diff --git a/phpBB/db/postgres_schema.sql b/phpBB/db/postgres_schema.sql index c3979e9b9a..fa39fde506 100644 --- a/phpBB/db/postgres_schema.sql +++ b/phpBB/db/postgres_schema.sql @@ -269,8 +269,8 @@ CREATE TABLE phpbb_privmsgs ( privmsgs_bbcode_uid int4 DEFAULT '0' NOT NULL, CONSTRAINT phpbb_privmsgs_pkey PRIMARY KEY (privmsgs_id) ); -CREATE INDEX privmsgs_from_groupid_phpbb_privmsgs_index ON phpbb_privmsgs (privmsgs_from_groupid); -CREATE INDEX privmsgs_to_groupid_phpbb_privmsgs_index ON phpbb_privmsgs (privmsgs_to_groupid); +CREATE INDEX privmsgs_from_groupid_index ON phpbb_privmsgs (privmsgs_from_groupid); +CREATE INDEX privmsgs_to_groupid_index ON phpbb_privmsgs (privmsgs_to_groupid); /* -------------------------------------------------------- diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php index ec65707b46..0825bcf8c9 100644 --- a/phpBB/includes/functions.php +++ b/phpBB/includes/functions.php @@ -67,14 +67,14 @@ function get_db_stat($mode) } } -function get_userdata_from_id($userid) +function get_userdata_from_id($userid) { global $db; - $sql = "SELECT * - FROM ".USERS_TABLE." + $sql = "SELECT * + FROM ".USERS_TABLE." WHERE user_id = $userid"; - if(!$result = $db->sql_query($sql)) + if(!$result = $db->sql_query($sql)) { $userdata = array("error" => "1"); return ($userdata); @@ -95,9 +95,9 @@ function get_userdata($username) { global $db; - $sql = "SELECT * - FROM ".USERS_TABLE." - WHERE username = '$username' + $sql = "SELECT * + FROM ".USERS_TABLE." + WHERE username = '$username' AND user_level != ".DELETED; if(!$result = $db->sql_query($sql)) { @@ -410,4 +410,63 @@ function generate_pagination($base_url, $num_items, $per_page, $start_item, $add } +// +// Check to see if the username has been taken, or if it is disallowed. +// Used for registering, changing names, and posting anonymously with a username +// +function validate_username($username) +{ + + global $db; + + switch(SQL_LAYER) + { + // Along with subqueries MySQL also lacks + // a UNION clause which would be very nice here :( + // So we have to use two queries + case 'mysql': + $sql_users = "SELECT username + FROM ".USERS_TABLE." + WHERE LOWER(username) = '".strtolower($username)."'"; + $sql_disallow = "SELECT disallow_username + FROM ".DISALLOW_TABLE." + WHERE disallow_username = '$username'"; + + if($result = $db->sql_query($sql_users)) + { + if($db->sql_numrows($result) > 0) + { + return(FALSE); + } + } + if($result = $db->sql_query($sql_disallow)) + { + if($db->sql_numrows($result) > 0) + { + return(FALSE); + } + } + break; + + default: + $sql = "SELECT disallow_username + FROM ".DISALLOW_TABLE." + WHERE disallow_username = '$username' + UNION + SELECT username + FROM ".USERS_TABLE." + WHERE LOWER(username) = '".strtolower($username)."'"; + + if($result = $db->sql_query($sql)) + { + if($db->sql_numrows($result) > 0) + { + return(FALSE); + } + } + break; + } + + return(TRUE); +} ?> diff --git a/phpBB/index.php b/phpBB/index.php index cb6ecb8e7a..cfdfe6c98a 100644 --- a/phpBB/index.php +++ b/phpBB/index.php @@ -136,7 +136,7 @@ if($total_categories) { case 'postgresql': $limit_forums = ($viewcat != -1) ? "AND f.cat_id = $viewcat " : ""; - $sql = "SELECT f.*, t.topic_id, t.topic_replies, t.topic_last_post_id, u.username, u.user_id, p.post_time + $sql = "SELECT f.*, t.topic_id, t.topic_replies, t.topic_last_post_id, u.username, u.user_id, p.post_time, p.post_username FROM ".FORUMS_TABLE." f, ".TOPICS_TABLE." t, ".POSTS_TABLE." p, ".USERS_TABLE." u, ".AUTH_FORUMS_TABLE." af WHERE f.forum_last_post_id = p.post_id AND p.post_id = t.topic_last_post_id @@ -144,7 +144,7 @@ if($total_categories) AND af.forum_id = f.forum_id $limit_forums UNION ( - SELECT f.*, NULL, NULL, NULL, NULL, NULL, NULL + SELECT f.*, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM ".FORUMS_TABLE." f WHERE NOT EXISTS ( SELECT p.post_time @@ -158,7 +158,7 @@ if($total_categories) case 'oracle': $limit_forums = ($viewcat != -1) ? "AND f.cat_id = $viewcat " : ""; - $sql = "SELECT f.*, t.topic_id, t.topic_replies, t.topic_last_post_id, u.username, u.user_id, p.post_time + $sql = "SELECT f.*, t.topic_id, t.topic_replies, t.topic_last_post_id, u.username, u.user_id, p.post_time, p.post_username FROM ".FORUMS_TABLE." f, ".POSTS_TABLE." p, ".TOPICS_TABLE." t, ".USERS_TABLE." u, ".AUTH_FORUMS_TABLE." af WHERE f.forum_last_post_id = p.post_id(+) AND p.post_id = t.topic_last_post_id(+) @@ -180,7 +180,7 @@ if($total_categories) $limit_forums ORDER BY f.cat_id, f.forum_order"; */ - $sql = "SELECT f.*, t.topic_id, t.topic_replies, t.topic_last_post_id, u.username, u.user_id, p.post_time, af.auth_view, af.auth_read, af.auth_post, af.auth_reply, af.auth_edit, af.auth_delete, af.auth_votecreate, af.auth_vote + $sql = "SELECT f.*, t.topic_id, t.topic_replies, t.topic_last_post_id, u.username, u.user_id, p.post_time, p.post_username, af.auth_view, af.auth_read, af.auth_post, af.auth_reply, af.auth_edit, af.auth_delete, af.auth_votecreate, af.auth_vote FROM ((( ".FORUMS_TABLE." f LEFT JOIN ".POSTS_TABLE." p ON f.forum_last_post_id = p.post_id ) LEFT JOIN ".TOPICS_TABLE." t ON p.post_id = t.topic_last_post_id ) @@ -282,11 +282,18 @@ if($total_categories) if($forum_rows[$j]['username'] != "" && $forum_rows[$j]['post_time'] > 0) { - + if($forum_rows[$j]['user_id'] == ANONYMOUS && $forum_rows[$j]['post_username'] != '') + { + $last_poster = $forum_rows[$j]['post_username']; + } + else + { + $last_poster = $forum_rows[$j]['username']; + } $last_post_time = create_date($board_config['default_dateformat'], $forum_rows[$j]['post_time'], $board_config['default_timezone']); $last_post = $last_post_time . "
by "; - $last_post .= "" . $forum_rows[$j]['username'] . " "; + $last_post .= "" . $last_poster . " "; $last_post .= "\"View"; diff --git a/phpBB/language/lang_english.php b/phpBB/language/lang_english.php index bff0043c3b..6e99840a74 100755 --- a/phpBB/language/lang_english.php +++ b/phpBB/language/lang_english.php @@ -135,6 +135,7 @@ $lang['Sticky'] = "Sticky:"; // // Viewtopic // +$lang['Guest'] = 'Guest'; // // Posting/Replying (Not private @@ -168,6 +169,7 @@ $lang['Date'] = "Date"; $lang['Website'] = "Website"; $lang['From'] = "From"; $lang['Wrong_Profile'] = "You cannot modify a profile that is not your own."; +$lang['Bad_username'] = "The username you choose has been taken or is disallowed by the administrator."; // // Memberslist diff --git a/phpBB/posting.php b/phpBB/posting.php index d52e238c10..71ab1992b2 100644 --- a/phpBB/posting.php +++ b/phpBB/posting.php @@ -110,8 +110,7 @@ switch($mode) } break; case 'reply': - - $auth_type = AUTH_REPLY; + $auth_type = AUTH_ALL; $is_auth_type = "auth_reply"; $error_string = "reply to topics"; break; @@ -171,6 +170,8 @@ $attach_sig = (isset($HTTP_POST_VARS['attach_sig'])) ? $HTTP_POST_VARS['attach_s $notify = (isset($HTTP_POST_VARS['notify'])) ? $HTTP_POST_VARS['notify'] : $userdata["always_notify"]; $annouce = (isset($HTTP_POST_VARS['annouce'])) ? $HTTP_POST_VARS['annouce'] : ""; $sticky = (isset($HTTP_POST_VARS['sticky'])) ? $HTTP_POST_VARS['sticky'] : ""; +$preview = (isset($HTTP_POST_VARS['preview'])) ? TRUE : FALSE; + if($annouce) { @@ -188,12 +189,12 @@ else // // Prepare our message and subject on a 'submit' // -if(isset($HTTP_POST_VARS['submit'])) +if(isset($HTTP_POST_VARS['submit']) || $preview) { // // Flood control // - if($mode != 'editpost') + if($mode != 'editpost' && !$preview) { $sql = "SELECT max(post_time) AS last_post_time FROM ".POSTS_TABLE." @@ -215,6 +216,25 @@ if(isset($HTTP_POST_VARS['submit'])) // End: Flood control // + // Handle anon posting with usernames + if(isset($HTTP_POST_VARS['username'])) + { + $username = trim(strip_tags(htmlspecialchars(stripslashes($HTTP_POST_VARS['username'])))); + if(!validate_username($username)) + { + $error = TRUE; + if(isset($error_msg)) + { + $error_msg .= "
"; + } + $error_msg .= $lang['Bad_username']; + } + } + else + { + $username = ""; + } + $subject = trim(strip_tags(htmlspecialchars($HTTP_POST_VARS['subject']))); if($mode == 'newtopic' && empty($subject)) { @@ -239,7 +259,7 @@ if(isset($HTTP_POST_VARS['submit'])) if(!empty($HTTP_POST_VARS['message'])) { - if(!$error) + if(!$error && !$preview) { if($disable_html) { @@ -312,8 +332,12 @@ switch($mode) } } - if(isset($HTTP_POST_VARS['submit']) && !$error) + if(isset($HTTP_POST_VARS['submit']) && !$error && !$preview) { + if($username) + { + $username = addslashes($username); + } $topic_time = get_gmt_ts(); $topic_notify = ($HTTP_POST_VARS['notify']) ? $HTTP_POST_VARS['notify'] : 0; $sql = "INSERT INTO ".TOPICS_TABLE." (topic_title, topic_poster, topic_time, forum_id, topic_notify, topic_status, topic_type) @@ -322,8 +346,8 @@ switch($mode) if($db->sql_query($sql)) { $new_topic_id = $db->sql_nextid(); - $sql = "INSERT INTO ".POSTS_TABLE." (topic_id, forum_id, poster_id, post_time, poster_ip, bbcode_uid) - VALUES ($new_topic_id, $forum_id, ".$userdata['user_id'].", $topic_time, '$user_ip', '$uid')"; + $sql = "INSERT INTO ".POSTS_TABLE." (topic_id, forum_id, poster_id, post_username, post_time, poster_ip, bbcode_uid) + VALUES ($new_topic_id, $forum_id, ".$userdata['user_id'].", '".$username."', $topic_time, '$user_ip', '$uid')"; if($db->sql_query($sql)) { @@ -504,7 +528,7 @@ switch($mode) $page_title = " $l_reply"; $section_title = $l_postreplyto; - if(isset($HTTP_POST_VARS['submit']) && !$error) + if(isset($HTTP_POST_VARS['submit']) && !$error && !$preview) { if($SQL_LAYER != "mysql") { @@ -519,11 +543,16 @@ switch($mode) } } + if($username) + { + $username = addslashes($username); + } + $new_topic_id = $HTTP_POST_VARS[POST_TOPIC_URL]; $topic_time = get_gmt_ts(); - $sql = "INSERT INTO ".POSTS_TABLE." (topic_id, forum_id, poster_id, post_time, poster_ip, bbcode_uid) - VALUES ($new_topic_id, $forum_id, ".$userdata['user_id'].", $topic_time, '$user_ip', '$uid')"; + $sql = "INSERT INTO ".POSTS_TABLE." (topic_id, forum_id, poster_id, post_username, post_time, poster_ip, bbcode_uid) + VALUES ($new_topic_id, $forum_id, ".$userdata['user_id'].", '".$username."', $topic_time, '$user_ip', '$uid')"; if($db->sql_query($sql)) { @@ -673,7 +702,7 @@ switch($mode) case 'editpost': $page_title = " $l_editpost"; $section_title = $l_editpostin; - if(isset($HTTP_POST_VARS['submit']) && !$error) + if(isset($HTTP_POST_VARS['submit']) && !$error && !$preview) { if(isset($HTTP_POST_VARS['delete_post'])) { @@ -724,7 +753,7 @@ switch($mode) } } } - else + else if(!$preview) { $post_id = ($HTTP_GET_VARS[POST_POST_URL]) ? $HTTP_GET_VARS[POST_POST_URL] : $HTTP_POST_VARS[POST_POST_URL]; if(!empty($post_id)) @@ -832,6 +861,36 @@ if($error) // End: error handling // +if(!isset($username)) +{ + $username = $userdata["username"]; +} + +// +// Start: Preview Post +// +if($preview) +{ + $preview_message = $message; + $uid = make_bbcode_uid(); + $preview_message = prepare_message($preview_message, TRUE, TRUE, TRUE, $uid); + $preview_message = bbencode_second_pass($preview_message, $uid); + $preview_message = make_clickable($preview_message); + + $template->set_filenames(array("preview" => "posting_preview.tpl")); + $template->assign_vars(array( + "TOPIC_TITLE" => $subject, + "ROW_COLOR" => $theme['td_color1'], + "POSTER_NAME" => $username, + "L_POSTED" => $lang['Posted'], + "POST_DATE" => create_date($board_config['default_dateformat'], time(), $board_config['default_timezone']), + "MESSAGE" => stripslashes(nl2br($preview_message)))); + $template->pparse("preview"); +} +// +// End: Preview Post +// + // // Show the same form for each mode. // @@ -876,10 +935,6 @@ if($error) } else { - if(!isset($username)) - { - $username = $userdata["username"]; - } $username_input = ''; $password_input = ''; } diff --git a/phpBB/profile.php b/phpBB/profile.php index a0ee1e8f34..b595e04d99 100644 --- a/phpBB/profile.php +++ b/phpBB/profile.php @@ -37,61 +37,7 @@ init_userprefs($userdata); // // Page specific functions // -function validate_username($username) -{ - global $db; - - switch(SQL_LAYER) - { - // Along with subqueries MySQL also lacks - // a UNION clause which would be very nice here :( - // So we have to use two queries - case 'mysql': - $sql_users = "SELECT username - FROM ".USERS_TABLE." - WHERE LOWER(username) = '".strtolower($username)."'"; - $sql_disallow = "SELECT disallow_username - FROM ".DISALLOW_TABLE." - WHERE disallow_username = '$username'"; - - if($result = $db->sql_query($sql_users)) - { - if($db->sql_numrows($result) > 0) - { - return(FALSE); - } - } - if($result = $db->sql_query($sql_disallow)) - { - if($db->sql_numrows($result) > 0) - { - return(FALSE); - } - } - break; - - default: - $sql = "SELECT disallow_username - FROM ".DISALLOW_TABLE." - WHERE disallow_username = '$username' - UNION - SELECT username - FROM ".USERS_TABLE." - WHERE LOWER(username) = '".strtolower($username)."'"; - - if($result = $db->sql_query($sql)) - { - if($db->sql_numrows($result) > 0) - { - return(FALSE); - } - } - break; - } - - return(TRUE); -} function language_select($default, $dirname="language/") { global $phpEx; diff --git a/phpBB/templates/Default/posting_body.tpl b/phpBB/templates/Default/posting_body.tpl index e6f6e1c341..6afc43cea7 100644 --- a/phpBB/templates/Default/posting_body.tpl +++ b/phpBB/templates/Default/posting_body.tpl @@ -1,11 +1,11 @@