Decir: comparison decir/posting.php

equal deleted inserted replaced

-:0417a5a0c7be
+:6f8b7c6fac02
 $parms2 = unserialize($parms2);
 $mode = 'already_taken_care_of';
 }
 else if ( isset($_POST['do']['post']) )
 {
+$errors = Array();
 // Decrypt authorization array
 $parms = $aes->decrypt($_POST['authorization'], $session->private_key, ENC_HEX);
+if ( !$parms )
+$errors[] = 'Could not decrypt authorization key.';
 $parms = unserialize($parms);
 // Perform a little input validation
-$errors = Array();
 if ( empty($_POST['post_text']) )
 $errors[] = 'Please enter a post.';
 if ( empty($_POST['subject']) && $parms['mode'] == 'topic' )
 $errors[] = 'Please enter a topic title.';
 // It's OK to trust this! The auth key is encrypted with the site's private key.
 if ( !$parms['authorized'] )
 $errors[] = 'Invalid authorization key';
-if ( sizeof($errors) > 0 )
+if ( sizeof($errors) < 1 )
 {
 // Collect other options
 // Submit post
-decir_submit_post();
+if ( $parms['mode'] == 'reply' || $parms['mode'] == 'quote' )
+{
+$result = decir_submit_post($parms['topic_in'], $_POST['subject'], $_POST['post_text'], $post_id);
+if ( $result )
+{
+// update forum stats
+$user = $db->escape($session->username);
+$q = $db->sql_query('UPDATE '.table_prefix."decir_forums SET num_posts = num_posts+1, last_post_id = $post_id, last_post_topic = {$parms['topic_in']}, last_post_user = $session->user_id WHERE forum_id={$parms['forum_in']};");
+if ( !$q )
+{
+$db->_die('Decir posting.php under Submit post [reply]');
+}
+$url = makeUrlNS('Special', 'Forum/Topic/' . $parms['topic_in'], false, true);
+redirect($url, 'Post submitted', 'Your post has been submitted successfully.', 4);
+}
+}
+else if ( $parms['mode'] == 'topic' )
+{
+$result = decir_submit_topic($parms['forum_id'], $_POST['subject'], $_POST['post_text'], $topic_id, $post_id);
+if ( $result )
+{
+// update forum stats
+$q = $db->sql_query('UPDATE '.table_prefix."decir_forums SET num_posts = num_posts+1, num_topics = num_topics+1, last_post_id = $post_id, last_post_topic = $topic_id, last_post_user = $session->user_id WHERE forum_id={$parms['forum_id']};");
+if ( !$q )
+{
+$db->_die('Decir posting.php under Submit post [topic]');
+}
+$url = makeUrlNS('Special', 'Forum/Topic/' . $topic_id, false, true);
+redirect($url, 'Post submitted', 'Your post has been submitted successfully.', 4);
+}
+}
 return;
 }
+$mode = 'already_taken_care_of';
+$parms2 = $parms;
+$parms = htmlspecialchars($_POST['authorization']);
 }
 }
 if ( $mode == 'reply' || $mode == 'quote' )
 {
 if ( $mode == 'reply' )
 {
 $message = '';
+$subject = '';
 // Validate topic ID
 $topic_id = intval($paths->getParam(2));
 if ( empty($topic_id) )
 die_friendly('Error', '<p>Invalid topic ID</p>');
 $title = 'Reply to topic';
 $post_id = intval($paths->getParam(2));
 if ( empty($post_id) )
 die_friendly('Error', '<p>Invalid post ID</p>');
 // Get post text and topic ID
-$q = $db->sql_query('SELECT p.topic_id,t.post_text,t.bbcode_uid,p.poster_name FROM '.table_prefix.'decir_posts AS p
+$q = $db->sql_query('SELECT p.topic_id,t.post_text,t.bbcode_uid,p.poster_name,p.post_subject FROM '.table_prefix.'decir_posts AS p
 LEFT JOIN '.table_prefix.'decir_posts_text AS t
 ON ( p.post_id = t.post_id )
 WHERE p.post_id=' . $post_id . ';');
 if ( !$q )
 $row = $db->fetchrow();
 $db->free_result();
 $message = '[quote="' . $row['poster_name'] . '"]' . bbcode_strip_uid( $row['post_text'], $row['bbcode_uid'] ) . '[/quote]';
+$subject = 'Re: ' . htmlspecialchars($row['post_subject']);
 $quote_poster = $row['poster_name'];
 $topic_id = intval($row['topic_id']);
 $title = 'Reply to topic with quote';
 $db->_die();
 $row = $db->fetchrow();
 $db->free_result();
-$forum_perms = $session->fetch_page_acl('DecirForum', $row['forum_id']);
+$forum_perms = $session->fetch_page_acl($row['forum_id'], 'DecirForum');
-$topic_perms = $session->fetch_page_acl('DecirTopic', $row['topic_id']);
+$topic_perms = $session->fetch_page_acl($row['topic_id'], 'DecirTopic');
 if ( !$forum_perms->get_permissions('decir_see_forum') )
 die_friendly('Error', '<p>The forum you requested does not exist.</p>');
 if ( !$topic_perms->get_permissions('decir_reply') )
 }
 else if ( $mode == 'topic' )
 {
 $message = '';
+$subject = '';
 // Validate topic ID
 $forum_id = intval($paths->getParam(2));
 if ( empty($forum_id) )
 die_friendly('Error', '<p>Invalid forum ID</p>');
 $title = 'Post new topic';
 // Topic ID is good, verify topic status
-$q = $db->sql_query('SELECT forum_id FROM '.table_prefix.'decir_forums WHERE forum_id=' . $forum_id . ';');
+$q = $db->sql_query('SELECT forum_id, forum_name FROM '.table_prefix.'decir_forums WHERE forum_id=' . $forum_id . ';');
 if ( !$q )
 $db->_die();
 if ( $db->numrows() < 1 )
 die_friendly('Error', '<p>The forum you requested does not exist.</p>');
 $row = $db->fetchrow();
 $db->free_result();
-$forum_perms = $session->fetch_page_acl('DecirForum', $row['forum_id']);
+$forum_perms = $session->fetch_page_acl($row['forum_id'], 'DecirForum');
 if ( !$forum_perms->get_permissions('decir_see_forum') )
 die_friendly('Error', '<p>The forum you requested does not exist.</p>');
 $parms = Array(
 'mode' => $mode,
-'forum_in' => $forum_in,
+'forum_id' => $forum_id,
 'timestamp' => time(),
 'authorized' => true
 );
 $parms = serialize($parms);
 }
 else if ( $mode == 'already_taken_care_of' )
 {
 $mode = $parms2['mode'];
-$title = ( $mode == 'topic' ) ? 'Post new topic' : ( $mode == 'reply' ) ? 'Reply to topic' : ( $mode  == 'quote' ) ? 'Reply to topic with quote' : 'Duh...';
+$title = ( $mode == 'topic' ) ? 'Post new topic' : ( ( $mode == 'reply' ) ? 'Reply to topic' : ( $mode  == 'quote' ) ? 'Reply to topic with quote' : 'Duh...' );
 }
 else
 {
 die_friendly('Invalid request', '<p>Invalid action defined</p>');
 }
 <link rel="stylesheet" type="text/css" href="' . scriptPath . '/decir/js/colorpick/farbtastic.css" />
 <!-- DECIR END -->');
 $template->header();
+if ( isset($errors) )
+{
+echo '<div class="error-box" style="margin: 10px 0;">
+<b>Your post could not be submitted.</b>
+<ul>
+<li>' . implode("</li>\n            <li>", $errors) . '</li>
+</ul>
+</div>';
+}
 if ( $do_preview )
 {
-echo 'Doing preview';
+$message = $_POST['post_text'];
+$subject = htmlspecialchars($_POST['subject']);
+$message_render = render_bbcode($message);
+$message_render = RenderMan::smilieyize($message_render);
+echo '<div style="border: 1px solid #222222; background-color: #F0F0F0; padding: 10px; max-height: 300px; clip: rect(0px,auto,auto,0px); overflow: auto; margin: 10px 0;">
+<h2>Post preview</h2>
+<p>' . $message_render . '</p>
+</div>';
 }
 $url = makeUrlNS('Special', 'Forum/New', 'act=post', true);
 echo '<br />
 <form action="' . $url . '" method="post" enctype="multipart/form-data">';
+echo '<div class="tblholder">
+<table border="0" cellspacing="1" cellpadding="4">';
+echo '<tr><td class="row2">Post subject:</td><td class="row1"><input name="subject" type="text" size="50" style="width: 100%;" value="' . $subject . '" /></td>';
+echo '<tr><td class="row3" colspan="2">';
 echo '<textarea name="post_text" class="bbcode" rows="20" cols="80">' . $message . '</textarea>';
-echo '<input type="hidden" name="authorization" value="' . $parms . '" />';
+echo '</td></tr>';
-echo '<div style="text-align: center; margin-top: 10px;"><input type="submit" name="do[post]" value="Submit post" style="font-weight: bold;" />&nbsp;<input type="submit" name="do[preview]" value="Show preview" /></div>';
+echo '
+<!-- This authorization code is encrypted with '.AES_BITS.'-bit AES. -->
+';
+echo '<tr><th colspan="2" class="subhead"><input type="hidden" name="authorization" value="' . $parms . '" />';
+echo '<input type="submit" name="do[post]" value="Submit post" style="font-weight: bold;" />&nbsp;<input type="submit" name="do[preview]" value="Show preview" /></th></tr>';
+echo '</table></div>';
 echo '</form>';
 $template->footer();
 ?>

changeset 1	6f8b7c6fac02
parent 0	0417a5a0c7be
child 3	88b85b9b9272