 fatal_lang_error('no_access', false);
220
221 // Setup the context!
222 $context['recipient'] = array(
223 'id' => $row['id_member'],
224 'name' => $row['name'],
225 'email' => $row['email'],
226 'email_link' => ($context['show_email_address'] == 'yes_permission_override' ? '<em>' : '') . '<a href="mailto:' . $row['email'] . '">' . $row['email'] . '</a>' . ($context['show_email_address'] == 'yes_permission_override' ? '</em>' : ''),
227 'link' => $row['id_member'] ? '<a href="' . $scripturl . '?action=profile;u=' . $row['id_member'] . '">' . $row['name'] . '</a>' : $row['name'],
228 );
229
230 // Can we see this person's email address?
231 $context['can_view_receipient_email'] = $context['show_email_address'] == 'yes' || $context['show_email_address'] == 'yes_permission_override';
232
233 // Are we actually sending it?
234 if (isset($_POST['send']) && isset($_POST['email_body']))
235 {
236 require_once($sourcedir . '/Subs-Post.php');
237
238 checkSession();
239
240 // If it's a guest sort out their names.
241 if ($user_info['is_guest'])
242 {
243 if (empty($_POST['y_name']) || $_POST['y_name'] == '_' || trim($_POST['y_name']) == '')
244 fatal_lang_error('no_name', false);
245 if (empty($_POST['y_email']))
246 fatal_lang_error('no_email', false);
247 if (preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', $_POST['y_email']) == 0)
248 fatal_lang_error('email_invalid_character', false);
249
250 $from_name = trim($_POST['y_name']);
251 $from_email = trim($_POST['y_email']);
252 }
253 else
254 {
255 $from_name = $user_info['name'];
256 $from_email = $user_info['email'];
257 }
258
259 // Check we have a body (etc).
260 if (trim($_POST['email_body']) == '' || trim($_POST['email_subject']) == '')
261 fatal_lang_error('email_missing_data');
262
263 // We use a template in case they want to customise!
264 $replacements = array(
265 'EMAILSUBJECT' => $_POST['email_subject'],
266 'EMAILBODY' => $_POST['email_body'],
267 'SENDERNAME' => $from_name,
268 'RECPNAME' => $context['recipient']['name'],
269 );
270
271 // Don't let them send too many!
272 spamProtection('sendmail');
273
274 // Get the template and get out!
275 $emaildata = loadEmailTemplate('send_email', $replacements);
276 sendmail($context['recipient']['email'], $emaildata['subject'], $emaildata['body'], $from_email, null, false, 1, null, true);
277
278 // Now work out where to go!
279 if (isset($_REQUEST['uid']))
280 redirectexit('action=profile;u=' . (int) $_REQUEST['uid']);
281 elseif (isset($_REQUEST['msg']))
282 redirectexit('msg=' . (int) $_REQUEST['msg']);
283 else
284 redirectexit();
285 }
286
287 $context['sub_template'] = 'custom_email';
288 $context['page_title'] = $txt['send_email'];
289 }
290
291 // Report a post to the moderator... ask for a comment.
292 function ReportToModerator()
293 {
294 global $txt, $topic, $sourcedir, $modSettings, $user_info, $context, $smcFunc;
295
296 $context['robot_no_index'] = true;
297
298 // You can't use this if it's off or you are not allowed to do it.
299 isAllowedTo('report_any');
300
301 // If they're posting, it should be processed by ReportToModerator2.
302 if ((isset($_POST[$context['session_var']]) || isset($_POST['submit'])) && empty($context['post_errors']))
303 ReportToModerator2();
304
305 // We need a message ID to check!
306 if (empty($_REQUEST['msg']) && empty($_REQUEST['mid']))
307 fatal_lang_error('no_access', false);
308
309 // For compatibility, accept mid, but we should be using msg. (not the flavor kind!)
310 $_REQUEST['msg'] = empty($_REQUEST['msg']) ? (int) $_REQUEST['mid'] : (int) $_REQUEST['msg'];
311
312 // Check the message's ID - don't want anyone reporting a post they can't even see!
313 $result = $smcFunc['db_query']('', '
314 SELECT m.id_msg, m.id_member, t.id_member_started
315 FROM {db_prefix}messages AS m
316 INNER JOIN {db_prefix}topics AS t ON (t.id_topic = {int:current_topic})
317 WHERE m.id_msg = {int:id_msg}
318 AND m.id_topic = {int:current_topic}
319 LIMIT 1',
320 array(
321 'current_topic' => $topic,
322 'id_msg' => $_REQUEST['msg'],
323 )
324 );
325 if ($smcFunc['db_num_rows']($result) == 0)
326 fatal_lang_error('no_board', false);
327 list ($_REQUEST['msg'], $member, $starter) = $smcFunc['db_fetch_row']($result);
328 $smcFunc['db_free_result']($result);
329
330 // Do we need to show the visual verification image?
331 $context['require_verification'] = $user_info['is_guest'] && !empty($modSettings['guests_report_require_captcha']);
332 if ($context['require_verification'])
333 {
334 require_once($sourcedir . '/Subs-Editor.php');
335 $verificationOptions = array(
336 'id' => 'report',
337 );
338 $context['require_verification'] = create_control_verification($verificationOptions);
339 $context['visual_verification_id'] = $verificationOptions['id'];
340 }
341
342 // Show the inputs for the comment, etc.
343 loadLanguage('Post');
344 loadTemplate('SendTopic');
345
346 $context['comment_body'] = !isset($_POST['comment']) ? '' : trim($_POST['comment']);
347 $context['email_address'] = !isset($_POST['email']) ? '' : trim($_POST['email']);
348
349 // This is here so that the user could, in theory, be redirected back to the topic.
350 $context['start'] = $_REQUEST['start'];
351 $context['message_id'] = $_REQUEST['msg'];
352
353 $context['page_title'] = $txt['report_to_mod'];
354 $context['sub_template'] = 'report';
355 }
356
357 // Send the emails.
358 function ReportToModerator2()
359 {
360 global $txt, $scripturl, $topic, $board, $user_info, $modSettings, $sourcedir, $language, $context, $smcFunc;
361
362 // You must have the proper permissions!
363 isAllowedTo('report_any');
364
365 // Make sure they aren't spamming.
366 spamProtection('reporttm');
367
368 require_once($sourcedir . '/Subs-Post.php');
369
370 // No errors, yet.
371 $post_errors = array();
372
373 // Check their session.
374 if (checkSession('post', '', false) != '')
375 $post_errors[] = 'session_timeout';
376
377 // Make sure we have a comment and it's clean.
378 if (!isset($_POST['comment']) || $smcFunc['htmltrim']($_POST['comment']) === '')
379 $post_errors[] = 'no_comment';
380 $poster_comment = strtr($smcFunc['htmlspecialchars']($_POST['comment']), array("\r" => '', "\n" => '', "\t" => ''));
381
382 // Guests need to provide their address!
383 if ($user_info['is_guest'])
384 {
385 $_POST['email'] = !isset($_POST['email']) ? '' : trim($_POST['email']);
386 if ($_POST['email'] === '')
387 $post_errors[] = 'no_email';
388 elseif (preg_match('~^[0-9A-Za-z=_+\-/][0-9A-Za-z=_\'+\-/\.]*@[\w\-]+(\.[\w\-]+)*(\.[\w]{2,6})$~', $_POST['email']) == 0)
389 $post_errors[] = 'bad_email';
390
391 isBannedEmail($_POST['email'], 'cannot_post', sprintf($txt['you_are_post_banned'], $txt['guest_title']));
392
393 $user_info['email'] = htmlspecialchars($_POST['email']);
394 }
395
396 // Could they get the right verification code?
397 if ($user_info['is_guest'] && !empty($modSettings['guests_report_require_captcha']))
398 {
399 require_once($sourcedir . '/Subs-Editor.php');
400 $verificationOptions = array(
401 'id' => 'report',
402 );
403 $context['require_verification'] = create_control_verification($verificationOptions, true);
404 if (is_array($context['require_verification']))
405 $post_errors = array_merge($post_errors, $context['require_verification']);
406 }
407
408 // Any errors?
409 if (!empty($post_errors))
410 {
411 loadLanguage('Errors');
412
413 $context['post_errors'] = array();
414 foreach ($post_errors as $post_error)
415 $context['post_errors'][] = $txt['error_' . $post_error];
416
417 return ReportToModerator();
418 }
419
420 // Get the basic topic information, and make sure they can see it.
421 $_POST['msg'] = (int) $_POST['msg'];
422
423 $request = $smcFunc['db_query']('', '
424 SELECT m.id_topic, m.id_board, m.subject, m.body, m.id_member AS id_poster, m.poster_name, mem.real_name
425 FROM {db_prefix}messages AS m
426 LEFT JOIN {db_prefix}members AS mem ON (m.id_member = mem.id_member)
427 WHERE m.id_msg = {int:id_msg}
428 AND m.id_topic = {int:current_topic}
429 LIMIT 1',
430 array(
431 'current_topic' => $topic,
432 'id_msg' => $_POST['msg'],
433 )
434 );
435 if ($smcFunc['db_num_rows']($request) == 0)
436 fatal_lang_error('no_board', false);
437 $message = $smcFunc['db_fetch_assoc']($request);
438 $smcFunc['db_free_result']($request);
439
440 $poster_name = un_htmlspecialchars($message['real_name']) . ($message['real_name'] != $message['poster_name'] ? ' (' . $message['poster_name'] . ')' : '');
441 $reporterName = un_htmlspecialchars($user_info['name']) . ($user_info['name'] != $user_info['username'] && $user_info['username'] != '' ? ' (' . $user_info['username'] . ')' : '');
442 $subject = un_htmlspecialchars($message['subject']);
443
444 // Get a list of members with the moderate_board permission.
445 require_once($sourcedir . '/Subs-Members.php');
446 $moderators = membersAllowedTo('moderate_board', $board);
447
448 $request = $smcFunc['db_query']('', '
449 SELECT id_member, email_address, lngfile, mod_prefs
450 FROM {db_prefix}members
451 WHERE id_member IN ({array_int:moderator_list})
452 AND notify_types != {int:notify_types}
453 ORDER BY lngfile',
454 array(
455 'moderator_list' => $moderators,
456 'notify_types' => 4,
457 )
458 );
459
460 // Check that moderators do exist!
461 if ($smcFunc['db_num_rows']($request) == 0)
462 fatal_lang_error('no_mods', false);
463
464 // If we get here, I believe we should make a record of this, for historical significance, yabber.
465 if (empty($modSettings['disable_log_report']))
466 {
467 $request2 = $smcFunc['db_query']('', '
468 SELECT id_report, ignore_all
469 FROM {db_prefix}log_reported
470 WHERE id_msg = {int:id_msg}
471 AND (closed = {int:not_closed} OR ignore_all = {int:ignored})
472 ORDER BY ignore_all DESC',
473 array(
474 'id_msg' => $_POST['msg'],
475 'not_closed' => 0,
476 'ignored' => 1,
477 )
478 );
479 if ($smcFunc['db_num_rows']($request2) != 0)
480 list ($id_report, $ignore) = $smcFunc['db_fetch_row']($request2);
481 $smcFunc['db_free_result']($request2);
482
483 // If we're just going to ignore these, then who gives a monkeys...
484 if (!empty($ignore))
485 redirectexit('topic=' . $topic . '.msg' . $_POST['msg'] . '#msg' . $_POST['msg']);
486
487 // Already reported? My god, we could be dealing with a real rogue here...
488 if (!empty($id_report))
489 $smcFunc['db_query']('', '
490 UPDATE {db_prefix}log_reported
491 SET num_reports = num_reports + 1, time_updated = {int:current_time}
492 WHERE id_report = {int:id_report}',
493 array(
494 'current_time' => time(),
495 'id_report' => $id_report,
496 )
497 );
498 // Otherwise, we shall make one!
499 else
500 {
501 if (empty($message['real_name']))
502 $message['real_name'] = $message['poster_name'];
503
504 $smcFunc['db_insert']('',
505 '{db_prefix}log_reported',
506 array(
507 'id_msg' => 'int', 'id_topic' => 'int', 'id_board' => 'int', 'id_member' => 'int', 'membername' => 'string',
508 'subject' => 'string', 'body' => 'string', 'time_started' => 'int', 'time_updated' => 'int',
509 'num_reports' => 'int', 'closed' => 'int',
510 ),
511 array(
512 $_POST['msg'], $message['id_topic'], $message['id_board'], $message['id_poster'], $message['real_name'],
513 $message['subject'], $message['body'] , time(), time(), 1, 0,
514 ),
515 array('id_report')
516 );
517 $id_report = $smcFunc['db_insert_id']('{db_prefix}log_reported', 'id_report');
518 }
519
520 // Now just add our report...
521 if ($id_report)
522 {
523 $smcFunc['db_insert']('',
524 '{db_prefix}log_reported_comments',
525 array(
526 'id_report' => 'int', 'id_member' => 'int', 'membername' => 'string', 'email_address' => 'string',
527 'member_ip' => 'string', 'comment' => 'string', 'time_sent' => 'int',
528 ),
529 array(
530 $id_report, $user_info['id'], $user_info['name'], $user_info['email'],
531 $user_info['ip'], $poster_comment, time(),
532 ),
533 array('id_comment')
534 );
535 }
536 }
537
538 // Find out who the real moderators are - for mod preferences.
539 $request2 = $smcFunc['db_query']('', '
540 SELECT id_member
541 FROM {db_prefix}moderators
542 WHERE id_board = {int:current_board}',
543 array(
544 'current_board' => $board,
545 )
546 );
547 $real_mods = array();
548 while ($row = $smcFunc['db_fetch_assoc']($request2))
549 $real_mods[] = $row['id_member'];
550 $smcFunc['db_free_result']($request2);
551
552 // Send every moderator an email.
553 while ($row = $smcFunc['db_fetch_assoc']($request))
554 {
555 // Maybe they don't want to know?!
556 if (!empty($row['mod_prefs']))
557 {
558 list(,, $pref_binary) = explode('|', $row['mod_prefs']);
559 if (!($pref_binary & 1) && (!($pref_binary & 2) || !in_array($row['id_member'], $real_mods)))
560 continue;
561 }
562
563 $replacements = array(
564 'TOPICSUBJECT' => $subject,
565 'POSTERNAME' => $poster_name,
566 'REPORTERNAME' => $reporterName,
567 'TOPICLINK' => $scripturl . '?topic=' . $topic . '.msg' . $_POST['msg'] . '#msg' . $_POST['msg'],
568 'REPORTLINK' => !empty($id_report) ? $scripturl . '?action=moderate;area=reports;report=' . $id_report : '',
569 'COMMENT' => $_POST['comment'],
570 );
571
572 $emaildata = loadEmailTemplate('report_to_moderator', $replacements, empty($row['lngfile']) || empty($modSettings['userLanguage']) ? $language : $row['lngfile']);
573
574 // Send it to the moderator.
575 sendmail($row['email_address'], $emaildata['subject'], $emaildata['body'], $user_info['email'], null, false, 2);
576 }
577 $smcFunc['db_free_result']($request);
578
579 // Keep track of when the mod reports get updated, that way we know when we need to look again.
580 updateSettings(array('last_mod_report_action' => time()));
581
582 // Back to the post we reported!
583 redirectexit('reportsent;topic=' . $topic . '.msg' . $_POST['msg'] . '#msg' . $_POST['msg']);
584 }
585
586 ?>