nucleus/libs/ACTION.php

   1 <?php
   2
   3 /*
   4  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   5  * Copyright (C) 2002-2009 The Nucleus Group
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  * (see nucleus/documentation/index.html#license for more info)
  12  */
  13 /**
  14  * Actions that can be called via action.php
  15  *
  16  * @license http://nucleuscms.org/license.txt GNU General Public License
  17  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  18  * @version $Id$
  19  * $NucleusJP: ACTION.php,v 1.10 2007/05/31 07:23:39 kimitake Exp $
  20  */
  21 class ACTION\r
  22 {\r
  23         /**\r
  24          *  Constructor for an new ACTION object\r
  25          */\r
  26         function ACTION()\r
  27         {\r
  28                 // do nothing\r
  29         }\r
  30 \r
  31         /**\r
  32          *  Calls functions that handle an action called from action.php\r
  33          */\r
  34         function doAction($action)\r
  35         {\r
  36                 switch($action) {\r
  37                         case 'autodraft':\r
  38                                 return $this->autoDraft();\r
  39                                 break;\r
  40                         case 'updateticket':\r
  41                                 return $this->updateTicket();\r
  42                                 break;\r
  43                         case 'addcomment':\r
  44                                 return $this->addComment();\r
  45                                 break;\r
  46                         case 'sendmessage':\r
  47                                 return $this->sendMessage();\r
  48                                 break;\r
  49                         case 'createaccount':\r
  50                                 return $this->createAccount();\r
  51                                 break;\r
  52                         case 'forgotpassword':\r
  53                                 return $this->forgotPassword();\r
  54                                 break;\r
  55                         case 'votepositive':\r
  56                                 return $this->doKarma('pos');\r
  57                                 break;\r
  58                         case 'votenegative':\r
  59                                 return $this->doKarma('neg');\r
  60                                 break;\r
  61                         case 'plugin':\r
  62                                 return $this->callPlugin();\r
  63                                 break;\r
  64                         default:\r
  65                                 doError(_ERROR_BADACTION);\r
  66                 }\r
  67         }\r
  68 \r
  69         /**\r
  70          *  Adds a new comment to an item (if IP isn't banned)\r
  71          */\r
  72         function addComment() {\r
  73                 global $CONF, $errormessage, $manager;\r
  74 \r
  75                 $post['itemid'] =       intPostVar('itemid');\r
  76                 $post['user'] =         postVar('user');\r
  77                 $post['userid'] =       postVar('userid');\r
  78                 $post['email'] =   postVar('email');\r
  79                 $post['body'] =         postVar('body');\r
  80 \r
  81                 // set cookies when required\r
  82                 $remember = intPostVar('remember');\r
  83                 if ($remember == 1) {\r
  84                         $lifetime = time()+2592000;\r
  85                         setcookie($CONF['CookiePrefix'] . 'comment_user',$post['user'],$lifetime,'/','',0);\r
  86                         setcookie($CONF['CookiePrefix'] . 'comment_userid', $post['userid'],$lifetime,'/','',0);\r
  87                         setcookie($CONF['CookiePrefix'] . 'comment_email',  $post['email'], $lifetime,'/','',0);\r
  88                 }\r
  89 \r
  90                 $comments = new COMMENTS($post['itemid']);\r
  91 \r
  92                 $blogid = getBlogIDFromItemID($post['itemid']);\r
  93                 $this->checkban($blogid);\r
  94                 $blog =& $manager->getBlog($blogid);\r
  95 \r
  96                 // note: PreAddComment and PostAddComment gets called somewhere inside addComment\r
  97                 $errormessage = $comments->addComment($blog->getCorrectTime(),$post);\r
  98 \r
  99                 if ($errormessage == '1') {\r
 100                         // redirect when adding comments succeeded\r
 101                         if (postVar('url')) {\r
 102                                 redirect(postVar('url'));\r
 103                         } else {\r
 104                                 $url = createItemLink($post['itemid']);\r
 105                                 redirect($url);\r
 106                         }\r
 107                 } else {\r
 108                         // else, show error message using default skin for blog\r
 109                         return array(\r
 110                                 'message' => $errormessage,\r
 111                                 'skinid' => $blog->getDefaultSkin()\r
 112                         );\r
 113                 }\r
 114 \r
 115                 exit;\r
 116         }\r
 117 \r
 118         /**\r
 119          *  Sends a message from the current member to the member given as argument\r
 120          */\r
 121         function sendMessage() {\r
 122                 global $CONF, $member;\r
 123 \r
 124                 $error = $this->validateMessage();\r
 125                 if ($error != '')\r
 126                         return array('message' => $error);\r
 127 \r
 128                 if (!$member->isLoggedIn()) {\r
 129                         $fromMail = postVar('frommail');\r
 130                         $fromName = _MMAIL_FROMANON;\r
 131                 } else {\r
 132                         $fromMail = $member->getEmail();\r
 133                         $fromName = $member->getDisplayName();\r
 134                 }\r
 135 \r
 136                 $tomem = new MEMBER();\r
 137                 $tomem->readFromId(postVar('memberid'));\r
 138 \r
 139                 $message  = _MMAIL_MSG . ' ' . $fromName . "\n"\r
 140                           . '(' . _MMAIL_FROMNUC. ' ' . $CONF['IndexURL'] .") \n\n"\r
 141                           . _MMAIL_MAIL . " \n\n"\r
 142                           . postVar('message');\r
 143                 $message .= getMailFooter();\r
 144 \r
 145                 $title = _MMAIL_TITLE . ' ' . $fromName;\r
 146                 mb_language('ja');\r
 147                 mb_internal_encoding(_CHARSET);\r
 148                 @mb_send_mail($tomem->getEmail(), $title, $message, "From: ". $fromMail);\r
 149 \r
 150                 if (postVar('url')) {\r
 151                         redirect(postVar('url'));\r
 152                 } else {\r
 153                         $CONF['MemberURL'] = $CONF['IndexURL'];\r
 154                         if ($CONF['URLMode'] == 'pathinfo')\r
 155                         {\r
 156                                 $url = createLink('member', array('memberid' => $tomem->getID(), 'name' => $tomem->getDisplayName()));\r
 157                         }\r
 158                         else\r
 159                         {\r
 160                                 $url = $CONF['IndexURL'] . createMemberLink($tomem->getID());\r
 161                         }\r
 162                         redirect($url);\r
 163                 }\r
 164                 exit;\r
 165         }\r
 166 \r
 167         /**\r
 168          *  Checks if a mail to a member is allowed\r
 169          *  Returns a string with the error message if the mail is disallowed\r
 170          */\r
 171         function validateMessage() {\r
 172                 global $CONF, $member, $manager;\r
 173 \r
 174                 if (!$CONF['AllowMemberMail'])\r
 175                         return _ERROR_MEMBERMAILDISABLED;\r
 176 \r
 177                 if (!$member->isLoggedIn() && !$CONF['NonmemberMail'])\r
 178                         return _ERROR_DISALLOWED;\r
 179 \r
 180                 if (!$member->isLoggedIn() && (!isValidMailAddress(postVar('frommail'))))\r
 181                         return _ERROR_BADMAILADDRESS;\r
 182 \r
 183                 // let plugins do verification (any plugin which thinks the comment is invalid\r
 184                 // can change 'error' to something other than '')\r
 185                 $result = '';\r
 186                 $manager->notify('ValidateForm', array('type' => 'membermail', 'error' => &$result));\r
 187 \r
 188                 return $result;\r
 189 \r
 190         }\r
 191 \r
 192         /**\r
 193          *  Creates a new user account\r
 194          */\r
 195         function createAccount() {\r
 196                 global $CONF, $manager;\r
 197 \r
 198                 if (!$CONF['AllowMemberCreate'])\r
 199                         doError(_ERROR_MEMBERCREATEDISABLED);\r
 200 \r
 201                 // evaluate content from FormExtra\r
 202                 $result = 1;\r
 203                 $data = array('type' => 'membermail', 'error' => &$result);\r
 204                 $manager->notify('ValidateForm', &$data);\r
 205 \r
 206                 if ($result!=1) {\r
 207                         return $result;\r
 208                 }\r
 209                 else {\r
 210 \r
 211                         // even though the member can not log in, set some random initial password. One never knows.\r
 212                         srand((double)microtime()*1000000);\r
 213                         $initialPwd = md5(uniqid(rand(), true));\r
 214 \r
 215                         // create member (non admin/can not login/no notes/random string as password)\r
 216                         $name = shorten(postVar('name'),16,'');\r
 217                         $r = MEMBER::create($name, postVar('realname'), $initialPwd, postVar('email'), postVar('url'), 0, 0, '');\r
 218 \r
 219                         if ($r != 1) {\r
 220                                 return $r;\r
 221                         }\r
 222 \r
 223                         // send message containing password.\r
 224                         $newmem = new MEMBER();\r
 225                         $newmem->readFromName($name);\r
 226                         $newmem->sendActivationLink('register');\r
 227 \r
 228                         $manager->notify('PostRegister',array('member' => &$newmem));\r
 229 \r
 230                         if (postVar('desturl')) {\r
 231                                 redirect(postVar('desturl'));\r
 232                         } else {\r
 233                                 // header has been already sent, so deleted the line below\r
 234                                 //header ("Content-Type: text/html; charset="._CHARSET);\r
 235                                 echo _MSG_ACTIVATION_SENT;\r
 236                         }\r
 237                         exit;\r
 238                 }\r
 239         }\r
 240 \r
 241         /**\r
 242          *  Sends a new password\r
 243          */\r
 244         function forgotPassword() {\r
 245                 $membername = trim(postVar('name'));\r
 246 \r
 247                 if (!MEMBER::exists($membername))\r
 248                         doError(_ERROR_NOSUCHMEMBER);\r
 249                 $mem = MEMBER::createFromName($membername);\r
 250 \r
 251                 if (!$mem->canLogin())\r
 252                         doError(_ERROR_NOLOGON_NOACTIVATE);\r
 253 \r
 254                 // check if e-mail address is correct\r
 255                 if (!($mem->getEmail() == postVar('email')))\r
 256                         doError(_ERROR_INCORRECTEMAIL);\r
 257 \r
 258                 // send activation link\r
 259                 $mem->sendActivationLink('forgot');\r
 260 \r
 261                 if (postVar('url')) {\r
 262                         redirect(postVar('url'));\r
 263                 } else {\r
 264                         header ("Content-Type: text/html; charset="._CHARSET);\r
 265                         echo _MSG_ACTIVATION_SENT;\r
 266                 }\r
 267                 exit;\r
 268         }\r
 269 \r
 270         /**\r
 271          *  Handle karma votes\r
 272          */\r
 273         function doKarma($type) {\r
 274                 global $itemid, $member, $CONF, $manager;\r
 275 \r
 276                 // check if itemid exists\r
 277                 if (!$manager->existsItem($itemid,0,0))\r
 278                         doError(_ERROR_NOSUCHITEM);\r
 279 \r
 280                 $blogid = getBlogIDFromItemID($itemid);\r
 281                 $this->checkban($blogid);\r
 282 \r
 283                 $karma =& $manager->getKarma($itemid);\r
 284 \r
 285                 // check if not already voted\r
 286                 if (!$karma->isVoteAllowed(serverVar('REMOTE_ADDR')))\r
 287                         doError(_ERROR_VOTEDBEFORE);\r
 288 \r
 289                 // check if item does allow voting\r
 290                 $item =& $manager->getItem($itemid,0,0);\r
 291                 if ($item['closed'])\r
 292                         doError(_ERROR_ITEMCLOSED);\r
 293 \r
 294                 switch($type) {\r
 295                         case 'pos':\r
 296                                 $karma->votePositive();\r
 297                                 break;\r
 298                         case 'neg':\r
 299                                 $karma->voteNegative();\r
 300                                 break;\r
 301                 }\r
 302 \r
 303                 $blogid = getBlogIDFromItemID($itemid);\r
 304                 $blog =& $manager->getBlog($blogid);\r
 305 \r
 306                 // send email to notification address, if any\r
 307                 if ($blog->getNotifyAddress() && $blog->notifyOnVote()) {\r
 308 \r
 309                         $mailto_msg = _NOTIFY_KV_MSG . ' ' . $itemid . "\n";\r
 310                         $mailto_msg .= $CONF['IndexURL'] . 'index.php?itemid=' . $itemid . "\n\n";\r
 311                         if ($member->isLoggedIn()) {\r
 312                                 $mailto_msg .= _NOTIFY_MEMBER . ' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";\r
 313                         }\r
 314                         $mailto_msg .= _NOTIFY_IP . ' ' . serverVar('REMOTE_ADDR') . "\n";\r
 315                         $mailto_msg .= _NOTIFY_HOST . ' ' .  gethostbyaddr(serverVar('REMOTE_ADDR'))  . "\n";\r
 316                         $mailto_msg .= _NOTIFY_VOTE . "\n " . $type . "\n";\r
 317                         $mailto_msg .= getMailFooter();\r
 318 \r
 319                         $mailto_title = _NOTIFY_KV_TITLE . ' ' . strip_tags($item['title']) . ' (' . $itemid . ')';\r
 320 \r
 321                         $frommail = $member->getNotifyFromMailAddress();\r
 322 \r
 323                         $notify = new NOTIFICATION($blog->getNotifyAddress());\r
 324                         $notify->notify($mailto_title, $mailto_msg , $frommail);\r
 325                 }\r
 326 \r
 327 \r
 328                 $refererUrl = serverVar('HTTP_REFERER');\r
 329                 if ($refererUrl)\r
 330                         $url = $refererUrl;\r
 331                 else\r
 332                         $url = $CONF['IndexURL'] . 'index.php?itemid=' . $itemid;\r
 333 \r
 334                 redirect($url);\r
 335                 exit;\r
 336         }\r
 337 \r
 338         /**\r
 339           * Calls a plugin action\r
 340           */\r
 341         function callPlugin() {\r
 342                 global $manager;\r
 343 \r
 344                 $pluginName = 'NP_' . requestVar('name');\r
 345                 $actionType = requestVar('type');\r
 346 \r
 347                 // 1: check if plugin is installed\r
 348                 if (!$manager->pluginInstalled($pluginName))\r
 349                         doError(_ERROR_NOSUCHPLUGIN);\r
 350 \r
 351                 // 2: call plugin\r
 352                 $pluginObject =& $manager->getPlugin($pluginName);\r
 353                 if ($pluginObject)\r
 354                         $error = $pluginObject->doAction($actionType);\r
 355                 else\r
 356                         $error = 'Could not load plugin (see actionlog)';\r
 357 \r
 358                 // doAction returns error when:\r
 359                 // - an error occurred (duh)\r
 360                 // - no actions are allowed (doAction is not implemented)\r
 361                 if ($error)\r
 362                         doError($error);\r
 363 \r
 364                 exit;\r
 365 \r
 366         }\r
 367 \r
 368         /**\r
 369          *  Checks if an IP or IP range is banned\r
 370          */\r
 371         function checkban($blogid) {\r
 372                 // check if banned\r
 373                 $ban = BAN::isBanned($blogid, serverVar('REMOTE_ADDR'));\r
 374                 if ($ban != 0) {\r
 375                         doError(_ERROR_BANNED1 . $ban->iprange . _ERROR_BANNED2 . $ban->message . _ERROR_BANNED3);\r
 376                 }\r
 377 \r
 378         }\r
 379 \r
 380         /**\r
 381          * Gets a new ticket\r
 382          */\r
 383         function updateTicket() {\r
 384                 global $manager;\r
 385                 if ($manager->checkTicket()) {\r
 386                         echo $manager->getNewTicket();\r
 387                 }\r
 388                 else {\r
 389                         echo 'err:' . _ERROR_BADTICKET;\r
 390                 }\r
 391                 return false;\r
 392         }\r
 393 \r
 394         /**\r
 395          * Handles AutoSaveDraft\r
 396          */\r
 397         function autoDraft() {\r
 398                 global $manager;\r
 399                 if ($manager->checkTicket()) {\r
 400                         $manager->loadClass('ITEM');\r
 401                         $info = ITEM::createDraftFromRequest();\r
 402                         if ($info['status'] == 'error') {\r
 403                                 echo $info['message'];\r
 404                         }\r
 405                         else {\r
 406                                 echo $info['draftid'];\r
 407                         }\r
 408                 }\r
 409                 else {\r
 410                         echo 'err:' . _ERROR_BADTICKET;\r
 411                 }\r
 412                 return false;\r
 413         }\r
 414 \r
 415 \r
 416 }\r
 417 \r
 418 ?>