<?php
// ======================================================================== //
//                                                                          //
//   KooBI- Webportalsystem                                                 //
//   SCRiPTMAFiA 2005 - THE DiRTY HANDS ON YOUR SCRiPTS                     //
//                                                                          //
//   ====================================================================   //
//                                                                          //   
//   dream4 | webservices - Am Michelsgrund 7 - 69469 Weinheim - Germany    //    
//   tel. +49(0) 6201 - 980442 / fax. +49(0) 6201 - 64809                   //
//                                                                          //
// ======================================================================== //
// ===============================================================
// <<-- USER- SUCHE FUER PN -->>
// ===============================================================
if(isset($_REQUEST['do']) && $_REQUEST['do']=="searchuser") {
	$sname = $lang['searchuser'];
	if((isset($_REQUEST['search']) && $_REQUEST['search']=="1") && !empty($_REQUEST['name'])) { 
		
		$nametemp = $_REQUEST['name'];
		$nametemp = "%".$nametemp."%";
		$sql = new dbc("SELECT uname FROM ".PREFIX."_user WHERE uname like '".$nametemp."'");
		
		while($row=$sql->fetchrow()) {
			$usererg .= "<a href='javascript:unametofield(\"".$row->uname."\");'>$row->uname</a><br>";
		}
		
		if($usererg) {
			$tmpl->assign('userfound', 1);
		}
		
	} 
	$tmpl->assign('userfound_t', $lang['searchuser_found']);
	$tmpl->assign('usererg', $usererg);
	$tmpl->assign('lang', $lang);
	$tmpl->assign('searchuser', $lang['searchuser']);
	$EOUT = $tmpl->fetch("user/searchuser_popup.tpl");
	
}

// ===============================================================
// <<-- EMAIL SENDEN -->>
// ===============================================================
if(isset($_REQUEST['do']) && $_REQUEST['do']=="EMAIL"){
	$sname = $lang['user_sendemail'];
	if(UGROUP == 2){
		#$EOUT = stderror("nopermission", $lang['nopermission_t'], str_replace("__URL__", "index.php", $lang['redirect']), "index.php", 1);
		$error = $lang['nopermission_t'];
	}
	
	
	$sql = new dbc("SELECT * FROM ".PREFIX."_user WHERE uid='$_REQUEST[uid]'");
	$row = $sql->fetchrow();
	
	if($row->user_viewemail!="yes") $error .= $lang['user_wants_noemails'];
	
	$ignore = array();
	$sql_2 = new dbc("SELECT ignore_uid FROM ".PREFIX."_ignore WHERE uid='$_REQUEST[uid]'");
	
	while($row_2 = $sql_2->fetchrow()){
		@array_push($ignore, $row_2->ignore_uid);
	}
	if(in_array(UID, $ignore)) $error .= $lang['error_emailsend_nobuddy'];
	
	
	switch($_REQUEST['mailsend']){
		case "" :
		if($error){
			$tmpl->assign('error', $error);
		} else {
		}
		break;
		
		case "1" :
		if($error){ 
			echo '<pre>' . $lang['error_emailsend_nobuddy'] . '</pre>'; 
			
		} else {
			
			$message_footer = $lang['emailform_homepage_footer'];
			$message_footer = str_replace("__HOMEPAGEURL__", HPURL, $message_footer);
			$message_footer = str_replace("__USER__", UNAME, $message_footer);
			$subject = stripslashes($_REQUEST['subject']);
			$message = stripslashes($_REQUEST['body']);
			$message = badwordreplace($message);
			$from = str_replace("__HOMEPAGE__", $pref['hpname'], $lang['emailform_homepage']);
			$message = str_replace("\n","\n\n", $message);
			@mail($row->email, $subject , $message . "\r\n" . $message_footer,
			"From: ". $UMAIL . ' ' . $from . "\nReply-To: " . $UMAIL . "\nX-Mailer: PHP/" . phpversion());
		}
		break;
	}
	$tmpl->assign('lang', $lang);
	$tmpl->assign('sname', $sname);
	$tmpl->assign('uid', $_REQUEST['uid']);
	$EOUT = $tmpl->fetch('user/email_popup.tpl');
	
}

// ===============================================================
// <<-- AIM / ICQ -->>
// ===============================================================
if(isset($_REQUEST['do']) && $_REQUEST['do']=="AIM"){
	$sname = ' - '.$lang['aolmessage'];
	$sql = new dbc("SELECT user_aim FROM ".PREFIX."_user WHERE uid='".$_REQUEST['uid']."'");
	$row = $sql->fetchrow();
	$tmpl->assign('aim', $row->user_aim);
	$EOUT = $tmpl->fetch('user/aim_popup.tpl');
}

if(isset($_REQUEST['do']) && $_REQUEST['do']=="ICQ"){
	$sname .= " - ICQ ";
	$sql = new dbc("SELECT * FROM ".PREFIX."_user WHERE uid='".$_REQUEST['uid']."'");
	$row = $sql->fetchrow();
	$tmpl->assign('row', $row);
	$tmpl->assign('lang', $lang);
	$EOUT = $tmpl->fetch('user/icq_popup.tpl');
	
}

// ===============================================================
// <<-- ADMIN- TEMPLATEVORSCHAU -->>
// ===============================================================
if(isset($_REQUEST['do']) && $_REQUEST['do']=="containerpreview"){
	if($_REQUEST['typ']=="in"){
		$folder = "container";
	} else {
		$tmpl->assign('showno', 1);
		$folder = "page";
	}
	
	ob_start();
	readfile("templates/$THEME/".$folder."/".$_REQUEST['id'].".tpl");
	$pre =  ob_get_contents(); 
	$pre = preg_replace("/{([a-zA-Z0-9,$]+)}/", "$THEME", $pre);
	$EOUT = $pre;
	ob_end_clean(); 
	
}


if(isset($_REQUEST['do']) && $_REQUEST['do']=="autowords"){
	$sql = new dbc("SELECT words,text FROM ".PREFIX."_autowords WHERE id='".$_REQUEST['id']."'");
	$row = $sql->fetchrow();
	$sql = new dbc("UPDATE ".PREFIX."_autowords SET hits=hits+1 WHERE id='".$_REQUEST['id']."'");
	$sname = "-". $row->words;
	$tmpl->assign('word', kstripslashes($row->words));
	$tmpl->assign('text', $row->text);
	$tmpl->assign('print', $lang['printtext']);
	$tmpl->assign('winclose', $lang['winclose']);
	$EOUT = parsetrue("container/".container("autowords"), $row->words, $tmpl->fetch("other/autowords.tpl"));
}

if(isset($_REQUEST['do']) && $_REQUEST['do']=="inlineshots"){
	$tmpl->assign('img_id', $_REQUEST['img_id']);
	$tmpl->assign('usererg', $usererg);
	$tmpl->assign('searchuser', $lang['searchuser']);
	$EOUT = $tmpl->fetch("gallery/inlineshot.tpl");
}

if (isset($_REQUEST['do']) && $_REQUEST['do'] == "attachment") {

	if($_REQUEST['toid']!=""){
		$q_closed = "
		SELECT
		f.id,
		f.status AS fstatus, 
		t.status AS tstatus,
		t.uid
		FROM
		" . PREFIX . "_f_forum AS f, 
		" . PREFIX . "_f_topic AS t
		WHERE
		t.id = '" . $_REQUEST["toid"]  . "' AND f.id = t.forum_id";
		
		$r_closed = new dbc($q_closed);
		$closed = $r_closed->fetchrow();
		$permissions = getForumPermissionsByUser($closed->id, UID);
		// $permissions = getForumPermissions($closed->id, UGROUP);
	} else {
		$permissions = getForumPermissionsByUser($_REQUEST['fid'], UID);
		// $permissions = getForumPermissions($_REQUEST['fid'], UGROUP);
	}
	if ($permissions[FORUM_PERMISSION_CAN_UPLOAD_ATTACHMENT] == 0){
		echo "<pre>permission denied</pre>";
		exit;
	}
	
	if (!isset($_REQUEST['action'])) {
		$query = "SELECT filetype, filesize FROM " . PREFIX . "_f_allowed_files";
		$result = new dbc($query);
		
		$allowed_files = array();
		
		while ($allowed_file = $result->fetchrow()) {
			$allowed_files[] = $allowed_file;
		}
		
		$tmpl->assign("allowed_files", $allowed_files);
		$tmpl->assign("lang", $lang);
		$EOUT = $tmpl->fetch("forums/attachment.tpl");
	} else {
		
		
		
		if (isset($_REQUEST['action']) && $_GET['action'] == "upload") {
			$file_names = $_FILES['attachment']['name'];
			$tmp_file_names = $_FILES['attachment']['tmp_name'];
			$file_types = $_FILES['attachment']['type'];
			$file_sizes = $_FILES['attachment']['size'];
			
			///////////////////////////////////////////////////////
			// erlaubte dateitypen und die dazugehoerige
			// dateigroesse aus der datenbank holen
			// -
			// NOTE: MIME-Type fuer JPEG
			//  o Opera: image/jpeg
			//  o IE: image/pjpeg
			//  o Netscape: image/pjpeg
			///////////////////////////////////////////////////////
			$upload_dir = BASEDIR . "/uploads/attachment";
			$files = array();
			
			$q_allowed_files = "SELECT filetype, filesize FROM " . PREFIX . "_f_allowed_files";
			$r_allowed_files = new dbc($q_allowed_files);
			
			$allowed_type = array();
			$allowed_size = array();
			
			while ($allowed_file = $r_allowed_files->fetchrow()) {
				$allowed_type[] = $allowed_file->filetype;
				$allowed_size[$allowed_file->filetype] = $allowed_file->filesize;
			}
			
			// alle hochgeschickten dateien durchgehen
			for ($i = 0; $i < count($file_names); $i++) {
				if ($file_names[$i]	!= "") {
					$orig_name = $file_names[$i];
					//echo $file_types[$i] . "<br />";
					if (in_array($file_types[$i], $allowed_type)) {
						//      filesize in KB
						if ( ($file_sizes[$i] / 1024) <= $allowed_size[$file_types[$i]]) {
							
							$file_names[$i] = createFilename(BASEDIR . "/uploads/attachment/");
							if (move_uploaded_file($tmp_file_names[$i], $upload_dir . "/" . $file_names[$i])) {
								@chmod($upload_dir . "/" . $file_names[$i],0777);
								$q_attach = "
								INSERT INTO " . PREFIX . "_f_attachment (
									id,
									orig_name,
									filename
									)
								VALUES
									(
									'',
									'$orig_name',
									'" . $file_names[$i] . "'
									)
								";
								
								$r_attach = new dbc($q_attach);
								$file['id'] = $r_attach->getid();
							} // if move_uploaded_file
						} else {
							$file['forbidden'] = true;
							$file['reason'] = $lang['f_err_wrong_size'];
						}
					} else { // if allowed file type
						$file['forbidden'] = true;
						$file['reason'] = $lang['f_err_not_supported'];
					}
					
					$file['orig_name'] = $orig_name;
					$file['file_name'] = $prefix . $file_names[$i];
					$file['file_size'] = $file_sizes[$i];
					$file['file_type'] = $file_types[$i];
					$files[] = $file;
				} // if filename != ""
			} // for uploaded files
			
			$tmpl->assign("files", $files);
			$tmpl->assign("lang", $lang);
			
			$EOUT = $tmpl->fetch("forums/attachment.tpl");
		} // if action == upload
	}
}

// ================================================================================
//  <<-- Alle Poster des Threads anzeigen -->>
// ================================================================================
if (isset($_REQUEST['do']) && $_REQUEST['do'] == "showposter") {
	if ($_GET['tid'] != "") {
		$q_poster = "
		SELECT
		COUNT(u.uname) AS ucount,
		u.uid,
		u.uname
		FROM
		" . PREFIX . "_user AS u,
		" . PREFIX . "_f_post AS p
		WHERE
		p.topic_id = " . $_GET['tid'] . " AND
		p.uid = u.uid
		GROUP BY u.uname
		";
		
		$r_poster = new dbc($q_poster);
		
		$poster = array();
		
		while ($post = $r_poster->fetchrow()) {
			$poster[] = $post;
		}
		
		$tmpl->assign("poster", $poster);
		$tmpl->assign("lang", $lang);
		$EOUT = $tmpl->fetch("forums/poster.tpl");
		
	} else {
		$EOUT = msg("nopermission", "nopermission_t", str_replace("__URL__", "index.php?p=showforums", $lang['redirect']), "index.php?p=showforums");
		$NOOUT = 1;
	}
}


$MISC = 1;

?>