\n";
}
// authenticate by user name/pass or by cookies
// return user id, die if authentication fails
function authenticate($dbh,$user,$pass) {
global $cookie_uname,$cookie_token;
if (isset($user) && $user!='' && isset($pass) && $pass!='') {
$query=mysqli_prepare($dbh,"
SELECT idx
FROM users
WHERE uname = ? AND pass = ?
") or die("auth attempt: ".mysqli_error($dbh));
mysqli_stmt_bind_param($query,'ss',$user,$pass);
mysqli_stmt_execute($query) or die(mysqli_error($dbh));
mysqli_stmt_bind_result($query,$uid);
if (!mysqli_stmt_fetch($query)) die("Authentication failed ".mysqli_error($dh));
mysqli_stmt_close($query);
} else if (isset($_COOKIE[$cookie_uname]) && isset($_COOKIE[$cookie_token])) {
$query=mysqli_prepare($dbh,"
SELECT idx
FROM users
WHERE uname = ? AND logintoken = ?
") or die("auth attempt: ".mysqli_error($dbh));
mysqli_stmt_bind_param($query,'ss',$_COOKIE[$cookie_uname],$_COOKIE[$cookie_token]);
mysqli_stmt_execute($query) or die(mysqli_error($dbh));
mysqli_stmt_bind_result($query,$uid);
if (!mysqli_stmt_fetch($query)) die ("Authentication failed".mysqli_error($dbh));
mysqli_stmt_close($query);
} else die("Authentication failed (incomplete data).");
return $uid;
}
// update the last updated timestamp for a post/thread
function update_post_time($dbh,$idx) {
$query = mysqli_prepare($dbh,"
UPDATE board
SET lasttime = NOW()
WHERE idx = ?
LIMIT 1
") or die("update error: ".mysqli_error($dbh));
mysqli_stmt_bind_param($query,'i',$idx);
mysqli_stmt_execute($query) or die(mysqli_error($dbh));
mysqli_stmt_close($query);
}
// ***************************** Top of code ********************************
require("dblogin.php");
require("dblogin_write.php");
$dbh = dblogin();
if (isset($_GET[login])) {
// **** Display login form
pageheader();
?>
the forum!";
} else echo "the passwords did not match";
} else echo "User name $_POST[uname] already exists.";
} else if (isset($_GET[userinfo])) {
// **** User info page
// get info from users database
$query= mysqli_prepare($dbh,"SELECT uname, UNIX_TIMESTAMP(joined) as joindate, logintoken, UNIX_TIMESTAMP(lastlogin) as login FROM users
WHERE idx = ?");
mysqli_stmt_bind_param($query,'i',$_GET[userinfo]);
mysqli_stmt_execute($query) or die(mysqli_error($dbh));
mysqli_stmt_store_result($query);
if (mysqli_stmt_num_rows($query) != 1) die("no such user");
mysqli_stmt_bind_result($query,$uname,$joindate,$logintoken,$login);
mysqli_stmt_fetch($query) or die(mysqli_error($dbh));
mysqli_stmt_close($query);
// get post count, last post
$query = mysqli_prepare($dbh,"SELECT COUNT(*) AS postcount, UNIX_TIMESTAMP(MAX(postedtime)) as lasttime FROM board WHERE author = ?");
mysqli_stmt_bind_param($query,'i',$_GET[userinfo]);
mysqli_stmt_execute($query) or die(mysqli_error($dbh));
mysqli_stmt_bind_result($query,$postcount,$lasttime);
mysqli_stmt_fetch($query) or die(mysqli_error($dbh));
mysqli_stmt_close($query);
pageheader($uname." user info");
echo "Info for user "$uname":
";
echo "Joined: ".date($datefmt,$joindate)." ";
echo "Posts: $postcount";
if ($postcount > 0) echo ", last posted ".date("$datefmt $timefmt",$lasttime)." ";
if (isset($logintoken) && $logintoken != "") echo "Logged in ".date("$datefmt $timefmt",$login)." ";
else if ($login > 0) echo "Last logged in ".date("$datefmt $timefmt",$login)." ";
else echo "Never logged in. ";
echo " User List";
} else if (isset($_GET[userlist])) {
// **** User list
pageheader("User List");
$query = mysqli_prepare($dbh,"
SELECT COUNT(*) AS postcount, users.uname AS uname, UNIX_TIMESTAMP(users.joined) AS joined, users.idx AS idx
FROM board, users
WHERE board.author = users.idx
GROUP BY uname
ORDER BY postcount DESC
");
mysqli_stmt_execute($query);
mysqli_stmt_store_result($query);
echo "User list:
".mysqli_stmt_num_rows($query)." users
Name
Post Count
Joined
\n";
mysqli_stmt_bind_result($query,$postcount,$uname,$joined,$uid);
while (mysqli_stmt_fetch($query)) {
echo "
\n";
} else if (isset($_GET[chpass])) {
// **** Change password form
pageheader();
?>
Change Password:
";
if ($pageno > 0) echo "Previous Page";
if ($pageno > 0 && $pageno < floor(($postcount-1)/$postsperpage)) echo " | ";
if ($pageno < floor(($postcount-1)/$postsperpage)) echo "Next Page";
echo "";
$query = mysqli_prepare($dbh,"
SELECT board.subject AS subject,
board.message AS message,
board.idx AS idx,
UNIX_TIMESTAMP(board.postedtime) AS postedtime,
UNIX_TIMESTAMP(board.lasttime) AS lasttime,
users.uname AS uname,
users.idx AS uidx
FROM board, users
WHERE board.author = users.idx AND (board.replyto = ? OR board.idx = ?)
ORDER BY postedtime ASC
LIMIT ?,?
") or die (mysqli_error($dbh));
mysqli_stmt_bind_param($query,'iiii',$_GET[showthread],$_GET[showthread],$firstonpage,$postsperpage);
mysqli_stmt_execute($query) or die(mysqli_error($dbh));
mysqli_stmt_bind_result($query,$subject,$message,$message_id,$postedtime,$updatetime,$uname,$uid);
echo "
\n";
$firstpost=1;
while (mysqli_stmt_fetch($query)) {
echo "
";
if ($lastlogin > 0 && $updatetime > $lastlogin) echo "* ";
echo "$subject by $uname at ".date($timefmt,$postedtime)." on ".date($datefmt,$postedtime)."
";
if ($pageno > 0) echo "Previous Page";
if ($pageno > 0 && $pageno < floor(($postcount-1)/$postsperpage)) echo " | ";
if ($pageno < floor(($postcount-1)/$postsperpage)) echo "Next Page";
echo " ";
echo "Go to Page ";
for ($i = 0; $i <= $lastpage; $i++)
{
if ($pageno != $i)
echo "";
echo "$i";
if ($pageno != $i)
echo "";
echo " ";
}
echo " ";
echo "Search this thread";
echo " ";
echo "Show all threads
";
echo "Reply to this thread: ";
NewPostForm($_GET[showthread]);
echo "
";
} else if (isset($_GET['addpost'])) {
// **** Add a post
pageheader();
$uid = authenticate($dbh,$_POST[author],$_POST[pass]);
if ($_POST[inresponseto]=="0" && (!isset($_POST[subject]) || $_POST[subject]=="" || ctype_space($_POST[subject]))) die("Cannot start thread with empty subject");
$dbh_write = dblogin_write();
$query = mysqli_prepare($dbh_write,"
INSERT INTO board
VALUES(NULL,NOW(),NOW(),?,?,?,?,?)
") or die ("post error: ".mysqli_error($dbh_write));
mysqli_stmt_bind_param($query,'iisss',$uid,$_POST[inresponseto],htmlspecialchars($_POST[subject],ENT_QUOTES),preg_replace($tags_search,$tags_replace,htmlspecialchars($_POST[message],ENT_QUOTES)),$_SERVER[REMOTE_ADDR]);
mysqli_stmt_execute($query) or die(mysqli_error($dbh_write));
mysqli_stmt_close($query);
echo "Added. ";
// update thread last updated time
if ($_POST[inresponseto] != 0) {
update_post_time($dbh_write,$_POST[inresponseto]);
echo "Return to thread ";
} echo "Return to forum";
mysqli_close($dbh_write);
} else if (isset($_GET['editpost'])) {
// **** Display post edit form
pageheader();
$query = mysqli_prepare($dbh,"
SELECT subject,message
FROM board
WHERE idx = ?") or die(mysqli_error($dbh));
mysqli_stmt_bind_param($query,'i',$_GET['editpost']);
mysqli_stmt_execute($query) or die(mysqli_error($dbh));
mysqli_stmt_bind_result($query,$subject,$message);
if (!mysqli_stmt_fetch($query)) die("no such post ".mysqli_error($dbh));
mysqli_stmt_close($query);
EditPostForm($_GET['editpost'],preg_replace($tags_decode_search,$tags_decode_replace,$message),$subject);
} else if (isset($_GET['editpost2'])) {
// **** Commit an edited post
pageheader();
$posttoedit = intval($_POST[posttoupdate]);
// look up what post this reponds to and when it was first posted
$query = mysqli_prepare($dbh,"SELECT replyto, UNIX_TIMESTAMP(postedtime) FROM board WHERE idx = ? LIMIT 1") or die(mysqli_error($dbh));
mysqli_stmt_bind_param($query,'i',$_POST[posttoupdate]);
mysqli_stmt_execute($query) or die(mysqli_error($dbh));
mysqli_stmt_bind_result($query,$inresponseto,$postedtime);
mysqli_stmt_fetch($query) or die("couldn't find first post in thread".mysqli_error($dbh));
mysqli_stmt_close($query);
if (time()-$postedtime >= $editexpire) die("edit time for this post has expired ($editexpire seconds)");
$uid = authenticate($dbh,$_POST[author],$_POST[pass]);
if ($inresponseto=="0" && (!isset($_POST[subject]) || $_POST[subject]=="" || ctype_space($_POST[subject]))) die("Thread cannot have empty subject");
$dbh_write = dblogin_write();
$query = mysqli_prepare($dbh_write,"
UPDATE board
SET subject = ?,
message = ?,
ip = ?,
lasttime = NOW()
WHERE idx = ? AND author = ?
LIMIT 1
") or die (mysqli_error($dbh_write));
$newmessage = preg_replace($tags_search,$tags_replace,htmlspecialchars($_POST[message],ENT_QUOTES))."
edited ".date($timefmt." ".$datefmt)."";
mysqli_stmt_bind_param($query,'sssii',htmlspecialchars($_POST[subject],ENT_QUOTES),$newmessage,$_SERVER[REMOTE_ADDR],$_POST[posttoupdate],$uid);
mysqli_stmt_execute($query) or die(mysqli_error($dbh_write));
if (mysqli_stmt_affected_rows($query) != 1) die("no such post by you");
mysqli_stmt_close($query);
echo "Updated. ";
if ($inresponseto != 0) {
update_post_time($dbh_write,$inresponseto);
echo "Return to thread ";
echo "Return to forum";
}
mysqli_close($dbh_write);
} else if (isset($_GET['searchmode'])) {
// **** Searching (largely ripped off from Josh W)
pageheader();
$post_action = "$my_path?searchmode";
if(isset($_GET['threadid'])) {
$post_action .= "&threadid=${_GET['threadid']}";
}
echo "
