nucleus/libs/ACTION.php

   1 <?php
   2
   3 /*
   4  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   5  * Copyright (C) 2002-2012 The Nucleus Group
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  * (see nucleus/documentation/index.html#license for more info)
  12  *
  13  * Actions that can be called via action.php
  14  */
  15
  16 class ACTION
  17 {
  18
  19         /**
  20          *  Constructor for an new ACTION object
  21          */
  22         function ACTION()
  23         {
  24                 // do nothing
  25         }
  26
  27
  28         /**
  29          *  Calls functions that handle an action called from action.php
  30          */
  31         function doAction($action)\r
  32         {\r
  33                 switch($action)\r
  34                 {\r
  35                         case 'autodraft':\r
  36                                 return $this->autoDraft();\r
  37                         break;\r
  38                 \r
  39                         case 'updateticket':\r
  40                                 return $this->updateTicket();\r
  41                         break;\r
  42 \r
  43                         case 'addcomment':\r
  44                                 return $this->addComment();\r
  45                         break;\r
  46 \r
  47                         case 'sendmessage':\r
  48                                 return $this->sendMessage();\r
  49                         break;\r
  50 \r
  51                         case 'createaccount':\r
  52                                 return $this->createAccount();\r
  53                         break;\r
  54 \r
  55                         case 'forgotpassword':\r
  56                                 return $this->forgotPassword();\r
  57                         break;\r
  58 \r
  59                         case 'votepositive':\r
  60                                 return $this->doKarma('pos');\r
  61                         break;\r
  62 \r
  63                         case 'votenegative':\r
  64                                 return $this->doKarma('neg');\r
  65                         break;\r
  66 \r
  67                         case 'plugin':\r
  68                                 return $this->callPlugin();\r
  69                         break;\r
  70 \r
  71                         default:\r
  72                                 doError(_ERROR_BADACTION);\r
  73                         break;\r
  74                 }\r
  75         }
  76
  77
  78         /**
  79          *  Adds a new comment to an item (if IP isn't banned)
  80          */
  81         function addComment()\r
  82         {\r
  83                 global $CONF, $errormessage, $manager;\r
  84 \r
  85                 $post['itemid']         = intPostVar('itemid');\r
  86                 $post['user']           = postVar('user');\r
  87                 $post['userid']         = postVar('userid');\r
  88                 $post['email']          = postVar('email');\r
  89                 $post['body']           = postVar('body');\r
  90                 $post['remember']       = intPostVar('remember');
  91
  92                 // set cookies when required
  93                 #$remember = intPostVar('remember');
  94 \r
  95                 // begin if: "Remember Me" box checked\r
  96                 if ( $post['remember'] == 1 )\r
  97                 {\r
  98                         $lifetime = time() + 2592000;\r
  99                         setcookie($CONF['CookiePrefix'] . 'comment_user', $post['user'], $lifetime, '/', '', 0);\r
 100                         setcookie($CONF['CookiePrefix'] . 'comment_userid', $post['userid'], $lifetime, '/', '', 0);\r
 101                         setcookie($CONF['CookiePrefix'] . 'comment_email', $post['email'], $lifetime, '/', '', 0);\r
 102                 } // end if
 103
 104                 $comments = new COMMENTS($post['itemid']);
 105
 106                 $blog_id = getBlogIDFromItemID($post['itemid']);\r
 107                 $this->checkban($blog_id);\r
 108                 $blog =& $manager->getBlog($blog_id);
 109
 110                 // note: PreAddComment and PostAddComment gets called somewhere inside addComment
 111                 $errormessage = $comments->addComment($blog->getCorrectTime(), $post);
 112
 113                 // begin if:\r
 114                 if ( $errormessage == '1' )\r
 115                 {
 116                         // redirect when adding comments succeeded
 117                         if ( postVar('url') )\r
 118                         {\r
 119                                 redirect(postVar('url') );\r
 120                         }\r
 121                         else\r
 122                         {
 123                                 $url = createItemLink($post['itemid']);
 124                                 redirect($url);
 125                         } // end if\r
 126 \r
 127                 }\r
 128                 // else, show error message using default skin for blog\r
 129                 else\r
 130                 {
 131                         return array(
 132                                 'message'       => $errormessage,\r
 133                                 'skinid'        => $blog->getDefaultSkin()
 134                         );
 135                 } // end if
 136
 137                 exit;
 138         }
 139
 140
 141         /**
 142          *  Sends a message from the current member to the member given as argument
 143          */
 144         function sendMessage()\r
 145         {
 146                 global $CONF, $member;
 147
 148                 $error = $this->validateMessage();
 149 \r
 150                 if ( $error != '' )\r
 151                 {
 152                         return array('message' => $error);
 153                 }
 154
 155                 if ( !$member->isLoggedIn() )\r
 156                 {
 157                         $fromMail = postVar('frommail');
 158                         $fromName = _MMAIL_FROMANON;
 159                 }\r
 160                 else\r
 161                 {
 162                         $fromMail = $member->getEmail();
 163                         $fromName = $member->getDisplayName();
 164                 }
 165
 166                 $tomem = new MEMBER();
 167                 $tomem->readFromId(postVar('memberid') );
 168
 169                 $message  = _MMAIL_MSG . ' ' . $fromName . "\n"
 170                           . '(' . _MMAIL_FROMNUC. ' ' . $CONF['IndexURL'] .") \n\n"
 171                           . _MMAIL_MAIL . " \n\n"
 172                           . postVar('message');
 173                 $message .= getMailFooter();
 174
 175                 $title = _MMAIL_TITLE . ' ' . $fromName;
 176                 mb_language('ja');
 177                 mb_internal_encoding(_CHARSET);
 178                 @mb_send_mail($tomem->getEmail(), $title, $message, "From: ". $fromMail);
 179
 180                 if ( postVar('url') )\r
 181                 {\r
 182                         redirect(postVar('url') );\r
 183                 }\r
 184                 else\r
 185                 {
 186                         $CONF['MemberURL'] = $CONF['IndexURL'];
 187 \r
 188                         if ( $CONF['URLMode'] == 'pathinfo' )
 189                         {
 190                                 $url = createLink('member', array('memberid' => $tomem->getID(), 'name' => $tomem->getDisplayName() ) );
 191                         }
 192                         else
 193                         {
 194                                 $url = $CONF['IndexURL'] . createMemberLink($tomem->getID());
 195                         }
 196
 197                         redirect($url);
 198                 }
 199
 200                 exit;
 201         }
 202
 203
 204         /**
 205          *  Checks if a mail to a member is allowed
 206          *  Returns a string with the error message if the mail is disallowed
 207          */
 208         function validateMessage()\r
 209         {
 210                 global $CONF, $member, $manager;
 211
 212                 if ( !$CONF['AllowMemberMail'] )\r
 213                 {
 214                         return _ERROR_MEMBERMAILDISABLED;
 215                 }
 216
 217                 if ( !$member->isLoggedIn() && !$CONF['NonmemberMail'] )\r
 218                 {\r
 219                         return _ERROR_DISALLOWED;\r
 220                 }
 221
 222                 if ( !$member->isLoggedIn() && (!isValidMailAddress(postVar('frommail') ) ) )\r
 223                 {\r
 224                         return _ERROR_BADMAILADDRESS;\r
 225                 }
 226
 227                 // let plugins do verification (any plugin which thinks the comment is invalid
 228                 // can change 'error' to something other than '')
 229                 $result = '';
 230                 $param = array(
 231                         'type'  => 'membermail',
 232                         'error' => &$result
 233                 );
 234                 $manager->notify('ValidateForm', $param);
 235
 236                 return $result;
 237
 238         }
 239
 240
 241         /**
 242          *  Creates a new user account
 243          */
 244         function createAccount()\r
 245         {
 246                 global $CONF, $manager;
 247
 248                 if ( !$CONF['AllowMemberCreate'] )\r
 249                 {\r
 250                         doError(_ERROR_MEMBERCREATEDISABLED);\r
 251                 }
 252
 253                 // evaluate content from FormExtra
 254                 $result = 1;
 255                 $param = array(
 256                         'type'  => 'membermail',
 257                         'error' => &$result
 258                 );
 259                 $manager->notify('ValidateForm', $param);
 260
 261                 if ( $result != 1 )\r
 262                 {
 263                         return $result;
 264                 }
 265                 else\r
 266                 {
 267
 268                         // even though the member can not log in, set some random initial password. One never knows.
 269                         srand( (double) microtime() * 1000000);\r
 270                         $initialPwd = md5(uniqid(rand(), TRUE) );
 271
 272                         // create member (non admin/can not login/no notes/random string as password)
 273                         $name = shorten(postVar('name'), 32, '');
 274                         $r = MEMBER::create($name, postVar('realname'), $initialPwd, postVar('email'), postVar('url'), 0, 0, '');
 275
 276                         if ( $r != 1 )\r
 277                         {
 278                                 return $r;
 279                         }
 280
 281                         // send message containing password.
 282                         $newmem = new MEMBER();
 283                         $newmem->readFromName($name);
 284                         $newmem->sendActivationLink('register');
 285
 286                         $param = array('member' => &$newmem);
 287                         $manager->notify('PostRegister', $param);
 288
 289                         if ( postVar('desturl') )\r
 290                         {\r
 291                                 redirect(postVar('desturl') );\r
 292                         }\r
 293                         else\r
 294                         {
 295                                 // header has been already sent, so deleted the line below
 296                                 sendContentType('text/html', '', _CHARSET);
 297                                 echo _MSG_ACTIVATION_SENT;
 298                                 echo '<br /><br />Return to <a href="'.$CONF['IndexURL'].'" title="'.$CONF['SiteName'].'">'.$CONF['SiteName'].'</a>';
 299                                 echo "\n</body>\n</html>";
 300                         }
 301
 302                         exit;
 303                 }
 304
 305         }
 306
 307
 308         /**
 309          *  Sends a new password
 310          */
 311         function forgotPassword()\r
 312         {\r
 313                 $membername = trim(postVar('name') );
 314
 315                 if ( !MEMBER::exists($membername) )\r
 316                 {\r
 317                         doError(_ERROR_NOSUCHMEMBER);\r
 318                 }\r
 319
 320                 $mem = MEMBER::createFromName($membername);
 321
 322                 /* below keeps regular users from resetting passwords using forgot password feature
 323                          Removing for now until clear why it is required.*/
 324                 /*if (!$mem->canLogin())
 325                         doError(_ERROR_NOLOGON_NOACTIVATE);*/
 326
 327                 // check if e-mail address is correct
 328                 if ( !($mem->getEmail() == postVar('email') ) )\r
 329                 {\r
 330                         doError(_ERROR_INCORRECTEMAIL);\r
 331                 }
 332
 333                 // send activation link
 334                 $mem->sendActivationLink('forgot');
 335
 336                 if ( postVar('url') )\r
 337                 {\r
 338                         redirect(postVar('url') );\r
 339                 }\r
 340                 else\r
 341                 {
 342 //                      header ("Content-Type: text/html; charset="._CHARSET);
 343                         sendContentType('text/html', '', _CHARSET);
 344                         echo _MSG_ACTIVATION_SENT;
 345                         echo '<br /><br />Return to <a href="'.$CONF['IndexURL'].'" title="'.$CONF['SiteName'].'">'.$CONF['SiteName'].'</a>';
 346                 }
 347
 348                 exit;
 349         }
 350
 351
 352         /**
 353          *  Handle karma votes
 354          */
 355         function doKarma($type)\r
 356         {
 357                 global $itemid, $member, $CONF, $manager;
 358
 359                 // check if itemid exists
 360                 if ( !$manager->existsItem($itemid, 0, 0) )\r
 361                 {\r
 362                         doError(_ERROR_NOSUCHITEM);\r
 363                 }
 364
 365                 $blogid = getBlogIDFromItemID($itemid);
 366                 $this->checkban($blogid);
 367
 368                 $karma =& $manager->getKarma($itemid);
 369
 370                 // check if not already voted
 371                 if ( !$karma->isVoteAllowed(serverVar('REMOTE_ADDR') ) )\r
 372                 {\r
 373                         doError(_ERROR_VOTEDBEFORE);\r
 374                 }
 375
 376                 // check if item does allow voting
 377                 $item =& $manager->getItem($itemid, 0, 0);\r
 378 \r
 379                 if ( $item['closed'] )\r
 380                 {\r
 381                         doError(_ERROR_ITEMCLOSED);\r
 382                 }
 383
 384                 switch ( $type )\r
 385                 {\r
 386                         case 'pos':\r
 387                                 $karma->votePositive();\r
 388                         break;\r
 389 \r
 390                         case 'neg':\r
 391                                 $karma->voteNegative();\r
 392                         break;\r
 393                 }
 394
 395 //              $blogid = getBlogIDFromItemID($itemid);
 396                 $blog =& $manager->getBlog($blogid);
 397
 398                 // send email to notification address, if any
 399                 if ( $blog->getNotifyAddress() && $blog->notifyOnVote() )\r
 400                 {
 401
 402                         $mailto_msg = _NOTIFY_KV_MSG . ' ' . $itemid . "\n";
 403                         $itemLink = createItemLink(intval($itemid) );
 404                         $temp = parse_url($itemLink);
 405
 406                         if ( !$temp['scheme'] )\r
 407                         {
 408                                 $itemLink = $CONF['IndexURL'] . $itemLink;
 409                         }
 410
 411                         $mailto_msg .= $itemLink . "\n\n";
 412
 413                         if ( $member->isLoggedIn() )\r
 414                         {
 415                                 $mailto_msg .= _NOTIFY_MEMBER . ' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";
 416                         }
 417
 418                         $mailto_msg .= _NOTIFY_IP . ' ' . serverVar('REMOTE_ADDR') . "\n";
 419                         $mailto_msg .= _NOTIFY_HOST . ' ' .  gethostbyaddr(serverVar('REMOTE_ADDR'))  . "\n";
 420                         $mailto_msg .= _NOTIFY_VOTE . "\n " . $type . "\n";
 421                         $mailto_msg .= getMailFooter();
 422
 423                         $mailto_title = _NOTIFY_KV_TITLE . ' ' . strip_tags($item['title']) . ' (' . $itemid . ')';
 424
 425                         $frommail = $member->getNotifyFromMailAddress();
 426
 427                         $notify = new NOTIFICATION($blog->getNotifyAddress() );\r
 428                         $notify->notify($mailto_title, $mailto_msg, $frommail);
 429                 }
 430
 431                 $refererUrl = serverVar('HTTP_REFERER');
 432 \r
 433                 if ( $refererUrl )\r
 434                 {
 435                         $url = $refererUrl;
 436                 }\r
 437                 else\r
 438                 {
 439 //                      $url = $CONF['IndexURL'] . 'index.php?itemid=' . $itemid;
 440                         $url = $itemLink;
 441                 }
 442
 443                 redirect($url);
 444                 exit;
 445         }
 446
 447
 448         /**
 449           * Calls a plugin action
 450           */
 451         function callPlugin()\r
 452         {
 453                 global $manager;
 454
 455                 $pluginName = 'NP_' . requestVar('name');
 456                 $actionType = requestVar('type');
 457
 458                 // 1: check if plugin is installed
 459                 if ( !$manager->pluginInstalled($pluginName) )\r
 460                 {
 461                         doError(_ERROR_NOSUCHPLUGIN);
 462                 }
 463
 464                 // 2: call plugin
 465                 $pluginObject =& $manager->getPlugin($pluginName);
 466 \r
 467                 if ( $pluginObject )\r
 468                 {
 469                         $error = $pluginObject->doAction($actionType);
 470                 }\r
 471                 else\r
 472                 {
 473                         $error = 'Could not load plugin (see actionlog)';
 474                 }
 475
 476                 // doAction returns error when:
 477                 // - an error occurred (duh)
 478                 // - no actions are allowed (doAction is not implemented)
 479                 if ( $error )\r
 480                 {\r
 481                         doError($error);\r
 482                 }
 483
 484                 exit;
 485
 486         }
 487
 488
 489         /**
 490          *  Checks if an IP or IP range is banned
 491          */
 492         function checkban($blogid)\r
 493         {
 494                 // check if banned
 495                 $ban = BAN::isBanned($blogid, serverVar('REMOTE_ADDR') );\r
 496 \r
 497                 if ( $ban != 0 )\r
 498                 {
 499                         doError(_ERROR_BANNED1 . $ban->iprange . _ERROR_BANNED2 . $ban->message . _ERROR_BANNED3);
 500                 }
 501
 502         }
 503
 504
 505         /**
 506          * Gets a new ticket
 507          */
 508         function updateTicket()\r
 509         {
 510                 global $manager;
 511 \r
 512                 if ( $manager->checkTicket() )\r
 513                 {
 514                         echo $manager->getNewTicket();
 515                 }
 516                 else\r
 517                 {
 518                         echo _ERROR . ':' . _ERROR_BADTICKET;
 519                 }
 520 \r
 521                 return FALSE;
 522         }
 523
 524
 525         /**
 526          * Handles AutoSaveDraft
 527          */
 528         function autoDraft()\r
 529         {
 530                 global $manager;
 531 \r
 532                 if ( $manager->checkTicket() )\r
 533                 {
 534                         $manager->loadClass('ITEM');
 535                         $info = ITEM::createDraftFromRequest();
 536
 537                         if ( $info['status'] == 'error' )\r
 538                         {
 539                                 echo $info['message'];
 540                         }
 541                         else\r
 542                         {
 543                                 echo $info['draftid'];
 544                         }
 545                 }
 546                 else\r
 547                 {
 548                         echo _ERROR . ':' . _ERROR_BADTICKET;
 549                 }
 550 \r
 551                 return FALSE;
 552         }
 553
 554 }
 555
 556 ?>