/**
* Fetches information about the selected message with permission checks
*
* @param	integer	The post we want info about
* @param	mixed		Should a permission check be performed as well
*
* @return	array	Array of information about the message or prints an error if it doesn't exist / permission problems
*/
function verify_visitormessage($vmid, $alert = true, $perm_check = true)
{
    global $vbulletin, $vbphrase;
    $messageinfo = fetch_visitormessageinfo($vmid);
    if (!$messageinfo) {
        if ($alert) {
            standard_error(fetch_error('invalidid', $vbphrase['visitor_message'], $vbulletin->options['contactuslink']));
        } else {
            return 0;
        }
    }
    if ($perm_check) {
        if ($messageinfo['state'] == 'deleted') {
            $can_view_deleted = (can_moderate(0, 'canmoderatevisitormessages') or $messageinfo['userid'] == $vbulletin->userinfo['userid'] and $vbulletin->userinfo['permissions']['visitormessagepermissions'] & $vbulletin->bf_ugp_visitormessagepermissions['canmanageownprofile']);
            if (!$can_view_deleted) {
                standard_error(fetch_error('invalidid', $vbphrase['visitor_message'], $vbulletin->options['contactuslink']));
            }
        }
        if ($messageinfo['state'] == 'moderation') {
            $can_view_moderated = ($messageinfo['postuserid'] == $vbulletin->userinfo['userid'] or $messageinfo['userid'] == $vbulletin->userinfo['userid'] and $vbulletin->userinfo['permissions']['visitormessagepermissions'] & $vbulletin->bf_ugp_visitormessagepermissions['canmanageownprofile'] or can_moderate(0, 'canmoderatevisitormessages'));
            if (!$can_view_moderated) {
                standard_error(fetch_error('invalidid', $vbphrase['visitor_message'], $vbulletin->options['contactuslink']));
            }
        }
        // 	Need coventry support first
        //		if (in_coventry($userinfo['userid']) AND !can_moderate())
        //		{
        //			standard_error(fetch_error('invalidid', $vbphrase['visitor_message'], $vbulletin->options['contactuslink']));
        //		}
    }
    return $messageinfo;
}

function verify_strike_status($username = '', $supress_error = false)
{
    global $vbulletin;
    $vbulletin->db->query_write("DELETE FROM " . TABLE_PREFIX . "strikes WHERE striketime < " . (TIMENOW - 3600));
    if (!$vbulletin->options['usestrikesystem']) {
        return 0;
    }
    $strikes = $vbulletin->db->query_first("\n\t\tSELECT COUNT(*) AS strikes, MAX(striketime) AS lasttime\n\t\tFROM " . TABLE_PREFIX . "strikes\n\t\tWHERE strikeip = '" . $vbulletin->db->escape_string(IPADDRESS) . "'\n\t");
    if ($strikes['strikes'] >= 5 and $strikes['lasttime'] > TIMENOW - 900) {
        //they've got it wrong 5 times or greater for any username at the moment
        // the user is still not giving up so lets keep increasing this marker
        exec_strike_user($username);
        if (!$supress_error) {
            eval(standard_error(fetch_error('strikes', $vbulletin->options['bburl'], $vbulletin->session->vars['sessionurl'])));
        } else {
            return false;
        }
    } else {
        if ($strikes['strikes'] > 5) {
            // a bit sneaky but at least it makes the error message look right
            $strikes['strikes'] = 5;
        }
    }
    return $strikes['strikes'];
}

 public function output()
 {
     global $vbulletin;
     $vbulletin->input->clean_array_gpc('r', array('userid' => TYPE_UINT));
     // verify the userid exists, don't want useless entries in our table.
     if ($vbulletin->GPC['userid'] and $vbulletin->GPC['userid'] != $vbulletin->userinfo['userid']) {
         if (!($userinfo = fetch_userinfo($vbulletin->GPC['userid']))) {
             standard_error(fetch_error('invalidid', $vbphrase['user'], $vbulletin->options['contactuslink']));
         }
         // are we a member of this user's blog?
         if (!is_member_of_blog($vbulletin->userinfo, $userinfo)) {
             print_no_permission();
         }
         $userid = $userinfo['userid'];
         /* Blog posting check */
         if (!($userinfo['permissions']['vbblog_entry_permissions'] & $vbulletin->bf_ugp_vbblog_entry_permissions['blog_canpost']) or !($userinfo['permissions']['vbblog_general_permissions'] & $vbulletin->bf_ugp_vbblog_general_permissions['blog_canviewown'])) {
             print_no_permission();
         }
     } else {
         $userinfo =& $vbulletin->userinfo;
         $userid = '';
         /* Blog posting check, no guests! */
         if (!($vbulletin->userinfo['permissions']['vbblog_general_permissions'] & $vbulletin->bf_ugp_vbblog_general_permissions['blog_canviewown']) or !($vbulletin->userinfo['permissions']['vbblog_entry_permissions'] & $vbulletin->bf_ugp_vbblog_entry_permissions['blog_canpost']) or !$vbulletin->userinfo['userid']) {
             print_no_permission();
         }
     }
     require_once DIR . '/includes/blog_functions_shared.php';
     prepare_blog_category_permissions($userinfo, true);
     $globalcats = $this->construct_category($userinfo, 'global');
     $localcats = $this->construct_category($userinfo, 'local');
     return array('globalcategorybits' => $globalcats, 'localcategorybits' => $localcats);
 }

function fetch_search_forumids(&$forumchoice, $childforums = 0)
{
    global $vbulletin, $display;
    // make sure that $forumchoice is an array
    if (!is_array($forumchoice)) {
        $forumchoice = array($forumchoice);
    }
    // initialize the $forumids for return by this function
    $forumids = array();
    foreach ($forumchoice as $forumid) {
        // get subscribed forumids
        if ($forumid === 'subscribed' and $vbulletin->userinfo['userid'] != 0) {
            DEVDEBUG("Querying subscribed forums for " . $vbulletin->userinfo['username']);
            $sforums = $vbulletin->db->query_read_slave("\n\t\t\t\tSELECT forumid FROM " . TABLE_PREFIX . "subscribeforum\n\t\t\t\tWHERE userid = " . $vbulletin->userinfo['userid']);
            if ($vbulletin->db->num_rows($sforums) == 0) {
                // no subscribed forums
                eval(standard_error(fetch_error('not_subscribed_to_any_forums')));
            }
            while ($sforum = $vbulletin->db->fetch_array($sforums)) {
                $forumids["{$sforum['forumid']}"] .= $sforum['forumid'];
            }
            unset($sforum);
            $vbulletin->db->free_result($sforums);
        } else {
            $forumid = intval($forumid);
            if (isset($vbulletin->forumcache["{$forumid}"]) and $vbulletin->forumcache["{$forumid}"]['link'] == '') {
                $forumids["{$forumid}"] = $forumid;
            }
        }
    }
    // now if there are any forumids we have to query, work out their child forums
    if (empty($forumids)) {
        $forumchoice = array();
        $display['forums'] = array();
    } else {
        // set $forumchoice to show the returned forumids
        #$forumchoice = implode(',', $forumids);
        // put current forumids into the display table
        $display['forums'] = $forumids;
        // get child forums of selected forums
        if ($childforums) {
            require_once DIR . '/includes/functions_misc.php';
            foreach ($forumids as $forumid) {
                $children = fetch_child_forums($forumid, 'ARRAY');
                if (!empty($children)) {
                    foreach ($children as $childid) {
                        $forumids["{$childid}"] = $childid;
                    }
                }
                unset($children);
            }
        }
    }
    // return the array of forumids
    return $forumids;
}

/**
* Shows the form for inline mod authentication.
*/
function show_inline_mod_login($showerror = false)
{
    global $vbulletin, $vbphrase, $show;
    $show['inlinemod_form'] = true;
    $show['passworderror'] = $showerror;
    if (!$showerror) {
        $vbulletin->url = SCRIPTPATH;
    }
    $forumHome = vB_Library::instance('content_channel')->getForumHomeChannel();
    eval(standard_error(fetch_error('nopermission_loggedin', $vbulletin->userinfo['username'], vB_Template_Runtime::fetchStyleVar('right'), vB::getCurrentSession()->get('sessionurl'), $vbulletin->userinfo['securitytoken'], vB5_Route::buildUrl($forumHome['routeid'] . 'home|fullurl'))));
}

 /**
  * For registration without existing account, create a new vb user
  * If a user is successfully created, her userid is written to $userid
  */
 private function createUser($data, &$userid)
 {
     global $vbulletin;
     $moderated = $vbulletin->options['moderatenewmembers'];
     $languageid = $vbulletin->userinfo['languageid'];
     $require_activation = $vbulletin->options['verifyemail'] && $data['default_email'] != $data['coded_email'];
     // Create a vB user with default permissions -- code from register.php
     if (!$vbulletin->options['allowregistration']) {
         eval(standard_error(fetch_error('noregister')));
     }
     // Init user datamanager class
     $userdata =& datamanager_init('User', $vbulletin, ERRTYPE_SILENT);
     $userdata->set_info('coppauser', false);
     $userdata->set_info('coppapassword', '');
     $userdata->set_bitfield('options', 'coppauser', '');
     $userdata->set('username', $data['username']);
     $userdata->set('password', md5($this->genPasswd()));
     $userdata->set('email', $data['email']);
     $userdata->set('languageid', $languageid);
     $userdata->set('ipaddress', IPADDRESS);
     // UserGroupId: Registered Users (2) or Users Awaiting Email Confirmation (3)
     $userdata->set('usergroupid', $require_activation ? 3 : 2);
     $userdata->set_usertitle('', false, $vbulletin->usergroupcache["{$newusergroupid}"], false, false);
     $userdata->presave_called = true;
     // If any error happened, we abort and return the error message(s)
     if ($userdata->has_errors(false)) {
         // $die := false
         return join('</li><li>', $userdata->errors);
     }
     // Save the data
     $userid = $userdata->save();
     // Did we get a valid vb userid?
     if (!$userid) {
         return 'vbnexus_registration_failed';
     }
     // If the user changed the email given by the external service, we follow
     // the regular steps for email activation
     if ($require_activation) {
         // Email phrase 'activateaccount' expects vars called $userid, $username
         // and $activateid to be defined and meaningfull
         $username = $data['username'];
         $activateid = build_user_activation_id($userid, $moderated ? 4 : 2, 0);
         eval(fetch_email_phrases('activateaccount', $languageid));
         // After eval'ing activateaccount we have vars $subject and $message set
         vbmail($data['email'], $subject, $message, true);
     }
     // Force a new session to prevent potential issues with guests from the same IP, see bug #2459
     $vbulletin->session->created = false;
     return true;
 }

// get special phrase groups
$phrasegroups = array('wol');
// get special data templates from the datastore
$specialtemplates = array('maxloggedin', 'wol_spiders');
// pre-cache templates used by all actions
$globaltemplates = array('forumdisplay_sortarrow', 'im_aim', 'im_icq', 'im_msn', 'im_yahoo', 'im_skype', 'WHOSONLINE', 'whosonlinebit');
// pre-cache templates used by specific actions
$actiontemplates = array('resolveip' => array('whosonline_resolveip'));
// ######################### REQUIRE BACK-END ############################
require_once './global.php';
require_once DIR . '/includes/functions_online.php';
// #######################################################################
// ######################## START MAIN SCRIPT ############################
// #######################################################################
if (!$vbulletin->options['WOLenable']) {
    eval(standard_error(fetch_error('whosonlinedisabled')));
}
if (!($permissions['wolpermissions'] & $vbulletin->bf_ugp_wolpermissions['canwhosonline'])) {
    print_no_permission();
}
// #######################################################################
// resolve an IP in Who's Online (this uses the WOL permissions)
if ($_REQUEST['do'] == 'resolveip') {
    $vbulletin->input->clean_array_gpc('r', array('ipaddress' => TYPE_NOHTML, 'ajax' => TYPE_BOOL));
    // can we actually resolve this?
    if (!($permissions['wolpermissions'] & $vbulletin->bf_ugp_wolpermissions['canwhosonlineip'])) {
        print_no_permission();
    }
    $resolved_host = htmlspecialchars_uni(@gethostbyaddr($vbulletin->GPC['ipaddress']));
    $ipaddress =& $vbulletin->GPC['ipaddress'];
    // no html'd already

function goto_nextthread($threadid, $throwerror = true)
{
    global $vbulletin;
    $thread = verify_id('thread', $threadid, $throwerror, 1);
    $forumperms = fetch_permissions($thread['forumid']);
    // remove threads from users on the global ignore list if user is not a moderator
    if ($coventry = fetch_coventry('string') and !can_moderate($thread['forumid'])) {
        $globalignore = "AND postuserid NOT IN ({$coventry})";
    } else {
        $globalignore = '';
    }
    if (!($forumperms & $vbulletin->bf_ugp_forumpermissions['canviewothers'])) {
        $limitothers = "AND postuserid = " . $vbulletin->userinfo['userid'] . " AND " . $vbulletin->userinfo['userid'] . " <> 0";
    } else {
        $limitothers = '';
    }
    if ($vbulletin->userinfo['userid'] and in_coventry($vbulletin->userinfo['userid'], true)) {
        $lastpost_info = ",IF(tachythreadpost.userid IS NULL, thread.lastpost, tachythreadpost.lastpost) AS lastpost";
        $tachyjoin = "LEFT JOIN " . TABLE_PREFIX . "tachythreadpost AS tachythreadpost ON " . "(tachythreadpost.threadid = thread.threadid AND tachythreadpost.userid = " . $vbulletin->userinfo['userid'] . ')';
        $lastpost_having = "HAVING lastpost > {$thread['lastpost']}";
    } else {
        $lastpost_info = "";
        $tachyjoin = "";
        $lastpost_having = "AND lastpost > {$thread['lastpost']}";
    }
    if ($getnextnewest = $vbulletin->db->query_first_slave("\n\t\tSELECT thread.threadid, thread.title\n\t\t\t{$lastpost_info}\n\t\tFROM " . TABLE_PREFIX . "thread AS thread\n\t\t{$tachyjoin}\n\t\tWHERE forumid = {$thread['forumid']}\n\t\t\tAND visible = 1\n\t\t\tAND open <> 10\n\t\t\t{$globalignore}\n\t\t\t{$limitothers}\n\t\t{$lastpost_having}\n\t\tORDER BY lastpost\n\t\tLIMIT 1\n\t")) {
        $threadid = $getnextnewest['threadid'];
        unset($thread);
    } else {
        if ($throwerror) {
            eval(standard_error(fetch_error('nonextnewest')));
        }
    }
    return $getnextnewest;
}

	$xml = new vB_AJAX_XML_Builder($vbulletin, 'text/xml');
	$xml->add_group('response');

	if ($profilefield = $db->query_first("SELECT profilefield.* FROM
		" . TABLE_PREFIX . "profilefield AS profilefield
		WHERE profilefieldid = " . $vbulletin->GPC['fieldid']))
	{
		if ($profilefield['editable'] == 1 OR ($profilefield['editable'] == 2 AND empty($vbulletin->userinfo["field$profilefield[profilefieldid]"])))
		{
			$profilefield_template = fetch_profilefield($profilefield, 'memberinfo_customfield_edit');
			$xml->add_tag('template', process_replacement_vars($profilefield_template));
		}
		else
		{
			$xml->add_tag('error', fetch_error('profile_field_uneditable'));
			$xml->add_tag('uneditable', '1');
		}
	}
	else
	{
		// we want this person to refresh the page, so just throw a no perm error
		print_no_permission();
	}

	$xml->close_group();
	$xml->print_xml();
}

// #############################################################################
// dismisses a dismissible notice

 /**
  * Shows an error message and halts execution - use this in the same way as print_stop_message();
  *
  * @param	string	Phrase name for error message
  */
 function error($errorphrase)
 {
     //if we are passed a array then assume that it is the phrase plus arguments
     if (is_array($errorphrase)) {
         $args = $errorphrase;
     } else {
         $args = func_get_args();
     }
     //if we aren't processing the error, just save the phrase id and args raw
     if ($this->error_handler == vB_DataManager_Constants::ERRTYPE_ARRAY_UNPROCESSED) {
         $error = $args;
     } else {
         if ($this->error_handler == vB_DataManager_Constants::ERRTYPE_UPGRADE) {
             $error = $args;
         } else {
             //otherwise fetch the error message
             $error = fetch_error($args);
         }
     }
     $this->errors[] = $error;
     if ($this->failure_callback and is_callable($this->failure_callback)) {
         call_user_func_array($this->failure_callback, array(&$this, $errorphrase));
     }
     switch ($this->error_handler) {
         case vB_DataManager_Constants::ERRTYPE_ARRAY:
         case vB_DataManager_Constants::ERRTYPE_SILENT:
         case vB_DataManager_Constants::ERRTYPE_ARRAY_UNPROCESSED:
         case vB_DataManager_Constants::ERRTYPE_UPGRADE:
             // do nothing -- either we are ignoring errors or manually checking the error array at intervals.
             break;
         case vB_DataManager_Constants::ERRTYPE_STANDARD:
             throw new Exception($error);
             break;
         case vB_DataManager_Constants::ERRTYPE_CP:
             print_cp_message($error);
             break;
     }
 }

    ($hook = vBulletinHook::fetch_hook('group_inlinemod_dodelete')) ? eval($hook) : false;
    eval(print_standard_redirect('redirect_inline_deletedmessages', true, $forceredirect));
}
if ($_POST['do'] == 'inlineundelete') {
    if (!can_moderate(0, 'candeletegroupmessages')) {
        standard_error(fetch_error('you_do_not_have_permission_to_manage_deleted_messages'));
    }
    // Validate Messages
    $messages = $db->query_read_slave("\n\t\tSELECT gm.gmid, gm.state, gm.groupid, gm.dateline, gm.postuserid, gm.postusername,\n\t\t\tsocialgroup.name AS group_name, socialgroup.creatoruserid\n\t\tFROM " . TABLE_PREFIX . "groupmessage AS gm\n\t\tLEFT JOIN " . TABLE_PREFIX . "socialgroup AS socialgroup ON (socialgroup.groupid = gm.groupid)\n\t\tWHERE gmid IN ({$messageids})\n\t\t\tAND state = 'deleted'\n\t");
    while ($message = $db->fetch_array($messages)) {
        $message['is_group_owner'] = $message['creatoruserid'] == $vbulletin->userinfo['userid'];
        $messagearray["{$message['gmid']}"] = $message;
        $grouplist["{$message['groupid']}"] = true;
    }
    if (empty($messagearray)) {
        standard_error(fetch_error('you_did_not_select_any_valid_messages'));
    }
    $db->query_write("\n\t\tDELETE FROM " . TABLE_PREFIX . "deletionlog\n\t\tWHERE type = 'groupmessage' AND\n\t\t\tprimaryid IN(" . implode(',', array_keys($messagearray)) . ")\n\t");
    $db->query_write("\n\t\tUPDATE " . TABLE_PREFIX . "groupmessage\n\t\tSET state = 'visible'\n\t\tWHERE gmid IN(" . implode(',', array_keys($messagearray)) . ")\n\t");
    foreach ($grouplist as $groupid => $foo) {
        build_group_counters($groupid);
    }
    foreach ($messagearray as $message) {
        if (!$message['is_group_owner']) {
            log_moderator_action($message, 'gm_by_x_for_y_undeleted', array($message['postusername'], $message['group_name']));
        }
    }
    // empty cookie
    setcookie('vbulletin_inlinegmessage', '', TIMENOW - 3600, '/');
    ($hook = vBulletinHook::fetch_hook('group_inlinemod_undelete')) ? eval($hook) : false;
    eval(print_standard_redirect('redirect_inline_undeletedmessages', true, $forceredirect));

 /**
  * Shows an error message and halts execution - use this in the same way as print_stop_message();
  *
  * @param	string	Phrase name for error message
  */
 function error($errorphrase)
 {
     $args = func_get_args();
     if (is_array($errorphrase)) {
         $error = fetch_error($errorphrase);
     } else {
         $error = call_user_func_array('fetch_error', $args);
     }
     $this->errors[] = $error;
     if ($this->failure_callback and is_callable($this->failure_callback)) {
         call_user_func_array($this->failure_callback, array(&$this, $errorphrase));
     }
     switch ($this->error_handler) {
         case ERRTYPE_ARRAY:
         case ERRTYPE_SILENT:
             // do nothing
             break;
         case ERRTYPE_STANDARD:
             eval(standard_error($error));
             break;
         case ERRTYPE_CP:
             print_cp_message($error);
             break;
     }
 }

             }
         }
         eval('$infractionbits .= "' . fetch_template('userinfractionbit') . '";');
     }
 }
 if ($vbulletin->userinfo['permissions']['genericpermissions'] & $vbulletin->bf_ugp_genericpermissions['cangivearbinfraction']) {
     $checked_inf = (!$vbulletin->GPC['infractionlevelid'] and !empty($vbulletin->GPC['period']) or empty($infractionbits)) ? 'checked="checked"' : '';
     $show['custominfraction'] = true;
 }
 if (!empty($banlist) and ($show['custominfraction'] or $infractionban or $pointsban)) {
     $show['banreason'] = true;
 } else {
     $show['banreason'] = false;
 }
 if (empty($infractionbits) and !($vbulletin->userinfo['permissions']['genericpermissions'] & $vbulletin->bf_ugp_genericpermissions['cangivearbinfraction'])) {
     eval(standard_error(fetch_error('there_are_no_infraction_levels')));
 }
 // draw nav bar
 $navbits = array();
 if ($postinfo['postid']) {
     $parentlist = array_reverse(explode(',', $foruminfo['parentlist']));
     foreach ($parentlist as $forumID) {
         $forumTitle = $vbulletin->forumcache["{$forumID}"]['title'];
         $navbits['forumdisplay.php?' . $vbulletin->session->vars['sessionurl'] . "f={$forumID}"] = $forumTitle;
     }
     $navbits['showthread.php?' . $vbulletin->session->vars['sessionurl'] . "p={$postid}"] = $threadinfo['prefix_plain_html'] . ' ' . $threadinfo['title'];
 }
 $navbits[''] = construct_phrase($vbphrase['user_infraction_for_x'], $userinfo['username']);
 $navbits = construct_navbits($navbits);
 require_once DIR . '/includes/functions_editor.php';
 $textareacols = fetch_textarea_width();

	$page_templater->register('spacer_close', $spacer_close);
	$page_templater->register('spacer_open', $spacer_open);
	$page_templater->register('totalcols', $totalcols);
	$page_templater->register('totalusers', $totalusers);
	$page_templater->register('usergroupid', $usergroupid);
	$page_templater->register('usergrouplink', $usergrouplink);
	$page_templater->register('oppositesort', $oppositesort);
}

// #############################################################################
// advanced search
if ($_REQUEST['do'] == 'search')
{
	if (!$vbulletin->options['usememberlistadvsearch'])
	{
		eval(standard_error(fetch_error('nomemberlistsearch')));
	}

	$bgclass = 'alt1';
	// get extra profile fields
	$profilefields = $db->query_read_slave("
		SELECT *
		FROM " . TABLE_PREFIX . "profilefield
		WHERE searchable = 1
			AND form = 0
			" . iif(!($permissions['genericpermissions'] & $vbulletin->bf_ugp_genericpermissions['canseehiddencustomfields']), " AND hidden = 0") . "
		ORDER BY displayorder
	");

	$customfields = '';
	while ($profilefield = $db->fetch_array($profilefields))

 /**
  * Sets the user we're working with. Automatically sets permissions as well.
  *
  * @param	integer	User to process
  * @param	boolean	Whether to fetch existing CSS data
  *
  * @return	boolean	True on success
  */
 function set_userid($userid, $fetch = true)
 {
     $userid = intval($userid);
     if ($userid == $this->registry->userinfo['userid']) {
         $this->userid = $userid;
         $this->permissions = $this->registry->userinfo['permissions'];
     } else {
         if ($user = $this->dbobject->query_first("SELECT * FROM " . TABLE_PREFIX . "user WHERE userid = {$userid}")) {
             $this->userid = $userid;
             $this->permissions = cache_permissions($user, false);
         } else {
             global $vbphrase;
             $this->error[] = fetch_error('invalidid', $vbphrase['user'], $this->registry->options['contactuslink']);
             return false;
         }
     }
     if ($fetch) {
         $this->existing = $this->fetch_existing();
     }
     return true;
 }

 /**
  * Performs atomic floodcheck
  *
  */
 function perform_floodcheck_commit()
 {
     $flood_limit = ($this->registry->options['enableemail'] and $this->registry->options['rpemail'] ? $this->registry->options['emailfloodtime'] : $this->registry->options['floodchecktime']);
     require_once DIR . '/includes/class_floodcheck.php';
     $floodcheck =& new vB_FloodCheck($this->registry, 'user', 'emailstamp');
     $floodcheck->commit_key($this->registry->userinfo['userid'], TIMENOW, TIMENOW - $flood_limit);
     if ($floodcheck->is_flooding()) {
         standard_error(fetch_error('report_post_floodcheck', $flood_limit, $floodcheck->flood_wait()));
     }
 }

     $vbulletin->options['attachfile'] = ATTACH_AS_DB;
 } else {
     // Converting FROM fs TO mysql
     $path = fetch_attachment_path($attachment['userid'], $attachment['filedataid']);
     $thumbnail_path = fetch_attachment_path($attachment['userid'], $attachment['filedataid'], true);
     $temp = $vbulletin->options['attachfile'];
     $vbulletin->options['attachfile'] = ATTACH_AS_DB;
     if ($filedata = @file_get_contents($path)) {
         $thumbnail_filedata = @file_get_contents($thumbnail_path);
         $attachdata =& datamanager_init('Filedata', $vbulletin, ERRTYPE_SILENT, 'attachment');
         $attachdata->set_existing($attachment);
         $attachdata->setr('filedata', $filedata);
         $attachdata->setr('thumbnail', $thumbnail_filedata);
         if (!($result = $attachdata->save())) {
             if (empty($attachdata->errors[0])) {
                 $attacherror = fetch_error('upload_file_failed');
                 // change this error
             } else {
                 $attacherror =& $attachdata->errors[0];
             }
         }
         unset($attachdata);
     } else {
         // Add error about file missing..
         $vbulletin->GPC['attacherrorcount']++;
     }
     $vbulletin->options['attachfile'] = $temp;
 }
 if ($vbulletin->debug) {
     echo "\t<tr>\n\t\t\t\t\t<td>{$attachment['filedataid']}" . iif($attacherror, "<br />{$attacherror}") . "</td>\n\t\t\t\t\t<td>{$attachment['filesize']}</td>\n\t\t\t\t\t<td>{$filesize} / {$thumbnail_filesize}</td>\n\t\t\t\t\t</tr>\n\t\t\t\t\t";
 } else {

 $tmp = explode('_', $currency);
 $currency = $tmp[1];
 $subscriptionsubid = intval($tmp[0]);
 unset($tmp);
 $costs = unserialize($sub['cost']);
 if ($costs["{$subscriptionsubid}"]['length'] == 1) {
     $subscription_units = $lengths[$costs["{$subscriptionsubid}"]['units']];
 } else {
     $subscription_units = $lengths[$costs["{$subscriptionsubid}"]['units'] . 's'];
 }
 $subscription_length = construct_phrase($vbphrase['length_x_units_y_recurring_z'], $costs["{$subscriptionsubid}"]['length'], $subscription_units, $costs["{$subscriptionsubid}"]['recurring'] ? ' *' : '');
 $subscription_title = $sub['title'];
 $subscription_cost = $subobj->_CURRENCYSYMBOLS["{$currency}"] . vb_number_format($costs["{$subscriptionsubid}"]['cost']["{$currency}"], 2);
 $orderbits = '';
 if (empty($costs["{$subscriptionsubid}"]['cost']["{$currency}"])) {
     eval(standard_error(fetch_error('invalid_currency')));
 }
 // These phrases are constant since they are the name of a service
 $tmp = array('paypal' => 'PayPal', 'nochex' => 'NOCHEX', 'worldpay' => 'WorldPay', '2checkout' => '2Checkout', 'moneybookers' => 'MoneyBookers', 'authorizenet' => 'Authorize.Net', 'ccbill' => 'CCBill');
 $vbphrase += $tmp;
 ($hook = vBulletinHook::fetch_hook('paidsub_order_start')) ? eval($hook) : false;
 $hash = md5($vbulletin->userinfo['userid'] . $vbulletin->userinfo['salt'] . $subscriptionid . uniqid(microtime(), 1));
 /* insert query */
 $db->query_write("\n\t\tINSERT INTO " . TABLE_PREFIX . "paymentinfo\n\t\t\t(hash, completed, subscriptionid, subscriptionsubid, userid)\n\t\tVALUES\n\t\t\t('" . $db->escape_string($hash) . "', 0, {$subscriptionid}, {$subscriptionsubid}, " . $vbulletin->userinfo['userid'] . ")\n\t");
 $methods = $db->query_read_slave("SELECT * FROM " . TABLE_PREFIX . "paymentapi WHERE active = 1 AND FIND_IN_SET('" . $db->escape_string($currency) . "', currency)");
 while ($method = $db->fetch_array($methods)) {
     if (empty($costs["{$subscriptionsubid}"]['ccbillsubid']) and $method['classname'] == 'ccbill') {
         continue;
     }
     if ($costs["{$subscriptionsubid}"]['cost']["{$currency}"] > 0) {
         $form = $subobj->construct_payment($hash, $method, $costs["{$subscriptionsubid}"], $currency, $sub, $vbulletin->userinfo);

    $orderedids = array();
    if ($starteronly) {
        $threads = $db->query_read_slave("\n\t\t\tSELECT thread.threadid\n\t\t\tFROM " . TABLE_PREFIX . "thread AS thread\n\t\t\tWHERE thread.postuserid = {$user['userid']}\n\t\t\t\t{$sql}\n\t\t\tORDER BY lastpost DESC\n\t\t\tLIMIT " . $vbulletin->options['maxresults'] * 2 . "\n\t\t");
        while ($thread = $db->fetch_array($threads)) {
            $orderedids[] = $thread['threadid'];
        }
    } else {
        $posts = $db->query_read_slave("\n\t\t\tSELECT postid\n\t\t\tFROM " . TABLE_PREFIX . "post AS post\n\t\t\tINNER JOIN " . TABLE_PREFIX . "thread AS thread ON(thread.threadid = post.threadid)\n\t\t\tWHERE post.userid = {$user['userid']}\n\t\t\t\t{$sql}\n\t\t\tORDER BY post.dateline DESC\n\t\t\tLIMIT " . $vbulletin->options['maxresults'] * 2 . "\n\t\t");
        while ($post = $db->fetch_array($posts)) {
            $orderedids[] = $post['postid'];
        }
        $db->free_result($posts);
    }
    // did we get some results?
    if (empty($orderedids)) {
        eval(standard_error(fetch_error('searchnoresults', $displayCommon), '', false));
    }
    // set display terms
    $display = array('words' => array(), 'highlight' => array(), 'common' => array(), 'users' => array($user['userid'] => $user['username']), 'forums' => iif($showforums, $display['forums'], 0), 'options' => array('starteronly' => $starteronly, 'childforums' => 1, 'action' => 'process'));
    // end search timer
    $searchtime = number_format(fetch_microtime_difference($searchtime), 5, '.', '');
    $sort_order = $showposts ? 'post.dateline' : 'lastpost';
    ($hook = vBulletinHook::fetch_hook('search_finduser_complete')) ? eval($hook) : false;
    /*insert query*/
    $db->query_write("\n\t\tREPLACE INTO " . TABLE_PREFIX . "search\n\t\t\t(userid, ipaddress, personal,\n\t\t\tsearchuser, forumchoice,\n\t\t\tsortby, sortorder, searchtime,\n\t\t\tshowposts, orderedids, dateline,\n\t\t\tdisplayterms, searchhash, completed)\n\t\tVALUES\n\t\t\t(" . $vbulletin->userinfo['userid'] . ", '" . $db->escape_string(IPADDRESS) . "', 1,\n\t\t\t'" . $db->escape_string($user['username']) . "', '" . $db->escape_string($forumchoice) . "',\n\t\t\t'{$sort_order}', 'DESC', {$searchtime},\n\t\t\t{$showposts}, '" . $db->escape_string(implode(',', $orderedids)) . "', " . TIMENOW . ",\n\t\t\t'" . $db->escape_string(serialize($display)) . "', '" . $db->escape_string($searchhash) . "', 1)\n\t");
    $searchid = $db->insert_id();
    $vbulletin->url = 'search.php?' . $vbulletin->session->vars['sessionurl'] . "searchid={$searchid}";
    eval(print_standard_redirect('search'));
}
// #############################################################################
if ($_POST['do'] == 'doprefs') {

        while ($attachment = $db->fetch_array($attachs)) {
            // hide users in Coventry
            $ast = '';
            if (in_coventry($attachment['userid']) and !can_moderate($threadinfo['forumid'])) {
                continue;
            }
            $attachment['filename'] = fetch_censored_text(htmlspecialchars_uni($attachment['filename']));
            $attachment['attachmentextension'] = strtolower(file_extension($attachment['filename']));
            $attachment['filesize'] = vb_number_format($attachment['filesize'], 1, true);
            exec_switch_bg();
            eval('$attachments .= "' . fetch_template('attachmentbit') . '";');
        }
        ($hook = vBulletinHook::fetch_hook('misc_showattachments_complete')) ? eval($hook) : false;
        eval('print_output("' . fetch_template('ATTACHMENTS') . '");');
    } else {
        eval(standard_error(fetch_error('noattachments')));
    }
}
// ############################### start show avatars ###############################
if ($_REQUEST['do'] == 'showavatars') {
    $vbulletin->input->clean_array_gpc('r', array('pagenumber' => TYPE_UINT));
    ($hook = vBulletinHook::fetch_hook('misc_avatars_start')) ? eval($hook) : false;
    $perpage = $vbulletin->options['numavatarsperpage'];
    $totalavatars = $db->query_first_slave("\n\t\tSELECT COUNT(*) AS count\n\t\tFROM " . TABLE_PREFIX . "avatar AS avatar\n\t\tLEFT JOIN " . TABLE_PREFIX . "imagecategorypermission AS perm ON (perm.imagecategoryid=avatar.imagecategoryid AND perm.usergroupid=" . $vbulletin->userinfo['usergroupid'] . ")\n\t\tWHERE ISNULL(perm.imagecategoryid)\n\t");
    $totalavatars = intval($totalavatars['count']);
    sanitize_pageresults($totalavatars, $vbulletin->GPC['pagenumber'], $perpage, 100, 25);
    $startat = ($vbulletin->GPC['pagenumber'] - 1) * $perpage;
    $first = $startat + 1;
    $last = $startat + $perpage;
    if ($last > $totalavatars) {
        $last = $totalavatars;