API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Oct 31st, 2014
204
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 32.22 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. /*-------------------------------------------------------+
  3. | PHP-Fusion Content Management System
  4. | Copyright (C) PHP-Fusion Inc
  5. | https://www.php-fusion.co.uk/
  6. +--------------------------------------------------------+
  7. | Filename: maincore.php
  8. | Author: Nick Jones (Digitanium)
  9. +--------------------------------------------------------+
  10. | This program is released as free software under the
  11. | Affero GPL license. You can redistribute it and/or
  12. | modify it under the terms of this license which you
  13. | can read by viewing the included agpl.txt or online
  14. | at www.gnu.org/licenses/agpl.html. Removal of this
  15. | copyright header is strictly prohibited without
  16. | written permission from the original author(s).
  17. +--------------------------------------------------------*/
  18. if (preg_match("/maincore.php/i", $_SERVER['PHP_SELF'])) { die(); }
  19.  
  20. // Calculate script start/end time
  21. function get_microtime() {
  22. list($usec, $sec) = explode(" ", microtime());
  23. return ((float)$usec + (float)$sec);
  24. }
  25.  
  26. // Define script start time
  27. define("START_TIME", get_microtime());
  28. define("IN_FUSION", TRUE);
  29.  
  30. // Prevent any possible XSS attacks via $_GET.
  31. if (stripget($_GET)) {
  32. die("Prevented a XSS attack through a GET variable!");
  33. }
  34.  
  35. // Locate config.php and set the basedir path
  36. $folder_level = ""; $i = 0;
  37. while (!file_exists($folder_level."config.php")) {
  38. $folder_level .= "../"; $i++;
  39. if ($i == 7) { die("config.php file not found"); }
  40. }
  41. define("BASEDIR", $folder_level);
  42.  
  43. require_once BASEDIR."config.php";
  44.  
  45. // If config.php is empty, activate setup.php script
  46. if (!isset($db_name)) { redirect("setup.php"); }
  47.  
  48. require_once BASEDIR."includes/multisite_include.php";
  49.  
  50. // Checking file types of the uploaded file with known mime types list to prevent uploading unwanted files
  51. if(isset($_FILES) && count($_FILES)) {
  52. require_once BASEDIR.'includes/mimetypes_include.php';
  53. $mime_types = mimeTypes();
  54. foreach($_FILES as $each) {
  55. if(isset($each['name']) && strlen($each['tmp_name'])) {
  56. $file_info = pathinfo($each['name']);
  57. $extension = $file_info['extension'];
  58. if(array_key_exists($extension, $mime_types)) {
  59. //An extension may have more than one mime type
  60. if(is_array($mime_types[$extension])) {
  61. //We should check each extension one by one
  62. $valid_mimetype = false;
  63. foreach($mime_types[$extension] as $each_mimetype) {
  64. //If we have a match, we set the value to true and break the loop
  65. if($each_mimetype==$each['type']) {
  66. $valid_mimetype = true;
  67. break;
  68. }
  69. }
  70.  
  71. if(!$valid_mimetype) {
  72. die('Prevented an unwanted file upload attempt!');
  73. }
  74. unset($valid_mimetype);
  75. } else {
  76. if($mime_types[$extension]!=$each['type']) {
  77. die('Prevented an unwanted file upload attempt!');
  78. }
  79. }
  80. } /*else { //Let's disable this for now
  81. //almost impossible with provided array, but we throw an error anyways
  82. die('Unknown file type');
  83. }*/
  84. unset($file_info,$extension);
  85. }
  86. }
  87. unset($mime_types);
  88. }
  89.  
  90. // Establish mySQL database connection
  91. $link = dbconnect($db_host, $db_user, $db_pass, $db_name);
  92. unset($db_host, $db_user, $db_pass);
  93.  
  94. // Fetch the settings from the database
  95. $settings = array();
  96. $result = dbquery("SELECT * FROM ".DB_SETTINGS);
  97. if (dbrows($result)) {
  98. while ($data = dbarray($result)) {
  99. $settings[$data['settings_name']] = $data['settings_value'];
  100. }
  101. } else {
  102. die("Settings do not exist, please check your config.php file or run setup.php again.");
  103. }
  104.  
  105. // Settings dependent functions
  106. date_default_timezone_set($settings['default_timezone']);
  107. //ob_start("ob_gzhandler"); //Uncomment this line and comment the one below to enable output compression.
  108. ob_start();
  109.  
  110. // Sanitise $_SERVER globals
  111. $_SERVER['PHP_SELF'] = cleanurl($_SERVER['PHP_SELF']);
  112. $_SERVER['QUERY_STRING'] = isset($_SERVER['QUERY_STRING']) ? cleanurl($_SERVER['QUERY_STRING']) : "";
  113. $_SERVER['REQUEST_URI'] = isset($_SERVER['REQUEST_URI']) ? cleanurl($_SERVER['REQUEST_URI']) : "";
  114. $PHP_SELF = cleanurl($_SERVER['PHP_SELF']);
  115.  
  116. // Common definitions
  117. define("FUSION_REQUEST", isset($_SERVER['REQUEST_URI']) && $_SERVER['REQUEST_URI'] != "" ? $_SERVER['REQUEST_URI'] : $_SERVER['SCRIPT_NAME']);
  118. define("FUSION_QUERY", isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : "");
  119. define("FUSION_SELF", basename($_SERVER['PHP_SELF']));
  120. define("FUSION_IP", $_SERVER['REMOTE_ADDR']);
  121. define("QUOTES_GPC", (ini_get('magic_quotes_gpc') ? TRUE : FALSE));
  122.  
  123. // Path definitions
  124. define("ADMIN", BASEDIR."administration/");
  125. define("CLASSES", BASEDIR."includes/classes/");
  126. define("DOWNLOADS", BASEDIR."downloads/");
  127. define("IMAGES", BASEDIR."images/");
  128. define("IMAGES_A", IMAGES."articles/");
  129. define("IMAGES_N", IMAGES."news/");
  130. define("IMAGES_N_T", IMAGES."news/thumbs/");
  131. define("IMAGES_NC", IMAGES."news_cats/");
  132. define("RANKS", IMAGES."ranks/");
  133. define("INCLUDES", BASEDIR."includes/");
  134. define("LOCALE", BASEDIR."locale/");
  135. define("LOCALESET", $settings['locale']."/");
  136. define("FORUM", BASEDIR."forum/");
  137. define("INFUSIONS", BASEDIR."infusions/");
  138. define("PHOTOS", IMAGES."photoalbum/");
  139. define("THEMES", BASEDIR."themes/");
  140.  
  141. // Variables initializing
  142. $mysql_queries_count = 0;
  143. $mysql_queries_time = array();
  144. $smiley_cache = "";
  145. $bbcode_cache = "";
  146. $groups_cache = "";
  147. $forum_rank_cache = "";
  148. $forum_mod_rank_cache = "";
  149. $locale = array();
  150.  
  151. // Calculate current true url
  152. $script_url = explode("/", $_SERVER['PHP_SELF']);
  153. $url_count = count($script_url);
  154. $base_url_count = substr_count(BASEDIR, "/") + 1;
  155. $current_page = "";
  156. while ($base_url_count != 0) {
  157. $current = $url_count - $base_url_count;
  158. $current_page .= "/".$script_url[$current];
  159. $base_url_count--;
  160. }
  161.  
  162. define("TRUE_PHP_SELF", $current_page);
  163. define("START_PAGE", substr(preg_replace("#(&amp;|\?)(s_action=edit&amp;shout_id=)([0-9]+)#s", "", TRUE_PHP_SELF.(FUSION_QUERY ? "?".FUSION_QUERY : "")), 1));
  164.  
  165. // IP address functions
  166. include BASEDIR."includes/ip_handling_include.php";
  167.  
  168. // Error Handling
  169. require_once BASEDIR."includes/error_handling_include.php";
  170.  
  171. // Redirects to the index if the URL is invalid (eg. file.php/folder/)
  172. if ($_SERVER['SCRIPT_NAME'] != $_SERVER['PHP_SELF']) { redirect($settings['siteurl']); }
  173.  
  174. // Load the Global language file
  175. include LOCALE.LOCALESET."global.php";
  176.  
  177. // Autenticate user
  178. require_once CLASSES."Authenticate.class.php";
  179.  
  180. // Log in user
  181. if (isset($_POST['login']) && isset($_POST['user_name']) && isset($_POST['user_pass'])) {
  182. $auth = new Authenticate($_POST['user_name'], $_POST['user_pass'], (isset($_POST['remember_me']) ? true : false));
  183. $userdata = $auth->getUserData();
  184. unset($auth, $_POST['user_name'], $_POST['user_pass']);
  185. } elseif (isset($_GET['logout']) && $_GET['logout'] == "yes") {
  186. $userdata = Authenticate::logOut();
  187. redirect(BASEDIR."index.php");
  188. } else {
  189. $userdata = Authenticate::validateAuthUser();
  190. }
  191.  
  192. // User level, Admin Rights & User Group definitions
  193. define("iGUEST", $userdata['user_level'] == 0 ? 1 : 0);
  194. define("iMEMBER", $userdata['user_level'] >= 101 ? 1 : 0);
  195. define("iADMIN", $userdata['user_level'] >= 102 ? 1 : 0);
  196. define("iSUPERADMIN", $userdata['user_level'] == 103 ? 1 : 0);
  197. define("iUSER", $userdata['user_level']);
  198. define("iUSER_RIGHTS", $userdata['user_rights']);
  199. define("iUSER_GROUPS", substr($userdata['user_groups'], 1));
  200.  
  201. if (iADMIN) {
  202. define("iAUTH", substr(md5($userdata['user_password'].USER_IP), 16, 16));
  203. $aidlink = "?aid=".iAUTH;
  204. }
  205.  
  206. // PHP-Fusion user cookie functions
  207. if (!isset($_COOKIE[COOKIE_PREFIX.'visited'])) {
  208. $result = dbquery("UPDATE ".DB_SETTINGS." SET settings_value=settings_value+1 WHERE settings_name='counter'");
  209. setcookie(COOKIE_PREFIX."visited", "yes", time() + 31536000, "/", "", "0");
  210. }
  211. $lastvisited = Authenticate::setLastVisitCookie();
  212.  
  213. // MySQL database functions
  214. function dbquery($query) {
  215. global $mysql_queries_count, $mysql_queries_time; $mysql_queries_count++;
  216.  
  217. $query_time = get_microtime();
  218. $result = @mysql_query($query);
  219. $query_time = substr((get_microtime() - $query_time),0,7);
  220.  
  221. $mysql_queries_time[$mysql_queries_count] = array($query_time, $query);
  222.  
  223. if (!$result) {
  224. echo mysql_error();
  225. return false;
  226. } else {
  227. return $result;
  228. }
  229. }
  230.  
  231. function dbcount($field, $table, $conditions = "") {
  232. global $mysql_queries_count, $mysql_queries_time; $mysql_queries_count++;
  233.  
  234. $cond = ($conditions ? " WHERE ".$conditions : "");
  235. $query_time = get_microtime();
  236. $result = @mysql_query("SELECT Count".$field." FROM ".$table.$cond);
  237. $query_time = substr((get_microtime() - $query_time),0,7);
  238.  
  239. $mysql_queries_time[$mysql_queries_count] = array($query_time, "SELECT COUNT".$field." FROM ".$table.$cond);
  240.  
  241. if (!$result) {
  242. echo mysql_error();
  243. return false;
  244. } else {
  245. $rows = mysql_result($result, 0);
  246. return $rows;
  247. }
  248. }
  249.  
  250. function dbresult($query, $row) {
  251. global $mysql_queries_count, $mysql_queries_time;
  252.  
  253. $query_time = get_microtime();
  254. $result = @mysql_result($query, $row);
  255. $query_time = substr((get_microtime() - $query_time),0,7);
  256.  
  257. $mysql_queries_time[$mysql_queries_count] = array($query_time, $query);
  258.  
  259. if (!$result) {
  260. echo mysql_error();
  261. return false;
  262. } else {
  263. return $result;
  264. }
  265. }
  266.  
  267. function dbrows($query) {
  268. $result = @mysql_num_rows($query);
  269. return $result;
  270. }
  271.  
  272. function dbarray($query) {
  273. $result = @mysql_fetch_assoc($query);
  274. if (!$result) {
  275. echo mysql_error();
  276. return false;
  277. } else {
  278. return $result;
  279. }
  280. }
  281.  
  282. function dbarraynum($query) {
  283. $result = @mysql_fetch_row($query);
  284. if (!$result) {
  285. echo mysql_error();
  286. return false;
  287. } else {
  288. return $result;
  289. }
  290. }
  291.  
  292. function dbconnect($db_host, $db_user, $db_pass, $db_name) {
  293. global $db_connect;
  294.  
  295. $db_connect = @mysql_connect($db_host, $db_user, $db_pass);
  296. $db_select = @mysql_select_db($db_name);
  297. if (!$db_connect) {
  298. die("<strong>Unable to establish connection to MySQL</strong><br />".mysql_errno()." : ".mysql_error());
  299. } elseif (!$db_select) {
  300. die("<strong>Unable to select MySQL database</strong><br />".mysql_errno()." : ".mysql_error());
  301. }
  302. }
  303.  
  304. // Set theme
  305. set_theme($userdata['user_theme']);
  306.  
  307. // Check if a given theme exists and is valid
  308. function theme_exists($theme) {
  309. global $settings;
  310.  
  311. if ($theme == "Default") { $theme = $settings['theme']; }
  312. if (!file_exists(THEMES) || !is_dir(THEMES) || !is_string($theme) || !preg_match("/^([a-z0-9_-]){2,50}$/i", $theme) || !file_exists(THEMES.$theme)) {
  313. return false;
  314. } elseif (file_exists(THEMES.$theme."/theme.php") && file_exists(THEMES.$theme."/styles.css")) {
  315. return true;
  316. } else {
  317. return false;
  318. }
  319. }
  320.  
  321. // Set a valid theme
  322. function set_theme($theme) {
  323. global $settings, $locale;
  324.  
  325. if (!defined("THEME")) {
  326. // If the theme is valid set it
  327. if (theme_exists($theme)) {
  328. define("THEME", THEMES.($theme == "Default" ? $settings['theme'] : $theme)."/");
  329. // The theme is invalid, search for a valid one inside themes folder and set it
  330. } else {
  331. $dh = opendir(THEMES);
  332. while (false !== ($entry = readdir($dh))) {
  333. if ($entry != "." && $entry != ".." && is_dir(THEMES.$entry)) {
  334. if (theme_exists($entry)) {
  335. define("THEME", THEMES.$entry."/");
  336. break;
  337. }
  338. }
  339. }
  340. closedir($dh);
  341. }
  342. // If can't find and set any valid theme show a warning
  343. if (!defined("THEME")) {
  344. echo "<strong>".$theme." - ".$locale['global_300'].".</strong><br /><br />\n";
  345. echo $locale['global_301'];
  346. die();
  347. }
  348. }
  349. }
  350.  
  351. // Set the admin password when needed
  352. function set_admin_pass($password) {
  353.  
  354. Authenticate::setAdminCookie($password);
  355.  
  356. }
  357.  
  358. // Check if admin password matches userdata
  359. function check_admin_pass($password) {
  360.  
  361. return Authenticate::validateAuthAdmin($password);
  362.  
  363. }
  364.  
  365. // Redirect browser using header or script function
  366. function redirect($location, $script = false) {
  367. if (!$script) {
  368. header("Location: ".str_replace("&amp;", "&", $location));
  369. exit;
  370. } else {
  371. echo "<script type='text/javascript'>document.location.href='".str_replace("&amp;", "&", $location)."'</script>\n";
  372. exit;
  373. }
  374. }
  375.  
  376. // Clean URL Function, prevents entities in server globals
  377. function cleanurl($url) {
  378. $bad_entities = array("&", "\"", "'", '\"', "\'", "<", ">", "(", ")", "*");
  379. $safe_entities = array("&amp;", "", "", "", "", "", "", "", "", "");
  380. $url = str_replace($bad_entities, $safe_entities, $url);
  381. return $url;
  382. }
  383.  
  384. // Strip Input Function, prevents HTML in unwanted places
  385. function stripinput($text) {
  386. if (!is_array($text)) {
  387. $text = stripslash(trim($text));
  388. $text = preg_replace("/(&amp;)+(?=\#([0-9]{2,3});)/i", "&", $text);
  389. $search = array("&", "\"", "'", "\\", '\"', "\'", "<", ">", "&nbsp;");
  390. $replace = array("&amp;", "&quot;", "&#39;", "&#92;", "&quot;", "&#39;", "&lt;", "&gt;", " ");
  391. $text = str_replace($search, $replace, $text);
  392. } else {
  393. foreach ($text as $key => $value) {
  394. $text[$key] = stripinput($value);
  395. }
  396. }
  397. return $text;
  398. }
  399.  
  400. // Prevent any possible XSS attacks via $_GET.
  401. function stripget($check_url) {
  402. $return = false;
  403. if (is_array($check_url)) {
  404. foreach ($check_url as $value) {
  405. if (stripget($value) == true) {
  406. return true;
  407. }
  408. }
  409. } else {
  410. $check_url = str_replace(array("\"", "\'"), array("", ""), urldecode($check_url));
  411. if (preg_match("/<[^<>]+>/i", $check_url)) {
  412. return true;
  413. }
  414. }
  415. return $return;
  416. }
  417.  
  418. // Strip file name
  419. function stripfilename($filename) {
  420. $filename = strtolower(str_replace(" ", "_", $filename));
  421. $filename = preg_replace("/[^a-zA-Z0-9_-]/", "", $filename);
  422. $filename = preg_replace("/^\W/", "", $filename);
  423. $filename = preg_replace('/([_-])\1+/', '$1', $filename);
  424. if ($filename == "") { $filename = time(); }
  425.  
  426. return $filename;
  427. }
  428.  
  429. // Strip Slash Function, only stripslashes if magic_quotes_gpc is on
  430. function stripslash($text) {
  431. if (QUOTES_GPC) { $text = stripslashes($text); }
  432. return $text;
  433. }
  434.  
  435. // Add Slash Function, add correct number of slashes depending on quotes_gpc
  436. function addslash($text) {
  437. if (!QUOTES_GPC) {
  438. $text = addslashes(addslashes($text));
  439. } else {
  440. $text = addslashes($text);
  441. }
  442. return $text;
  443. }
  444.  
  445. // htmlentities is too agressive so we use this function
  446. function phpentities($text) {
  447. $search = array("&", "\"", "'", "\\", "<", ">");
  448. $replace = array("&amp;", "&quot;", "&#39;", "&#92;", "&lt;", "&gt;");
  449. $text = str_replace($search, $replace, $text);
  450. return $text;
  451. }
  452.  
  453. // Trim a line of text to a preferred length
  454. function trimlink($text, $length) {
  455. $dec = array("&", "\"", "'", "\\", '\"', "\'", "<", ">");
  456. $enc = array("&amp;", "&quot;", "&#39;", "&#92;", "&quot;", "&#39;", "&lt;", "&gt;");
  457. $text = str_replace($enc, $dec, $text);
  458. if (strlen($text) > $length) $text = substr($text, 0, ($length-3))."...";
  459. $text = str_replace($dec, $enc, $text);
  460. return $text;
  461. }
  462.  
  463. // Validate numeric input
  464. function isnum($value) {
  465. if (!is_array($value)) {
  466. return (preg_match("/^[0-9]+$/", $value));
  467. } else {
  468. return false;
  469. }
  470. }
  471.  
  472. // Custom preg-match function
  473. function preg_check($expression, $value) {
  474. if (!is_array($value)) {
  475. return preg_match($expression, $value);
  476. } else {
  477. return false;
  478. }
  479. }
  480.  
  481. // Cache smileys mysql
  482. function cache_smileys() {
  483. global $smiley_cache;
  484. $result = dbquery("SELECT smiley_code, smiley_image, smiley_text FROM ".DB_SMILEYS);
  485. if (dbrows($result)) {
  486. $smiley_cache = array();
  487. while ($data = dbarray($result)) {
  488. $smiley_cache[] = array(
  489. "smiley_code" => $data['smiley_code'],
  490. "smiley_image" => $data['smiley_image'],
  491. "smiley_text" => $data['smiley_text']
  492. );
  493. }
  494. } else {
  495. $smiley_cache = array();
  496. }
  497. }
  498.  
  499. // Parse smiley bbcode
  500. function parsesmileys($message) {
  501. global $smiley_cache;
  502. if (!preg_match("#(\[code\](.*?)\[/code\]|\[geshi=(.*?)\](.*?)\[/geshi\]|\[php\](.*?)\[/php\])#si", $message)) {
  503. if (!$smiley_cache) { cache_smileys(); }
  504. if (is_array($smiley_cache) && count($smiley_cache)) {
  505. foreach ($smiley_cache as $smiley) {
  506. $smiley_code = preg_quote($smiley['smiley_code'], '#');
  507. $smiley_image = "<img src='".get_image("smiley_".$smiley['smiley_text'])."' alt='".$smiley['smiley_text']."' style='vertical-align:middle;' />";
  508. $message = preg_replace("#{$smiley_code}#si", $smiley_image, $message);
  509. }
  510. }
  511. }
  512. return $message;
  513. }
  514.  
  515. // Show smiley icons in comments, forum and other post pages
  516. function displaysmileys($textarea, $form = "inputform") {
  517. global $smiley_cache;
  518. $smileys = ""; $i = 0;
  519. if (!$smiley_cache) { cache_smileys(); }
  520. if (is_array($smiley_cache) && count($smiley_cache)) {
  521. foreach ($smiley_cache as $smiley) {
  522. if ($i != 0 && ($i % 10 == 0)) { $smileys .= "<br />\n"; $i++; }
  523. $smileys .= "<img src='".get_image("smiley_".$smiley['smiley_text'])."' alt='".$smiley['smiley_text']."' onclick=\"insertText('".$textarea."', '".$smiley['smiley_code']."', '".$form."');\" />\n";
  524. }
  525. }
  526. return $smileys;
  527. }
  528.  
  529. // Cache bbcode mysql
  530. function cache_bbcode() {
  531. global $bbcode_cache;
  532. $result = dbquery("SELECT bbcode_name FROM ".DB_BBCODES." ORDER BY bbcode_order ASC");
  533. if (dbrows($result)) {
  534. $bbcode_cache = array();
  535. while ($data = dbarray($result)) {
  536. $bbcode_cache[] = $data['bbcode_name'];
  537. }
  538. } else {
  539. $bbcode_cache = array();
  540. }
  541. }
  542.  
  543. // Parse bbcode
  544. function parseubb($text, $selected = false) {
  545. global $bbcode_cache;
  546. if (!$bbcode_cache) { cache_bbcode(); }
  547. if (is_array($bbcode_cache) && count($bbcode_cache)) {
  548. if ($selected) { $sel_bbcodes = explode("|", $selected); }
  549. foreach ($bbcode_cache as $bbcode) {
  550. if ($selected && in_array($bbcode, $sel_bbcodes)) {
  551. if (file_exists(INCLUDES."bbcodes/".$bbcode."_bbcode_include.php")) {
  552. if (file_exists(LOCALE.LOCALESET."bbcodes/".$bbcode.".php")) {
  553. include (LOCALE.LOCALESET."bbcodes/".$bbcode.".php");
  554. } elseif (file_exists(LOCALE."English/bbcodes/".$bbcode.".php")) {
  555. include (LOCALE."English/bbcodes/".$bbcode.".php");
  556. }
  557. include (INCLUDES."bbcodes/".$bbcode."_bbcode_include.php");
  558. }
  559. } elseif (!$selected) {
  560. if (file_exists(INCLUDES."bbcodes/".$bbcode."_bbcode_include.php")) {
  561. if (file_exists(LOCALE.LOCALESET."bbcodes/".$bbcode.".php")) {
  562. include (LOCALE.LOCALESET."bbcodes/".$bbcode.".php");
  563. } elseif (file_exists(LOCALE."English/bbcodes/".$bbcode.".php")) {
  564. include (LOCALE."English/bbcodes/".$bbcode.".php");
  565. }
  566. include (INCLUDES."bbcodes/".$bbcode."_bbcode_include.php");
  567. }
  568. }
  569. }
  570. }
  571. $text = descript($text, false);
  572. return $text;
  573. }
  574.  
  575. // Javascript email encoder by Tyler Akins
  576. // http://rumkin.com/tools/mailto_encoder/
  577. function hide_email($email, $title = "", $subject = "") {
  578. if (strpos($email, "@")) {
  579. $parts = explode("@", $email);
  580. $MailLink = "<a href='mailto:".$parts[0]."@".$parts[1];
  581. if ($subject != "") { $MailLink .= "?subject=".urlencode($subject); }
  582. $MailLink .= "'>".($title?$title:$parts[0]."@".$parts[1])."</a>";
  583. $MailLetters = "";
  584. for ($i = 0; $i < strlen($MailLink); $i++) {
  585. $l = substr($MailLink, $i, 1);
  586. if (strpos($MailLetters, $l) === false) {
  587. $p = rand(0, strlen($MailLetters));
  588. $MailLetters = substr($MailLetters, 0, $p).$l.substr($MailLetters, $p, strlen($MailLetters));
  589. }
  590. }
  591. $MailLettersEnc = str_replace("\\", "\\\\", $MailLetters);
  592. $MailLettersEnc = str_replace("\"", "\\\"", $MailLettersEnc);
  593. $MailIndexes = "";
  594. for ($i = 0; $i < strlen($MailLink); $i ++) {
  595. $index = strpos($MailLetters, substr($MailLink, $i, 1));
  596. $index += 48;
  597. $MailIndexes .= chr($index);
  598. }
  599. $MailIndexes = str_replace("\\", "\\\\", $MailIndexes);
  600. $MailIndexes = str_replace("\"", "\\\"", $MailIndexes);
  601.  
  602. $res = "<script type='text/javascript'>";
  603. $res .= "/*<![CDATA[*/";
  604. $res .= "ML=\"".str_replace("<", "xxxx", $MailLettersEnc)."\";";
  605. $res .= "MI=\"".str_replace("<", "xxxx", $MailIndexes)."\";";
  606. $res .= "ML=ML.replace(/xxxx/g, '<');";
  607. $res .= "MI=MI.replace(/xxxx/g, '<');"; $res .= "OT=\"\";";
  608. $res .= "for(j=0;j < MI.length;j++){";
  609. $res .= "OT+=ML.charAt(MI.charCodeAt(j)-48);";
  610. $res .= "}document.write(OT);";
  611. $res .= "/*]]>*/";
  612. $res .= "</script>";
  613.  
  614. return $res;
  615. } else {
  616. return $email;
  617. }
  618. }
  619.  
  620. // Format spaces and tabs in code bb tags
  621. function formatcode($text) {
  622. $text = str_replace(" ", "&nbsp; ", $text);
  623. $text = str_replace(" ", " &nbsp;", $text);
  624. $text = str_replace("\t", "&nbsp; &nbsp;", $text);
  625. $text = preg_replace("/^ {1}/m", "&nbsp;", $text);
  626. return $text;
  627. }
  628.  
  629. // Highlights given words in subject
  630. // Don't forget to remove later
  631. function highlight_words($word, $subject) {
  632. for($i = 0, $l = count($word); $i < $l; $i++) {
  633. $word[$i] = str_replace(array("\\", "+", "*", "?", "[", "^", "]", "$", "(", ")", "{", "}", "=", "!", "<", ">", "|", ":", "#", "-", "_"), "", $word[$i]);
  634. if (!empty($word[$i])) {
  635. $subject = preg_replace("#($word[$i])(?![^<]*>)#i", "<span style='background-color:yellow;color:#333;font-weight:bold;padding-left:2px;padding-right:2px'>\${1}</span>", $subject);
  636. }
  637. }
  638. return $subject;
  639. }
  640.  
  641.  
  642. // This function sanitises news & article submissions
  643. function descript($text, $striptags = true) {
  644. // Convert problematic ascii characters to their true values
  645. $search = array("40","41","58","65","66","67","68","69","70",
  646. "71","72","73","74","75","76","77","78","79","80","81",
  647. "82","83","84","85","86","87","88","89","90","97","98",
  648. "99","100","101","102","103","104","105","106","107",
  649. "108","109","110","111","112","113","114","115","116",
  650. "117","118","119","120","121","122"
  651. );
  652. $replace = array("(",")",":","a","b","c","d","e","f","g","h",
  653. "i","j","k","l","m","n","o","p","q","r","s","t","u",
  654. "v","w","x","y","z","a","b","c","d","e","f","g","h",
  655. "i","j","k","l","m","n","o","p","q","r","s","t","u",
  656. "v","w","x","y","z"
  657. );
  658. $entities = count($search);
  659. for ($i=0; $i < $entities; $i++) {
  660. $text = preg_replace("#(&\#)(0*".$search[$i]."+);*#si", $replace[$i], $text);
  661. }
  662. $text = preg_replace('#(&\#x)([0-9A-F]+);*#si', "", $text);
  663. $text = preg_replace('#(<[^>]+[/\"\'\s])(onmouseover|onmousedown|onmouseup|onmouseout|onmousemove|onclick|ondblclick|onfocus|onload|xmlns)[^>]*>#iU', ">", $text);
  664. $text = preg_replace('#([a-z]*)=([\`\'\"]*)script:#iU', '$1=$2nojscript...', $text);
  665. $text = preg_replace('#([a-z]*)=([\`\'\"]*)javascript:#iU', '$1=$2nojavascript...', $text);
  666. $text = preg_replace('#([a-z]*)=([\'\"]*)vbscript:#iU', '$1=$2novbscript...', $text);
  667. $text = preg_replace('#(<[^>]+)style=([\`\'\"]*).*expression\([^>]*>#iU', "$1>", $text);
  668. $text = preg_replace('#(<[^>]+)style=([\`\'\"]*).*behaviour\([^>]*>#iU', "$1>", $text);
  669. if ($striptags) {
  670. do {
  671. $thistext = $text;
  672. $text = preg_replace('#</*(applet|meta|xml|blink|link|style|script|embed|object|iframe|frame|frameset|ilayer|layer|bgsound|title|base)[^>]*>#i', "", $text);
  673. } while ($thistext != $text);
  674. }
  675. return $text;
  676. }
  677.  
  678. // Scan image files for malicious code
  679. function verify_image($file) {
  680. $txt = file_get_contents($file);
  681. $image_safe = true;
  682. if (preg_match('#<?php#i', $txt)) { $image_safe = false; } //edit
  683. elseif (preg_match('#&(quot|lt|gt|nbsp|<?php);#i', $txt)) { $image_safe = false; }
  684. elseif (preg_match("#&\#x([0-9a-f]+);#i", $txt)) { $image_safe = false; }
  685. elseif (preg_match('#&\#([0-9]+);#i', $txt)) { $image_safe = false; }
  686. elseif (preg_match("#([a-z]*)=([\`\'\"]*)script:#iU", $txt)) { $image_safe = false; }
  687. elseif (preg_match("#([a-z]*)=([\`\'\"]*)javascript:#iU", $txt)) { $image_safe = false; }
  688. elseif (preg_match("#([a-z]*)=([\'\"]*)vbscript:#iU", $txt)) { $image_safe = false; }
  689. elseif (preg_match("#(<[^>]+)style=([\`\'\"]*).*expression\([^>]*>#iU", $txt)) { $image_safe = false; }
  690. elseif (preg_match("#(<[^>]+)style=([\`\'\"]*).*behaviour\([^>]*>#iU", $txt)) { $image_safe = false; }
  691. elseif (preg_match("#</*(applet|link|style|script|iframe|frame|frameset)[^>]*>#i", $txt)) { $image_safe = false; }
  692. return $image_safe;
  693. }
  694.  
  695. // Replace offensive words with the defined replacement word
  696. function censorwords($text) {
  697. global $settings;
  698. if ($settings['bad_words_enabled'] == "1" && $settings['bad_words'] != "" ) {
  699. $word_list = explode("\r\n", $settings['bad_words']);
  700. for ($i=0; $i < count($word_list); $i++) {
  701. if ($word_list[$i] != "") $text = preg_replace("/".$word_list[$i]."/si", $settings['bad_word_replace'], $text);
  702. }
  703. }
  704. return $text;
  705. }
  706.  
  707. // Display the user's level
  708. function getuserlevel($userlevel) {
  709. global $locale;
  710. if ($userlevel == 101) { return $locale['user1'];
  711. } elseif ($userlevel == 102) { return $locale['user2'];
  712. } elseif ($userlevel == 103) { return $locale['user3']; }
  713. }
  714.  
  715. // Display the user's status
  716. function getuserstatus($userstatus) {
  717. global $locale;
  718. if ($userstatus == 0) { return $locale['status0'];
  719. } elseif ($userstatus == 1) { return $locale['status1'];
  720. } elseif ($userstatus == 2) { return $locale['status2'];
  721. } elseif ($userstatus == 3) { return $locale['status3'];
  722. } elseif ($userstatus == 4) { return $locale['status4'];
  723. } elseif ($userstatus == 5) { return $locale['status5'];
  724. } elseif ($userstatus == 6) { return $locale['status6'];
  725. } elseif ($userstatus == 7) { return $locale['status7'];
  726. } elseif ($userstatus == 8) { return $locale['status8']; }
  727. }
  728.  
  729. // Check if Administrator has correct rights assigned
  730. function checkrights($right) {
  731. if (iADMIN && in_array($right, explode(".", iUSER_RIGHTS))) {
  732. return true;
  733. } else {
  734. return false;
  735. }
  736. }
  737.  
  738. function checkAdminPageAccess($right) {
  739. if (!checkrights($right) || !defined("iAUTH") || !isset($_GET['aid']) || $_GET['aid'] != iAUTH) {
  740. return false;
  741. } else {
  742. return true;
  743. }
  744. }
  745.  
  746. // Check if user is assigned to the specified user group
  747. function checkgroup($group) {
  748. if (iSUPERADMIN) { return true; }
  749. elseif (iADMIN && ($group == "0" || $group == "101" || $group == "102")) { return true;
  750. } elseif (iMEMBER && ($group == "0" || $group == "101")) { return true;
  751. } elseif (iGUEST && $group == "0") { return true;
  752. } elseif (iMEMBER && $group && in_array($group, explode(".", iUSER_GROUPS))) {
  753. return true;
  754. } else {
  755. return false;
  756. }
  757. }
  758.  
  759. // Cache groups mysql
  760. function cache_groups() {
  761. global $groups_cache;
  762. $result = dbquery("SELECT * FROM ".DB_USER_GROUPS." ORDER BY group_id ASC");
  763. if (dbrows($result)) {
  764. $groups_cache = array();
  765. while ($data = dbarray($result)) {
  766. $groups_cache[] = $data;
  767. }
  768. } else {
  769. $groups_cache = array();
  770. }
  771. }
  772.  
  773. // Compile access levels & user group array
  774. function getusergroups() {
  775. global $locale, $groups_cache;
  776. $groups_array = array(
  777. array("0", $locale['user0']),
  778. array("101", $locale['user1']),
  779. array("102", $locale['user2']),
  780. array("103", $locale['user3'])
  781. );
  782. if (!$groups_cache) { cache_groups(); }
  783. if (is_array($groups_cache) && count($groups_cache)) {
  784. foreach ($groups_cache as $group) {
  785. array_push($groups_array, array($group['group_id'], $group['group_name']));
  786. }
  787. }
  788. return $groups_array;
  789. }
  790.  
  791. // Get the name of the access level or user group
  792. function getgroupname($group_id, $return_desc = false) {
  793. global $locale, $groups_cache;
  794. if ($group_id == "0") { return $locale['user0'];
  795. } elseif ($group_id == "101") { return $locale['user1']; exit;
  796. } elseif ($group_id == "102") { return $locale['user2']; exit;
  797. } elseif ($group_id == "103") { return $locale['user3']; exit;
  798. } else {
  799. if (!$groups_cache) { cache_groups(); }
  800. if (is_array($groups_cache) && count($groups_cache)) {
  801. foreach ($groups_cache as $group) {
  802. if ($group_id == $group['group_id']) { return ($return_desc ? ($group['group_description'] ? $group['group_description'] : '-') : $group['group_name']); exit; }
  803. }
  804. }
  805. }
  806. return $locale['user_na'];
  807. }
  808.  
  809. // Getting the access levels used when asking the database for data
  810. function groupaccess($field) {
  811. if (iGUEST) { return "$field = '0'";
  812. } elseif (iSUPERADMIN) { return "1 = 1";
  813. } elseif (iADMIN) { $res = "($field='0' OR $field='101' OR $field='102'";
  814. } elseif (iMEMBER) { $res = "($field='0' OR $field='101'";
  815. }
  816. if (iUSER_GROUPS != "" && !iSUPERADMIN) { $res .= " OR $field='".str_replace(".", "' OR $field='", iUSER_GROUPS)."'"; }
  817. $res .= ")";
  818. return $res;
  819. }
  820.  
  821. // Create a list of files or folders and store them in an array
  822. // You may filter out extensions by adding them to $extfilter as:
  823. // $ext_filter = "gif|jpg"
  824. function makefilelist($folder, $filter, $sort = true, $type = "files", $ext_filter = "") {
  825. $res = array();
  826. $filter = explode("|", $filter);
  827. if ($type == "files" && !empty($ext_filter)) {
  828. $ext_filter = explode("|", strtolower($ext_filter));
  829. }
  830. $temp = opendir($folder);
  831. while ($file = readdir($temp)) {
  832. if ($type == "files" && !in_array($file, $filter)) {
  833. if (!empty($ext_filter)) {
  834. if (!in_array(substr(strtolower(stristr($file, '.')), +1), $ext_filter) && !is_dir($folder.$file)) { $res[] = $file; }
  835. } else {
  836. if (!is_dir($folder.$file)) { $res[] = $file; }
  837. }
  838. } elseif ($type == "folders" && !in_array($file, $filter)) {
  839. if (is_dir($folder.$file)) { $res[] = $file; }
  840. }
  841. }
  842. closedir($temp);
  843. if ($sort) { sort($res); }
  844. return $res;
  845. }
  846.  
  847. // Create a selection list from an array created by makefilelist()
  848. function makefileopts($files, $selected = "") {
  849. $res = "";
  850. for ($i = 0; $i < count($files); $i++) {
  851. $sel = ($selected == $files[$i] ? " selected='selected'" : "");
  852. $res .= "<option value='".$files[$i]."'$sel>".$files[$i]."</option>\n";
  853. }
  854. return $res;
  855. }
  856.  
  857. // Making Page Navigation
  858. function makepagenav($start, $count, $total, $range = 0, $link = "", $getname = "rowstart") {
  859. global $locale;
  860.  
  861. if ($link == "") { $link = FUSION_SELF."?"; }
  862. if (!preg_match("#[0-9]+#", $count) || $count == 0) return false;
  863.  
  864. $pg_cnt = ceil($total / $count);
  865. if ($pg_cnt <= 1) { return ""; }
  866.  
  867. $idx_back = $start - $count;
  868. $idx_next = $start + $count;
  869. $cur_page = ceil(($start + 1) / $count);
  870.  
  871. $res = $locale['global_092']." ".$cur_page.$locale['global_093'].$pg_cnt.": ";
  872. if ($idx_back >= 0) {
  873. if ($cur_page > ($range + 1)) {
  874. $res .= "<a href='".$link.$getname."=0'>1</a>";
  875. if ($cur_page != ($range + 2)) {
  876. $res .= "...";
  877. }
  878. }
  879. }
  880. $idx_fst = max($cur_page - $range, 1);
  881. $idx_lst = min($cur_page + $range, $pg_cnt);
  882. if ($range == 0) {
  883. $idx_fst = 1;
  884. $idx_lst = $pg_cnt;
  885. }
  886. for ($i = $idx_fst; $i <= $idx_lst; $i++) {
  887. $offset_page = ($i - 1) * $count;
  888. if ($i == $cur_page) {
  889. $res .= "<span><strong>".$i."</strong></span>";
  890. } else {
  891. $res .= "<a href='".$link.$getname."=".$offset_page."'>".$i."</a>";
  892. }
  893. }
  894. if ($idx_next < $total) {
  895. if ($cur_page < ($pg_cnt - $range)) {
  896. if ($cur_page != ($pg_cnt - $range - 1)) {
  897. $res .= "...";
  898. }
  899. $res .= "<a href='".$link.$getname."=".($pg_cnt - 1) * $count."'>".$pg_cnt."</a>\n";
  900. }
  901. }
  902.  
  903. return "<div class='pagenav'>\n".$res."</div>\n";
  904. }
  905.  
  906. // Format the date & time accordingly
  907. function showdate($format, $val) {
  908. global $settings, $userdata;
  909.  
  910. if (isset($userdata['user_offset'])) {
  911. $offset = $userdata['user_offset']+$settings['serveroffset'];
  912. } else {
  913. $offset = $settings['timeoffset']+$settings['serveroffset'];
  914. }
  915. if ($format == "shortdate" || $format == "longdate" || $format == "forumdate" || $format == "newsdate") {
  916. return strftime($settings[$format], $val + ($offset * 3600));
  917. } else {
  918. return strftime($format, $val + ($offset * 3600));
  919. }
  920. }
  921.  
  922. // Translate bytes into kB, MB, GB or TB by CrappoMan, lelebart fix
  923. function parsebytesize($size, $digits = 2, $dir = false) {
  924. global $locale;
  925. $kb = 1024; $mb = 1024 * $kb; $gb= 1024 * $mb; $tb = 1024 * $gb;
  926. if (($size == 0) && ($dir)) { return $locale['global_460']; }
  927. elseif ($size < $kb) { return $size.$locale['global_461']; }
  928. elseif ($size < $mb) { return round($size / $kb,$digits).$locale['global_462']; }
  929. elseif ($size < $gb) { return round($size / $mb,$digits).$locale['global_463']; }
  930. elseif ($size < $tb) { return round($size / $gb,$digits).$locale['global_464']; }
  931. else { return round($size / $tb, $digits).$locale['global_465']; }
  932. }
  933.  
  934. // User profile link
  935. function profile_link($user_id, $user_name, $user_status, $class = "profile-link") {
  936. global $locale, $settings;
  937.  
  938. $class = ($class ? " class='$class'" : "");
  939.  
  940. if ((in_array($user_status, array(0, 3, 7)) || checkrights("M")) && (iMEMBER || $settings['hide_userprofiles'] == "0")) {
  941. $link = "<a href='".BASEDIR."profile.php?lookup=".$user_id."'".$class.">".$user_name."</a>";
  942. } elseif ($user_status == "5" || $user_status == "6") {
  943. $link = $locale['user_anonymous'];
  944. } else {
  945. $link = $user_name;
  946. }
  947.  
  948. return $link;
  949. }
  950.  
  951. include INCLUDES."system_images.php";
  952. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!