0.2.1/inc/modules/member/what-order.php

   1 <?php\r
   2 /************************************************************************\r
   3  * MXChange v0.2.1                                    Start: 10/19/2003 *\r
   4  * ===============                              Last change: 08/26/2004 *\r
   5  *                                                                      *\r
   6  * -------------------------------------------------------------------- *\r
   7  * File              : what-order.php                                   *\r
   8  * -------------------------------------------------------------------- *\r
   9  * Short description : Order mails here                                 *\r
  10  * -------------------------------------------------------------------- *\r
  11  * Kurzbeschreibung  : Hier können Ihre Mitglieder Mails buchen         *\r
  12  * -------------------------------------------------------------------- *\r
  13  *                                                                      *\r
  14  * -------------------------------------------------------------------- *\r
  15  * Copyright (c) 2003 - 2007 by Roland Haeder                           *\r
  16  * For more information visit: http://www.mxchange.org                  *\r
  17  *                                                                      *\r
  18  * This program is free software; you can redistribute it and/or modify *\r
  19  * it under the terms of the GNU General Public License as published by *\r
  20  * the Free Software Foundation; either version 2 of the License, or    *\r
  21  * (at your option) any later version.                                  *\r
  22  *                                                                      *\r
  23  * This program is distributed in the hope that it will be useful,      *\r
  24  * but WITHOUT ANY WARRANTY; without even the implied warranty of       *\r
  25  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        *\r
  26  * GNU General Public License for more details.                         *\r
  27  *                                                                      *\r
  28  * You should have received a copy of the GNU General Public License    *\r
  29  * along with this program; if not, write to the Free Software          *\r
  30  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,               *\r
  31  * MA  02110-1301  USA                                                  *\r
  32  ************************************************************************/\r
  33 \r
  34 // Some security stuff...\r
  35 if (ereg(basename(__FILE__), $_SERVER['PHP_SELF']))\r
  36 {\r
  37         $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4)."/security.php";\r
  38         require($INC);\r
  39 }\r
  40  elseif (!IS_LOGGED_IN())\r
  41 {\r
  42         LOAD_URL(URL."/modules.php?module=index");\r
  43 }\r
  44  elseif ((!EXT_IS_ACTIVE("order")) && (!IS_ADMIN()))\r
  45 {\r
  46         ADD_FATAL(EXTENSION_PROBLEM_EXT_INACTIVE, "order");\r
  47         return;\r
  48 }\r
  49 \r
  50 // Add description as navigation point\r
  51 ADD_DESCR("member", basename(__FILE__));\r
  52 \r
  53 $URL = ""; $id = 0;\r
  54 $WHERE = " WHERE visible='Y'";\r
  55 \r
  56 // Set undefined array elements\r
  57 if (empty($_GET['msg']))       $_GET['msg']       = "";\r
  58 if (empty($_POST['zip']))      $_POST['zip']      = "";\r
  59 if (empty($_POST['html']))     $_POST['html']     = "";\r
  60 if (empty($_POST['receiver'])) $_POST['receiver'] = "";\r
  61 if (is_admin()) $WHERE = "";\r
  62 \r
  63 // Add slashes to every value\r
  64 foreach($_POST as $key=>$value)\r
  65 {\r
  66         // Skip submit buttons\r
  67         if (($key != "data") && ($key != "frametester")) $_POST[$key] = addslashes($value);\r
  68 }\r
  69 \r
  70 // Minimum mails / order\r
  71 define('__MIN_VALUE', $CONFIG['order_min']);\r
  72 \r
  73 // Count unconfirmed mails\r
  74 $result_links = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_links WHERE userid=%d",\r
  75  array($GLOBALS['userid']), __FILE__, __LINE__);\r
  76 $links = SQL_NUMROWS($result_links);\r
  77 SQL_FREERESULT($result_links);\r
  78 \r
  79 // Does the user has more than 0 mails per day set?\r
  80 $HOLIDAY="userid";\r
  81 if (GET_EXT_VERSION("holiday") >= "0.1.3")\r
  82 {\r
  83         // Fetch also holiday activation data\r
  84         $HOLIDAY = "holiday_active";\r
  85 }\r
  86 \r
  87 $result_mmails = SQL_QUERY_ESC("SELECT userid, receive_mails, mail_orders, ".$HOLIDAY."\r
  88 FROM "._MYSQL_PREFIX."_user_data\r
  89 WHERE userid=%d AND max_mails > 0 LIMIT 1",\r
  90  array($GLOBALS['userid']), __FILE__, __LINE__);\r
  91 \r
  92 $mmails = SQL_NUMROWS($result_mmails);\r
  93 list($DMY, $MAXI, $ORDERS, $HOLIDAY) = SQL_FETCHROW($result_mmails);\r
  94 SQL_FREERESULT($result_mmails);\r
  95 if ($HOLIDAY == $DMY) $HOLIDAY="N";\r
  96 \r
  97 $ALLOWED = $MAXI - $ORDERS;\r
  98 if ($CONFIG['order_max'] == "MAX") $ALLOWED = $MAXI;\r
  99 \r
 100 // Check HTML extension\r
 101 $HTML_EXT = EXT_IS_ACTIVE("html_mail");\r
 102 \r
 103 // Now check his points amount\r
 104 $result_p = SQL_QUERY_ESC("SELECT SUM(points) FROM "._MYSQL_PREFIX."_user_points WHERE userid=%d",\r
 105  array($GLOBALS['userid']), __FILE__, __LINE__);\r
 106 \r
 107 $TOTAL = "0";\r
 108 if (SQL_NUMROWS($result_p) > 0)\r
 109 {\r
 110         // Load points\r
 111         list($TOTAL) = SQL_FETCHROW($result_p);\r
 112         SQL_FREERESULT($result_p);\r
 113 \r
 114         // And subtract his used points...\r
 115         $result_p = SQL_QUERY_ESC("SELECT used_points FROM "._MYSQL_PREFIX."_user_data WHERE userid=%d LIMIT 1",\r
 116          array($GLOBALS['userid']), __FILE__, __LINE__);\r
 117 \r
 118         list($p) = SQL_FETCHROW($result_p);\r
 119         SQL_FREERESULT($result_p);\r
 120         $TOTAL -= $p;\r
 121 \r
 122         // Add (maybe) missing three zeros\r
 123         if (!ereg(".", $TOTAL)) $TOTAL .= ".00000";\r
 124 }\r
 125 \r
 126 if (($HOLIDAY == "Y") && (GET_EXT_VERSION("holiday") >= "0.1.3"))\r
 127 {\r
 128         // Holiday is active!\r
 129         SQL_FREERESULT($result_p);\r
 130         LOAD_TEMPLATE("admin_settings_saved", false, HOLIDAY_ORDER_NOT_POSSIBLE);\r
 131 }\r
 132  elseif ((!empty($_POST['frametester'])) && ($ALLOWED > 0) && ($_POST['receiver'] > 0))\r
 133 {\r
 134         // Continue with the frametester, we first need to store the data temporary in the pool\r
 135         //\r
 136         // First we would like to store the data and get it's pool position back...\r
 137         $result = SQL_QUERY_ESC("SELECT id, data_type FROM "._MYSQL_PREFIX."_pool WHERE sender=%d AND url='%s' AND timestamp > %d LIMIT 1",\r
 138          array($GLOBALS['userid'], $_POST['url'], bigintval(time() - $CONFIG['url_tlock'])), __FILE__, __LINE__);\r
 139 \r
 140         $type = "TEMP"; $id = "0";\r
 141         if (SQL_NUMROWS($result) == 1)\r
 142         {\r
 143                 list($id, $type) = SQL_FETCHROW($result);\r
 144                 SQL_FREERESULT($result);\r
 145         }\r
 146         if ($type == "TEMP")\r
 147         {\r
 148                 // No entry found, so we need to check out the stats table as well... :)\r
 149                 // We have to add that suff here, now we continue WITHOUT checking and check the text and subject against some filters\r
 150                 $URL = "";\r
 151                 if ($CONFIG['test_text'] == "Y")\r
 152                 {\r
 153                         // Test submitted text against some filters (length, URLs in text etc.)\r
 154                         if ((strpos(strtolower($_POST['text']), "https://") > -1) || (strpos(strtolower($_POST['text']), "http://") > -1) || (strpos(strtolower($_POST['text']), "www") > -1))\r
 155                         {\r
 156                                 // URL found!\r
 157                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_URL_FOUND;\r
 158                         }\r
 159                         $TEST = str_replace("\n", "", str_replace("\r", "", addslashes($_POST['text'])));\r
 160                         if (strlen($TEST) > $CONFIG['max_tlength'])\r
 161                         {\r
 162                                 // Text is too long!\r
 163                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_OVERLENGTH;\r
 164                         }\r
 165                 }\r
 166                 // Shall I test the subject line against URLs?\r
 167                 if ($CONFIG['test_subj'] == "Y")\r
 168                 {\r
 169                         // Check the subject line for issues\r
 170                         $_POST['subject'] = str_replace("\\", "[nl]", substr($_POST['subject'], 0, 200));\r
 171                         if ((strpos(strtolower($_POST['subject']), "http://") > -1) || (strpos(strtolower($_POST['subject']), "www") > -1))\r
 172                         {\r
 173                                 // URL in subject found\r
 174                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_SUBJ_URL;\r
 175                         }\r
 176                 }\r
 177                 // And shall I check that his URL is not in the black list?\r
 178                 if ($CONFIG['url_blacklist'] == "Y")\r
 179                 {\r
 180                         // Ok, I do that for you know...\r
 181                         $result = SQL_QUERY_ESC("SELECT timestamp FROM "._MYSQL_PREFIX."_url_blist WHERE url='%s' LIMIT 1",\r
 182                          array($_POST['url']), __FILE__, __LINE__);\r
 183 \r
 184                         if (SQL_NUMROWS($result) == 1)\r
 185                         {\r
 186                                 // Jupp, we got one listed\r
 187                                 list($blist) = SQL_FETCHROW($result);\r
 188                                 SQL_FREERESULT($result);\r
 189                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_BLIST_URL."&blist=".$blist;\r
 190                         }\r
 191                 }\r
 192                 if (($_POST['receiver'] < $CONFIG['order_min']) && (!IS_ADMIN()))\r
 193                 {\r
 194                         // Less than allowed receivers entered!\r
 195                         $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_MORE_RECEIVERS3;\r
 196                 }\r
 197 \r
 198                 // Validate URL\r
 199                 if (!VALIDATE_URL($_POST['url']))\r
 200                 {\r
 201                         // URL is invalid!\r
 202                         $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_INVALID_URL;\r
 203                 }\r
 204 \r
 205                 // Probe for HTML extension\r
 206                 if ($HTML_EXT)\r
 207                 {\r
 208                         if ($_POST['html'] == "Y")\r
 209                         {\r
 210                                 // Chek for valid HTML tags\r
 211                                 $_POST['text'] = HTML_CHECK_TAGS($_POST['text']);\r
 212 \r
 213                                 // Maybe invalid tags found?\r
 214                                 if (empty($_POST['text'])) $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_INVALID_TAGS."&id=".$id;\r
 215                         }\r
 216                          else\r
 217                         {\r
 218                                 // Remove any HTML code\r
 219                                 $_POST['text'] = str_replace("<", "{OPEN_HTML}", str_replace(">", "{CLOSE_HTML}", $_POST['text']));\r
 220                         }\r
 221                 }\r
 222         }\r
 223          elseif (!IS_ADMIN())\r
 224         {\r
 225                 // He has already sent a mail within a specific time\r
 226                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_URL_TLOCK."&id=".$id;\r
 227         }\r
 228         if (empty($URL))\r
 229         {\r
 230                 // Check if category and number of receivers is okay\r
 231                 $ADD = "";\r
 232                 if (($CONFIG['order_multi'] == "Y") && (!empty($_POST['zip']))) $ADD = "AND d.zip LIKE '".bigintval($_POST['zip'])."{PER}'";\r
 233 \r
 234                 // Check for userids\r
 235                 $result = SQL_QUERY_ESC("SELECT DISTINCT c.userid FROM "._MYSQL_PREFIX."_user_cats AS c\r
 236 LEFT JOIN "._MYSQL_PREFIX."_user_data AS d\r
 237 ON c.userid=d.userid\r
 238 WHERE c.cat_id=%d AND c.userid != '%s' AND d.status='CONFIRMED' AND d.receive_mails > 0\r
 239 ".$ADD."\r
 240 ORDER BY d.%s %s",\r
 241  array(\r
 242         bigintval($_POST['cat']),\r
 243         $GLOBALS['userid'],\r
 244         $CONFIG['order_select'],\r
 245         $CONFIG['order_mode'],\r
 246  ), __FILE__, __LINE__);\r
 247 \r
 248                 // Do we enougth receivers left?\r
 249                 if (SQL_NUMROWS($result) >= $_POST['receiver'])\r
 250                 {\r
 251                         // Check for holiday extensions\r
 252                         $HOLIDAY = false;\r
 253                         if (GET_EXT_VERSION("holiday") >= "0.1.3")\r
 254                         {\r
 255                                 // Include checking for users in holiday\r
 256                                 $HOLIDAY = true;\r
 257                         }\r
 258 \r
 259                         // Load receivers from database\r
 260                         $TEST = array(); $cnt = 0;\r
 261                         while (list($REC) = SQL_FETCHROW($result))\r
 262                         {\r
 263                                 if ($HOLIDAY)\r
 264                                 {\r
 265                                         // Check for his holiday status\r
 266                                         $result_holiday = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_holidays\r
 267 WHERE userid=%d AND holiday_start < ".time()." AND holiday_end > ".time()." LIMIT 1",\r
 268  array(bigintval($REC)), __FILE__, __LINE__);\r
 269                                         if (SQL_NUMROWS($result_holiday) == 1) $REC = 0; // Exclude user who are in holiday\r
 270 \r
 271                                         // Free memory\r
 272                                         SQL_FREERESULT($result_holiday);\r
 273                                 }\r
 274 \r
 275                                 if ($REC > 0)\r
 276                                 {\r
 277                                         // Add receiver\r
 278                                         $TEST[] = $REC;\r
 279                                         $cnt++;\r
 280                                 }\r
 281                         }\r
 282 \r
 283                         // Free memory\r
 284                         SQL_FREERESULT($result);\r
 285 \r
 286                         // Implode array into string for the sending pool\r
 287                         $RECEIVER = implode($TEST, ";");\r
 288 \r
 289                         // Count array for maximum sent\r
 290                         $MAX_SEND = count($TEST);\r
 291 \r
 292                         // Update receiver list\r
 293                         $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_user_data SET receive_mails=receive_mails-1 WHERE userid IN (%s) LIMIT %s",\r
 294                          array(str_replace(";", ", ", $RECEIVER), $MAX_SEND), __FILE__, __LINE__);\r
 295 \r
 296                         // Is calculated max receivers larger than wanted receivers then reset it\r
 297                         if ($MAX_SEND > $_POST['receiver']) $MAX_SEND = $_POST['receiver'];\r
 298 \r
 299                         // Calculate used points\r
 300                         $USED = $MAX_SEND * GET_PAY_POINTS(bigintval($_POST['type']));\r
 301 \r
 302                         // Check if he has enougth points for this order and selected more than 0 receivers\r
 303                         if (($USED > 0) && ($USED <= $TOTAL) && ($MAX_SEND > 0))\r
 304                         {\r
 305                                 // Gettings points is okay, so we can add $USED later from\r
 306                                 $TIME = time();\r
 307                                 if (($id == "0") || ($type != "TEMP"))\r
 308                                 {\r
 309                                         // New order\r
 310                                         $id = 0;\r
 311                                         if ($HTML_EXT)\r
 312                                         {\r
 313                                                 // HTML extension is active\r
 314                                                 $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_pool (sender, subject, text, receivers, payment_id, data_type, timestamp, url, cat_id, target_send, zip, html_msg)\r
 315  VALUES ('%s', '%s', '%s', '%s', '%s', 'TEMP', '%s', '%s', '%s', '%s', '%s', '%s')",\r
 316 array(\r
 317         $GLOBALS['userid'],\r
 318         addslashes($_POST['subject']),\r
 319         addslashes($_POST['text']),\r
 320         $RECEIVER,\r
 321         bigintval($_POST['type']),\r
 322         $TIME,\r
 323         $_POST['url'],\r
 324         bigintval($_POST['cat']),\r
 325         $MAX_SEND,\r
 326         bigintval($_POST['zip']),\r
 327         $_POST['html']\r
 328 ), __FILE__, __LINE__);\r
 329                                         }\r
 330                                          else\r
 331                                         {\r
 332                                                 // No HTML extension is active\r
 333                                                 $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_pool (sender, subject, text, receivers, payment_id, data_type, timestamp, url, cat_id, target_send, zip)\r
 334  VALUES ('%s', '%s', '%s', '%s', '%s', 'TEMP', '%s', '%s', '%s', '%s', '%s')",\r
 335 array(\r
 336         $GLOBALS['userid'],\r
 337         addslashes($_POST['subject']),\r
 338         addslashes($_POST['text']),\r
 339         $RECEIVER,\r
 340         bigintval($_POST['type']),\r
 341         $TIME,\r
 342         $_POST['url'],\r
 343         bigintval($_POST['cat']),\r
 344         $MAX_SEND,\r
 345         bigintval($_POST['zip']),\r
 346 ), __FILE__, __LINE__);\r
 347                                         }\r
 348                                 }\r
 349                                  else\r
 350                                 {\r
 351                                         // Change current order\r
 352                                         if ($HTML_EXT)\r
 353                                         {\r
 354                                                 // HTML extension is active\r
 355                                                 $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET\r
 356 subject='%s',\r
 357 text='%s',\r
 358 receivers='%s',\r
 359 payment_id=%d,\r
 360 timestamp=UNIX_TIMESTAMP(),\r
 361 url='%s',\r
 362 cat_id=%d,\r
 363 target_send=%d,\r
 364 zip=%d,\r
 365 html_msg='%s'\r
 366 WHERE id=%d LIMIT 1",\r
 367 array(\r
 368         $_POST['subject'],\r
 369         $_POST['text'],\r
 370         $RECEIVER,\r
 371         bigintval($_POST['type']),\r
 372         $_POST['url'],\r
 373         bigintval($_POST['cat']),\r
 374         $MAX_SEND,\r
 375         bigintval($_POST['zip']),\r
 376         $_POST['html'],\r
 377         bigintval($id)\r
 378 ), __FILE__, __LINE__);\r
 379                                         }\r
 380                                          else\r
 381                                         {\r
 382                                                 // No HTML extension is active\r
 383                                                 $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET\r
 384 subject='%s',\r
 385 text='%s',\r
 386 receivers='%s',\r
 387 payment_id=%d,\r
 388 timestamp=UNIX_TIMESTAMP(),\r
 389 url='%s',\r
 390 cat_id=%d,\r
 391 target_send=%d,\r
 392 zip=%d\r
 393 WHERE id=%d LIMIT 1",\r
 394 array(\r
 395         $_POST['subject'],\r
 396         $_POST['text'],\r
 397         $RECEIVER,\r
 398         bigintval($_POST['type']),\r
 399         $_POST['url'],\r
 400         bigintval($_POST['cat']),\r
 401         $MAX_SEND,\r
 402         bigintval($_POST['zip']),\r
 403         bigintval($id)\r
 404 ), __FILE__, __LINE__);\r
 405                                         }\r
 406                                 }\r
 407 \r
 408                                 // Do we need to get the ID number?\r
 409                                 if ($id == 0) {\r
 410                                         // Order is placed as temporary. We need to get it's id for the frametester\r
 411                                         $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_pool WHERE sender=%d AND subject='%s' AND payment_id=%d AND data_type='TEMP' AND timestamp=%d LIMIT 1",\r
 412                                         array(\r
 413                                                 $GLOBALS['userid'],\r
 414                                                 $_POST['subject'],\r
 415                                                 bigintval($_POST['type']),\r
 416                                                 $TIME\r
 417                                         ), __FILE__, __LINE__);\r
 418 \r
 419                                         list($id) = SQL_FETCHROW($result);\r
 420                                         SQL_FREERESULT($result);\r
 421                                 }\r
 422 \r
 423                                 // ID is received so we can redirect the user, used points will be added when he send's out the mail\r
 424                                 $URL = URL."/modules.php?module=frametester&amp;order=".$id."";\r
 425                         }\r
 426                          elseif ($MAX_SEND == 0)\r
 427                         {\r
 428                                 // Not enougth receivers found which can receive mails\r
 429                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_MORE_RECEIVERS2;\r
 430                         }\r
 431                          else\r
 432                         {\r
 433                                 // No enougth points left!\r
 434                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_MORE_POINTS;\r
 435                         }\r
 436                 }\r
 437                  else\r
 438                 {\r
 439                         // Ordered more mails than he can send in this category\r
 440                         $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_NO_RECS_LEFT;\r
 441                 }\r
 442         }\r
 443 }\r
 444  elseif ($_POST['receiver'] == "0")\r
 445 {\r
 446         // Not enougth receivers selected\r
 447         $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_MORE_RECEIVERS1;\r
 448 }\r
 449  elseif (($ALLOWED == 0) && ($CONFIG['order_max'] == "ORDER"))\r
 450 {\r
 451         // No more mail orders allowed\r
 452         LOAD_TEMPLATE("admin_settings_saved", false, MEMBER_ORDER_ALLOWED_EXHAUSTED);\r
 453 }\r
 454  elseif (($links < $CONFIG['unconfirmed']) && ($mmails == "1"))\r
 455 {\r
 456         // Display order form\r
 457         $result_cats = SQL_QUERY("SELECT id, cat FROM "._MYSQL_PREFIX."_cats".$WHERE." ORDER BY sort", __FILE__, __LINE__);\r
 458         if (SQL_NUMROWS($result_cats) > 0)\r
 459         {\r
 460                 if ($TOTAL > 0)\r
 461                 {\r
 462                         // Initialize array...\r
 463                         $CATS = array(\r
 464                                 'id'   => array(),\r
 465                                 'name' => array(),\r
 466                                 'uids' => array()\r
 467                         );\r
 468 \r
 469                         // Enable HTML checking\r
 470                         $HTML = ""; $HOLIDAY = false; $HOL_STRING = "";\r
 471                         if (($HTML_EXT) && ($_POST['html'] == "Y")) $HTML = " AND html='Y'";\r
 472                         if (GET_EXT_VERSION("holiday") >= "0.1.3")\r
 473                         {\r
 474                                 // Extension's version is fine\r
 475                                 $HOLIDAY = true; $HOL_STRING = " AND holiday_active='N'";\r
 476                         }\r
 477 \r
 478                         // ... and begin loading stuff\r
 479                         while (list($id, $cat) = SQL_FETCHROW($result_cats))\r
 480                         {\r
 481                                 $CATS['id'][]   = bigintval($id);\r
 482                                 $CATS['name'][] = $cat;\r
 483 \r
 484                                 // Select users in current category\r
 485                                 $result_uids = SQL_QUERY_ESC("SELECT userid FROM "._MYSQL_PREFIX."_user_cats WHERE cat_id=%d AND userid != '%s' ORDER BY userid",\r
 486                                  array(bigintval($id), $GLOBALS['userid']), __FILE__, __LINE__);\r
 487 \r
 488                                 $uid_cnt = "0";\r
 489                                 while (list($ucat) = SQL_FETCHROW($result_uids))\r
 490                                 {\r
 491                                         // Check for holiday system\r
 492                                         $HOL_ACTIVE = false;\r
 493                                         if ($HOLIDAY)\r
 494                                         {\r
 495                                                 // Check user's holiday status\r
 496                                                 $result_holiday = SQL_QUERY_ESC("SELECT DISTINCT d.userid FROM "._MYSQL_PREFIX."_user_data AS d\r
 497 LEFT JOIN "._MYSQL_PREFIX."_user_holidays AS h\r
 498 ON d.userid=h.userid\r
 499 WHERE d.userid=%d AND d.receive_mails > 0 AND d.status='CONFIRMED' AND d.holiday_active='Y'\r
 500 AND h.holiday_start < ".time()." AND h.holiday_end > ".time()."\r
 501 LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__);\r
 502                                                 if (SQL_NUMROWS($result_holiday) == 1)\r
 503                                                 {\r
 504                                                         // Holiday is active!\r
 505                                                         $HOL_ACTIVE = true;\r
 506                                                 }\r
 507 \r
 508                                                 // Free memory\r
 509                                                 SQL_FREERESULT($result_holiday);\r
 510                                         }\r
 511 \r
 512                                         if (!$HOL_ACTIVE)\r
 513                                         {\r
 514                                                 // Check if the user want's to receive mails?\r
 515                                                 $result_ver = SQL_QUERY_ESC("SELECT zip FROM "._MYSQL_PREFIX."_user_data WHERE userid=%d".$HTML." AND receive_mails > 0 AND status='CONFIRMED' LIMIT 1",\r
 516                                                  array(bigintval($ucat)), __FILE__, __LINE__);\r
 517 \r
 518                                                 if ((SQL_NUMROWS($result_ver) == 1) && (!empty($_POST['zip'])) && ($CONFIG['order_multi'] == "Y"))\r
 519                                                 {\r
 520                                                         list($zip) = SQL_FETCHROW($result_ver);\r
 521                                                         SQL_FREERESULT($result_ver);\r
 522                                                         if (substr($zip, 0, strlen($_POST['zip'])) == $_POST['zip'])\r
 523                                                         {\r
 524                                                                 // Ok, ZIP part is found\r
 525                                                                 $uid_cnt++;\r
 526                                                         }\r
 527                                                 }\r
 528                                                  else\r
 529                                                 {\r
 530                                                         // Count numbers up!\r
 531                                                         $uid_cnt += SQL_NUMROWS($result_ver);\r
 532                                                 }\r
 533                                         }\r
 534                                 }\r
 535 \r
 536                                 // Free memory\r
 537                                 SQL_FREERESULT($result_uids);\r
 538                                 $CATS['uids'][] = $uid_cnt;\r
 539                         }\r
 540 \r
 541                         // Free memory\r
 542                         SQL_FREERESULT($result_cats);\r
 543 \r
 544                         // Now we need to load the mail types...\r
 545                         $result = SQL_QUERY("SELECT id, price, payment, mail_title FROM "._MYSQL_PREFIX."_payments ORDER BY payment", __FILE__, __LINE__);\r
 546 \r
 547                         $TYPES = array();\r
 548                         if (SQL_NUMROWS($result) > 0)\r
 549                         {\r
 550                                 // Check for message ID in URL\r
 551                                 $MSG = "";\r
 552                                 switch ($_GET['msg'])\r
 553                                 {\r
 554                                 case CODE_URL_TLOCK:\r
 555                                         $result = SQL_QUERY_ESC("SELECT timestamp FROM "._MYSQL_PREFIX."_pool WHERE id=%d LIMIT 1",\r
 556                                          array(bigintval($_GET['id'])), __FILE__, __LINE__);\r
 557 \r
 558                                         // Load timestamp from last order\r
 559                                         list($LORDER) = SQL_FETCHROW($result);\r
 560                                         $LORDER = MAKE_DATETIME($LORDER, "1");\r
 561 \r
 562                                         // Free memory\r
 563                                         SQL_FREERESULT($result);\r
 564 \r
 565                                         // Calculate hours...\r
 566                                         $STD = round($CONFIG['url_tlock'] / 60 / 60);\r
 567 \r
 568                                         // Minutes...\r
 569                                         $MIN = round(($CONFIG['url_tlock'] - $STD * 60 * 60) / 60);\r
 570 \r
 571                                         // And seconds\r
 572                                         $SEC = $CONFIG['url_tlock'] - $STD * 60 * 60 - $MIN * 60;\r
 573 \r
 574                                         // Finally contruct the message\r
 575                                         $MSG = MEMBER_URL_TIME_LOCK."<BR>".CONFIG_URL_TLOCK." ".$STD." ".\r
 576                                                 HOURS.", ".$MIN." ".MINS." "._AND." ".$SEC." ".SECS."<BR>".\r
 577                                                 MEMBER_LAST_TLOCK.": ".$LORDER;\r
 578                                         break;\r
 579 \r
 580                                 case CODE_OVERLENGTH:\r
 581                                         $MSG = MEMBER_TEXT_OVERLENGTH;\r
 582                                         break;\r
 583 \r
 584                                 case CODE_URL_FOUND:\r
 585                                         $MSG = MEMBER_TEXT_CONTAINS_URL;\r
 586                                         break;\r
 587 \r
 588                                 case CODE_SUBJ_URL:\r
 589                                         $MSG = MEMBER_SUBJ_CONTAINS_URL;\r
 590                                         break;\r
 591 \r
 592                                 case CODE_BLIST_URL:\r
 593                                         $MSG = MEMBER_URL_BLACK_LISTED."<BR>\r
 594 ".MEMBER_BLIST_TIME.": ".MAKE_DATETIME($_GET['blist'], "0");\r
 595                                         break;\r
 596 \r
 597                                 case CODE_NO_RECS_LEFT:\r
 598                                         $MSG = MEMBER_SELECTED_MORE_RECS;\r
 599                                         break;\r
 600 \r
 601                                 case CODE_INVALID_TAGS:\r
 602                                         $MSG = MEMBER_HTML_INVALID_TAGS;\r
 603                                         break;\r
 604 \r
 605                                 case CODE_MORE_POINTS:\r
 606                                         $MSG = MEMBER_MORE_POINTS_NEEDED;\r
 607                                         break;\r
 608 \r
 609                                 case CODE_MORE_RECEIVERS1:\r
 610                                         $MSG = MEMBER_ENTER_MORE_RECEIVERS;\r
 611                                         break;\r
 612 \r
 613                                 case CODE_MORE_RECEIVERS2:\r
 614                                         $MSG = MEMBER_NO_MORE_RECEIVERS_FOUND;\r
 615                                         break;\r
 616 \r
 617                                 case CODE_MORE_RECEIVERS3:\r
 618                                         $MSG = MEMBER_ENTER_MORE_MIN_RECEIVERS_1.$CONFIG['order_min'].MEMBER_ENTER_MORE_MIN_RECEIVERS_2;\r
 619                                         break;\r
 620 \r
 621                                 case CODE_INVALID_URL:\r
 622                                         $MSG = MEMBER_ENTER_INVALID_URL;\r
 623                                         break;\r
 624 \r
 625                                 case "": // When no error code is included in the URL we do not need to output an error message as well...\r
 626                                         break;\r
 627 \r
 628                                 default:\r
 629                                         $MSG = UNKNOWN_CODE_1.$_GET['msg'].UNKNOWN_CODE_2;\r
 630                                         break;\r
 631                                 }\r
 632                                 if (!empty($MSG))\r
 633                                 {\r
 634                                         // We got system message so we drop it out to the user\r
 635                                         LOAD_TEMPLATE("admin_settings_saved", false, $MSG);\r
 636                                 }\r
 637 \r
 638                                 // Load all email types...\r
 639                                 while ($TYPES[] = SQL_FETCHROW($result))\r
 640                                 {\r
 641                                         // Nothing to do here... ;-)\r
 642                                 }\r
 643 \r
 644                                 // Free memory\r
 645                                 SQL_FREERESULT($result);\r
 646 \r
 647                                 // Output user's points\r
 648                                 $TOTAL = TRANSLATE_COMMA($TOTAL);\r
 649 \r
 650                                 // Check how many mail orders he has placed today and how many he's allowed to send\r
 651                                 switch ($CONFIG['order_max'])\r
 652                                 {\r
 653                                 case "MAX": // He is allowed to send as much as possible\r
 654                                         define('ORDER_MAX_VALUE', ORDER_ALLOED_MAX);\r
 655                                         break;\r
 656 \r
 657                                 case "ORDER": // He is allowed to send as much as he setup the receiving value\r
 658                                         define('ORDER_MAX_VALUE', ORDER_ALLOWED_RECEIVE_1.$ALLOWED.ORDER_ALLOWED_RECEIVE_2.$MAXI.ORDER_ALLOWED_RECEIVE_3);\r
 659                                         break;\r
 660                                 }\r
 661 \r
 662                                 // Load final template\r
 663                                 LOAD_TEMPLATE("member_order_points", false, $TOTAL);\r
 664 \r
 665                                 // Reset variables\r
 666                                 $OLD_ORDER = false; $subject = ""; $text = ""; $target = "";\r
 667 \r
 668                                 // Check if we already have an order placed and make it editable\r
 669                                 $result = SQL_QUERY_ESC("SELECT subject, text, payment_id, timestamp, url, target_send, cat_id, zip FROM "._MYSQL_PREFIX."_pool WHERE sender=%d AND data_type='TEMP' LIMIT 1",\r
 670                                  array($GLOBALS['userid']), __FILE__, __LINE__);\r
 671 \r
 672                                 if (SQL_NUMROWS($result) == 1)\r
 673                                 {\r
 674                                         // Old order found\r
 675                                         list($subject, $text, $payment, $tstamp, $url, $target, $cat, $zip) = SQL_FETCHROW($result);\r
 676                                         SQL_FREERESULT($result);\r
 677 \r
 678                                         // Fix max receivers when it is too much\r
 679                                         if ($target > $CATS['uids'][$cat]) $target = $CATS['uids'][$cat];\r
 680 \r
 681                                         // Old order is grabbed\r
 682                                         $OLD_ORDER = true;\r
 683                                 }\r
 684                                  else\r
 685                                 {\r
 686                                         // Default output for that your members don't forget it...\r
 687                                         $url = "http://";\r
 688                                 }\r
 689 \r
 690                                 // 01      2                       21    12                             2    23         443    3          3210\r
 691                                 if ((!empty($_POST['data'])) || (($CONFIG['order_multi'] == "N") && ((!IS_ADMIN()) && (!$HTML_EXT))))\r
 692                                 {\r
 693                                         // Pre-output categories\r
 694                                         $CAT = "";\r
 695                                         foreach ($CATS['id'] as $key=>$value)\r
 696                                         {\r
 697                                                 $CAT .= "      <OPTION value=\"".$value."\"";\r
 698                                                 if (($OLD_ORDER) && ($cat == $value)) $CAT .= " selected=\"selected\"";\r
 699                                                 $CAT .= ">".$CATS['name'][$key]." (".$CATS['uids'][$key]." ".USER_IN_CAT.")</OPTION>\n";\r
 700                                         }\r
 701                                         // Mail type\r
 702                                         $TYPE = "";\r
 703                                         foreach ($TYPES as $key=>$value)\r
 704                                         {\r
 705                                                 $P = TRANSLATE_COMMA($TYPES[$key][1]);\r
 706                                                 if (is_array($value))\r
 707                                                 {\r
 708                                                         // Output option line\r
 709                                                         $TYPE .= "      <OPTION value=\"".$TYPES[$key][0]."\"";\r
 710                                                         if (($OLD_ORDER) && ($payment == $TYPES[$key][0])) $TYPE .= " selected=\"selected\"";\r
 711                                                         $TYPE .= ">".$P." ".PER_MAIL." - ".$TYPES[$key][3]." - ".round($TYPES[$key][2])." ".PAYMENT."</OPTION>\n";\r
 712                                                 }\r
 713                                         }\r
 714 \r
 715                                         // Put all in constants for the template\r
 716                                         define('CATEGORY_SELECTION', $CAT);\r
 717                                         define('TYPE_SELECTION', $TYPE);\r
 718                                         define('TARGET', $target);\r
 719                                         define('SUBJECT', $subject);\r
 720                                         define('TEXT', COMPILE_CODE($text));\r
 721                                         define('T_URL', $url);\r
 722 \r
 723                                         if (!empty($_POST['zip']))\r
 724                                         {\r
 725                                                 // Output entered ZIP code\r
 726                                                 define('ZIP_OUTPUT', LOAD_TEMPLATE("member_order-zip2", true, $_POST['zip']));\r
 727                                         }\r
 728                                          else\r
 729                                         {\r
 730                                                 define('ZIP_OUTPUT', "<TR><TD colspan=\"5\" height=\"5\" class=\"seperator\">&nbsp;</TD></TR>");\r
 731                                         }\r
 732                                         // HTML extension\r
 733                                         if (($HTML_EXT) && ($_POST['html'] == "Y"))\r
 734                                         {\r
 735                                                 // Extension is active so output valid HTML tags\r
 736                                                 define('MEMBER_HTML_EXTENSION', LOAD_TEMPLATE("member_order-html_ext", true, HTML_ADD_VALID_TAGS()));\r
 737                                         }\r
 738                                          else\r
 739                                         {\r
 740                                                 // Extension not active and/or class not uploaded\r
 741                                                 define('MEMBER_HTML_EXTENSION', "<TR><TD colspan=\"5\"><INPUT type=\"hidden\" name=\"html\" value=\"N\"></TD></TR>");\r
 742                                         }\r
 743 \r
 744                                         // Output form for page 2\r
 745                                         LOAD_TEMPLATE("member_order_page2");\r
 746                                 }\r
 747                                  else\r
 748                                 {\r
 749                                         // Remember maybe entered ZIP code in constant\r
 750                                         $ADD = "";\r
 751                                         if ($HTML_EXT)\r
 752                                         {\r
 753                                                 // Add some content when html extension is active\r
 754                                                 if (($CONFIG['order_multi'] == "Y") || (IS_ADMIN())) $ADD = "<TR><TD colspan=\"2\" class=\"seperator bottom2\" height=\"5\">&nbsp;</TD></TR>\n";\r
 755                                                 define('MEMBER_HTML_EXTENSION', LOAD_TEMPLATE("member_order-html_intro", true));\r
 756                                         }\r
 757                                          else\r
 758                                         {\r
 759                                                 // No HTML extension installed\r
 760                                                 define('MEMBER_HTML_EXTENSION', "<TR><TD colspan=\"2\"><INPUT type=\"hidden\" name=\"html\" value=\"N\"></TD></TR>");\r
 761                                         }\r
 762                                         // Do we want ZIP code or not?\r
 763                                         if (($CONFIG['order_multi'] == "Y") || (IS_ADMIN()))\r
 764                                         {\r
 765                                                 // Yes\r
 766                                                 $content = array(\r
 767                                                         'zip' => $_POST['zip'],\r
 768                                                         'add' => $ADD\r
 769                                                 );\r
 770                                                 define('MEMBER_ZIP_CONTENT', LOAD_TEMPLATE("member_order-zip1", true, $content));\r
 771                                         }\r
 772                                          else\r
 773                                         {\r
 774                                                 // No\r
 775                                                 define('MEMBER_ZIP_CONTENT', "");\r
 776                                         }\r
 777 \r
 778                                         // Output form for page 1 (ZIP code or HTML)\r
 779                                         LOAD_TEMPLATE("member_order_page1");\r
 780                                 }\r
 781                         }\r
 782                          else\r
 783                         {\r
 784                                 // No mail types defined\r
 785                                 OUTPUT_HTML ("<STRONG><SPAN class=\"member_failed\">".MEMBER_NO_PAYMENTS."</SPAN></STRONG>");\r
 786                         }\r
 787                 }\r
 788                  else\r
 789                 {\r
 790                         // No points left!\r
 791                         OUTPUT_HTML ("<STRONG><SPAN class=\"member_failed\">".MEMBER_NO_POINTS."</SPAN></STRONG>");\r
 792                 }\r
 793         }\r
 794          else\r
 795         {\r
 796                 // No cateogries are defined yet\r
 797                 OUTPUT_HTML ("<STRONG><SPAN class=\"member_failed\">".MEMBER_NO_CATS."</SPAN></STRONG>");\r
 798         }\r
 799 }\r
 800  elseif ($mmails == "0")\r
 801 {\r
 802         // Please set more than 0 mails per day!\r
 803         LOAD_TEMPLATE("admin_settings_saved", false, MEMBER_HAS_ZERO_MMAILS);\r
 804 }\r
 805  else\r
 806 {\r
 807         // Please confirm some mails first!\r
 808         LOAD_TEMPLATE("admin_settings_saved", false, MEMBER_LINKS_LEFT_1.$links.MEMBER_LINKS_LEFT_2.$CONFIG['unconfirmed'].MEMBER_LINKS_LEFT_3);\r
 809 }\r
 810 \r
 811 if (!empty($URL))\r
 812 {\r
 813         // Redirect to requested URL\r
 814         LOAD_URL($URL);\r
 815 }\r
 816 \r
 817 //\r
 818 ?>\r