xxx/publish/post.lib.php

<? 
require_once('../open_db.lib.php');
require_once('../get_data.lib.php');

function save_data($id = NULL) {
  global $db, $is_admin, $queue, $action;
  $queue = get_queue();
  // Are we posting a story from the queue?
  if ($queue && $action == 'post')
    $move = TRUE;
  else
    $move = FALSE;
  $table = which_table($move, $action);

  // extract POST variables (running through stripslashes)
  $result = get_post_data(TRUE);
  // assign their keys and values to the symbol table
  extract($result[0], EXTR_OVERWRITE);
 
  // Process data...
  $story = sanitise($story);
  // Add the date if it's not got one
  if (!$date) 
    $date = gmdate("Y-m-d H:i:s");
  // Verify image
  if ($move && isset($uploaded) && $uploaded === $id) {
    // Special case - transfer image from queue table
    $query    = "SELECT img, mime FROM queue WHERE id = $id;";
    if ($getimg = $db->query($query)) {
      $row   = $getimg->fetch_assoc();
      $img   = $row['img'];
      $mime  = $row['mime'];
      $getimg->close();
    } else {
      die("Error in query: $db->error");
    }
  } else {
    $image_file = save_uploaded_file();
    if ($image_file) {
      $img  = fread(fopen($image_file, "r"), filesize($image_file));
      $mime = get_mimetype($image_file);
    }
  }

  if (is_numeric($id) && !$move)
    $query = "UPDATE $table SET";
  else
    $query = "INSERT INTO $table SET";
  $query .= " `title`  = '".$db->real_escape_string($title)."'"
          .", `author` = '".$db->real_escape_string($author)."'"
          .", `email`  = '".$db->real_escape_string($email)."'"
          .", `editor` = '".$db->real_escape_string($editor)."'";
  if ($is_admin && isset($comments)) {
    $query .= ", `comments` = '".$db->real_escape_string($comments)."'";
  }
  if ($hidden) {
    $query .= ", `hidden` = TRUE";
  } else {
    $query .= ", `hidden` = FALSE";
  }
  if ($remove_img && $story) {
    $query .= ", `story`  = '".$db->real_escape_string($story)."'";
    $query .= ", `mime`   = NULL";
    $query .= ", `img`    = NULL";
  } else if (isset($img)) {
    $query .= ", `mime`   = '".$db->real_escape_string($mime)."'";
    $query .= ", `img`    = '".$db->real_escape_string($img)."'";
    $query .= ", `story`  = ''";
  } else {
    $query .= ", `story`  = '".$db->real_escape_string($story)."'";
  }
  if (!is_numeric($id) || $move)
    $query .= ", `date`   = '".$db->real_escape_string($date)."'";
  if (is_numeric($id) && !$move)
    $query .= " WHERE  `id` = '".$id."' LIMIT 1;";
  else
    $query .= ";";
 
  //echo $query;
  $result = $db->query($query) or die("Query failed: ".$db->error);
  
  if (is_numeric($id) && $move) {
    $queue_id = $id;
  }

  // Get the (new) ID if we don't already have it.
  if (!is_numeric($id) || $move) {
    $query = "SELECT LAST_INSERT_ID();";
    $getid = $db->query($query) or die("Query failed: ".$db->error());
    $row = $getid->fetch_row();
    $id = $row[0];
  }

  // Delete the article in the queue if pushing live
  if ($move && $queue_id) {
    delete_story($queue_id, $move);
    $queue = FALSE;
  }

  // Allow unprivileged user to view image on queue
  if (!$is_admin && $action == 'submit')
    $_SESSION['allow_queue_image'] = $id;

  // Prune filesystem
  if ($image_file)
    prune_images($image_file);

  // email admin if added to the queue
  if ($action == 'submit')
    send_email($title, $author, $story);

  return $id;
}

function delete_story($id, $move = FALSE) {
  global $db, $is_admin, $queue;
  $queue = get_queue();
  $table = which_table($move, 'delete');

  $query = "DELETE FROM $table WHERE `id` = '".$id."' LIMIT 1;";
  //echo $query;
  $result = $db->query($query)or die("Query failed : ".$db->error());

  if (!$move)
    $message = 'Article has been deleted.';

  return $message;
}

function get_mimetype($image_file) {
  $upload = getimagesize($image_file);
  $mimetype = $upload['mime'];
  return $mimetype;
}

function save_uploaded_file() {
  // Save uploaded file to new, temporary location
  if (is_uploaded_file($_FILES['upload']['tmp_name'])) {
    $tmp_file = $_FILES['upload']['tmp_name'];
    $new_file = $_SERVER['DOCUMENT_ROOT'] . "/graphics" . $tmp_file;
    $end_dir  = dirname($new_file);
    if (!is_dir($end_dir)) 
      mkdir($end_dir, "0644", 1);
    $image_file = $new_file;
    move_uploaded_file($tmp_file, $image_file);

  // File has already been uploaded, get location
  } else if (isset($_POST['uploaded']) && 
             is_file($_SERVER['DOCUMENT_ROOT'] . $_POST['uploaded'])) {
    $image_file = realpath($_SERVER['DOCUMENT_ROOT'] . $_POST['uploaded']);
  }

  if (isset($image_file)) {
    return $image_file;
  } else {
    return FALSE;
  }
}

function prune_images($image_file) {
  // Delete image from filesystem, and cleanup anything older than $age
  $age = '86400'; // a day old
  $cleanup_dir =  dirname($image_file);
  unlink($image_file);

  if ( $dir_handle = @opendir($cleanup_dir) ) {
    if($dir_handle=='.' || $dir_handle=='..') continue;
    while ($cleanup_file = readdir ($dir_handle)) {
      $cleanup_file = $cleanup_dir . "/". $cleanup_file;
      if (@filemtime($cleanup_file) < (time() - $age)) {
        @unlink($cleanup_file);
      }
    }
    closedir($dir_handle);
  }
}

/*
 * Validate data
 *
 * Updates the global $validate array, with the key as the element name, and the value set to the error message.
 * 
 */
$validate = array();
function validate_data() {
  global $validate;
  // extract POST variables (running through stripslashes)
  $result = get_post_data(TRUE);
  // assign their keys and values to the symbol table
  extract($result[0], EXTR_OVERWRITE);


  if (!$author) {
    $validate['author'] = "You have not submitted an author.";
  }

  if (!$title) {
    $validate['title'] = "You have not submitted a title.";
  }

  if ($remove_img && !$story) {
    $validate['story'] = "You've tried to remove an image without replacing it with text.";
  }

  // 0 == no error; 4 == no file; all others are errors.
  if ($_FILES['upload']['error'] > 0 &&
      $_FILES['upload']['error'] !== 4) {
    $validate['upload'] = 'There was an error uploading the file ('.$_FILES['upload']['error'].')';
  } else if ($_FILES['upload']['tmp_name']) {
    $upload = getimagesize($_FILES['upload']['tmp_name']);
    if (!$upload)
      $validate['upload'] = htmlspecialchars($_FILES['upload']['name']) . 
                            " wasn't an image file. Please go back.";
  }
  return TRUE;
}

function sanitise($story) {
  if ($story) {
    // No Javascript please!
    $story = preg_replace("#<script[^>]*?>.*?</script>#si", "", $story); 
    // No comments please!
    $story = preg_replace("#<!--.*?-->#si", "", $story); 
    // Replace number ranges with n-dashes
    $stort = preg_replace("#(\d)-+(\d)#si", "$1&ndash;$2", $story); 
    // Replace " -- " and "--" with m-dashes
    $story = preg_replace("#(\s?)--(\s?)#si", "$1&mdash;$2", $story); 
    // Replace ellipses
    $story = preg_replace("#(\w|\p{P}|>)\. ?\. ?\.(\s|\p{P})#si", "$1&hellip;$2", $story); 
  
    // External processing
    include_once('../lib/smartypants.inc.php');
    $story = SmartyPants($story);
    #include_once('../lib/convert_entities.inc.php');
    #$story = html_entity_decode_full($story); // Convert named entities to numeric entities
    // Won't worry about HTML Purifier yet
  }
  return $story;
}

function send_email($title, $author, $story) {
  include_once('../lib/convert_entities.inc.php');
  $to = 'editor@xxx.org.za';
  $subject = "New submission: $title";
  $headers = 'From: x.x.x Queue <editor@xxx.org.za>'."\r\n";
  $message = "Please review the queue. $author has sent the following new submission:\n\n";
  if ($story)
    $message .= wordwrap(preg_replace("#(<br.?/?>|</p>)#", "\n", strip_tags(stripslashes(html_entity_decode_full($story)))));
  else
    $message .= "<Submission is an image. Review on the site.>";
  $message .= "\n\nhttp://xxx.org.za/publish/edit";
  mb_send_mail($to, $subject, $message, $headers);
}