nucleus/libs/ACTION.php

   1 <?php\r
   2 \r
   3 /*\r
   4  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   5  * Copyright (C) 2002-2009 The Nucleus Group\r
   6  *\r
   7  * This program is free software; you can redistribute it and/or\r
   8  * modify it under the terms of the GNU General Public License\r
   9  * as published by the Free Software Foundation; either version 2\r
  10  * of the License, or (at your option) any later version.\r
  11  * (see nucleus/documentation/index.html#license for more info)\r
  12  */\r
  13 /**\r
  14  * Actions that can be called via action.php\r
  15  *\r
  16  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  17  * @copyright Copyright (C) 2002-2009 The Nucleus Group\r
  18  * @version $Id: ACTION.php 1646 2012-01-29 10:47:32Z sakamocchi $\r
  19  */\r
  20 class Action\r
  21 {\r
  22         /**\r
  23          * Action::__construct()\r
  24          *  Constructor for an new ACTION object\r
  25          * \r
  26          * @param       void\r
  27          * @return      void\r
  28          */\r
  29         public function __construct()\r
  30         {\r
  31                 return;\r
  32         }\r
  33         \r
  34         /**\r
  35          * Action::doAction()\r
  36          *  Calls functions that handle an action called from action.php\r
  37          * \r
  38          * @param       string  $action action type\r
  39          * @return      mixed\r
  40          */\r
  41         public function doAction($action)\r
  42         {\r
  43                 switch ( $action )\r
  44                 {\r
  45                         case 'autodraft':\r
  46                                 return $this->autoDraft();\r
  47                                 break;\r
  48                         case 'updateticket':\r
  49                                 return $this->updateTicket();\r
  50                                 break;\r
  51                         case 'addcomment':\r
  52                                 return $this->addComment();\r
  53                                 break;\r
  54                         case 'sendmessage':\r
  55                                 return $this->sendMessage();\r
  56                                 break;\r
  57                         case 'createaccount':\r
  58                                 return $this->createAccount();\r
  59                                 break;\r
  60                         case 'forgotpassword':\r
  61                                 return $this->forgotPassword();\r
  62                                 break;\r
  63                         case 'votepositive':\r
  64                                 return $this->doKarma('pos');\r
  65                                 break;\r
  66                         case 'votenegative':\r
  67                                 return $this->doKarma('neg');\r
  68                                 break;\r
  69                         case 'plugin':\r
  70                                 return $this->callPlugin();\r
  71                                 break;\r
  72                         default:\r
  73                                 doError(_ERROR_BADACTION);\r
  74                                 break;\r
  75                 }\r
  76                 return;\r
  77         }\r
  78         \r
  79         /**\r
  80          * Action::addComment()\r
  81          * Adds a new comment to an item (if IP isn't banned)\r
  82          * \r
  83          * @param       void\r
  84          * @return      void\r
  85          */\r
  86         private function addComment()\r
  87         {\r
  88                 global $CONF, $errormessage, $manager;\r
  89                 \r
  90                 $post['itemid'] = intPostVar('itemid');\r
  91                 $post['user']   = postVar('user');\r
  92                 $post['userid'] = postVar('userid');\r
  93                 $post['email']  = postVar('email');\r
  94                 $post['body']   = postVar('body');\r
  95                 $post['remember'] = intPostVar('remember');\r
  96                 \r
  97                 // begin if: "Remember Me" box checked\r
  98                 if ( $post['remember'] == 1 )\r
  99                 {\r
 100                         $lifetime = time() + 2592000;\r
 101                         setcookie($CONF['CookiePrefix'] . 'comment_user', $post['user'], $lifetime, '/', '', 0);\r
 102                         setcookie($CONF['CookiePrefix'] . 'comment_userid', $post['userid'], $lifetime, '/', '', 0);\r
 103                         setcookie($CONF['CookiePrefix'] . 'comment_email', $post['email'], $lifetime, '/', '', 0);\r
 104                 }\r
 105                 \r
 106                 $comments = new Comments($post['itemid']);\r
 107                 \r
 108                 $blog_id = getBlogIDFromItemID($post['itemid']);\r
 109                 $this->checkban($blog_id);\r
 110                 $blog =& $manager->getBlog($blog_id);\r
 111                 \r
 112                 // note: PreAddComment and PostAddComment gets called somewhere inside addComment\r
 113                 $errormessage = $comments->addComment($blog->getCorrectTime(), $post);\r
 114                 \r
 115                 if ( $errormessage != '1' )\r
 116                 {\r
 117                         // show error message using default skin for blo\r
 118                         return array(\r
 119                                 'message'       => $errormessage,\r
 120                                 'skinid'        => $blog->getDefaultSkin()\r
 121                         );\r
 122                 }\r
 123                 else\r
 124                 {\r
 125                         // redirect when adding comments succeeded\r
 126                         if ( postVar('url') )\r
 127                         {\r
 128                                 redirect(postVar('url') );\r
 129                         }\r
 130                         else\r
 131                         {\r
 132                                 $url = Link::create_item_link($post['itemid']);\r
 133                                 redirect($url);\r
 134                         }\r
 135                 }\r
 136                 return;\r
 137         }\r
 138         \r
 139         /**\r
 140          * Action::sendMessage()\r
 141          * Sends a message from the current member to the member given as argument\r
 142          * \r
 143          * @param       void\r
 144          * @return      void\r
 145          */\r
 146         private function sendMessage()\r
 147         {\r
 148                 global $CONF, $member;\r
 149                 \r
 150                 $error = $this->validateMessage();\r
 151                 \r
 152                 if ( $error != '' )\r
 153                 {\r
 154                         return array('message' => $error);\r
 155                 }\r
 156                 \r
 157                 if ( !$member->isLoggedIn() )\r
 158                 {\r
 159                         $fromMail = postVar('frommail');\r
 160                         $fromName = _MMAIL_FROMANON;\r
 161                 }\r
 162                 else\r
 163                 {\r
 164                         $fromMail = $member->getEmail();\r
 165                         $fromName = $member->getDisplayName();\r
 166                 }\r
 167                 \r
 168                 /* TODO: validation */\r
 169                 $memberid = postVar('memberid');\r
 170                 $tomem = new Member();\r
 171                 $tomem->readFromId($memberid);\r
 172                 \r
 173                 /* TODO: validation */\r
 174                 $message = postVar('message');\r
 175                 $message  = _MMAIL_MSG . ' ' . $fromName . "\n"\r
 176                         . '(' . _MMAIL_FROMNUC. ' ' . $CONF['IndexURL'] .") \n\n"\r
 177                         . _MMAIL_MAIL . " \n\n"\r
 178                         . $message;\r
 179                 $message .= Notification::get_mail_footer();\r
 180                 \r
 181                 $title = _MMAIL_TITLE . ' ' . $fromName;\r
 182                 Notification::mail($tomem->getEmail(), $title, $message, $fromMail, i18n::get_current_charset());\r
 183                 \r
 184                 /* TODO: validation */\r
 185                 $url = postVar('url');\r
 186                 if ( empty($url) )\r
 187                 {\r
 188                         $CONF['MemberURL'] = $CONF['IndexURL'];\r
 189                         \r
 190                         if ( $CONF['URLMode'] == 'pathinfo' )\r
 191                         {\r
 192                                 $data = array(\r
 193                                         'memberid'      => $tomem->getID(),\r
 194                                         'name'          => $tomem->getDisplayName()\r
 195                                 );\r
 196                                 $url = Link::create_link('member', $data);\r
 197                         }\r
 198                         else\r
 199                         {\r
 200                                 $url = $CONF['IndexURL'] . Link::create_member_link($tomem->getID());\r
 201                         }\r
 202                 }\r
 203                 redirect($url );\r
 204                 \r
 205                 return;\r
 206         }\r
 207         \r
 208         /**\r
 209          * Action::validateMessage()\r
 210          *  Checks if a mail to a member is allowed\r
 211          *  Returns a string with the error message if the mail is disallowed\r
 212          * \r
 213          * @param               void\r
 214          * @return      String  Null character string\r
 215          */\r
 216         private function validateMessage()\r
 217         {\r
 218                 global $CONF, $member, $manager;\r
 219                 \r
 220                 if ( !$CONF['AllowMemberMail'] )\r
 221                 {\r
 222                         return _ERROR_MEMBERMAILDISABLED;\r
 223                 }\r
 224                 \r
 225                 if ( !$member->isLoggedIn() && !$CONF['NonmemberMail'] )\r
 226                 {\r
 227                         return _ERROR_DISALLOWED;\r
 228                 }\r
 229                 \r
 230                 if ( !$member->isLoggedIn() && !Notification::address_validation(postVar('frommail')) )\r
 231                 {\r
 232                         return _ERROR_BADMAILADDRESS;\r
 233                 }\r
 234                 \r
 235                 /*\r
 236                  * let plugins do verification (any plugin which thinks the comment is\r
 237                  * invalid can change 'error' to something other than '')\r
 238                  */\r
 239                 $result = '';\r
 240                 $data = array(\r
 241                         'type'  => 'membermail',\r
 242                         'error' => &$result\r
 243                 );\r
 244                 $manager->notify('ValidateForm', $data);\r
 245                 \r
 246                 return $result;\r
 247         }\r
 248         \r
 249         /**\r
 250          * Action::createAccount()\r
 251          * Creates a new user account\r
 252          *  \r
 253          * @param       void\r
 254          * @return      mixed\r
 255          */\r
 256         private function createAccount()\r
 257         {\r
 258                 global $CONF, $manager;\r
 259                 \r
 260                 if ( array_key_exists('AllowMemberCreate', $CONF) && !$CONF['AllowMemberCreate'] )\r
 261                 {\r
 262                         doError(_ERROR_MEMBERCREATEDISABLED);\r
 263                 }\r
 264                 \r
 265                 // evaluate content from FormExtra\r
 266                 $result = 1;\r
 267                 $data = array(\r
 268                         'type'  => 'membermail',\r
 269                         'error' => &$result\r
 270                 );\r
 271                 $manager->notify('ValidateForm', $data);\r
 272                 \r
 273                 if ( $result != 1 )\r
 274                 {\r
 275                         return $result;\r
 276                 }\r
 277                 \r
 278                 // even though the member can not log in, set some random initial password. One never knows.\r
 279                 srand((double) microtime() * 1000000);\r
 280                 $initialPwd = md5(uniqid(rand(), TRUE) );\r
 281                 \r
 282                 // create member (non admin/can not login/no notes/random string as password)\r
 283                 $name           = Entity::shorten(postVar('name'), 32, '');\r
 284                 $relname        = postVar('realname');\r
 285                 $email          = postVar('email');\r
 286                 $url            = postVar('url');\r
 287                 \r
 288                 $r = Member::create($name, $realname, $initialPwd, $email, $url, 0, 0, '');\r
 289                 \r
 290                 if ( $r != 1 )\r
 291                 {\r
 292                         return $r;\r
 293                 }\r
 294                 \r
 295                 // send message containing password.\r
 296                 $newmem = new Member();\r
 297                 $newmem->readFromName($name);\r
 298                 $newmem->sendActivationLink('register');\r
 299                 \r
 300                 $manager->notify('PostRegister', array('member' => &$newmem) );\r
 301                 \r
 302                 if ( postVar('desturl') )\r
 303                 {\r
 304                         redirect(postVar('desturl') );\r
 305                 }\r
 306                 \r
 307                 return 1;\r
 308         }\r
 309         \r
 310         /**\r
 311          * Action::forgotPassword()\r
 312          * Sends a new password\r
 313          * \r
 314          * @param       void\r
 315          * @return      void\r
 316          */\r
 317         private function forgotPassword()\r
 318         {\r
 319                 $membername = trim(postVar('name') );\r
 320                 \r
 321                 if ( !Member::exists($membername) )\r
 322                 {\r
 323                         doError(_ERROR_NOSUCHMEMBER);\r
 324                 }\r
 325                 \r
 326                 $mem = Member::createFromName($membername);\r
 327                 \r
 328                 // check if e-mail address is correct\r
 329                 $email = postVar('email');\r
 330                 if ( $mem->getEmail() != $email )\r
 331                 {\r
 332                         doError(_ERROR_INCORRECTEMAIL);\r
 333                 }\r
 334                 \r
 335                 // send activation link\r
 336                 $mem->sendActivationLink('forgot');\r
 337                 \r
 338                 // redirection\r
 339                 $url = postVar('url');\r
 340                 if ( !empty($url) )\r
 341                 {\r
 342                         redirect(postVar('url') );\r
 343                 }\r
 344                 else\r
 345                 {\r
 346                         echo _MSG_ACTIVATION_SENT;\r
 347                         echo "<br />"\r
 348                             . "<br />"\r
 349                             . "Return to <a href=\"{$CONF['IndexURL']}\" title=\"{$CONF['SiteName']}\">{$CONF['SiteName']}</a>\n";\r
 350                 }\r
 351                 \r
 352                 return;\r
 353         }\r
 354         \r
 355         /**\r
 356          * Action::doKarma()\r
 357          * Handle karma votes\r
 358          * \r
 359          * @param       string  $type   pos or neg\r
 360          * @return      Void\r
 361          */\r
 362         private function doKarma($type)\r
 363         {\r
 364                 global $itemid, $member, $CONF, $manager;\r
 365                 \r
 366                 // check if itemid exists\r
 367                 if ( !$manager->existsItem($itemid, 0, 0) )\r
 368                 {\r
 369                         doError(_ERROR_NOSUCHITEM);\r
 370                 }\r
 371                 \r
 372                 $blogid = getBlogIDFromItemID($itemid);\r
 373                 $this->checkban($blogid);\r
 374                 \r
 375                 $karma =& $manager->getKarma($itemid);\r
 376                 \r
 377                 // check if not already voted\r
 378                 if ( !$karma->isVoteAllowed(serverVar('REMOTE_ADDR') ) )\r
 379                 {\r
 380                         doError(_ERROR_VOTEDBEFORE);\r
 381                 }\r
 382                 \r
 383                 // check if item does allow voting\r
 384                 $item =& $manager->getItem($itemid, 0, 0);\r
 385                 \r
 386                 if ( $item['closed'] )\r
 387                 {\r
 388                         doError(_ERROR_ITEMCLOSED);\r
 389                 }\r
 390                 \r
 391                 switch ( $type )\r
 392                 {\r
 393                         case 'pos':\r
 394                                 $karma->votePositive();\r
 395                         break;\r
 396                         \r
 397                         case 'neg':\r
 398                                 $karma->voteNegative();\r
 399                         break;\r
 400                 }\r
 401                 \r
 402                 $blog =& $manager->getBlog($blogid);\r
 403                 \r
 404                 // send email to notification address, if any\r
 405                 if ( $blog->getNotifyAddress() && $blog->notifyOnVote() )\r
 406                 {\r
 407                         $message = _NOTIFY_KV_MSG . ' ' . $itemid . "\n";\r
 408                         $itemLink = Link::create_item_link((integer)$itemid);\r
 409                         $temp = parse_url($itemLink);\r
 410                         \r
 411                         if ( !$temp['scheme'] )\r
 412                         {\r
 413                                 $itemLink = $CONF['IndexURL'] . $itemLink;\r
 414                         }\r
 415                         \r
 416                         $message .= $itemLink . "\n\n";\r
 417                         \r
 418                         if ( $member->isLoggedIn() )\r
 419                         {\r
 420                                 $message .= _NOTIFY_MEMBER . ' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";\r
 421                         }\r
 422                         \r
 423                         $message .= _NOTIFY_IP . ' ' . serverVar('REMOTE_ADDR') . "\n";\r
 424                         $message .= _NOTIFY_HOST . ' ' .  gethostbyaddr(serverVar('REMOTE_ADDR'))  . "\n";\r
 425                         $message .= _NOTIFY_VOTE . "\n " . $type . "\n";\r
 426                         $message .= Notification::get_mail_footer();\r
 427                         \r
 428                         $subject = _NOTIFY_KV_TITLE . ' ' . strip_tags($item['title']) . ' (' . $itemid . ')';\r
 429                         \r
 430                         $from = $member->getNotifyFromMailAddress();\r
 431                         \r
 432                         Notification::mail($blog->getNotifyAddress(), $subject, $message, $from, i18n::get_current_charset());\r
 433                 }\r
 434                 \r
 435                 $refererUrl = serverVar('HTTP_REFERER');\r
 436                 \r
 437                 if ( !$refererUrl )\r
 438                 {\r
 439                         $url = $itemLink;\r
 440                 }\r
 441                 else\r
 442                 {\r
 443                         $url = $refererUrl;\r
 444                 }\r
 445                 \r
 446                 redirect($url);\r
 447                 return;\r
 448         }\r
 449         \r
 450         /**\r
 451          * Action::callPlugin()\r
 452          * Calls a plugin action\r
 453          * \r
 454          * @param       void\r
 455          * @return      void\r
 456          */\r
 457         private function callPlugin()\r
 458         {\r
 459                 global $manager;\r
 460                 \r
 461                 $name = requestVar('name');\r
 462                 $pluginName = "NP_{$name}";\r
 463                 $actionType = requestVar('type');\r
 464                 \r
 465                 // 1: check if plugin is installed\r
 466                 if ( !$manager->pluginInstalled($pluginName) )\r
 467                 {\r
 468                         doError(_ERROR_NOSUCHPLUGIN);\r
 469                 }\r
 470                 \r
 471                 // 2: call plugin\r
 472                 $pluginObject =& $manager->getPlugin($pluginName);\r
 473                 if ( !$pluginObject )\r
 474                 {\r
 475                         $error = 'Could not load plugin (see actionlog)';\r
 476                 }\r
 477                 else\r
 478                 {\r
 479                         $error = $pluginObject->doAction($actionType);\r
 480                 }\r
 481                 \r
 482                 /*\r
 483                  * doAction returns error when:\r
 484                  *  - an error occurred (duh)\r
 485                  *  - no actions are allowed (doAction is not implemented)\r
 486                  */\r
 487                 if ( $error )\r
 488                 {\r
 489                         doError($error);\r
 490                 }\r
 491                 \r
 492                 return;\r
 493         }\r
 494         \r
 495         /**\r
 496          * Action::checkban()\r
 497          *  Checks if an IP or IP range is banned\r
 498          * \r
 499          * @param       integer $blogid\r
 500          * @return      void\r
 501          */\r
 502         private function checkban($blogid)\r
 503         {\r
 504                 // check if banned\r
 505                 $ban = Ban::isBanned($blogid, serverVar('REMOTE_ADDR') );\r
 506                 \r
 507                 if ( $ban != 0 )\r
 508                 {\r
 509                         doError(_ERROR_BANNED1 . $ban->iprange . _ERROR_BANNED2 . $ban->message . _ERROR_BANNED3);\r
 510                 }\r
 511                 \r
 512                 return;\r
 513         }\r
 514         \r
 515         /**\r
 516          * Action::updateTicket()\r
 517          * Gets a new ticket\r
 518          * \r
 519          * @param       void\r
 520          * @return      boolean FALSE\r
 521          */\r
 522         private function updateTicket()\r
 523         {\r
 524                 global $manager;\r
 525                 \r
 526                 if ( !$manager->checkTicket() )\r
 527                 {\r
 528                         echo _ERROR . ':' . _ERROR_BADTICKET;\r
 529                 }\r
 530                 else\r
 531                 {\r
 532                         echo $manager->getNewTicket();\r
 533                 }\r
 534                 \r
 535                 return FALSE;\r
 536         }\r
 537         \r
 538         /**\r
 539          * Action::autoDraft()\r
 540          * Handles AutoSaveDraft\r
 541          * \r
 542          * @param       void\r
 543          * @return      boolean FALSE\r
 544          */\r
 545         private function autoDraft()\r
 546         {\r
 547                 global $manager;\r
 548                 \r
 549                 if ( !$manager->checkTicket() )\r
 550                 {\r
 551                         echo _ERROR . ':' . _ERROR_BADTICKET;\r
 552                 }\r
 553                 else\r
 554                 {\r
 555                         $manager->loadClass('ITEM');\r
 556                         $info = Item::createDraftFromRequest();\r
 557                         \r
 558                         if ( $info['status'] != 'error' )\r
 559                         {\r
 560                                 echo $info['draftid'];\r
 561                         }\r
 562                         else\r
 563                         {\r
 564                                 echo $info['message'];\r
 565                         }\r
 566                 }\r
 567                 \r
 568                 return FALSE;\r
 569         }\r
 570 }\r
 571 \r