<?php

@( (bool)FALSE === strpos( $_SERVER['REQUEST_URI'], basename( __FILE__ ) ) ) OR exit( '!! ACCESS DENIED !!' );
error_reporting( _E_VALUE );


/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | myPHPNuke Version 188_8 RC2                                          |
// +----------------------------------------------------------------------+
// | License: GNU/GPL - http://www.gnu.org/copyleft/gpl.html              |
// +----------------------------------------------------------------------+
// | Support: http://myphpnuke.com/                                       |
// +----------------------------------------------------------------------+
// | Author: myPHPNuke Dev Team                                           |
// +----------------------------------------------------------------------+
// | Copyright: © 2001-2004 myPHPNuke Dev Team                            |
// +----------------------------------------------------------------------+
// $Id: email_user.php,v 1.16.2.10 2004/08/23 15:56:34 kirilt Exp $


/* DISPLAY DEFAULT ADMIN SCREEN */
function email_user()
{
    global $mpnTables, $mpn_anonymous_id, $sitename, $adminmail;

    $subject = translate("Newsletter from ") . $sitename;
    OpenTable();
    echo '<form action="admin.php?fct=emailuser" method="post">';
    echo '<table align = "center">';
    echo '<tr>';
    echo '<td><strong>' . translate("Email Users") . '</strong></td><td>&nbsp;</td><td>&nbsp;</td>';
    echo '</tr>';
    echo '<tr>';
    echo '<td>&nbsp;</td><td>' . translate('Username') . '</td><td>';
    echo '<select name="username[]" multiple size="15">';

    $result = mysql_query('SELECT uid, uname FROM ' . $mpnTables['users'] . " WHERE uid > 1 ORDER BY uname");
    $c = 0;
    while(list($uid, $uname) = mysql_fetch_row($result))
    {
        echo '<option value = "' . $uid . '"';
        if ($c == 0)
        {
            echo ' selected';
        }

        echo '>' . $uname;
        $c++;
    }

    unset($c);
    echo '</select></td>';
    echo '</tr>';
    echo '<tr>';
    echo '<td>&nbsp;</td><td>' . translate('Reply-to Address') . "</td><td><input type=\"text\" size=\"28\" name=\"from\" value=\"" . $adminmail . "\"></td>";
    echo '</tr>';
    echo '<tr>';
    echo '<td>&nbsp;</td><td>' . translate('Send Newsletter') . "</td><td><input type=\"checkbox\" name=\"newsletter\" value=\"1\"></td>";
    echo '</tr>';
    echo '<tr>';
    echo '<td>&nbsp;</td><td>' . translate('HTML Formatted') . '</td><td><input type="checkbox" name="html" value="1" checked>&nbsp;&nbsp;&nbsp;';
    echo '<a href="./admin.php?fct=emailuser&op=html_options">' . translate('HTML Options') . '</a></td>';
    echo '</tr>';
    echo '<tr>';
    echo '<td>&nbsp;</td><td>' . translate('Subject') . "</td><td><input type=\"text\" size=\"50\" name=\"subject\" value=\"". stripslashes($subject) . "\"></td>";
    echo '</tr>';
    echo '<tr>';
// 2004-3-22 - AvW: Remove the wrap attribute as it doesn't belong to the HTML 4.01 standard and it disturbs the text flow.
    echo '<td>&nbsp;</td><td>' . translate('Message') . '</td>';
    echo '<td><textarea cols="55" rows="12" name="message"></textarea>';
    echo '<br />' . addFormatOption() . '</td>' . "\n";
    echo '</tr>';
    echo '<tr>';
    echo '<td>&nbsp;</td><td>&nbsp;</td><td>';

    // Kiril: New Sanitizer

    echo "<input type='hidden' name='clickit_form' value='message' />\n";
    echo "<input type='hidden' name='stripit_form' value='from|subject' />\n";
    echo "<input type='hidden' name='mpn_sectype' value='1' />\n";

    // End Sanitizer

    echo '<input class="button" type="submit" name="op" value="' . translate('Send') . '">';
    echo '&nbsp;<input class="button" type="submit" name="op" value="' . translate('Preview') . '"></td>';
    echo '</tr>';
    echo '</table>';
    echo '</form>';
    CloseTable();
}


/* HERE IS WHERE THE MAIL GETS PROCESSED */

function send_email_to_user($username, $from, $subject, $message, $newsletter, $html) {
    global $sitename, $adminmail, $storyhome, $smtp, $mpn_webmaster_name, $mpnTables;
    global $mpn_anonymous_id, $mailmethod, $topicname;

    // IF WE HAVE NO USERS TO SEND MAIL TO, WHATS THE SENSE

    $username = $_POST['username'];

    if (!is_array($username))
    {
        goBack( translate("You didn't select a user") );
    }

    // SORT THE ARRAY TO MAKE THE DATABASE FETCH EASIER
    sort($username, SORT_NUMERIC);

    require_once('./class.phpmailer.php');
    $mail = new phpmailer();

    /* SET THE METHOD OF HOW MAIL GETS SENT */
    if ($mailmethod == "0") {
        $mail->IsMail();
    } else {
        $mail->IsSMTP();
        $mail->Host = $smtp;
        $mail->SMTPKeepAlive = true;
    }

    // TURN ON HTML HERE IF IT WAS CHECKED IN THE FORM



    if (isset($html))
    {
        $mail->IsHTML(true);
        include_once('./admin/emailuser/html.inc.php');

        $sanity_ary = compact( 'css_link', 'html_header' );
        $_SERVER['SAN'] -> slashIT( $sanity_ary );
        extract( $sanity_ary );

        $_SERVER['SAN'] -> adjustFormat( $html_header, 3, 10 );
    }

    $email_list   = array();
    $text_content = null;
    $html_content = null;

    // CREATE SQL TO RETRIEVE EMAIL ADDRESSES
    $sql = 'SELECT name, uname, email FROM ' . $mpnTables['users'] . " WHERE uid > 1 AND (";

    $loop = false;

    foreach($username as $value)
    {
        if ($loop === true)
        {
            $sql .= ' OR ';
        }

        $sql .= "uid = $value";

        $loop = true;
    }

    $sql .= ')';

    if (isset($newsletter) && $newsletter == '1')
    {
        $sql .= ' AND allowemail = 1';
    }


    $result = mysql_query($sql);

    // COLLECT ARRAY OF EMAIL ADDRESSES
    while ($data = mysql_fetch_row($result))
    {
        if ($data[0] == '')
        {
            $data[0] = $data[1];
        }

        $email_list[] = array('name' => $data[0], 'email' => $data[2]);
    }

    // OK, PREPARE THE EMAIL BODY

    // PREPARE HTML CONTENT



    if (isset($html))
    {
        $html_content .= '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">' . "\n";
        $html_content .= '<html>' . "\n";
        $html_content .= '<head>' . "\n";
        $html_content .= '<title>' . translate("Newsletter") .'</title>' . "\n";

        // STYLE SHEET HERE

        $html_content .= '<link rel="stylesheet" href="' . $css_link . '" type="text/css">' ."\n";

        $html_content .= '</head>' . "\n";
        $html_content .= '<body>' . "\n";

        // HTML HEADER HERE

        $html_content .= $html_header . "\n";

        $message1 = $message;
        $_SERVER['SAN'] -> adjustFormat( $message1, 3, 10 );

        if (isset($message1) && $message1 != '')
        {
            $html_content .= $message1 . '<br><hr>' . "\n";
        }
    }

    // PREPARE NON HTML CONTENT
    if (isset($message) && $message != '')
    {
        // REFERENCE: sanitize( $content, $type = NULL, $auto_close = NULL, $strip = NULL, $tag_list = NULL, $legacy = FALSE )

        $_SERVER['SAN'] -> sanitize( $message, 5, TRUE, array(), array( TRUE ) );
        $_SERVER['SAN'] -> adjustFormat( $message, 3, 10 );

        $message .= "\n=======================================================\n\n";

        $text_content .= $message . "\n";
    }


    // FETCH NEWS ARTICLES (IF NEEDED)

    if (isset($newsletter) && $newsletter == '1')
    {
        $sql  = 'SELECT s.sid, s.title, s.hometext, s.topic, s.time, t.topicimage FROM ';
        $sql .= $mpnTables['stories'] . ' s, ' . $mpnTables['topics'] . ' t ';
        $sql .= "WHERE s.topic = t.topicid ORDER BY s.sid DESC LIMIT $storyhome";
        $result = mysql_query($sql);

        while (list($sid, $title, $hometext, $topic, $time, $topicimage) = mysql_fetch_row($result))
        {
            $sanity_ary = compact( 'title', 'hometext', 'topic', 'topicimage' );
            $_SERVER['SAN'] -> slashIT( $sanity_ary );
            extract( $sanity_ary );

            if ( $_SERVER['F_LIB'] -> checkPostDate( $time ) )
            {
                $_SERVER['SAN'] -> sanitizeLegacyContent( $hometext );
            }
            else
            {
                $_SERVER['SAN'] -> adjustFormat( $hometext, 3, 10 );
            }

            // PREPARE HTML CONTENT
            if (isset($html))
            {
                $html_content .= '<a href="' . _MPN_ROOT_URI . 'search.php?query=&topic=' . $topic . '"><img src="' . _MPN_ROOT_URI . 'images/topics/' . $topicimage . '" width="50" height="50" border="0"></a><br><br>';
                $html_content .= $title . '<br>' . "\n";
                $html_content .= $hometext . '<br>' . "\n";
                $html_content .= '&nbsp;&nbsp;-- <a href="' . _MPN_ROOT_URI . 'article.php?sid=' . $sid . '">' . translate("Read More") . '</a>' . "\n";
                $html_content .= '<hr><br>' . "\n";
            }

            // PREPARE NON HTML CONTENT

            $_SERVER['SAN'] -> sanitize( $hometext, 5, TRUE, array(), array( TRUE ) );

            $text_content .= $topicname . "\n\n";
            $text_content .= $title . "\n";
            $text_content .= $hometext . "\n";
            $text_content .= _MPN_ROOT_URI . 'article.php?sid=' . $sid . "\n";
            $text_content .= '=================================================' . "\n\n";
        }
    }

    // PREPARE HTML CONTENT
    if (isset($html))
    {
        $html_content .= "</body>\n</html>";
    }

    // LETS SEND THE EMAIL(S)
    if (!isset($from) || $from == '')
    {
        $from = $adminmail;
    }

    $mail->From     = $from;
    $mail->FromName = stripslashes($mpn_webmaster_name);

    $mail->Subject = $subject;

    if (isset($html))
    {
        $mail->Body    = trim( $html_content );
        $mail->AltBody = trim( $text_content );
    }
    else
    {
        $mail->Body = trim( $text_content );
    }

    foreach($email_list as $value)
    {
        $mail->AddAddress($value['email'], $value['name']);
        if (!$mail->Send())
        {
            goBack( translate('Mail Send Error') . $mail->ErrorInfo);
        }

        $mail->ClearAddresses();
    }

    if ($mailmethod == "1")
    {
        $mail->SmtpClose();
    }

    header('location: admin.php?fct=emailuser');
}

/* HTML MAIL OPTIONS HERE */
function html_options()
{
    if (isset($_POST['submit']))
    {
        $css_link = '$css_link = "' . $_POST['css_link'] . '";';
        $html_header = '$html_header = "' . $_POST['html_header'] . '";';

        $file_content  = '<?php' . "\n";
        $file_content .= require './admin/configs_header.php';
        $file_content .= $css_link . "\n" . $html_header . "\n\n";
        $file_content .= '?>';

        $filename = 'admin/emailuser/html.inc.php';

        if ( ! $_SERVER['F_LIB'] -> writeFile( $filename, 'w+b', $file_content ) )
        {
            goBack( translate( 'File Write Error.  Check Permissions On ' ) . $filename );
            exit;
        }
    }

    include('./admin/emailuser/html.inc.php');

    $sanity_ary = compact( 'css_link', 'html_header' );
    $_SERVER['SAN'] -> slashIT( $sanity_ary );
    extract( $sanity_ary );

    OpenTable();
    echo '<p><div align = "center"><big>' . translate("Email User HTML Options") . '</big><br><a href = "./admin.php?fct=emailuser">'.
          translate('Back to Email User Administration') . '</a></div></p>';
    echo '<form action="./admin.php?fct=emailuser" method="post">';
    echo '<table align="center"><tr>';
    echo '<td>' . translate('CSS Link') . '</td>';
    echo '<td><input type="text" size="60" name="css_link" value="' . $css_link . '"></td>';
    echo '</tr><tr>';
    echo '<td>' . translate('HTML Header') . '</td>';
    echo '<td>';
    echo '<textarea name="html_header" rows="10" cols="70">' . $html_header . '</textarea>';
    echo '<br />' . addFormatOption() . '</td>' . "\n";
    echo '</tr><tr>';
    echo '<td>&nbsp;</td>';

    echo "<input type='hidden' name='clickit_form' value='html_header' />\n";
    echo "<input type='hidden' name='stripit_form' value='css_link' />\n";
    echo "<input type='hidden' name='mpn_sectype' value='2' />\n";


    echo '<td><input type="hidden" name="op" value="html_options">';
    echo '<input class="button" type="submit" name="submit" value="' . translate('Submit') . '"></td>';
    echo '</tr></table>';
    CloseTable();
}

/* PREVIEW MAIL HERE */
function preview_mail($username, $from, $subject, $message, $newsletter, $html) {
    global $mpnTables, $mpn_anonymous_id, $storyhome, $topicname;

    OpenTable();
    echo '<p><div align = "center"><big>' . translate("Email Preview") . '</big><br><a href = "./admin.php?fct=emailuser">'.
    translate('Back to Email User Administration') . '</a></div></p>';
    echo '<table align = "center" width="80%" bgcolor = "#000000"><tr><td>';
    echo '<table align = "center" width="100%" cellpadding = "5" cellspacing = "1" bgcolor = "#ffffff"><tr><td>';
    if (sizeof($username) > 1 && sizeof($username) != 0) {
        echo translate('To : Selected Users');
    } else {
        $data = mysql_fetch_row(mysql_query('SELECT  uname, email FROM ' . $mpnTables['users'] ." WHERE uid = '$username[0]'"));
        echo translate('To : ') . $data[0] . ' &lt;' . $data[1] . '&gt;';
    }
    echo '<br>';
    echo translate('From : ') . $from;
    echo '<br>';
    echo translate('Subject : ') . stripslashes($subject);
    echo '<br>';

    $message2 = null;

    if (isset($newsletter))
    {
        $result = mysql_query("SELECT sid, aid, title, time, hometext, bodytext, comments, counter, topic, informant, notes FROM ".$mpnTables['stories']." ORDER BY sid DESC limit $storyhome");

        while (list($s_sid, $aid, $title, $time, $hometext, $bodytext, $comments, $counter, $topic, $informant, $notes) = mysql_fetch_row($result))
        {
            $sanity_ary = compact( 'title', 'time', 'hometext', 'bodytext', 'comments', 'counter', 'topic', 'informant', 'notes' );
            $_SERVER['SAN'] -> slashIT( $sanity_ary );
            extract( $sanity_ary );

            if ( $_SERVER['F_LIB'] -> checkPostDate( $time ) )
            {
                $_SERVER['SAN'] -> sanitizeLegacyContent( $hometext );
            }
            else
            {
                $_SERVER['SAN'] -> adjustFormat( $hometext, 3, 10 );
            }

            $hometext_prev = $hometext;

            if (isset($html))
            {
                $line = '<br><hr><br>';

                $sql_img = 'SELECT topicimage FROM ' . $mpnTables['topics'] . " WHERE topicid = $topic";
                $img_result = mysql_query($sql_img);
                $topicimage = mysql_result($img_result, 0);

                $message2 .= '<a href="' . _MPN_ROOT_URI . 'search.php?query=&topic=' . $topic . '&author="><img src="' . _MPN_ROOT_URI . 'images/topics/' . $topicimage . '" width="50" height="50" border="0"></a><br><br>';
                $message2 .= $title . "<br>";
                $message2 .= $hometext_prev . "<br>";
                $message2 .= '&nbsp;&nbsp;-- <a href="' . _MPN_ROOT_URI . 'article.php?sid=' . $s_sid . '">' . translate("Read More") . '</a>';
                $message2 .= '<hr><br>';

            }
            else
            {
                $line = "\n=================================================\n\n";

                getTopics($s_sid);
                formatTimestamp($time);

                $_SERVER['SAN'] -> sanitize( $hometext_prev, 5, TRUE, array(), array( TRUE ) );

                $message2 .= $topicname . "\n\n";
                $message2 .= $title . "\n";
                $message2 .= $hometext_prev . "\n";
                $message2 .= "=================================================\n\n";
            }
        }
    }

    echo translate('Message : ');
    echo $message . $line . $message2;

    echo '<br><br><hr>';
    echo '<small>' . translate('Outgoing status') . '</small><br>';

    if (isset($html)) {
        echo '&nbsp;&nbsp;<small>' . translate('HTML Formatted') . '</small>';
    } else {
        echo '&nbsp;&nbsp;<small>' . translate('TEXT Formatted') . '</small>';
    }
    if (isset($newsletter)) {
        echo '&nbsp;&nbsp;<small>' . translate('Newsletter On') . '</small>';
    } else {
        echo '&nbsp;&nbsp;<small>' . translate('Newsletter Off') . '</small>';
    }

    echo '</td></tr></table></td></tr></table>';
    CloseTable();

    echo '<br>';
    OpenTable();
    echo '<form action="admin.php?fct=emailuser" method="post">';
    echo '<table align = "center">';
        echo '<tr>';
            echo '<td><strong>' . translate("Email Users") . '</strong></td><td>&nbsp;</td><td>&nbsp;</td>';
        echo '</tr>';
        echo '<tr>';
            echo  '<td>&nbsp;</td><td>' . translate('Username') . '</td><td>'
                 .'<select name="username[]" multiple size="15">';
            $sql = 'SELECT uid, uname FROM ' . $mpnTables['users'] . " WHERE uid > 1 ORDER BY uname";
            $result2 = mysql_query($sql);
            while($data = mysql_fetch_row($result2)) {
                list($uid, $uname) = $data;
                echo "<option value = \"$uid\"";
                if (in_array($uid, $username)) {
                    echo 'selected';
                }
                    echo ">$uname";
            }
            echo '</select></td>';
        echo '</tr>';
        echo '<tr>';
            echo '<td>&nbsp;</td><td>' . translate('Reply-to Address') . "</td><td><input type=\"text\" size=\"28\" name=\"from\" value=\"" . $from . "\"></td>";
        echo '</tr>';
        echo '<tr>';
            echo '<td>&nbsp;</td><td>' . translate('Send Newsletter') . "</td><td><input type=\"checkbox\" name=\"newsletter\" value=\"1\""; if (isset($newsletter)) echo 'checked'; echo '></td>';
        echo '</tr>';
        echo '<tr>';
            echo '<td>&nbsp;</td><td>' . translate('HTML Formatted') . "</td><td><input type=\"checkbox\" name=\"html\" value=\"1\""; if (isset($html)) echo 'checked'; echo '>';
            echo '<a href="./admin.php?fct=emailuser&op=html_options">' . translate('HTML Options') . '</a></td>';
        echo '</tr>';
        echo '<tr>';
            echo '<td>&nbsp;</td><td>' . translate('Subject') . "</td><td><input type=\"text\" size=\"50\" name=\"subject\" value=\"". $subject . "\"></td>";
        echo '</tr>';
        echo '<tr>';
            echo '<td>&nbsp;</td><td>' . translate('Message') . '</td>';
            echo '<td><textarea wrap="hard" cols="55" rows="12" name="message">' . $message . '</textarea>';
            echo '<br />' . addFormatOption() . '</td>' . "\n";
        echo '</tr>';
        echo '<tr>';
        echo '<td>&nbsp;</td><td>&nbsp;</td><td>' . "\n";

        echo "<input type='hidden' name='clickit_form' value='message' />\n";
        echo "<input type='hidden' name='stripit_form' value='from|subject' />\n";
        echo "<input type='hidden' name='mpn_sectype' value='1' />\n";


        echo '<input class="button" type="submit" name="op" value="' . translate('Send') . '">' .
             '&nbsp;<input class="button" type="submit" name="op" value="' . translate('Preview') . '"></td>';
        echo '</tr>';
    echo '</table>';
    echo '</form>';
    CloseTable();
}

?>