<?php

/**!info**

{

	"Plugin Name"  : "plugin_privatemessages_title",

	"Plugin URI"   : "http://enanocms.org/",

	"Description"  : "plugin_privatemessages_desc",

	"Author"       : "Dan Fuhry",

	"Version"      : "1.1.6",

	"Author URI"   : "http://enanocms.org/"

}

**!*/

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Copyright (C) 2006-2009 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

global $db, $session, $paths, $template, $plugins; // Common objects

function PrivateMessages_paths_init()

{

	register_special_page('PrivateMessages', 'specialpage_private_messages');

}

function page_Special_PrivateMessages()

{

	global $db, $session, $paths, $template, $plugins; // Common objects

	global $lang;

	if ( !$session->user_logged_in )

	{

		die_friendly($lang->get('etc_access_denied_short'), '<p>' . $lang->get('privmsgs_err_need_login', array('login_link' => makeUrlNS('Special', 'Login/' . $paths->page))) . '</p>');

	}

	$argv = Array();

	$argv[] = $paths->getParam(0);

	$argv[] = $paths->getParam(1);

	$argv[] = $paths->getParam(2);

	if ( !$argv[0] )

	{

		$argv[0] = 'InVaLiD';

	}

	switch($argv[0])

	{

		default:

			header('Location: '.makeUrlNS('Special', 'PrivateMessages/Folder/Inbox'));

			break;

		case 'View':

			$id = $argv[1];

			if ( !ctype_digit($id) )

			{

				die_friendly('Message error', '<p>Invalid message ID</p>');

			}

			$q = $db->sql_query('SELECT p.message_from, p.message_to, p.subject, p.message_text, p.date, p.folder_name, u.signature FROM '.table_prefix.'privmsgs AS p LEFT JOIN '.table_prefix.'users AS u ON (p.message_from=u.username) WHERE message_id='.$id.'');

			if ( !$q )

			{

				$db->_die('The message data could not be selected.');

			}

			$r = $db->fetchrow();

			$db->free_result();

			if ( ($r['message_to'] != $session->username && $r['message_from'] != $session->username ) || $r['folder_name']=='drafts' )

			{

				die_friendly($lang->get('etc_access_denied_short'), '<p>' . $lang->get('privmsgs_err_not_authorized_read') . '</p>');

			}

			if ( $r['message_to'] == $session->username )

			{

				$q = $db->sql_query('UPDATE '.table_prefix.'privmsgs SET message_read=1 WHERE message_id='.$id.'');

				$db->free_result();

				if ( !$q )

				{

					$db->_die('Could not mark message as read');

				}

			}

			$template->header();

			userprefs_show_menu();

			?>

				<br />

				<div class="tblholder"><table border="0" width="100%" cellspacing="1" cellpadding="4">

					<tr><th colspan="2"><?php echo $lang->get('privmsgs_lbl_message_from', array('sender' => htmlspecialchars($r['message_from']))); ?></th></tr>

					<tr><td class="row1"><?php echo $lang->get('privmsgs_lbl_subject') ?></td><td class="row1"><?php echo $r['subject']; ?></td></tr>

					<tr><td class="row2"><?php echo $lang->get('privmsgs_lbl_date') ?></td><td class="row2"><?php echo enano_date(ED_DATE | ED_TIME, $r['date']); ?></td></tr>

					<tr><td class="row1"><?php echo $lang->get('privmsgs_lbl_message') ?></td><td class="row1"><?php echo RenderMan::render($r['message_text']);

					if ( $r['signature'] != '' )

					{

						echo '<hr style="margin-left: 1em; width: 200px;" />';

						echo RenderMan::render($r['signature']);

					}

					?></td></tr>

					<tr><td colspan="2" class="row3"><a href="<?php echo makeUrlNS('Special', 'PrivateMessages/Compose/ReplyTo/'.$id); ?>"><?php echo $lang->get('privmsgs_btn_send_reply'); ?></a>  |  <a href="<?php echo makeUrlNS('Special', 'PrivateMessages/Delete/'.$id); ?>">Delete message</a>  |  <?php if($r['folder_name'] != 'archive') { ?><a href="<?php echo makeUrlNS('Special', 'PrivateMessages/Move/'.$id.'/Archive'); ?>"><?php echo $lang->get('privmsgs_btn_archive'); ?></a>  |  <?php } ?><a href="<?php echo makeUrlNS('Special', 'PrivateMessages/Folder/Inbox') ?>"><?php echo $lang->get('privmsgs_btn_return_to_inbox'); ?></a></td></tr>

				</table></div>

			<?php

			$template->footer();              

			break;

		case 'Move':

			$id = $argv[1];

			if ( !ctype_digit($id) )

			{

				die_friendly('Message error', '<p>Invalid message ID</p>');

			}

			$q = $db->sql_query('SELECT message_to FROM '.table_prefix.'privmsgs WHERE message_id='.$id.'');

			if ( !$q )

			{

				$db->_die('The message data could not be selected.');

			}

			$r = $db->fetchrow();

			$db->free_result();

			if ( $r['message_to'] != $session->username )

			{

				die_friendly($lang->get('etc_access_denied_short'), '<p>' . $lang->get('privmsgs_err_not_authorized_edit') . '</p>');

			}

			$fname = $argv[2];

			if ( !$fname || ( $fname != 'Inbox' && $fname != 'Outbox' && $fname != 'Sent' && $fname != 'Drafts' && $fname != 'Archive' ) )

			{

				die_friendly('Invalid request', '<p>The folder name "'.$fname.'" is invalid.</p>');

			}

			$q = $db->sql_query('UPDATE '.table_prefix.'privmsgs SET folder_name=\''.strtolower($fname).'\' WHERE message_id='.$id.';');

			$db->free_result();

			if ( !$q )

			{

				$db->_die('The message was not successfully moved.');

			}

			die_friendly($lang->get('privmsgs_msg_message_status'), '<p>' . $lang->get('privmsgs_msg_message_moved', array('folder' => $fname)) . '</p><p><a href="'.makeUrlNS('Special', 'PrivateMessages/Folder/Inbox').'">' . $lang->get('privmsgs_btn_return_to_inbox') . '</a></p>');

			break;

		case 'Delete':

			$id = $argv[1];

			if ( !ctype_digit($id) )

			{

				die_friendly('Message error', '<p>Invalid message ID</p>');

			}

			$q = $db->sql_query('SELECT message_to FROM '.table_prefix.'privmsgs WHERE message_id='.$id.'');

			if ( !$q )

			{

				$db->_die('The message data could not be selected.');

			}

			$r = $db->fetchrow();

			if ( $r['message_to'] != $session->username )

			{

				die_friendly($lang->get('etc_access_denied_short'), '<p>You are not authorized to delete this message.</p>');

			}

			$q = $db->sql_query('DELETE FROM '.table_prefix.'privmsgs WHERE message_id='.$id.';');

			if ( !$q )

			{

				$db->_die('The message was not successfully deleted.');

			}

			$db->free_result();

			die_friendly($lang->get('privmsgs_msg_message_status'), '<p>' . $lang->get('privmsgs_msg_message_deleted') . '</p><p><a href="'.makeUrlNS('Special', 'PrivateMessages/Folder/Inbox').'">' . $lang->get('privmsgs_btn_return_to_inbox') . '</a></p>');

			break;

		case 'Compose':

			if ( $argv[1]=='Send' && isset($_POST['_send']) )

			{

				// Check each POST DATA parameter...

				csrf_request_confirm();

				$errors = array();

				if(!isset($_POST['to']) || ( isset($_POST['to']) && $_POST['to'] == ''))

				{

					$errors[] = $lang->get('privmsgs_err_need_username');

				}

				if(!isset($_POST['subject']) || ( isset($_POST['subject']) && $_POST['subject'] == ''))

				{

					$errors[] = $lang->get('privmsgs_err_need_subject');

				}

				if(!isset($_POST['message']) || ( isset($_POST['message']) && $_POST['message'] == ''))

				{

					$errors[] = $lang->get('privmsgs_err_need_message');

				}

				if ( count($errors) < 1 )

				{

					$namelist = $_POST['to'];

					$namelist = str_replace(', ', ',', $namelist);

					$namelist = explode(',', $namelist);

					foreach($namelist as $n) { $n = $db->escape($n); }

					$subject = RenderMan::preprocess_text($_POST['subject']);

					$message = RenderMan::preprocess_text($_POST['message']);

					$base_query = 'INSERT INTO '.table_prefix.'privmsgs(message_from,message_to,date,subject,message_text,folder_name,message_read) VALUES';

					foreach($namelist as $n)

					{

						$base_query .= '(\''.$session->username.'\', \''.$n.'\', '.time().', \''.$subject.'\', \''.$message.'\', \'inbox\', 0),';

					}

					$base_query = substr($base_query, 0, strlen($base_query)-1) . ';';

					$result = $db->sql_query($base_query);

					$db->free_result();

					if ( !$result )

					{

						$db->_die('The message could not be sent.');

					}

					else

					{

						die_friendly($lang->get('privmsgs_msg_message_status'), '<p>' . $lang->get('privmsgs_msg_message_sent', array('inbox_link' => makeUrlNS('Special', 'PrivateMessages/Folder/Inbox'))) . '</p>');

					}

					return;

				}

			}

			else if ( $argv[1] == 'Send' && isset($_POST['_savedraft'] ) )

			{

				csrf_request_confirm();

				$errors = array();

				if ( !isset($_POST['to']) || ( isset($_POST['to']) && $_POST['to'] == '') )

				{

					$errors[] = $lang->get('privmsgs_err_need_username');

				}

				if ( !isset($_POST['subject']) || ( isset($_POST['subject']) && $_POST['subject'] == '') )

				{

					$errors[] = $lang->get('privmsgs_err_need_subject');

				}

				if ( !isset($_POST['message']) || ( isset($_POST['message']) && $_POST['message'] == '') )

				{

					$errors[] = $lang->get('privmsgs_err_need_message');

				}

				if ( count($errors) < 1 )

				{

					$namelist = $_POST['to'];

					$namelist = str_replace(', ', ',', $namelist);

					$namelist = explode(',', $namelist);

					foreach($namelist as $n)

					{

						$n = $db->escape($n);

					}

					if ( count($namelist) > MAX_PMS_PER_BATCH && !$session->get_permssions('mod_misc') )

					{

						die_friendly($lang->get('privmsgs_err_limit_exceeded_title'), '<p>' . $lang->get('privmsgs_err_limit_exceeded_body', array('limit' => MAX_PMS_PER_BATCH)) . '</p>');

					}

					$subject = $db->escape($_POST['subject']);

					$message = RenderMan::preprocess_text($_POST['message']);

					$base_query = 'INSERT INTO '.table_prefix.'privmsgs(message_from,message_to,date,subject,message_text,folder_name,message_read) VALUES';

					foreach($namelist as $n)

					{

						$base_query .= '(\''.$session->username.'\', \''.$n.'\', '.time().', \''.$subject.'\', \''.$message.'\', \'drafts\', 0),';

					}

					$base_query = substr($base_query, 0, strlen($base_query) - 1) . ';';

					$result = $db->sql_query($base_query);

					$db->free_result();

					if ( !$result )

					{

						$db->_die('The message could not be saved.');

					}

				}

			}

			else if(isset($_POST['_inbox']))

			{

				redirect(makeUrlNS('Special', 'PrivateMessages/Folder/Inbox'), '', '', 0);

			}

			if($argv[1] == 'ReplyTo' && preg_match('#^([0-9]+)$#', $argv[2]))

			{

				$to = '';

				$text = '';

				$subj = '';

				$id = $argv[2];

				$q = $db->sql_query('SELECT p.message_from, p.message_to, p.subject, p.message_text, p.date, p.folder_name, u.signature FROM '.table_prefix.'privmsgs AS p LEFT JOIN '.table_prefix.'users AS u ON (p.message_from=u.username) WHERE message_id='.$id.';');

				if ( !$q )

					$db->_die('The message data could not be selected.');

				$r = $db->fetchrow();

				$db->free_result();

				if ( ($r['message_to'] != $session->username && $r['message_from'] != $session->username ) || $r['folder_name'] == 'drafts' )

				{

					die_friendly($lang->get('etc_access_denied_short'), '<p>You are not authorized to view the contents of this message.</p>');

				}

				$subj = 'Re: ' . $r['subject'];

				$text = "\n\n\nOn " . enano_date(ED_DATE | ED_TIME, $r['date']) . ", " . $r['message_from'] . " wrote:\n> " . str_replace("\n", "\n> ", $r['message_text']); // Way less complicated than using a regex ;-)

				$tbuf = $text;

				while( preg_match("/\n([\> ]*?)\> \>/", $text) )

				{

					$text = preg_replace("/\n([\> ]*?)\> \>/", '\\1>>', $text);

					if ( $text == $tbuf )

						break;

					$tbuf = $text;

				}

				$to = $r['message_from'];

			}

			else

			{

				if ( ( $argv[1]=='to' || $argv[1]=='To' ) && $argv[2] )

				{

					$to = htmlspecialchars(str_replace('_', ' ', dirtify_page_id($argv[2])));

				}

				else

				{

					$to = '';

				}

				$text = '';

				$subj = '';

			}

				$template->header();

				userprefs_show_menu();

				if ( isset($errors) && count($errors) > 0 )

				{

					echo '<div class="warning-box">

									' . $lang->get('privmsgs_err_send_submit') . '

									<ul>

										<li>' . implode('</li><li>', $errors) . '</li>

									</ul>

								</div>';

				}

				echo '<form action="'.makeUrlNS('Special', 'PrivateMessages/Compose/Send').'" method="post">';

				if ( isset($_POST['_savedraft']) )

				{

					echo '<div class="info-box">' . $lang->get('privmsgs_msg_draft_saved') . '</div>';

				}

				?>

				<br />

				<input type="hidden" name="cstok" value="<?php echo $session->csrf_token; ?>" />

				<div class="tblholder"><table border="0" width="100%" cellspacing="1" cellpadding="4">

					<tr>

						<th colspan="2"><?php echo $lang->get('privmsgs_lbl_compose_th'); ?></th>

					</tr>

					<tr>

						<td class="row1">

							<?php echo $lang->get('privmsgs_lbl_compose_to'); ?><br />

							<small><?php echo $lang->get('privmsgs_lbl_compose_to_max', array('limit' => MAX_PMS_PER_BATCH)); ?></small>

						</td>

						<td class="row1">

							<?php echo $template->username_field('to', (isset($_POST['_savedraft'])) ? $_POST['to'] : $to ); ?>

						</td>

					</tr>

					<tr>

						<td class="row2">

							<?php echo $lang->get('privmsgs_lbl_subject'); ?>

						</td>

						<td class="row2">

							<input name="subject" type="text" size="30" value="<?php if(isset($_POST['_savedraft'])) echo htmlspecialchars($_POST['subject']); else echo $subj; ?>" />

						</td>

					</tr>

					<tr>

						<td class="row1">

							<?php echo $lang->get('privmsgs_lbl_message'); ?>

						</td>

						<td class="row1" style="min-width: 80%;">

							<?php

								if ( isset($_POST['_savedraft']) )

								{

									$content = htmlspecialchars($_POST['message']);

								}

								else

								{

									$content =& $text;

								}

								echo $template->tinymce_textarea('message', $content, 20, 40);

							?>

						</td>

					</tr>

					<tr>

						<th class="subhead" colspan="2">

							<input type="submit" name="_send" value="<?php echo $lang->get('privmsgs_btn_send'); ?>" />

							<input type="submit" name="_savedraft" value="<?php echo $lang->get('privmsgs_btn_savedraft'); ?>" />

							<input type="submit" name="_inbox" value="<?php echo $lang->get('privmsgs_btn_return_to_inbox'); ?>" />

						</th>

					</tr>

				</table></div>

				<?php

				echo '</form>';

				$template->footer();

			break;

		case 'Edit':

			$id = $argv[1];

			if ( !ctype_digit($id) )

			{

				die_friendly('Message error', '<p>Invalid message ID</p>');

			}

			$q = $db->sql_query('SELECT message_from, message_to, subject, message_text, date, folder_name, message_read FROM '.table_prefix.'privmsgs WHERE message_id='.$id.'');

			if ( !$q )

			{

				$db->_die('The message data could not be selected.');

			}

			$r = $db->fetchrow();

			$db->free_result();

			if ( $r['message_from'] != $session->username || $r['message_read'] == 1 )

			{

				die_friendly($lang->get('etc_access_denied_short'), '<p>You are not authorized to edit this message.</p>');

			}

			$fname = $argv[2];

			if(isset($_POST['_send']))

			{

				// Check each POST DATA parameter...

				$errors = array();

				if(!isset($_POST['to']) || ( isset($_POST['to']) && $_POST['to'] == ''))

				{

					$errors[] = $lang->get('privmsgs_err_need_username');

				}

				if(!isset($_POST['subject']) || ( isset($_POST['subject']) && $_POST['subject'] == ''))

				{

					$errors[] = $lang->get('privmsgs_err_need_subject');

				}

				if(!isset($_POST['message']) || ( isset($_POST['message']) && $_POST['message'] == ''))

				{

					$errors[] = $lang->get('privmsgs_err_need_message');

				}

				if ( count($errors) < 1 )

				{

					$namelist = $_POST['to'];

					$namelist = str_replace(', ', ',', $namelist);

					$namelist = explode(',', $namelist);

					foreach ($namelist as $n)

					{

						$n = $db->escape($n);

					}

					$subject = RenderMan::preprocess_text($_POST['subject']);

					$message = RenderMan::preprocess_text($_POST['message']);

					$base_query = 'UPDATE '.table_prefix.'privmsgs SET subject=\''.$subject.'\',message_to=\''.$namelist[0].'\',message_text=\''.$message.'\',folder_name=\'inbox\' WHERE message_id='.$id.';';

					$result = $db->sql_query($base_query);

					$db->free_result();

					if ( !$result )

					{

						$db->_die('The message could not be sent.');

					}

					else

					{

						die_friendly($lang->get('privmsgs_msg_message_status'), '<p>' . $lang->get('privmsgs_msg_message_sent', array('inbox_link' => makeUrlNS('Special', 'PrivateMessages/Folder/Inbox'))) . '</p>');

					}

					return;

				}

			}

			else if ( isset($_POST['_savedraft']) )

			{

				csrf_request_confirm();

				// Check each POST DATA parameter...

				$errors = array();

				if(!isset($_POST['to']) || ( isset($_POST['to']) && $_POST['to'] == ''))

				{

					$errors[] = $lang->get('privmsgs_err_need_username');

				}

				if(!isset($_POST['subject']) || ( isset($_POST['subject']) && $_POST['subject'] == ''))

				{

					$errors[] = $lang->get('privmsgs_err_need_subject');

				}

				if(!isset($_POST['message']) || ( isset($_POST['message']) && $_POST['message'] == ''))

				{

					$errors[] = $lang->get('privmsgs_err_need_message');

				}

				if ( count($errors) < 1 )

				{

					$namelist = $_POST['to'];

					$namelist = str_replace(', ', ',', $namelist);

					$namelist = explode(',', $namelist);

					foreach ( $namelist as $n )

					{

						$n = $db->escape($n);

					}

					$subject = $db->escape($_POST['subject']);

					$message = RenderMan::preprocess_text($_POST['message']);

					$base_query = 'UPDATE '.table_prefix.'privmsgs SET subject=\''.$subject.'\',message_to=\''.$namelist[0].'\',message_text=\''.$message.'\' WHERE message_id='.$id.';';

					$result = $db->sql_query($base_query);

					$db->free_result();

					if ( !$result )

					{

						$db->_die('The message could not be saved.');

					}

				}

			}

				if ( $argv[1]=='to' && $argv[2] )

				{

					$to = htmlspecialchars($argv[2]);

				}

				else

				{

					$to = '';

				}

				$template->header();

				userprefs_show_menu();

				echo '<form action="'.makeUrlNS('Special', 'PrivateMessages/Edit/'.$id).'" method="post">';

				if ( isset($_POST['_savedraft']) )

				{

					echo '<div class="info-box">' . $lang->get('privmsgs_msg_draft_saved') . '</div>';

				}

				?>

				<input type="hidden" name="cstok" value="<?php echo $session->csrf_token; ?>" />

				<br />

				<div class="tblholder"><table border="0" width="100%" cellspacing="1" cellpadding="4">

					<tr><th colspan="2"><?php echo $lang->get('privmsgs_lbl_edit_th'); ?></th></tr>

					<tr>

						<td class="row1">

							<?php echo $lang->get('privmsgs_lbl_compose_to'); ?><br />

							<small><?php echo $lang->get('privmsgs_lbl_compose_to_max', array('limit' => MAX_PMS_PER_BATCH)); ?></small>

						</td>

						<td class="row1">

							<?php echo $template->username_field('to', (isset($_POST['_savedraft'])) ? $_POST['to'] : $r['message_to'] ); ?>

						</td>

					</tr>

					<tr>

						<td class="row2">

							<?php echo $lang->get('privmsgs_lbl_subject'); ?>

						</td>

						<td class="row2">

							<input name="subject" type="text" size="30" value="<?php if(isset($_POST['_savedraft'])) echo htmlspecialchars($_POST['subject']); else echo $r['subject']; ?>" />

						</td>

					</tr>

					<tr>