isSMTP();
$mail->Host = SMTP_HOST;
$mail->SMTPAuth = SMTP_AUTH;
if (SMTP_AUTH) {
$mail->Username = SMTP_USERNAME;
$mail->Password = SMTP_PASSWORD;
}
if (SMTP_SECURITY != "none") {
$mail->SMTPSecure = SMTP_SECURITY;
}
$mail->Port = SMTP_PORT;
$mail->isHTML(false);
$mail->setFrom(SMTP_FROMADDRESS, SMTP_FROMNAME);
// Get addresses
$addresses = [];
if ($database->has('mail_lists', ['listid' => $VARS['list']])) {
$addresses = $database->select("addresses", 'email', ['listid' => $VARS['list']]);
} else {
returnToSender("invalid_listid");
}
// Split address list into batches
$segmented = [];
$s = 0;
for ($i = 0; $i < count($addresses); $i++) {
$segmented[$s][] = $addresses[$i];
if (count($segmented[$s]) >= SMTP_BATCH_SIZE) {
$s++;
}
}
// Build message content
if (empty($VARS['subject']) || trim($VARS['subject']) == "") {
returnToSender("invalid_parameters");
}
if (empty($VARS['pubid']) || !$database->has("publications", ['pubid' => $VARS['pubid']])) {
returnToSender("invalid_pubid");
}
$mail->Subject = $VARS['subject'];
$parsedown = new Parsedown();
$parsedown->setSafeMode(true);
$html = $parsedown->text($VARS['message']);
if (strpos(URL, "https://") === 0 || strpos(URL, "http://") === 0) {
$url = URL;
} else {
// Don't trust the URL setting, it's not an absolute URL
$url = (isset($_SERVER['HTTPS']) ? "https" : "http") . "://$_SERVER[HTTP_HOST]";
$path = explode("/", $_SERVER["REQUEST_URI"]);
array_pop($path);
$url .= implode("/", $path);
}
$url = $url . (substr($url, -1) == '/' ? '' : '/');
$puburl = $url . "view.php?id=" . $VARS['pubid'];
$unsuburl = $url . "unsubscribe.php";
$link = "$puburl\n";
$footer = "
\nUnsubscribe: $unsuburl";
$mail->Body = $html . "
\n" . $link . $footer;
$mail->AltBody = $VARS['message'] . "\n" . $puburl . "\n\n-----\nUnsubscribe: $unsuburl";
var_dump($mail->Body);
var_dump($mail->AltBody);
// Send the mail
foreach ($segmented as $segment) {
foreach ($segment as $s) {
$mail->addBCC($s);
}
$mail->send();
$mail->clearAllRecipients();
}
} catch (Exception $ex) {
returnToSender("mail_error", $mail->ErrorInfo);
}
$database->update("publications", ['mailedon' => date("Y-m-d H:i:s"), 'mailedto' => $VARS['list']], ['pubid' => $VARS['pubid']]);
returnToSender("mail_sent");
break;
case "editpub":
$insert = true;
if (is_empty($VARS['pubid'])) {
$insert = true;
} else {
if ($database->has('publications', ['pubid' => $VARS['pubid']])) {
$insert = false;
if ($database->get("publications", 'uid', ['pubid' => $VARS['pubid']]) != $_SESSION['uid']) {
returnToSender("no_permission");
}
} else {
returnToSender("invalid_pubid");
}
}
if (is_empty($VARS['name'])) {
returnToSender('invalid_parameters');
}
$VARS['columns'] = 4;
/* if (!is_numeric($VARS['columns'])) {
returnToSender('invalid_parameters');
} */
if (!preg_match("/([A-Za-z0-9_])+/", $VARS['style'])) {
$VARS['style'] = "";
}
if (!$database->has('pub_permissions', ["permid" => $VARS['perm']])) {
returnToSender('invalid_parameters');
}
if (!$database->has('page_sizes', ["sizeid" => $VARS['size']])) {
returnToSender('invalid_parameters');
}
if (!is_numeric($VARS['landscape']) || ((int) $VARS['landscape'] !== 0 && (int) $VARS['landscape'] !== 1)) {
returnToSender('invalid_parameters');
}
if ($VARS['password_protect'] == 1) {
if (!is_empty($VARS['password'])) {
$password = password_hash($VARS['password'], PASSWORD_BCRYPT);
} else if (!$insert) {
$password = $database->get("publications", 'pwd', ['pubid' => $VARS['pubid']]);
}
$permission = 3;
} else {
$password = null;
$permission = $VARS['perm'];
}
$data = [
'pubname' => $VARS['name'],
'pubdate' => date("Y-m-d H:i:s"),
'style' => $VARS['style'],
'columns' => $VARS['columns'],
'permid' => $permission,
'pwd' => $password,
'page_size' => $VARS['size'],
'landscape' => $VARS['landscape']
];
if ($insert) {
$data['uid'] = $_SESSION['uid'];
$database->insert('publications', $data);
$pubid = $database->id();
if (is_empty($VARS['cloneid']) || !$database->has("publications", ['pubid' => $VARS['cloneid']])) {
// Make a header to get started
$database->insert('tiles', [
"pubid" => $pubid,
"page" => 1,
"styleid" => 1,
"content" => "" . $VARS['name'] . "
",
"width" => $VARS['columns'],
"order" => 0]
);
} else {
$tiles = $database->select("tiles", ["page", "styleid", "content", "width", "order"], ["pubid" => $VARS['cloneid']]);
foreach ($tiles as $tile) {
$tile["pubid"] = $pubid;
$database->insert("tiles", $tile);
}
}
} else {
$database->update('publications', $data, ['pubid' => $VARS['pubid']]);
}
if (isset($VARS["gotocontent"])) {
header("Location: app.php?page=content&pubid=" . $VARS['pubid']);
die();
}
returnToSender("pub_saved");
case "deletepub":
if ($database->has('publications', ['pubid' => $VARS['pubid']])) {
if ($database->get("publications", 'uid', ['pubid' => $VARS['pubid']]) != $_SESSION['uid']) {
returnToSender("no_permission");
}
$database->delete('tiles', ['pubid' => $VARS['pubid']]);
$database->delete('publications', ['pubid' => $VARS['pubid']]);
returnToSender("pub_deleted");
}
returnToSender("invalid_parameters");
case "savetile":
header("Content-Type: application/json");
if (!$database->has('publications', ['pubid' => $VARS['pubid']])) {
die(json_encode(["status" => "ERROR", "msg" => lang("invalid pubid", false)]));
}
if ($database->get("publications", 'uid', ['pubid' => $VARS['pubid']]) != $_SESSION['uid']) {
die(json_encode(["status" => "ERROR", "msg" => lang("no permission", false)]));
}
$data = [
"pubid" => $VARS['pubid'],
"page" => $VARS['page'],
"styleid" => $VARS['styleid'],
"content" => trim($VARS['content']),
"width" => $VARS['width'],
"order" => $VARS['order']
];
if ($database->has('tiles', ["tileid" => $VARS['tileid']])) {
$database->update('tiles', $data, ["tileid" => $VARS['tileid']]);
} else {
$database->insert('tiles', $data);
}
exit(json_encode(["status" => "OK"]));
case "deltile":
header("Content-Type: application/json");
if (!$database->has('tiles', ['tileid' => $VARS['tileid']])) {
die(json_encode(["status" => "ERROR", "msg" => lang("invalid tileid", false)]));
}
$pubid = $database->get("tiles", "pubid", ['tileid' => $VARS['tileid']]);
if ($database->get("publications", 'uid', ['pubid' => $pubid]) != $_SESSION['uid']) {
die(json_encode(["status" => "ERROR", "msg" => lang("no permission", false)]));
}
$database->delete('tiles', ["tileid" => $VARS['tileid']]);
exit(json_encode(["status" => "OK"]));
case "editlist":
$insert = true;
if (is_empty($VARS['listid'])) {
$insert = true;
} else {
if ($database->has('mail_lists', ['listid' => $VARS['listid']])) {
$insert = false;
if ($database->get("mail_lists", 'uid', ['listid' => $VARS['listid']]) != $_SESSION['uid']) {
returnToSender("no_permission");
}
} else {
returnToSender("invalid_listid");
}
}
if (is_empty($VARS['name'])) {
returnToSender('invalid_parameters');
}
$data = [
'listname' => $VARS['name']
];
if ($insert) {
$data['uid'] = $_SESSION['uid'];
$database->insert('mail_lists', $data);
$listid = $database->id();
} else {
$database->update('mail_lists', $data, ['listid' => $VARS['listid']]);
$listid = $VARS['listid'];
}
$emails = explode(",", $VARS['emails']);
$dbemails = $database->select('addresses', 'email', ['listid' => $listid]);
$todelete = $dbemails;
$toadd = [];
foreach ($emails as $m) {
if (!in_array($m, $dbemails)) {
$toadd[] = $m;
}
$todelete = array_diff($todelete, [$m]);
}
foreach ($todelete as $m) {
$database->delete('addresses', ["AND" => ['listid' => $listid, "email" => $m]]);
}
foreach ($toadd as $m) {
$database->insert('addresses', ['listid' => $listid, 'email' => $m, 'name' => '']);
}
returnToSender("list_saved");
case "deletelist":
if ($database->has('mail_lists', ['listid' => $VARS['listid']])) {
if ($database->get("mail_lists", 'uid', ['listid' => $VARS['listid']]) != $_SESSION['uid']) {
returnToSender("no_permission");
}
$database->delete('addresses', ['listid' => $VARS['listid']]);
$database->delete('mail_lists', ['listid' => $VARS['listid']]);
returnToSender("list_deleted");
}
returnToSender("invalid_parameters");
case "signout":
session_destroy();
header('Location: index.php');
die("Logged out.");
}