view.php

   1 <?php
   2 /* See file COPYING for permissions and conditions to use the file. */
   3 ?>
   4 <?php
   5 require_once("{$_SERVER['DOCUMENT_ROOT']}/extra/config.php");
   6 ?>
   7 <?php
   8 if (empty($_GET['id'])) {
   9         header("Location: $protocol://$server/index.php");
  10         exit;
  11 }
  12 $id = $_GET['id'];
  13 $result = mysqli_execute_query($dbc, "SELECT * FROM $msgtable WHERE msg_id=?", [$id]);
  14 if (mysqli_num_rows($result) != 1) {
  15         header("Location: $protocol://$server/index.php");
  16         exit;
  17 }
  18 $assoc = mysqli_fetch_assoc($result);
  19 mysqli_free_result($result);
  20 if ($assoc['r_pwlvl'] > 0 && !isset($_SESSION['auth'])) {
  21         /* unreadable for "normal" also unreadable for anonymous users */
  22         header("Location: $protocol://$server/account/login.php");
  23         exit;
  24 }
  25 foreach ($assoc as $k => $value) {
  26         $assoc[$k] = export_data($value);
  27 }
  28 /*
  29  * Groups are separated extensively so admins can config how they want
  30  * links to displays.
  31  * \\0 full url for sure.
  32  * \\3 for hostname
  33  * \\9 for path
  34  * \\2 for the protocol, \\1 for protocol with ://
  35  */
  36 $urlre = "((http{1}s?):\/\/)" . "((([[:alnum:]-])+(\.))+" . "([[:alnum:]]){2,6}"
  37 . "(:[0-9]{2,5})?)" . "(\/[[:alnum:]+=%#&_.:~?@\-\/]*)?";
  38
  39 $body = nl2br(preg_replace("/$urlre/ium", '<a href="\\0">\\0</a>',
  40               str_replace("&amp;", "&", $assoc['body'])), false);
  41
  42 $author = mysqli_fetch_assoc(mysqli_execute_query($dbc, "SELECT name, powerlevel FROM $table WHERE email='{$assoc['from_addr']}'"));
  43 ?>
  44 <?php
  45 $title = $assoc['subject'];
  46 include("{$_SERVER['DOCUMENT_ROOT']}/html/header.html");
  47 if ($assoc['r_pwlvl'] <= $_SESSION['powerlevel'])
  48 {
  49 ?>
  50 <h1><?=$assoc['subject']; ?></h1>
  51 <p><?php echo "Boi " .
  52 "<a href=\"$protocol://$server/profiles.php?email={$assoc['from_addr']}\">" .
  53 "{$author['name']}</a> " .
  54 "&lt;<a href=\"mailto:{$assoc['from_addr']}\">{$assoc['from_addr']}</a>&gt; ";
  55 ?></p>
  56 <?php
  57 if ($assoc['relate_to'] != 0) {
  58         echo "<p><a href=\"$protocol://$server/view.php?id={$assoc['relate_to']}\">Tin nhan truoc</a></p>";
  59 }
  60 ?>
  61 <pre><a href="<?php echo "$protocol://$server{$_SERVER['REQUEST_URI']}"; ?>"><?=$assoc['last_edit'];?></a></pre>
  62 <?php
  63 if ($assoc['w_pwlvl'] <= $_SESSION['powerlevel']) {
  64 echo "
  65 <p><a href=\"$protocol://$server/board.php?relate_to=$id\">Viet tra loi</a></p>
  66 ";
  67 }
  68 ?>
  69 <p><br><?=$body;?></p>
  70 <hr>
  71 <?php
  72 $rmsg_result = mysqli_execute_query($dbc, "SELECT * FROM $msgtable "
  73              . "WHERE relate_to=? AND r_pwlvl <= '{$_SESSION['powerlevel']}' "
  74              . "AND to_addr='{$assoc['to_addr']}' ORDER BY last_edit DESC", [$id]);
  75 $rmsg_count = mysqli_num_rows($rmsg_result);
  76 echo "<h3>Tra loi ($rmsg_count)</h3>";
  77 if ($rmsg_count > 0) {
  78         while ($rmsg = mysqli_fetch_assoc($rmsg_result)) {
  79                 echo "<h4>{$rmsg['subject']}</h4>";
  80                 echo "<p>Boi {$rmsg['from_addr']}<br></p>";
  81                 echo "<p>{$rmsg['body']}</p>";
  82                 echo "<pre><a href=\"$protocol://$server/view.php?" .
  83                      "id={$rmsg['msg_id']}\">{$rmsg['last_edit']}</a>
  84
  85 </pre>";
  86         }
  87 }
  88 ?>
  89 <?php
  90 } else {
  91         echo "<h3>Ban khong co quyen truy cap vao noi dung nay.</h3>";
  92 }
  93 include("{$_SERVER['DOCUMENT_ROOT']}/html/footer.html");
  94 ?>