safe_mode = true; $parse->allow_url = $user_group[$member_id['user_group']]['allow_url']; $parse->allow_image = $user_group[$member_id['user_group']]['allow_image']; $stop_pm = FALSE; if( isset( $_REQUEST['doaction'] ) ) $doaction = $_REQUEST['doaction']; else $doaction = ""; if( ! $is_logged or ! $user_group[$member_id['user_group']]['allow_pm'] ) { msgbox( $lang['all_err_1'], $lang['pm_err_1'] ); $stop_pm = TRUE; } if( $member_id['pm_all'] >= $user_group[$member_id['user_group']]['max_pm'] and ! $stop_pm ) { msgbox( $lang['all_info'], $lang['pm_err_9'] ); } if( $user_group[$member_id['user_group']]['max_pm_day'] AND ( isset( $_POST['send'] ) OR $doaction == "newpm" ) ) { $this_time = time() + ($config['date_adjust'] * 60) - 86400; $db->query( "DELETE FROM " . PREFIX . "_sendlog WHERE date < '$this_time' AND flag='1'" ); $row = $db->super_query("SELECT COUNT(*) as count FROM " . PREFIX . "_sendlog WHERE user = '{$member_id['name']}' AND flag='1'"); if( $row['count'] >= $user_group[$member_id['user_group']]['max_pm_day'] ) { msgbox( $lang['all_err_1'], str_replace('{max}', $user_group[$member_id['user_group']]['max_pm_day'], $lang['pm_err_10']) ); $stop_pm = TRUE; } } $tpl->load_template( 'pm.tpl' ); $tpl->set( '[inbox]', "" ); $tpl->set( '[/inbox]', "" ); $tpl->set( '[outbox]', "" ); $tpl->set( '[/outbox]', "" ); $tpl->set( '[new_pm]', "" ); $tpl->set( '[/new_pm]', "" ); $tpl->copy_template = " " . $tpl->copy_template; if( isset( $_POST['send'] ) and ! $stop_pm ) { $name = $db->safesql( $parse->process( trim( $_POST['name'] ) ) ); $subj = $db->safesql( $parse->process( trim( $_POST['subj'] ) ) ); $stop = ""; $id_key = $_POST[$_SESSION['id_key']]; if( $id_key == "" or $id_key != $dle_login_hash ) $stop .= "

ANTISPAM: User ID not valid

"; if (clean_url($_SERVER['HTTP_REFERER']) != clean_url($_SERVER['HTTP_HOST'])) $stop .= "

ANTISPAM: User ID not valid

"; if( $config['allow_comments_wysiwyg'] != "yes" ) $comments = $db->safesql( $parse->BB_Parse( $parse->process( trim( $_POST['comments'] ) ), false ) ); else { $parse->wysiwyg = true; if( strlen( $_POST['comments'] ) < 18 ) $_POST['comments'] = ""; if( $user_group[$member_id['user_group']]['allow_url'] ) $parse->ParseFilter( Array ('div', 'a', 'span', 'p', 'br', 'strong', 'em', 'ul', 'li', 'ol' ), Array (), 0, 1 ); else $parse->ParseFilter( Array ('div', 'span', 'p', 'br', 'strong', 'em', 'ul', 'li', 'ol' ), Array (), 0, 1 ); $comments = $db->safesql( $parse->BB_Parse( $parse->process( trim( $_POST['comments'] ) ) ) ); } if( empty( $name ) or empty( $subj ) or $comments == "" ) $stop .= $lang['pm_err_2']; if( dle_strlen( $subj, $config['charset'] ) > 250 ) { $stop .= $lang['pm_err_3']; } if( $parse->not_allowed_tags ) { $stop .= "

" .$lang['news_err_33']. "

"; } if( $parse->not_allowed_text ) { $stop .= "

" . $lang['news_err_37']. "

"; } if( $user_group[$member_id['user_group']]['captcha_pm'] and ($_REQUEST['sec_code'] != $_SESSION['sec_code_session'] or ! $_SESSION['sec_code_session']) ) { $stop .= "

" . $lang['news_err_30'] . "

"; } $db->query( "SELECT email, name, user_id, pm_all, user_group FROM " . USERPREFIX . "_users where name = '$name'" ); if( ! $db->num_rows() ) $stop .= $lang['pm_err_4']; $row = $db->get_row(); $db->free(); if( $stop == "" and ($row['pm_all'] >= $user_group[$row['user_group']]['max_pm']) and $member_id['user_group'] != 1 ) { $stop .= $lang['pm_err_8']; } if( ! $stop ) { $_SESSION['sec_code_session'] = 0; $time = time() + ($config['date_adjust'] * 60); $db->query( "INSERT INTO " . USERPREFIX . "_pm (subj, text, user, user_from, date, pm_read, folder) values ('$subj', '$comments', '$row[user_id]', '$member_id[name]', '$time', 'no', 'inbox')" ); $db->query( "UPDATE " . USERPREFIX . "_users set pm_all=pm_all+1, pm_unread=pm_unread+1 where user_id='$row[user_id]'" ); if( intval( $_REQUEST['outboxcopy'] ) ) { $db->query( "INSERT INTO " . USERPREFIX . "_pm (subj, text, user, user_from, date, pm_read, folder) values ('$subj', '$comments', '$row[user_id]', '$member_id[name]', '$time', 'yes', 'outbox')" ); $db->query( "UPDATE " . USERPREFIX . "_users set pm_all=pm_all+1 where user_id='$member_id[user_id]'" ); } $replyid = intval( $_GET['replyid'] ); if( $replyid ) { $db->query( "UPDATE " . USERPREFIX . "_pm SET reply=1 WHERE id= '$replyid'" ); } if( $user_group[$member_id['user_group']]['max_pm_day'] ) { $db->query( "INSERT INTO " . PREFIX . "_sendlog (user, date, flag) values ('{$member_id['name']}', '{$time}', '1')" ); } if( $config['mail_pm'] ) { include_once ENGINE_DIR . '/classes/mail.class.php'; $mail = new dle_mail( $config ); $mail_template = $db->super_query( "SELECT template FROM " . PREFIX . "_email WHERE name='pm' LIMIT 0,1" ); $mail_template['template'] = stripslashes( $mail_template['template'] ); $mail_template['template'] = str_replace( "{%username%}", $row['name'], $mail_template['template'] ); $mail_template['template'] = str_replace( "{%date%}", langdate( "j F Y H:i", $_TIME ), $mail_template['template'] ); $mail_template['template'] = str_replace( "{%fromusername%}", $member_id['name'], $mail_template['template'] ); $mail_template['template'] = str_replace( "{%title%}", strip_tags( stripslashes( $subj ) ), $mail_template['template'] ); $body = str_replace( '\n', "", $comments ); $body = str_replace( '\r', "", $body ); $body = stripslashes( stripslashes( $body ) ); $body = str_replace( "
", "\n", $body ); $body = strip_tags( $body ); $mail_template['template'] = str_replace( "{%text%}", $body, $mail_template['template'] ); $mail->send( $row['email'], $lang['mail_pm'], $mail_template['template'] ); } msgbox( $lang['all_info'], $lang['pm_sendok'] . " " . $lang['pm_noch'] . " " . $lang['pm_or'] . " " . $lang['pm_main'] . "" ); $stop_pm = TRUE; } else msgbox( $lang['all_err_1'], "

".$stop."

" ); } if( $doaction == "del" and ! $stop_pm ) { $delete_count = 0; if( $_REQUEST['dle_allow_hash'] == "" or $_REQUEST['dle_allow_hash'] != $dle_login_hash ) { die( "Hacking attempt! User ID not valid" ); } if( $_GET['pmid'] ) { $pmid = intval( $_GET['pmid'] ); $row = $db->super_query( "SELECT id, user, user_from, pm_read, folder FROM " . USERPREFIX . "_pm where id= '$pmid'" ); if( ($row['user'] == $member_id['user_id'] and $row['folder'] == "inbox") or ($row['user_from'] == $member_id['name'] and $row['folder'] == "outbox") ) { $db->query( "DELETE FROM " . USERPREFIX . "_pm WHERE id='$row[id]'" ); $delete_count ++; if( $row['pm_read'] != "yes" ) { $db->query( "UPDATE " . USERPREFIX . "_users set pm_unread=pm_unread-1 where user_id='$member_id[user_id]'" ); } $db->query( "UPDATE " . USERPREFIX . "_users set pm_all=pm_all-1 where user_id='$member_id[user_id]'" ); } } elseif( count( $_REQUEST['selected_pm'] ) ) { foreach ( $_REQUEST['selected_pm'] as $pmid ) { $pmid = intval( $pmid ); $row = $db->super_query( "SELECT id, user, user_from, pm_read, folder FROM " . USERPREFIX . "_pm where id= '$pmid'" ); if( ($row['user'] == $member_id['user_id'] and $row['folder'] == "inbox") or ($row['user_from'] == $member_id['name'] and $row['folder'] == "outbox") ) { $db->query( "DELETE FROM " . USERPREFIX . "_pm WHERE id='$row[id]'" ); $delete_count ++; if( $row['pm_read'] != "yes" ) { $db->query( "UPDATE " . USERPREFIX . "_users set pm_unread=pm_unread-1 where user_id='$member_id[user_id]'" ); } $db->query( "UPDATE " . USERPREFIX . "_users set pm_all=pm_all-1 where user_id='$member_id[user_id]'" ); } } } if( $delete_count ) msgbox( $lang['all_info'], $lang['pm_delok'] . " " . $lang['all_prev'] . "." ); else msgbox( $lang['all_err_1'], $lang['pm_err_5'] ); } elseif( $doaction == "readpm" and ! $stop_pm ) { $pmid = intval( $_GET['pmid'] ); $tpl->set( '[readpm]', "" ); $tpl->set( '[/readpm]', "" ); $tpl->set_block( "'\\[pmlist\\].*?\\[/pmlist\\]'si", "" ); $tpl->set_block( "'\\[newpm\\].*?\\[/newpm\\]'si", "" ); $db->query( "SELECT id, subj, text, user, user_from, date, pm_read, news_num, comm_num, user_group, reg_date, signature, foto, fullname, land, icq, xfields FROM " . USERPREFIX . "_pm LEFT JOIN " . USERPREFIX . "_users ON " . USERPREFIX . "_pm.user_from=" . USERPREFIX . "_users.name WHERE " . USERPREFIX . "_pm.id= '$pmid'" ); $row = $db->get_row(); if( $db->num_rows() < 1 ) { msgbox( $lang['all_err_1'], $lang['pm_err_6'] ); $stop_pm = TRUE; } elseif( $row['user'] != $member_id['user_id'] and $row['user_from'] != $member_id['name'] ) { msgbox( $lang['all_err_1'], $lang['pm_err_7'] ); $stop_pm = TRUE; } else { if( $row['user'] == $member_id['user_id'] and $row['pm_read'] != "yes" ) { $db->query( "UPDATE " . USERPREFIX . "_users set pm_unread=pm_unread-1 where user_id='$member_id[user_id]'" ); $db->query( "UPDATE " . USERPREFIX . "_pm set pm_read='yes' where id='$row[id]'" ); } if( strpos( $tpl->copy_template, "[xfvalue_" ) !== false ) $xfound = true; else $xfound = false; if( $xfound ) { $xfields = xfieldsload( true ); $xfieldsdata = xfieldsdataload( $row['xfields'] ); foreach ( $xfields as $value ) { $preg_safe_name = preg_quote( $value[0], "'" ); if( $value[5] != 1 OR $member_id['user_group'] == 1 OR ($is_logged AND $member_id['name'] == $row['user_from']) ) { if( empty( $xfieldsdata[$value[0]] ) ) { $tpl->copy_template = preg_replace( "'\\[xfgiven_{$preg_safe_name}\\](.*?)\\[/xfgiven_{$preg_safe_name}\\]'is", "", $tpl->copy_template ); } else { $tpl->copy_template = preg_replace( "'\\[xfgiven_{$preg_safe_name}\\](.*?)\\[/xfgiven_{$preg_safe_name}\\]'is", "\\1", $tpl->copy_template ); } $tpl->copy_template = preg_replace( "'\\[xfvalue_{$preg_safe_name}\\]'i", stripslashes( $xfieldsdata[$value[0]] ), $tpl->copy_template ); } else { $tpl->copy_template = preg_replace( "'\\[xfgiven_{$preg_safe_name}\\](.*?)\\[/xfgiven_{$preg_safe_name}\\]'is", "", $tpl->copy_template ); $tpl->copy_template = preg_replace( "'\\[xfvalue_{$preg_safe_name}\\]'i", "", $tpl->copy_template ); } } } $tpl->set( '{subj}', stripslashes( $row['subj'] ) ); $tpl->set( '{text}', stripslashes( $row['text'] ) ); if( $row['signature'] and $user_group[$row['user_group']]['allow_signature'] ) { $tpl->set_block( "'\\[signature\\](.*?)\\[/signature\\]'si", "\\1" ); $tpl->set( '{signature}', stripslashes( $row['signature'] ) ); } else { $tpl->set_block( "'\\[signature\\](.*?)\\[/signature\\]'si", "" ); } if( $row['icq'] ) $tpl->set( '{icq}', stripslashes( $row['icq'] ) ); else $tpl->set( '{icq}', '--' ); if( $user_group[$row['user_group']]['icon'] ) $tpl->set( '{group-icon}', "" ); else $tpl->set( '{group-icon}', "" ); $tpl->set( '{group-name}', $user_group[$row['user_group']]['group_prefix'].$user_group[$row['user_group']]['group_name'].$user_group[$row['user_group']]['group_suffix'] ); $tpl->set( '{news-num}', intval( $row['news_num'] ) ); $tpl->set( '{comm-num}', intval( $row['comm_num'] ) ); if( $row['foto'] ) $tpl->set( '{foto}', $config['http_home_url'] . "uploads/fotos/" . $row['foto'] ); else $tpl->set( '{foto}', "{THEME}/images/noavatar.png" ); if( date( Ymd, $row['date'] ) == date( Ymd, $_TIME ) ) { $tpl->set( '{date}', $lang['time_heute'] . langdate( ", H:i", $row['date'] ) ); } elseif( date( Ymd, $row['date'] ) == date( Ymd, ($_TIME - 86400) ) ) { $tpl->set( '{date}', $lang['time_gestern'] . langdate( ", H:i", $row['date'] ) ); } else { $tpl->set( '{date}', langdate( $config['timestamp_comment'], $row['date'] ) ); } if($row['reg_date'] ) $tpl->set( '{registration}', langdate( "j.m.Y", $row['reg_date'] ) ); else $tpl->set( '{registration}', '--' ); if( $config['allow_alt_url'] == "yes" ) { $user_from = $config['http_home_url'] . "user/" . urlencode( $row['user_from'] ) . "/"; $user_from = "onclick=\"ShowProfile('" . urlencode( $row['user_from'] ) . "', '" . htmlspecialchars( $user_from ) . "'); return false;\""; $tpl->set( '{author}', "" . $row['user_from'] . ""); } else { $user_from = "$PHP_SELF?subaction=userinfo&user=" . urlencode( $row['user_from'] ); $user_from = "onclick=\"ShowProfile('" . urlencode( $row['user_from'] ) . "', '" . htmlspecialchars( $user_from ) . "'); return false;\""; $tpl->set( '{author}', "" . $row['user_from'] . ""); } $tpl->set( '[reply]', "" ); $tpl->set( '[/reply]', "" ); $tpl->set( '[del]', "" ); $tpl->set( '[/del]', "" ); $tpl->compile( 'content' ); $tpl->clear(); } } elseif( $doaction == "newpm" and ! $stop_pm ) { $ajax_form = << HTML; $tpl->set( '[newpm]', $ajax_form ); $tpl->set( '[/newpm]', "" ); $tpl->set_block( "'\\[pmlist\\].*?\\[/pmlist\\]'si", "" ); $tpl->set_block( "'\\[readpm\\].*?\\[/readpm\\]'si", "" ); if( $user_group[$member_id['user_group']]['captcha_pm'] ) { $tpl->set( '[sec_code]', "" ); $tpl->set( '[/sec_code]', "" ); $path = parse_url( $config['http_home_url'] ); $tpl->set( '{sec_code}', "
{$lang['reload_code']}" ); } else { $tpl->set( '{sec_code}', "" ); $tpl->set_block( "'\\[sec_code\\](.*?)\\[/sec_code\\]'si", "" ); } $replyid = intval( $_GET['replyid'] ); $user = intval( $_GET['user'] ); if( isset( $_REQUEST['username'] ) ) $username = $db->safesql( strip_tags( urldecode( $_GET['username'] ) ) ); else $username = ''; $text = ""; if( $replyid ) { $row = $db->super_query( "SELECT * FROM " . USERPREFIX . "_pm where id= '$replyid'" ); if( ($row['user'] != $member_id['user_id']) and ($row['user_from'] != $member_id['name']) ) { msgbox( $lang['all_err_1'], $lang['pm_err_7'] ); $stop_pm = TRUE; } if( $config['allow_comments_wysiwyg'] != "yes" ) { $text = $parse->decodeBBCodes( $row['text'], false ); $text = "[quote]" . $text . "[/quote]\n"; } else { $text = $parse->decodeBBCodes( $row['text'], TRUE, $config['allow_comments_wysiwyg'] ); $text = "[quote]" . $text . "[/quote]
"; } $tpl->set( '{author}', $row['user_from'] ); if (strpos ( $row['subj'], "RE:" ) === false) $tpl->set( '{subj}', "RE: " . stripslashes( $row['subj'] ) ); else $tpl->set( '{subj}', stripslashes( $row['subj'] ) ); $row = $db->super_query( "SELECT pm_all, user_group FROM " . USERPREFIX . "_users WHERE name = '" . $db->safesql( $row['user_from'] ) . "'" ); if( $row['pm_all'] >= $user_group[$row['user_group']]['max_pm'] and $member_id['user_group'] != 1 ) { $stop_pm = true; } } elseif( $user or $username != "" ) { if( $user ) $row = $db->super_query( "SELECT name, pm_all, user_group FROM " . USERPREFIX . "_users where user_id = '$user'" ); elseif( $username != "" ) $row = $db->super_query( "SELECT name, pm_all, user_group FROM " . USERPREFIX . "_users where name='$username'" ); if( $row['pm_all'] >= $user_group[$row['user_group']]['max_pm'] and $member_id['user_group'] != 1 ) { $stop_pm = true; } $tpl->set( '{author}', $row['name'] ); $tpl->set( '{subj}', "" ); } else { $tpl->set( '{author}', "" ); $tpl->set( '{subj}', "" ); } if( $config['allow_comments_wysiwyg'] == "yes" ) { include_once ENGINE_DIR . '/editor/comments.php'; $bb_code = ""; $allow_comments_ajax = true; } else include_once ENGINE_DIR . '/modules/bbcode.php'; if( $config['allow_comments_wysiwyg'] == "yes" ) { $tpl->set( '{editor}', $wysiwyg ); } else { $tpl->set( '{editor}', $bb_code ); } $tpl->set( '{text}', $text ); $salt = "abchefghjkmnpqrstuvwxyz"; $random_key = ""; for($i = 0; $i < 8; $i ++) { $random_key .= $salt{rand( 0, 23 )}; } @session_register( 'id_key' ); $_SESSION['id_key'] = $random_key; $random_key = ""; if( $config['allow_comments_wysiwyg'] == "yes" ) $tpl->copy_template = "

\n" . $tpl->copy_template . "{$random_key}

"; else $tpl->copy_template = "

\n" . $tpl->copy_template . "{$random_key}

"; if( ! $stop_pm ) { $tpl->compile( 'content' ); $tpl->clear(); } else { $tpl->clear(); if( ! $tpl->result['info'] ) msgbox( $lang['all_info'], $lang['pm_err_8'] ); } } elseif( ! $stop_pm ) { $tpl->set( '[pmlist]', "" ); $tpl->set( '[/pmlist]', "" ); $tpl->set_block( "'\\[newpm\\].*?\\[/newpm\\]'si", "" ); $tpl->set_block( "'\\[readpm\\].*?\\[/readpm\\]'si", "" ); if( $member_id['pm_unread'] < 0 ) { $db->query( "UPDATE " . USERPREFIX . "_users SET pm_unread='0' WHERE user_id='{$member_id['user_id']}'" ); } $pmlist = << HTML; if( $doaction == "outbox" ) { $lang['pm_from'] = $lang['pm_to']; $sql = "SELECT id, subj, name as user_from, date, pm_read FROM " . USERPREFIX . "_pm LEFT JOIN " . USERPREFIX . "_users ON " . USERPREFIX . "_pm.user=" . USERPREFIX . "_users.user_id WHERE user_from = '{$member_id['name']}' AND folder = 'outbox' order by date desc"; } else $sql = "SELECT id, subj, user_from, date, pm_read, reply FROM " . USERPREFIX . "_pm where user = '{$member_id['user_id']}' AND folder = 'inbox' order by date desc"; $pmlist .= ""; $db->query( $sql ); $i = 0; while ( $row = $db->get_row() ) { $i ++; if( $config['allow_alt_url'] == "yes" ) { $user_from = $config['http_home_url'] . "user/" . urlencode( $row['user_from'] ) . "/"; $user_from = "onclick=\"ShowProfile('" . urlencode( $row['user_from'] ) . "', '" . htmlspecialchars( $user_from ) . "'); return false;\""; $user_from = "" . $row['user_from'] . ""; } else { $user_from = "$PHP_SELF?subaction=userinfo&user=" . urlencode( $row['user_from'] ); $user_from = "onclick=\"ShowProfile('" . urlencode( $row['user_from'] ) . "', '" . htmlspecialchars( $user_from ) . "'); return false;\""; $user_from = "" . $row['user_from'] . ""; } if( $row['pm_read'] == "yes" ) { $subj = "" . stripslashes( $row['subj'] ) . ""; $icon = "{THEME}/dleimages/read.gif"; } else { $subj = "" . stripslashes( $row['subj'] ) . ""; $icon = "{THEME}/dleimages/unread.gif"; } if( $row['reply'] ) $icon = "{THEME}/dleimages/send.gif"; $pmlist .= ""; } $db->free(); $pmlist .= "

	" . $lang['pm_subj'] . "	" . $lang['pm_from'] . "	" . $lang['pm_date'] . "
	{$subj}	{$user_from}	" . langdate( "j.m.Y H:i", $row['date'] ) . "

"; if( $i ) $tpl->set( '{pmlist}', $pmlist ); else $tpl->set( '{pmlist}', $lang['no_message'] ); $tpl->compile( 'content' ); $tpl->clear(); } ?>