forked from fisharebest/webtrees
-
Notifications
You must be signed in to change notification settings - Fork 0
/
message.php
210 lines (196 loc) · 9.79 KB
/
message.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
<?php
// Send a message to a user in the system
//
// webtrees: Web based Family History software
// Copyright (C) 2013 webtrees development team.
//
// Derived from PhpGedView
// Copyright (C) 2002 to 2007 John Finlay and Others
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation; either version 2 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
define('WT_SCRIPT_NAME', 'message.php');
require './includes/session.php';
// Some variables are initialised from $_GET (so we can set initial values in URLs),
// but are submitted in $_POST so we can have long body text.
$subject = WT_Filter::post('subject', null, WT_Filter::get('subject'));
$body = WT_Filter::post('body');
$from_name = WT_Filter::post('from_name');
$from_email = WT_Filter::post('from_email');
$action = WT_Filter::post('action', 'compose|send', 'compose');
$to = WT_Filter::post('to', null, WT_Filter::get('to'));
$method = WT_Filter::post('method', 'messaging|messaging2|messaging3|mailto|none', WT_Filter::get('method', 'messaging|messaging2|messaging3|mailto|none', 'messaging2'));
$url = WT_Filter::postUrl('url', WT_Filter::getUrl('url'));
$controller=new WT_Controller_Simple();
$controller->setPageTitle(WT_I18N::translate('webtrees Message'));
$to_user_id=get_user_id($to);
// Only admins can send broadcast messages
if ((!$to_user_id || $to=='all' || $to=='last_6mo' || $to=='never_logged') && !WT_USER_IS_ADMIN) {
// TODO, what if we have a user called "all" or "last_6mo" or "never_logged" ???
WT_FlashMessages::addMessage(WT_I18N::translate('Message was not sent'));
$controller->pageHeader();
$controller->addInlineJavascript('window.opener.location.reload(); window.close();');
exit;
}
$errors='';
// Is this message from a member or a visitor?
if (WT_USER_ID) {
$from=WT_USER_NAME;
} else {
// Visitors must provide a valid email address
if ($from_email && (!preg_match("/(.+)@(.+)/", $from_email, $match) || function_exists('checkdnsrr') && checkdnsrr($match[2])===false)) {
$errors.='<p class="ui-state-error">'.WT_I18N::translate('Please enter a valid email address.').'</p>';
$action='compose';
}
// Do not allow anonymous visitors to include links to external sites
if (preg_match('/(?!'.preg_quote(WT_SERVER_NAME, '/').')(((?:ftp|http|https):\/\/)[a-zA-Z0-9.-]+)/', $subject.$body, $match)) {
$errors.=
'<p class="ui-state-error">'.WT_I18N::translate('You are not allowed to send messages that contain external links.').'</p>'.
'<p class="ui-state-highlight">'./* I18N: e.g. ‘You should delete the “http://” from “http://www.example.com” and try again.’ */ WT_I18N::translate('You should delete the “%1$s” from “%2$s” and try again.', $match[2], $match[1]).'</p>'.
AddToLog('Possible spam message from "'.$from_name.'"/"'.$from_email.'", IP="'.$WT_REQUEST->getClientIp().'", subject="'.$subject.'", body="'.$body.'"', 'auth');
$action='compose';
}
$from=$from_email;
}
// Ensure the user always visits this page twice - once to compose it and again to send it.
// This makes it harder for spammers.
switch ($action) {
case 'compose':
$WT_SESSION->good_to_send=true;
break;
case 'send':
// Only send messages if we've come straight from the compose page.
if (!$WT_SESSION->good_to_send) {
AddToLog('Attempt to send message without visiting the compose page. Spam attack?', 'auth');
$action='compose';
}
if (!WT_Filter::checkCsrf()) {
$action='compose';
}
unset($WT_SESSION->good_to_send);
break;
}
switch ($action) {
case 'compose':
$controller
->pageHeader()
->addInlineJavascript('
function checkForm(frm) {
if (frm.subject.value=="") {
alert("'.WT_I18N::translate('Please enter a message subject.').'");
document.messageform.subject.focus();
return false;
}
if (frm.body.value=="") {
alert("'.WT_I18N::translate('Please enter some message text before sending.').'");
document.messageform.body.focus();
return false;
}
return true;
}
');
echo '<span class="subheaders">', WT_I18N::translate('Send message'), '</span>';
echo $errors;
if (!WT_USER_ID) {
echo '<br><br>', WT_I18N::translate('<b>Please Note:</b> Private information of living individuals will only be given to family relatives and close friends. You will be asked to verify your relationship before you will receive any private data. Sometimes information of dead individuals may also be private. If this is the case, it is because there is not enough information known about the individual to determine whether they are alive or not and we probably do not have more information on this individual.<br><br>Before asking a question, please verify that you are inquiring about the correct individual by checking dates, places, and close relatives. If you are submitting changes to the genealogical data, please include the sources where you obtained the data.');
}
echo '<br><form name="messageform" method="post" action="message.php" onsubmit="t = new Date(); document.messageform.time.value=t.toUTCString(); return checkForm(this);">';
echo WT_Filter::getCsrf();
echo '<table>';
if ($to != 'all' && $to != 'last_6mo' && $to != 'never_logged') {
echo '<tr><td></td><td>', WT_I18N::translate('This message will be sent to %s', '<b>'.getUserFullName($to_user_id).'</b>'), '<br>';
echo /* I18N: %s is the name of a language */ WT_I18N::translate('This user prefers to receive messages in %s', Zend_Locale::getTranslation(get_user_setting($to_user_id, 'language'), 'language', WT_LOCALE)), '</td></tr>';
}
if (!WT_USER_ID) {
echo '<tr><td valign="top" width="15%" align="right">', WT_I18N::translate('Your Name:'), '</td>';
echo '<td><input type="text" name="from_name" size="40" value="', WT_Filter::escapeHtml($from_name), '"></td></tr><tr><td valign="top" align="right">', WT_I18N::translate('Email address:'), '</td><td><input type="email" name="from_email" size="40" value="', WT_Filter::escapeHtml($from_email), '"><br>', WT_I18N::translate('Please provide your email address so that we may contact you in response to this message. If you do not provide your email address we will not be able to respond to your inquiry. Your email address will not be used in any other way besides responding to this inquiry.'), '<br><br></td></tr>';
}
echo '<tr><td align="right">', WT_I18N::translate('Subject:'), '</td>';
echo '<td>';
echo '<input type="hidden" name="action" value="send">';
echo '<input type="hidden" name="to" value="', WT_Filter::escapeHtml($to), '">';
echo '<input type="hidden" name="time" value="">';
echo '<input type="hidden" name="method" value="', $method, '">';
echo '<input type="hidden" name="url" value="', WT_Filter::escapeHtml($url), '">';
echo '<input type="text" name="subject" size="50" value="', WT_Filter::escapeHtml($subject), '"><br></td></tr>';
echo '<tr><td valign="top" align="right">', WT_I18N::translate('Body:'), '<br></td><td><textarea name="body" cols="50" rows="7">', WT_Filter::escapeHtml($body), '</textarea><br></td></tr>';
echo '<tr><td></td><td><input type="submit" value="', WT_I18N::translate('Send'), '"></td></tr>';
echo '</table>';
echo '</form>';
if ($method=='messaging2') {
echo WT_I18N::translate('When you send this message you will receive a copy sent via email to the address you provided.');
}
echo
'<br><br><br><br>', // TODO use margin-bottom instead of this
'<p id="save-cancel">',
'<input type="button" class="cancel" value="', WT_I18N::translate('close'), '" onclick="window.close();">',
'</p>';
break;
case 'send':
if ($from_email) {
$from = $from_email;
}
$toarray = array($to);
if ($to == 'all') {
$toarray = get_all_users();
}
if ($to == 'never_logged') {
$toarray = array();
foreach (get_all_users() as $user_id=>$user_name) {
if (get_user_setting($user_id,'verified_by_admin') && get_user_setting($user_id, 'reg_timestamp') > get_user_setting($user_id, 'sessiontime')) {
$toarray[$user_id] = $user_name;
}
}
}
if ($to == 'last_6mo') {
$toarray = array();
$sixmos = 60*60*24*30*6; //-- timestamp for six months
foreach (get_all_users() as $user_id=>$user_name) {
if (get_user_setting($user_id,'sessiontime')>0 && (WT_TIMESTAMP - get_user_setting($user_id, 'sessiontime') > $sixmos)) {
$toarray[$user_id] = $user_name;
}
//-- not verified by registration past 6 months
else if (!get_user_setting($user_id, 'verified_by_admin') && (WT_TIMESTAMP - get_user_setting($user_id, 'reg_timestamp') > $sixmos)) {
$toarray[$user_id] = $user_name;
}
}
}
$i = 0;
foreach ($toarray as $indexval => $to) {
$message = array();
$message['to']=$to;
$message['from']=$from;
if (!empty($from_name)) {
$message['from_name'] = $from_name;
$message['from_email'] = $from_email;
}
$message['subject'] = $subject;
$message['body'] = $body;
$message['created'] = WT_TIMESTAMP;
$message['method'] = $method;
$message['url'] = $url;
if ($i>0) $message['no_from'] = true;
if (addMessage($message)) {
WT_FlashMessages::addMessage(WT_I18N::translate('Message successfully sent to %s', WT_Filter::escapeHtml($to)));
} else {
WT_FlashMessages::addMessage(WT_I18N::translate('Message was not sent'));
AddToLog('Unable to send message. FROM:'.$from.' TO:'.$to.' (failed to send)', 'error');
}
$i++;
}
$controller
->pageHeader()
->addInlineJavascript('window.opener.location.reload(); window.close();');
break;
}