rendered paste body<?php
/*
+--------------------------------------------------------------------------
| TS Special Edition v.4.3
| ========================================
| by xam
| (c) 2005 - 2007 Template Shares Services
| http://templateshares.net
| ========================================
| Web: http://templateshares.net
| Time: March 14, 2008, 6:15 am
| Signature Key: TSSE90342008
| Email: contact@templateshares.net
| TS SE IS NOT FREE SOFTWARE!
+---------------------------------------------------------------------------
*/
@error_reporting(E_ALL & ~E_NOTICE);
@ini_set('error_reporting', E_ALL & ~E_NOTICE);
@ini_set('display_errors', '0');
@ini_set('display_startup_errors', '0');
@ini_set('ignore_repeated_errors', '1');
@ini_set('log_errors', '1');
require_once('include/bittorrent.php');
require_once(INC_PATH.'/benc.php');
dbconn();
loggedinorreturn();
maxsysop();
@set_time_limit(300);
@ini_set('upload_max_filesize', ($max_torrent_size > 1000 ? $max_torrent_size : 10485760));
@ini_set('memory_limit', '20000M');
@ignore_user_abort(1);
define ('TU_VERSION', '2.3 by xam');
if ($usergroups['canupload'] == 'no' OR $usergroups['canupload'] != 'yes' OR $CURUSER['uploadpos'] == 'no')
{
print_no_permission();
exit;
}
else if (strtoupper($_SERVER['REQUEST_METHOD']) != 'POST')
{
header("Location: $BASEURL/upload.php");
exit;
}
$lang->load('upload');
$conv_table = array(
/* 0*/ 0x0000, 0x263a, 0x263b, 0x2665, 0x2666,
/* 5*/ 0x2663, 0x2660, 0x2022, 0x25d8, 0x0000,
/* 10*/ 0x0000, 0x2642, 0x2640, 0x0000, 0x266b,
/* 15*/ 0x263c, 0x25ba, 0x25c4, 0x2195, 0x203c,
/* 20*/ 0x00b6, 0x00a7, 0x25ac, 0x21a8, 0x2191,
/* 25*/ 0x2193, 0x2192, 0x2190, 0x221f, 0x2194,
/* 30*/ 0x25b2, 0x25bc, 0x0000, 0x0000, 0x0022,
/* 35*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0027,
/* 40*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/* 45*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/* 50*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/* 55*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/* 60*/ 0x003c, 0x0000, 0x0000, 0x0000, 0x0000,
/* 65*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/* 70*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/* 75*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/* 80*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/* 85*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/* 90*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/* 95*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/*100*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/*105*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/*110*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/*115*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/*120*/ 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
/*125*/ 0x0000, 0x0000, 0x2302, 0x00c7, 0x00fc,
/*130*/ 0x00e9, 0x00e2, 0x00e4, 0x00e0, 0x00e5,
/*135*/ 0x00e7, 0x00ea, 0x00eb, 0x00e8, 0x00ef,
/*140*/ 0x00ee, 0x00ec, 0x00c4, 0x00c5, 0x00c9,
/*145*/ 0x00e6, 0x00c6, 0x00f4, 0x00f6, 0x00f2,
/*150*/ 0x00fb, 0x00f9, 0x00ff, 0x00d6, 0x00dc,
/*155*/ 0x00a2, 0x00a3, 0x00a5, 0x20a7, 0x0192,
/*160*/ 0x00e1, 0x00ed, 0x00f3, 0x00fa, 0x00f1,
/*165*/ 0x00d1, 0x00aa, 0x00ba, 0x00bf, 0x2310,
/*170*/ 0x00ac, 0x00bd, 0x00bc, 0x00a1, 0x00ab,
/*175*/ 0x00bb, 0x2591, 0x2592, 0x2593, 0x2502,
/*180*/ 0x2524, 0x2561, 0x2562, 0x2556, 0x2555,
/*185*/ 0x2563, 0x2551, 0x2557, 0x255d, 0x255c,
/*190*/ 0x255b, 0x2510, 0x2514, 0x2534, 0x252c,
/*195*/ 0x251c, 0x2500, 0x253c, 0x255e, 0x255f,
/*200*/ 0x255a, 0x2554, 0x2569, 0x2566, 0x2560,
/*205*/ 0x2550, 0x256c, 0x2567, 0x2568, 0x2564,
/*210*/ 0x2565, 0x2559, 0x2558, 0x2552, 0x2553,
/*215*/ 0x256b, 0x256a, 0x2518, 0x250c, 0x2588,
/*220*/ 0x2584, 0x258c, 0x2590, 0x2580, 0x03b1,
/*225*/ 0x03b2, 0x0393, 0x03c0, 0x03a3, 0x03c3,
/*230*/ 0x03bc, 0x03c4, 0x03a6, 0x03b8, 0x2126,
/*235*/ 0x03b4, 0x221e, 0x00f8, 0x03b5, 0x2229,
/*240*/ 0x2261, 0x00b1, 0x2265, 0x2264, 0x2320,
/*245*/ 0x2321, 0x00f7, 0x2248, 0x00b0, 0x00b7,
/*250*/ 0x02d9, 0x221a, 0x207f, 0x00b2, 0x25a0,
/*255*/ 0x00a0
);
function validfilename($name)
{
return preg_match('/^[^\0-\x1f:\\\\\/?*\xff#<>|]+$/si', $name);
}
function nfo_ripper($str)
{
global $conv_table;
$str = str_replace("&", "&", $str);
for ($i = 0; $i < 256; $i++)
{
if ($conv_table[$i] != 0)
$str = str_replace(chr($i), "&#".$conv_table[$i].";", $str);
}
return '[nfo]'.$str.'[/nfo]';
}
function bark($msg,$redirect=true)
{
global $lang, $where;
if ($redirect)
{
$where .= '&msg='.base64_encode($msg);
header("Location: $where");
exit;
}
stderr($lang->global['error'], $msg);
}
function dict_check($d, $s)
{
global $lang;
if ($d["type"] != "dictionary")
bark($lang->upload['dicterror1']);
$a = explode(":", $s);
$dd = $d["value"];
$ret = array();
foreach ($a as $k)
{
unset($t);
if (preg_match('/^(.*)\((.*)\)$/', $k, $m))
{
$k = $m[1];
$t = $m[2];
}
if (!isset($dd[$k]))
bark($lang->upload['dicterror2']);
if (isset($t)) {
if ($dd[$k]["type"] != $t)
bark($lang->upload['dicterror3']);
$ret[] = $dd[$k]["value"];
}
else
$ret[] = $dd[$k];
}
return $ret;
}
function dict_get($d, $k, $t)
{
global $lang;
if ($d["type"] != "dictionary")
bark($lang->upload['dicterror1']);
$dd = $d["value"];
if (!isset($dd[$k]))
return;
$v = $dd[$k];
if ($v["type"] != $t)
bark($lang->upload['dicterror4']);
return $v["value"];
}
$where = 'upload.php?upload_step=2&subject='.base64_encode($_POST['subject']).'&type='.htmlspecialchars_uni($_POST['type']).'&trackerurl='.base64_encode($_POST['trackerurl']).'&t_link='.base64_encode($_POST['t_link']).'&nforip='.htmlspecialchars_uni($_POST['nforip']).'&uplver='.htmlspecialchars_uni($_POST['uplver']).'&offensive='.htmlspecialchars_uni($_POST['offensive']).'&t_image_url='.base64_encode($_POST['t_image_url']).'&t_image_file='.base64_encode($_POST['t_image_file']).'&message='.base64_encode($_POST['message']);
foreach(explode(":","message:type:subject") as $v)
{
if (!isset($_POST[$v]))
bark($lang->global['dontleavefieldsblank']);
}
if (!isset($_FILES["file"]))
bark($lang->global['dontleavefieldsblank']);
$f = $_FILES["file"];
// Remove Spaces+.
$f = preg_replace("#\s+#", "_", $f);
$fname = unesc($f["name"]);
if (empty($fname))
bark($lang->global['dontleavefieldsblank']);
if ($_POST['uplver'] == 'yes')
{
$anonymous = "yes";
$anon = $lang->upload['anonymous'];
}
else
{
$anonymous = "no";
$anon = $CURUSER["username"];
}
if ($_POST['free'] == '1' AND is_mod($usergroups))
$free = "yes";
else
$free = "no";
if ($_POST['silver'] == '1' AND $free == 'no' AND is_mod($usergroups))
$silver = "yes";
else
$silver = "no";
if ($_POST['sticky'] == 'yes' AND is_mod($usergroups))
$sticky = "yes";
else
$sticky = "no";
if ($_POST['offensive'] == 'yes')
$offensive = 'yes';
else
$offensive = 'no';
$nfofile = $_FILES['nfo'];
if ($nfofile['name'] != '')
{
if ($nfofile['size'] == 0)
bark($lang->upload['nfoerror1']);
if ($nfofile['size'] > 65535)
bark($lang->upload['nfoerror2']);
$nfofilename = $nfofile['tmp_name'];
if (@!is_uploaded_file($nfofilename))
bark($lang->upload['nfoerror3']);
if ($_POST['nforip'] == 'yes')
{
$nfo = @file_get_contents($nfofilename);
$descr = nfo_ripper($nfo);
}
}
$descr = (isset($descr) ? unesc($descr) : unesc($_POST['message']));
if (!$descr)
bark($lang->global['dontleavefieldsblank']);
elseif (strlen($descr) < 10)
bark($lang->upload['mindesclimit']);
$catid = (int)$_POST["type"];
if (!is_valid_id($catid))
bark($lang->upload['selectcategory']);
if (!validfilename($fname))
bark($lang->upload['fileerror1']);
if (!preg_match('/^(.+)\.torrent$/si', $fname, $matches))
bark($lang->upload['fileerror2']);
$shortfname = $torrent = $matches[1];
if (!empty($_POST["subject"]))
$torrent = unesc($_POST["subject"]);
$tmpname = $f["tmp_name"];
if (!@is_uploaded_file($tmpname))
bark($lang->upload['uploaderror1']);
if (!@filesize($tmpname))
bark($lang->upload['uploaderror2']);
if ($privatetrackerpatch == 'yes')
{
$alink = $announce_urls[0];
}
else
{
$alink = $announce_urls[0].'?passkey='.$CURUSER['passkey'];
}
$dict = bdec_file($tmpname, $max_torrent_size);
if (!isset($dict))
bark($lang->upload['uploaderror3']);
list($ann, $info) = dict_check($dict, "announce(string):info");
list($dname, $plen, $pieces) = dict_check($info, "name(string):piece length(integer):pieces(string)");
$external = false;
$sql1 = $sql2 = $trackerurl = "";
$visible = "no";
if ($externalscrape == 'yes' && $ann != $alink)
{
$external = true;
$trackerurl = trim($ann);
$sql1 = ",ts_external, ts_external_url";
$sql2 = ", 'yes', ".sqlesc($ann)."";
$visible = "yes";
}
if ($external && $usergroups['canexternal'] != 'yes')
{
bark($lang->upload['externalerror']);
}
if ($privatetrackerpatch == 'no' && !$external)
{
if (!in_array($ann, $announce_urls, 1))
{
$aok=false;
foreach($announce_urls as $au)
{
if($ann=="$au?passkey=$CURUSER[passkey]")
$aok=true;
}
if(!$aok)
bark($lang->upload['invalidannounceurl'].$announce_urls[0] . '?passkey='.$CURUSER['passkey']);
}
}
if (strlen($pieces) % 20 != 0)
bark($lang->upload['invalidpieces']);
if ($privatetrackerpatch == 'yes' && !$external)
{
if(isset($dict['value']['announce-list']) || isset($dict['value']['nodes']) || (isset($dict['value']['azureus_properties']['value']['dht_backup_enable']) && $dict['value']['azureus_properties']['value']['dht_backup_enable']['value'] != 0))
bark($lang->upload['dhterror']);
}
$filelist = array();
$totallen = dict_get($info, "length", "integer");
if (isset($totallen))
{
$filelist[] = array($dname, $totallen);
$type = "single";
}
else
{
$flist = dict_get($info, "files", "list");
if (!isset($flist))
bark($lang->upload['dicterror5']);
if (!count($flist))
bark($lang->upload['dicterror6']);
$totallen = 0;
foreach ($flist as $fn) {
list($ll, $ff) = dict_check($fn, "length(integer):path(list)");
$totallen += $ll;
$ffa = array();
foreach ($ff as $ffe)
{
if ($ffe["type"] != "string")
bark($lang->upload['dicterror7']);
$ffa[] = $ffe["value"];
}
if (!count($ffa))
bark($lang->upload['dicterror7']);
$ffe = implode("/", $ffa);
$filelist[] = array($ffe, $ll);
}
$type = "multi";
}
if ($privatetrackerpatch == 'yes' && !$external)
{
$dict['value']['announce']=bdec(benc_str( $announce_urls[0])); // change announce url to local
$dict['value']['info']['value']['private']=bdec('i1e'); // add private tracker flag
$dict['value']['info']['value']['source']=bdec(benc_str( "[$DEFAULTBASEURL] $SITENAME")); // add link for bitcomet users
unset($dict['value']['announce-list']); // remove multi-tracker capability
unset($dict['value']['nodes']); // remove cached peers (Bitcomet & Azareus)
$dict=bdec(benc($dict)); // double up on the becoding solves the occassional misgenerated infohash
list($ann, $info) = dict_check($dict, "announce(string):info");
}
$infohash = pack("H*", sha1($info["string"]));
$torrent = str_replace("_", " ", $torrent);
$nfo = sqlesc(str_replace("\x0d\x0d\x0a", "\x0d\x0a", @file_get_contents($nfofilename)));
if (!empty($_FILES['t_image_file']) || !empty($_POST['t_image_url']) || !empty($_POST['t_link']))
{
include_once(INC_PATH.'/class_upload.php');
$upload = new ts_upload();
if (!empty($_POST['t_image_url']) && $_POST['t_image_url'] != $lang->upload['field23'])
{
$t_image = fix_url($_POST['t_image_url']);
$upload->url = $t_image;
$upload->file_type = 'image';
$upload->allowed_ext = array('gif', 'jpg', 'png');
$upload->check_url();
}
elseif (!empty($_FILES['t_image_file']) && !empty($_FILES['t_image_file']['name']) && !empty($_FILES['t_image_file']['tmp_name']))
{
include_once(INC_PATH.'/class_upload2.php');
$handle = new Upload($_FILES['t_image_file']);
if ($handle->uploaded)
{
$SQL = "SHOW
TABLE STATUS
FROM
$mysql_db
LIKE
'torrents'";
$result = mysql_query($SQL);
$row = mysql_fetch_assoc($result);
$nextInsertId = $row['Auto_increment'];
$handle->allowed = array(
"image/gif",
"image/jpg",
"image/jpeg",
"image/png"
);
$allowed = implode(',', $handle->allowed);
$allowed = str_replace('image/', '', $allowed);
$handle->file_new_name_body = $nextInsertId;
$handle->image_text = $SITENAME;
$handle->image_text_direction = 'v';
$handle->image_text_background = '#000000';
$handle->image_text_font = 1;
$handle->image_text_position = 'BL';
$handle->image_text_padding_x = 2;
$handle->image_text_padding_y = 8;
$handle->Process($rootpath.$torrent_dir.'/images/');
if ($handle->processed) {
$t_image = $BASEURL.'/'.$torrent_dir.'/images/'.$handle->file_dst_name;
} else {
stderr($lang->global['error'], sprintf($lang->upload['invalid_image'], $allowed));
}
$handle-> Clean();
}
}
if (!empty($_POST['t_link']))
{
$t_link = fix_url($_POST['t_link']);
if (substr($t_link, -1, 1) != '/')
$t_link = "{$t_link}/";
$upload->url = $t_link;
$upload->valid_link = array('http://www.imdb.com/title/');
$upload->file_type = 'imdb';
$upload->check_url();
if (strstr($t_link, 'imdb'))
include_once(INC_PATH.'/ts_imdb.php');
}
}
$ret = sql_query("INSERT INTO torrents (search_text, t_image, t_link, filename, owner, visible, anonymous, free, silver, sticky, offensive, info_hash, name, size, numfiles, type, descr, ori_descr, category, added, last_action, nfo".$sql1.") VALUES (" .implode(",", array_map("sqlesc", array(searchfield("$shortfname $torrent"), (!empty($t_image) ? $t_image : (!empty($cover_photo_name) ? $BASEURL.'/'.$cover_photo_name : '')), (!empty($t_link) ? $t_link : ''), $fname, $CURUSER["id"], $visible, $anonymous, $free, $silver, $sticky, $offensive, $infohash, $torrent, $totallen, count($filelist), $type, $descr, $descr, 0 + $_POST["type"]))) . ", '" . get_date_time() . "', '" . get_date_time() . "', ".$nfo.$sql2.")");
if (!$ret)
{
if (mysql_errno() == 1062)
bark($lang->upload['sqlerror1']);
else
bark($lang->upload['sqlerror2'].mysql_error());
}
$id = mysql_insert_id();
if ($privatetrackerpatch == 'yes' && !$external)
{
$fp = @fopen("$torrent_dir/$id.torrent", "w");
if ($fp)
{
@fwrite($fp, benc($dict), strlen(benc($dict)));
@fclose($fp);
}
}
if ($privatetrackerpatch == 'no' && !$external)
@move_uploaded_file($tmpname, "$torrent_dir/$id.torrent");
if ($external)
{
$externaltorrent = "$torrent_dir/$id.torrent";
@move_uploaded_file($tmpname, $externaltorrent);
include_once(INC_PATH.'/ts_external_scrape/ts_external.php');
}
//===add karma
include_once(INC_PATH.'/readconfig_kps.php');
KPS("+",$kpsupload,$CURUSER['id']);
//===end
if ($CURUSER["anonymous"] == 'yes')
write_log(sprintf($lang->upload['writelog1'], $id, $torrent));
else
write_log(sprintf($lang->upload['writelog2'], $id, $torrent, $CURUSER['username']));
if (isset($_POST['offer']))
{
$offer = intval($_POST['offer']);
$pn_msg = sprintf($lang->upload['offermessage'], $torrent, $CURUSER['username'], $BASEURL, $id);
$subject = sprintf($lang->upload['offersubject'], $torrent);
$res = sql_query("SELECT userid FROM offervotes WHERE userid != ".$CURUSER['id']." AND offerid = ".sqlesc($offer)) or sqlerr(__FILE__, __LINE__);
while($row = mysql_fetch_assoc($res))
{
sql_query("INSERT INTO messages (sender, subject, receiver, added, msg) VALUES (0, ".sqlesc($subject).", $row[userid], ".sqlesc(get_date_time()).", ".sqlesc($pn_msg).")") or sqlerr(__FILE__, __LINE__);
}
//=== delete all offer stuff
@sql_query("DELETE FROM offers WHERE id = ". sqlesc($offer));
@sql_query("DELETE FROM offervotes WHERE offerid = ". sqlesc($offer));
@sql_query("DELETE FROM comments WHERE torrent = 0 AND request = 0 AND offer = ".sqlesc($offer));
}
/* Email notifs */
// Send notification email to VIP users.
$res = sql_query("SELECT name FROM categories WHERE id=".sqlesc($catid));
$arr = mysql_fetch_assoc($res);
$cat = $arr["name"];
$res = sql_query("SELECT u.email FROM users u LEFT JOIN usergroups g ON (u.usergroup=g.gid) WHERE u.enabled='yes' AND u.parked='no' AND u.status='confirmed' AND u.notifs LIKE '%[cat{$catid}]%' AND u.notifs LIKE '%[email]%' AND u.notifs != '' AND g.isvipgroup='yes'");
$size = mksize($totallen);
$body = sprintf($lang->upload['emailbody'], $torrent, $size, $cat, $anon, $descr, $BASEURL, $id, $SITENAME);
$to = "";
$nmax = 100;
$nthis = $ntotal = 0;
$total = mysql_num_rows($res);
if ($total > 0)
{
while ($arr = mysql_fetch_row($res))
{
if ($nthis == 0)
$to = $arr[0];
else
$to .= "," . $arr[0];
++$nthis;
++$ntotal;
if ($nthis == $nmax || $ntotal == $total)
{
$sm = sent_mail($to, sprintf($lang->upload['emailsubject'], $SITENAME, $torrent), $body,'takeupload',false);
$nthis = 0;
}
}
}
include_once(INC_PATH.'/readconfig_pjirc.php');
if ($ircbot == 'yes' && ($connect = @fsockopen($botip, $botport, $errno, $errstr)))
{
$botmessage = chr(3)."9".chr(2)." $SITENAME".chr(2)." -".chr(3)."10 New Torrent: (".chr(3)."15 $torrent".chr(3)."10 ) Size: (".chr(3)."15 ".$size.chr(3)."10 ) Category: (".chr(3)."15 ". $cat.chr(3)."10 ) Uploader: (".chr(3)."15 $anon".chr(3)."10 ) Link: (".chr(3)."15 $BASEURL/details.php?id=$id".chr(3)."10 )\r\n";
@fwrite($connect, $botmessage);
@fclose($connect);
}
if ($tsshoutbot == 'yes' && ($showshoutbox == 'yes' || $showshoutbox == 'staffonly') && preg_match("#upload#", $tsshoutboxoptions))
{
$seo_link = ts_seo($id,$torrent,'s');
$shoutbOT = sprintf($lang->upload['shoutbOT'], $seo_link, $torrent, $anon);
$shout_sql = "INSERT INTO shoutbox (username, userid, namestyle, date, content)
VALUES (".sqlesc($tsshoutbotname).", ".sqlesc('999999999').", ".sqlesc('<span style="color: darkred;"><strong><em>{username}</em></strong></span>').", '".TIMENOW."', ".sqlesc("{systemnotice}".$shoutbOT).")";
$shout_result = sql_query($shout_sql);
}
redirect('details.php?id='.intval($id).'&uploaded=1', sprintf($lang->upload['writelog2'], $id, $torrent, $CURUSER['username']));
?>