<?php

/*
	[DISCUZ!] pm.php - user to user(personal messages)
	This is NOT a freeware, use is subject to license terms
 
	Version: 4.0.0
	Web: http://www.comsenz.com
	Copyright: 2001-2005 Comsenz Technology Ltd.
	Last Modified: 2003/10/10 05:51
*/

require_once './include/common.inc.php';
require_once DISCUZ_ROOT.'./include/discuzcode.func.php';

@include DISCUZ_ROOT.'./forumdata/cache/cache_bbcodes.php';

$discuz_action = 101;

if(empty($discuz_uid)) {
	showmessage('not_loggedin', NULL, 'HALTED');
} elseif($maxpmnum == 0) {
	showmessage('group_nopermission', NULL, 'NOPERM');
}

$query1 = $db->query("SELECT COUNT(*) FROM {$tablepre}pms WHERE msgfromid='$discuz_uid' AND folder='outbox'");
$query2 = $db->query("SELECT COUNT(*) FROM {$tablepre}pms WHERE msgtoid='$discuz_uid' AND folder='inbox'");
$pm_total = $db->result($query1, 0) + $db->result($query2, 0);

@$storage_percent = round((100 * $pm_total / $maxpmnum) + 1).'%';

if(empty($action)) {

	$page = !ispage($page) ? 1 : $page;
	$start_limit = ($page - 1) * $tpp;

	if($folder == 'outbox') {
		$query = $db->query("SELECT COUNT(*) FROM {$tablepre}pms WHERE msgfromid='$discuz_uid' AND folder='outbox'");
		$pmnum = $db->result($query, 0);
		$query = $db->query("SELECT p.*, m.username AS msgto FROM {$tablepre}pms p
					LEFT JOIN {$tablepre}members m ON m.uid=p.msgtoid
					WHERE msgfromid='$discuz_uid' AND folder='outbox'
					ORDER BY p.dateline DESC LIMIT $start_limit, $tpp");
	} elseif($folder == 'track') {
		$query = $db->query("SELECT COUNT(*) FROM {$tablepre}pms WHERE msgfromid='$discuz_uid' AND folder='inbox'");
		$pmnum = $db->result($query, 0);
		$query = $db->query("SELECT p.*, m.username AS msgto FROM {$tablepre}pms p
					LEFT JOIN {$tablepre}members m ON m.uid=p.msgtoid
					WHERE msgfromid='$discuz_uid' AND folder='inbox'
					ORDER BY p.dateline DESC LIMIT $start_limit, $tpp");
	} else {
		$folder = 'inbox';
		$query = $db->query("SELECT COUNT(*) FROM {$tablepre}pms WHERE msgtoid='$discuz_uid' AND folder='inbox'");
		$pmnum = $db->result($query, 0);
		$query = $db->query("SELECT * FROM {$tablepre}pms WHERE msgtoid='$discuz_uid' AND folder='inbox' ORDER BY dateline DESC LIMIT $start_limit, $tpp");
	}

	$multipage = multi($pmnum, $tpp, $page, "pm.php?folder=$folder");

	$pmlist = array();
	while($pm = $db->fetch_array($query)) {
		$pm['dateline'] = gmdate("$dateformat $timeformat", $pm['dateline'] + $timeoffset * 3600);
		$pm['subject'] = $pm['new'] ? "<b>$pm[subject]</b>" : $pm['subject'];
		$pmlist[] = $pm;
	}

} elseif($action == 'view') {

	if($pm_total > $maxpmnum) {
		showmessage('pm_box_isfull', 'pm.php');
	}

	$codecount = 0;

	$query = $db->query("SELECT p.*, m.username AS msgto FROM {$tablepre}pms p
				LEFT JOIN {$tablepre}members m ON m.uid=p.msgtoid
				WHERE pmid='$pmid' AND (msgtoid='$discuz_uid' OR msgfromid='$discuz_uid')");
	if(!$pm = $db->fetch_array($query)) {
		showmessage('pm_nonexistence');
	}

	if($pm['new'] && !($pm['msgfromid'] == $discuz_uid && $pm['msgtoid'] != $discuz_uid && $pm['folder'] == 'inbox')) {
		$db->query("UPDATE {$tablepre}pms SET new='0' WHERE pmid='$pmid'");
	}

	$folder = $folder == 'track' ? $folder : $pm['folder'];

	$pm['dateline'] = gmdate("$dateformat $timeformat", $pm['dateline'] + $timeoffset * 3600);
	$pm['message'] = discuzcode($pm['message'], 0, 0);

} elseif($action == 'send') {

	if(!$adminid && $newbiespan && (!$lastpost || $timestamp - $lastpost < $newbiespan * 3600)) {
		$query = $db->query("SELECT regdate FROM {$tablepre}members WHERE uid='$discuz_uid'");
		if($timestamp - ($db->result($query, 0)) < $newbiespan * 3600) {
			showmessage('pm_newbie_span');
		}
	}

	if($pm_total > $maxpmnum) {
		showmessage('pm_box_isfull', 'pm.php');
	}

	$subject = dhtmlspecialchars(censor($subject));
	$message = trim(censor(parseurl($message)));

	if(!submitcheck('pmsubmit')) {

		$buddylist = array();
		$query = $db->query("SELECT b.buddyid, m.username AS buddyname FROM {$tablepre}buddys b
					LEFT JOIN {$tablepre}members m ON m.uid=b.buddyid
					WHERE b.uid='$discuz_uid'");
		while($buddy = $db->fetch_array($query)) {
			$buddylist[] = $buddy;
		}

		$subject = $message = '';

		if($pmid) {
			$query = $db->query("SELECT * FROM {$tablepre}pms WHERE pmid='$pmid' AND msgtoid='$discuz_uid'");
			$pm = $db->fetch_array($query);

			$pm['subject'] = $message = preg_replace("/^(Re:|Fw:)\s*/", "", $pm['subject']);
			$username = $pm['msgfrom'];

			if($do == 'reply') {
				$subject = "Re: $pm[subject]";
				$message = '[quote]'.dhtmlspecialchars(trim(preg_replace("/(\[quote])(.*)(\[\/quote])/siU", '', $pm['message']))).'[/quote]'."\n";
				$touser = $pm['msgfrom'];
			} elseif($do == 'forward') {
				$subject = "Fw: $pm[subject]";
				$message = '[quote]'.dhtmlspecialchars($pm['message']).'[/quote]'."\n";
				$touser = $pm['msgfrom'];
			}
		} elseif($uid) {
			$query = $db->query("SELECT username FROM {$tablepre}members WHERE uid='$uid'");
			$touser = dhtmlspecialchars($db->result($query, 0));
		} else {
			$touser = dhtmlspecialchars($touser);
		}

	} else {

		$floodctrl = $floodctrl * 2;
		if($floodctrl && !$disablepostctrl && $timestamp - $lastpost < $floodctrl) {
			showmessage('pm_flood_ctrl');
		}

		if(empty($msgto)) {
			$msgto = array_merge($msgtobuddys, NULL);
		} else {
			$msgtoid = 0;
			$query = $db->query("SELECT uid, username FROM {$tablepre}members WHERE username='$msgto'");
			while($member = $db->fetch_array($query)) {
				if(addslashes($member['username']) == $msgto) {
					$msgtoid = $member['uid'];
					break;
				}
			}

			if(!$msgtoid) {
				showmessage('pm_send_nonexistence');
			}

			if(is_array($msgtobuddys)) {
				$msgto = array_merge($msgtobuddys, array($msgtoid));
			} else {
				$msgto = array($msgtoid);
			}
		}

		$subject = cutstr(trim($subject), 75);
		$msgto_count = count($msgto);
		$maxpmsend = ceil($maxpmnum / 10);
		if($msgto_count > $maxpmsend) {
			showmessage('pm_send_toomany');
		}
		if(!$msgto_count || !$subject) {
			showmessage('pm_send_invalid');
		}

		$uids = $comma = '';
		foreach($msgto as $uid) {
			$uids .= $comma.$uid;
			$comma = ',';
		}

		$ignorenum = 0;
		$query = $db->query("SELECT m.username, mf.ignorepm FROM {$tablepre}members m
			LEFT JOIN {$tablepre}memberfields mf USING(uid)
			WHERE m.uid IN ($uids)");

		if($db->num_rows($query) != $msgto_count) {
			showmessage('undefined_action');
		}
		while($member = $db->fetch_array($query)) {
			if(preg_match("/(^{ALL}$|(,|^)\s*".preg_quote($discuz_user, '/')."\s*(,|$))/i", $member['ignorepm'])) {
				showmessage('pm_send_ignore');
			}
		}
		
		foreach($msgto as $uid) {
			$db->query("INSERT INTO {$tablepre}pms (msgfrom, msgfromid, msgtoid, folder, new, subject, dateline, message)
				VALUES('$discuz_user', '$discuz_uid', '$uid', 'inbox', '1', '$subject', '$timestamp', '$message')");
		}
		$db->query("UPDATE {$tablepre}members SET newpm='1' WHERE uid IN ($uids)", 'UNBUFFERED');

		if($floodctrl) {
			$db->query("UPDATE {$tablepre}members SET lastpost='$timestamp' WHERE uid='$discuz_uid'");
		}

		if($saveoutbox) {
			$db->query("INSERT INTO {$tablepre}pms (msgfrom, msgfromid, msgtoid, folder, new, subject, dateline, message)
				VALUES('$discuz_user', '$discuz_uid', '$msgto[0]', 'outbox', '1', '$subject', '$timestamp', '$message')");
		}
		showmessage('pm_send_succeed', 'pm.php');
	}

} elseif($action == 'delete') {

	$msg_field = $folder == 'inbox' ? 'msgtoid' : 'msgfromid';
	if(!$pmid) {
		if(is_array($delete)) {
			$pmids = $comma = '';
			foreach($delete as $pmid) {
				$pmids .= "$comma'$pmid'";
				$comma = ',';
			}
			$db->query("DELETE FROM {$tablepre}pms WHERE $msg_field='$discuz_uid' AND pmid IN ($pmids)");
		}
	} else {
		$db->query("DELETE FROM {$tablepre}pms WHERE $msg_field='$discuz_uid' AND pmid='$pmid'");
	}

	showmessage('pm_delete_succeed', "pm.php?folder=$folder");

} elseif($action == 'markunread' && !empty($pmid)) {

	$db->query("UPDATE {$tablepre}pms SET new='2' WHERE pmid='$pmid' AND msgtoid='$discuz_uid'");
	showmessage('pm_mark_unread_succeed', "pm.php?folder=$folder");

} elseif($action == 'download' && !empty($pmid)) {

	$query = $db->query("SELECT * FROM {$tablepre}pms WHERE pmid='$pmid' AND (msgtoid='$discuz_uid' OR msgfromid='$discuz_uid')");
	if(!$pm = $db->fetch_array($query)) {
		showmessage('pm_nonexistence');
	}
	$pm['dateline'] = gmdate("$dateformat $timeformat", $pm['dateline'] + $timeoffset * 3600);

	$export = "Discuz! Private Message Export\n\n".
		"Date:\t\t$pm[dateline]\n".
		"From:\t\t$pm[msgfrom]\n".
		"To:\t\t$pm[msgto]\n".
		"Subject:\t$pm[subject]\n\n".
		"$pm[message]\n\n\n".
		"Welcome to $bbname ($boardurl)";

	ob_end_clean();
	header('Content-Encoding: none');
	header('Content-Type: '.(strpos($HTTP_SERVER_VARS['HTTP_USER_AGENT'], 'MSIE') ? 'application/octetstream' : 'application/octet-stream'));	header('Content-Disposition: '.(strpos($HTTP_SERVER_VARS['HTTP_USER_AGENT'], 'MSIE') ? 'inline; ' : 'attachment; ').'filename="pm_'.$discuz_user.'_'.$pmid.'.txt"');	header('Content-Length: '.strlen($export));
	header('Pragma: no-cache');	header('Expires: 0');

	echo $export;
	dexit();

} elseif($action == 'ignore') {

	if(!submitcheck('ignoresubmit')) {
		$query = $db->query("SELECT ignorepm FROM {$tablepre}memberfields WHERE uid='$discuz_uid'");
		$ignorepm = $db->result($query, 0);
	} else {
		$db->query("UPDATE {$tablepre}memberfields SET ignorepm='$ignorelist' WHERE uid='$discuz_uid'");
		showmessage('pm_ignore_succeed', 'pm.php');
	}

}

include template('pm');

?>