X-Git-Url: https://git.mxchange.org/?p=mailer.git;a=blobdiff_plain;f=inc%2Fmodules%2Fmember%2Fwhat-order.php;h=eace0213cbae9e80d58104fab8836a8cd6b47a9a;hp=9635d3d515f199872130b4fdc2c707e7e1215101;hb=f9a9c09e1ae257449bfd98f8854e321efba1dc3c;hpb=307a4e11763f0914e73dc756b219356e1c29ab25 diff --git a/inc/modules/member/what-order.php b/inc/modules/member/what-order.php index 9635d3d515..eace0213cb 100644 --- a/inc/modules/member/what-order.php +++ b/inc/modules/member/what-order.php @@ -32,23 +32,18 @@ ************************************************************************/ // Some security stuff... -if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) -{ +if (!defined('__SECURITY')) { $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php"; require($INC); -} - elseif (!IS_LOGGED_IN()) -{ +} elseif (!IS_MEMBER()) { LOAD_URL("modules.php?module=index"); -} - elseif ((!EXT_IS_ACTIVE("order")) && (!IS_ADMIN())) -{ +} elseif ((!EXT_IS_ACTIVE("order")) && (!IS_ADMIN())) { ADD_FATAL(EXTENSION_PROBLEM_EXT_INACTIVE, "order"); return; } // Add description as navigation point -ADD_DESCR("member", basename(__FILE__)); +ADD_DESCR("member", __FILE__); $URL = ""; $id = 0; $whereStatement = " WHERE visible='Y'"; @@ -58,35 +53,27 @@ if (empty($_GET['msg'])) $_GET['msg'] = ""; if (empty($_POST['zip'])) $_POST['zip'] = ""; if (empty($_POST['html'])) $_POST['html'] = ""; if (empty($_POST['receiver'])) $_POST['receiver'] = ""; -if (is_admin()) $whereStatement = ""; - -// Add slashes to every value -foreach($_POST as $key=>$value) -{ - // Skip submit buttons - if (($key != "data") && ($key != "frametester")) $_POST[$key] = addslashes($value); -} +if (IS_ADMIN()) $whereStatement = ""; // Minimum mails / order -define('__MIN_VALUE', $_CONFIG['order_min']); +define('__MIN_VALUE', getConfig('order_min')); // Count unconfirmed mails -$result_links = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_links WHERE userid=%d", +$result_links = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_links WHERE userid=%s", array($GLOBALS['userid']), __FILE__, __LINE__); $links = SQL_NUMROWS($result_links); SQL_FREERESULT($result_links); // Does the user has more than 0 mails per day set? $HOLIDAY="userid"; -if (GET_EXT_VERSION("holiday") >= "0.1.3") -{ +if (GET_EXT_VERSION("holiday") >= "0.1.3") { // Fetch also holiday activation data $HOLIDAY = "holiday_active"; -} +} // END - if $result_mmails = SQL_QUERY_ESC("SELECT userid, receive_mails, mail_orders, ".$HOLIDAY." FROM "._MYSQL_PREFIX."_user_data -WHERE userid=%d AND max_mails > 0 LIMIT 1", +WHERE userid=%s AND max_mails > 0 LIMIT 1", array($GLOBALS['userid']), __FILE__, __LINE__); $mmails = SQL_NUMROWS($result_mmails); @@ -95,190 +82,170 @@ SQL_FREERESULT($result_mmails); if ($HOLIDAY == $DMY) $HOLIDAY='N'; $ALLOWED = $MAXI - $ORDERS; -if ($_CONFIG['order_max'] == "MAX") $ALLOWED = $MAXI; +if (getConfig('order_max_full') == "MAX") $ALLOWED = $MAXI; // Check HTML extension $HTML_EXT = EXT_IS_ACTIVE("html_mail"); // Now check his points amount -$result_p = SQL_QUERY_ESC("SELECT SUM(points) FROM "._MYSQL_PREFIX."_user_points WHERE userid=%d", - array($GLOBALS['userid']), __FILE__, __LINE__); - -$TOTAL = "0"; -if (SQL_NUMROWS($result_p) > 0) -{ - // Load points - list($TOTAL) = SQL_FETCHROW($result_p); - SQL_FREERESULT($result_p); +$TOTAL = GET_TOTAL_DATA($GLOBALS['userid'], "user_points", "points"); +if ($TOTAL > 0) { // And subtract his used points... - $result_p = SQL_QUERY_ESC("SELECT used_points FROM "._MYSQL_PREFIX."_user_data WHERE userid=%d LIMIT 1", - array($GLOBALS['userid']), __FILE__, __LINE__); - - list($p) = SQL_FETCHROW($result_p); - SQL_FREERESULT($result_p); - $TOTAL -= $p; + $TOTAL -= GET_TOTAL_DATA($GLOBALS['userid'], "user_data", "used_points"); // Add (maybe) missing three zeros if (!ereg(".", $TOTAL)) $TOTAL .= ".00000"; -} +} // END - if -if (($HOLIDAY == "Y") && (GET_EXT_VERSION("holiday") >= "0.1.3")) -{ +if (($HOLIDAY == "Y") && (GET_EXT_VERSION("holiday") >= "0.1.3")) { // Holiday is active! SQL_FREERESULT($result_p); LOAD_TEMPLATE("admin_settings_saved", false, HOLIDAY_ORDER_NOT_POSSIBLE); -} - elseif ((!empty($_POST['frametester'])) && ($ALLOWED > 0) && ($_POST['receiver'] > 0)) -{ +} elseif ((!empty($_POST['frametester'])) && ($ALLOWED > 0) && ($_POST['receiver'] > 0)) { // Continue with the frametester, we first need to store the data temporary in the pool // // First we would like to store the data and get it's pool position back... - $result = SQL_QUERY_ESC("SELECT id, data_type FROM "._MYSQL_PREFIX."_pool WHERE sender=%d AND url='%s' AND timestamp > %d LIMIT 1", - array($GLOBALS['userid'], $_POST['url'], bigintval(time() - $_CONFIG['url_tlock'])), __FILE__, __LINE__); + $result = SQL_QUERY_ESC("SELECT id, data_type +FROM "._MYSQL_PREFIX."_pool +WHERE sender=%s AND url='%s' AND timestamp > (UNIX_TIMESTAMP() - %s) LIMIT 1", + array($GLOBALS['userid'], $_POST['url'], getConfig('url_tlock')), __FILE__, __LINE__); - $type = "TEMP"; $id = "0"; - if (SQL_NUMROWS($result) == 1) - { + $type = "TEMP"; $id = 0; + if (SQL_NUMROWS($result) == 1) { list($id, $type) = SQL_FETCHROW($result); - SQL_FREERESULT($result); } - if ($type == "TEMP") - { + + // Free result + SQL_FREERESULT($result); + + if ($type == "TEMP") { // No entry found, so we need to check out the stats table as well... :) // We have to add that suff here, now we continue WITHOUT checking and check the text and subject against some filters $URL = ""; - if ($_CONFIG['test_text'] == "Y") - { + if (getConfig('test_text') == "Y") { // Test submitted text against some filters (length, URLs in text etc.) - if ((strpos(strtolower($_POST['text']), "https://") > -1) || (strpos(strtolower($_POST['text']), "http://") > -1) || (strpos(strtolower($_POST['text']), "www") > -1)) - { + if ((strpos(strtolower($_POST['text']), "https://") > -1) || (strpos(strtolower($_POST['text']), "http://") > -1) || (strpos(strtolower($_POST['text']), "www") > -1)) { // URL found! $URL = URL."/modules.php?module=login&what=order&msg=".CODE_URL_FOUND; - } - $TEST = str_replace("\n", "", str_replace("\r", "", addslashes($_POST['text']))); - if (strlen($TEST) > $_CONFIG['max_tlength']) - { + } // END - if + + // Remove new-line and carriage-return characters + $TEST = str_replace("\n", "", str_replace("\r", "", $_POST['text'])); + + // Text length within allowed length? + if (strlen($TEST) > getConfig('max_tlength')) { // Text is too long! $URL = URL."/modules.php?module=login&what=order&msg=".CODE_OVERLENGTH; - } - } + } // END - if + } // END - if + // Shall I test the subject line against URLs? - if ($_CONFIG['test_subj'] == "Y") - { + if (getConfig('test_subj') == "Y") { // Check the subject line for issues $_POST['subject'] = str_replace("\\", "[nl]", substr($_POST['subject'], 0, 200)); - if ((strpos(strtolower($_POST['subject']), "http://") > -1) || (strpos(strtolower($_POST['subject']), "www") > -1)) - { + if ((strpos(strtolower($_POST['subject']), "http://") > -1) || (strpos(strtolower($_POST['subject']), "www") > -1)) { // URL in subject found $URL = URL."/modules.php?module=login&what=order&msg=".CODE_SUBJ_URL; - } - } + } // END - if + } // END - if + // And shall I check that his URL is not in the black list? - if ($_CONFIG['url_blacklist'] == "Y") - { + if (getConfig('url_blacklist') == "Y") { // Ok, I do that for you know... $result = SQL_QUERY_ESC("SELECT timestamp FROM "._MYSQL_PREFIX."_url_blist WHERE url='%s' LIMIT 1", - array($_POST['url']), __FILE__, __LINE__); + array($_POST['url']), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + if (SQL_NUMROWS($result) == 1) { // Jupp, we got one listed list($blist) = SQL_FETCHROW($result); SQL_FREERESULT($result); $URL = URL."/modules.php?module=login&what=order&msg=".CODE_BLIST_URL."&blist=".$blist; - } - } - if (($_POST['receiver'] < $_CONFIG['order_min']) && (!IS_ADMIN())) - { + } // END - if + } // END - if + + // Enougth receivers entered? + if (($_POST['receiver'] < getConfig('order_min')) && (!IS_ADMIN())) { // Less than allowed receivers entered! $URL = URL."/modules.php?module=login&what=order&msg=".CODE_MORE_RECEIVERS3; - } + } // END - if // Validate URL - if (!VALIDATE_URL($_POST['url'])) - { + if (!VALIDATE_URL($_POST['url'])) { // URL is invalid! $URL = URL."/modules.php?module=login&what=order&msg=".CODE_INVALID_URL; - } + } // END - if // Probe for HTML extension - if ($HTML_EXT) - { - if ($_POST['html'] == "Y") - { + if ($HTML_EXT) { + // HTML or regular text mail? + if ($_POST['html'] == "Y") { // Chek for valid HTML tags $_POST['text'] = HTML_CHECK_TAGS($_POST['text']); // Maybe invalid tags found? if (empty($_POST['text'])) $URL = URL."/modules.php?module=login&what=order&msg=".CODE_INVALID_TAGS."&id=".$id; - } - else - { + } else { // Remove any HTML code $_POST['text'] = str_replace("<", "{OPEN_HTML}", str_replace(">", "{CLOSE_HTML}", $_POST['text'])); } } - } - elseif (!IS_ADMIN()) - { + } elseif (!IS_ADMIN()) { // He has already sent a mail within a specific time $URL = URL."/modules.php?module=login&what=order&msg=".CODE_URL_TLOCK."&id=".$id; } - if (empty($URL)) - { + + // Still no error? + if (empty($URL)) { // Check if category and number of receivers is okay $ADD = ""; - if (($_CONFIG['order_multi_page'] == "Y") && (!empty($_POST['zip']))) $ADD = "AND d.zip LIKE '".bigintval($_POST['zip'])."{PER}'"; + if ((getConfig('order_multi_page') == "Y") && (!empty($_POST['zip']))) { + // Choose recipients by ZIP code + $ADD = " AND d.zip LIKE '".bigintval($_POST['zip'])."{PER}'"; + } // END - if // Check for userids $result = SQL_QUERY_ESC("SELECT DISTINCT c.userid FROM "._MYSQL_PREFIX."_user_cats AS c -LEFT JOIN "._MYSQL_PREFIX."_user_data AS d +LEFT JOIN `"._MYSQL_PREFIX."_user_data` AS d ON c.userid=d.userid -WHERE c.cat_id=%d AND c.userid != '%s' AND d.status='CONFIRMED' AND d.receive_mails > 0 -".$ADD." +WHERE c.cat_id=%s AND c.userid != '%s' AND d.status='CONFIRMED' AND d.receive_mails > 0".$ADD." ORDER BY d.%s %s", array( bigintval($_POST['cat']), $GLOBALS['userid'], - $_CONFIG['order_select'], - $_CONFIG['order_mode'], + getConfig('order_select'), + getConfig('order_mode'), ), __FILE__, __LINE__); // Do we enougth receivers left? - if (SQL_NUMROWS($result) >= $_POST['receiver']) - { + if (SQL_NUMROWS($result) >= $_POST['receiver']) { // Check for holiday extensions $HOLIDAY = false; - if (GET_EXT_VERSION("holiday") >= "0.1.3") - { + if (GET_EXT_VERSION("holiday") >= "0.1.3") { // Include checking for users in holiday $HOLIDAY = true; - } + } // END - if // Load receivers from database $TEST = array(); $cnt = 0; - while (list($REC) = SQL_FETCHROW($result)) - { - if ($HOLIDAY) - { + while (list($REC) = SQL_FETCHROW($result)) { + if ($HOLIDAY) { // Check for his holiday status $result_holiday = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_holidays -WHERE userid=%d AND holiday_start < ".time()." AND holiday_end > ".time()." LIMIT 1", +WHERE userid=%s AND holiday_start < UNIX_TIMESTAMP() AND holiday_end > UNIX_TIMESTAMP() LIMIT 1", array(bigintval($REC)), __FILE__, __LINE__); if (SQL_NUMROWS($result_holiday) == 1) $REC = 0; // Exclude user who are in holiday // Free memory SQL_FREERESULT($result_holiday); - } + } // END - if - if ($REC > 0) - { + if ($REC > 0) { // Add receiver $TEST[] = $REC; $cnt++; - } - } + } // END - if + } // END - while // Free memory SQL_FREERESULT($result); @@ -290,8 +257,8 @@ WHERE userid=%d AND holiday_start < ".time()." AND holiday_end > ".time()." LIMI $MAX_SEND = count($TEST); // Update receiver list - $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_user_data SET receive_mails=receive_mails-1 WHERE userid IN (%s) LIMIT %s", - array(str_replace(";", ", ", $RECEIVER), $MAX_SEND), __FILE__, __LINE__); + $result = SQL_QUERY_ESC("UPDATE `"._MYSQL_PREFIX."_user_data` SET receive_mails=receive_mails-1 WHERE userid IN (%s) LIMIT %s", + array(str_replace(";", ", ", $RECEIVER), $MAX_SEND), __FILE__, __LINE__); // Is calculated max receivers larger than wanted receivers then reset it if ($MAX_SEND > $_POST['receiver']) $MAX_SEND = $_POST['receiver']; @@ -299,24 +266,24 @@ WHERE userid=%d AND holiday_start < ".time()." AND holiday_end > ".time()." LIMI // Calculate used points $USED = $MAX_SEND * GET_PAY_POINTS(bigintval($_POST['type'])); + // Fix empty zip code + if (empty($_POST['zip'])) $_POST['zip'] = "0"; + // Check if he has enougth points for this order and selected more than 0 receivers - if (($USED > 0) && ($USED <= $TOTAL) && ($MAX_SEND > 0)) - { + if (($USED > 0) && ($USED <= $TOTAL) && ($MAX_SEND > 0)) { // Gettings points is okay, so we can add $USED later from $TIME = time(); - if (($id == "0") || ($type != "TEMP")) - { + if (($id == "0") || ($type != "TEMP")) { // New order $id = 0; - if ($HTML_EXT) - { + if ($HTML_EXT) { // HTML extension is active $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_pool (sender, subject, text, receivers, payment_id, data_type, timestamp, url, cat_id, target_send, zip, html_msg) - VALUES ('%s', '%s', '%s', '%s', '%s', 'TEMP', '%s', '%s', '%s', '%s', '%s', '%s')", + VALUES ('%s','%s','%s','%s','%s','TEMP','%s','%s','%s','%s','%s','%s')", array( $GLOBALS['userid'], - addslashes($_POST['subject']), - addslashes($_POST['text']), + $_POST['subject'], + $_POST['text'], $RECEIVER, bigintval($_POST['type']), $TIME, @@ -326,16 +293,14 @@ array( bigintval($_POST['zip']), $_POST['html'] ), __FILE__, __LINE__); - } - else - { + } else { // No HTML extension is active $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_pool (sender, subject, text, receivers, payment_id, data_type, timestamp, url, cat_id, target_send, zip) - VALUES ('%s', '%s', '%s', '%s', '%s', 'TEMP', '%s', '%s', '%s', '%s', '%s')", + VALUES ('%s','%s','%s','%s','%s','TEMP','%s','%s','%s','%s','%s')", array( $GLOBALS['userid'], - addslashes($_POST['subject']), - addslashes($_POST['text']), + $_POST['subject'], + $_POST['text'], $RECEIVER, bigintval($_POST['type']), $TIME, @@ -345,25 +310,22 @@ array( bigintval($_POST['zip']), ), __FILE__, __LINE__); } - } - else - { + } else { // Change current order - if ($HTML_EXT) - { + if ($HTML_EXT) { // HTML extension is active $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET subject='%s', text='%s', receivers='%s', -payment_id=%d, +payment_id=%s, timestamp=UNIX_TIMESTAMP(), url='%s', -cat_id=%d, -target_send=%d, -zip=%d, +cat_id=%s, +target_send=%s, +zip=%s, html_msg='%s' -WHERE id=%d LIMIT 1", +WHERE id=%s LIMIT 1", array( $_POST['subject'], $_POST['text'], @@ -376,21 +338,19 @@ array( $_POST['html'], bigintval($id) ), __FILE__, __LINE__); - } - else - { + } else { // No HTML extension is active $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET subject='%s', text='%s', receivers='%s', -payment_id=%d, +payment_id=%s, timestamp=UNIX_TIMESTAMP(), url='%s', -cat_id=%d, -target_send=%d, -zip=%d -WHERE id=%d LIMIT 1", +cat_id=%s, +target_send=%s, +zip=%s +WHERE id=%s LIMIT 1", array( $_POST['subject'], $_POST['text'], @@ -408,7 +368,7 @@ array( // Do we need to get the ID number? if ($id == 0) { // Order is placed as temporary. We need to get it's id for the frametester - $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_pool WHERE sender=%d AND subject='%s' AND payment_id=%d AND data_type='TEMP' AND timestamp=%d LIMIT 1", + $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_pool WHERE sender=%s AND subject='%s' AND payment_id=%s AND data_type='TEMP' AND timestamp=%s LIMIT 1", array( $GLOBALS['userid'], $_POST['subject'], @@ -422,43 +382,29 @@ array( // ID is received so we can redirect the user, used points will be added when he send's out the mail $URL = URL."/modules.php?module=frametester&order=".$id.""; - } - elseif ($MAX_SEND == 0) - { + } elseif ($MAX_SEND == 0) { // Not enougth receivers found which can receive mails $URL = URL."/modules.php?module=login&what=order&msg=".CODE_MORE_RECEIVERS2; - } - else - { + } else { // No enougth points left! $URL = URL."/modules.php?module=login&what=order&msg=".CODE_MORE_POINTS; } - } - else - { + } else { // Ordered more mails than he can send in this category $URL = URL."/modules.php?module=login&what=order&msg=".CODE_NO_RECS_LEFT; } } -} - elseif ($_POST['receiver'] == "0") -{ +} elseif ($_POST['receiver'] == "0") { // Not enougth receivers selected $URL = URL."/modules.php?module=login&what=order&msg=".CODE_MORE_RECEIVERS1; -} - elseif (($ALLOWED == 0) && ($_CONFIG['order_max'] == "ORDER")) -{ +} elseif (($ALLOWED == 0) && (getConfig('order_max_full') == "ORDER")) { // No more mail orders allowed LOAD_TEMPLATE("admin_settings_saved", false, MEMBER_ORDER_ALLOWED_EXHAUSTED); -} - elseif (($links < $_CONFIG['unconfirmed']) && ($mmails == "1")) -{ +} elseif (($links < getConfig('unconfirmed')) && ($mmails == "1")) { // Display order form $result_cats = SQL_QUERY("SELECT id, cat FROM "._MYSQL_PREFIX."_cats".$whereStatement." ORDER BY sort", __FILE__, __LINE__); - if (SQL_NUMROWS($result_cats) > 0) - { - if ($TOTAL > 0) - { + if (SQL_NUMROWS($result_cats) > 0) { + if ($TOTAL > 0) { // Initialize array... $CATS = array( 'id' => array(), @@ -469,74 +415,64 @@ array( // Enable HTML checking $HTML = ""; $HOLIDAY = false; $HOL_STRING = ""; if (($HTML_EXT) && ($_POST['html'] == "Y")) $HTML = " AND html='Y'"; - if (GET_EXT_VERSION("holiday") >= "0.1.3") - { + if (GET_EXT_VERSION("holiday") >= "0.1.3") { // Extension's version is fine $HOLIDAY = true; $HOL_STRING = " AND holiday_active='N'"; - } + } // END - if // ... and begin loading stuff - while (list($id, $cat) = SQL_FETCHROW($result_cats)) - { + while (list($id, $cat) = SQL_FETCHROW($result_cats)) { $CATS['id'][] = bigintval($id); $CATS['name'][] = $cat; // Select users in current category - $result_uids = SQL_QUERY_ESC("SELECT userid FROM "._MYSQL_PREFIX."_user_cats WHERE cat_id=%d AND userid != '%s' ORDER BY userid", + $result_uids = SQL_QUERY_ESC("SELECT userid FROM "._MYSQL_PREFIX."_user_cats WHERE cat_id=%s AND userid != '%s' ORDER BY userid", array(bigintval($id), $GLOBALS['userid']), __FILE__, __LINE__); - $uid_cnt = "0"; - while (list($ucat) = SQL_FETCHROW($result_uids)) - { + $uid_cnt = 0; + while (list($ucat) = SQL_FETCHROW($result_uids)) { // Check for holiday system $HOL_ACTIVE = false; - if ($HOLIDAY) - { + if ($HOLIDAY) { // Check user's holiday status - $result_holiday = SQL_QUERY_ESC("SELECT DISTINCT d.userid FROM "._MYSQL_PREFIX."_user_data AS d + $result_holiday = SQL_QUERY_ESC("SELECT DISTINCT d.userid FROM `"._MYSQL_PREFIX."_user_data` AS d LEFT JOIN "._MYSQL_PREFIX."_user_holidays AS h ON d.userid=h.userid -WHERE d.userid=%d AND d.receive_mails > 0 AND d.status='CONFIRMED' AND d.holiday_active='Y' -AND h.holiday_start < ".time()." AND h.holiday_end > ".time()." +WHERE d.userid=%s AND d.receive_mails > 0 AND d.status='CONFIRMED' AND d.holiday_active='Y' +AND h.holiday_start < UNIX_TIMESTAMP() AND h.holiday_end > UNIX_TIMESTAMP() LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); - if (SQL_NUMROWS($result_holiday) == 1) - { + if (SQL_NUMROWS($result_holiday) == 1) { // Holiday is active! $HOL_ACTIVE = true; - } + } // END - if // Free memory SQL_FREERESULT($result_holiday); - } + } // END - if - if (!$HOL_ACTIVE) - { + if (!$HOL_ACTIVE) { // Check if the user want's to receive mails? - $result_ver = SQL_QUERY_ESC("SELECT zip FROM "._MYSQL_PREFIX."_user_data WHERE userid=%d".$HTML." AND receive_mails > 0 AND status='CONFIRMED' LIMIT 1", + $result_ver = SQL_QUERY_ESC("SELECT zip FROM `"._MYSQL_PREFIX."_user_data` WHERE userid=%s".$HTML." AND receive_mails > 0 AND status='CONFIRMED' LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); - if ((SQL_NUMROWS($result_ver) == 1) && (!empty($_POST['zip'])) && ($_CONFIG['order_multi_page'] == "Y")) - { + if ((SQL_NUMROWS($result_ver) == 1) && (!empty($_POST['zip'])) && (getConfig('order_multi_page') == "Y")) { list($zip) = SQL_FETCHROW($result_ver); SQL_FREERESULT($result_ver); - if (substr($zip, 0, strlen($_POST['zip'])) == $_POST['zip']) - { + if (substr($zip, 0, strlen($_POST['zip'])) == $_POST['zip']) { // Ok, ZIP part is found $uid_cnt++; - } - } - else - { + } // END - if + } else { // Count numbers up! $uid_cnt += SQL_NUMROWS($result_ver); } - } - } + } // END - if + } // END - while // Free memory SQL_FREERESULT($result_uids); $CATS['uids'][] = $uid_cnt; - } + } // END - while // Free memory SQL_FREERESULT($result_cats); @@ -545,14 +481,13 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); $result = SQL_QUERY("SELECT id, price, payment, mail_title FROM "._MYSQL_PREFIX."_payments ORDER BY payment", __FILE__, __LINE__); $typeS = array(); - if (SQL_NUMROWS($result) > 0) - { + if (SQL_NUMROWS($result) > 0) { // Check for message ID in URL $MSG = ""; switch ($_GET['msg']) { case CODE_URL_TLOCK: - $result = SQL_QUERY_ESC("SELECT timestamp FROM "._MYSQL_PREFIX."_pool WHERE id=%d LIMIT 1", + $result = SQL_QUERY_ESC("SELECT timestamp FROM "._MYSQL_PREFIX."_pool WHERE id=%s LIMIT 1", array(bigintval($_GET['id'])), __FILE__, __LINE__); // Load timestamp from last order @@ -563,17 +498,17 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); SQL_FREERESULT($result); // Calculate hours... - $STD = round($_CONFIG['url_tlock'] / 60 / 60); + $STD = round(getConfig('url_tlock') / 60 / 60); // Minutes... - $MIN = round(($_CONFIG['url_tlock'] - $STD * 60 * 60) / 60); + $MIN = round((getConfig('url_tlock') - $STD * 60 * 60) / 60); // And seconds - $SEC = $_CONFIG['url_tlock'] - $STD * 60 * 60 - $MIN * 60; + $SEC = getConfig('url_tlock') - $STD * 60 * 60 - $MIN * 60; // Finally contruct the message $MSG = MEMBER_URL_TIME_LOCK."
".CONFIG_URL_TLOCK." ".$STD." ". - HOURS.", ".$MIN." ".MINS." "._AND." ".$SEC." ".SECS."
". + _HOURS.", ".$MIN." "._MINUTES." "._AND." ".$SEC." "._SECONDS."
". MEMBER_LAST_TLOCK.": ".$LORDER; break; @@ -590,8 +525,7 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); break; case CODE_BLIST_URL: - $MSG = MEMBER_URL_BLACK_LISTED."
-".MEMBER_BLIST_TIME.": ".MAKE_DATETIME($_GET['blist'], "0"); + $MSG = MEMBER_URL_BLACK_LISTED."
\n".MEMBER_BLIST_TIME.": ".MAKE_DATETIME($_GET['blist'], "0"); break; case CODE_NO_RECS_LEFT: @@ -615,7 +549,7 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); break; case CODE_MORE_RECEIVERS3: - $MSG = MEMBER_ENTER_MORE_MIN_RECEIVERS_1.$_CONFIG['order_min'].MEMBER_ENTER_MORE_MIN_RECEIVERS_2; + $MSG = MEMBER_ENTER_MORE_MIN_RECEIVERS_1.getConfig('order_min').MEMBER_ENTER_MORE_MIN_RECEIVERS_2; break; case CODE_INVALID_URL: @@ -626,20 +560,20 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); break; default: + DEBUG_LOG(__FILE__, __LINE__, sprintf("Unknown error code %s detected.", $_GET['msg'])); $MSG = UNKNOWN_CODE_1.$_GET['msg'].UNKNOWN_CODE_2; break; } - if (!empty($MSG)) - { + + if (!empty($MSG)) { // We got system message so we drop it out to the user LOAD_TEMPLATE("admin_settings_saved", false, $MSG); - } + } // END - if // Load all email types... - while ($typeS[] = SQL_FETCHROW($result)) - { + while ($typeS[] = SQL_FETCHROW($result)) { // Nothing to do here... ;-) - } + } // END - while // Free memory SQL_FREERESULT($result); @@ -648,7 +582,7 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); $TOTAL = TRANSLATE_COMMA($TOTAL); // Check how many mail orders he has placed today and how many he's allowed to send - switch ($_CONFIG['order_max']) + switch (getConfig('order_max_full')) { case "MAX": // He is allowed to send as much as possible define('ORDER_MAX_VALUE', ORDER_ALLOED_MAX); @@ -657,6 +591,11 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); case "ORDER": // He is allowed to send as much as he setup the receiving value define('ORDER_MAX_VALUE', ORDER_ALLOWED_RECEIVE_1.$ALLOWED.ORDER_ALLOWED_RECEIVE_2.$MAXI.ORDER_ALLOWED_RECEIVE_3); break; + + default: // Unknown/invalid + DEBUG_LOG(__FILE__, __LINE__, sprintf("Unknown order_mas_full config detected.", getConfig('order_max_full'))); + define('ORDER_MAX_VALUE', ORDER_ALLOED_UNKNOWN); + break; } // Load final template @@ -666,11 +605,10 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); $OLD_ORDER = false; $subject = ""; $text = ""; $target = ""; // Check if we already have an order placed and make it editable - $result = SQL_QUERY_ESC("SELECT subject, text, payment_id, timestamp, url, target_send, cat_id, zip FROM "._MYSQL_PREFIX."_pool WHERE sender=%d AND data_type='TEMP' LIMIT 1", + $result = SQL_QUERY_ESC("SELECT subject, text, payment_id, timestamp, url, target_send, cat_id, zip FROM "._MYSQL_PREFIX."_pool WHERE sender=%s AND data_type='TEMP' LIMIT 1", array($GLOBALS['userid']), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + if (SQL_NUMROWS($result) == 1) { // Old order found list($subject, $text, $payment, $tstamp, $url, $target, $cat, $zip) = SQL_FETCHROW($result); SQL_FREERESULT($result); @@ -680,37 +618,32 @@ LIMIT 1", array(bigintval($ucat)), __FILE__, __LINE__); // Old order is grabbed $OLD_ORDER = true; - } - else - { + } else { // Default output for that your members don't forget it... $url = "http://"; } - // 01 2 21 12 2 23 443 3 3210 - if ((!empty($_POST['data'])) || (($_CONFIG['order_multi_page'] == "N") && ((!IS_ADMIN()) && (!$HTML_EXT)))) - { + // 01 2 21 12 2 23 443 3 3210 + if ((!empty($_POST['data'])) || ((getConfig('order_multi_page') == "N") && ((!IS_ADMIN()) && (!$HTML_EXT)))) { // Pre-output categories $CAT = ""; - foreach ($CATS['id'] as $key=>$value) - { + foreach ($CATS['id'] as $key => $value) { $CAT .= "