' . $msg_title . '
'; echo '' . $msg_text . '
';
echo $l_notify;
echo '
* append_sid("{$phpbb_root_path}viewtopic.$phpEx?t=1&f=2");
* append_sid("{$phpbb_root_path}viewtopic.$phpEx", 't=1&f=2');
* append_sid("{$phpbb_root_path}viewtopic.$phpEx", 't=1&f=2', false);
* append_sid("{$phpbb_root_path}viewtopic.$phpEx", array('t' => 1, 'f' => 2));
*
*
*/
function append_sid($url, $params = false, $is_amp = true, $session_id = false)
{
global $_SID, $_EXTRA_URL, $phpbb_hook;
// Developers using the hook function need to globalise the $_SID and $_EXTRA_URL on their own and also handle it appropiatly.
// They could mimick most of what is within this function
if ($phpbb_hook->call_hook(__FUNCTION__, $url, $params, $is_amp, $session_id))
{
if ($phpbb_hook->hook_return(__FUNCTION__))
{
return $phpbb_hook->hook_return_result(__FUNCTION__);
}
}
// Assign sid if session id is not specified
if ($session_id === false)
{
$session_id = $_SID;
}
$amp_delim = ($is_amp) ? '&' : '&';
$url_delim = (strpos($url, '?') === false) ? '?' : $amp_delim;
// Appending custom url parameter?
$append_url = (!empty($_EXTRA_URL)) ? implode($amp_delim, $_EXTRA_URL) : '';
$anchor = '';
if (strpos($url, '#') !== false)
{
list($url, $anchor) = explode('#', $url, 2);
$anchor = '#' . $anchor;
}
else if (!is_array($params) && strpos($params, '#') !== false)
{
list($params, $anchor) = explode('#', $params, 2);
$anchor = '#' . $anchor;
}
// Use the short variant if possible ;)
if ($params === false)
{
// Append session id
if (!$session_id)
{
return $url . (($append_url) ? $url_delim . $append_url : '') . $anchor;
}
else
{
return $url . (($append_url) ? $url_delim . $append_url . $amp_delim : $url_delim) . 'sid=' . $session_id . $anchor;
}
}
// Build string if parameters are specified as array
if (is_array($params))
{
$output = array();
foreach ($params as $key => $item)
{
if ($item === NULL)
{
continue;
}
if ($key == '#')
{
$anchor = '#' . $item;
continue;
}
$output[] = $key . '=' . $item;
}
$params = implode($amp_delim, $output);
}
// Append session id and parameters (even if they are empty)
// If parameters are empty, the developer can still append his/her parameters without caring about the delimiter
return $url . (($append_url) ? $url_delim . $append_url . $amp_delim : $url_delim) . $params . ((!$session_id) ? '' : $amp_delim . 'sid=' . $session_id) . $anchor;
}
/**
* Generate board url (example: http://www.foo.bar/phpBB)
* @param bool $without_script_path if set to true the script path gets not appended (example: http://www.foo.bar)
*/
function generate_board_url($without_script_path = false)
{
global $config, $user;
$server_name = (!empty($_SERVER['SERVER_NAME'])) ? $_SERVER['SERVER_NAME'] : getenv('SERVER_NAME');
$server_port = (!empty($_SERVER['SERVER_PORT'])) ? (int) $_SERVER['SERVER_PORT'] : (int) getenv('SERVER_PORT');
// Forcing server vars is the only way to specify/override the protocol
if ($config['force_server_vars'] || !$server_name)
{
$server_protocol = ($config['server_protocol']) ? $config['server_protocol'] : (($config['cookie_secure']) ? 'https://' : 'http://');
$server_name = $config['server_name'];
$server_port = (int) $config['server_port'];
$script_path = $config['script_path'];
$url = $server_protocol . $server_name;
}
else
{
// Do not rely on cookie_secure, users seem to think that it means a secured cookie instead of an encrypted connection
$cookie_secure = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 1 : 0;
$url = (($cookie_secure) ? 'https://' : 'http://') . $server_name;
$script_path = $user->page['root_script_path'];
}
if ($server_port && (($config['cookie_secure'] && $server_port <> 443) || (!$config['cookie_secure'] && $server_port <> 80)))
{
$url .= ':' . $server_port;
}
if (!$without_script_path)
{
$url .= $script_path;
}
// Strip / from the end
if (substr($url, -1, 1) == '/')
{
$url = substr($url, 0, -1);
}
return $url;
}
/**
* Redirects the user to another page then exits the script nicely
*/
function redirect($url, $return = false)
{
global $db, $cache, $config, $user, $phpbb_root_path;
if (empty($user->lang))
{
$user->add_lang('common');
}
if (!$return)
{
garbage_collection();
}
// Make sure no &'s are in, this will break the redirect
$url = str_replace('&', '&', $url);
// Determine which type of redirect we need to handle...
$url_parts = parse_url($url);
if ($url_parts === false)
{
// Malformed url, redirect to current page...
$url = generate_board_url() . '/' . $user->page['page'];
}
else if (!empty($url_parts['scheme']) && !empty($url_parts['host']))
{
// Full URL
}
else if ($url[0] == '/')
{
// Absolute uri, prepend direct url...
$url = generate_board_url(true) . $url;
}
else
{
// Relative uri
$pathinfo = pathinfo($url);
// Is the uri pointing to the current directory?
if ($pathinfo['dirname'] == '.')
{
$url = str_replace('./', '', $url);
// Strip / from the beginning
if ($url && substr($url, 0, 1) == '/')
{
$url = substr($url, 1);
}
if ($user->page['page_dir'])
{
$url = generate_board_url() . '/' . $user->page['page_dir'] . '/' . $url;
}
else
{
$url = generate_board_url() . '/' . $url;
}
}
else
{
// Used ./ before, but $phpbb_root_path is working better with urls within another root path
$root_dirs = explode('/', str_replace('\\', '/', phpbb_realpath($phpbb_root_path)));
$page_dirs = explode('/', str_replace('\\', '/', phpbb_realpath($pathinfo['dirname'])));
$intersection = array_intersect_assoc($root_dirs, $page_dirs);
$root_dirs = array_diff_assoc($root_dirs, $intersection);
$page_dirs = array_diff_assoc($page_dirs, $intersection);
$dir = str_repeat('../', sizeof($root_dirs)) . implode('/', $page_dirs);
// Strip / from the end
if ($dir && substr($dir, -1, 1) == '/')
{
$dir = substr($dir, 0, -1);
}
// Strip / from the beginning
if ($dir && substr($dir, 0, 1) == '/')
{
$dir = substr($dir, 1);
}
$url = str_replace($pathinfo['dirname'] . '/', '', $url);
// Strip / from the beginning
if (substr($url, 0, 1) == '/')
{
$url = substr($url, 1);
}
$url = $dir . '/' . $url;
$url = generate_board_url() . '/' . $url;
}
}
// Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2
if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false)
{
trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
}
// Now, also check the protocol and for a valid url the last time...
$allowed_protocols = array('http', 'https', 'ftp', 'ftps');
$url_parts = parse_url($url);
if ($url_parts === false || empty($url_parts['scheme']) || !in_array($url_parts['scheme'], $allowed_protocols))
{
trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
}
if ($return)
{
return $url;
}
// Redirect via an HTML form for PITA webservers
if (@preg_match('#Microsoft|WebSTAR|Xitami#', getenv('SERVER_SOFTWARE')))
{
header('Refresh: 0; URL=' . $url);
echo '';
echo '';
echo '';
echo '';
echo '';
echo '' . sprintf($user->lang['URL_REDIRECT'], '', '') . '
';
echo '';
echo '';
exit;
}
// Behave as per HTTP/1.1 spec for others
header('Location: ' . $url);
exit;
}
/**
* Re-Apply session id after page reloads
*/
function reapply_sid($url)
{
global $phpEx, $phpbb_root_path;
if ($url === "index.$phpEx")
{
return append_sid("index.$phpEx");
}
else if ($url === "{$phpbb_root_path}index.$phpEx")
{
return append_sid("{$phpbb_root_path}index.$phpEx");
}
// Remove previously added sid
if (strpos($url, '?sid=') !== false)
{
$url = preg_replace('/(\?)sid=[a-z0-9]+(&|&)?/', '\1', $url);
}
else if (strpos($url, '&sid=') !== false)
{
$url = preg_replace('/&sid=[a-z0-9]+(&)?/', '\1', $url);
}
else if (strpos($url, '&sid=') !== false)
{
$url = preg_replace('/&sid=[a-z0-9]+(&)?/', '\1', $url);
}
return append_sid($url);
}
/**
* Returns url from the session/current page with an re-appended SID with optionally stripping vars from the url
*/
function build_url($strip_vars = false)
{
global $user, $phpbb_root_path;
// Append SID
$redirect = append_sid($user->page['page'], false, false);
// Add delimiter if not there...
if (strpos($redirect, '?') === false)
{
$redirect .= '?';
}
// Strip vars...
if ($strip_vars !== false && strpos($redirect, '?') !== false)
{
if (!is_array($strip_vars))
{
$strip_vars = array($strip_vars);
}
$query = $_query = array();
$args = substr($redirect, strpos($redirect, '?') + 1);
$args = ($args) ? explode('&', $args) : array();
$redirect = substr($redirect, 0, strpos($redirect, '?'));
foreach ($args as $argument)
{
$arguments = explode('=', $argument);
$key = $arguments[0];
unset($arguments[0]);
$query[$key] = implode('=', $arguments);
}
// Strip the vars off
foreach ($strip_vars as $strip)
{
if (isset($query[$strip]))
{
unset($query[$strip]);
}
}
// Glue the remaining parts together... already urlencoded
foreach ($query as $key => $value)
{
$_query[] = $key . '=' . $value;
}
$query = implode('&', $_query);
$redirect .= ($query) ? '?' . $query : '';
}
return $phpbb_root_path . str_replace('&', '&', $redirect);
}
/**
* Meta refresh assignment
*/
function meta_refresh($time, $url)
{
global $template;
$url = redirect($url, true);
// For XHTML compatibility we change back & to &
$template->assign_vars(array(
'META' => '')
);
}
//Form validation
/**
* Add a secret token to the form (requires the S_FORM_TOKEN template variable)
* @param string $form_name The name of the form; has to match the name used in check_form_key, otherwise no restrictions apply
*/
function add_form_key($form_name)
{
global $template, $user;
$now = time();
$token = sha1($now . $user->data['user_form_salt'] . $form_name);
$s_fields = build_hidden_fields(array(
'creation_time' => $now,
'form_token' => $token,
));
$template->assign_vars(array(
'S_FORM_TOKEN' => $s_fields,
));
}
/**
* Check the form key. Required for all altering actions not secured by confirm_box
* @param string $form_name The name of the form; has to match the name used in add_form_key, otherwise no restrictions apply
* @param int $timespan The maximum acceptable age for a submitted form in seconds. Defaults to the config setting.
* @param string $return_page The address for the return link
* @param bool $trigger If true, the function will triger an error when encountering an invalid form
* @param int $minimum_time The minimum acceptable age for a submitted form in seconds
*/
function check_form_key($form_name, $timespan = false, $return_page = '', $trigger = false, $miniumum_time = false)
{
global $user, $config;
if ($timespan === false)
{
$timespan = $config['form_token_lifetime'];
}
if ($miniumum_time === false)
{
$miniumum_time = $config['form_token_mintime'];
}
if (isset($_POST['creation_time']) && isset($_POST['form_token']))
{
$creation_time = abs(request_var('creation_time', 0));
$token = request_var('form_token', '');
$diff = (time() - $creation_time);
if (($diff > $miniumum_time) && (($diff < $timespan) || $timespan == -1))
{
$key = sha1($creation_time . $user->data['user_form_salt'] . $form_name);
if ($key === $token)
{
return true;
}
}
}
if ($trigger)
{
trigger_error($user->lang['FORM_INVALID'] . $return_page);
}
return false;
}
// Message/Login boxes
/**
* Build Confirm box
* @param boolean $check True for checking if confirmed (without any additional parameters) and false for displaying the confirm box
* @param string $title Title/Message used for confirm box.
* message text is _CONFIRM appended to title.
* If title cannot be found in user->lang a default one is displayed
* If title_CONFIRM cannot be found in user->lang the text given is used.
* @param string $hidden Hidden variables
* @param string $html_body Template used for confirm box
* @param string $u_action Custom form action
*/
function confirm_box($check, $title = '', $hidden = '', $html_body = 'confirm_body.html', $u_action = '')
{
global $user, $template, $db;
global $phpEx, $phpbb_root_path;
if (isset($_POST['cancel']))
{
return false;
}
$confirm = false;
if (isset($_POST['confirm']))
{
// language frontier
if ($_POST['confirm'] === $user->lang['YES'])
{
$confirm = true;
}
}
if ($check && $confirm)
{
$user_id = request_var('user_id', 0);
$session_id = request_var('sess', '');
$confirm_key = request_var('confirm_key', '');
if ($user_id != $user->data['user_id'] || $session_id != $user->session_id || !$confirm_key || !$user->data['user_last_confirm_key'] || $confirm_key != $user->data['user_last_confirm_key'])
{
return false;
}
// Reset user_last_confirm_key
$sql = 'UPDATE ' . USERS_TABLE . " SET user_last_confirm_key = ''
WHERE user_id = " . $user->data['user_id'];
$db->sql_query($sql);
return true;
}
else if ($check)
{
return false;
}
$s_hidden_fields = build_hidden_fields(array(
'user_id' => $user->data['user_id'],
'sess' => $user->session_id,
'sid' => $user->session_id)
);
// generate activation key
$confirm_key = gen_rand_string(10);
if (defined('IN_ADMIN') && isset($user->data['session_admin']) && $user->data['session_admin'])
{
adm_page_header((!isset($user->lang[$title])) ? $user->lang['CONFIRM'] : $user->lang[$title]);
}
else
{
page_header((!isset($user->lang[$title])) ? $user->lang['CONFIRM'] : $user->lang[$title]);
}
$template->set_filenames(array(
'body' => $html_body)
);
// If activation key already exist, we better do not re-use the key (something very strange is going on...)
if (request_var('confirm_key', ''))
{
// This should not occur, therefore we cancel the operation to safe the user
return false;
}
// re-add sid / transform & to & for user->page (user->page is always using &)
$use_page = ($u_action) ? $phpbb_root_path . $u_action : $phpbb_root_path . str_replace('&', '&', $user->page['page']);
$u_action = reapply_sid($use_page);
$u_action .= ((strpos($u_action, '?') === false) ? '?' : '&') . 'confirm_key=' . $confirm_key;
$template->assign_vars(array(
'MESSAGE_TITLE' => (!isset($user->lang[$title])) ? $user->lang['CONFIRM'] : $user->lang[$title],
'MESSAGE_TEXT' => (!isset($user->lang[$title . '_CONFIRM'])) ? $title : $user->lang[$title . '_CONFIRM'],
'YES_VALUE' => $user->lang['YES'],
'S_CONFIRM_ACTION' => $u_action,
'S_HIDDEN_FIELDS' => $hidden . $s_hidden_fields)
);
$sql = 'UPDATE ' . USERS_TABLE . " SET user_last_confirm_key = '" . $db->sql_escape($confirm_key) . "'
WHERE user_id = " . $user->data['user_id'];
$db->sql_query($sql);
if (defined('IN_ADMIN') && isset($user->data['session_admin']) && $user->data['session_admin'])
{
adm_page_footer();
}
else
{
page_footer();
}
}
/**
* Generate login box or verify password
*/
function login_box($redirect = '', $l_explain = '', $l_success = '', $admin = false, $s_display = true)
{
global $db, $user, $template, $auth, $phpEx, $phpbb_root_path, $config;
$err = '';
// Make sure user->setup() has been called
if (empty($user->lang))
{
$user->setup();
}
// Print out error if user tries to authenticate as an administrator without having the privileges...
if ($admin && !$auth->acl_get('a_'))
{
// Not authd
// anonymous/inactive users are never able to go to the ACP even if they have the relevant permissions
if ($user->data['is_registered'])
{
add_log('admin', 'LOG_ADMIN_AUTH_FAIL');
}
trigger_error('NO_AUTH_ADMIN');
}
if (isset($_POST['login']))
{
$username = request_var('username', '', true);
$password = request_var('password', '', true);
$autologin = (!empty($_POST['autologin'])) ? true : false;
$viewonline = (!empty($_POST['viewonline'])) ? 0 : 1;
$admin = ($admin) ? 1 : 0;
$viewonline = ($admin) ? $user->data['session_viewonline'] : $viewonline;
// Check if the supplied username is equal to the one stored within the database if re-authenticating
if ($admin && utf8_clean_string($username) != utf8_clean_string($user->data['username']))
{
// We log the attempt to use a different username...
add_log('admin', 'LOG_ADMIN_AUTH_FAIL');
trigger_error('NO_AUTH_ADMIN_USER_DIFFER');
}
// If authentication is successful we redirect user to previous page
$result = $auth->login($username, $password, $autologin, $viewonline, $admin);
// If admin authentication and login, we will log if it was a success or not...
// We also break the operation on the first non-success login - it could be argued that the user already knows
if ($admin)
{
if ($result['status'] == LOGIN_SUCCESS)
{
add_log('admin', 'LOG_ADMIN_AUTH_SUCCESS');
}
else
{
// Only log the failed attempt if a real user tried to.
// anonymous/inactive users are never able to go to the ACP even if they have the relevant permissions
if ($user->data['is_registered'])
{
add_log('admin', 'LOG_ADMIN_AUTH_FAIL');
}
}
}
// The result parameter is always an array, holding the relevant information...
if ($result['status'] == LOGIN_SUCCESS)
{
$redirect = request_var('redirect', "{$phpbb_root_path}index.$phpEx");
$message = ($l_success) ? $l_success : $user->lang['LOGIN_REDIRECT'];
$l_redirect = ($admin) ? $user->lang['PROCEED_TO_ACP'] : (($redirect === "{$phpbb_root_path}index.$phpEx" || $redirect === "index.$phpEx") ? $user->lang['RETURN_INDEX'] : $user->lang['RETURN_PAGE']);
// append/replace SID (may change during the session for AOL users)
$redirect = reapply_sid($redirect);
// Special case... the user is effectively banned, but we allow founders to login
if (defined('IN_CHECK_BAN') && $result['user_row']['user_type'] != USER_FOUNDER)
{
return;
}
meta_refresh(3, $redirect);
trigger_error($message . '' . sprintf($l_redirect, '', '')); } // Something failed, determine what... if ($result['status'] == LOGIN_BREAK) { trigger_error($result['error_msg'], E_USER_ERROR); } // Special cases... determine switch ($result['status']) { case LOGIN_ERROR_ATTEMPTS: // Show confirm image $sql = 'DELETE FROM ' . CONFIRM_TABLE . " WHERE session_id = '" . $db->sql_escape($user->session_id) . "' AND confirm_type = " . CONFIRM_LOGIN; $db->sql_query($sql); // Generate code $code = gen_rand_string(mt_rand(5, 8)); $confirm_id = md5(unique_id($user->ip)); $seed = hexdec(substr(unique_id(), 4, 10)); // compute $seed % 0x7fffffff $seed -= 0x7fffffff * floor($seed / 0x7fffffff); $sql = 'INSERT INTO ' . CONFIRM_TABLE . ' ' . $db->sql_build_array('INSERT', array( 'confirm_id' => (string) $confirm_id, 'session_id' => (string) $user->session_id, 'confirm_type' => (int) CONFIRM_LOGIN, 'code' => (string) $code, 'seed' => (int) $seed) ); $db->sql_query($sql); $template->assign_vars(array( 'S_CONFIRM_CODE' => true, 'CONFIRM_ID' => $confirm_id, 'CONFIRM_IMAGE' => '
', "[/*:m:$bbcode_uid]", ":u:$bbcode_uid", ":o:$bbcode_uid", ":$bbcode_uid"); $replace = array("\n", '', '', '', ''); } else { $match = array('
'); $replace = array("\n"); } $message = str_replace($match, $replace, $message); $match = get_preg_expression('bbcode_htm'); $replace = array('\1', '\1', '\2', '\1', '', ''); $message = preg_replace($match, $replace, $message); } /** * Strips all bbcode from a text and returns the plain content */ function strip_bbcode(&$text, $uid = '') { if (!$uid) { $uid = '[0-9a-z]{5,}'; } $text = preg_replace("#\[\/?[a-z0-9\*\+\-]+(?:=(?:".*"|[^\]]*))?(?::[a-z])?(\:$uid)\]#", ' ', $text); $match = get_preg_expression('bbcode_htm'); $replace = array('\1', '\1', '\2', '\1', '', ''); $text = preg_replace($match, $replace, $text); } /** * For display of custom parsed text on user-facing pages * Expects $text to be the value directly from the database (stored value) */ function generate_text_for_display($text, $uid, $bitfield, $flags) { static $bbcode; if (!$text) { return ''; } $text = censor_text($text); // Parse bbcode if bbcode uid stored and bbcode enabled if ($uid && ($flags & OPTION_FLAG_BBCODE)) { if (!class_exists('bbcode')) { global $phpbb_root_path, $phpEx; include($phpbb_root_path . 'includes/bbcode.' . $phpEx); } if (empty($bbcode)) { $bbcode = new bbcode($bitfield); } else { $bbcode->bbcode($bitfield); } $bbcode->bbcode_second_pass($text, $uid); } $text = bbcode_nl2br($text); $text = smiley_text($text, !($flags & OPTION_FLAG_SMILIES)); return $text; } /** * For parsing custom parsed text to be stored within the database. * This function additionally returns the uid and bitfield that needs to be stored. * Expects $text to be the value directly from request_var() and in it's non-parsed form */ function generate_text_for_storage(&$text, &$uid, &$bitfield, &$flags, $allow_bbcode = false, $allow_urls = false, $allow_smilies = false) { global $phpbb_root_path, $phpEx; $uid = $bitfield = ''; if (!$text) { return; } if (!class_exists('parse_message')) { include($phpbb_root_path . 'includes/message_parser.' . $phpEx); } $message_parser = new parse_message($text); $message_parser->parse($allow_bbcode, $allow_urls, $allow_smilies); $text = $message_parser->message; $uid = $message_parser->bbcode_uid; // If the bbcode_bitfield is empty, there is no need for the uid to be stored. if (!$message_parser->bbcode_bitfield) { $uid = ''; } $flags = (($allow_bbcode) ? OPTION_FLAG_BBCODE : 0) + (($allow_smilies) ? OPTION_FLAG_SMILIES : 0) + (($allow_urls) ? OPTION_FLAG_LINKS : 0); $bitfield = $message_parser->bbcode_bitfield; return; } /** * For decoding custom parsed text for edits as well as extracting the flags * Expects $text to be the value directly from the database (pre-parsed content) */ function generate_text_for_edit($text, $uid, $flags) { global $phpbb_root_path, $phpEx; decode_message($text, $uid); return array( 'allow_bbcode' => ($flags & OPTION_FLAG_BBCODE) ? 1 : 0, 'allow_smilies' => ($flags & OPTION_FLAG_SMILIES) ? 1 : 0, 'allow_urls' => ($flags & OPTION_FLAG_LINKS) ? 1 : 0, 'text' => $text ); } /** * A subroutine of make_clickable used with preg_replace * It places correct HTML around an url, shortens the displayed text * and makes sure no entities are inside URLs */ function make_clickable_callback($type, $whitespace, $url, $relative_url, $class) { $append = ''; $url = htmlspecialchars_decode($url); $relative_url = htmlspecialchars_decode($relative_url); // make sure no HTML entities were matched $chars = array('<', '>', '"'); $split = false; foreach ($chars as $char) { $next_split = strpos($url, $char); if ($next_split !== false) { $split = ($split !== false) ? min($split, $next_split) : $next_split; } } if ($split !== false) { // an HTML entity was found, so the URL has to end before it $append = substr($url, $split) . $relative_url; $url = substr($url, 0, $split); $relative_url = ''; } else if ($relative_url) { // same for $relative_url $split = false; foreach ($chars as $char) { $next_split = strpos($relative_url, $char); if ($next_split !== false) { $split = ($split !== false) ? min($split, $next_split) : $next_split; } } if ($split !== false) { $append = substr($relative_url, $split); $relative_url = substr($relative_url, 0, $split); } } // if the last character of the url is a punctuation mark, exclude it from the url $last_char = ($relative_url) ? $relative_url[strlen($relative_url) - 1] : $url[strlen($url) - 1]; switch ($last_char) { case '.': case '?': case '!': case ':': case ',': $append = $last_char; if ($relative_url) { $relative_url = substr($relative_url, 0, -1); } else { $url = substr($url, 0, -1); } break; } switch ($type) { case MAGIC_URL_LOCAL: $tag = 'l'; $relative_url = preg_replace('/[&?]sid=[0-9a-f]{32}$/', '', preg_replace('/([&?])sid=[0-9a-f]{32}&/', '$1', $relative_url)); $url = $url . '/' . $relative_url; $text = ($relative_url) ? $relative_url : $url; break; case MAGIC_URL_FULL: $tag = 'm'; $text = (strlen($url) > 55) ? substr($url, 0, 39) . ' ... ' . substr($url, -10) : $url; break; case MAGIC_URL_WWW: $tag = 'w'; $url = 'http://' . $url; $text = (strlen($url) > 55) ? substr($url, 0, 39) . ' ... ' . substr($url, -10) : $url; break; case MAGIC_URL_EMAIL: $tag = 'e'; $text = (strlen($url) > 55) ? substr($url, 0, 39) . ' ... ' . substr($url, -10) : $url; $url = 'mailto:' . $url; break; } $url = htmlspecialchars($url); $text = htmlspecialchars($text); $append = htmlspecialchars($append); $html = "$whitespace
so now revert that $text = str_replace(array("\n", "\r"), array('
', "\n"), $text); return $text; } /** * Smiley processing */ function smiley_text($text, $force_option = false) { global $config, $user, $phpbb_root_path; if ($force_option || !$config['allow_smilies'] || !$user->optionget('viewsmilies')) { return preg_replace('#
';
$backtrace = debug_backtrace();
$path = phpbb_realpath($phpbb_root_path);
foreach ($backtrace as $number => $trace)
{
// We skip the first one, because it only shows this file/function
if ($number == 0)
{
continue;
}
// Strip the current directory from path
if (empty($trace['file']))
{
$trace['file'] = '';
}
else
{
$trace['file'] = str_replace(array($path, '\\'), array('', '/'), $trace['file']);
$trace['file'] = substr($trace['file'], 1);
}
$args = array();
// If include/require/include_once is not called, do not show arguments - they may contain sensible information
if (!in_array($trace['function'], array('include', 'require', 'include_once')))
{
unset($trace['args']);
}
else
{
// Path...
if (!empty($trace['args'][0]))
{
$argument = htmlspecialchars($trace['args'][0]);
$argument = str_replace(array($path, '\\'), array('', '/'), $argument);
$argument = substr($argument, 1);
$args[] = "'{$argument}'";
}
}
$trace['class'] = (!isset($trace['class'])) ? '' : $trace['class'];
$trace['type'] = (!isset($trace['type'])) ? '' : $trace['type'];
$output .= '
'; $output .= 'FILE: ' . htmlspecialchars($trace['file']) . '
'; $output .= 'LINE: ' . ((!empty($trace['line'])) ? $trace['line'] : '') . '
'; $output .= 'CALL: ' . htmlspecialchars($trace['class'] . $trace['type'] . $trace['function']) . '(' . ((sizeof($args)) ? implode(', ', $args) : '') . ')
'; } $output .= '
';
return $output;
}
/**
* This function returns a regular expression pattern for commonly used expressions
* Use with / as delimiter for email mode and # for url modes
* mode can be: email|bbcode_htm|url|url_inline|www_url|www_url_inline|relative_url|relative_url_inline|ipv4|ipv6
*/
function get_preg_expression($mode)
{
switch ($mode)
{
case 'email':
return '[a-z0-9&\'\.\-_\+]+@[a-z0-9\-]+\.([a-z0-9\-]+\.)*[a-z]+';
break;
case 'bbcode_htm':
return array(
'#.*?#',
'#.*?#',
'#.*?#',
'#'; $output .= 'FILE: ' . htmlspecialchars($trace['file']) . '
'; $output .= 'LINE: ' . ((!empty($trace['line'])) ? $trace['line'] : '') . '
'; $output .= 'CALL: ' . htmlspecialchars($trace['class'] . $trace['type'] . $trace['function']) . '(' . ((sizeof($args)) ? implode(', ', $args) : '') . ')
'; } $output .= '
' . "\n"; } return; break; case E_USER_ERROR: if (!empty($user) && !empty($user->lang)) { $msg_text = (!empty($user->lang[$msg_text])) ? $user->lang[$msg_text] : $msg_text; $msg_title = (!isset($msg_title)) ? $user->lang['GENERAL_ERROR'] : ((!empty($user->lang[$msg_title])) ? $user->lang[$msg_title] : $msg_title); $l_return_index = sprintf($user->lang['RETURN_INDEX'], '', ''); $l_notify = ''; if (!empty($config['board_contact'])) { $l_notify = '
' . sprintf($user->lang['NOTIFY_ADMIN_EMAIL'], $config['board_contact']) . '
'; } } else { $msg_title = 'General Error'; $l_return_index = 'Return to index page'; $l_notify = ''; if (!empty($config['board_contact'])) { $l_notify = 'Please notify the board administrator or webmaster: ' . $config['board_contact'] . '
'; } } garbage_collection(); // Try to not call the adm page data... echo ''; echo ''; echo ''; echo ''; echo '';
echo '
';
echo '';
echo '';
exit_handler();
break;
case E_USER_WARNING:
case E_USER_NOTICE:
define('IN_ERROR_HANDLER', true);
if (empty($user->data))
{
$user->session_begin();
}
// We re-init the auth array to get correct results on login/logout
$auth->acl($user->data);
if (empty($user->lang))
{
$user->setup();
}
$msg_text = (!empty($user->lang[$msg_text])) ? $user->lang[$msg_text] : $msg_text;
$msg_title = (!isset($msg_title)) ? $user->lang['INFORMATION'] : ((!empty($user->lang[$msg_title])) ? $user->lang[$msg_title] : $msg_title);
if (!defined('HEADER_INC'))
{
if (defined('IN_ADMIN') && isset($user->data['session_admin']) && $user->data['session_admin'])
{
adm_page_header($msg_title);
}
else
{
page_header($msg_title);
}
}
$template->set_filenames(array(
'body' => 'message_body.html')
);
$template->assign_vars(array(
'MESSAGE_TITLE' => $msg_title,
'MESSAGE_TEXT' => $msg_text,
'S_USER_WARNING' => ($errno == E_USER_WARNING) ? true : false,
'S_USER_NOTICE' => ($errno == E_USER_NOTICE) ? true : false)
);
// We do not want the cron script to be called on error messages
define('IN_CRON', true);
if (defined('IN_ADMIN') && isset($user->data['session_admin']) && $user->data['session_admin'])
{
adm_page_footer();
}
else
{
page_footer();
}
exit_handler();
break;
}
// If we notice an error not handled here we pass this back to PHP by returning false
// This may not work for all php versions
return false;
}
/**
* Generate page header
*/
function page_header($page_title = '', $display_online_list = true)
{
global $db, $config, $template, $SID, $_SID, $user, $auth, $phpEx, $phpbb_root_path;
if (defined('HEADER_INC'))
{
return;
}
define('HEADER_INC', true);
// gzip_compression
if ($config['gzip_compress'])
{
if (@extension_loaded('zlib') && !headers_sent())
{
ob_start('ob_gzhandler');
}
}
// Generate logged in/logged out status
if ($user->data['user_id'] != ANONYMOUS)
{
$u_login_logout = append_sid("{$phpbb_root_path}ucp.$phpEx", 'mode=logout', true, $user->session_id);
$l_login_logout = sprintf($user->lang['LOGOUT_USER'], $user->data['username']);
}
else
{
$u_login_logout = append_sid("{$phpbb_root_path}ucp.$phpEx", 'mode=login');
$l_login_logout = $user->lang['LOGIN'];
}
// Last visit date/time
$s_last_visit = ($user->data['user_id'] != ANONYMOUS) ? $user->format_date($user->data['session_last_visit']) : '';
// Get users online list ... if required
$l_online_users = $online_userlist = $l_online_record = '';
if ($config['load_online'] && $config['load_online_time'] && $display_online_list)
{
$logged_visible_online = $logged_hidden_online = $guests_online = $prev_user_id = 0;
$prev_session_ip = $reading_sql = '';
if (!empty($_REQUEST['f']))
{
$f = request_var('f', 0);
$reading_sql = ' AND s.session_page ' . $db->sql_like_expression("{$db->any_char}_f_={$f}x{$db->any_char}");
}
// Get number of online guests
if (!$config['load_online_guests'])
{
if ($db->sql_layer === 'sqlite')
{
$sql = 'SELECT COUNT(session_ip) as num_guests
FROM (
SELECT DISTINCT s.session_ip
FROM ' . SESSIONS_TABLE . ' s
WHERE s.session_user_id = ' . ANONYMOUS . '
AND s.session_time >= ' . (time() - ($config['load_online_time'] * 60)) .
$reading_sql .
')';
}
else
{
$sql = 'SELECT COUNT(DISTINCT s.session_ip) as num_guests
FROM ' . SESSIONS_TABLE . ' s
WHERE s.session_user_id = ' . ANONYMOUS . '
AND s.session_time >= ' . (time() - ($config['load_online_time'] * 60)) .
$reading_sql;
}
$result = $db->sql_query($sql);
$guests_online = (int) $db->sql_fetchfield('num_guests');
$db->sql_freeresult($result);
}
$sql = 'SELECT u.username, u.username_clean, u.user_id, u.user_type, u.user_allow_viewonline, u.user_colour, s.session_ip, s.session_viewonline
FROM ' . USERS_TABLE . ' u, ' . SESSIONS_TABLE . ' s
WHERE s.session_time >= ' . (time() - (intval($config['load_online_time']) * 60)) .
$reading_sql .
((!$config['load_online_guests']) ? ' AND s.session_user_id <> ' . ANONYMOUS : '') . '
AND u.user_id = s.session_user_id
ORDER BY u.username_clean ASC, s.session_ip ASC';
$result = $db->sql_query($sql);
while ($row = $db->sql_fetchrow($result))
{
// User is logged in and therefore not a guest
if ($row['user_id'] != ANONYMOUS)
{
// Skip multiple sessions for one user
if ($row['user_id'] != $prev_user_id)
{
if ($row['user_colour'])
{
$user_colour = ' style="color:#' . $row['user_colour'] . '"';
$row['username'] = '' . $row['username'] . '';
}
else
{
$user_colour = '';
}
if ($row['session_viewonline'])
{
$user_online_link = $row['username'];
$logged_visible_online++;
}
else
{
$user_online_link = '' . $row['username'] . '';
$logged_hidden_online++;
}
if (($row['session_viewonline']) || $auth->acl_get('u_viewonline'))
{
if ($row['user_type'] <> USER_IGNORE)
{
$user_online_link = '' . $user_online_link . '';
}
else
{
$user_online_link = ($user_colour) ? '';
echo ' ' . $l_return_index;
echo '
';
echo ' ';
echo '
';
echo ' ';
echo '';
echo '
';
echo ' ';
echo '
';
echo '