Security line in all includes changed
[mailer.git] / inc / modules / member / what-order.php
1 <?php
2 /************************************************************************
3  * MXChange v0.2.1                                    Start: 10/19/2003 *
4  * ===============                              Last change: 08/26/2004 *
5  *                                                                      *
6  * -------------------------------------------------------------------- *
7  * File              : what-order.php                                   *
8  * -------------------------------------------------------------------- *
9  * Short description : Order mails here                                 *
10  * -------------------------------------------------------------------- *
11  * Kurzbeschreibung  : Hier koennen Ihre Mitglieder Mails buchen        *
12  * -------------------------------------------------------------------- *
13  *                                                                      *
14  * -------------------------------------------------------------------- *
15  * Copyright (c) 2003 - 2008 by Roland Haeder                           *
16  * For more information visit: http://www.mxchange.org                  *
17  *                                                                      *
18  * This program is free software; you can redistribute it and/or modify *
19  * it under the terms of the GNU General Public License as published by *
20  * the Free Software Foundation; either version 2 of the License, or    *
21  * (at your option) any later version.                                  *
22  *                                                                      *
23  * This program is distributed in the hope that it will be useful,      *
24  * but WITHOUT ANY WARRANTY; without even the implied warranty of       *
25  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        *
26  * GNU General Public License for more details.                         *
27  *                                                                      *
28  * You should have received a copy of the GNU General Public License    *
29  * along with this program; if not, write to the Free Software          *
30  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,               *
31  * MA  02110-1301  USA                                                  *
32  ************************************************************************/
33
34 // Some security stuff...
35 if (!defined('__SECURITY')) {
36         $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php";
37         require($INC);
38 } elseif (!IS_MEMBER()) {
39         LOAD_URL("modules.php?module=index");
40 } elseif (!EXT_IS_ACTIVE("order")) {
41         ADD_FATAL(EXTENSION_PROBLEM_EXT_INACTIVE, "order");
42         return;
43 }
44
45 // Add description as navigation point
46 ADD_DESCR("member", basename(__FILE__));
47
48 $URL = ""; $id = 0;
49 $whereStatement = " WHERE visible='Y'";
50
51 // Set undefined array elements
52 if (empty($_GET['msg']))       $_GET['msg']       = "";
53 if (empty($_POST['zip']))      $_POST['zip']      = "";
54 if (empty($_POST['html']))     $_POST['html']     = "";
55 if (empty($_POST['receiver'])) $_POST['receiver'] = "";
56 if (is_admin()) $whereStatement = "";
57
58 // Add slashes to every value
59 foreach($_POST as $key => $value)
60 {
61         // Skip submit buttons
62         if (($key != "data") && ($key != "frametester")) $_POST[$key] = addslashes($value);
63 }
64
65 // Minimum mails / order
66 define('__MIN_VALUE', $_CONFIG['order_min']);
67
68 // Count unconfirmed mails
69 $result_links = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_links WHERE userid=%s",
70  array($GLOBALS['userid']), __FILE__, __LINE__);
71 $links = SQL_NUMROWS($result_links);
72 SQL_FREERESULT($result_links);
73
74 // Does the user has more than 0 mails per day set?
75 $HOLIDAY="userid";
76 if (GET_EXT_VERSION("holiday") >= "0.1.3")
77 {
78         // Fetch also holiday activation data
79         $HOLIDAY = "holiday_active";
80 }
81
82 $result_mmails = SQL_QUERY_ESC("SELECT userid, receive_mails, mail_orders, ".$HOLIDAY."
83 FROM "._MYSQL_PREFIX."_user_data
84 WHERE userid=%s AND max_mails > 0 LIMIT 1",
85  array($GLOBALS['userid']), __FILE__, __LINE__);
86
87 $mmails = SQL_NUMROWS($result_mmails);
88 list($DMY, $MAXI, $ORDERS, $HOLIDAY) = SQL_FETCHROW($result_mmails);
89 SQL_FREERESULT($result_mmails);
90 if ($HOLIDAY == $DMY) $HOLIDAY='N';
91
92 $ALLOWED = $MAXI - $ORDERS;
93 if ($_CONFIG['order_max_full'] == "MAX") $ALLOWED = $MAXI;
94
95 // Check HTML extension
96 $HTML_EXT = EXT_IS_ACTIVE("html_mail");
97
98 // Now check his points amount
99 $result_p = SQL_QUERY_ESC("SELECT SUM(points) FROM "._MYSQL_PREFIX."_user_points WHERE userid=%s",
100  array($GLOBALS['userid']), __FILE__, __LINE__);
101
102 $TOTAL = 0;
103 if (SQL_NUMROWS($result_p) > 0)
104 {
105         // Load points
106         list($TOTAL) = SQL_FETCHROW($result_p);
107         SQL_FREERESULT($result_p);
108
109         // And subtract his used points...
110         $TOTAL -= GET_TOTAL_DATA($GLOBALS['userid'], "user_data", "used_points");
111
112         // Add (maybe) missing three zeros
113         if (!ereg(".", $TOTAL)) $TOTAL .= ".00000";
114 }
115
116 if (($HOLIDAY == "Y") && (GET_EXT_VERSION("holiday") >= "0.1.3"))
117 {
118         // Holiday is active!
119         SQL_FREERESULT($result_p);
120         LOAD_TEMPLATE("admin_settings_saved", false, HOLIDAY_ORDER_NOT_POSSIBLE);
121 }
122  elseif ((!empty($_POST['frametester'])) && ($ALLOWED > 0) && ($_POST['receiver'] > 0))
123 {
124         // Continue with the frametester, we first need to store the data temporary in the pool
125         //
126         // First we would like to store the data and get it's pool position back...
127         $result = SQL_QUERY_ESC("SELECT id, data_type FROM "._MYSQL_PREFIX."_pool WHERE sender=%s AND url='%s' AND timestamp > %s LIMIT 1",
128          array($GLOBALS['userid'], $_POST['url'], bigintval(time() - $_CONFIG['url_tlock'])), __FILE__, __LINE__);
129
130         $type = "TEMP"; $id = 0;
131         if (SQL_NUMROWS($result) == 1)
132         {
133                 list($id, $type) = SQL_FETCHROW($result);
134                 SQL_FREERESULT($result);
135         }
136         if ($type == "TEMP")
137         {
138                 // No entry found, so we need to check out the stats table as well... :)
139                 // We have to add that suff here, now we continue WITHOUT checking and check the text and subject against some filters
140                 $URL = "";
141                 if ($_CONFIG['test_text'] == "Y")
142                 {
143                         // Test submitted text against some filters (length, URLs in text etc.)
144                         if ((strpos(strtolower($_POST['text']), "https://") > -1) || (strpos(strtolower($_POST['text']), "http://") > -1) || (strpos(strtolower($_POST['text']), "www") > -1))
145                         {
146                                 // URL found!
147                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_URL_FOUND;
148                         }
149                         $TEST = str_replace("\n", "", str_replace("\r", "", addslashes($_POST['text'])));
150                         if (strlen($TEST) > $_CONFIG['max_tlength'])
151                         {
152                                 // Text is too long!
153                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_OVERLENGTH;
154                         }
155                 }
156                 // Shall I test the subject line against URLs?
157                 if ($_CONFIG['test_subj'] == "Y")
158                 {
159                         // Check the subject line for issues
160                         $_POST['subject'] = str_replace("\\", "[nl]", substr($_POST['subject'], 0, 200));
161                         if ((strpos(strtolower($_POST['subject']), "http://") > -1) || (strpos(strtolower($_POST['subject']), "www") > -1))
162                         {
163                                 // URL in subject found
164                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_SUBJ_URL;
165                         }
166                 }
167                 // And shall I check that his URL is not in the black list?
168                 if ($_CONFIG['url_blacklist'] == "Y")
169                 {
170                         // Ok, I do that for you know...
171                         $result = SQL_QUERY_ESC("SELECT timestamp FROM "._MYSQL_PREFIX."_url_blist WHERE url='%s' LIMIT 1",
172                          array($_POST['url']), __FILE__, __LINE__);
173
174                         if (SQL_NUMROWS($result) == 1)
175                         {
176                                 // Jupp, we got one listed
177                                 list($blist) = SQL_FETCHROW($result);
178                                 SQL_FREERESULT($result);
179                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_BLIST_URL."&blist=".$blist;
180                         }
181                 }
182                 if (($_POST['receiver'] < $_CONFIG['order_min']) && (!IS_ADMIN()))
183                 {
184                         // Less than allowed receivers entered!
185                         $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_MORE_RECEIVERS3;
186                 }
187
188                 // Validate URL
189                 if (!VALIDATE_URL($_POST['url']))
190                 {
191                         // URL is invalid!
192                         $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_INVALID_URL;
193                 }
194
195                 // Probe for HTML extension
196                 if ($HTML_EXT)
197                 {
198                         if ($_POST['html'] == "Y")
199                         {
200                                 // Chek for valid HTML tags
201                                 $_POST['text'] = HTML_CHECK_TAGS($_POST['text']);
202
203                                 // Maybe invalid tags found?
204                                 if (empty($_POST['text'])) $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_INVALID_TAGS."&id=".$id;
205                         }
206                          else
207                         {
208                                 // Remove any HTML code
209                                 $_POST['text'] = str_replace("<", "{OPEN_HTML}", str_replace(">", "{CLOSE_HTML}", $_POST['text']));
210                         }
211                 }
212         }
213          elseif (!IS_ADMIN())
214         {
215                 // He has already sent a mail within a specific time
216                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_URL_TLOCK."&id=".$id;
217         }
218         if (empty($URL))
219         {
220                 // Check if category and number of receivers is okay
221                 $ADD = "";
222                 if (($_CONFIG['order_multi_page'] == "Y") && (!empty($_POST['zip']))) $ADD = "AND d.zip LIKE '".bigintval($_POST['zip'])."{PER}'";
223
224                 // Check for userids
225                 $result = SQL_QUERY_ESC("SELECT DISTINCT c.userid FROM "._MYSQL_PREFIX."_user_cats AS c
226 LEFT JOIN "._MYSQL_PREFIX."_user_data AS d
227 ON c.userid=d.userid
228 WHERE c.cat_id=%s AND c.userid != '%s' AND d.status='CONFIRMED' AND d.receive_mails > 0
229 ".$ADD."
230 ORDER BY d.%s %s",
231  array(
232         bigintval($_POST['cat']),
233         $GLOBALS['userid'],
234         $_CONFIG['order_select'],
235         $_CONFIG['order_mode'],
236  ), __FILE__, __LINE__);
237
238                 // Do we enougth receivers left?
239                 if (SQL_NUMROWS($result) >= $_POST['receiver'])
240                 {
241                         // Check for holiday extensions
242                         $HOLIDAY = false;
243                         if (GET_EXT_VERSION("holiday") >= "0.1.3")
244                         {
245                                 // Include checking for users in holiday
246                                 $HOLIDAY = true;
247                         }
248
249                         // Load receivers from database
250                         $TEST = array(); $cnt = 0;
251                         while (list($REC) = SQL_FETCHROW($result))
252                         {
253                                 if ($HOLIDAY)
254                                 {
255                                         // Check for his holiday status
256                                         $result_holiday = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_holidays
257 WHERE userid=%s AND holiday_start < UNIX_TIMESTAMP() AND holiday_end > UNIX_TIMESTAMP() LIMIT 1",
258  array(bigintval($REC)), __FILE__, __LINE__);
259                                         if (SQL_NUMROWS($result_holiday) == 1) $REC = 0; // Exclude user who are in holiday
260
261                                         // Free memory
262                                         SQL_FREERESULT($result_holiday);
263                                 }
264
265                                 if ($REC > 0)
266                                 {
267                                         // Add receiver
268                                         $TEST[] = $REC;
269                                         $cnt++;
270                                 }
271                         }
272
273                         // Free memory
274                         SQL_FREERESULT($result);
275
276                         // Implode array into string for the sending pool
277                         $RECEIVER = implode($TEST, ";");
278
279                         // Count array for maximum sent
280                         $MAX_SEND = count($TEST);
281
282                         // Update receiver list
283                         $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_user_data SET receive_mails=receive_mails-1 WHERE userid IN (%s) LIMIT %s",
284                          array(str_replace(";", ", ", $RECEIVER), $MAX_SEND), __FILE__, __LINE__);
285
286                         // Is calculated max receivers larger than wanted receivers then reset it
287                         if ($MAX_SEND > $_POST['receiver']) $MAX_SEND = $_POST['receiver'];
288
289                         // Calculate used points
290                         $USED = $MAX_SEND * GET_PAY_POINTS(bigintval($_POST['type']));
291
292                         // Check if he has enougth points for this order and selected more than 0 receivers
293                         if (($USED > 0) && ($USED <= $TOTAL) && ($MAX_SEND > 0))
294                         {
295                                 // Gettings points is okay, so we can add $USED later from
296                                 $TIME = time();
297                                 if (($id == "0") || ($type != "TEMP"))
298                                 {
299                                         // New order
300                                         $id = 0;
301                                         if ($HTML_EXT)
302                                         {
303                                                 // HTML extension is active
304                                                 $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_pool (sender, subject, text, receivers, payment_id, data_type, timestamp, url, cat_id, target_send, zip, html_msg)
305  VALUES ('%s', '%s', '%s', '%s', '%s', 'TEMP', '%s', '%s', '%s', '%s', '%s', '%s')",
306 array(
307         $GLOBALS['userid'],
308         addslashes($_POST['subject']),
309         addslashes($_POST['text']),
310         $RECEIVER,
311         bigintval($_POST['type']),
312         $TIME,
313         $_POST['url'],
314         bigintval($_POST['cat']),
315         $MAX_SEND,
316         bigintval($_POST['zip']),
317         $_POST['html']
318 ), __FILE__, __LINE__);
319                                         }
320                                          else
321                                         {
322                                                 // No HTML extension is active
323                                                 $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_pool (sender, subject, text, receivers, payment_id, data_type, timestamp, url, cat_id, target_send, zip)
324  VALUES ('%s', '%s', '%s', '%s', '%s', 'TEMP', '%s', '%s', '%s', '%s', '%s')",
325 array(
326         $GLOBALS['userid'],
327         addslashes($_POST['subject']),
328         addslashes($_POST['text']),
329         $RECEIVER,
330         bigintval($_POST['type']),
331         $TIME,
332         $_POST['url'],
333         bigintval($_POST['cat']),
334         $MAX_SEND,
335         bigintval($_POST['zip']),
336 ), __FILE__, __LINE__);
337                                         }
338                                 }
339                                  else
340                                 {
341                                         // Change current order
342                                         if ($HTML_EXT)
343                                         {
344                                                 // HTML extension is active
345                                                 $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET
346 subject='%s',
347 text='%s',
348 receivers='%s',
349 payment_id=%s,
350 timestamp=UNIX_TIMESTAMP(),
351 url='%s',
352 cat_id=%s,
353 target_send=%s,
354 zip=%s,
355 html_msg='%s'
356 WHERE id=%s LIMIT 1",
357 array(
358         $_POST['subject'],
359         $_POST['text'],
360         $RECEIVER,
361         bigintval($_POST['type']),
362         $_POST['url'],
363         bigintval($_POST['cat']),
364         $MAX_SEND,
365         bigintval($_POST['zip']),
366         $_POST['html'],
367         bigintval($id)
368 ), __FILE__, __LINE__);
369                                         }
370                                          else
371                                         {
372                                                 // No HTML extension is active
373                                                 $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET
374 subject='%s',
375 text='%s',
376 receivers='%s',
377 payment_id=%s,
378 timestamp=UNIX_TIMESTAMP(),
379 url='%s',
380 cat_id=%s,
381 target_send=%s,
382 zip=%s
383 WHERE id=%s LIMIT 1",
384 array(
385         $_POST['subject'],
386         $_POST['text'],
387         $RECEIVER,
388         bigintval($_POST['type']),
389         $_POST['url'],
390         bigintval($_POST['cat']),
391         $MAX_SEND,
392         bigintval($_POST['zip']),
393         bigintval($id)
394 ), __FILE__, __LINE__);
395                                         }
396                                 }
397
398                                 // Do we need to get the ID number?
399                                 if ($id == 0) {
400                                         // Order is placed as temporary. We need to get it's id for the frametester
401                                         $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_pool WHERE sender=%s AND subject='%s' AND payment_id=%s AND data_type='TEMP' AND timestamp=%s LIMIT 1",
402                                         array(
403                                                 $GLOBALS['userid'],
404                                                 $_POST['subject'],
405                                                 bigintval($_POST['type']),
406                                                 $TIME
407                                         ), __FILE__, __LINE__);
408
409                                         list($id) = SQL_FETCHROW($result);
410                                         SQL_FREERESULT($result);
411                                 }
412
413                                 // ID is received so we can redirect the user, used points will be added when he send's out the mail
414                                 $URL = URL."/modules.php?module=frametester&amp;order=".$id."";
415                         }
416                          elseif ($MAX_SEND == 0)
417                         {
418                                 // Not enougth receivers found which can receive mails
419                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_MORE_RECEIVERS2;
420                         }
421                          else
422                         {
423                                 // No enougth points left!
424                                 $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_MORE_POINTS;
425                         }
426                 }
427                  else
428                 {
429                         // Ordered more mails than he can send in this category
430                         $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_NO_RECS_LEFT;
431                 }
432         }
433 }
434  elseif ($_POST['receiver'] == "0")
435 {
436         // Not enougth receivers selected
437         $URL = URL."/modules.php?module=login&amp;what=order&amp;msg=".CODE_MORE_RECEIVERS1;
438 }
439  elseif (($ALLOWED == 0) && ($_CONFIG['order_max_full'] == "ORDER"))
440 {
441         // No more mail orders allowed
442         LOAD_TEMPLATE("admin_settings_saved", false, MEMBER_ORDER_ALLOWED_EXHAUSTED);
443 }
444  elseif (($links < $_CONFIG['unconfirmed']) && ($mmails == "1"))
445 {
446         // Display order form
447         $result_cats = SQL_QUERY("SELECT id, cat FROM "._MYSQL_PREFIX."_cats".$whereStatement." ORDER BY sort", __FILE__, __LINE__);
448         if (SQL_NUMROWS($result_cats) > 0)
449         {
450                 if ($TOTAL > 0)
451                 {
452                         // Initialize array...
453                         $CATS = array(
454                                 'id'   => array(),
455                                 'name' => array(),
456                                 'uids' => array()
457                         );
458
459                         // Enable HTML checking
460                         $HTML = ""; $HOLIDAY = false; $HOL_STRING = "";
461                         if (($HTML_EXT) && ($_POST['html'] == "Y")) $HTML = " AND html='Y'";
462                         if (GET_EXT_VERSION("holiday") >= "0.1.3")
463                         {
464                                 // Extension's version is fine
465                                 $HOLIDAY = true; $HOL_STRING = " AND holiday_active='N'";
466                         }
467
468                         // ... and begin loading stuff
469                         while (list($id, $cat) = SQL_FETCHROW($result_cats))
470                         {
471                                 $CATS['id'][]   = bigintval($id);
472                                 $CATS['name'][] = $cat;
473
474                                 // Select users in current category
475                                 $result_uids = SQL_QUERY_ESC("SELECT userid FROM "._MYSQL_PREFIX."_user_cats WHERE cat_id=%s AND userid != '%s' ORDER BY userid",
476                                  array(bigintval($id), $GLOBALS['userid']), __FILE__, __LINE__);
477
478                                 $uid_cnt = 0;
479                                 while (list($ucat) = SQL_FETCHROW($result_uids))
480                                 {
481                                         // Check for holiday system
482                                         $HOL_ACTIVE = false;
483                                         if ($HOLIDAY)
484                                         {
485                                                 // Check user's holiday status
486                                                 $result_holiday = SQL_QUERY_ESC("SELECT DISTINCT d.userid FROM "._MYSQL_PREFIX."_user_data AS d
487 LEFT JOIN "._MYSQL_PREFIX."_user_holidays AS h
488 ON d.userid=h.userid
489 WHERE d.userid=%s AND d.receive_mails > 0 AND d.status='CONFIRMED' AND d.holiday_active='Y'
490 AND h.holiday_start < UNIX_TIMESTAMP() AND h.holiday_end > UNIX_TIMESTAMP()
491 LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__);
492                                                 if (SQL_NUMROWS($result_holiday) == 1)
493                                                 {
494                                                         // Holiday is active!
495                                                         $HOL_ACTIVE = true;
496                                                 }
497
498                                                 // Free memory
499                                                 SQL_FREERESULT($result_holiday);
500                                         }
501
502                                         if (!$HOL_ACTIVE)
503                                         {
504                                                 // Check if the user want's to receive mails?
505                                                 $result_ver = SQL_QUERY_ESC("SELECT zip FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s".$HTML." AND receive_mails > 0 AND status='CONFIRMED' LIMIT 1",
506                                                  array(bigintval($ucat)), __FILE__, __LINE__);
507
508                                                 if ((SQL_NUMROWS($result_ver) == 1) && (!empty($_POST['zip'])) && ($_CONFIG['order_multi_page'] == "Y"))
509                                                 {
510                                                         list($zip) = SQL_FETCHROW($result_ver);
511                                                         SQL_FREERESULT($result_ver);
512                                                         if (substr($zip, 0, strlen($_POST['zip'])) == $_POST['zip'])
513                                                         {
514                                                                 // Ok, ZIP part is found
515                                                                 $uid_cnt++;
516                                                         }
517                                                 }
518                                                  else
519                                                 {
520                                                         // Count numbers up!
521                                                         $uid_cnt += SQL_NUMROWS($result_ver);
522                                                 }
523                                         }
524                                 }
525
526                                 // Free memory
527                                 SQL_FREERESULT($result_uids);
528                                 $CATS['uids'][] = $uid_cnt;
529                         }
530
531                         // Free memory
532                         SQL_FREERESULT($result_cats);
533
534                         // Now we need to load the mail types...
535                         $result = SQL_QUERY("SELECT id, price, payment, mail_title FROM "._MYSQL_PREFIX."_payments ORDER BY payment", __FILE__, __LINE__);
536
537                         $typeS = array();
538                         if (SQL_NUMROWS($result) > 0)
539                         {
540                                 // Check for message ID in URL
541                                 $MSG = "";
542                                 switch ($_GET['msg'])
543                                 {
544                                 case CODE_URL_TLOCK:
545                                         $result = SQL_QUERY_ESC("SELECT timestamp FROM "._MYSQL_PREFIX."_pool WHERE id=%s LIMIT 1",
546                                          array(bigintval($_GET['id'])), __FILE__, __LINE__);
547
548                                         // Load timestamp from last order
549                                         list($LORDER) = SQL_FETCHROW($result);
550                                         $LORDER = MAKE_DATETIME($LORDER, "1");
551
552                                         // Free memory
553                                         SQL_FREERESULT($result);
554
555                                         // Calculate hours...
556                                         $STD = round($_CONFIG['url_tlock'] / 60 / 60);
557
558                                         // Minutes...
559                                         $MIN = round(($_CONFIG['url_tlock'] - $STD * 60 * 60) / 60);
560
561                                         // And seconds
562                                         $SEC = $_CONFIG['url_tlock'] - $STD * 60 * 60 - $MIN * 60;
563
564                                         // Finally contruct the message
565                                         $MSG = MEMBER_URL_TIME_LOCK."<br />".CONFIG_URL_TLOCK." ".$STD." ".
566                                                 _HOURS.", ".$MIN." "._MINUTES." "._AND." ".$SEC." "._SECONDS."<br />".
567                                                 MEMBER_LAST_TLOCK.": ".$LORDER;
568                                         break;
569
570                                 case CODE_OVERLENGTH:
571                                         $MSG = MEMBER_TEXT_OVERLENGTH;
572                                         break;
573
574                                 case CODE_URL_FOUND:
575                                         $MSG = MEMBER_TEXT_CONTAINS_URL;
576                                         break;
577
578                                 case CODE_SUBJ_URL:
579                                         $MSG = MEMBER_SUBJ_CONTAINS_URL;
580                                         break;
581
582                                 case CODE_BLIST_URL:
583                                         $MSG = MEMBER_URL_BLACK_LISTED."<br />
584 ".MEMBER_BLIST_TIME.": ".MAKE_DATETIME($_GET['blist'], "0");
585                                         break;
586
587                                 case CODE_NO_RECS_LEFT:
588                                         $MSG = MEMBER_SELECTED_MORE_RECS;
589                                         break;
590
591                                 case CODE_INVALID_TAGS:
592                                         $MSG = MEMBER_HTML_INVALID_TAGS;
593                                         break;
594
595                                 case CODE_MORE_POINTS:
596                                         $MSG = MEMBER_MORE_POINTS_NEEDED;
597                                         break;
598
599                                 case CODE_MORE_RECEIVERS1:
600                                         $MSG = MEMBER_ENTER_MORE_RECEIVERS;
601                                         break;
602
603                                 case CODE_MORE_RECEIVERS2:
604                                         $MSG = MEMBER_NO_MORE_RECEIVERS_FOUND;
605                                         break;
606
607                                 case CODE_MORE_RECEIVERS3:
608                                         $MSG = MEMBER_ENTER_MORE_MIN_RECEIVERS_1.$_CONFIG['order_min'].MEMBER_ENTER_MORE_MIN_RECEIVERS_2;
609                                         break;
610
611                                 case CODE_INVALID_URL:
612                                         $MSG = MEMBER_ENTER_INVALID_URL;
613                                         break;
614
615                                 case "": // When no error code is included in the URL we do not need to output an error message as well...
616                                         break;
617
618                                 default:
619                                         $MSG = UNKNOWN_CODE_1.$_GET['msg'].UNKNOWN_CODE_2;
620                                         break;
621                                 }
622                                 if (!empty($MSG))
623                                 {
624                                         // We got system message so we drop it out to the user
625                                         LOAD_TEMPLATE("admin_settings_saved", false, $MSG);
626                                 }
627
628                                 // Load all email types...
629                                 while ($typeS[] = SQL_FETCHROW($result))
630                                 {
631                                         // Nothing to do here... ;-)
632                                 }
633
634                                 // Free memory
635                                 SQL_FREERESULT($result);
636
637                                 // Output user's points
638                                 $TOTAL = TRANSLATE_COMMA($TOTAL);
639
640                                 // Check how many mail orders he has placed today and how many he's allowed to send
641                                 switch ($_CONFIG['order_max_full'])
642                                 {
643                                 case "MAX": // He is allowed to send as much as possible
644                                         define('ORDER_MAX_VALUE', ORDER_ALLOED_MAX);
645                                         break;
646
647                                 case "ORDER": // He is allowed to send as much as he setup the receiving value
648                                         define('ORDER_MAX_VALUE', ORDER_ALLOWED_RECEIVE_1.$ALLOWED.ORDER_ALLOWED_RECEIVE_2.$MAXI.ORDER_ALLOWED_RECEIVE_3);
649                                         break;
650                                 }
651
652                                 // Load final template
653                                 LOAD_TEMPLATE("member_order_points", false, $TOTAL);
654
655                                 // Reset variables
656                                 $OLD_ORDER = false; $subject = ""; $text = ""; $target = "";
657
658                                 // Check if we already have an order placed and make it editable
659                                 $result = SQL_QUERY_ESC("SELECT subject, text, payment_id, timestamp, url, target_send, cat_id, zip FROM "._MYSQL_PREFIX."_pool WHERE sender=%s AND data_type='TEMP' LIMIT 1",
660                                  array($GLOBALS['userid']), __FILE__, __LINE__);
661
662                                 if (SQL_NUMROWS($result) == 1)
663                                 {
664                                         // Old order found
665                                         list($subject, $text, $payment, $tstamp, $url, $target, $cat, $zip) = SQL_FETCHROW($result);
666                                         SQL_FREERESULT($result);
667
668                                         // Fix max receivers when it is too much
669                                         if ($target > $CATS['uids'][$cat]) $target = $CATS['uids'][$cat];
670
671                                         // Old order is grabbed
672                                         $OLD_ORDER = true;
673                                 }
674                                  else
675                                 {
676                                         // Default output for that your members don't forget it...
677                                         $url = "http://";
678                                 }
679
680                                 // 01      2                       21    12                             2    23         443    3          3210
681                                 if ((!empty($_POST['data'])) || (($_CONFIG['order_multi_page'] == "N") && ((!IS_ADMIN()) && (!$HTML_EXT))))
682                                 {
683                                         // Pre-output categories
684                                         $CAT = "";
685                                         foreach ($CATS['id'] as $key => $value)
686                                         {
687                                                 $CAT .= "      <OPTION value=\"".$value."\"";
688                                                 if (($OLD_ORDER) && ($cat == $value)) $CAT .= " selected=\"selected\"";
689                                                 $CAT .= ">".$CATS['name'][$key]." (".$CATS['uids'][$key]." ".USER_IN_CAT.")</OPTION>\n";
690                                         }
691                                         // Mail type
692                                         $type = "";
693                                         foreach ($typeS as $key => $value)
694                                         {
695                                                 $P = TRANSLATE_COMMA($typeS[$key][1]);
696                                                 if (is_array($value))
697                                                 {
698                                                         // Output option line
699                                                         $type .= "      <OPTION value=\"".$typeS[$key][0]."\"";
700                                                         if (($OLD_ORDER) && ($payment == $typeS[$key][0])) $type .= " selected=\"selected\"";
701                                                         $type .= ">".$P." ".PER_MAIL." - ".$typeS[$key][3]." - ".round($typeS[$key][2])." ".PAYMENT."</OPTION>\n";
702                                                 }
703                                         }
704
705                                         // Put all in constants for the template
706                                         define('CATEGORY_SELECTION', $CAT);
707                                         define('TYPE_SELECTION', $type);
708                                         define('TARGET', $target);
709                                         define('SUBJECT', $subject);
710                                         define('TEXT', COMPILE_CODE($text));
711                                         define('T_URL', $url);
712
713                                         if (!empty($_POST['zip']))
714                                         {
715                                                 // Output entered ZIP code
716                                                 define('ZIP_OUTPUT', LOAD_TEMPLATE("member_order-zip2", true, $_POST['zip']));
717                                         }
718                                          else
719                                         {
720                                                 define('ZIP_OUTPUT', "<TR><TD colspan=\"5\" height=\"5\" class=\"seperator\">&nbsp;</TD></TR>");
721                                         }
722                                         // HTML extension
723                                         if (($HTML_EXT) && ($_POST['html'] == "Y"))
724                                         {
725                                                 // Extension is active so output valid HTML tags
726                                                 define('MEMBER_HTML_EXTENSION', LOAD_TEMPLATE("member_order-html_ext", true, HTML_ADD_VALID_TAGS()));
727                                         }
728                                          else
729                                         {
730                                                 // Extension not active and/or class not uploaded
731                                                 define('MEMBER_HTML_EXTENSION', "<TR><TD colspan=\"5\"><INPUT type=\"hidden\" name=\"html\" value=\"N\"></TD></TR>");
732                                         }
733
734                                         // Output form for page 2
735                                         LOAD_TEMPLATE("member_order_page2");
736                                 }
737                                  else
738                                 {
739                                         // Remember maybe entered ZIP code in constant
740                                         $ADD = "";
741                                         if ($HTML_EXT)
742                                         {
743                                                 // Add some content when html extension is active
744                                                 if (($_CONFIG['order_multi_page'] == "Y") || (IS_ADMIN())) $ADD = "<TR><TD colspan=\"2\" class=\"seperator bottom2\" height=\"5\">&nbsp;</TD></TR>\n";
745                                                 define('MEMBER_HTML_EXTENSION', LOAD_TEMPLATE("member_order-html_intro", true));
746                                         }
747                                          else
748                                         {
749                                                 // No HTML extension installed
750                                                 define('MEMBER_HTML_EXTENSION', "<TR><TD colspan=\"2\"><INPUT type=\"hidden\" name=\"html\" value=\"N\"></TD></TR>");
751                                         }
752                                         // Do we want ZIP code or not?
753                                         if (($_CONFIG['order_multi_page'] == "Y") || (IS_ADMIN()))
754                                         {
755                                                 // Yes
756                                                 $content = array(
757                                                         'zip' => $_POST['zip'],
758                                                         'add' => $ADD
759                                                 );
760                                                 define('MEMBER_ZIP_CONTENT', LOAD_TEMPLATE("member_order-zip1", true, $content));
761                                         }
762                                          else
763                                         {
764                                                 // No
765                                                 define('MEMBER_ZIP_CONTENT', "");
766                                         }
767
768                                         // Output form for page 1 (ZIP code or HTML)
769                                         LOAD_TEMPLATE("member_order_page1");
770                                 }
771                         }
772                          else
773                         {
774                                 // No mail types defined
775                                 OUTPUT_HTML("<STRONG><SPAN class=\"member_failed\">".MEMBER_NO_PAYMENTS."</SPAN></STRONG>");
776                         }
777                 }
778                  else
779                 {
780                         // No points left!
781                         OUTPUT_HTML("<STRONG><SPAN class=\"member_failed\">".MEMBER_NO_POINTS."</SPAN></STRONG>");
782                 }
783         }
784          else
785         {
786                 // No cateogries are defined yet
787                 OUTPUT_HTML("<STRONG><SPAN class=\"member_failed\">".MEMBER_NO_CATS."</SPAN></STRONG>");
788         }
789 }
790  elseif ($mmails == "0")
791 {
792         // Please set more than 0 mails per day!
793         LOAD_TEMPLATE("admin_settings_saved", false, MEMBER_HAS_ZERO_MMAILS);
794 }
795  else
796 {
797         // Please confirm some mails first!
798         LOAD_TEMPLATE("admin_settings_saved", false, MEMBER_LINKS_LEFT_1.$links.MEMBER_LINKS_LEFT_2.$_CONFIG['unconfirmed'].MEMBER_LINKS_LEFT_3);
799 }
800
801 if (!empty($URL))
802 {
803         // Redirect to requested URL
804         LOAD_URL($URL);
805 }
806
807 //
808 ?>