<?php session_start();
/**********************************************************************
* Copyright notice Ja2BU 1.1.
*
* (c) 2011 Predrag Rukavina - admin[at]phpform[dot]net
* All rights reserved
*
* This script is part of the Ja2BU project.
* The Ja2BU project is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*
* This copyright notice MUST appear in all copies of the script!
************************************************************************/
include ('settings.php');
error_reporting(E_ERROR | E_WARNING | E_PARSE);
require_once ('salt.php');
require_once ('classes/securesession.class.php');
$ss = new SecSession();
$ss->check_browser = true;
$ss->check_ip_blocks = 2;
$ss->secure_word = $salt;
$ss->regenerate_id = true;
if(!$ss->Check() || !isset($_SESSION['loggedin']) || !$_SESSION['loggedin']) {
header('Location: signin.php');
die();
}
if(!$_SESSION['inecsess']) {
die();
}
include('session.php');
$smarty->display('submit.php');
$shouter = @$_SESSION['INC_USER_ID'];
$drecordSet = &$conn->Execute('SELECT * FROM users WHERE usid = ? LIMIT 1',array($shouter));
if(!$drecordSet)
print $conn->ErrorMsg();
else
while(!$drecordSet->EOF) {
$priv = $drecordSet->fields['privilege'];
$kori = $drecordSet->fields['usid'];
$usercc = $drecordSet->fields['username'];
$thumbs = $drecordSet->fields['thumbs'];
if($priv == 1) {
echo "<div id=\"error\">".$lang['MUSTPR']." ".$lang['MUSTCO']." <a href=\"mailto:".$sitemail."\">".
$lang['MUSTWE']."</a> ".$lang['MUSTSI']."</div></div>";
$smarty->display('footer.php');
die();
}
$drecordSet->MoveNext();
}
if(isset($_POST['query'])) {
$cuniver = $_POST['bname'];
if(get_magic_quotes_gpc()) {
$type = stripslashes($_POST['type']);
$univer = stripslashes($_POST['univer']);
$bname = stripslashes($_POST['bname']);
$amess = stripslashes($_POST['amess']);
$amess = htmlspecialchars($amess);
$hashtags = stripslashes($_POST['hashtags']);
} else {
$type = $_POST['type'];
$univer = $_POST['univer'];
$bname = $_POST['bname'];
$amess = $_POST['amess'];
$amess = htmlspecialchars($amess);
$hashtags = $_POST['hashtags'];
}
if(preg_match("/</",$bname)) {
echo "<div id='errorpost'>$lang[INVALIDCHAR] '<' </div>";
$error1 = "color:#cc0000";
include ('form.php');
$smarty->display('footer.php');
die();
}
if(preg_match("/]/",$bname)) {
echo "<div id='errorpost'>$lang[INVALIDCHAR] '[' </div>";
include ('form.php');
$error1 = "color:#cc0000";
$smarty->display('footer.php');
die();
}
if(preg_match("/</",$hashtags)) {
echo "<div id='errorpost'>$lang[INVALIDCHAR] '<' </div>";
$error12 = "color:#cc0000";
include ('form.php');
$smarty->display('footer.php');
die();
}
if(preg_match("/]/",$hashtags)) {
echo "<div id='errorpost'>$lang[INVALIDCHAR] '[' </div>";
include ('form.php');
$error12 = "color:#cc0000";
$smarty->display('footer.php');
die();
}
if(preg_match("/;/",$hashtags)) {
echo "<div id='errorpost'>$lang[INVALIDCHAR] ';' </div>";
include ('form.php');
$error12 = "color:#cc0000";
$smarty->display('footer.php');
die();
}
if(strlen($bname) < 3) {
echo "<div id='errorpost'>$lang[POSTERR1] </div>";
$error1 = "color:#cc0000";
include ('form.php');
$smarty->display('footer.php');
die();
}
if(strlen($bname) > 250) {
echo "$<div id='errorpost'>lang[POSTERR2] </div>";
$error1 = "color:#cc0000";
include ('form.php');
$smarty->display('footer.php');
die();
}
if(@$_SESSION["reloadse"] == $cuniver) {
echo "<div id='errorpost'>$lang[BOOKERR9].</div>";
include ('form.php');
$smarty->display('footer.php');
die();
}
if(strlen($amess) < 10) {
echo "<div id='errorpost'>$lang[POSTERR3] </div>";
$error4 = "color:#cc0000";
include ('form.php');
$smarty->display('footer.php');
die();
}
if(strlen($amess) > $maxposting) {
echo "<div id='errorpost'>Error [23] </div>";
$error4 = "color:#cc0000";
include ('form.php');
$smarty->display('footer.php');
die();
}
if(strlen($hashtags) < 3) {
echo "<div id='errorpost'>$lang[POSTERR0] </div>";
$error12 = "color:#cc0000";
include ('form.php');
$smarty->display('footer.php');
die();
}
$name = array($bname,$amess);
$list = "/(content-type|mime-version|content-transfer-encoding|to:|bcc:|cc:|document.cookie|document.write|onmouse|onkey|onclick|onload)/i";
foreach($name as $name) {
if(preg_match($list,$name)) {
echo "<center><font face='verdana'>$lang[INVALIDCHAR] '??' </font></center>";
die();
}
}
@$_SESSION["reloadse"] = $cuniver;
$time = date("Y-m-d H:i:s");
$hcta = array("onload","onclick");
$ycta = array("-","-");
$amess = str_replace($hcta,$ycta,$amess);
$helper = preg_replace('/([?,\/,|,",\',:,%,*,(,),[,\,\],\,])/',"-",$bname);
$helper = urlencode($helper);
$commas = array(" ,",", ");
$replaced = array(",",",");
$hasher = str_replace($commas,$replaced,$hashtags);
$sql = $conn->Prepare('INSERT INTO article (main,univer,buserid,buser,btexty,tags,bhelper,bimgs,bdate,bamess) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
if($conn->Execute($sql,array($type,$univer,$kori,$usercc,$bname,$hasher,$helper,$thumbs,$time,$amess)) === false) {
print '<br /><div id="error">error inserting[1]: '.$conn->ErrorMsg().'</div><br />';
}
$amess = htmlspecialchars_decode($amess);
$amess = strip_tags($amess);
$hcta = array("<",">","[","]","onload","onclick");
$ycta = array("-","-","-","-","-","-");
$amess = str_replace($hcta,$ycta,$amess);
$sql2 = $conn->Prepare('INSERT INTO onewse (omain,oniver,otexty,ohelper,oamess,odate) VALUES (?, ?, ?, ?, ?, ?)');
if($conn->Execute($sql2,array($type,$univer,$bname,$helper,$amess,$time)) === false) {
print '<br /><div id="error">error inserting[1]: '.$conn->ErrorMsg().'</div><br />';
}
$getags = explode(',',$hashtags);
foreach($getags as $value) {
$value = trim($value);
$sql1 = $conn->Prepare('INSERT INTO catags (hashtags,nofhash) VALUES (?, ?) on duplicate key UPDATE nofhash = nofhash + ?');
if($conn->Execute($sql1,array($value,'1','1')) === false) {
print '<br /><div id="error">error inserting[1]: '.$conn->ErrorMsg().'</div><br />';
}
}
$conn->Close();
$cname = "New Post - ".$bname."\r\nvia ".$usercc;
$ctitle = "New Post [".$sitetitle."]";
$headers = 'From:'.$sitemail."\r\n".'Reply-To: $ccmail'."\r\n".'X-Mailer: PHP/'.phpversion();
mail($sitemail,$ctitle,$cname,$headers);
?>
<script type="text/javascript">
<!--
function delayer(){
window.location = "index.php"
}
//-->
</script>
</head>
<body onLoad="setTimeout('delayer()', 1200)">
<div id="loader"><?php echo $lang['SIGSEC'] ?><br /><br /><img src="themes/<?php echo $themes; ?>/styles/images/ajax-loader.gif" border="0"><br /></div></div>
<?php } else {
$univer = date("Yhis");
$ref = $_GET['ref'];
if($ref == 1) {
$type = '1';
}
if($ref == 2) {
$type = '2';
}
if($ref == false) {
die('no type');
} ?>
<form action="post.php" id="incform" enctype="multipart/form-data" method="post">
<?php if($ref == 1) { ?>
<h3><?php echo $lang['ASK']; ?></h3>
<?php } ?>
<?php if($ref == 2) { ?>
<h3><?php echo $lang['SNIPPET']; ?></h3>
<?php } ?>
<input type="hidden" name="univer" value="<?php echo $univer; ?>" />
<input type="hidden" name="type" value="<?php echo $type; ?>" />
<div><?php echo $lang['BOOKFIELD1']; ?>:</div>
<div><input id="firstfield" type="text" name="bname" class="incc" /></div>
<br />
<br />
<div><?php echo $lang['POSTDES']; ?>:</div>
<script>edToolbar('mytxtarea3'); </script>
<div><textarea id="mytxtarea3" name="amess" class="ed"></textarea></div><br /><br />
<div><?php echo $lang['TAGS']; ?>: <?php echo $lang['TAGSDESC']; ?></div>
<div><input id="firstfield" type="text" name="hashtags" class="incc" /></div>
<br />
<br />
<div><input class="buton" type="submit" value="<?php echo $lang['LINKSUB']; ?>" name="query" /></div>
</form>
<br />
<br />
<?php } ?>
</div>
</div>
<?php $smarty->display('footer.php');
$conn->Close();
######################################
##post.php 1.1.##
######################################
?>