misuzu/public-legacy/forum/post.php

<?php
namespace Misuzu;

use RuntimeException;

$forum = $msz->getForum();

$postId = !empty($_GET['p']) && is_string($_GET['p']) ? (int)$_GET['p'] : 0;
$postMode = !empty($_GET['m']) && is_string($_GET['m']) ? (string)$_GET['m'] : '';
$submissionConfirmed = !empty($_GET['confirm']) && is_string($_GET['confirm']) && $_GET['confirm'] === '1';

$postRequestVerified = CSRF::validateRequest();

if(!empty($postMode) && !$msz->isLoggedIn()) {
    echo render_info('You must be logged in to manage posts.', 401);
    return;
}

$currentUser = $msz->getActiveUser();
$currentUserId = $currentUser === null ? '0' : $currentUser->getId();

if($postMode !== '' && $msz->hasActiveBan()) {
    echo render_info('You have been banned, check your profile for more information.', 403);
    return;
}

try {
    $postInfo = $forum->getPost(postId: $postId);
} catch(RuntimeException $ex) {
    echo render_error(404);
    return;
}

$perms = forum_perms_get_user($postInfo->getCategoryId(), $currentUserId)[MSZ_FORUM_PERMS_GENERAL];

if(!perms_check($perms, MSZ_FORUM_PERM_VIEW_FORUM)) {
    echo render_error(403);
    return;
}

$canDeleteAny = perms_check($perms, MSZ_FORUM_PERM_DELETE_ANY_POST);

switch($postMode) {
    case 'delete':
        if($canDeleteAny) {
            if($postInfo->isDeleted()) {
                echo render_info('This post has already been marked as deleted.', 404);
                return;
            }
        } else {
            if($postInfo->isDeleted()) {
                echo render_error(404);
                return;
            }

            if(!perms_check($perms, MSZ_FORUM_PERM_DELETE_POST)) {
                echo render_info('You are not allowed to delete posts.', 403);
                return;
            }

            if($postInfo->getUserId() !== $currentUser->getId()) {
                echo render_info('You can only delete your own posts.', 403);
                return;
            }

            // posts may only be deleted within a week of creation, this should be a config value
            $deleteTimeFrame = 60 * 60 * 24 * 7;
            if($postInfo->getCreatedTime() < time() - $deleteTimeFrame) {
                echo render_info('This post has existed for too long. Ask a moderator to remove if it absolutely necessary.', 403);
                return;
            }
        }

        $originalPostInfo = $forum->getPost(topicInfo: $postInfo->getTopicId());
        if($originalPostInfo->getId() === $postInfo->getId()) {
            echo render_info('This is the opening post of the topic it belongs to, it may not be deleted without deleting the entire topic as well.', 403);
            return;
        }

        if($postRequestVerified && !$submissionConfirmed) {
            url_redirect('forum-post', [
                'post' => $postInfo->getId(),
                'post_fragment' => 'p' . $postInfo->getId(),
            ]);
            break;
        } elseif(!$postRequestVerified) {
            Template::render('forum.confirm', [
                'title' => 'Confirm post deletion',
                'class' => 'far fa-trash-alt',
                'message' => sprintf('You are about to delete post #%d. Are you sure about that?', $postInfo->getId()),
                'params' => [
                    'p' => $postInfo->getId(),
                    'm' => 'delete',
                ],
            ]);
            break;
        }

        $forum->deletePost($postInfo);
        $msz->createAuditLog('FORUM_POST_DELETE', [$postInfo->getId()]);

        url_redirect('forum-topic', ['topic' => $postInfo->getTopicId()]);
        break;

    case 'nuke':
        if(!$canDeleteAny) {
            echo render_error(403);
            break;
        }

        if($postRequestVerified && !$submissionConfirmed) {
            url_redirect('forum-post', [
                'post' => $postInfo->getId(),
                'post_fragment' => 'p' . $postInfo->getId(),
            ]);
            break;
        } elseif(!$postRequestVerified) {
            Template::render('forum.confirm', [
                'title' => 'Confirm post nuke',
                'class' => 'fas fa-radiation',
                'message' => sprintf('You are about to PERMANENTLY DELETE post #%d. Are you sure about that?', $postInfo->getId()),
                'params' => [
                    'p' => $postInfo->getId(),
                    'm' => 'nuke',
                ],
            ]);
            break;
        }

        $forum->nukePost($postInfo->getId());
        $msz->createAuditLog('FORUM_POST_NUKE', [$postInfo->getId()]);

        url_redirect('forum-topic', ['topic' => $postInfo->getTopicId()]);
        break;

    case 'restore':
        if(!$canDeleteAny) {
            echo render_error(403);
            break;
        }

        if($postRequestVerified && !$submissionConfirmed) {
            url_redirect('forum-post', [
                'post' => $postInfo->getId(),
                'post_fragment' => 'p' . $postInfo->getId(),
            ]);
            break;
        } elseif(!$postRequestVerified) {
            Template::render('forum.confirm', [
                'title' => 'Confirm post restore',
                'class' => 'fas fa-magic',
                'message' => sprintf('You are about to restore post #%d. Are you sure about that?', $postInfo->getId()),
                'params' => [
                    'p' => $postInfo->getId(),
                    'm' => 'restore',
                ],
            ]);
            break;
        }

        $forum->restorePost($postInfo->getId());
        $msz->createAuditLog('FORUM_POST_RESTORE', [$postInfo->getId()]);

        url_redirect('forum-topic', ['topic' => $postInfo->getTopicId()]);
        break;

    default: // function as an alt for topic.php?p= by default
        url_redirect('forum-post', [
            'post' => $postInfo->getId(),
            'post_fragment' => 'p' . $postInfo->getId(),
        ]);
        break;
}