wwwroot/nodes.php

   1 <?php
   2 // output buffering forcing (mx)
   3 if (!empty($_POST['FORCE_OB']) && $_POST['FORCE_OB'] == 'true') ob_start();
   4
   5 //header("Location: http://web.archive.org/web/20020925021139/http://kyberia.sk");
   6 //echo "je to uz uplne v pici. vsetky data su stratene, prajem pekny den :)";
   7 //exit;
   8
   9 //starting timer for benchmarking purposes
  10 $timer_start=Time()+SubStr(MicroTime(),0,8);
  11
  12 //setting PHPSESSID cookie and starting user session
  13 session_start();
  14
  15 error_reporting(1);
  16 //$_SESSION['debugging']=1;
  17 //exit;
  18
  19
  20 if ($_SESSION['debugging']) {
  21
  22     error_reporting(E_ALL);
  23     echo "GET VARIABLES::<br/>";
  24     print_r($_GET);
  25     echo "POST VARIABLES::<br/>";
  26     print_r($_POST);
  27     echo "<b>SESSION VARIABLES::</b><br/>";
  28     print_r($_SESSION);
  29 }
  30
  31 //requiring main config file with path/database etc. constants
  32 require('config/config.inc');
  33 require(INCLUDE_DIR.'senate.inc');
  34
  35 if (isset($_SERVER['HTTP_REFERER'])) {
  36         preg_match("/id\/([0-9]*)\//",$_SERVER['HTTP_REFERER'],$ref_match);
  37         $referer_id=$ref_match[1];
  38 }
  39
  40 //connecting to database and creating universal $db object
  41 require(INCLUDE_DIR.'log.inc');
  42 require(INCLUDE_DIR.'ubik.inc');
  43 require(INCLUDE_DIR.'nodes.inc');
  44 require(INCLUDE_DIR.'error_messages.inc');
  45 require(INCLUDE_DIR.'database.inc');
  46
  47 $db = new CLASS_DATABASE();
  48
  49 if (!empty($_GET['template_id'])) {
  50         $template_id=$_GET['template_id'];
  51 }
  52 else $template_id=false;
  53
  54 //initializing node methods
  55 if (!empty($_GET['node_name'])) {
  56         $node  = nodes::redirByName($_GET['node_name']);
  57 }
  58 elseif (!empty($_GET['node_id'])) {
  59         $node = nodes::getNodeById($_GET['node_id'],isset($_SESSION['user_id']))?$_SESSION['user_id']:'');
  60 }
  61
  62 //XXX Paths are wrong (!)
  63 //loading smarty template engine and setting main parameters
  64 require(SMARTY_DIR.'Smarty.class.php');
  65 $smarty = new Smarty;
  66
  67 //$smarty->php_handling = SMARTY_PHP_REMOVE; //XXX
  68 $smarty->template_dir = TEMPLATE_DIR;
  69 //echo TEMPLATE_DIR.TEMPLATE_SET;
  70 //echo $smarty->template_dir;
  71 $smarty->compile_dir = SYSTEM_DATA."templates_c/";
  72 $smarty->config_dir = SMARTY_DIR.'configs/'; //XXX neexistuje
  73 $smarty->cache_dir = SMARTY_DIR.'cache/';
  74 $smarty->plugins_dir = SMARTY_PLUGIN_DIR ;
  75 if ($_SESSION['debugging']) $smarty->debugging=true;
  76
  77 // initializing variables
  78 // preg_replace prevents LFI
  79 if (empty($_POST['event'])) $event=false;
  80 else $event= preg_replace( "![^a-zA-Z0-9_]+!", "", $_POST['event']);
  81
  82
  83 if ($_SESSION['debugging']) {
  84         echo "<pre><b>NODE::";
  85         print_r($node);
  86         echo "</pre>";
  87 }
  88
  89 if ((isset($_SESSION['user_id']) && ($node['node_creator']==$_SESSION['user_id']))) {
  90         $node['node_permission']='owner';
  91 }
  92
  93 if (isset($_SESSION['cube_vector']) && ($_SESSION['cube_vector'])) {
  94         if (strpos($node['node_vector'],$_SESSION['cube_vector'])===false) {
  95                 echo "node::".$node['node_vector'];
  96                 echo "cube_Vector::".$_SESSION['cube_vector'];
  97                 echo "you are out of allowed cwbe. access forbidden";
  98                 die();
  99         }
 100 }
 101
 102 //if not existent node show our own 404
 103 if (empty($node)) {
 104         $nodes= nodes::getNodesByName($_GET['node_name']);
 105         if ($nodes) {
 106                 $smarty->assign('nodes',$nodes);
 107                 $content=$smarty->display("404.tpl");
 108                 die();
 109         }
 110         elseif ($_SESSION['user_id']) {
 111                 $smarty->assign('node_name',$_GET['node_name']);
 112                 $content=$smarty->display("modules/addnode.tpl");
 113         }
 114 }
 115
 116 //modifying node glass pearl //XXX WTF
 117 if (is_array($children_types[$node['node_type']])) {
 118         $smarty->assign('children_types',$children_types[$node['node_type']]);
 119 }
 120 $smarty->assign('types',$types);
 121
 122
 123 //$node['node_type']=$types[$node['node_type']];
 124 $node['node_content']= StripSlashes($node['node_content']);
 125 $node['node_name']= StripSlashes($node['node_name']);
 126
 127 //checking permissions
 128 function _checkPermissions()
 129 {
 130         global $permissions, $node;
 131
 132         require(INCLUDE_DIR.'permissions.inc');
 133         $permissions=permissions::checkPermissions($node);
 134         $permissions['h']=permissions::isHierarch($node);
 135 }
 136
 137 // mail rss
 138 if ($template_id=='rss')
 139 {
 140         $_feedType = "RSS0.91";
 141         if (!is_numeric($_SESSION['user_id']))
 142         {
 143                 if (!isset($_SERVER['PHP_AUTH_USER'])) {
 144                         header('WWW-Authenticate: Basic realm="Kyberia"');
 145                         header('HTTP/1.0 401 Unauthorized');
 146                         echo 'Cancel button';
 147                         exit;
 148                 }
 149                 else
 150                 {
 151                         require_once(EVENT_DIR.'/login.inc');
 152                         $_POST['login'] = $_SERVER['PHP_AUTH_USER'];
 153                         $_POST['password'] = $_SERVER['PHP_AUTH_PW'];
 154                         $_POST['login_type'] = "name";
 155                         if (!login())
 156                         {
 157                                 echo "Zle meno/heslo.";
 158                                 exit();
 159                         }
 160                 }
 161         }
 162
 163         _checkPermissions();
 164
 165         // Mail
 166         if ($_GET['node_id']==='24' && $permissions['r'])
 167         {
 168            require_once(INCLUDE_DIR.'/feedcreator.class.php');
 169
 170            $rss = new UniversalFeedCreator();
 171            $rss->title = "Kyberia mail";
 172            $rss->description = "";
 173            $rss->link = "https://". SYSTEM_URL . "/id/24";
 174
 175            $query = "select date_format(mail.mail_timestamp,\"%e.%c. %k:%i:%s\") as cas,
 176    userfrom.user_action as locationfrom_action,
 177    userfrom.user_action_id as locationfrom_action_id,
 178    userto.user_action as locationto_action,
 179    userto.user_action_id as locationto_action_id,
 180    userto.login as mail_to_name, userfrom.login as mail_from_name,
 181    mail.* from mail left join users as userfrom on
 182    mail_from=userfrom.user_id left join users as userto on mail_to=userto.user_id
 183    where mail_user='$_SESSION[user_id]' and mail_to='$_SESSION[user_id]' order by mail_id desc limit 0,10";
 184
 185            $set = $db->query($query);
 186
 187            while($set->next()) {
 188                    $m = $set->getRecord();
 189                    if ($m['mail_to'] != $_SESSION['user_id'])
 190                            continue;
 191                    $item = new FeedItem();
 192                    $item->title = $m['mail_from_name'];
 193                    $item->link = "https://".SYSTEM_URL."/id/24";
 194                    $item->description = $m['mail_text'];
 195                    $rss->addItem($item);
 196            }
 197         }
 198         // bookmarks
 199         elseif ($_GET['node_id']=='19' && $permissions['r'])
 200         {
 201                 require_once(INCLUDE_DIR.'/feedcreator.class.php');
 202
 203                 $rss = new UniversalFeedCreator();
 204                 $rss->title = "Kyberia bookmarks";
 205                 $rss->link = "http://".SYSTEM_URL."/id/19";
 206
 207                 require_once(SMARTY_PLUGIN_DIR.'/function.get_bookmarks.php');
 208                 smarty_function_get_bookmarks(array(), $smarty);
 209                 $_items = $smarty->get_template_vars('get_bookmarks');
 210                 foreach ($_items as $_item)
 211                 {
 212                         if (is_array($_item['children']))
 213                                 foreach ($_item['children'] as $_b)
 214                                 {
 215                                         $item = new FeedItem();
 216                                         $item->title = $_b['node_name'];
 217                                         $item->link = "http://".SYSTEM_URL."/id/".$_b['node_id']."/rss";
 218                                         $rss->addItem($item);
 219                                 }
 220                 }
 221                 $_feedType = 'OPML';
 222         }
 223         elseif ($permissions['r'])
 224         {
 225                 require_once(INCLUDE_DIR.'/feedcreator.class.php');
 226
 227                 $rss = new UniversalFeedCreator();
 228                 $rss->title = $node['node_name'];
 229                 $rss->description = "";
 230                 $rss->link = "http://".SYSTEM_URL."/id/".$node['node_id'];
 231
 232                 // K list
 233                 if ($_GET['node_id']=='15')
 234                 {
 235                         require_once(SMARTY_PLUGIN_DIR.'/function.get_k.php');
 236                         smarty_function_get_k(array(), $smarty);
 237                         $_items = $smarty->get_template_vars('get_k');
 238                 }
 239                 else
 240                 {
 241                         require_once(SMARTY_PLUGIN_DIR.'/function.get_children.php');
 242                         smarty_function_get_children(
 243                                 array('orderby' => 'desc', 'orderby_type' => 'time'), $smarty);
 244                         $_items = $smarty->get_template_vars('get_children');
 245                 }
 246
 247                 foreach ($_items as $_item)
 248                 {
 249                         $item = new FeedItem();
 250                         $item->title = $_item['node_name'];
 251                         $item->link = "http://".SYSTEM_URL."/id/".$_item['node_id'];
 252                         $item->description = $_item['node_content'];
 253                         $rss->addItem($item);
 254                 }
 255         }
 256
 257         if ($permissions['r']) $rss->showFeed($_feedType);
 258         exit();
 259 }
 260
 261 _checkPermissions();
 262
 263 //entering the node
 264
 265 //sventest
 266 if (($permissions['r']) || ($event != 'register')) {
 267
 268 //performing node_events (based on update/insert/delete db queries)
 269 if ($event) {
 270         require(INCLUDE_DIR.'eventz.inc');
 271 }
 272
 273 elseif ($transaction) {
 274         require(INCLUDE_DIR.'transaction.inc');
 275 }
 276 //end of performing node events
 277
 278 //sventest
 279 }
 280
 281
 282 if ($permissions['r']) {
 283
 284 //these 4 lines are not the source of kyberia lagging problems. leave them. started on the 10.4. data gained will be used for scientific purposes
 285 if ($_SESSION['user_id']) {
 286         $q="insert delayed into levenshtein set user_id='".$_SESSION['user_id']."',node_id='".$node['node_id']."'";
 287         $db->update($q);
 288 }
 289
 290 //if node is css
 291 if ($node['template_id']!='2019721'){
 292
 293         logger::log('enter',$node['node_id'],'ok',$node['node_user_subchild_count']);
 294         if (!empty($_SESSION['user_id']) && is_numeric($node['node_id'])) {
 295                 $q="update node_access set visits=visits+1,node_user_subchild_count='0',last_visit=NOW() where node_id='".$node['node_id']."' and user_id='".$_SESSION['user_id']."'";
 296 //              echo $q;
 297                 $result=$db->update($q);
 298
 299                 if (!$result) {
 300                         $q="insert into node_access set user_id='".$_SESSION['user_id']."',node_id='".$node['node_id']."',last_visit=NOW()";
 301                         $db->query($q);
 302         }
 303 }//end of if node os css
 304 }
 305
 306
 307         }
 308 // DO NOT MESS WITH THIS !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 309 //creating neural network
 310 $db->update("update nodes set node_views=node_views+1 where node_id='".$node['node_id']."'");
 311 if (is_numeric($referer_id)) {
 312         $q="update neurons set synapse=synapse+1 where dst='".$node['node_id']."' and src='$referer_id'";
 313         $result=$db->update($q);
 314         if (!$result) {
 315                 $q="insert into neurons set synapse_creator='".$_SESSION['user_id']."',dst='".$node['node_id']."',src='$referer_id',synapse=1";
 316                 $db->query($q);
 317                 }
 318 }
 319
 320
 321 elseif (!$permissions['r'] && $_GET['magic_word']) {
 322         $magic_word_big=$_GET['magic_word'];
 323
 324         if ( preg_match("/(\d+)-(.+)/",$_GET['magic_word'],$mu)) {
 325                 $magic_uid=$mu['1'];
 326                 $magic_word=addslashes($mu['2']);
 327                 $q="select login from users where user_id='$magic_uid' and magic_word='$magic_word'";
 328                 $set=$db->query($q);
 329                 if ($set->getNumRows()) {
 330                         $permissions['r']=true;
 331                 }
 332         }
 333 }
 334
 335
 336
 337
 338
 339 else {
 340         logger::log('enter',$node['node_id'],'failed');
 341 }
 342
 343
 344
 345 //assigning user data to smarty if user logged in
 346 if ($user_id=$_SESSION['user_id']) {
 347         $smarty->assign('_POST',$_POST);
 348         $smarty->assign('bookmarks',$_SESSION['bookmarks']);
 349         $smarty->assign('ignore',$_SESSION['ignore']);
 350         $smarty->assign('bookstyl',$_SESSION['bookstyl']);
 351         $smarty->assign('fook',$_SESSION['fook']);
 352         $smarty->assign('user_id',$_SESSION['user_id']);
 353         if (!empty($_SESSION['cube_vector']))
 354                 $smarty->assign('cube_vector',$_SESSION['cube_vector']);
 355         $smarty->assign('friends',$_SESSION['friends']); //req by freezy, done by darkaural
 356         $smarty->assign('user_quota',$_SESSION['user_quota']);
 357
 358         $newmail_q = sprintf('select u.user_mail_id
 359                                 , u.user_k
 360                                 , u.k_wallet
 361                                 , u.user_mail
 362                                 , ms.user_id as mail_sender_id
 363                                 , ms.login as mail_sender
 364                                 from users u
 365                                 left join users ms on ms.user_id = u.user_mail_id
 366                                 where u.user_id = %d',
 367                                 $user_id);
 368         $newmailset = $db->query($newmail_q);
 369
 370 //$newmailset=$db->query("select user_mail,user_mail_name,user_k,k_wallet from users where user_id='$user_id'");
 371
 372         $newmailset->next();
 373         $new_mail=$newmailset->getString('user_mail');
 374         $newmailset2 = $db->query("select users.user_mail_id,mailsender.login
 375  from users left join users as mailsender on users.user_mail_id = mailsender.user_id where users.user_id = '$user_id'");
 376         $newmailset2->next();
 377         $smarty->assign('new_mail',$new_mail);
 378         $smarty->assign('new_mail_name',$newmailset->getString('mail_sender'));
 379         $smarty->assign('new_mail_name2',$newmailset2->getString('login'));
 380         $user_k=$newmailset->getString('user_k');
 381         $smarty->assign('user_k',$user_k);
 382         $k_wallet=$newmailset->getString('k_wallet');
 383         $smarty->assign('k_wallet',$k_wallet);
 384         $user_id=$_SESSION['user_id'];
 385
 386         //mail node
 387         if ($node['node_name']=='mail') {
 388
 389                 //clear new mail message
 390                 if ($new_mail) $db->query("update users set user_mail=0 where user_id='$user_id'");
 391
 392                 //set messages as delivered to recipient
 393                 $set=$db->query("select mail_id,mail_duplicate_id from mail where mail_user='$user_id' and mail_to='$user_id' and mail_read='no'");
 394                 while($set->next()) {
 395                         $db->query("update mail set mail_read='yes' where mail_id='".$set->getString('mail_duplicate_id')."'");
 396                         $db->query("update mail set mail_read='yes' where mail_id='".$set->getString('mail_id')."'");
 397
 398                         $new_messages[$set->getString('mail_id')]=true;
 399                 }
 400 /*
 401                 if (count($new_messages)) {
 402                         $db->query("update mail set mail_read='yes' where mail_user='$user_id' and mail_user=mail_to and mail_read='no'");
 403                         $smarty->assign('new_messages',$new_messages);
 404
 405                 }
 406 */
 407         }
 408 }
 409
 410
 411
 412 if ($node['node_system_access']=='crypto') {
 413         $smarty->assign('crypto_pass',$_SESSION['crypto'][$node['node_id']]);
 414 }
 415
 416 $smarty->assign('error',$error);
 417 $smarty->assign('permissions',$permissions);
 418 $smarty->assign('current_vector',$node['node_vector']);
 419 if ($permissions['r']) $smarty->assign('node',$node);
 420 else {
 421
 422         $smarty->assign('node',$node);
 423         //new templates by Dark matter
 424         $smarty->template_dir=OWN_TEMPLATE_DIR;
 425
 426         $smarty->display('1549864.tpl');
 427         $smarty->display('1549885.tpl');
 428         $smarty->display('630526.tpl');
 429         die();
 430
 431         //redirect to mainpage
 432 // looks like poeple totaly hate this redirect!
 433 //      header("Location: /id/1");
 434 }
 435
 436
 437 if ($node['template_id']!='2019721'){
 438 //setting user location
 439 $q="update users set last_action=NOW(),user_location_vector='".$node['node_vector']."',user_action='".addslashes($node['node_name'])."',user_action_id='".$node['node_id']."' where user_id='".$_SESSION['user_id']."'";
 440 $db->executequery($q);
 441 }
 442
 443 $whole_time=SubStr((Time()+SubStr(MicroTime(),0,8)-$timer_start),0,7);
 444 $smarty->assign('whole_time',$whole_time);
 445
 446
 447 if ($template_id=='download' OR $template_id=='download.jpg') {
 448         if ($permissions['r']) {
 449         $linkname = SYSTEM_ROOT."/files/".$node['node_id'];
 450         $filename= readlink($linkname);
 451         $suffix=preg_replace("/(.*?)\.(.*?)/i","$2",$filename);
 452
 453         $ext = substr( $filename,-3 );
 454         if( $filename == "" ) {
 455            echo "ERROR: Empty file to download. ";
 456            exit;
 457         } elseif ( ! file_exists( $filename ) ) {
 458                 exit;
 459         };
 460         switch( strtolower($ext) ){
 461            case "pdf": $ctype="application/pdf";              break;
 462            case "exe": $ctype="application/octet-stream";      break;
 463            case "zip": $ctype="application/zip";              break;
 464            case "doc": $ctype="application/msword";            break;
 465            case "xls": $ctype="application/vnd.ms-excel";      break;
 466            case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
 467            case "gif": $ctype="image/gif";                    break;
 468            case "png": $ctype="image/png";                    break;
 469            case "jpg": $ctype="image/jpg";                    break;
 470            default:    $ctype="application/force-download";
 471         }
 472         $file=str_replace(" ","_",$node['node_name']).".$ext";
 473         header("Pragma: public");
 474         header("Expires: 0");
 475         header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
 476         header("Content-Type: $ctype");
 477         $user_agent = strtolower ($_SERVER["HTTP_USER_AGENT"]);
 478         if ((is_integer (strpos($user_agent, "msie"))) && (is_integer
 479         (strpos($user_agent, "win")))) {
 480            header( "Content-Disposition: filename=$file;" );
 481         } else  {
 482            header( "Content-Disposition: attachment;
 483         filename=$file;" );
 484         }
 485         header("Content-Transfer-Encoding: binary");
 486         header("Content-Length: ".filesize($filename));
 487         readfile("$filename");
 488         exit();
 489         }
 490         else { echo "you don't have permissions for downloading this data"; die(); }
 491 }
 492
 493 if ($node['template_id']=='2019721'){
 494 Header("Cache-control: max-age=3600");
 495 }else{
 496 Header("Cache-control: no-cache");
 497 Header("Expires:".gmdate("D, d M Y H:i:s")." GMT");
 498 header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");
 499 }
 500
 501
 502 //for cases like search & preview
 503         $smarty->assign('post_vars',$_POST);
 504 if (!empty($_POST['template_event'])) {
 505         $smarty->assign('template_event',$_POST['template_event']);
 506
 507 }
 508
 509 //setting listing parameters
 510         $children_count=$node['node_children_count'];
 511         $descendant_count=$node['node_descendant_count'];
 512
 513         if (is_numeric($_POST['listing_amount'])) $listing_amount=$_POST['listing_amount'];
 514         elseif (!empty($_SESSION['listing_amount'])) $listing_amount=$_SESSION['listing_amount'];
 515         else $listing_amount=DEFAULT_LISTING_AMOUNT;
 516         $smarty->assign('listing_amount',$listing_amount);
 517
 518         if ($_POST['listing_order']) $listing_order=$_POST['listing_order'];
 519         elseif (!empty($_SESSION['listing_order'])) $listing_order=$_SESSION['listing_order'];
 520         else $listing_order=DEFAULT_LISTING_ORDER;
 521         $smarty->assign('listing_order',$listing_order);
 522
 523         if (is_numeric($_POST['get_children_offset'])) $offset=$_POST['get_children_offset'];
 524         else $offset=0;
 525
 526
 527         //movement forward and backward
 528 //      if ($listing_order=='asc' && !$offset) $offset=$descendant_count-$listing_amount;
 529
 530         if ($_POST['get_children_move']=='<') {
 531                 $offset=$offset-$listing_amount;
 532               if ($offset<0) $offset=0;
 533         }
 534         elseif ($_POST['get_children_move']=='>') {
 535                 $offset=$offset+$listing_amount;
 536         }
 537         elseif ($_POST['get_children_move']=='>>') {
 538                 $offset=$descendant_count-$listing_amount;
 539         }
 540
 541         elseif ($_POST['get_children_move']=='<<') {
 542                $offset=0;
 543         }
 544         if ($offset<0) $offset=0;
 545         $_POST['offset']=$offset;
 546         $smarty->assign('offset',$offset);
 547
 548
 549 if ($node['external_link']=='header://svg' && !is_numeric($template_id)) {
 550         header("Content-Type: image/svg+xml");
 551 }
 552
 553 //show own header
 554 elseif ($_SESSION['header_id']==true) {
 555         $smarty->assign('header_id',$_SESSION['header_id']);
 556         $smarty->template_dir=OWN_TEMPLATE_DIR;
 557         $content=$smarty->fetch($_SESSION['header_id'].".tpl");
 558         $smarty->template_dir = TEMPLATE_DIR.TEMPLATE_SET;
 559         //not registered user
 560         if ($_SESSION['header_id']==2091520) {
 561                 echo $content;
 562                 session_destroy();
 563                 die();
 564         }
 565 }
 566
 567 $smarty->template_dir=OWN_TEMPLATE_DIR;
 568
 569 if (is_numeric($template_id)) {
 570         $content.=$smarty->fetch($template_id.".tpl");
 571 }
 572
 573 else {
 574         $template_id=$node['template_id'];
 575         $content.=$smarty->fetch($node['template_id'].".tpl");
 576 }
 577
 578 if ($template_id=='2019721'){
 579         $content=$smarty->fetch($template_id.".tpl");
 580         echo $content;
 581 }else{
 582         $time=SubStr((Time()+SubStr(MicroTime(),0,8)-$timer_start),0,7);
 583         echo $content;
 584 //      echo "<center>page generation took: $time second</center>";
 585 }
 586 //end of displaying
 587
 588 // output buffering forcing (mx)
 589 if (!empty($_POST['FORCE_OB']) && $_POST['FORCE_OB'] == 'true') ob_end_flush();
 590
 591 ?>