<?php
defined('_VALID') or die('Restricted Access!');

$access = true;
if ( $config['private_msgs'] == 'friends' ) {
    $sql    = "SELECT FID FROM friends WHERE UID = " .$uid. " LIMIT 1";
    $conn->execute($sql);
    if ( $conn->Affected_Rows() != 1 ) {
        $access = false;
        $_URL   = $config['BASE_URL']. '/error/private_messages_friends';
    }
} elseif ( $config['private_msgs'] == 'disabled' ) {
    $access = false;
    $_URL   = $config['BASE_URL']. '/error/private_messages_disabled';
}

if ( !$access ) {
    VRedirect::go($_URL);
}

require $config['BASE_DIR']. '/classes/filter.class.php';
require $config['BASE_DIR']. '/classes/validation.class.php';

$compose = array('receiver' => '', 'friend' => '', 'subject' => '', 'body' => '', 'save_outbox' => 1, 'send_self' => 0);
if ( isset($query['1']) && $query['1'] != '' ) {
    $valid  = new VValidation();
    if ( $valid->usernameExists($query['1']) ) {
        $compose['receiver'] = $query['1'];
    }
}

if ( isset($_POST['send_mail']) ) {
    $filter         = new VFilter();
    $valid          = new VValidation();
    $receiver       = $filter->get('receiver');
    $friend         = $filter->get('receiver_friend');
    $subject        = $filter->get('subject');
    $body           = $filter->process(trim($_POST['body']), array('a'), array('href'));
    
    if ( $receiver == '' ) {
        if ( $friend != '' ) {
            if ( !$valid->usernameExists($friend) ) {
                $errors[] = 'Friend receiver is not a valid ' .$config['site_name'] . ' username!';
            } else {
                $sql    = "SELECT UID FROM signup WHERE username = '" .mysql_real_escape_string($friend).  "' LIMIT 1";
                $rs     = $conn->execute($sql);
                $fuid   = intval($rs->fields['UID']);
                $sql    = "SELECT UID FROM friends WHERE UID = " .$uid. " AND FID = " .$fuid. " AND status = 'Confirmed' LIMIT 1";
                $conn->execute($sql);
                if ( $conn->Affected_Rows() === 1 ) {
                    $receiver = $friend;
                    $compose['friend'] = $friend;
                } else {
                    $errors[] = 'Username ' .htmlspecialchars($friend, ENT_QUOTES, 'UTF-8'). ' is not a valid friend!';
                }                
            }
        }
    }
    
    if ( $receiver == '' ) {
        $errors[]   = 'Receiver field cannot be blank!';
    } elseif ( !$valid->usernameExists($receiver) ) {
        $errors[]   = 'Receiver is not a valid ' .$config['site_name']. ' username!';
    } else {
        $compose['receiver'] = $receiver;
    }
    
    if ( $subject == '' ) {
        $errors[]   = 'Subject field cannot be blank!';
    } elseif ( strlen($subject) < 3 ) {
        $errors[]   = 'Subject field must contain at least 3 characters!';
    } else {
        $compose['subject'] = $subject;
    }
    
    if ( $body == '' ) {
        $errors[]   = 'Message body cannot be blank!';
    } elseif ( strlen($body) < 3 ) {
        $errors[]   = 'Message body must contain at least 3 characters!';
    } else {
        $compose['body'] = $body;
    }
    
    $compose['save_outbox'] = ( isset($_POST['save_outbox']) ) ? 1 : 0;
    $compose['send_self']   = ( isset($_POST['send_self']) ) ? 1 : 0;
    
    if ( !$errors ) {
        $sql    = "INSERT INTO mail ( sender, receiver, subject, body, inbox, outbox, send_date, status )
                   VALUES ('" .mysql_real_escape_string($username). "', '" .mysql_real_escape_string($receiver). "',
                           '" .mysql_real_escape_string($subject). "', '" .mysql_real_escape_string($body). "',
                           '1', '" .mysql_real_escape_string($compose['save_outbox']). "', '" .date('Y-m-d h:i:s'). "', '1')";
        $conn->execute($sql);
        $messages[] = 'Message successfully sent to <strong>' .$receiver. '</strong>!';
        if ( $compose['send_self'] ) {
            $sql    = "INSERT INTO mail ( sender, receiver, subject, body, inbox, outbox, send_date, status )
                       VALUES ('" .mysql_real_escape_string($username). "', '" .mysql_real_escape_string($username). "',
                               '" .mysql_real_escape_string($subject). "', '" .mysql_real_escape_string($body). "',
                               '1', '0', '" .date('Y-m-d h:i:s'). "', '1')";
            $conn->execute($sql);            
        }
    }
}

$sql        = "SELECT u.username FROM signup AS u, friends AS f
               WHERE f.UID = " .$uid. " AND f.status = 'Confirmed' AND f.FID = u.UID";
$rs         = $conn->execute($sql);
$friends    = $rs->getrows();

$smarty->assign('compose', $compose);
$smarty->assign('friends', $friends);
?>
