nucleus/libs/ACTION.php

   1 <?php
   2
   3 /*
   4  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   5  * Copyright (C) 2002-2009 The Nucleus Group
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  * (see nucleus/documentation/index.html#license for more info)
  12  */
  13 /**
  14  * Actions that can be called via action.php
  15  *
  16  * @license http://nucleuscms.org/license.txt GNU General Public License
  17  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  18  * @version $Id: ACTION.php 1646 2012-01-29 10:47:32Z sakamocchi $
  19  */
  20 class Action
  21 {
  22         /**
  23          * Action::__construct()
  24          *  Constructor for an new ACTION object
  25          *
  26          * @param       void
  27          * @return      void
  28          */
  29         public function __construct()
  30         {
  31                 return;
  32         }
  33
  34         /**
  35          * Action::doAction()
  36          *  Calls functions that handle an action called from action.php
  37          *
  38          * @param       string  $action action type
  39          * @return      mixed
  40          */
  41         public function doAction($action)
  42         {
  43                 switch ( $action )
  44                 {
  45                         case 'autodraft':
  46                                 return $this->autoDraft();
  47                                 break;
  48                         case 'updateticket':
  49                                 return $this->updateTicket();
  50                                 break;
  51                         case 'addcomment':
  52                                 return $this->addComment();
  53                                 break;
  54                         case 'sendmessage':
  55                                 return $this->sendMessage();
  56                                 break;
  57                         case 'createaccount':
  58                                 return $this->createAccount();
  59                                 break;
  60                         case 'forgotpassword':
  61                                 return $this->forgotPassword();
  62                                 break;
  63                         case 'votepositive':
  64                                 return $this->doKarma('pos');
  65                                 break;
  66                         case 'votenegative':
  67                                 return $this->doKarma('neg');
  68                                 break;
  69                         case 'plugin':
  70                                 return $this->callPlugin();
  71                                 break;
  72                         default:
  73                                 doError(_ERROR_BADACTION);
  74                                 break;
  75                 }
  76                 return;
  77         }
  78
  79         /**
  80          * Action::addComment()
  81          * Adds a new comment to an item (if IP isn't banned)
  82          *
  83          * @param       void
  84          * @return      void
  85          */
  86         private function addComment()
  87         {
  88                 global $CONF, $errormessage, $manager;
  89
  90                 $post['itemid'] = intPostVar('itemid');
  91                 $post['user']   = postVar('user');
  92                 $post['userid'] = postVar('userid');
  93                 $post['email']  = postVar('email');
  94                 $post['body']   = postVar('body');
  95                 $post['remember'] = intPostVar('remember');
  96
  97                 // begin if: "Remember Me" box checked
  98                 if ( $post['remember'] == 1 )
  99                 {
 100                         $lifetime = time() + 2592000;
 101                         setcookie($CONF['CookiePrefix'] . 'comment_user', $post['user'], $lifetime, '/', '', 0);
 102                         setcookie($CONF['CookiePrefix'] . 'comment_userid', $post['userid'], $lifetime, '/', '', 0);
 103                         setcookie($CONF['CookiePrefix'] . 'comment_email', $post['email'], $lifetime, '/', '', 0);
 104                 }
 105
 106                 $item =& $manager->getItem($post['itemid'], 0, 0);
 107                 $this->checkban($item['blogid']);
 108                 $blog =& $manager->getBlog($item['blogid']);
 109
 110                 // note: PreAddComment and PostAddComment gets called somewhere inside addComment
 111                 $comments = new Comments($post['itemid']);
 112                 $errormessage = $comments->addComment($blog->getCorrectTime(), $post);
 113
 114                 if ( $errormessage != '1' )
 115                 {
 116                         // show error message using default skin for blo
 117                         return array(
 118                                 'message'       => $errormessage,
 119                                 'skinid'        => $blog->getDefaultSkin()
 120                         );
 121                 }
 122                 else
 123                 {
 124                         // redirect when adding comments succeeded
 125                         if ( postVar('url') )
 126                         {
 127                                 redirect(postVar('url') );
 128                         }
 129                         else
 130                         {
 131                                 $url = Link::create_item_link($post['itemid']);
 132                                 redirect($url);
 133                         }
 134                 }
 135                 return;
 136         }
 137
 138         /**
 139          * Action::sendMessage()
 140          * Sends a message from the current member to the member given as argument
 141          *
 142          * @param       void
 143          * @return      void
 144          */
 145         private function sendMessage()
 146         {
 147                 global $CONF, $member;
 148
 149                 $error = $this->validateMessage();
 150
 151                 if ( $error != '' )
 152                 {
 153                         return array('message' => $error);
 154                 }
 155
 156                 if ( !$member->isLoggedIn() )
 157                 {
 158                         $fromMail = postVar('frommail');
 159                         $fromName = _MMAIL_FROMANON;
 160                 }
 161                 else
 162                 {
 163                         $fromMail = $member->getEmail();
 164                         $fromName = $member->getDisplayName();
 165                 }
 166
 167                 /* TODO: validation */
 168                 $memberid = postVar('memberid');
 169                 $tomem = new Member();
 170                 $tomem->readFromId($memberid);
 171
 172                 /* TODO: validation */
 173                 $message = postVar('message');
 174                 $message  = _MMAIL_MSG . ' ' . $fromName . "\n"
 175                         . '(' . _MMAIL_FROMNUC. ' ' . $CONF['IndexURL'] .") \n\n"
 176                         . _MMAIL_MAIL . " \n\n"
 177                         . $message;
 178                 $message .= Notification::get_mail_footer();
 179
 180                 $title = _MMAIL_TITLE . ' ' . $fromName;
 181                 Notification::mail($tomem->getEmail(), $title, $message, $fromMail, i18n::get_current_charset());
 182
 183                 /* TODO: validation */
 184                 $url = postVar('url');
 185                 if ( empty($url) )
 186                 {
 187                         $CONF['MemberURL'] = $CONF['IndexURL'];
 188
 189                         if ( $CONF['URLMode'] == 'pathinfo' )
 190                         {
 191                                 $data = array(
 192                                         'memberid'      => $tomem->getID(),
 193                                         'name'          => $tomem->getDisplayName()
 194                                 );
 195                                 $url = Link::create_link('member', $data);
 196                         }
 197                         else
 198                         {
 199                                 $url = $CONF['IndexURL'] . Link::create_member_link($tomem->getID());
 200                         }
 201                 }
 202                 redirect($url );
 203
 204                 return;
 205         }
 206
 207         /**
 208          * Action::validateMessage()
 209          *  Checks if a mail to a member is allowed
 210          *  Returns a string with the error message if the mail is disallowed
 211          *
 212          * @param               void
 213          * @return      String  Null character string
 214          */
 215         private function validateMessage()
 216         {
 217                 global $CONF, $member, $manager;
 218
 219                 if ( !$CONF['AllowMemberMail'] )
 220                 {
 221                         return _ERROR_MEMBERMAILDISABLED;
 222                 }
 223
 224                 if ( !$member->isLoggedIn() && !$CONF['NonmemberMail'] )
 225                 {
 226                         return _ERROR_DISALLOWED;
 227                 }
 228
 229                 if ( !$member->isLoggedIn() && !Notification::address_validation(postVar('frommail')) )
 230                 {
 231                         return _ERROR_BADMAILADDRESS;
 232                 }
 233
 234                 /*
 235                  * let plugins do verification (any plugin which thinks the comment is
 236                  * invalid can change 'error' to something other than '')
 237                  */
 238                 $result = '';
 239                 $data = array(
 240                         'type'  => 'membermail',
 241                         'error' => &$result
 242                 );
 243                 $manager->notify('ValidateForm', $data);
 244
 245                 return $result;
 246         }
 247
 248         /**
 249          * Action::createAccount()
 250          * Creates a new user account
 251          *
 252          * @param       void
 253          * @return      mixed
 254          */
 255         private function createAccount()
 256         {
 257                 global $CONF, $manager;
 258
 259                 if ( array_key_exists('AllowMemberCreate', $CONF) && !$CONF['AllowMemberCreate'] )
 260                 {
 261                         doError(_ERROR_MEMBERCREATEDISABLED);
 262                         return;
 263                 }
 264
 265                 // evaluate content from FormExtra
 266                 $result = 1;
 267                 $data = array(
 268                         'type'  => 'membermail',
 269                         'error' => &$result
 270                 );
 271                 $manager->notify('ValidateForm', $data);
 272
 273                 if ( $result != 1 )
 274                 {
 275                         return $result;
 276                 }
 277
 278                 // even though the member can not log in, set some random initial password. One never knows.
 279                 srand((double) microtime() * 1000000);
 280                 $initialPwd = md5(uniqid(rand(), TRUE) );
 281
 282                 // create member (non admin/can not login/no notes/random string as password)
 283                 $name           = Entity::shorten(postVar('name'), 32, '');
 284                 $relname        = postVar('realname');
 285                 $email          = postVar('email');
 286                 $url            = postVar('url');
 287
 288                 $r = Member::create($name, $realname, $initialPwd, $email, $url, 0, 0, '');
 289
 290                 if ( $r != 1 )
 291                 {
 292                         return $r;
 293                 }
 294
 295                 // send message containing password.
 296                 $newmem = new Member();
 297                 $newmem->readFromName($name);
 298                 $newmem->sendActivationLink('register');
 299
 300                 $data = array('member' => $newmem);
 301                 $manager->notify('PostRegister', $data);
 302
 303                 if ( postVar('desturl') )
 304                 {
 305                         redirect(postVar('desturl') );
 306                 }
 307
 308                 return 1;
 309         }
 310
 311         /**
 312          * Action::forgotPassword()
 313          * Sends a new password
 314          *
 315          * @param       void
 316          * @return      void
 317          */
 318         private function forgotPassword()
 319         {
 320                 $membername = trim(postVar('name') );
 321
 322                 if ( !Member::exists($membername) )
 323                 {
 324                         doError(_ERROR_NOSUCHMEMBER);
 325                         return;
 326                 }
 327
 328                 $mem = Member::createFromName($membername);
 329
 330                 // check if e-mail address is correct
 331                 $email = postVar('email');
 332                 if ( $mem->getEmail() != $email )
 333                 {
 334                         doError(_ERROR_INCORRECTEMAIL);
 335                         return;
 336                 }
 337
 338                 // send activation link
 339                 $mem->sendActivationLink('forgot');
 340
 341                 // redirection
 342                 $url = postVar('url');
 343                 if ( !empty($url) )
 344                 {
 345                         redirect(postVar('url') );
 346                 }
 347                 else
 348                 {
 349                         echo _MSG_ACTIVATION_SENT;
 350                         echo "<br />"
 351                             . "<br />"
 352                             . "Return to <a href=\"{$CONF['IndexURL']}\" title=\"{$CONF['SiteName']}\">{$CONF['SiteName']}</a>\n";
 353                 }
 354
 355                 return;
 356         }
 357
 358         /**
 359          * Action::doKarma()
 360          * Handle karma votes
 361          *
 362          * @param       string  $type   pos or neg
 363          * @return      Void
 364          */
 365         private function doKarma($type)
 366         {
 367                 global $itemid, $member, $CONF, $manager;
 368
 369                 // check if itemid exists
 370                 if ( !$manager->existsItem($itemid, 0, 0) )
 371                 {
 372                         doError(_ERROR_NOSUCHITEM);
 373                         return;
 374                 }
 375
 376                 $item =& $manager->getItem($itemid, 0, 0);
 377                 $this->checkban($item['blogid']);
 378
 379                 $karma =& $manager->getKarma($itemid);
 380
 381                 // check if not already voted
 382                 if ( !$karma->isVoteAllowed(serverVar('REMOTE_ADDR') ) )
 383                 {
 384                         doError(_ERROR_VOTEDBEFORE);
 385                         return;
 386                 }
 387
 388                 // check if item does allow voting
 389                 $item =& $manager->getItem($itemid, 0, 0);
 390
 391                 if ( $item['closed'] )
 392                 {
 393                         doError(_ERROR_ITEMCLOSED);
 394                         return;
 395                 }
 396
 397                 switch ( $type )
 398                 {
 399                         case 'pos':
 400                                 $karma->votePositive();
 401                         break;
 402
 403                         case 'neg':
 404                                 $karma->voteNegative();
 405                         break;
 406                 }
 407
 408                 $blog =& $manager->getBlog($blogid);
 409
 410                 // send email to notification address, if any
 411                 if ( $blog->getNotifyAddress() && $blog->notifyOnVote() )
 412                 {
 413                         $message = _NOTIFY_KV_MSG . ' ' . $itemid . "\n";
 414                         $itemLink = Link::create_item_link((integer)$itemid);
 415                         $temp = parse_url($itemLink);
 416
 417                         if ( !$temp['scheme'] )
 418                         {
 419                                 $itemLink = $CONF['IndexURL'] . $itemLink;
 420                         }
 421
 422                         $message .= $itemLink . "\n\n";
 423
 424                         if ( $member->isLoggedIn() )
 425                         {
 426                                 $message .= _NOTIFY_MEMBER . ' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";
 427                         }
 428
 429                         $message .= _NOTIFY_IP . ' ' . serverVar('REMOTE_ADDR') . "\n";
 430                         $message .= _NOTIFY_HOST . ' ' .  gethostbyaddr(serverVar('REMOTE_ADDR'))  . "\n";
 431                         $message .= _NOTIFY_VOTE . "\n " . $type . "\n";
 432                         $message .= Notification::get_mail_footer();
 433
 434                         $subject = _NOTIFY_KV_TITLE . ' ' . strip_tags($item['title']) . ' (' . $itemid . ')';
 435
 436                         $from = $member->getNotifyFromMailAddress();
 437
 438                         Notification::mail($blog->getNotifyAddress(), $subject, $message, $from, i18n::get_current_charset());
 439                 }
 440
 441                 $refererUrl = serverVar('HTTP_REFERER');
 442
 443                 if ( !$refererUrl )
 444                 {
 445                         $url = $itemLink;
 446                 }
 447                 else
 448                 {
 449                         $url = $refererUrl;
 450                 }
 451
 452                 redirect($url);
 453                 return;
 454         }
 455
 456         /**
 457          * Action::callPlugin()
 458          * Calls a plugin action
 459          *
 460          * @param       void
 461          * @return      void
 462          */
 463         private function callPlugin()
 464         {
 465                 global $manager;
 466
 467                 $name = requestVar('name');
 468                 $pluginName = "NP_{$name}";
 469                 $actionType = requestVar('type');
 470
 471                 // 1: check if plugin is installed
 472                 if ( !$manager->pluginInstalled($pluginName) )
 473                 {
 474                         doError(_ERROR_NOSUCHPLUGIN);
 475                         return;
 476                 }
 477
 478                 // 2: call plugin
 479                 $pluginObject =& $manager->getPlugin($pluginName);
 480                 if ( !$pluginObject )
 481                 {
 482                         $error = 'Could not load plugin (see actionlog)';
 483                 }
 484                 else
 485                 {
 486                         $error = $pluginObject->doAction($actionType);
 487                 }
 488
 489                 /*
 490                  * doAction returns error when:
 491                  *  - an error occurred (duh)
 492                  *  - no actions are allowed (doAction is not implemented)
 493                  */
 494                 if ( $error )
 495                 {
 496                         doError($error);
 497                         return;
 498                 }
 499
 500                 return;
 501         }
 502
 503         /**
 504          * Action::checkban()
 505          *  Checks if an IP or IP range is banned
 506          *
 507          * @param       integer $blogid
 508          * @return      void
 509          */
 510         private function checkban($blogid)
 511         {
 512                 // check if banned
 513                 $ban = Ban::isBanned($blogid, serverVar('REMOTE_ADDR') );
 514
 515                 if ( $ban != 0 )
 516                 {
 517                         doError(_ERROR_BANNED1 . $ban->iprange . _ERROR_BANNED2 . $ban->message . _ERROR_BANNED3);
 518                         return;
 519                 }
 520
 521                 return;
 522         }
 523
 524         /**
 525          * Action::updateTicket()
 526          * Gets a new ticket
 527          *
 528          * @param       void
 529          * @return      boolean FALSE
 530          */
 531         private function updateTicket()
 532         {
 533                 global $manager;
 534
 535                 if ( !$manager->checkTicket() )
 536                 {
 537                         echo _ERROR . ':' . _ERROR_BADTICKET;
 538                 }
 539                 else
 540                 {
 541                         echo $manager->getNewTicket();
 542                 }
 543
 544                 return FALSE;
 545         }
 546
 547         /**
 548          * Action::autoDraft()
 549          * Handles AutoSaveDraft
 550          *
 551          * @param       void
 552          * @return      boolean FALSE
 553          */
 554         private function autoDraft()
 555         {
 556                 global $manager;
 557
 558                 if ( !$manager->checkTicket() )
 559                 {
 560                         echo _ERROR . ':' . _ERROR_BADTICKET;
 561                 }
 562                 else
 563                 {
 564                         $manager->loadClass('ITEM');
 565                         $info = Item::createDraftFromRequest();
 566
 567                         if ( $info['status'] != 'error' )
 568                         {
 569                                 echo $info['draftid'];
 570                         }
 571                         else
 572                         {
 573                                 echo $info['message'];
 574                         }
 575                 }
 576
 577                 return FALSE;
 578         }
 579 }
 580