nucleus/libs/ACTION.php

   1 <?php\r
   2 \r
   3 /*\r
   4  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   5  * Copyright (C) 2002-2009 The Nucleus Group\r
   6  *\r
   7  * This program is free software; you can redistribute it and/or\r
   8  * modify it under the terms of the GNU General Public License\r
   9  * as published by the Free Software Foundation; either version 2\r
  10  * of the License, or (at your option) any later version.\r
  11  * (see nucleus/documentation/index.html#license for more info)\r
  12  */\r
  13 /**\r
  14  * Actions that can be called via action.php\r
  15  *\r
  16  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  17  * @copyright Copyright (C) 2002-2009 The Nucleus Group\r
  18  * @version $Id: ACTION.php 1646 2012-01-29 10:47:32Z sakamocchi $\r
  19  */\r
  20 class Action\r
  21 {\r
  22         /**\r
  23          * Action::__construct()\r
  24          *  Constructor for an new ACTION object\r
  25          * \r
  26          * @param       void\r
  27          * @return      void\r
  28          */\r
  29         public function __construct()\r
  30         {\r
  31                 return;\r
  32         }\r
  33         \r
  34         /**\r
  35          * Action::doAction()\r
  36          *  Calls functions that handle an action called from action.php\r
  37          * \r
  38          * @param       string  $action action type\r
  39          * @return      mixed\r
  40          */\r
  41         public function doAction($action)\r
  42         {\r
  43                 switch ( $action )\r
  44                 {\r
  45                         case 'autodraft':\r
  46                                 return $this->autoDraft();\r
  47                                 break;\r
  48                         case 'updateticket':\r
  49                                 return $this->updateTicket();\r
  50                                 break;\r
  51                         case 'addcomment':\r
  52                                 return $this->addComment();\r
  53                                 break;\r
  54                         case 'sendmessage':\r
  55                                 return $this->sendMessage();\r
  56                                 break;\r
  57                         case 'createaccount':\r
  58                                 return $this->createAccount();\r
  59                                 break;\r
  60                         case 'forgotpassword':\r
  61                                 return $this->forgotPassword();\r
  62                                 break;\r
  63                         case 'votepositive':\r
  64                                 return $this->doKarma('pos');\r
  65                                 break;\r
  66                         case 'votenegative':\r
  67                                 return $this->doKarma('neg');\r
  68                                 break;\r
  69                         case 'plugin':\r
  70                                 return $this->callPlugin();\r
  71                                 break;\r
  72                         default:\r
  73                                 doError(_ERROR_BADACTION);\r
  74                                 break;\r
  75                 }\r
  76                 return;\r
  77         }\r
  78         \r
  79         /**\r
  80          * Action::addComment()\r
  81          * Adds a new comment to an item (if IP isn't banned)\r
  82          * \r
  83          * @param       void\r
  84          * @return      void\r
  85          */\r
  86         private function addComment()\r
  87         {\r
  88                 global $CONF, $errormessage, $manager;\r
  89                 \r
  90                 $post['itemid'] = intPostVar('itemid');\r
  91                 $post['user']   = postVar('user');\r
  92                 $post['userid'] = postVar('userid');\r
  93                 $post['email']  = postVar('email');\r
  94                 $post['body']   = postVar('body');\r
  95                 $post['remember'] = intPostVar('remember');\r
  96                 \r
  97                 // begin if: "Remember Me" box checked\r
  98                 if ( $post['remember'] == 1 )\r
  99                 {\r
 100                         $lifetime = time() + 2592000;\r
 101                         setcookie($CONF['CookiePrefix'] . 'comment_user', $post['user'], $lifetime, '/', '', 0);\r
 102                         setcookie($CONF['CookiePrefix'] . 'comment_userid', $post['userid'], $lifetime, '/', '', 0);\r
 103                         setcookie($CONF['CookiePrefix'] . 'comment_email', $post['email'], $lifetime, '/', '', 0);\r
 104                 }\r
 105                 \r
 106                 $item =& $manager->getItem($post['itemid'], 0, 0);\r
 107                 $this->checkban($item['blogid']);\r
 108                 $blog =& $manager->getBlog($item['blogid']);\r
 109                 \r
 110                 // note: PreAddComment and PostAddComment gets called somewhere inside addComment\r
 111                 $comments = new Comments($post['itemid']);\r
 112                 $errormessage = $comments->addComment($blog->getCorrectTime(), $post);\r
 113                 \r
 114                 if ( $errormessage != '1' )\r
 115                 {\r
 116                         // show error message using default skin for blo\r
 117                         return array(\r
 118                                 'message'       => $errormessage,\r
 119                                 'skinid'        => $blog->getDefaultSkin()\r
 120                         );\r
 121                 }\r
 122                 else\r
 123                 {\r
 124                         // redirect when adding comments succeeded\r
 125                         if ( postVar('url') )\r
 126                         {\r
 127                                 redirect(postVar('url') );\r
 128                         }\r
 129                         else\r
 130                         {\r
 131                                 $url = Link::create_item_link($post['itemid']);\r
 132                                 redirect($url);\r
 133                         }\r
 134                 }\r
 135                 return;\r
 136         }\r
 137         \r
 138         /**\r
 139          * Action::sendMessage()\r
 140          * Sends a message from the current member to the member given as argument\r
 141          * \r
 142          * @param       void\r
 143          * @return      void\r
 144          */\r
 145         private function sendMessage()\r
 146         {\r
 147                 global $CONF, $member;\r
 148                 \r
 149                 $error = $this->validateMessage();\r
 150                 \r
 151                 if ( $error != '' )\r
 152                 {\r
 153                         return array('message' => $error);\r
 154                 }\r
 155                 \r
 156                 if ( !$member->isLoggedIn() )\r
 157                 {\r
 158                         $fromMail = postVar('frommail');\r
 159                         $fromName = _MMAIL_FROMANON;\r
 160                 }\r
 161                 else\r
 162                 {\r
 163                         $fromMail = $member->getEmail();\r
 164                         $fromName = $member->getDisplayName();\r
 165                 }\r
 166                 \r
 167                 /* TODO: validation */\r
 168                 $memberid = postVar('memberid');\r
 169                 $tomem = new Member();\r
 170                 $tomem->readFromId($memberid);\r
 171                 \r
 172                 /* TODO: validation */\r
 173                 $message = postVar('message');\r
 174                 $message  = _MMAIL_MSG . ' ' . $fromName . "\n"\r
 175                         . '(' . _MMAIL_FROMNUC. ' ' . $CONF['IndexURL'] .") \n\n"\r
 176                         . _MMAIL_MAIL . " \n\n"\r
 177                         . $message;\r
 178                 $message .= Notification::get_mail_footer();\r
 179                 \r
 180                 $title = _MMAIL_TITLE . ' ' . $fromName;\r
 181                 Notification::mail($tomem->getEmail(), $title, $message, $fromMail, i18n::get_current_charset());\r
 182                 \r
 183                 /* TODO: validation */\r
 184                 $url = postVar('url');\r
 185                 if ( empty($url) )\r
 186                 {\r
 187                         $CONF['MemberURL'] = $CONF['IndexURL'];\r
 188                         \r
 189                         if ( $CONF['URLMode'] == 'pathinfo' )\r
 190                         {\r
 191                                 $data = array(\r
 192                                         'memberid'      => $tomem->getID(),\r
 193                                         'name'          => $tomem->getDisplayName()\r
 194                                 );\r
 195                                 $url = Link::create_link('member', $data);\r
 196                         }\r
 197                         else\r
 198                         {\r
 199                                 $url = $CONF['IndexURL'] . Link::create_member_link($tomem->getID());\r
 200                         }\r
 201                 }\r
 202                 redirect($url );\r
 203                 \r
 204                 return;\r
 205         }\r
 206         \r
 207         /**\r
 208          * Action::validateMessage()\r
 209          *  Checks if a mail to a member is allowed\r
 210          *  Returns a string with the error message if the mail is disallowed\r
 211          * \r
 212          * @param               void\r
 213          * @return      String  Null character string\r
 214          */\r
 215         private function validateMessage()\r
 216         {\r
 217                 global $CONF, $member, $manager;\r
 218                 \r
 219                 if ( !$CONF['AllowMemberMail'] )\r
 220                 {\r
 221                         return _ERROR_MEMBERMAILDISABLED;\r
 222                 }\r
 223                 \r
 224                 if ( !$member->isLoggedIn() && !$CONF['NonmemberMail'] )\r
 225                 {\r
 226                         return _ERROR_DISALLOWED;\r
 227                 }\r
 228                 \r
 229                 if ( !$member->isLoggedIn() && !Notification::address_validation(postVar('frommail')) )\r
 230                 {\r
 231                         return _ERROR_BADMAILADDRESS;\r
 232                 }\r
 233                 \r
 234                 /*\r
 235                  * let plugins do verification (any plugin which thinks the comment is\r
 236                  * invalid can change 'error' to something other than '')\r
 237                  */\r
 238                 $result = '';\r
 239                 $data = array(\r
 240                         'type'  => 'membermail',\r
 241                         'error' => &$result\r
 242                 );\r
 243                 $manager->notify('ValidateForm', $data);\r
 244                 \r
 245                 return $result;\r
 246         }\r
 247         \r
 248         /**\r
 249          * Action::createAccount()\r
 250          * Creates a new user account\r
 251          *  \r
 252          * @param       void\r
 253          * @return      mixed\r
 254          */\r
 255         private function createAccount()\r
 256         {\r
 257                 global $CONF, $manager;\r
 258                 \r
 259                 if ( array_key_exists('AllowMemberCreate', $CONF) && !$CONF['AllowMemberCreate'] )\r
 260                 {\r
 261                         doError(_ERROR_MEMBERCREATEDISABLED);\r
 262                 }\r
 263                 \r
 264                 // evaluate content from FormExtra\r
 265                 $result = 1;\r
 266                 $data = array(\r
 267                         'type'  => 'membermail',\r
 268                         'error' => &$result\r
 269                 );\r
 270                 $manager->notify('ValidateForm', $data);\r
 271                 \r
 272                 if ( $result != 1 )\r
 273                 {\r
 274                         return $result;\r
 275                 }\r
 276                 \r
 277                 // even though the member can not log in, set some random initial password. One never knows.\r
 278                 srand((double) microtime() * 1000000);\r
 279                 $initialPwd = md5(uniqid(rand(), TRUE) );\r
 280                 \r
 281                 // create member (non admin/can not login/no notes/random string as password)\r
 282                 $name           = Entity::shorten(postVar('name'), 32, '');\r
 283                 $relname        = postVar('realname');\r
 284                 $email          = postVar('email');\r
 285                 $url            = postVar('url');\r
 286                 \r
 287                 $r = Member::create($name, $realname, $initialPwd, $email, $url, 0, 0, '');\r
 288                 \r
 289                 if ( $r != 1 )\r
 290                 {\r
 291                         return $r;\r
 292                 }\r
 293                 \r
 294                 // send message containing password.\r
 295                 $newmem = new Member();\r
 296                 $newmem->readFromName($name);\r
 297                 $newmem->sendActivationLink('register');\r
 298                 \r
 299                 $manager->notify('PostRegister', array('member' => &$newmem) );\r
 300                 \r
 301                 if ( postVar('desturl') )\r
 302                 {\r
 303                         redirect(postVar('desturl') );\r
 304                 }\r
 305                 \r
 306                 return 1;\r
 307         }\r
 308         \r
 309         /**\r
 310          * Action::forgotPassword()\r
 311          * Sends a new password\r
 312          * \r
 313          * @param       void\r
 314          * @return      void\r
 315          */\r
 316         private function forgotPassword()\r
 317         {\r
 318                 $membername = trim(postVar('name') );\r
 319                 \r
 320                 if ( !Member::exists($membername) )\r
 321                 {\r
 322                         doError(_ERROR_NOSUCHMEMBER);\r
 323                 }\r
 324                 \r
 325                 $mem = Member::createFromName($membername);\r
 326                 \r
 327                 // check if e-mail address is correct\r
 328                 $email = postVar('email');\r
 329                 if ( $mem->getEmail() != $email )\r
 330                 {\r
 331                         doError(_ERROR_INCORRECTEMAIL);\r
 332                 }\r
 333                 \r
 334                 // send activation link\r
 335                 $mem->sendActivationLink('forgot');\r
 336                 \r
 337                 // redirection\r
 338                 $url = postVar('url');\r
 339                 if ( !empty($url) )\r
 340                 {\r
 341                         redirect(postVar('url') );\r
 342                 }\r
 343                 else\r
 344                 {\r
 345                         echo _MSG_ACTIVATION_SENT;\r
 346                         echo "<br />"\r
 347                             . "<br />"\r
 348                             . "Return to <a href=\"{$CONF['IndexURL']}\" title=\"{$CONF['SiteName']}\">{$CONF['SiteName']}</a>\n";\r
 349                 }\r
 350                 \r
 351                 return;\r
 352         }\r
 353         \r
 354         /**\r
 355          * Action::doKarma()\r
 356          * Handle karma votes\r
 357          * \r
 358          * @param       string  $type   pos or neg\r
 359          * @return      Void\r
 360          */\r
 361         private function doKarma($type)\r
 362         {\r
 363                 global $itemid, $member, $CONF, $manager;\r
 364                 \r
 365                 // check if itemid exists\r
 366                 if ( !$manager->existsItem($itemid, 0, 0) )\r
 367                 {\r
 368                         doError(_ERROR_NOSUCHITEM);\r
 369                 }\r
 370                 \r
 371                 $item =& $manager->getItem($itemid, 0, 0);\r
 372                 $this->checkban($item['blogid']);\r
 373                 \r
 374                 $karma =& $manager->getKarma($itemid);\r
 375                 \r
 376                 // check if not already voted\r
 377                 if ( !$karma->isVoteAllowed(serverVar('REMOTE_ADDR') ) )\r
 378                 {\r
 379                         doError(_ERROR_VOTEDBEFORE);\r
 380                 }\r
 381                 \r
 382                 // check if item does allow voting\r
 383                 $item =& $manager->getItem($itemid, 0, 0);\r
 384                 \r
 385                 if ( $item['closed'] )\r
 386                 {\r
 387                         doError(_ERROR_ITEMCLOSED);\r
 388                 }\r
 389                 \r
 390                 switch ( $type )\r
 391                 {\r
 392                         case 'pos':\r
 393                                 $karma->votePositive();\r
 394                         break;\r
 395                         \r
 396                         case 'neg':\r
 397                                 $karma->voteNegative();\r
 398                         break;\r
 399                 }\r
 400                 \r
 401                 $blog =& $manager->getBlog($blogid);\r
 402                 \r
 403                 // send email to notification address, if any\r
 404                 if ( $blog->getNotifyAddress() && $blog->notifyOnVote() )\r
 405                 {\r
 406                         $message = _NOTIFY_KV_MSG . ' ' . $itemid . "\n";\r
 407                         $itemLink = Link::create_item_link((integer)$itemid);\r
 408                         $temp = parse_url($itemLink);\r
 409                         \r
 410                         if ( !$temp['scheme'] )\r
 411                         {\r
 412                                 $itemLink = $CONF['IndexURL'] . $itemLink;\r
 413                         }\r
 414                         \r
 415                         $message .= $itemLink . "\n\n";\r
 416                         \r
 417                         if ( $member->isLoggedIn() )\r
 418                         {\r
 419                                 $message .= _NOTIFY_MEMBER . ' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";\r
 420                         }\r
 421                         \r
 422                         $message .= _NOTIFY_IP . ' ' . serverVar('REMOTE_ADDR') . "\n";\r
 423                         $message .= _NOTIFY_HOST . ' ' .  gethostbyaddr(serverVar('REMOTE_ADDR'))  . "\n";\r
 424                         $message .= _NOTIFY_VOTE . "\n " . $type . "\n";\r
 425                         $message .= Notification::get_mail_footer();\r
 426                         \r
 427                         $subject = _NOTIFY_KV_TITLE . ' ' . strip_tags($item['title']) . ' (' . $itemid . ')';\r
 428                         \r
 429                         $from = $member->getNotifyFromMailAddress();\r
 430                         \r
 431                         Notification::mail($blog->getNotifyAddress(), $subject, $message, $from, i18n::get_current_charset());\r
 432                 }\r
 433                 \r
 434                 $refererUrl = serverVar('HTTP_REFERER');\r
 435                 \r
 436                 if ( !$refererUrl )\r
 437                 {\r
 438                         $url = $itemLink;\r
 439                 }\r
 440                 else\r
 441                 {\r
 442                         $url = $refererUrl;\r
 443                 }\r
 444                 \r
 445                 redirect($url);\r
 446                 return;\r
 447         }\r
 448         \r
 449         /**\r
 450          * Action::callPlugin()\r
 451          * Calls a plugin action\r
 452          * \r
 453          * @param       void\r
 454          * @return      void\r
 455          */\r
 456         private function callPlugin()\r
 457         {\r
 458                 global $manager;\r
 459                 \r
 460                 $name = requestVar('name');\r
 461                 $pluginName = "NP_{$name}";\r
 462                 $actionType = requestVar('type');\r
 463                 \r
 464                 // 1: check if plugin is installed\r
 465                 if ( !$manager->pluginInstalled($pluginName) )\r
 466                 {\r
 467                         doError(_ERROR_NOSUCHPLUGIN);\r
 468                 }\r
 469                 \r
 470                 // 2: call plugin\r
 471                 $pluginObject =& $manager->getPlugin($pluginName);\r
 472                 if ( !$pluginObject )\r
 473                 {\r
 474                         $error = 'Could not load plugin (see actionlog)';\r
 475                 }\r
 476                 else\r
 477                 {\r
 478                         $error = $pluginObject->doAction($actionType);\r
 479                 }\r
 480                 \r
 481                 /*\r
 482                  * doAction returns error when:\r
 483                  *  - an error occurred (duh)\r
 484                  *  - no actions are allowed (doAction is not implemented)\r
 485                  */\r
 486                 if ( $error )\r
 487                 {\r
 488                         doError($error);\r
 489                 }\r
 490                 \r
 491                 return;\r
 492         }\r
 493         \r
 494         /**\r
 495          * Action::checkban()\r
 496          *  Checks if an IP or IP range is banned\r
 497          * \r
 498          * @param       integer $blogid\r
 499          * @return      void\r
 500          */\r
 501         private function checkban($blogid)\r
 502         {\r
 503                 // check if banned\r
 504                 $ban = Ban::isBanned($blogid, serverVar('REMOTE_ADDR') );\r
 505                 \r
 506                 if ( $ban != 0 )\r
 507                 {\r
 508                         doError(_ERROR_BANNED1 . $ban->iprange . _ERROR_BANNED2 . $ban->message . _ERROR_BANNED3);\r
 509                 }\r
 510                 \r
 511                 return;\r
 512         }\r
 513         \r
 514         /**\r
 515          * Action::updateTicket()\r
 516          * Gets a new ticket\r
 517          * \r
 518          * @param       void\r
 519          * @return      boolean FALSE\r
 520          */\r
 521         private function updateTicket()\r
 522         {\r
 523                 global $manager;\r
 524                 \r
 525                 if ( !$manager->checkTicket() )\r
 526                 {\r
 527                         echo _ERROR . ':' . _ERROR_BADTICKET;\r
 528                 }\r
 529                 else\r
 530                 {\r
 531                         echo $manager->getNewTicket();\r
 532                 }\r
 533                 \r
 534                 return FALSE;\r
 535         }\r
 536         \r
 537         /**\r
 538          * Action::autoDraft()\r
 539          * Handles AutoSaveDraft\r
 540          * \r
 541          * @param       void\r
 542          * @return      boolean FALSE\r
 543          */\r
 544         private function autoDraft()\r
 545         {\r
 546                 global $manager;\r
 547                 \r
 548                 if ( !$manager->checkTicket() )\r
 549                 {\r
 550                         echo _ERROR . ':' . _ERROR_BADTICKET;\r
 551                 }\r
 552                 else\r
 553                 {\r
 554                         $manager->loadClass('ITEM');\r
 555                         $info = Item::createDraftFromRequest();\r
 556                         \r
 557                         if ( $info['status'] != 'error' )\r
 558                         {\r
 559                                 echo $info['draftid'];\r
 560                         }\r
 561                         else\r
 562                         {\r
 563                                 echo $info['message'];\r
 564                         }\r
 565                 }\r
 566                 \r
 567                 return FALSE;\r
 568         }\r
 569 }\r
 570 \r