also prevent it in .htacces. You may want to add this to one of your files in /etc...
[mailer.git] / beg.php
diff --git a/beg.php b/beg.php
index c411b85b9e7ef9fe3389bca403eea47b27242a6f..5114836eb16db9ff3e76d491993af5bb349fa250 100644 (file)
--- a/beg.php
+++ b/beg.php
@@ -1,7 +1,7 @@
 <?php
 /************************************************************************
- * MXChange v0.2.1                                    Start: 01/09/2005 *
- * ===============                              Last change: 01/09/2005 *
+ * Mailer v0.2.1-FINAL                                Start: 01/09/2005 *
+ * ===================                          Last change: 01/09/2005 *
  *                                                                      *
  * -------------------------------------------------------------------- *
  * File              : beg.php                                          *
  * -------------------------------------------------------------------- *
  * Kurzbeschreibung  : Bettel-Link fuer Mitglieder                      *
  * -------------------------------------------------------------------- *
- * $Revision::                                                        $ *
- * $Date::                                                            $ *
- * $Tag:: 0.2.1-FINAL                                                 $ *
- * $Author::                                                          $ *
- * Needs to be in all Files and every File needs "svn propset           *
- * svn:keywords Date Revision" (autoprobset!) at least!!!!!!            *
- * -------------------------------------------------------------------- *
  * Copyright (c) 2003 - 2009 by Roland Haeder                           *
- * For more information visit: http://www.mxchange.org                  *
+ * Copyright (c) 2009 - 2016 by Mailer Developer Team                   *
+ * For more information visit: http://mxchange.org                      *
  *                                                                      *
  * This program is free software; you can redistribute it and/or modify *
  * it under the terms of the GNU General Public License as published by *
 require('inc/libs/security_functions.php');
 
 // Init start time
-$GLOBALS['startTime'] = microtime(true);
+$GLOBALS['__start_time'] = microtime(TRUE);
 
-// Set module
-$GLOBALS['module'] = 'beg';
-$GLOBALS['output_mode'] = -1;
-$errorCode = null;
+// Set module and output mode (HTML)
+$GLOBALS['__module']      = 'beg';
+$GLOBALS['__output_mode'] = '0';
+$errorCode = NULL;
 
-// Load the required file(s)
-require('inc/config-global.php');
+// Initialize application
+require('inc/init.php');
 
 // Set content type
 setContentType('text/html');
 
 // Is the 'beg' extension active?
-REDIRCT_ON_UNINSTALLED_EXTENSION('beg');
+redirectOnUninstalledExtension('beg');
 
 // Check for userid
 if (isGetRequestElementSet('userid')) {
        // Init variables
-       $userid = 0;
-       $result = false;
-       $points = 0;
+       $points = '0';
 
        // Don't pay is the default...
-       $pay = false;
+       $isPayed = FALSE;
 
        // Validate if it is not a number
-       if (''.(getRequestElement('userid') + 0).'' !== ''.getRequestElement('userid').'') {
-               if (isExtensionActive('nickname')) {
-                       // Maybe we have found a nickname?
-                       $result = SQL_QUERY_ESC("SELECT `userid`, `beg_clicks`, `ref_payout`, `status`, `last_online` FROM `{?_MYSQL_PREFIX?}_user_data` WHERE `nickname`='%s' LIMIT 1",
-                               array(getRequestElement('userid')), __FILE__, __LINE__);
-               } else {
-                       // Nickname entered but nickname is not active
-                       $errorCode = getCode('EXTENSION_PROBLEM');
-                       $userid = -1;
-               }
+       if ((isExtensionActive('nickname')) && (isNicknameUsed(getRequestElement('userid')))) {
+               // Maybe a nickname is provided?
+               fetchUserData(getRequestElement('userid'), 'nickname');
+       } elseif (isNicknameUsed(getRequestElement('userid'))) {
+               // Nickname entered but nickname is not active
+               $errorCode = getCode('EXTENSION_PROBLEM');
        } else {
                // Direct userid
-               $result = SQL_QUERY_ESC("SELECT `userid`, `beg_clicks`, `ref_payout`, `status`, `last_online` FROM `{?_MYSQL_PREFIX?}_user_data` WHERE `userid`=%s LIMIT 1",
-                       array(bigintval(getRequestElement('userid'))), __FILE__, __LINE__);
+               fetchUserData(getRequestElement('userid'));
        }
 
        // Check if locked in so don't pay points
        $status = 'failed';
 
        // Check if account was found
-       if (SQL_NUMROWS($result) == 1) {
-               // Found an ID so we simply set it
-               list($userid, $clicks, $ref_payout, $status, $last) = SQL_FETCHROW($result);
-
-               // Account confirmed?
-               if ($status == 'CONFIRMED') {
-                       // Secure userid
-                       $userid = bigintval($userid);
-
-                       // Multiply configured values with 100000 and divide with 100000 so we can also handle small values
-                       // If we need more number behind the decimal dot then we just need to increase all these three
-                       // numbers matching to the numbers behind the decimal dot. Simple! ;-)
-                       $points = mt_rand((getConfig('beg_points') * 100000), (getConfig('beg_points_max') * 100000)) / 100000;
-
-                       // Set nickname / userid for the template(s
-                       $content['userid'] = getRequestElement('userid');
-                       $content['clicks'] = ($clicks + 1);
-                       $content['banner'] = loadTemplate('beg_banner', true);
-                       $content['points'] = translateComma($points);
-               } else {
-                       // Other status
-                       $userid = 0;
-               }
+       if ((isValidUserData()) && (getUserData('status') == 'CONFIRMED')) {
+               /*
+                * Multiply configured values with 100000 and divide with 100000 so we can also handle small values
+                * If we need more number behind the decimal dot then we just need to increase all these three
+                * numbers matching to the numbers behind the decimal dot. Simple! ;-)
+                */
+               $points = mt_rand((getBegPoints() * 100000), (getBegPointsMax() * 100000)) / 100000;
+
+               // Set nickname / userid for template
+               $content['userid']        = getRequestElement('userid');
+               $content['clicks']        = (getUserData('beg_clicks') + 1);
+               $content['points']        = $points;
        } // END - if
 
-       // Free memory
-       SQL_FREERESULT($result);
-
        // User id valid and not webmaster's id?
-       if (($userid > 0) && (getConfig('beg_userid') != $userid)) {
+       if ((isValidId(getUserData('userid'))) && (getBegUserid() != getUserData('userid'))) {
                // Update counter
-               SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_user_data` SET `beg_clicks`=`beg_clicks`+1 WHERE `userid`=%s AND `status`='CONFIRMED' LIMIT 1",
-                       array($userid), __FILE__, __LINE__);
+               sqlQueryEscaped("UPDATE `{?_MYSQL_PREFIX?}_user_data` SET `beg_clicks`=`beg_clicks`+1 WHERE `userid`=%s LIMIT 1",
+                       array(getUserData('userid')), __FILE__, __LINE__);
 
-               // Check for last entry for userid w/o IP number
-               $result = SQL_QUERY_ESC("SELECT `id` FROM `{?_MYSQL_PREFIX?}_beg_ips` WHERE (timeout > (UNIX_TIMESTAMP() - ".getConfig('beg_timeout').") OR (timeout > (UNIX_TIMESTAMP() - ".getConfig('beg_userid_timeout').") AND `userid`=%s)) AND (remote_ip='%s' OR sid='%s') LIMIT 1",
-               array($userid, detectRemoteAddr(), session_id()), __FILE__, __LINE__);
+               // Check for last entry for userid w/o IP number                            12              33                               2    23              44            3                                          21     1                              1
+               $result = sqlQueryEscaped("SELECT `id` FROM `{?_MYSQL_PREFIX?}_beg_ips` WHERE ((UNIX_TIMESTAMP() - `timeout`) >= {?beg_timeout?} OR ((UNIX_TIMESTAMP() - `timeout`) >= {?beg_userid_timeout?} AND `userid`=%s)) AND (`remote_ip`='%s' OR `sid`='%s') LIMIT 1",
+                       array(
+                               getUserData('userid'),
+                               determineRealRemoteAddress(),
+                               session_id()
+                       ), __FILE__, __LINE__);
 
                // Entry not found, points set and not logged in?
-               if (((SQL_NUMROWS($result) == 0) || (isAdmin())) && ($points > 0) && (!isMember()) && (getConfig('beg_pay_mode') == 'NONE')) {
+               //* DEBUG: */ logDebugMessage(__FILE__, __LINE__, 'SQL_HASZERONUMS()=' . intval(SQL_HASZERONUMS($result)) . ',isAdmin()=' . intval(isAdmin()) . ',points=' . $points . ',isMember()=' . intval(isMember()) . ',getBegPayMode()=' . getBegPayMode());
+               if ((ifSqlHasZeroNumRows($result)) && ($points > 0) && (getBegPayMode() == 'NONE') && ((!isMember()) || (isAdmin()))) {
+                       // Default is result from isAdmin(), mostly false
+                       $isPayed = isAdmin();
 
                        // Admin is testing?
                        if (!isAdmin()) {
-                               // Remember remote address, userid and timestamp for next click
-                               // but only when there is no admin begging.
-                               // Admins shall be able to test it!
-                               SQL_QUERY_ESC("INSERT INTO `{?_MYSQL_PREFIX?}_beg_ips` (`userid`, `remote_ip`,`sid`, `timeout`) VALUES ('%s','%s','%s', UNIX_TIMESTAMP())",
-                                       array($userid, detectRemoteAddr(), session_id()), __FILE__, __LINE__);
+                               /*
+                                * Remember remote address, userid and timestamp for next click
+                                * but only when there is no admin begging.
+                                * Admins shall be able to test it!
+                                */
+                               sqlQueryEscaped("INSERT INTO `{?_MYSQL_PREFIX?}_beg_ips` (`userid`, `remote_ip`, `sid`, `timeout`) VALUES ('%s','%s','%s', UNIX_TIMESTAMP())",
+                                       array(
+                                               getUserData('userid'),
+                                               determineRealRemoteAddress(),
+                                               session_id()
+                                       ), __FILE__, __LINE__);
 
                                // Was is successfull?
-                               $pay (SQL_AFFECTEDROWS() == 1);
-                       } else {
-                               // Is admin!
-                               $pay = true;
-                       }
+                               $isPayed = (!ifSqlHasZeroAffectedRows());
+                       } // END - if
 
                        // Pay points?
-                       if ($pay === true) {
+                       //* DEBUG: */ logDebugMessage(__FILE__, __LINE__, 'isPayed=' . intval($isPayed));
+                       if ($isPayed === TRUE) {
                                // Add points to user or begging rallye account
-                               if (addPointsBeg($userid, $points)) {
+                               if (addPointsBeg(getUserData('userid'), $points)) {
                                        // Set 'done' message
-                                       $content['message'] = loadTemplate('beg_done', true);
+                                       $content['message'] = loadTemplate('beg_done', TRUE, $content);
                                } else {
                                        // Error!
-                                       $content['message'] = loadTemplate('beg_failed', true);
+                                       $content['message'] = loadTemplate('beg_failed', TRUE, $content);
                                }
                        } else {
                                // Error!
-                               $content['message'] = loadTemplate('beg_failed', true);
+                               $content['message'] = loadTemplate('beg_failed', TRUE, $content);
                        }
                } elseif (isMember()) {
-                       // Logged in user found!
-                       $content['message'] = loadTemplate('beg_login', true);
-               } elseif (getConfig('beg_pay_mode') != 'NONE') { // Other pay-mode active!
-                       // Prepare content for template
-                       $content = array(
-                               'clicks' => $content['clicks'],
-                               'points' => $content['points'],
-                               'userid'    => $content['userid']
-                       );
-
+                       // Logged in user found
+                       $content['message'] = loadTemplate('beg_login', TRUE, $content);
+               } elseif (getBegPayMode() != 'NONE') { // Other pay-mode active!
                        // Load message template depending on pay-mode
-                       $content['message'] = loadTemplate('beg_pay_mode_'.strtolower(getConfig('beg_pay_mode')), true, $content);
-                       $pay = true;
+                       $content['message'] = loadTemplate('beg_pay_mode_' . strtolower(getBegPayMode()), TRUE, $content);
+                       $isPayed = TRUE;
                } else {
                        // Clicked received while reload lock is active
-                       $content['message'] = loadTemplate('beg_failed', true);
+                       $content['message'] = loadTemplate('beg_failed', TRUE, $content);
                }
 
                // Free memory
-               SQL_FREERESULT($result);
+               sqlFreeResult($result);
 
                // Include header
-               loadIncludeOnce('inc/header.php');
+               loadPageHeader();
 
                // Load final template
-               loadTemplate('beg_link', false, $content);
+               loadTemplate('beg_link', FALSE, $content);
 
                // Tracker code enabled? (We don't track users here!
-               if ((getConfig('beg_pay_mode') != 'NONE') && ($pay === true)) {
+               if ((getBegPayMode() != 'NONE') && ($isPayed === TRUE)) {
                        // Prepare content for template
                        // @TODO Opps, what is missing here???
                        $content = array(
                        );
 
                        // Include config-depending template
-                       loadTemplate('beg_pay_code_'.strtolower(getConfig('beg_pay_mode')), false, $content);
-               } elseif (($pay === false) && (!isset($content['message']))) {
+                       loadTemplate('beg_pay_code_' . strtolower(getBegPayMode()), FALSE, $content);
+               } elseif (($isPayed === FALSE) && (!isset($content['message']))) {
                        // Cannot pay! :-(
-                       $content['message'] = loadTemplate('beg_failed', true);
+                       $content['message'] = loadTemplate('beg_failed', TRUE);
                }
 
                // Include footer
-               loadIncludeOnce('inc/footer.php');
-       } elseif (($status != 'CONFIRMED') && ($status != 'failed')) {
+               loadPageFooter();
+       } elseif ((getUserData('status') != 'CONFIRMED') && (getUserData('status') != 'failed')) {
                // Maybe locked/unconfirmed account?
-               $errorCode = generateErrorCodeFromUserStatus($status);
-       } elseif (($userid == '0') || ($status == 'failed')) {
+               $errorCode = generateErrorCodeFromUserStatus();
+       } elseif ((!isValidId(getUserData('userid'))) || (getUserData('status') == 'failed')) {
                // Inalid or locked account, so let's find out
-               $result = SQL_QUERY_ESC("SELECT userid FROM `{?_MYSQL_PREFIX?}_user_data` WHERE nickname='%s' LIMIT 1",
-                       array(getRequestElement('userid')), __FILE__, __LINE__);
-               if (SQL_NUMROWS($result) == 1) {
+               if (fetchUserData(getRequestElement('userid'), 'nickname')) {
                        // Locked account
                        $errorCode = getCode('ACCOUNT_LOCKED');
                } else {
                        // Invalid nickname! (404)
                        $errorCode = getCode('USER_404');
                }
-
-               // Free memory
-               SQL_FREERESULT($result);
-       } elseif ($userid == getConfig('beg_userid')) {
-               // Webmaster's ID cannot beg for points!
+       } elseif (getUserData('userid') == getBegUserid()) {
+               // Webmaster's id cannot beg for points!
                $errorCode = getCode('BEG_SAME_AS_OWN');
        }
 
-       // Reload to index module
-       if ((!empty($errorCode)) && (!empty($errorCode))) redirectToUrl('modules.php?module=index&amp;code=' . $errorCode . '&amp;ext=beg');
+       // Reload to index module if an error happens
+       if (!is_null($errorCode)) {
+               redirectToUrl('modules.php?module=index&amp;code=' . $errorCode . '&amp;ext=beg');
+       } // END - if
 } else {
        // No userid entered
        redirectToUrl('modules.php?module=index');
 }
 
 // Really all done here... ;-)
-shutdown();
+doShutdown();
 
 // [EOF]
 ?>