.
*
* File Name: profile.inc
* Description: Display a member's profile
* $Date: 2010-02-21 23:16:57 +0000 (Sun, 21 Feb 2010) $
* $Revision: 12 $
*/
global $db,$sitepath,$loggedIn,$templateimagepath ;
if (isset($_GET['user'])) {
$db->query("SELECT * FROM member WHERE username = '".$_GET['user']."'") ;
$idres = $db->fetch() ;
$profileid = $idres['id'] ;
$avatarname = $idres['avatar'] ;
$avatargender = $idres['gender'] > 0 ? 'female' : 'male' ;
}
$db->query("SELECT * FROM member WHERE username = '".$_SESSION['username']."'") ;
$userres = $db->fetch() ;
$userid = $userres['id'] ;
$fromID = $userid ;
$toID = $profileid ;
$avatarpath = $templateimagepath."default_".$avatargender."_avatar.jpg" ;
if (@file_exists("uploads/avatars/".$avatarname) && ($avatarname != "")) {
$avatarpath = "uploads/avatars/".$avatarname ;
$avatarpath = $sitepath.str_replace(" ", "%20", $avatarpath) ;
}
$userandavatar = ''.$_GET['user'].' ' ;
//send message
if (isset($_POST['submit']) && ($_POST['type'] == 'sendmessage') && (canMessage() == '') && ($loggedIn)) {
$messagebody = quote_smart($_POST['msgbody']) ;
$messagebody = apply_word_censor($messagebody) ;
$db->query("INSERT INTO message (fromid, toid, body, sentdate, msgread) VALUES (".quote_smart($_POST['from']).",".quote_smart($_POST['to']).",'".$messagebody."',".time().",0)") ;
$message = "Thank you, your message has been sent to ".$_GET['user']."" ;
}
if (($loggedIn) && ($profileid != 0) && ($userid != 0)) {
$action = $_GET['act'] ;
//arr - Accept request from profile member
if ($action == 'arr') {
//update friend record where userid = loggedinuser and friendid = profileuser to approved = 0, removed = 0
$db->query('UPDATE friend SET friend_approved = 1 WHERE userid='.$userid.' AND friendid='.$profileid) ;
$db->query('UPDATE friend SET friend_removed = 0 WHERE userid='.$userid.' AND friendid='.$profileid) ;
}
//rfa - Profile member removed you - click here to ask again
if ($action == 'rfa') {
//delete old friend record where userid = loggedinuser and friendid = profileuser
$db->query('DELETE FROM friend WHERE userid='.$userid.' AND friendid='.$profileid) ;
//insert new friend record with userid = profileuser, friendid = loggedinuser, approved = 0, removed = 0
$db->query('INSERT INTO friend (userid,friendid,friend_approved,friend_removed) VALUES ('.$profileid.','.$userid.',0,0)') ;
}
//csr - Your sent request is pending - cancel the request
if ($action == 'csr') {
//delete friend record where userid = profileuser and friendid = loggedinuser
$db->query('DELETE FROM friend WHERE userid='.$profileid.' AND friendid='.$userid) ;
}
//rmaf - You have removed this friend request - this just removes the remove! Makes it a live request again
if ($action == 'rmaf') {
//update where userid = profileuser and friendid = loggedinuser set removed = 0
$db->query('UPDATE friend SET friend_removed = 0 WHERE userid='.$profileid.' AND friendid='.$userid) ;
}
//af - Send a request to profile user
if ($action == 'af') {
//check there isn't already a record
$db->query('SELECT * FROM friend WHERE userid='.$profileid.' AND friendid='.$userid) ;
if ($db->numRows() < 1) {
$db->query('INSERT INTO friend (userid,friendid,friend_approved,friend_removed) VALUES ('.$profileid.','.$userid.',0,0)') ;
}
else {
//if already sent, just update it
$db->query('UPDATE friend SET friend_removed = 0 WHERE userid='.$profileid.' AND friendid='.$userid) ;
}
}
//afr - Remove approved friend
if ($action == 'afr') {
//Remove: check if i am the original requester
$db->query('SELECT * FROM friend WHERE userid='.$profileid.' AND friendid='.$userid) ;
if ($db->numRows() > 0) {
//if i am, just make it 'removed = 1 approved = 0' goes back to a request, but removed
$db->query('UPDATE friend SET friend_removed = 1 WHERE userid='.$profileid.' AND friendid='.$userid) ;
$db->query('UPDATE friend SET friend_approved = 0 WHERE userid='.$profileid.' AND friendid='.$userid) ;
}
else {
//if i'm not, need to reverse (delete and insert) the request, removed =1 approved = 0
$db->query('DELETE FROM friend WHERE userid='.$userid.' AND friendid='.$profileid) ;
$db->query('INSERT INTO friend (userid,friendid,friend_approved,friend_removed) VALUES ('.$profileid.','.$userid.',0,1)') ;
}
}
if ($action == 'bl') {
$db->query('SELECT * FROM blocked WHERE blocker_id='.$userid.' AND blockee_id='.$profileid) ;
if ($db->numRows() < 1) {
$db->query('INSERT INTO blocked (blocker_id,blockee_id) VALUES ('.$userid.','.$profileid.')') ;
}
}
if ($action == 'sb') {
$db->query('SELECT * FROM subscription WHERE userid='.$userid.' AND subscribedtoid='.$profileid) ;
if ($db->numRows() < 1) {
$db->query('INSERT INTO subscription (userid,subscribedtoid) VALUES ('.$userid.','.$profileid.')') ;
}
}
if ($action == 'ub') {
$db->query('DELETE FROM blocked WHERE blocker_id='.$userid.' AND blockee_id='.$profileid) ;
}
if ($action == 'us') {
$db->query('DELETE FROM subscription WHERE userid='.$userid.' AND subscribedtoid='.$profileid) ;
}
}
function subscriptionsList($res, $page, $url) {
global $db,$sitepath,$templateimagepath ;
$perpage = getSetting("profsubspp", $db) ;
$size = sizeof($res) ;
$pages = ceil(sizeof($res) / $perpage) ;
$pageLinks = "
" ;
if ($pages > 0)
$output .= $pageLinks ;
return $output ;
}
function getFriends($page) {
global $db ;
$sitefolder = getSetting("sitefolder", $db) ;
$path = "http://".$_SERVER['SERVER_NAME'].$sitefolder."profile/".$_GET['user']."/frd" ;
$db->query("SELECT * FROM member WHERE username = '".$_GET['user']."'") ;
$idres = $db->fetch() ;
$userid = $idres['id'] ;
$db->query("SELECT * FROM member LEFT JOIN friend ON (member.id = friend.friendid OR member.id = friend.userid) WHERE (friend.userid =".$userid." OR friend.friendid =".$userid.") AND (username!='".$_GET['user']."') AND friend.friend_removed=0 AND friend.friend_approved=1 GROUP BY member.id") ;
$resLV = $db->fetchAll() ;
if (sizeof($resLV) > 0) {
$output = "
" ;
}
return $output ;
}
function getGroups($page, $joinedcreated) {
global $db,$sitepath ;
if (($joinedcreated != "joined") && ($joinedcreated != "created")) {
$joinedcreated = "joined" ;
}
$path = $sitepath."profile/".$_GET['user']."/grp/_".$joinedcreated ;
$db->query("SELECT * FROM member WHERE username = '".$_GET['user']."'") ;
$idres = $db->fetch() ;
$userid = $idres['id'] ;
if ($joinedcreated == "created") {
$db->query("SELECT * FROM `group` WHERE `owner_id`=".$userid." ORDER BY created DESC") ;
$tabtitle = "
".$_GET['user']."'s groups
" ;
$action = "created" ;
$links = 'joined | created' ;
$type = "created" ;
}
else if ($joinedcreated == "joined") {
$db->query("SELECT * FROM `group` LEFT JOIN `group_member` ON group_id=`group_id_g` WHERE (`member_id`=".$userid.") AND (approved=1) ORDER BY joined DESC") ;
$tabtitle = "
' ;
return $tabs ;
}
function tabContent() {
$content = '' ;
$activetab = $_GET['act'] ;
if (!isset($_GET['act'])) {
$activetab = 'med' ;
}
if (($activetab != "med") && ($activetab != "fav") && ($activetab != "sub") && ($activetab != "frd") && ($activetab != "grp")) {
$activetab = 'med' ;
}
if ($activetab == "med") {
$content .= getMedia() ;
}
elseif ($activetab == "fav") {
$content .= getFavorites() ;
}
elseif ($activetab == "sub") {
$content .= getSubscriptions() ;
}
elseif ($activetab == "frd") {
$content .= getFriends() ;
}
elseif ($activetab == "grp") {
$content .= getGroups() ;
}
$content .= '' ;
echo $content ;
}
function checkMemberExists() {
global $db,$loggedIn ;
$path = getSetting('sitefolder', $db) ;
$sitepath = 'http://'.$_SERVER['SERVER_NAME'].$path ;
$message = "" ;
if (!isset($_GET['user'])) {
// NO USER IN URL
$message = "Sorry - this user does not exist or is no longer registered" ;
}
else {
$username = mysql_real_escape_string($_GET['user']) ;
$db->query("SELECT * FROM member WHERE username = '".$username."'") ;
$registeredUser = false ;
if ($db->numRows() < 1) {
$message = "Sorry - this user does not exist or is no longer registered" ;
}
}
return $message ;
}
function canMessage() {
global $db,$loggedIn ;
$path = getSetting('sitefolder', $db) ;
$sitepath = 'http://'.$_SERVER['SERVER_NAME'].$path ;
$message = "" ;
if (!isset($_GET['user'])) {
// NO USER IN URL
$message = "Sorry - this user does not exist or is no longer registered" ;
}
else {
$username = mysql_real_escape_string($_GET['user']) ;
//Check it's a registered user
$db->query("SELECT * FROM member WHERE username = '".$username."'") ;
$registeredUser = false ;
if ($db->numRows() >= 1) {
$registeredUser = true ;
$res = $db->fetch() ;
$profileid = $res['id'] ;
$profileprivacylevel = $res['profile_privacy'] ;
// NOW CHECK THAT THIS USER IS ALLOWED TO VIEW THE PROFILE
// IF USER IS LOGGED IN CHECK IF USER IS BLOCKED
$blocked = false ;
$userisfriend = false ;
$userisowner = false ;
$useridadmin = false ;
if ($loggedIn) {
$db->query("SELECT * FROM member WHERE username = '".$_SESSION['username']."'") ;
$res = $db->fetch() ;
$loggedInid = $res['id'] ;
$privs = $res['privs'] ;
$db->query("SELECT * FROM blocked WHERE blocker_id = ".$profileid." AND blockee_id = ".$loggedInid) ;
$blocked = ($db->numRows() >= 1) ;
// CHECK IF USER IS THE OWNER OF THIS PROFILE
$userisowner = ($profileid == $loggedInid) ;
// CHECK IF USER IS ON THE OWNER'S FRIENDS LIST AND IS APPROVED
$db->query("SELECT * from friend WHERE ((userid = ".$profileid." AND friendid = ".$loggedInid.") OR (friendid = ".$profileid." AND userid = ".$loggedInid.")) AND friend_approved = 1") ;
$userisfriend = ($db->numRows() > 0) ;
$userisadmin = ($privs > 6) ;
}
if (!$userisadmin)
// IF USER IS ADMIN THEN NO NEED T0 CHECK FRIENDS/BLOCKED ETC.
{
if ($blocked) {
//USER IS BLOCKED
$message = "
Sorry, this member has chosen not to let you see their profile
" ;
}
else
// USER IS NOT BLOCKED
{
// NOW CHECK IF THE PROFILE IS VISIBLE - IT WILL BE SHOWN IN ANY OF THESE 3 CASES:
// 1 - PROFILE IS PUBLIC
// 2 - PROFILE IS REGISTERED ONLY AND USER IS LOGGED IN
// 3 - PROFILE IS PRIVATE AND USER IS LOGGED IN AND (USER IS A FRIEND OR THE OWNER OF THIS PROFILE)
$profileispublic = ($profileprivacylevel == 0) ;
$registeredonlyandloggedin = (($profileprivacylevel == 1) && ($loggedIn)) ;
$privateandloggedinandfriendorowner = (($profileprivacylevel == 2) && ($loggedIn) && (($userisfriend) OR ($userisowner))) ;
$showprofile = $profileispublic || $registeredonlyandloggedin || $privateandloggedinandfriendorowner ;
if (!$showprofile) {
if (!$loggedIn) {
$message = "
' ;
}
}
}
}
}
}
else {
// USER NAME IS NOT IN THE DATABASE
if (!$registeredUser) {
$message = "Sorry - this user does not exist or is no longer registered" ;
}
}
}
return $message ;
}
function canMessageForMenu() {
global $db,$loggedIn ;
$path = getSetting('sitefolder', $db) ;
$sitepath = 'http://'.$_SERVER['SERVER_NAME'].$path ;
$message = "" ;
if (!isset($_GET['user'])) {
// NO USER IN URL
$message = "Sorry - this user does not exist or is no longer registered" ;
}
else {
$username = mysql_real_escape_string($_GET['user']) ;
//Check it's a registered user
$db->query("SELECT * FROM member WHERE username = '".$username."'") ;
$registeredUser = false ;
if ($db->numRows() >= 1) {
$registeredUser = true ;
$res = $db->fetch() ;
$profileid = $res['id'] ;
$profileprivacylevel = $res['profile_privacy'] ;
// NOW CHECK THAT THIS USER IS ALLOWED TO VIEW THE PROFILE
// IF USER IS LOGGED IN CHECK IF USER IS BLOCKED
$blocked = false ;
$userisfriend = false ;
$userisowner = false ;
$useridadmin = false ;
if ($loggedIn) {
$db->query("SELECT * FROM member WHERE username = '".$_SESSION['username']."'") ;
$res = $db->fetch() ;
$loggedInid = $res['id'] ;
$privs = $res['privs'] ;
$db->query("SELECT * FROM blocked WHERE blocker_id = ".$profileid." AND blockee_id = ".$loggedInid) ;
$blocked = ($db->numRows() >= 1) ;
// CHECK IF USER IS THE OWNER OF THIS PROFILE
$userisowner = ($profileid == $loggedInid) ;
// CHECK IF USER IS ON THE OWNER'S FRIENDS LIST AND IS APPROVED
$db->query("SELECT * from friend WHERE ((userid = ".$profileid." AND friendid = ".$loggedInid.") OR (friendid = ".$profileid." AND userid = ".$loggedInid.")) AND friend_approved = 1") ;
$userisfriend = ($db->numRows() > 0) ;
$userisadmin = ($privs > 6) ;
}
if (!$userisadmin)
// IF USER IS ADMIN THEN NO NEED T0 CHECK FRIENDS/BLOCKED ETC.
{
if ($blocked) {
//USER IS BLOCKED
$message = "
$username has chosen not to let you send messages
" ;
}
else
// USER IS NOT BLOCKED
{
// NOW CHECK IF THE PROFILE IS VISIBLE - IT WILL BE SHOWN IN ANY OF THESE 3 CASES:
// 1 - PROFILE IS PUBLIC
// 2 - PROFILE IS REGISTERED ONLY AND USER IS LOGGED IN
// 3 - PROFILE IS PRIVATE AND USER IS LOGGED IN AND (USER IS A FRIEND OR THE OWNER OF THIS PROFILE)
$profileispublic = ($profileprivacylevel == 0) ;
$registeredonlyandloggedin = (($profileprivacylevel == 1) && ($loggedIn)) ;
$privateandloggedinandfriendorowner = (($profileprivacylevel == 2) && ($loggedIn) && (($userisfriend) OR ($userisowner))) ;
$showprofile = $profileispublic || $registeredonlyandloggedin || $privateandloggedinandfriendorowner ;
if (!$showprofile) {
if (!$loggedIn) {
$message = "Log in to send a message to ".$username ;
}
else {
if ($_GET['act'] == 'af') {
$message = "You will be able to send a message to ".$username." when your friend request is approved" ;
}
else {
$message = 'Become '.$username.'\'s friend to send a message' ;
}
}
}
}
}
}
else {
// USER NAME IS NOT IN THE DATABASE
if (!$registeredUser) {
$message = "Sorry - this user does not exist or is no longer registered" ;
}
}
}
return $message ;
}
function canComment() {
global $db,$loggedIn ;
$path = getSetting('sitefolder', $db) ;
$sitepath = 'http://'.$_SERVER['SERVER_NAME'].$path ;
$message = "" ;
if (!isset($_GET['user'])) {
// NO USER IN URL
$message = "Sorry - this user does not exist or is no longer registered" ;
}
else {
$username = mysql_real_escape_string($_GET['user']) ;
//Check it's a registered user
$db->query("SELECT * FROM member WHERE username = '".$username."'") ;
$registeredUser = false ;
if ($db->numRows() >= 1) {
$registeredUser = true ;
$res = $db->fetch() ;
$profileid = $res['id'] ;
$profileprivacylevel = $res['profile_privacy'] ;
// NOW CHECK THAT THIS USER IS ALLOWED TO VIEW THE PROFILE
// IF USER IS LOGGED IN CHECK IF USER IS BLOCKED
$blocked = false ;
$userisfriend = false ;
$userisowner = false ;
$useridadmin = false ;
if ($loggedIn) {
$db->query("SELECT * FROM member WHERE username = '".$_SESSION['username']."'") ;
$res = $db->fetch() ;
$loggedInid = $res['id'] ;
$privs = $res['privs'] ;
$db->query("SELECT * FROM blocked WHERE blocker_id = ".$profileid." AND blockee_id = ".$loggedInid) ;
$blocked = ($db->numRows() >= 1) ;
// CHECK IF USER IS THE OWNER OF THIS PROFILE
$userisowner = ($profileid == $loggedInid) ;
// CHECK IF USER IS ON THE OWNER'S FRIENDS LIST AND IS APPROVED
$db->query("SELECT * from friend WHERE ((userid = ".$profileid." AND friendid = ".$loggedInid.") OR (friendid = ".$profileid." AND userid = ".$loggedInid.")) AND friend_approved = 1") ;
$userisfriend = ($db->numRows() > 0) ;
$userisadmin = ($privs > 6) ;
}
if (!$userisadmin)
// IF USER IS ADMIN THEN NO NEED T0 CHECK FRIENDS/BLOCKED ETC.
{
if ($blocked) {
//USER IS BLOCKED
$message = "
Sorry, this member has chosen not to let you see their profile
" ;
}
else
// USER IS NOT BLOCKED
{
// NOW CHECK IF THE PROFILE IS VISIBLE - IT WILL BE SHOWN IN ANY OF THESE 3 CASES:
// 1 - PROFILE IS PUBLIC
// 2 - PROFILE IS REGISTERED ONLY AND USER IS LOGGED IN
// 3 - PROFILE IS PRIVATE AND USER IS LOGGED IN AND (USER IS A FRIEND OR THE OWNER OF THIS PROFILE)
$profileispublic = ($profileprivacylevel == 0) ;
$registeredonlyandloggedin = (($profileprivacylevel == 1) && ($loggedIn)) ;
$privateandloggedinandfriendorowner = (($profileprivacylevel == 2) && ($loggedIn) && (($userisfriend) OR ($userisowner))) ;
$showprofile = $profileispublic || $registeredonlyandloggedin || $privateandloggedinandfriendorowner ;
if (!$showprofile) {
if ((!$loggedIn) && (!$profileispublic)) {
$message = "
You must log in to post comments on ".$username."'s profile
'.canMessageForMenu().'