<?php

/*

+------------------------------------------------

| TBDev.net BitTorrent Tracker PHP

| =============================================

| by CoLdFuSiOn

| (c) 2003 - 2011 TBDev.Net

| http://www.tbdev.net

| =============================================

| svn: http://sourceforge.net/projects/tbdevnet/

| Licence Info: GPL

+------------------------------------------------

| $Date$

| $Revision$

| $Author$

| $URL$

+------------------------------------------------

*/

ob_start("ob_gzhandler");

require_once "include/bittorrent.php";

require_once "include/bbcode_functions.php";

require_once "include/user_functions.php";

// Connect to DB & check login

dbconn();

loggedinorreturn();

$lang = array_merge( load_language('global'), load_language('messages') );

// Define constants

define('PM_DELETED',0); // Message was deleted

define('PM_INBOX',1); // Message located in Inbox for reciever

define('PM_SENTBOX',-1); // GET value for sent box

// Determine action

$action = isset($_GET['action']) ? (string) $_GET['action'] : false;

if (!$action)

{

$action = isset($_POST['action']) ? (string) $_POST['action'] : 'viewmailbox';

//if (!$action)

//$action = 'viewmailbox';

}

// View listing of Messages in mail box

if ($action == "viewmailbox")

{

// Get Mailbox Number

$mailbox = isset($_GET['box']) ? (int)$_GET['box'] : PM_INBOX;

//if (!$mailbox)

//$mailbox = PM_INBOX;

// Get Mailbox Name

if ($mailbox != PM_INBOX && $mailbox != PM_SENTBOX)

{

$res = mysql_query('SELECT name FROM pmboxes WHERE userid=' . sqlesc($CURUSER['id']) . ' AND boxnumber=' . sqlesc($mailbox) . ' LIMIT 1') or

sqlerr(__FILE__,__LINE__);

if (mysql_num_rows($res) == 0)

stderr("{$lang['messages_error']}","{$lang['messages_invalid_box']}");

$mailbox_name = mysql_fetch_array($res);

$mailbox_name = htmlsafechars($mailbox_name[0]);

}

else

{

if ($mailbox == PM_INBOX)

$mailbox_name = "{$lang['messages_inbox']}";

else

$mailbox_name = "{$lang['messages_sentbox']}";

}

//$pmcount = mysql_fetch_row(mysql_query("SELECT COUNT(*) FROM messages WHERE receiver = ".$CURUSER['id']));

$pmcount = mysql_fetch_row(mysql_query("SELECT COUNT(*) FROM messages WHERE receiver=".$CURUSER['id']." AND location >= '1' || sender=".$CURUSER['id']." AND saved = 'yes' ")) or sqlerr(__FILE__,__LINE__);

$pm_perc = $pmcount[0] ? ($pmcount[0] / 50 * 100) : 0;

$perc_image = ($pm_perc > 66) ? 'loadbarred.gif' : (($pm_perc > 33) ? 'loadbaryellow.gif' : 'loadbargreen.gif');

//$image_width = ($pmcount[0] / 250 * 100);

$image_width = $pm_perc > 0 ? round($pm_perc * 2.5) : 1;

if($image_width > 250)

$image_width = 250;

$HTMLOUT = '';

$HTMLOUT .= "<!-- <script type='text/javascript' src='js/checkall.js'></script> -->

<!-- check all -->

<script type='text/javascript'>

function checkAll(field) {

if (field.CheckAll.checked == true) {

for (i = 0; i < field.length; i++) {

field[i].checked = true;

}

}

else {

for (i = 0; i < field.length; i++) {

field[i].checked = false;

}

}

}

</script>

<!-- check all -->

<table style='width: 250px;' cellspacing='1'>

<tbody><tr>

<td colspan='3'>".sprintf($lang['messages_percent_full'], $pm_perc)."</td>

</tr>

<tr>

<td colspan='3' nowrap='nowrap' valign='middle'>

<img src='{$TBDEV['pic_base_url']}$perc_image' alt='' align='middle' height='10' width='$image_width' />

</td>

</tr>

<tr>

<td valign='middle' width='33%'>0%</td>

<td align='center' valign='middle' width='33%'>50%</td>

<td align='right' valign='middle' width='33%'>100%</td>

</tr>

</tbody></table><br />

<table border='0' cellpadding='4' cellspacing='0' width='737'>

<tr><td align='right'>".insertJumpTo($mailbox)."</td></tr>

</table>

<form action='messages.php' method='post' name='mutliact'>

<input type='hidden' name='action' value='moveordel' />

<table border='0' cellpadding='4' cellspacing='0' width='737'>

<tr>

<td width='1%' class='colhead'>{$lang['messages_status']}</td>

<td class='colhead'>Subject </td>";

if ($mailbox != PM_SENTBOX)

{

$HTMLOUT .= "<td width='35%' class='colhead'>{$lang['messages_sender']}</td>";

}

else

{

$HTMLOUT .= "<td width='35%' class='colhead'>{$lang['messages_receiver']}</td>";

}

$HTMLOUT .= "<td width='1%' class='colhead'>{$lang['messages_date']}</td>

<td width='1%' class='colhead'><input name='CheckAll' id='CheckAll' class='checkbox' value='1' type='checkbox' title='{$lang['messages_checkall']}' />

</td>

</tr>";

if ($mailbox != PM_SENTBOX)

{

$res = mysql_query('SELECT * FROM messages WHERE receiver=' . sqlesc($CURUSER['id']) . ' AND location=' . sqlesc($mailbox) . ' ORDER BY id DESC') or sqlerr(__FILE__,__LINE__);

}

else

{

$res = mysql_query('SELECT * FROM messages WHERE sender=' . sqlesc($CURUSER['id']) . ' AND saved=\'yes\' ORDER BY id DESC') or sqlerr(__FILE__,__LINE__);

}

if (mysql_num_rows($res) == 0)

{

$HTMLOUT .= "<tr><td colspan='5' align='center'>{$lang['messages_no_messages']}</td></tr>\n";

}

else

{

while ($row = mysql_fetch_assoc($res))

{

// Get Sender Username

if ($row['sender'] != 0 && $row['sender'] != $CURUSER['id'])

{

$res2 = mysql_query("SELECT username FROM users WHERE id=" . sqlesc($row['sender']));

$username = mysql_fetch_array($res2);

$username = "<a href='userdetails.php?id={$row['sender']}'>{$username[0]}</a>";

$id = 0+$row['sender'];

$r = mysql_query("SELECT id FROM friends WHERE userid={$CURUSER['id']} AND friendid=$id") or sqlerr(__FILE__, __LINE__);

$friend = mysql_num_rows($r);

if ($friend)

{

$username .= "&nbsp;<a href='friends.php?action=delete&amp;type=friend&amp;targetid=$id'>{$lang['messages_remove_friends']}</a>";

}

else

{

$username .= "&nbsp;<a href='friends.php?action=add&amp;type=friend&amp;targetid=$id'>{$lang['messages_add_friends']}</a>";

}

}

elseif ($row['sender'] == $CURUSER['id'])

{

$res2 = mysql_query("select username FROM users WHERE id=" . sqlesc($row['receiver']));

$username = mysql_fetch_array($res2);

$username = "<a href='userdetails.php?id={$row['receiver']}'>{$username[0]}</a>";

//if ($row['sender'] == $CURUSER['id'])

//$id = 0+$row['receiver'];

//else

$id = 0+$row['receiver'];

}

else

{

$username = "System";

}

$subject = htmlsafechars($row['subject']);

if (strlen($subject) <= 0)

{

$subject = "{$lang['messages_no_subject']}";

}

if ($row['unread'] == 'yes'/* && $mailbox != PM_SENTBOX*/)

{

$HTMLOUT .= "<tr>\n<td align='center'><img src='{$TBDEV['pic_base_url']}unreadpm.gif' title='{$lang['messages_unread']}' alt=\"{$lang['messages_unread_title']}\" /></td>\n";

}

else

{

$HTMLOUT .= "<tr>\n<td align='center'><img src='{$TBDEV['pic_base_url']}readpm.gif' title='{$lang['messages_read']}e' alt='{$lang['messages_read_title']}' /></td>\n";

}

$HTMLOUT .= "<td align='left'>

<a href='messages.php?action=viewmessage&amp;id={$row['id']}'>$subject</a></td>

<td align='left'>$username</td>

<td nowrap='nowrap'>" . get_date($row['added'], '') . "</td>

<td><input type='checkbox' name='messages[]' value='{$row['id']}' /></td>\n</tr>";

}

}

$HTMLOUT .= "<tr class='colhead'>

<td colspan='5' align='right' class='colhead'>

<input type='submit' name='move' value='{$lang['messages_move']}' class='btn' />

<select name='box'>

<option value='1'>{$lang['messages_inbox']}</option>";

$res = mysql_query('select * FROM pmboxes WHERE userid=' . sqlesc($CURUSER['id']) . ' ORDER BY boxnumber') or sqlerr(__FILE__,__LINE__);

while ($row = mysql_fetch_assoc($res))

{

$HTMLOUT .= "<option value='{$row['boxnumber']}'>" . htmlsafechars($row['name']) . "</option>\n";

}

/*

print("<p align='right'><input type='button' value=\"Check All\" type='submit' value=\"Delete selected\" /></p>");

print("</form>");

*/

$HTMLOUT .= "</select> or <input type='submit' name='delete' value='{$lang['messages_delete']}' class='btn' />

</td>

</tr>

</table>

</form>

<table border='0' cellpadding='4' cellspacing='0' width='737'><tr><td colspan='5'>

<div align='left'><img src='{$TBDEV['pic_base_url']}unreadpm.gif' title='{$lang['messages_unread_msg']}' alt='{$lang['messages_unread_title']}' /> {$lang['messages_unread_msg']}<br />

<img src='{$TBDEV['pic_base_url']}readpm.gif' title='{$lang['messages_read_msg']}' alt='{$lang['messages_read_title']}' /> {$lang['messages_read_msg']}</div>

<div align='right'>

<a href='messages.php'>{$lang['messages_return']}</a>

</div></td></tr></table>";

/////////////////// HTML OUTPUT ///////////////////////////////////////

print stdhead($mailbox_name, false) . $HTMLOUT . stdfoot();

}

if ($action == "viewmessage")

{

$pm_id = (int) $_GET['id'];

if (!$pm_id)

{

stderr("{$lang['messages_error']}","{$lang['messages_access']}");

}

// Get the message

$res = mysql_query("select * FROM messages WHERE id=" . sqlesc($pm_id)." AND (receiver=". sqlesc($CURUSER['id']) . " OR (sender=" . sqlesc($CURUSER['id']) . " AND saved='yes')) LIMIT 1") or sqlerr(__FILE__,__LINE__);

if (!$res)

{

stderr("{$lang['messages_error']}","{$lang['messages_access']}");

}

// Prepare for displaying message

$message = mysql_fetch_assoc($res) or header("Location: messages.php");

if ($message['sender'] == $CURUSER['id'])

{

// Display to

$res2 = mysql_query("select username FROM users WHERE id=" . sqlesc($message['receiver'])) or sqlerr(__FILE__,__LINE__);

$sender = mysql_fetch_array($res2);

$sender = "<a href=\"userdetails.php?id=" . $message['receiver'] . "\">" . $sender[0] . "</a>";

$reply = "";

$from = "To";

}

else

{

$from = "{$lang['messages_from']}";

if ($message['sender'] == 0)

{

$sender = "{$lang['messages_system']}";

$reply = "";

}

else

{

$res2 = mysql_query("select username FROM users WHERE id=" . sqlesc($message['sender'])) or sqlerr(__FILE__,__LINE__);

$sender = mysql_fetch_array($res2);

$sender = "<a href='userdetails.php?id={$message['sender']}'>{$sender[0]}</a>";

$reply = "<a href='sendmessage.php?receiver={$message['sender']}&amp;replyto={$pm_id}'><span class='btn'>{$lang['messages_reply']}</span></a>";

}

}

$body = format_comment($message['msg']);

$added = get_date($message['added'], '');

if ($CURUSER['class'] >= UC_MODERATOR && $message['sender'] == $CURUSER['id'])

{

$unread = ($message['unread'] == 'yes' ? "<span style='color: #FF0000;'><strong>{$lang['messages_new']}</strong></span>" : "");

}

else

{

$unread = "";

}

$subject = htmlsafechars($message['subject']);

if (strlen($subject) <= 0)

{

$subject = "{$lang['messages_no_subject']}";

}

if ($message['unread'] === 'yes')

{

// Mark message unread

@mysql_query("UPDATE messages SET unread='no' WHERE id=" . sqlesc($pm_id) . " AND receiver=" . sqlesc($CURUSER['id']) . " LIMIT 1");

}

$HTMLOUT = '';

$HTMLOUT .= "<h1>{$subject}</h1>

<table width='737' border='0' cellpadding='4' cellspacing='0'>

<tr>

<td width='50%' class='colhead'>{$from}</td>

<td width='50%' class='colhead'>{$lang['messages_date']}</td>

</tr>

<tr>

<td>{$sender}</td>

<td>{$added}&nbsp;&nbsp;{$unread}</td>

</tr>

<tr>

<td colspan='2' align='left'>{$body}</td>

</tr>

<tr>

<td colspan='2'><div style='float:left;vertical-align:middle'>

<form action='messages.php' method='post'>

<input type='hidden' name='action' value='moveordel' />

<input type='hidden' name='id' value='{$pm_id}' />

Move to: <select name='box'><option value='1'>{$lang['messages_inbox']}</option>";

$res = mysql_query('select * FROM pmboxes WHERE userid=' . sqlesc($CURUSER['id']) . ' ORDER BY boxnumber') or sqlerr(__FILE__,__LINE__);

while ($row = mysql_fetch_assoc($res))

{

$HTMLOUT .= "<option value='{$row['boxnumber']}'>" . htmlsafechars($row['name']) . "</option>\n";

}

$HTMLOUT .= "</select> <input type='submit' name='move' value='{$lang['messages_move']}' class='btn' />

</form></div>

<span style='float:right;vertical-align:inherit'><a href='messages.php'><span class='btn'>{$lang['messages_return']}</span></a>&nbsp;<a href='messages.php?action=deletemessage&amp;id=$pm_id'><span class='btn'>{$lang['messages_delete']}</span></a>&nbsp;{$reply}&nbsp;<a href='messages.php?action=forward&amp;id={$pm_id}'><span class='btn'>{$lang['messages_forward']}</span></a></span></td>

</tr>

</table>";

// Display message

print stdhead("PM ($subject)", false). $HTMLOUT . stdfoot();

}

if ($action == "moveordel")

{

$pm_id = (int) $_POST['id'];

$pm_box = (int) $_POST['box'];

$pm_messages = $_POST['messages'];

if ($_POST['move'])

{

if ($pm_id)

{

// Move a single message

@mysql_query("UPDATE messages SET location=" . sqlesc($pm_box) . " WHERE id=" . sqlesc($pm_id) . " AND receiver=" . $CURUSER['id'] . " LIMIT 1");

}

else

{

// Move multiple messages

@mysql_query("UPDATE messages SET location=" . sqlesc($pm_box) . " WHERE id IN (" . implode(", ", array_map("sqlesc",$pm_messages)) . ') AND receiver=' .

$CURUSER['id']);

}

// Check if messages were moved

if (@mysql_affected_rows() == 0)

{

stderr("{$lang['messages_error']}","{$lang['messages_not_moved']}");

}

header("Location: messages.php?action=viewmailbox&box=" . $pm_box);

exit();

}

elseif ($_POST['delete'])

{

if ($pm_id)

{

// Delete a single message

$res = mysql_query("select * FROM messages WHERE id=" . sqlesc($pm_id)) or sqlerr(__FILE__,__LINE__);

$message = mysql_fetch_assoc($res);

if ($message['receiver'] == $CURUSER['id'] && $message['saved'] == 'no')

{

mysql_query("DELETE FROM messages WHERE id=" . sqlesc($pm_id)) or sqlerr(__FILE__,__LINE__);

}

elseif ($message['sender'] == $CURUSER['id'] && $message['location'] == PM_DELETED)

{

mysql_query("DELETE FROM messages WHERE id=" . sqlesc($pm_id)) or sqlerr(__FILE__,__LINE__);

}

elseif ($message['receiver'] == $CURUSER['id'] && $message['saved'] == 'yes')

{

mysql_query("UPDATE messages SET location=0 WHERE id=" . sqlesc($pm_id)) or sqlerr(__FILE__,__LINE__);

}

elseif ($message['sender'] == $CURUSER['id'] && $message['location'] != PM_DELETED)

{

mysql_query("UPDATE messages SET saved='no' WHERE id=" . sqlesc($pm_id)) or sqlerr(__FILE__,__LINE__);

}

}

else

{

// Delete multiple messages

foreach ($pm_messages as $id)

{

$res = mysql_query("select * FROM messages WHERE id=" . sqlesc((int) $id));

$message = mysql_fetch_assoc($res);

if ($message['receiver'] == $CURUSER['id'] && $message['saved'] == 'no')

{

mysql_query("DELETE FROM messages WHERE id=" . sqlesc((int) $id)) or sqlerr(__FILE__,__LINE__);

}

elseif ($message['sender'] == $CURUSER['id'] && $message['location'] == PM_DELETED)

{

mysql_query("DELETE FROM messages WHERE id=" . sqlesc((int) $id)) or sqlerr(__FILE__,__LINE__);

}

elseif ($message['receiver'] == $CURUSER['id'] && $message['saved'] == 'yes')

{

mysql_query("UPDATE messages SET location=0 WHERE id=" . sqlesc((int) $id)) or sqlerr(__FILE__,__LINE__);

}

elseif ($message['sender'] == $CURUSER['id'] && $message['location'] != PM_DELETED)

{

mysql_query("UPDATE messages SET saved='no' WHERE id=" . sqlesc((int) $id)) or sqlerr(__FILE__,__LINE__);

}

}

}

// Check if messages were moved

if (@mysql_affected_rows() == 0)

{

stderr("{$lang['messages_error']}","{$lang['messages_not_deleted']}");

}

else

{

header("Location: messages.php?action=viewmailbox");

exit();

}

}

stderr("{$lang['messages_error']}","{$lang['messages_no_action']}");

}

if ($action == "forward")

{

if ($_SERVER['REQUEST_METHOD'] == 'GET')

{

// Display form

$pm_id = (int) $_GET['id'];

// Get the message

$res = mysql_query("select * FROM messages WHERE id=" . sqlesc($pm_id) . " AND (receiver=" . sqlesc($CURUSER['id']) . " OR sender=" . sqlesc($CURUSER['id']) .") LIMIT 1") or sqlerr(__FILE__,__LINE__);

if (!$res)

{

stderr("{$lang['messages_error']}","{$lang['messages_access_forward']}");

}

if (mysql_num_rows($res) == 0)

{

stderr("{$lang['messages_error']}","{$lang['messages_access_forward']}");

}

$message = mysql_fetch_assoc($res);

// Prepare variables

$subject = "{$lang['messages_fwd']}" . htmlsafechars($message['subject']);

$from = $message['sender'];

$orig = $message['receiver'];

$res = mysql_query("select username FROM users WHERE id=" . sqlesc($orig) . " OR id=" . sqlesc($from)) or sqlerr(__FILE__,__LINE__);

$orig2 = mysql_fetch_assoc($res);

$orig_name = "<a href='userdetails.php?id=$from'>{$orig2['username']}</a>";

if ($from == 0)

{

$from_name = "{$lang['messages_system']}";

$from2['username'] = "{$lang['messages_system']}";

}

else

{

$from2 = mysql_fetch_array($res);

$from_name = "<a href='userdetails.php?id=$from'>{$from2['username']}</a>";

}

$body = sprintf($lang['messages_original'], $from2['username']) . format_comment($message['msg']);

$HTMLOUT = '';

$HTMLOUT .= "<h1>$subject</h1>

<form action='messages.php' method='post'>

<input type='hidden' name='action' value='forward' />

<input type='hidden' name='id' value='$pm_id' />

<table border='0' cellpadding='4' cellspacing='0' width='737'>

<tr>

<td class='colhead'>{$lang['messages_to']}</td>

<td align='left'><input type='text' name='to' value='{$lang['messages_username']}' size='83' /></td>

</tr>

<tr>

<td class='colhead'>Orignal<br />{$lang['messages_receiver']}</td>

<td align='left'>$orig_name</td>

</tr>

<tr>

<td class='colhead'>{$lang['messages_from']}</td>

<td align='left'>$from_name</td>

</tr>

<tr>

<td class='colhead'>{$lang['messages_subject']}</td>

<td align='left'><input type='text' name='subject' value='$subject' size='83' /></td>

</tr>

<tr>

<td class='colhead'>{$lang['messages_message']}</td>

<td align='left'><textarea name='msg' cols='80' rows='8'></textarea><br />$body</td>

</tr>

<tr>

<td colspan='2' align='left'>{$lang['messages_save']} <input type='checkbox' name='save' value='1' ".($CURUSER['savepms'] == 'yes' ? " checked='checked'":'')." />&nbsp;

<input type='submit' value='{$lang['messages_forward_btn']}' class='btn' /></td>

</tr>

</table>

</form>";

print stdhead($subject, false) . $HTMLOUT . stdfoot();

}

else

{

// Forward the message

$pm_id = (int) $_POST['id'];

// Get the message

$res = mysql_query("select * FROM messages WHERE id=" . sqlesc($pm_id) . " AND (receiver=" . sqlesc($CURUSER['id']) . " OR sender=" . sqlesc($CURUSER['id']) .") LIMIT 1") or sqlerr(__FILE__,__LINE__);

if (!$res)

{

stderr("{$lang['messages_error']}","{$lang['messages_access_forward']}");

}

if (mysql_num_rows($res) == 0)

{

stderr("{$lang['messages_error']}","{$lang['messages_access_forward']}");

}

$message = mysql_fetch_assoc($res);

$subject = (string) $_POST['subject'];

$username = strip_tags($_POST['to']);

// Try finding a user with specified name

$res = mysql_query("select id FROM users WHERE LOWER(username)=LOWER(" . sqlesc($username) . ") LIMIT 1");

if (!$res)

{

stderr("{$lang['messages_error']}","{$lang['messages_no_user']}");

}

if (mysql_num_rows($res) == 0)

{

stderr("{$lang['messages_error']}","{$lang['messages_no_user']}");

}

$to = mysql_fetch_array($res);

$to = $to[0];

// Get Orignal sender's username

if ($message['sender'] == 0)

{

$from = "{$lang['messages_system']}";

}

else

{

$res = mysql_query("select * FROM users WHERE id=" . sqlesc($message['sender'])) or sqlerr(__FILE__,__LINE__);

$from = mysql_fetch_assoc($res);

$from = $from['username'];

}

$body = (isset($_POST['msg'])?(string)$_POST['msg']:'');

$body .= sprintf($lang['messages_original1'], $from, $message['msg']);

$save = (isset($_POST['save'])?(int)$_POST['save']:'');

if ($save)

{

$save = 'yes';

}

else

{

$save = 'no';

}

//Make sure recipient wants this message

if ($CURUSER['class'] < UC_MODERATOR)

{

if ($from["acceptpms"] == "yes")

{

$res2 = mysql_query("select * FROM blocks WHERE userid=$to AND blockid=" . $CURUSER["id"]) or sqlerr(__FILE__, __LINE__);

if (mysql_num_rows($res2) == 1)

stderr("{$lang['messages_refused']}", "{$lang['messages_blocked']}");

}

elseif ($from["acceptpms"] == "friends")

{

$res2 = mysql_query("select * FROM friends WHERE userid=$to AND friendid=" . $CURUSER["id"]) or sqlerr(__FILE__, __LINE__);

if (mysql_num_rows($res2) != 1)

stderr("{$lang['messages_refused']}", "{$lang['messages_only_friends']}");

}

elseif ($from["acceptpms"] == "no")

{

stderr("{$lang['messages_refused']}", "{$lang['messages_decline']}");

}

}

@mysql_query("INSERT INTO messages (poster, sender, receiver, added, subject, msg, location, saved) VALUES({$CURUSER["id"]}, {$CURUSER["id"]}, $to, " . TIME_NOW . ", " . sqlesc($subject) . "," .

sqlesc($body) . ", " . sqlesc(PM_INBOX) . ", " . sqlesc($save) . ")") or sqlerr(__FILE__, __LINE__);

stderr("{$lang['messages_success']}", "{$lang['messages_pm_forwarded']}");

}

}

if ($action == "editmailboxes")

{

$res = mysql_query("select * FROM pmboxes WHERE userid=" . sqlesc($CURUSER['id'])) or sqlerr(__FILE__,__LINE__);

$HTMLOUT = '';

$HTMLOUT .= "<h1>{$lang['messages_edit_mb']}</h1>

<table width='737' border='0' cellpadding='4' cellspacing='0'>

<tr>

<td class='colhead' align='left'>{$lang['messages_add_mb']}</td>

</tr>

<tr>

<td align='left'>{$lang['messages_extra']}<br />

<form action='messages.php' method='get'>

<input type='hidden' name='action' value='editmailboxes2' />

<input type='hidden' name='action2' value='add' />

<input type='text' name='new1' size='40' maxlength='14' /><br />

<input type='text' name='new2' size='40' maxlength='14' /><br />

<input type='text' name='new3' size='40' maxlength='14' /><br />

<input type='submit' value='{$lang['messages_add']}' class='btn' />

</form></td>

</tr>

<tr>

<td class='colhead' align='left'>{$lang['messages_mb_edit']}</td>

</tr>

<tr>

<td align='left'>{$lang['messages_vir_dir']}

<form action='messages.php' method='get'>

<input type='hidden' name='action' value='editmailboxes2' />

<input type='hidden' name='action2' value='edit' />";

if (!$res)

{

$HTMLOUT .= "<span align='center'><b>{$lang['messages_no_edit']}<b></span>";

}

if (mysql_num_rows($res) == 0)

{

$HTMLOUT .= "<span align='center'><b>{$lang['messages_no_edit']}</b></span>";

}

else

{

while ($row = mysql_fetch_assoc($res))

{

$id = $row['id'];

$name = htmlsafechars($row['name']);

$HTMLOUT .= "<input type='text' name='edit$id' value='$name' size='40' maxlength='14' /><br />\n";

}

$HTMLOUT .= "<input type='submit' value='{$lang['messages_edit']}' class='btn' />";

}

$HTMLOUT .= "</form></td>

</tr>

</table>";

print stdhead("{$lang['messages_edit_mb']}s", false) . $HTMLOUT . stdfoot();

}

if ($action == "editmailboxes2")

{

$action2 = (string) $_GET['action2'];

if (!$action2)

{

stderr("Error","No action.");

}

if ($action2 == "add")

{

$name1 = $_GET['new1'];

$name2 = $_GET['new2'];

$name3 = $_GET['new3'];

// Get current max box number

$res = mysql_query("select MAX(boxnumber) FROM pmboxes WHERE userid=" . sqlesc($CURUSER['id']));

$box = mysql_fetch_array($res);

$box = (int) $box[0];

if ($box < 2)

{

$box = 1;

}

if (strlen($name1) > 0)

{

++$box;

@mysql_query("INSERT INTO pmboxes (userid, name, boxnumber) VALUES (" . sqlesc($CURUSER['id']) . ", " . sqlesc($name1) . ", $box)") or sqlerr(__FILE__,__LINE__);

}

if (strlen($name2) > 0)

{

++$box;

@mysql_query("INSERT INTO pmboxes (userid, name, boxnumber) VALUES (" . sqlesc($CURUSER['id']) . ", " . sqlesc($name2) . ", $box)") or sqlerr(__FILE__,__LINE__);

}

if (strlen($name3) > 0)

{

++$box;

@mysql_query("INSERT INTO pmboxes (userid, name, boxnumber) VALUES (" . sqlesc($CURUSER['id']) . ", " . sqlesc($name3) . ", $box)") or sqlerr(__FILE__,__LINE__);

}

header("Location: messages.php?action=editmailboxes");

exit();

}

if ($action2 == "edit");

{

$res = mysql_query("select * FROM pmboxes WHERE userid=" . sqlesc($CURUSER['id']));

if (!$res)

{

stderr("{$lang['messages_error']}","{$lang['messages_no_mb_edit']}");

}

if (mysql_num_rows($res) == 0)

{

stderr("{$lang['messages_error']}","{$lang['messages_no_mb_edit']}");

}

else

{

while ($row = mysql_fetch_assoc($res))

{

if (isset($_GET['edit' . $row['id']]))

{

if ($_GET['edit' . $row['id']] != $row['name'])

{

// Do something

if (strlen($_GET['edit' . $row['id']]) > 0)

{

// Edit name

@mysql_query("UPDATE pmboxes SET name=" . sqlesc($_GET['edit' . $row['id']]) . " WHERE id=" . sqlesc($row['id']) . " LIMIT 1");

}

else

{

// Delete

@mysql_query("DELETE FROM pmboxes WHERE id=" . sqlesc($row['id']) . " LIMIT 1");

// Delete all messages from this folder (uses multiple queries because we can only perform security checks in WHERE clauses)

@mysql_query("UPDATE messages SET location=0 WHERE saved='yes' AND location=" . sqlesc($row['boxnumber']) . " AND receiver=" . sqlesc($CURUSER['id']));

@mysql_query("UPDATE messages SET saved='no' WHERE saved='yes' AND sender=" . sqlesc($CURUSER['id']));

@mysql_query("DELETE FROM messages WHERE saved='no' AND location=" . sqlesc($row['boxnumber']) . " AND receiver=" . sqlesc($CURUSER['id']));

@mysql_query("DELETE FROM messages WHERE location=0 AND saved='yes' AND sender=" . sqlesc($CURUSER['id']));

}

}

}

}

header("Location: messages.php?action=editmailboxes");

exit();

}

}

}

if ($action == "deletemessage")

{

$pm_id = (int) $_GET['id'];

// Delete message

$res = mysql_query("select * FROM messages WHERE id=" . sqlesc($pm_id)) or sqlerr(__FILE__,__LINE__);

if (!$res)

{

stderr("{$lang['messages_error']}","{$lang['messages_no_id']}");

}

if (mysql_num_rows($res) == 0)

{

stderr("{$lang['messages_error']}","{$lang['messages_no_id']}");

}

$message = mysql_fetch_assoc($res);

if ($message['receiver'] == $CURUSER['id'] && $message['saved'] == 'no')

{

$res2 = mysql_query("DELETE FROM messages WHERE id=" . sqlesc($pm_id)) or sqlerr(__FILE__,__LINE__);

}

elseif ($message['sender'] == $CURUSER['id'] && $message['location'] == PM_DELETED)

{

$res2 = mysql_query("DELETE FROM messages WHERE id=" . sqlesc($pm_id)) or sqlerr(__FILE__,__LINE__);

}

elseif ($message['receiver'] == $CURUSER['id'] && $message['saved'] == 'yes')

{

$res2 = mysql_query("UPDATE messages SET location=0 WHERE id=" . sqlesc($pm_id)) or sqlerr(__FILE__,__LINE__);

}

elseif ($message['sender'] == $CURUSER['id'] && $message['location'] != PM_DELETED)

{

$res2 = mysql_query("UPDATE messages SET saved='no' WHERE id=" . sqlesc($pm_id)) or sqlerr(__FILE__,__LINE__);

}

if (!$res2)

{

stderr("{$lang['messages_error']}","{$lang['messages_no_delete']}");

}

if (mysql_affected_rows() == 0)

{

stderr("{$lang['messages_error']}","{$lang['messages_no_delete']}");

}

else

{

header("Location: messages.php?action=viewmailbox&id=" . $message['location']);

exit();

}

}

//----- FUNCTIONS ------

function insertJumpTo($selected = 0)

}

?>