<?php

if ( ! @include_once( './mainfile.php' ) ) { exit( '!! INCLUDE ERROR. ACCESS DENIED !!' ); }
error_reporting( _E_VALUE );


/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | myPHPNuke Version 188_8 RC2                                          |
// +----------------------------------------------------------------------+
// | License: GNU/GPL - http://www.gnu.org/copyleft/gpl.html              |
// +----------------------------------------------------------------------+
// | Support: http://myphpnuke.com/                                       |
// +----------------------------------------------------------------------+
// | Author: myPHPNuke Dev Team                                           |
// +----------------------------------------------------------------------+
// | Copyright: © 2001-2004 myPHPNuke Dev Team                            |
// +----------------------------------------------------------------------+
// $Id: replypmsg.php,v 1.19.2.18 2004/08/27 16:02:18 kirilt Exp $




/************************************************************************/
/* PHP-NUKE: Web Portal System                                          */
/* ===========================                                          */
/*                                                                      */
/* Copyright (c) 2001 by Francisco Burzi (fburzi@ncc.org.ve)            */
/* http://phpnuke.org                                                   */
/*                                                                      */
/* =========================                                            */
/* Part of phpBB integration                                            */
/* Copyright (c) 2001 by                                                */
/*    Richard Tirtadji AKA King Richard (rtirtadji@hotmail.com)         */
/*    Hutdik Hermawan AKA hotFix (hutdik76@hotmail.com)                 */
/* http://www.phpnuke.web.id                                            */
/*                                                                      */
/* This program is free software. You can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 2 of the License.       */
/************************************************************************/
// 09-30-2001 trini0:- Make it so multiple "Re: " dont come up.
//                     & have it redirect after a post or delete.

if ( ! _MPN_USER ) { $_SERVER['F_LIB'] -> redirectRequest( 'user.php' ); }

if ( isset( $_REQUEST['cancel']  ) )
{
    $_SERVER['F_LIB'] -> redirectRequest( 'viewpmsg.php' );
}

$index = 2;

@( include_once __ROOT__ . 'core_ForumEntry.php' )
  OR goBack( translate( 'Include Error' ) );

$allow_html = $forumconfig['allow_html'];
$allow_bbcode = $forumconfig['allow_bbcode'];

if ( isset( $_POST['delete_messages'] ) )
{
    for ( $i = 0; $i < $_POST['total_messages']; $i++ )
    {
        $sql = "DELETE FROM ".$mpnTables['priv_msgs']." WHERE msg_id='$msg_id[$i]' AND to_userid='" . $GLOBALS['uinf']['uid'] . "'";

        if ( ! mysql_query( $sql ) ) { goBack( forumerror('0021') ); }
    }

    $_SERVER['F_LIB'] -> redirectRequest( 'viewpmsg.php' );
}

if ( isset( $_REQUEST['delete'] ) )
{
    $sql = "DELETE FROM ".$mpnTables['priv_msgs']." WHERE msg_id='{$_REQUEST['msg_id']}' AND to_userid='" . $GLOBALS['uinf']['uid'] . "'";

    if ( ! mysql_query( $sql ) ) { goBack( forumerror('0021') ); }

    $_SERVER['F_LIB'] -> redirectRequest( 'viewpmsg.php' );
}


if ( isset( $_POST['submit'] ) )
{
    $chkary = array( $_POST['subject'], $_POST['message'] );

    if ( in_array( (bool)FALSE, $_SERVER['SAN'] -> verifyContent( $chkary, 3 ) ) )
    {
        goBack( translate( 'Message Or Subject Field Empty' ), TRUE, TRUE );
    }

    unset( $chkary );

    if ( ! isset( $_POST['image'] ) || $_POST['image'] == '')
    {
       $image = 'icon1.gif';
    }

    // REFERENCE: BBConversion( $body, $encode, $edited = FALSE, $editby = '' )

    $message = $GLOBALS['bbencoder'] -> BBConversion( $_POST['message'], TRUE );

    $message = addslashes( $message );
    $subject = addslashes( $subject );

    $time = date("Y-m-d H:i:s",mktime(date("H")+$serv_offset));

    $res = mysql_query( 'SELECT uid FROM ' . $mpnTables['users'] . ' WHERE uname = "' . $to_user . '" && uid > 1' );

    $userrec=mysql_fetch_object( $res );
    $to_userid = $userrec->uid;

    if ( (mysql_error() != '') || ($to_userid == '') )
    {
        $msg =   translate( "The selected user doesn't exist in the database" )
               . '.<br />'
               . translate( 'Please check the name and try again' );

        goBack( $msg );
    }
    else
    {
    $time = date("Y-m-d H:i:s",mktime(date("H")+$serv_offset));
        $sql =   'INSERT INTO '
               . $mpnTables['priv_msgs']
               . ' SET msg_image = "'
               . $image
               . '", subject = "'
               . $subject
               . '", from_userid = "'
               . $GLOBALS['uinf']['uid']
               . '", to_userid = "'
               . $to_userid
               . '", msg_time = "'
               . _MPN_TIMESTAMP
               . '", msg_text = "'
               . $message
               . '"'
               ;

        @mysql_query( $sql );

        if ( mysql_error() != '' )
        {
            $msg =   translate( 'Failed To Send Message' )
                   . '.<br />'
                   . translate( 'Please Contact Your Administrator' );

            goBack( $msg );
        }

        $_SERVER['F_LIB'] -> redirectRequest( 'viewpmsg.php' );
    }
}

$reply = null;



if (isset($_REQUEST['reply']) || isset($_REQUEST['send']) || isset($_REQUEST['send2']))
{
    if ( isset($_REQUEST['reply'] ) )
    {
        $sql = "SELECT t1.msg_image, t1.subject, t1.from_userid, t1.to_userid, t1.msg_text, t1.msg_time, t2.uname
                FROM ".$mpnTables['priv_msgs']." AS t1, ".$mpnTables['users']." AS t2
                WHERE t1.msg_id = '" . $_REQUEST['msg_id'] . "'
                    && t1.from_userid = t2.uid
                    && t2.uid > 1";

        @( $result = mysql_query( $sql ) )
          OR goBack( translate( 'Query Failed' ) . '**' . __FILE__ . '***' .  __LINE__ );

        @( $row = mysql_fetch_array($result) )
          OR goBack( translate( 'Query Failed, No Data' ) . '**' . __FILE__ . '***' .  __LINE__ );

        $fromuserdata = getPosterData( NULL, $row['from_userid'] );
        $touserdata = getPosterData( NULL, $row['to_userid'] );

        if ( ( $GLOBALS['uinf']['uid'] != $touserdata['uid'] ) )
        {
            goBack( translate( 'Access Denied' ) . '**' . __FILE__ . '***' .  __LINE__ );
        }

        if ( isset( $_REQUEST['qmsg'] ) && $row['msg_text'] != '' )
        {
            $reply = '<b>On '
                    . getDisplayTime( $row['msg_time'], 'forumdatestring2' )
                    . ' , '
                    . $row['uname']
                    . ' '
                    . translate( 'Wrote' )
                    . ':</b>'
                    . "\n<blockquote>\n"
                    . stripslashes( $row['msg_text'] )
                    . "\n</blockquote>\n";

            // REF: BBConversion( $body, $encode, $edited = FALSE, $editby = '' )

            $reply = $GLOBALS['bbencoder'] -> BBConversion( $reply, FALSE );
        }
    }
    else
    {
        $touserdata = getPosterData( NULL, $_REQUEST['to_userid'] );
    }

    @( include_once __ROOT__ . 'header.php' )
      OR goBack( translate( 'Include Error' ) );

    echo '<div id="forum">' . "\n";

    echo '<h1>' . translate ( 'Write A Private Message' ) . '</h1><br />' . "\n";

    echo "<FORM ACTION=\"replypmsg.$phpEx\" METHOD=\"POST\" NAME=\"coolsus\">";
    ?>

    <table class="simpleborders" summary="private message reply">

    <TR>
        <TD class="flabel" bgcolor="<?php echo $bgcolor3?>"  width=25%><b><?php echo translate("To: ")?><b></TD>
    <?php
    if (isset($_REQUEST['reply'])) {
        echo "<TD class=\"formdata\" BGCOLOR=\"$bgcolor1\"><INPUT CLASS=\"textbox\" TYPE=\"HIDDEN\" NAME=\"to_user\" VALUE=\"" . $fromuserdata['uname'] . "\">" . $fromuserdata['uname'] . "</TD>";
    } elseif (isset($_REQUEST['send2'])) {
        echo "<TD class=\"formdata\"  BGCOLOR=\"$bgcolor1\"><INPUT CLASS=\"textbox\" TYPE=\"HIDDEN\" NAME=\"to_user\" VALUE=\"$to_userid\">" . $touserdata['uname'] . "</TD>";
    } else {
        echo "<TD class=\"formdata\"  BGCOLOR=\"$bgcolor1\"><select name=to_user>";
        $result = mysql_query("SELECT uname FROM ".$mpnTables['users']." where uid > 1 ORDER BY uname");
        while(list($ftouname) = mysql_fetch_row($result)) {
            echo "<option value=$ftouname>$ftouname</option>";
        }
        echo "</td>";
    }
$labelcss = 'style="background-color: ' . $bgcolor3 . ';"';
$labelcss1 = 'style="background-color: ' . $bgcolor3 . ';"';
$formcss = 'style="background-color: ' . $bgcolor1 . ';"';

echo '</tr><tr><td class="flabel" ' . $labelcss . '><b>' . "\n";
echo translate("Subject: ");
echo '</b></td><td class="formdata" ' . $formcss . '>' . "\n";

$row['subject']  = ( isset( $row["subject"] ) )
                ? ( str_replace("Re: ", "", $row["subject"] ) )
                : ( '' );

if ( isset( $_REQUEST['reply'] ) )
{
    echo "<input class=\"textbox\" type=\"text\" name=\"subject\" value=\"Re: " . $row['subject'] . "\" size=\"50\" maxlength=\"100\">";
}
else
{
    echo "<input class=\"textbox\" type=\"text\" name=\"subject\" size=\"50\" maxlength=\"100\">";
}

echo '</td></tr><tr><td class="flabel" ' . $labelcss . '>' . "\n";

        echo translate("Message Icon: ") . "\n";

    echo '</td><td class="formdata" ' . $formcss . '>' . "\n";

        echo getMsgIcons( ( isset( $image ) ) ? ( $image ) : ( 'icon1.gif' ) );

    echo '</td></tr><tr><td class="formlabel1" ' . $labelcss . '>' . "\n";

        echo translate( 'Message' ) . ':&nbsp;';

        echo '<br /><br />' . "\n";

        $html_status  = translate( "HTML" );
        $html_status .= ':&nbsp;&nbsp;<em class="look">';

        if ( ! $GLOBALS['bbencoder'] -> allow_html )
        {
            $html_status .= ( $GLOBALS['bbencoder'] -> allow_html ) ? ( translate( 'Allowed' ) ) : ( translate( 'Disabled' ) );
        }
        else
        {
            $html_status .= ( $GLOBALS['bbencoder'] -> allow_html ) ? ( translate( 'ON' ) ) : ( translate( 'OFF' ) );
        }

        $html_status .= '</em>';

        echo '<span class="font6">' . $html_status . '</span>' . "\n";

        echo '<br /><br />';

        $bbcode_status  = "<a href='bbcode_ref.php' target='blank' title='" . translate( "BBCode Reference" ) . "'>" . translate( "BBCode" ) . "</a>";
        $bbcode_status .= ':&nbsp;&nbsp;<em class="look">';
        $bbcode_status .= ( $GLOBALS['bbencoder'] -> allow_bbcode ) ? ( translate( 'ON' ) ) : ( translate( 'OFF' ) );
        $bbcode_status .= '</em>';

        echo "<span class='font6'>$bbcode_status</span>\n";

        echo '<br /><br />';

        $smile_status  = "<a href='bb_smilies.php' target='blank' title='" . translate( "Emoticon Reference" ) . "'>" . translate( "Emoticons" ) . "</a>";
        $smile_status .= ':&nbsp;&nbsp;<em class="look">';
        $smile_status .= ( ! isset( $_POST['smile'] ) ) ? ( translate( 'ON' ) ) : ( translate( 'OFF' ) );
        $smile_status .= '</em>';

        echo "<span class='font6'>$smile_status</span>\n";

    echo '</td><td class="formdata" ' . $formcss . '>' . "\n";

        echo '<span class="label">' . translate( 'NOTE' ) . ": </span>\n";

        echo translate( 'ALL Code <b>MUST</b> be posted using the bbcode <i>code</i> tags<br />or by using the <i>exttrans</i> text format option' );

        echo addFormatOption( TRUE, TRUE );

        echo getClickEmoticons();

        echo '<textarea name="message" rows="20" cols="65" wrap="virtual">' . "\n";

            echo $reply;

        echo '</textarea>' . "\n";

        echo getBBButtons();

   echo '</td></tr><tr>' . "\n";
?>

    <TD class="flabel" BGCOLOR="<?php echo $bgcolor3?>" width=25%><b><?php echo translate("Options: ");?></b></TD>
    <TD class="formdata" BGCOLOR="<?php echo $bgcolor1?>" >
    <?php
            if($allow_html == 1) {
    ?>
                    <INPUT TYPE="CHECKBOX" NAME="html"><?php echo translate("Disable HTML on this Post");?><br />
    <?php
            }
    ?>
    <?php
            if($allow_bbcode == 1) {
    ?>
                    <INPUT TYPE="CHECKBOX" NAME="bbcode"><?php echo "".translate("Disable")." <a href=\"bbcode_ref.$phpEx\" target=\"_blank\"><i>BBCode</i></a> ".translate("on this Post");?><br />
    <?php
            }
    ?>

    <INPUT TYPE="CHECKBOX" NAME="smile"><?php echo "".translate("Disable")." <a href=\"bb_smilies.$phpEx\" target=\"_blank\"><i>".translate("smilies")."</i></a> ".translate("on this Post");?><br />
    <?php
            if(isset($allow_sig) && $allow_sig == 1) {
                $asig = mysql_query("select attachsig from ".$mpnTables['users_status']." where uid='$cookie[0]'");
                list($attachsig) = mysql_fetch_row($asig);
                    if ($attachsig == 1) {
                        $s = "CHECKED";
                    }

    ?>
                    <INPUT TYPE="CHECKBOX" NAME="sig" <?php echo $s?>><?php echo translate("Show signature");?> <font size=-2>(<?php echo translate("This can be altered or added in your profile");?>)</font><br />
    <?php
            }

            //addFormatOption( TRUE );
    ?>
    </TD>
</TR>
<TR>
    <TD  BGCOLOR="<?php echo $bgcolor1?>" colspan=2 ALIGN="CENTER">

    <?php

    // Kiril: New Sanitizer

    echo "<input type='hidden' name='clickit_form' value='message' />\n";
    echo "<input type='hidden' name='mpn_encode' value='1' />\n";
    echo "<input type='hidden' name='stripit_form' value='subject' />\n";
    echo "<input type='hidden' name='mpn_sectype' value='1' />\n";

    // End New Saintizer

    if (!isset($msg_id))
    {
        $msg_id = null;
    }

    ?>

    <INPUT TYPE="HIDDEN" NAME="msg_id" VALUE="<?php echo $msg_id?>">
    <INPUT class='button' TYPE="SUBMIT" NAME="submit" VALUE="<?php echo translate("Submit"); ?>">&nbsp;<INPUT class='button' TYPE="RESET" VALUE="<?php echo translate("Clear"); ?>">

    <?php

    if (isset($_REQUEST['reply']))
    {
        echo "&nbsp;<INPUT class='button' TYPE=\"SUBMIT\" NAME=\"cancel\" VALUE=\"".translate("Cancel Reply")."\">";
    }
    else
    {
        echo "&nbsp;<INPUT class='button' TYPE=\"SUBMIT\" NAME=\"cancel\" VALUE=\"".translate("Cancel Send")."\">";
    }

    echo '</td></tr></table></form><br />' . "\n";

}

echo '</div>' . "\n";

@( include_once __ROOT__ . 'footer.php' )
  OR goBack( translate( 'Include Error' ) );

?>
