start();
$auth->acl($user->data);
// Initial var setup
$forum_id = (isset($_GET['f'])) ? max(intval($_GET['f']), 0) : 0;
$topic_id = (isset($_GET['t'])) ? max(intval($_GET['t']), 0) : 0;
$post_id = (isset($_GET['p'])) ? max(intval($_GET['p']), 0) : 0;
$start = (isset($_GET['start'])) ? max(intval($_GET['start']), 0) : 0;
// Do we need to check for specific allowed keys here? So long as
// parameters are not directly used in SQL I'm tempted to say
// if someone wishes to screw their view up by entering unknown data
// good luck to them :D
// If, for some reason, the SQL query would not fail and $sort vars were
// displayed in $pagination_url they could be used for XSS -- Ashe
$sort_days = (!empty($_REQUEST['st'])) ? max(intval($_REQUEST['st']), 0) : 0;
$sort_key = (!empty($_REQUEST['sk'])) ? htmlspecialchars($_REQUEST['sk']) : 't';
$sort_dir = (!empty($_REQUEST['sd'])) ? htmlspecialchars($_REQUEST['sd']) : 'a';
// Do we have a topic or post id?
if (empty($topic_id) && empty($post_id))
{
trigger_error('NO_TOPIC');
}
// Find topic id if user requested a newer or older topic
if (isset($_GET['view']) && empty($post_id))
{
if ($_GET['view'] == 'unread')
{
if ($user->data['user_id'] != ANONYMOUS)
{
if ($config['load_db_lastread'])
{
switch (SQL_LAYER)
{
case 'oracle':
break;
default:
$sql_lastread = 'LEFT JOIN ' . TOPICS_TRACK_TABLE . ' tt ON (tt.user_id = ' . $user->data['user_id'] . '
AND tt.topic_id = p.topic_id)';
$sql_unread_time = ' tt.mark_time OR tt.mark_time IS NULL';
}
}
else
{
$tracking_topics = (isset($_COOKIE[$config['cookie_name'] . '_t'])) ? unserialize($_COOKIE[$config['cookie_name'] . '_t']) : array();
$sql_unread_time = (!empty($tracking_topics[$topic_id])) ? $tracking_topics[$topic_id] : 0;
}
$sql = "SELECT p.post_id
FROM (" . POSTS_TABLE . " p
$sql_lastread)
WHERE p.topic_id = $topic_id
" . (($auth->acl_get('m_approve', $forum_id)) ? '' : 'AND p.post_approved = 1') . "
AND (p.post_time >= $sql_unread_time)
ORDER BY p.post_time ASC";
$result = $db->sql_query_limit($sql, 1);
if (!($row = $db->sql_fetchrow($result)))
{
// Setup user environment so we can process lang string
$user->setup();
meta_refresh(3, "viewtopic.$phpEx$SID&f=$forum_id&t=$topic_id");
$message = $user->lang['NO_UNREAD_POSTS'] . '
' . sprintf($user->lang['RETURN_TOPIC'], "", '');
trigger_error($message);
}
redirect("viewtopic.$phpEx$SID&p=" . $row['post_id'] . "#" . $row['post_id']);
}
redirect("index.$phpEx$SID");
}
else if ($_GET['view'] == 'next' || $_GET['view'] == 'previous')
{
$sql_condition = ($_GET['view'] == 'next') ? '>' : '<';
$sql_ordering = ($_GET['view'] == 'next') ? 'ASC' : 'DESC';
$sql = "SELECT t.topic_id
FROM " . TOPICS_TABLE . " t, " . TOPICS_TABLE . " t2
WHERE t2.topic_id = $topic_id
AND t.forum_id = t2.forum_id
AND t.topic_last_post_time $sql_condition t2.topic_last_post_time
ORDER BY t.topic_last_post_time $sql_ordering";
$result = $db->sql_query_limit($sql, 1);
if (!($row = $db->sql_fetchrow($result)))
{
$message = ($_GET['view'] == 'next') ? 'NO_NEWER_TOPICS' : 'NO_OLDER_TOPICS';
trigger_error($message);
}
else
{
$topic_id = $row['topic_id'];
}
}
}
// Look at this query ... perhaps a re-think? Perhaps store topic ids rather
// than last/first post ids and have a redirect at the top of this page
// for latest post, newest post for a given topic_id?
// This rather complex gaggle of code handles querying for topics but
// also allows for direct linking to a post (and the calculation of which
// page the post is on and the correct display of viewtopic)
$join_sql_table = (!$post_id) ? '' : ', ' . POSTS_TABLE . ' p, ' . POSTS_TABLE . ' p2 ';
if (!$post_id)
{
$join_sql = "t.topic_id = $topic_id";
}
else
{
if ($auth->acl_get('m_approve', $forum_id))
{
$join_sql = (!$post_id) ? "t.topic_id = $topic_id" : "p.post_id = $post_id AND t.topic_id = p.topic_id AND p2.topic_id = p.topic_id AND p2.post_id <= $post_id";
}
else
{
$join_sql = (!$post_id) ? "t.topic_id = $topic_id" : "p.post_id = $post_id AND p.post_approved = 1 AND t.topic_id = p.topic_id AND p2.topic_id = p.topic_id AND p2.post_approved = 1 AND p2.post_id <= $post_id";
}
}
$extra_fields = (!$post_id) ? '' : ", COUNT(p2.post_id) AS prev_posts";
$order_sql = (!$post_id) ? '' : "GROUP BY p.post_id, t.topic_id, t.topic_title, t.topic_status, t.topic_replies, t.topic_time, t.topic_type, t.poll_max_options, t.poll_start, t.poll_length, t.poll_title, f.forum_name, f.forum_desc, f.forum_parents, f.parent_id, f.left_id, f.right_id, f.forum_status, f.forum_id, f.forum_style, f.forum_password ORDER BY p.post_id ASC";
if ($user->data['user_id'] != ANONYMOUS)
{
switch (SQL_LAYER)
{
case 'oracle':
// TODO
break;
default:
$extra_fields .= ', tw.notify_status';
$join_sql_table .= ' LEFT JOIN ' . TOPICS_WATCH_TABLE . ' tw ON (tw.user_id = ' . $user->data['user_id'] . '
AND t.topic_id = tw.topic_id)';
}
}
// Join to forum table on topic forum_id unless topic forum_id is zero
// whereupon we join on the forum_id passed as a parameter ... this
// is done so navigation, forum name, etc. remain consistent with where
// user clicked to view a global topic
// Note2: after much inspection, having to find a valid forum_id when making return_to_topic links for global announcements in mcp is a pain. The easiest solution is to let admins choose under what forum topics should be seen when forum_id is not specified (preferably a public forum)
if (!$forum_id)
{
$forum_id = 2;
}
$sql = 'SELECT t.topic_id, t.forum_id AS real_forum_id, t.topic_title, t.topic_attachment, t.topic_status, ' . (($auth->acl_get('m_approve')) ? 't.topic_replies_real AS topic_replies' : 't.topic_replies') . ', t.topic_last_post_id, t.topic_time, t.topic_type, t.poll_max_options, t.poll_start, t.poll_length, t.poll_title, f.forum_name, f.forum_desc, f.forum_parents, f.parent_id, f.left_id, f.right_id, f.forum_status, f.forum_id, f.forum_style, f.forum_password' . $extra_fields . '
FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . ' f' . $join_sql_table . "
WHERE $join_sql
AND (f.forum_id = t.forum_id
OR (t.forum_id = 0 AND
f.forum_id = $forum_id)
)
$order_sql";
$result = $db->sql_query($sql);
if (!$topic_data = $db->sql_fetchrow($result))
{
trigger_error('NO_TOPIC');
}
// Setup look and feel
$user->setup(false, $topic_data['forum_style']);
// Forum is passworded ... check whether access has been granted to this
// user this session, if not show login box
if ($topic_data['forum_password'])
{
login_forum_box($topic_data);
}
// Extract the data
extract($topic_data);
// Start auth check
if (!$auth->acl_get('f_read', $forum_id))
{
if ($user->data['user_id'] != ANONYMOUS)
{
trigger_error($user->lang['SORRY_AUTH_READ']);
}
login_box(preg_replace('#.*?([a-z]+?\.' . $phpEx . '.*?)$#i', '\1', htmlspecialchars($_SERVER['REQUEST_URI'])), '', $user->lang['LOGIN_VIEWFORUM']);
}
// What is start equal to?
if (!empty($post_id))
{
$start = floor(($prev_posts - 1) / $config['posts_per_page']) * $config['posts_per_page'];
}
// Fill extension informations, if this topic has attachments
$extensions = array();
if ($topic_attachment)
{
obtain_attach_extensions($extensions);
}
// Are we watching this topic?
$s_watching_topic = '';
$s_watching_topic_img = '';
watch_topic_forum('topic', $s_watching_topic, $s_watching_topic_img, $user->data['user_id'], $topic_id, $notify_status);
// Post ordering options
$limit_days = array(0 => $user->lang['ALL_POSTS'], 1 => $user->lang['1_DAY'], 7 => $user->lang['7_DAYS'], 14 => $user->lang['2_WEEKS'], 30 => $user->lang['1_MONTH'], 90 => $user->lang['3_MONTHS'], 180 => $user->lang['6_MONTHS'], 364 => $user->lang['1_YEAR']);
$sort_by_text = array('a' => $user->lang['AUTHOR'], 't' => $user->lang['POST_TIME'], 's' => $user->lang['SUBJECT']);
$sort_by_sql = array('a' => 'u.username', 't' => 'p.post_id', 's' => 'p.post_subject');
$s_limit_days = $s_sort_key = $s_sort_dir = $u_sort_param = '';
gen_sort_selects($limit_days, $sort_by_text, $sort_days, $sort_key, $sort_dir, $s_limit_days, $s_sort_key, $s_sort_dir, $u_sort_param);
// Obtain correct post count and ordering SQL if user has
// requested anything different
if ($sort_days)
{
$min_post_time = time() - ($sort_days * 86400);
$sql = 'SELECT COUNT(post_id) AS num_posts
FROM ' . POSTS_TABLE . "
WHERE topic_id = $topic_id
AND post_time >= $min_post_time
" . (($auth->acl_get('m_approve', $forum_id)) ? '' : 'AND p.post_approved = 1');
$result = $db->sql_query($sql);
$start = 0;
$total_posts = ($row = $db->sql_fetchrow($result)) ? $row['num_posts'] : 0;
$limit_posts_time = "AND p.post_time >= $min_post_time ";
}
else
{
$total_posts = $topic_replies + 1;
$limit_posts_time = '';
}
// Select the sort order
$sort_order = $sort_by_sql[$sort_key] . ' ' . (($sort_dir == 'd') ? 'DESC' : 'ASC');
// Cache this? ... it is after all doing a simple data grab
// Only good if there are lots of ranks IMHO (we save the sorting)
// Moved to global cache but could be simply obtained dynamically if we see
// the cache is growing too big -- Ashe
if ($cache->exists('ranks'))
{
$ranks = $cache->get('ranks');
}
else
{
$sql = 'SELECT *
FROM ' . RANKS_TABLE . '
ORDER BY rank_min DESC';
$result = $db->sql_query($sql);
$ranks = array();
while ($row = $db->sql_fetchrow($result))
{
if ($row['rank_special'])
{
$ranks['special'][$row['rank_id']] = array(
'rank_title' => $row['rank_title'],
'rank_image' => $row['rank_image']
);
}
else
{
$ranks['normal'][] = array(
'rank_title' => $row['rank_title'],
'rank_min' => $row['rank_min'],
'rank_image' => $row['rank_image']
);
}
}
$db->sql_freeresult($result);
$cache->put('ranks', $ranks);
}
// Grab icons
$icons = array();
obtain_icons($icons);
// Was a highlight request part of the URI?
$highlight_match = $highlight = '';
if (isset($_GET['hilit']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars(urldecode($_GET['hilit']))));
foreach ($words as $word)
{
if (trim($word) != '')
{
$highlight_match .= (($highlight_match != '') ? '|' : '') . str_replace('*', '\w*?', preg_quote($word, '#'));
}
}
unset($words);
$highlight = urlencode($_GET['hilit']);
}
// Forum rules listing
$s_forum_rules = '';
gen_forum_rules('topic', $forum_id);
// Quick mod tools
$topic_mod = '';
$topic_mod .= ($auth->acl_get('m_lock', $forum_id)) ? ((intval($topic_status) == ITEM_UNLOCKED) ? '' : '') : '';
$topic_mod .= ($auth->acl_get('m_delete', $forum_id)) ? '' : '';
$topic_mod .= ($auth->acl_get('m_move', $forum_id)) ? '' : '';
$topic_mod .= ($auth->acl_get('m_split', $forum_id)) ? '' : '';
$topic_mod .= ($auth->acl_get('m_merge', $forum_id)) ? '' : '';
$topic_mod .= ($auth->acl_get('m_', $forum_id)) ? '' : '';
$topic_mod .= ($auth->acl_get('m_', $forum_id) && $topic_type != POST_NORMAL) ? '' : '';
$topic_mod .= ($auth->acl_get('f_sticky', $forum_id) && $topic_type != POST_STICKY) ? '' : '';
$topic_mod .= ($auth->acl_get('f_announce', $forum_id) && ($topic_type != POST_ANNOUNCE || $real_forum_id == 0)) ? '' : '';
$topic_mod .= ($auth->acl_get('f_announce', $forum_id) && ($topic_type != POST_ANNOUNCE || $real_forum_id > 0)) ? '' : '';
$topic_mod .= ($auth->acl_get('m_', $forum_id)) ? '' : '';
// If we've got a hightlight set pass it on to pagination.
$pagination_url = "viewtopic.$phpEx$SID&t=$topic_id&" . (($highlight_match) ? "&hilit=$highlight" : '');
$pagination = generate_pagination($pagination_url, $total_posts, $config['posts_per_page'], $start);
// Post, reply and other URL generation for templating vars
$new_topic_url = 'posting.' . $phpEx . $SID . '&mode=post&f=' . $forum_id;
$reply_topic_url = 'posting.' . $phpEx . $SID . '&mode=reply&f=' . $forum_id . '&t=' . $topic_id;
$view_forum_url = 'viewforum.' . $phpEx . $SID . '&f=' . $forum_id;
$view_prev_topic_url = 'viewtopic.' . $phpEx . $SID . '&f=' . $forum_id . '&t=' . $topic_id . '&view=previous';
$view_next_topic_url = 'viewtopic.' . $phpEx . $SID . '&f=' . $forum_id . '&t=' . $topic_id . '&view=next';
// Post/reply images
$reply_img = ($forum_status == ITEM_LOCKED || $topic_status == ITEM_LOCKED) ? $user->img('btn_locked', $user->lang['TOPIC_LOCKED']) : $user->img('btn_reply', $user->lang['REPLY_TO_TOPIC']);
$post_img = ($forum_status == ITEM_LOCKED) ? $user->img('post_locked', $user->lang['FORUM_LOCKED']) : $user->img('btn_post', $user->lang['POST_NEW_TOPIC']);
// Grab censored words
$censors = array();
obtain_word_list($censors);
// Navigation links
generate_forum_nav($topic_data);
// Moderators
$forum_moderators = array();
get_moderators($forum_moderators, $forum_id);
// This is only used for print view so ...
$server_path = (!isset($_GET['view'])) ? '' : (($config['cookie_secure']) ? 'https://' : 'http://') . trim($config['server_name']) . (($config['server_port'] <> 80) ? ':' . trim($config['server_port']) . '/' : '/') . trim($config['script_path']) . '/';
// Replace naughty words in title
if (sizeof($censors))
{
$topic_title = preg_replace($censors['match'], $censors['replace'], $topic_title);
}
// Send vars to template
$template->assign_vars(array(
'FORUM_ID' => $forum_id,
'FORUM_NAME' => $forum_name,
'FORUM_DESC' => strip_tags($forum_desc),
'TOPIC_ID' => $topic_id,
'TOPIC_TITLE' => $topic_title,
'PAGINATION' => (isset($_GET['view']) && $_GET['view'] == 'print') ? '' : $pagination,
'PAGE_NUMBER' => (isset($_GET['view']) && $_GET['view'] == 'print') ? '' : on_page($total_posts, $config['posts_per_page'], $start),
'TOTAL_POSTS' => ($total_posts == 1) ? $user->lang['VIEW_TOPIC_POST'] : sprintf($user->lang['VIEW_TOPIC_POSTS'], $total_posts),
'MCP' => ($auth->acl_get('m_', $forum_id)) ? sprintf($user->lang['MCP'], "session_id . "&f=$forum_id&t=$topic_id&start=$start&$u_sort_param&posts_per_page=" . $config['posts_per_page'] . '">', '') : '',
'MODERATORS' => (sizeof($forum_moderators[$forum_id])) ? implode(', ', $forum_moderators[$forum_id]) : '',
'POST_IMG' => $post_img,
'REPLY_IMG' => $reply_img,
'REPORT_IMG' => $user->img('btn_report', $user->lang['REPORT_TO_ADMIN']),
'REPORTED_IMG' => $user->img('icon_reported', $user->lang['POST_BEEN_REPORTED']),
'UNAPPROVED_IMG' => $user->img('icon_unapproved', $user->lang['POST_NOT_BEEN_APPROVED']),
'S_TOPIC_LINK' => 't',
'S_SELECT_SORT_DIR' => $s_sort_dir,
'S_SELECT_SORT_KEY' => $s_sort_key,
'S_SELECT_SORT_DAYS' => $s_limit_days,
'S_TOPIC_ACTION' => "viewtopic.$phpEx$SID&f=$forum_id&t=$topic_id&start=$start",
'S_TOPIC_MOD' => ($topic_mod != '') ? '' : '',
'S_MOD_ACTION' => "mcp.$phpEx?sid=" . $user->session_id . "&t=$topic_id&quickmod=1",
'S_WATCH_TOPIC' => $s_watching_topic,
'S_DISPLAY_SEARCHBOX' => ($auth->acl_get('f_search', $forum_id)) ? true : false,
'S_SEARCHBOX_ACTION' => "search.$phpEx$SID&f=$forum_id",
'U_TOPIC' => $server_path . "viewtopic.$phpEx?f=$forum_id&t=$topic_id",
'U_FORUM' => $server_path,
'U_VIEW_UNREAD_POST' => "viewtopic.$phpEx$SID&f=$forum_id&t=$topic_id&view=unread",
'U_VIEW_TOPIC' => "viewtopic.$phpEx$SID&f=$forum_id&t=$topic_id&start=$start&$u_sort_param&hilit=$highlight",
'U_VIEW_FORUM' => $view_forum_url,
'U_VIEW_OLDER_TOPIC' => $view_prev_topic_url,
'U_VIEW_NEWER_TOPIC' => $view_next_topic_url,
'U_PRINT_TOPIC' => "viewtopic.$phpEx$SID&f=$forum_id&t=$topic_id&$u_sort_param&view=print",
'U_EMAIL_TOPIC' => "viewtopic.$phpEx$SID&f=$forum_id&t=$topic_id&view=email",
'U_POST_NEW_TOPIC' => $new_topic_url,
'U_POST_REPLY_TOPIC' => $reply_topic_url)
);
// Does this topic contain a poll?
if (!empty($poll_start))
{
$sql = "SELECT *
FROM " . POLL_OPTIONS_TABLE . "
WHERE topic_id = $topic_id
ORDER BY poll_option_id";
$result = $db->sql_query($sql);
while ($row = $db->sql_fetchrow($result))
{
$poll_info[] = $row;
}
$db->sql_freeresult($result);
if ($user->data['user_id'] != ANONYMOUS)
{
$sql = "SELECT poll_option_id
FROM " . POLL_VOTES_TABLE . "
WHERE topic_id = $topic_id
AND vote_user_id = " . $user->data['user_id'];
$result = $db->sql_query($sql);
$voted_id = array();
if ($row = $db->sql_fetchrow($result))
{
do
{
$voted_id[] = $row['poll_option_id'];
}
while ($row = $db->sql_fetchrow($result));
}
$db->sql_freeresult($result);
}
else
{
// Cookie based guest tracking ... I don't like this but hum ho
// it's oft requested. This relies on "nice" users who don't feel
// the need to delete cookies to mess with results. We could get
// a little more clever by time limiting based on ip's but ultimately
// it can be overcome without great difficulty.
if (isset($_COOKIE[$config['cookie_name'] . '_poll_' . $topic_id]))
{
$voted_id = explode(',', $_COOKIE[$config['cookie_name'] . '_poll_' . $topic_id]);
}
}
$s_can_vote = (((!sizeof($voted_id) && $auth->acl_get('f_vote', $forum_id)) || $auth->acl_get('f_votechg', $forum_id)) &&
($poll_length != 0 && $poll_start + $poll_length > time()) &&
$topic_status != ITEM_LOCKED &&
$forum_status != ITEM_LOCKED) ? true : false;
$s_display_results = (!$s_can_vote || ($s_can_vote && sizeof($voted_id)) || $_GET['vote'] = 'viewresult') ? true : false;
if (isset($_POST['castvote']) && $s_can_vote)
{
$voted_id = array_map('intval', $_POST['vote_id']);
if (!sizeof($voted_id) || sizeof($voted_id) > $poll_max_options)
{
meta_refresh(5, "viewtopic.$phpEx$SID&f=$forum_id&t=$topic_id");
$message = (!sizeof($voted_id)) ? 'NO_VOTE_OPTION' : 'TOO_MANY_VOTE_OPTIONS';
$message = $user->lang[$message] . '