Initial commit.
This commit is contained in:
@@ -0,0 +1,253 @@
|
||||
<?
|
||||
require_once('../open_db.lib.php');
|
||||
require_once('../get_data.lib.php');
|
||||
|
||||
function save_data($id = NULL) {
|
||||
global $db, $is_admin, $queue, $action;
|
||||
$queue = get_queue();
|
||||
// Are we posting a story from the queue?
|
||||
if ($queue && $action == 'post')
|
||||
$move = TRUE;
|
||||
else
|
||||
$move = FALSE;
|
||||
$table = which_table($move, $action);
|
||||
|
||||
// extract POST variables (running through stripslashes)
|
||||
$result = get_post_data(TRUE);
|
||||
// assign their keys and values to the symbol table
|
||||
extract($result[0], EXTR_OVERWRITE);
|
||||
|
||||
// Process data...
|
||||
$story = sanitise($story);
|
||||
// Add the date if it's not got one
|
||||
if (!$date)
|
||||
$date = gmdate("Y-m-d H:i:s");
|
||||
// Verify image
|
||||
if ($move && isset($uploaded) && $uploaded === $id) {
|
||||
// Special case - transfer image from queue table
|
||||
$query = "SELECT img, mime FROM queue WHERE id = $id;";
|
||||
if ($getimg = $db->query($query)) {
|
||||
$row = $getimg->fetch_assoc();
|
||||
$img = $row['img'];
|
||||
$mime = $row['mime'];
|
||||
$getimg->close();
|
||||
} else {
|
||||
die("Error in query: $db->error");
|
||||
}
|
||||
} else {
|
||||
$image_file = save_uploaded_file();
|
||||
if ($image_file) {
|
||||
$img = fread(fopen($image_file, "r"), filesize($image_file));
|
||||
$mime = get_mimetype($image_file);
|
||||
}
|
||||
}
|
||||
|
||||
if (is_numeric($id) && !$move)
|
||||
$query = "UPDATE $table SET";
|
||||
else
|
||||
$query = "INSERT INTO $table SET";
|
||||
$query .= " `title` = '".$db->real_escape_string($title)."'"
|
||||
.", `author` = '".$db->real_escape_string($author)."'"
|
||||
.", `email` = '".$db->real_escape_string($email)."'"
|
||||
.", `editor` = '".$db->real_escape_string($editor)."'";
|
||||
if ($is_admin && isset($comments)) {
|
||||
$query .= ", `comments` = '".$db->real_escape_string($comments)."'";
|
||||
}
|
||||
if ($hidden) {
|
||||
$query .= ", `hidden` = TRUE";
|
||||
} else {
|
||||
$query .= ", `hidden` = FALSE";
|
||||
}
|
||||
if ($remove_img && $story) {
|
||||
$query .= ", `story` = '".$db->real_escape_string($story)."'";
|
||||
$query .= ", `mime` = NULL";
|
||||
$query .= ", `img` = NULL";
|
||||
} else if (isset($img)) {
|
||||
$query .= ", `mime` = '".$db->real_escape_string($mime)."'";
|
||||
$query .= ", `img` = '".$db->real_escape_string($img)."'";
|
||||
$query .= ", `story` = ''";
|
||||
} else {
|
||||
$query .= ", `story` = '".$db->real_escape_string($story)."'";
|
||||
}
|
||||
if (!is_numeric($id) || $move)
|
||||
$query .= ", `date` = '".$db->real_escape_string($date)."'";
|
||||
if (is_numeric($id) && !$move)
|
||||
$query .= " WHERE `id` = '".$id."' LIMIT 1;";
|
||||
else
|
||||
$query .= ";";
|
||||
|
||||
//echo $query;
|
||||
$result = $db->query($query) or die("Query failed: ".$db->error);
|
||||
|
||||
if (is_numeric($id) && $move) {
|
||||
$queue_id = $id;
|
||||
}
|
||||
|
||||
// Get the (new) ID if we don't already have it.
|
||||
if (!is_numeric($id) || $move) {
|
||||
$query = "SELECT LAST_INSERT_ID();";
|
||||
$getid = $db->query($query) or die("Query failed: ".$db->error());
|
||||
$row = $getid->fetch_row();
|
||||
$id = $row[0];
|
||||
}
|
||||
|
||||
// Delete the article in the queue if pushing live
|
||||
if ($move && $queue_id) {
|
||||
delete_story($queue_id, $move);
|
||||
$queue = FALSE;
|
||||
}
|
||||
|
||||
// Allow unprivileged user to view image on queue
|
||||
if (!$is_admin && $action == 'submit')
|
||||
$_SESSION['allow_queue_image'] = $id;
|
||||
|
||||
// Prune filesystem
|
||||
if ($image_file)
|
||||
prune_images($image_file);
|
||||
|
||||
// email admin if added to the queue
|
||||
if ($action == 'submit')
|
||||
send_email($title, $author, $story);
|
||||
|
||||
return $id;
|
||||
}
|
||||
|
||||
function delete_story($id, $move = FALSE) {
|
||||
global $db, $is_admin, $queue;
|
||||
$queue = get_queue();
|
||||
$table = which_table($move, 'delete');
|
||||
|
||||
$query = "DELETE FROM $table WHERE `id` = '".$id."' LIMIT 1;";
|
||||
//echo $query;
|
||||
$result = $db->query($query)or die("Query failed : ".$db->error());
|
||||
|
||||
if (!$move)
|
||||
$message = 'Article has been deleted.';
|
||||
|
||||
return $message;
|
||||
}
|
||||
|
||||
function get_mimetype($image_file) {
|
||||
$upload = getimagesize($image_file);
|
||||
$mimetype = $upload['mime'];
|
||||
return $mimetype;
|
||||
}
|
||||
|
||||
function save_uploaded_file() {
|
||||
// Save uploaded file to new, temporary location
|
||||
if (is_uploaded_file($_FILES['upload']['tmp_name'])) {
|
||||
$tmp_file = $_FILES['upload']['tmp_name'];
|
||||
$new_file = $_SERVER['DOCUMENT_ROOT'] . "/graphics" . $tmp_file;
|
||||
$end_dir = dirname($new_file);
|
||||
if (!is_dir($end_dir))
|
||||
mkdir($end_dir, "0644", 1);
|
||||
$image_file = $new_file;
|
||||
move_uploaded_file($tmp_file, $image_file);
|
||||
|
||||
// File has already been uploaded, get location
|
||||
} else if (isset($_POST['uploaded']) &&
|
||||
is_file($_SERVER['DOCUMENT_ROOT'] . $_POST['uploaded'])) {
|
||||
$image_file = realpath($_SERVER['DOCUMENT_ROOT'] . $_POST['uploaded']);
|
||||
}
|
||||
|
||||
if (isset($image_file)) {
|
||||
return $image_file;
|
||||
} else {
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
function prune_images($image_file) {
|
||||
// Delete image from filesystem, and cleanup anything older than $age
|
||||
$age = '86400'; // a day old
|
||||
$cleanup_dir = dirname($image_file);
|
||||
unlink($image_file);
|
||||
|
||||
if ( $dir_handle = @opendir($cleanup_dir) ) {
|
||||
if($dir_handle=='.' || $dir_handle=='..') continue;
|
||||
while ($cleanup_file = readdir ($dir_handle)) {
|
||||
$cleanup_file = $cleanup_dir . "/". $cleanup_file;
|
||||
if (@filemtime($cleanup_file) < (time() - $age)) {
|
||||
@unlink($cleanup_file);
|
||||
}
|
||||
}
|
||||
closedir($dir_handle);
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Validate data
|
||||
*
|
||||
* Updates the global $validate array, with the key as the element name, and the value set to the error message.
|
||||
*
|
||||
*/
|
||||
$validate = array();
|
||||
function validate_data() {
|
||||
global $validate;
|
||||
// extract POST variables (running through stripslashes)
|
||||
$result = get_post_data(TRUE);
|
||||
// assign their keys and values to the symbol table
|
||||
extract($result[0], EXTR_OVERWRITE);
|
||||
|
||||
|
||||
if (!$author) {
|
||||
$validate['author'] = "You have not submitted an author.";
|
||||
}
|
||||
|
||||
if (!$title) {
|
||||
$validate['title'] = "You have not submitted a title.";
|
||||
}
|
||||
|
||||
if ($remove_img && !$story) {
|
||||
$validate['story'] = "You've tried to remove an image without replacing it with text.";
|
||||
}
|
||||
|
||||
// 0 == no error; 4 == no file; all others are errors.
|
||||
if ($_FILES['upload']['error'] > 0 &&
|
||||
$_FILES['upload']['error'] !== 4) {
|
||||
$validate['upload'] = 'There was an error uploading the file ('.$_FILES['upload']['error'].')';
|
||||
} else if ($_FILES['upload']['tmp_name']) {
|
||||
$upload = getimagesize($_FILES['upload']['tmp_name']);
|
||||
if (!$upload)
|
||||
$validate['upload'] = htmlspecialchars($_FILES['upload']['name']) .
|
||||
" wasn't an image file. Please go back.";
|
||||
}
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
function sanitise($story) {
|
||||
if ($story) {
|
||||
// No Javascript please!
|
||||
$story = preg_replace("#<script[^>]*?>.*?</script>#si", "", $story);
|
||||
// No comments please!
|
||||
$story = preg_replace("#<!--.*?-->#si", "", $story);
|
||||
// Replace number ranges with n-dashes
|
||||
$stort = preg_replace("#(\d)-+(\d)#si", "$1–$2", $story);
|
||||
// Replace " -- " and "--" with m-dashes
|
||||
$story = preg_replace("#(\s?)--(\s?)#si", "$1—$2", $story);
|
||||
// Replace ellipses
|
||||
$story = preg_replace("#(\w|\p{P}|>)\. ?\. ?\.(\s|\p{P})#si", "$1…$2", $story);
|
||||
|
||||
// External processing
|
||||
include_once('../lib/smartypants.inc.php');
|
||||
$story = SmartyPants($story);
|
||||
#include_once('../lib/convert_entities.inc.php');
|
||||
#$story = html_entity_decode_full($story); // Convert named entities to numeric entities
|
||||
// Won't worry about HTML Purifier yet
|
||||
}
|
||||
return $story;
|
||||
}
|
||||
|
||||
function send_email($title, $author, $story) {
|
||||
include_once('../lib/convert_entities.inc.php');
|
||||
$to = 'editor@xxx.org.za';
|
||||
$subject = "New submission: $title";
|
||||
$headers = 'From: x.x.x Queue <editor@xxx.org.za>'."\r\n";
|
||||
$message = "Please review the queue. $author has sent the following new submission:\n\n";
|
||||
if ($story)
|
||||
$message .= wordwrap(preg_replace("#(<br.?/?>|</p>)#", "\n", strip_tags(stripslashes(html_entity_decode_full($story)))));
|
||||
else
|
||||
$message .= "<Submission is an image. Review on the site.>";
|
||||
$message .= "\n\nhttp://xxx.org.za/publish/edit";
|
||||
mb_send_mail($to, $subject, $message, $headers);
|
||||
}
|
||||
Reference in New Issue
Block a user