#!/usr/bin/perl

#################################################################################################
#Messageboard version 1.2#
#Version Finish Date: 14 July 2001
#This version adds better parsing of the form--carriage returns are turned into html paragraphs,
#all html formatting is eliminated, and attempting to insert a <script> tag is met with chastisement
#Also, a possible security bug was fixed, by now doing regexp parsing of all user input, including
#the query string

#works on unix; i am not sure, and frankly don't care, if it works on brain-damaged operating systems (e.g., windows)
#I just learned that it actually works on NT server, as well (may 2001)
#
#copyright 2001 by Michael K. Goode.
#loosely based on the guestbook script by bernard sowa : www.zonecoaster.com
#actually, all that is left of that script are the getformdata and nicedate subroutines
#
#Copyright 2001 by Michael K. Goode#

#This script is free for use, distribution, and modification#
#The only right I reserve is this header must remain intact, as long as the program#
#is used for its original purpose (appending comments to a webpage).#
#This header may be removed, if, and only if, a portion of the code is used in a program that does not#
#fulfill the functions of this program#
#The home of this script: http://www.mikegoode.com/web/scripts/#
#please check there for any updates or upgrades or bug fixes and for help files#
#my email address: mike@mikegoode.com#
#if you have any good changes or additions, please email them to me,#
#and I will add them to this program or add new versions of the program#
#to my website and credit you.#
##
#I am not responsible for any damage resulting from the use of this program#
#and I make no guarentees about its performance, specific or implied#
#I am also not able to help anyone with support, other than #
#by providing some basic help info on my website.#
#############################################################
#          YOU CAN CHANGE  ANYTHING BELOW THIS POINT TO YOUR HEART'S CONTENT#
#############################################################
######################################################################
############################cheese######################################
#################################################################################################
#Configuration Section
#
#$basedir
#The base directory onto which all user directories are appended.
#Example:
#Two typical users, jdoe and eodj have the following home directories(respectively)
#/root/users/jdoe
#/root/users/eodj
#$basedir would be:  $basedir='/root/users';
#
#If you're setting it up for your own personal use, set this to your home directory.  If you
#have a public_html directory, include public_html in $basedir
#
#No trailing slash!
#
#$baseurl
#The URL for the $basedir.  No trailing slash!
#
#
#
#@required
#Array containing a list of all of the fields that must be present in a form and which
#must be filled in by a person signing the guestbook in order for the entry to be
#added to the guestbook(required inputs from your form...<input type=text name="whatever">)
#################################################################################################
#This script supports running multiple messageboards using just this one script. Just change the hidden input on the form
#on the page bottom.htm to the relative location of the guestbook directory from your $basedir,
#e.g., if your base url is www.yoursite.com and your guestbook directory is www.yoursite.com/guestbook/
#then the hidden input should be set to 'guestbook'
#
#Also, before this program will work, it is necessary to chmod the program to world executable,
#and to chmod the messageboard directory to world writeable.
#
#the only files you need are this file, and the html files top.htm and bottom.htm. The program will automatically
#create all the other files it uses, including the message files and the log file

$basedir='/data/domains/mikegoode.com/public_html';
$baseurl='http://www.mikegoode.com';
@required=('realname','email');

$program = 'http://www.mikegoode.com/cgi-bin/messageboard.pl';
#the url location of this script

$max_messages = '50';
#the maximum number of messages to be included on each page of the message board

$log = 'logfile.txt';
#enter name of log file (ex: logfile.txt) if you want to have a log.
#If you do not want a log, leave as ''

$bottom2 = 'bottom2.htm';
#if you want to print something below the archived message links, put it in a file called bottom2.htm;
#if you dont, leave as ''


#You do not need to change anything below this point.

#################################################################################################
#Get Form Data
#################################################################################################

$query_string = $ENV{'QUERY_STRING'};
if($query_string){&print_page}
#prints messageboard if there is anything in the query string
#otherwise it runs the rest of the program, which parses form data
#and gets the info of new messageboard entries

$who = $ENV{'REMOTE_ADDR'};
$who2 = $ENV{'REMOTE_HOST'};
#find out IP Address and Remote Host of user who posts a message,
#to be encoded into the message as an html comment
#In later versions of this program, or if you need it, you can code it yourself, this will allow
#an administrator to automatically delete or refuse posts from a certain host or IP address
#Also, because each post is labeled with a post number, and seperated from each other with html comments
#it would be very simple to automatically delete posts containing certain text (such as poster names or phrases)
#or, it could allow for an admin program to allow a sysadmin to have a special admin page that will allow
#real-time deletion of posts, over the WWW


&get_form_data;
#gets and parses form data


foreach $rfield (@required)#Check if required fields are filled out. If not, quit.
{
	if($formdata{$rfield} eq "")
	{
		++$bad;
	}
}
if($bad != "0")#if one or more of the required fields isn't filled in
{
	print "Content-type: text/html\n\n";
	print "<html>\n<title>Error</title>\n";
	print "<body bgcolor=\"\#ececec\" text=\"\#000000\">\n\n";
	print "<p>At least one of the required fields was left blank or your email address was not accepted.\n";
	print "<p>The required inputs are:\n<p>\n";
	print "<ul>\n";
	foreach $rfield (@required)
	{
		print "<li><b>$rfield</b>\n";
	}
	print "<p>Please press your browser's \"Back\" button and try again.\n";
	print "</ul>\n<center><hr width=50%></center>\n</html>";
	exit;
}

#################################################################################################D
#This section takes the form data and adds it to the message file
#################################################################################################


$page=$formdata{'board_directory'}; #find out directory of messageboard
#if($page =~ /^([-\@\w.\/]+)$/){$page = $1}
#else{die "Content-type: text/html\n\n Improper input"}
$pagename="$page";
$page="$basedir/$page";
$textfile = "textfile.txt";
chdir("$page") || print "Content-type: text/html\n\n cannot chdir to $page"; #chdir to right directory


###open text file that has current mesage page and count or create new page
open(TEXTFILE, "<$textfile") ||  &newtextfile;
@b = <TEXTFILE>;
close(TEXTFILE);
chomp(@b);
$count = "$b[0]";
$current_msg_page_number = "$b[1]";
if($current_msg_page_number =~ /^([-\@\w.]+)$/){$current_msg_page_number = $1}
else{die "Content-type: text/html\n\n Improper input"}
$current_msg_page =  "$current_msg_page_number.htm";


open(PAGE, "<$current_msg_page") || open(PAGE, ">$current_msg_page") || print "Content-type: text/html\n\n Could not open or create $current_msg_page";
#this will either open the message html page or, if this is the first time running the program, automatically create it, or
#it will print out an error message
@contents=<PAGE>;  #get contents of messageboard
close(PAGE);

############################This next section puts the new message in the current message file
open(PAGE2, ">$current_msg_page");
print PAGE2 "<\!\-\-Begin Entry \-\-><\!\-\-Page=$current_msg_page_number \& Count=$count\-\->";
print PAGE2 "<br><p align=\"left\"><br><font size=\"4\"><b><font color=\"#800000\">$formdata{message}</font></b></font><br><br>";
print PAGE2 "$formdata{'comments'}<br><p>from:\&nbsp;<b><a href=\"mailto:$formdata{'email'}\">$formdata{'realname'}</a></b><br>";
&get_date;
$nicedate="$nicedate";
print PAGE2 "<font size=-2>$nicedate</font><hr>";
print PAGE2 "<\!\-\-POSTER IP=$who and POSTER HOST=$who2\-\->";
print PAGE2 "<\!\-\-End Entry (Page=$current_msg_page_number \& Count=$count)\-\->";
print PAGE2 "\n";

foreach $line (@contents)
{
	print PAGE2 "$line";
	
}
close(PAGE2);
############################################################
#######################################################
#updates $count, and, if necessary, $current_msg_page_number in $textfile ##
###############################################
++$count;
if($count == $max_messages)
{$current_msg_page_number++;
	$count = '1';
	$a = "$current_msg_page_number" . '.htm';
	open(A, ">$a") || print "Content-type: text/html\n\n couldna open $a<br><br><br>";
	#creates new page with new page number
	close(A);
	#if a certain number of messages on page (sysadmin defined), make a new page to put newer messages on
}

#prints new message count and page count to the $textfile
open(TEXTFILE, ">$textfile");
print TEXTFILE "$count\n";
print TEXTFILE "$current_msg_page_number";
close(TEXTFILE);

if($log){&log}
#if set to log stuff, runs the log subroutine

#########################################################
########################


#this prints out the 'thank you for posting a message' message
#and provides a link back to view the messageboard
print "Content-type: text/html\n\n";
print "<html>\n<title>Thank you</title>\n";
print "<body bgcolor=\"\#ececec\" text=\"\#000000\">\n\n";
print "Thank you for adding your comment.  In one second you will be returned to the messageboard. Or, you can click ";
print "<a href=\"$program?$pagename\">here</a> to see it.";
print "</body></html>";
exit;
#################################################################################################
#Subroutines
#################################################################################################

sub get_form_data {
	#this gets the form data and puts it into a nice looking hash
	#edited to allow better and more complex text formatting 2 june 2001 michael goode Mike@mikegoode.com
	$buffer = "";
	read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});
	@pairs=split(/&/,$buffer);
	foreach $pair (@pairs)
	{
		@a = split(/=/,$pair);
		$name=$a[0];
		$value=$a[1];
		$name =~ s/\+/ /g;
		
		
		#these all use the s/// replacement operator--if there is nothing between the last 2
		#slashes, then the said pattern is replaced with nothing.
		$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
		$value =~ s/~!/ ~!/g;
		$value =~ s/\+/ /g;
		#after here gets rid of stuff
		if($value=~/<SCRIPT/i){
			print "Content-type: text/html\n\n"; print "You have attempted to post a script. That is forbidden, and is marks you as being potentially malicious. Your IP has been logged";
			#(have person's IP and stuff logged to bad file, then notify admin)
			exit;
		}
		$value =~ s/<([^>])*>//g;
		$value =~ s/(\r|\n)+/<p>/g;  #carriage returns or newlines
		$value=~s/\function \{//gi;
			push (@formdata,$name);
			push (@formdata,$value);
		}
		%formdata=@formdata;
		%formdata;
		
	}
	
	sub get_date {
		#this gets the date and formats it nicely
		%days=('Sun','Sunday',
		'Mon','Monday',
		'Tue','Tuesday',
		'Wed','Wednesday',
		'Thu','Thursday',
		'Fri','Friday',
		'Sat','Saturday');
		
		%mos=('Jan','January',
		'Feb','February',
		'Mar','March',
		'Apr','April',
		'May','May',
		'Jun','June',
		'Jul','July',
		'Aug','August',
		'Sep','September',
		'Oct','October',
		'Nov','November',
		'Dec','December');
		$a = scalar localtime time;
		@a=split(/ /,$a);
		#############################################
		#@a looks like:
		#############################################
		#@a = ('wdy','mmm',' ','dd','HH:MM:SS','yy');
		# 0     1    2    3       4       5
		#############################################
		foreach $key (keys(%days))
		{
			if($a[0] eq $key)
			{
				$a[0]=$days{$key};
			}
		}
		foreach $key (keys(%mos))
		{
			if($a[1] eq $key)
			{
				$a[1]=$mos{$key};
			}
		}
		if($a[2] eq "")
		{
			$a[2] = $a[3];
			$not = 1;
		}
		if($a[2] eq "1" | $a[2] eq "21" | $a[2] eq "31")
		{
			$a[2]="$a[2]st";
		}
		elsif($a[2] eq "2" | $a[2] eq "22")
		{
			$a[2]="$a[2]nd";
		}
		elsif($a[2] eq "3" | $a[2] eq "23")
		{
			$a[2]="$a[2]rd";
		}
		else
		{
			$a[2]="$a[2]th";
		}
		if($not)
		{
			$nicedate="$a[0] $a[1] $a[2], $a[5] at $a[4]";
		}
		else
		{
			$nicedate="$a[0] $a[1] $a[2], $a[4] at $a[3]";
		}
		return $nicedate;
	}
	
	##sub print page -- prints out the messageboard contents
	
	sub print_page{
		@u = split(/&/, $query_string);
		$dir = shift(@u);
		 if($dir =~ /^([-\@\w.\/]+)$/){$dir = $1}
		 else{die "Content-type: text/html\n\n Improper input"}
		
		chdir("$basedir/$dir") || print "Content-type: text/html\n\n cannot chdir to $basedir/$dir";
		#splits query string and gets messageboard directory from it, and
		#gets the archived page number if it is in the query string
		$top = "top.htm";
		$bottom = "bottom.htm";
		$textfile = "textfile.txt";
		print "Content-type: text/html\n\n";
		
		#######################prints header of messageboard page
		open(TOP, "<$top") || print "Content-type: text/html\n\n Could not open $top";
		@contents=<TOP>;
		foreach $line (@contents) {print "$line\n";}
		close(TOP);
		#######################
		#######################
		#opens up the $textfile to get number of messages and current message page
		open(TEXTFILE, "<$textfile") || print "Could not open $textfile; This is message should appear if there are no messages. otherwise, there is a problem";
		@contents = <TEXTFILE>;
		chomp(@contents);
		$count = "$contents[0]";
		$current_msg_page = "$contents[1]" . '.htm';
		$current_msg_page_number = "$contents[1]";
		close(TEXTFILE);
		if($u[0])
		{
			$current_msg_page = "$u[0]" . '.htm';
			$current_msg_page_number = "$u[0]";
			$count = "$max_messages";
			#this loop gets info from @u for printing out archived pages
		}
		
		#################################
		#######prints out current messages##########
		#################################
		open(MESSAGES, "<$current_msg_page") || print "Content-type: text/html\n\n Could not open $current_msg_page";
		@contents = <MESSAGES>;
		foreach $line (@contents) {print "$line\n";}
		close(MESSAGES);
		
		##########prints older messages to make a total of $max_messages on page########
		if($current_msg_page_number>1)
		{
			$old = ("$current_msg_page_number" - '1') . '.htm';
			$old2 = "$current_msg_page_number" - '1';
			$e = "$max_messages" - "$count";
			open(OLDERMESSAGES, "<$old") || print "Could not open $old";
			
			@d = <OLDERMESSAGES>;
			close(OLDERMESSAGES);
			$d = join("", @d);
			@d = split(/<\!\-\-Begin Entry \-\->/, $d);
			
			while($e>=0)
			{$a = shift(@d);
				print "$a\n";
				$e--;
			}
		}
		##########################################
		
		##################################
		##################################
		###################prints footer of messageboard page#####
		open(BOTTOM, "<$bottom") || print "Content-type: text/html\n\n Could not open $bottom";
		@contents=<BOTTOM>;#get contents of Guestbook so you can add this entry to it.
		foreach $line (@contents) {print "$line\n";}
		print "<hr>";
		close(BOTTOM);
		#################
		
		###this prints out links to the archived pages of the messageboard
		if($current_msg_page_number > '1')
		{
			$count = "$current_msg_page_number" - 1;
			print "<p>View the archived messages, starting with the most recent ($max_messages messages per page):</p>\n";
			$count2 = '2';
			print "<table border=\"0\" width=\"100%\">";
			
			while($count >= 1)
			{
				
				if($count2 == '2') {print "<tr><td width=\"20%\"><a href=\"$program?$dir&$count\">Page $count</a></td>"}
				elsif($count2 == '6'){print "<td width=\"20%\"><a href=\"$program?$dir&$count\">Page $count</a></td></tr>"}
				else{print "<td width=\"20%\"><a href=\"$program?$dir&$count\">Page $count</a></td>"}
				$count2++;
				if($count2 == '7') {$count2 = '2'}
				--$count ;
				
				#the $count2 determines if the table row should end
				
			}
			print "</table>";
		}
		##################################
		###################prints 2nd footer of messageboard page#####
		open(BOTTOM2, "<$bottom2") || print "";
		@contents=<BOTTOM2>; #puts contents of $bottom2 into @contents
		foreach $line (@contents) {print "$line\n";}
		print "<hr>";
		close(BOTTOM2);
		#################
		
		
		
		print "</body></html>";
		
		exit;
	}
	
	
	sub log
	{
		#this prints info into the logfile
		#first, get all sorts of info, then print out in tab delimited text database
		$agent= $ENV{'HTTP_USER_AGENT'};
		open(LOG, ">>$log") || open(LOG, ">$log") || print "Content-type: text/html\n\n cannot open $log or create it";
	print LOG "PAGE NUMBER=$current_msg_page_number\tPOST NUMBER=$count\tREMOTE ADDRESS=$who\tREMOTE HOST=$who2\tHTTP USER AGENT=$agent\n";
	close(LOG);
}

sub newtextfile
{
	#creates a new $textfile if not already extent
	open(FILE, ">$textfile") || print "Content-type: text/html\n\n Could not open or create $textfile";
	print FILE "0\n1";
	close(FILE);
	open(TEXTFILE, "<$textfile");
}