<?php
/*
+-----------------------------------------------------------------------------+
| $Id: pm_send.php 2010-05-24 12:37:44Z Bleakwind $
| Send pm for admin
| Copyright (c) 2003-2010 Bleakwind (www.weaverdream.com)
| http://www.weaverdream.com/
| Release under the GNU Lesser General Public License Version 3 (LGPLv3):
|   http://www.gnu.org/licenses/lgpl.html
+-----------------------------------------------------------------------------+
*/

if (!defined( 'ENTRY_INDEX')){
    echo "<h1>Forbidden</h1><p>You don't have permission to access on this server.</p>";
    exit;
}

if($sys->get['ope'] == "save"){
    // check the post
    if ($sys->post['to']      == "" ||
        $sys->post['subject'] == "" ||
        $sys->post['content'] == ""
        ){
        $sys->prompt("failed","请将表单填写完整!");
    } elseif ( (mb_strwidth($sys->post['to'],"UTF-8") < 4 ||
               mb_strwidth($sys->post['to'],"UTF-8") > 16 ||
               preg_match("/[\x01-\x2E]|[\\x2F]|[\x3A-\x40]|[\x5B-\x5E]|[\x60]|[\x7B-\x7F]/",$sys->post['to']))
               && !preg_match("/^[a-z0-9-_\.]+@([a-z0-9][a-z0-9-]*\.)+[a-z]{2,4}$/i",$sys->post['to']) ) {
        $sys->prompt("failed","收件人发生错误!<!-- to error -->");
    } elseif ( strlen($sys->post['subject']) > $CONFIG['max_pm_subject'] ){
        $sys->prompt("failed","标题不能大于".$CONFIG['max_pm_subject']."字节!<!-- subject error -->");
    } elseif ( strlen($sys->post['content']) > $CONFIG['max_pm_content'] ){
        $sys->prompt("failed","内容不能大于".$CONFIG['max_pm_content']."字节!<!-- content error -->");
    }else{

        if (preg_match("/^[a-z0-9-_\.]+@([a-z0-9][a-z0-9-]*\.)+[a-z]{2,4}$/i",$sys->post['to'])) {
            $to_id = func::db_select(DB_TABLE_MEMBER, "id", "email='".$sys->post['to']."'");
        } else {
            $to_id = func::db_select(DB_TABLE_MEMBER, "id", "username='".$sys->post['to']."'");
        }
        if(empty($to_id)){
            $sys->prompt("failed","收件人不存在!<!-- to not exist -->");
        }else{
            
            $sql = "INSERT INTO ".DB_TABLE_PM_IN." SET
                       subject   ='".addslashes($sys->post['subject'])."',
                       content   ='".addslashes($sys->post['content'])."',
                       fid       ='".$MEMBER['id']."',
                       tid       ='".$to_id[0]['id']."',
                       mid       ='".$MEMBER['id']."',
                       if_read   =0,
                       time      =".$sys->nowtime."";
            if (!$db->Execute($sql)) {
                echo $db->ErrorMsg();
            }
            $sql = "INSERT INTO ".DB_TABLE_PM_OUT." SET
                       subject   ='".addslashes($sys->post['subject'])."',
                       content   ='".addslashes($sys->post['content'])."',
                       fid       ='".$MEMBER['id']."',
                       tid       ='".$to_id[0]['id']."',
                       mid       ='".$MEMBER['id']."',
                       if_read   =0,
                       time      =".$sys->nowtime."";
            if (!$db->Execute($sql)) {
                echo $db->ErrorMsg();
            }
            $sys->prompt("succeed","发送短信成功!", $CONFIGURE['common']['control_admin']."?act=pm_send");
        }
    }
} elseif ($sys->get['ope'] == "reply"){
    if(!preg_match("/^[0-9]+$/i",$sys->get['piid'])){
        $sys->prompt("failed","回复短信ID错误!<!-- piid error -->");
    }else{
        $sql = "SELECT pi.*
                FROM ".DB_TABLE_PM_IN." pi
                WHERE pi.id=".$sys->get['piid']."";
        $result = &$db->Execute($sql);
        if (!$result) {
            echo $db->ErrorMsg();
        } else {
            if (!$result->EOF) {

                $member_info = $sys->return_member($result->fields['fid'], array("id","username"));

                $pm_send_reply = array(
                       'id'         => $result->fields['id'],
                       'subject'    => $result->fields['subject'],
                       'content'    => $result->fields['content'],
                       'fid'        => $result->fields['fid'],
                       'tid'        => $result->fields['tid'],
                       'mid'        => $result->fields['mid'],
                       'if_read'    => $result->fields['if_read'],
                       'time'       => $result->fields['time'],
                       'm_id'       => $member_info['m_id'],
                       'm_username' => $member_info['m_username'],
                );
            }
        }

        $t->assign(array(
            "pm_send_reply" => $pm_send_reply,
            "page"              => $bwpage->page_current,
        ));
    }
} elseif ($sys->get['ope'] == "send"){
    if(!preg_match("/^[0-9]+$/i",$sys->get['mid'])){
        $sys->prompt("failed","收信用户ID发生错误!<!-- mid error -->");
    }else{

        $member_info = $sys->return_member($sys->get['mid'], array("id","username"));
        $t->assign(array(
            "pm_send_to" => $member_info,
            "page"          => $bwpage->page_current,
        ));
    }
}
?>
