nucleus/libs/ACTION.php

   1 <?php
   2
   3 /*
   4  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   5  * Copyright (C) 2002-2009 The Nucleus Group
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  * (see nucleus/documentation/index.html#license for more info)
  12  */
  13 /**
  14  * Actions that can be called via action.php
  15  *
  16  * @license http://nucleuscms.org/license.txt GNU General Public License
  17  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  18  * @version $Id: ACTION.php 1646 2012-01-29 10:47:32Z sakamocchi $
  19  */
  20 class Action
  21 {
  22         /**
  23          * Action::__construct()
  24          *  Constructor for an new ACTION object
  25          *
  26          * @param       void
  27          * @return      void
  28          */
  29         public function __construct()
  30         {
  31                 return;
  32         }
  33
  34         /**
  35          * Action::doAction()
  36          *  Calls functions that handle an action called from action.php
  37          *
  38          * @param       string  $action action type
  39          * @return      mixed
  40          */
  41         public function doAction($action)
  42         {
  43                 switch ( $action )
  44                 {
  45                         case 'autodraft':
  46                                 return $this->autoDraft();
  47                                 break;
  48                         case 'updateticket':
  49                                 return $this->updateTicket();
  50                                 break;
  51                         case 'addcomment':
  52                                 return $this->addComment();
  53                                 break;
  54                         case 'sendmessage':
  55                                 return $this->sendMessage();
  56                                 break;
  57                         case 'createaccount':
  58                                 return $this->createAccount();
  59                                 break;
  60                         case 'forgotpassword':
  61                                 return $this->forgotPassword();
  62                                 break;
  63                         case 'votepositive':
  64                                 return $this->doKarma('pos');
  65                                 break;
  66                         case 'votenegative':
  67                                 return $this->doKarma('neg');
  68                                 break;
  69                         case 'plugin':
  70                                 return $this->callPlugin();
  71                                 break;
  72                         default:
  73                                 doError(_ERROR_BADACTION);
  74                                 break;
  75                 }
  76                 return;
  77         }
  78
  79         /**
  80          * Action::addComment()
  81          * Adds a new comment to an item (if IP isn't banned)
  82          *
  83          * @param       void
  84          * @return      void
  85          */
  86         private function addComment()
  87         {
  88                 global $CONF, $errormessage, $manager;
  89
  90                 $post['itemid'] = intPostVar('itemid');
  91                 $post['user']   = postVar('user');
  92                 $post['userid'] = postVar('userid');
  93                 $post['email']  = postVar('email');
  94                 $post['body']   = postVar('body');
  95                 $post['remember'] = intPostVar('remember');
  96
  97                 // begin if: "Remember Me" box checked
  98                 if ( $post['remember'] == 1 )
  99                 {
 100                         $lifetime = time() + 2592000;
 101                         setcookie($CONF['CookiePrefix'] . 'comment_user', $post['user'], $lifetime, '/', '', 0);
 102                         setcookie($CONF['CookiePrefix'] . 'comment_userid', $post['userid'], $lifetime, '/', '', 0);
 103                         setcookie($CONF['CookiePrefix'] . 'comment_email', $post['email'], $lifetime, '/', '', 0);
 104                 }
 105
 106                 $item =& $manager->getItem($post['itemid'], 0, 0);
 107                 $this->checkban($item['blogid']);
 108                 $blog =& $manager->getBlog($item['blogid']);
 109
 110                 // note: PreAddComment and PostAddComment gets called somewhere inside addComment
 111                 $comments = new Comments($post['itemid']);
 112                 $errormessage = $comments->addComment($blog->getCorrectTime(), $post);
 113
 114                 if ( $errormessage != '1' )
 115                 {
 116                         // show error message using default skin for blo
 117                         return array(
 118                                 'message'       => $errormessage,
 119                                 'skinid'        => $blog->getDefaultSkin()
 120                         );
 121                 }
 122                 else
 123                 {
 124                         // redirect when adding comments succeeded
 125                         if ( postVar('url') )
 126                         {
 127                                 redirect(postVar('url') );
 128                         }
 129                         else
 130                         {
 131                                 $url = Link::create_item_link($post['itemid']);
 132                                 redirect($url);
 133                         }
 134                 }
 135                 return;
 136         }
 137
 138         /**
 139          * Action::sendMessage()
 140          * Sends a message from the current member to the member given as argument
 141          *
 142          * @param       void
 143          * @return      void
 144          */
 145         private function sendMessage()
 146         {
 147                 global $CONF, $member;
 148
 149                 $error = $this->validateMessage();
 150
 151                 if ( $error != '' )
 152                 {
 153                         return array('message' => $error);
 154                 }
 155
 156                 if ( !$member->isLoggedIn() )
 157                 {
 158                         $fromMail = postVar('frommail');
 159                         $fromName = _MMAIL_FROMANON;
 160                 }
 161                 else
 162                 {
 163                         $fromMail = $member->getEmail();
 164                         $fromName = $member->getDisplayName();
 165                 }
 166
 167                 /* TODO: validation */
 168                 $memberid = postVar('memberid');
 169                 $tomem = new Member();
 170                 $tomem->readFromId($memberid);
 171
 172                 /* TODO: validation */
 173                 $message = postVar('message');
 174                 $message  = _MMAIL_MSG . ' ' . $fromName . "\n"
 175                         . '(' . _MMAIL_FROMNUC. ' ' . $CONF['IndexURL'] .") \n\n"
 176                         . _MMAIL_MAIL . " \n\n"
 177                         . $message;
 178                 $message .= Notification::get_mail_footer();
 179
 180                 $title = _MMAIL_TITLE . ' ' . $fromName;
 181                 Notification::mail($tomem->getEmail(), $title, $message, $fromMail, i18n::get_current_charset());
 182
 183                 /* TODO: validation */
 184                 $url = postVar('url');
 185                 if ( empty($url) )
 186                 {
 187                         $CONF['MemberURL'] = $CONF['IndexURL'];
 188
 189                         if ( $CONF['URLMode'] == 'pathinfo' )
 190                         {
 191                                 $data = array(
 192                                         'memberid'      => $tomem->getID(),
 193                                         'name'          => $tomem->getDisplayName()
 194                                 );
 195                                 $url = Link::create_link('member', $data);
 196                         }
 197                         else
 198                         {
 199                                 $url = $CONF['IndexURL'] . Link::create_member_link($tomem->getID());
 200                         }
 201                 }
 202                 redirect($url );
 203
 204                 return;
 205         }
 206
 207         /**
 208          * Action::validateMessage()
 209          *  Checks if a mail to a member is allowed
 210          *  Returns a string with the error message if the mail is disallowed
 211          *
 212          * @param               void
 213          * @return      String  Null character string
 214          */
 215         private function validateMessage()
 216         {
 217                 global $CONF, $member, $manager;
 218
 219                 if ( !$CONF['AllowMemberMail'] )
 220                 {
 221                         return _ERROR_MEMBERMAILDISABLED;
 222                 }
 223
 224                 if ( !$member->isLoggedIn() && !$CONF['NonmemberMail'] )
 225                 {
 226                         return _ERROR_DISALLOWED;
 227                 }
 228
 229                 if ( !$member->isLoggedIn() && !Notification::address_validation(postVar('frommail')) )
 230                 {
 231                         return _ERROR_BADMAILADDRESS;
 232                 }
 233
 234                 /*
 235                  * let plugins do verification (any plugin which thinks the comment is
 236                  * invalid can change 'error' to something other than '')
 237                  */
 238                 $result = '';
 239                 $data = array(
 240                         'type'  => 'membermail',
 241                         'error' => &$result
 242                 );
 243                 $manager->notify('ValidateForm', $data);
 244
 245                 return $result;
 246         }
 247
 248         /**
 249          * Action::createAccount()
 250          * Creates a new user account
 251          *
 252          * @param       void
 253          * @return      mixed
 254          */
 255         private function createAccount()
 256         {
 257                 global $CONF, $manager;
 258
 259                 if ( array_key_exists('AllowMemberCreate', $CONF) && !$CONF['AllowMemberCreate'] )
 260                 {
 261                         doError(_ERROR_MEMBERCREATEDISABLED);
 262                         return;
 263                 }
 264
 265                 // evaluate content from FormExtra
 266                 $result = 1;
 267                 $data = array(
 268                         'type'  => 'membermail',
 269                         'error' => &$result
 270                 );
 271                 $manager->notify('ValidateForm', $data);
 272
 273                 if ( $result != 1 )
 274                 {
 275                         return $result;
 276                 }
 277
 278                 // even though the member can not log in, set some random initial password. One never knows.
 279                 srand((double) microtime() * 1000000);
 280                 $initialPwd = md5(uniqid(rand(), TRUE) );
 281
 282                 // create member (non admin/can not login/no notes/random string as password)
 283                 $name           = Entity::shorten(postVar('name'), 32, '');
 284                 $relname        = postVar('realname');
 285                 $email          = postVar('email');
 286                 $url            = postVar('url');
 287
 288                 $r = Member::create($name, $realname, $initialPwd, $email, $url, 0, 0, '');
 289
 290                 if ( $r != 1 )
 291                 {
 292                         return $r;
 293                 }
 294
 295                 // send message containing password.
 296                 $newmem = new Member();
 297                 $newmem->readFromName($name);
 298                 $newmem->sendActivationLink('register');
 299
 300                 $manager->notify('PostRegister', array('member' => &$newmem) );
 301
 302                 if ( postVar('desturl') )
 303                 {
 304                         redirect(postVar('desturl') );
 305                 }
 306
 307                 return 1;
 308         }
 309
 310         /**
 311          * Action::forgotPassword()
 312          * Sends a new password
 313          *
 314          * @param       void
 315          * @return      void
 316          */
 317         private function forgotPassword()
 318         {
 319                 $membername = trim(postVar('name') );
 320
 321                 if ( !Member::exists($membername) )
 322                 {
 323                         doError(_ERROR_NOSUCHMEMBER);
 324                         return;
 325                 }
 326
 327                 $mem = Member::createFromName($membername);
 328
 329                 // check if e-mail address is correct
 330                 $email = postVar('email');
 331                 if ( $mem->getEmail() != $email )
 332                 {
 333                         doError(_ERROR_INCORRECTEMAIL);
 334                         return;
 335                 }
 336
 337                 // send activation link
 338                 $mem->sendActivationLink('forgot');
 339
 340                 // redirection
 341                 $url = postVar('url');
 342                 if ( !empty($url) )
 343                 {
 344                         redirect(postVar('url') );
 345                 }
 346                 else
 347                 {
 348                         echo _MSG_ACTIVATION_SENT;
 349                         echo "<br />"
 350                             . "<br />"
 351                             . "Return to <a href=\"{$CONF['IndexURL']}\" title=\"{$CONF['SiteName']}\">{$CONF['SiteName']}</a>\n";
 352                 }
 353
 354                 return;
 355         }
 356
 357         /**
 358          * Action::doKarma()
 359          * Handle karma votes
 360          *
 361          * @param       string  $type   pos or neg
 362          * @return      Void
 363          */
 364         private function doKarma($type)
 365         {
 366                 global $itemid, $member, $CONF, $manager;
 367
 368                 // check if itemid exists
 369                 if ( !$manager->existsItem($itemid, 0, 0) )
 370                 {
 371                         doError(_ERROR_NOSUCHITEM);
 372                         return;
 373                 }
 374
 375                 $item =& $manager->getItem($itemid, 0, 0);
 376                 $this->checkban($item['blogid']);
 377
 378                 $karma =& $manager->getKarma($itemid);
 379
 380                 // check if not already voted
 381                 if ( !$karma->isVoteAllowed(serverVar('REMOTE_ADDR') ) )
 382                 {
 383                         doError(_ERROR_VOTEDBEFORE);
 384                         return;
 385                 }
 386
 387                 // check if item does allow voting
 388                 $item =& $manager->getItem($itemid, 0, 0);
 389
 390                 if ( $item['closed'] )
 391                 {
 392                         doError(_ERROR_ITEMCLOSED);
 393                         return;
 394                 }
 395
 396                 switch ( $type )
 397                 {
 398                         case 'pos':
 399                                 $karma->votePositive();
 400                         break;
 401
 402                         case 'neg':
 403                                 $karma->voteNegative();
 404                         break;
 405                 }
 406
 407                 $blog =& $manager->getBlog($blogid);
 408
 409                 // send email to notification address, if any
 410                 if ( $blog->getNotifyAddress() && $blog->notifyOnVote() )
 411                 {
 412                         $message = _NOTIFY_KV_MSG . ' ' . $itemid . "\n";
 413                         $itemLink = Link::create_item_link((integer)$itemid);
 414                         $temp = parse_url($itemLink);
 415
 416                         if ( !$temp['scheme'] )
 417                         {
 418                                 $itemLink = $CONF['IndexURL'] . $itemLink;
 419                         }
 420
 421                         $message .= $itemLink . "\n\n";
 422
 423                         if ( $member->isLoggedIn() )
 424                         {
 425                                 $message .= _NOTIFY_MEMBER . ' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";
 426                         }
 427
 428                         $message .= _NOTIFY_IP . ' ' . serverVar('REMOTE_ADDR') . "\n";
 429                         $message .= _NOTIFY_HOST . ' ' .  gethostbyaddr(serverVar('REMOTE_ADDR'))  . "\n";
 430                         $message .= _NOTIFY_VOTE . "\n " . $type . "\n";
 431                         $message .= Notification::get_mail_footer();
 432
 433                         $subject = _NOTIFY_KV_TITLE . ' ' . strip_tags($item['title']) . ' (' . $itemid . ')';
 434
 435                         $from = $member->getNotifyFromMailAddress();
 436
 437                         Notification::mail($blog->getNotifyAddress(), $subject, $message, $from, i18n::get_current_charset());
 438                 }
 439
 440                 $refererUrl = serverVar('HTTP_REFERER');
 441
 442                 if ( !$refererUrl )
 443                 {
 444                         $url = $itemLink;
 445                 }
 446                 else
 447                 {
 448                         $url = $refererUrl;
 449                 }
 450
 451                 redirect($url);
 452                 return;
 453         }
 454
 455         /**
 456          * Action::callPlugin()
 457          * Calls a plugin action
 458          *
 459          * @param       void
 460          * @return      void
 461          */
 462         private function callPlugin()
 463         {
 464                 global $manager;
 465
 466                 $name = requestVar('name');
 467                 $pluginName = "NP_{$name}";
 468                 $actionType = requestVar('type');
 469
 470                 // 1: check if plugin is installed
 471                 if ( !$manager->pluginInstalled($pluginName) )
 472                 {
 473                         doError(_ERROR_NOSUCHPLUGIN);
 474                         return;
 475                 }
 476
 477                 // 2: call plugin
 478                 $pluginObject =& $manager->getPlugin($pluginName);
 479                 if ( !$pluginObject )
 480                 {
 481                         $error = 'Could not load plugin (see actionlog)';
 482                 }
 483                 else
 484                 {
 485                         $error = $pluginObject->doAction($actionType);
 486                 }
 487
 488                 /*
 489                  * doAction returns error when:
 490                  *  - an error occurred (duh)
 491                  *  - no actions are allowed (doAction is not implemented)
 492                  */
 493                 if ( $error )
 494                 {
 495                         doError($error);
 496                         return;
 497                 }
 498
 499                 return;
 500         }
 501
 502         /**
 503          * Action::checkban()
 504          *  Checks if an IP or IP range is banned
 505          *
 506          * @param       integer $blogid
 507          * @return      void
 508          */
 509         private function checkban($blogid)
 510         {
 511                 // check if banned
 512                 $ban = Ban::isBanned($blogid, serverVar('REMOTE_ADDR') );
 513
 514                 if ( $ban != 0 )
 515                 {
 516                         doError(_ERROR_BANNED1 . $ban->iprange . _ERROR_BANNED2 . $ban->message . _ERROR_BANNED3);
 517                         return;
 518                 }
 519
 520                 return;
 521         }
 522
 523         /**
 524          * Action::updateTicket()
 525          * Gets a new ticket
 526          *
 527          * @param       void
 528          * @return      boolean FALSE
 529          */
 530         private function updateTicket()
 531         {
 532                 global $manager;
 533
 534                 if ( !$manager->checkTicket() )
 535                 {
 536                         echo _ERROR . ':' . _ERROR_BADTICKET;
 537                 }
 538                 else
 539                 {
 540                         echo $manager->getNewTicket();
 541                 }
 542
 543                 return FALSE;
 544         }
 545
 546         /**
 547          * Action::autoDraft()
 548          * Handles AutoSaveDraft
 549          *
 550          * @param       void
 551          * @return      boolean FALSE
 552          */
 553         private function autoDraft()
 554         {
 555                 global $manager;
 556
 557                 if ( !$manager->checkTicket() )
 558                 {
 559                         echo _ERROR . ':' . _ERROR_BADTICKET;
 560                 }
 561                 else
 562                 {
 563                         $manager->loadClass('ITEM');
 564                         $info = Item::createDraftFromRequest();
 565
 566                         if ( $info['status'] != 'error' )
 567                         {
 568                                 echo $info['draftid'];
 569                         }
 570                         else
 571                         {
 572                                 echo $info['message'];
 573                         }
 574                 }
 575
 576                 return FALSE;
 577         }
 578 }
 579