stderr("Error", "Access denied.");
}
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if ($_POST["username"] == "" || $_POST["password"] == "" || $_POST["email"] == "") {
        stderr("Error", "Missing form data.");
    }
    if ($_POST["password"] != $_POST["password2"]) {
        stderr("Error", "Passwords mismatch.");
    }
    $email = htmlspecialchars(trim($_POST["email"]));
    $email = safe_email($email);
    if (!check_email($email)) {
        stderr("Error", "Invalid email address!");
    }
    $username = $_POST["username"];
    if (!validusername($username)) {
        stderr("Error", "Invalid username.");
    }
    $username = sqlesc($username);
    $res = sql_query("SELECT id FROM users WHERE username={$username}");
    $arr = mysql_fetch_row($res);
    if ($arr) {
        stderr("Error", "Username already exists!");
    }
    $password = $_POST["password"];
    $email = sqlesc($_POST["email"]);
    $res = sql_query("SELECT id FROM users WHERE email={$email}");
    $arr = mysql_fetch_row($res);
    if ($arr) {
        stderr("Error", "The e-mail address is already in use.");
    }

$ycharge['setall2up_half_down'] = 3500 * $discount;
//50%下载&2X上传
$ycharge['top'] = 4000 * $discount * 10;
//置顶
if (!$action) {
    print_r("<script type=\"text/javascript\" >alert(\"参数错误, 返回前一个页面\");window.history.back(-1);</script>");
    echo "参数错误";
}
$userid = $CURUSER['id'];
$userbouns = (int) $CURUSER['seedbonus'];
// changename
if ($action == "changename") {
    $charge = -1;
    $newname = htmlspecialchars($_POST['newname']);
    $oldname = $CURUSER['username'];
    if (utf8_strlen($newname) > 14 || utf8_strlen($newname) < 4 || !validusername($newname)) {
        echo "名字不符合要求";
        die;
    }
    if ($newname == $oldname) {
        echo "新旧用户名一样，无需更改";
        die;
    }
    if ($res = sql_query("SELECT namecharge from bonusapp where userid ='" . $userid . "'") or sqlerr(__FILE__, __LINE__)) {
        $row = mysql_fetch_array($res);
        $charge = $row['namecharge'];
    }
    if ($charge <= 0) {
        $charge = $changenamecharge;
        if (preg_match("/^[\\d][\\d]*[\\d]\$/", $oldname)) {
            $charge = $charge / 2;

if ($wantpassword != $passagain)
	bark("Lykilorð passa ekki saman! Eflaust gert innsláttarvillu. Reyndu aftur.");

if (strlen($wantpassword) < 6)
	bark("Lykilorð er of stutt (minnst má hafa 6 stafi)");

if (strlen($wantpassword) > 40)
	bark("Lykilorð er of langt (mest má hafa 40 stafi)");

if ($wantpassword == $wantusername)
	bark("Lykilorð má ekki vera sama og notandanafn.");

if (!validemail($email))
	bark("Þetta lítur út fyrir að vera ógilt netfang.");

if (!validusername($wantusername))
	bark("Ógilt notandanafn.");

// make sure user agrees to everything...
if ($HTTP_POST_VARS["rulesverify"] != "yes" || $HTTP_POST_VARS["faqverify"] != "yes" || $HTTP_POST_VARS["ageverify"] != "yes")
	stderr("Skráning mistókst", "Því miður þá verðuru að staðfesta að þú hafir lesið reglurnar, munir lesa SOS áður en þú spyrð spurninga og sért 13 ára eða eldri.");

// check if email addy is already in use
$a = (@mysql_fetch_row(@mysql_query("select count(*) from users where email='$email'"))) or die(mysql_error());
if ($a[0] != 0)
  bark("Netfangið $email er nú þegar skráð á listann hjá okkur.");

$invid = $_POST['invite'];
if(!$invid)
	bark("Nauðsynlegt að skrá inn boðslykilinn");
$verifystring = verifystring($invid,'md5');

//=== end of takesendmessage script
//=== basic page :D
$receiver = isset($_GET['receiver']) ? intval($_GET['receiver']) : (isset($_POST['receiver']) ? intval($_POST['receiver']) : 0);
$replyto = isset($_GET['replyto']) ? intval($_GET['replyto']) : (isset($_POST['replyto']) ? intval($_POST['replyto']) : 0);
$returnto = htmlsafechars(isset($_POST['returnto']) ? $_POST['returnto'] : '');
if ($receiver === 0) {
    stderr('Error', 'you can\'t PM Sys-Bot... It won\'t write you back!');
}
if (!is_valid_id($receiver)) {
    stderr('Error', 'No member with that ID!');
}
$res_member = sql_query('SELECT username FROM users WHERE id = ' . sqlesc($receiver)) or sqlerr(__FILE__, __LINE__);
$arr_member = mysqli_fetch_row($res_member);
//=== if reply
if ($replyto != 0) {
    if (!validusername($arr_member[0])) {
        stderr('Error', 'No member with that ID!');
    }
    //=== make sure they should be replying to this PM...
    $res_old_message = sql_query('SELECT receiver, sender, subject, msg FROM messages WHERE id = ' . sqlesc($replyto)) or sqlerr(__FILE__, __LINE__);
    $arr_old_message = mysqli_fetch_assoc($res_old_message);
    //print $arr_old_message['sender'];
    //exit();
    if ($arr_old_message['sender'] == $CURUSER['id']) {
        stderr('Error', 'Slander, whose edge is sharper than the sword, whose tongue out venoms all the worms of Nile');
    }
    $body .= "\n\n\n-------- {$arr_member['0']} wrote: --------\n{$arr_old_message['msg']}\n";
    $subject = 'Re: ' . htmlsafechars($arr_old_message['subject']);
}
//=== if preview or not replying
if ($_SERVER['REQUEST_METHOD'] == 'POST') {

dbconn();
maxcoder();
if (!logged_in()) {
    header("HTTP/1.0 404 Not Found");
    // moddifed logginorreturn by retro//Remember to change the following line to match your server
    print "<html><h1>Not Found</h1><p>The requested URL /{$_SERVER['PHP_SELF']} was not found on this server.</p><hr /><address>Apache/1.1.11 " . $SITENAME . " Server at " . $_SERVER['SERVER_NAME'] . " Port 80</address></body></html>\n";
    die;
}
if (get_user_class() < UC_ADMINISTRATOR) {
    stderr("Smartass!", "What the hell are you doing here?");
}
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if ($_POST["username"] == "" || $_POST["password"] == "" || $_POST["email"] == "" || $_POST["class"] == "" || $_POST["seedbonus"] == "" || $_POST["modcomment"] == "") {
        stderr("Error", "Missing form data.");
    }
    if (!validusername($_POST["username"])) {
        stderr("Error", "Invalid username.");
    }
    if ($_POST["password"] != $_POST["password2"]) {
        stderr("Error", "Passwords mismatch.");
    }
    if (!validemail($_POST['email'])) {
        stderr("Error", "Not valid email");
    }
    $class = 0 + $_POST["class"];
    $country = 0 + $_POST["country"];
    $seedbonus = 0 + $_POST["seedbonus"];
    $modcomment = $_POST["modcomment"];
    $username = $_POST["username"];
    $password = $_POST["password"];
    // //// email stuff \\\\\\\\

    if ($namelength < 3 or $namelength > 32) {
        $HTMLOUT = "";
        $HTMLOUT .= "<font color='#cc0000'>{$lang['takesignup_username_length']}</font>";
        print $HTMLOUT;
        exit;
    }
    // The following characters are allowed in user names
    $allowedchars = $lang['takesignup_allowed_chars'];
    for ($i = 0; $i < $namelength; ++$i) {
        if (strpos($allowedchars, $username[$i]) === false) {
            return false;
        }
    }
    return true;
}
if (!validusername($_GET["wantusername"])) {
    $HTMLOUT .= "<font color='#cc0000'>{$lang['takesignup_allowed_chars']}</font>";
    print $HTMLOUT;
    exit;
}
if (strlen($_GET["wantusername"]) > 12) {
    $HTMLOUT .= "<font color='#cc0000'>{$lang['takesignup_username_length']}</font>";
    print $HTMLOUT;
    exit;
}
$checkname = sqlesc($_GET["wantusername"]);
$sql = "SELECT username FROM users WHERE username = {$checkname}";
$result = sql_query($sql);
$numbers = mysql_num_rows($result);
if ($numbers > 0) {
    while ($namecheck = mysql_fetch_assoc($result)) {

    //=== if this member has blocked the sender
    $res2 = sql_query('SELECT id FROM blocks WHERE userid=' . sqlesc($to_username['id']) . ' AND blockid=' . sqlesc($CURUSER['id'])) or sqlerr(__FILE__, __LINE__);
    if (mysqli_num_rows($res2) === 1) {
        stderr('Refused', 'This member has blocked PMs from you.');
    }
    //=== finally if they only allow PMs from friends
    if ($to_username['acceptpms'] === 'friends') {
        $res2 = sql_query('SELECT * FROM friends WHERE userid=' . sqlesc($to_username['id']) . ' AND friendid=' . sqlesc($CURUSER['id'])) or sqlerr(__FILE__, __LINE__);
        if (mysqli_num_rows($res2) != 1) {
            stderr('Refused', 'This member only accepts PMs from members on their friends list.');
        }
    }
}
//=== ok... all is good... let's get the info and send it :D
$subject = htmlsafechars($_POST['subject']);
$first_from = validusername($_POST['first_from']) ? htmlsafechars($_POST['first_from']) : '';
$body = "\n\n" . $_POST['body'] . "\n\n-------- Original Message from [b]" . $first_from . "::[/b] \"" . htmlsafechars($message['subject']) . "\"  -------------------------------------\n" . $message['msg'] . "\n";
sql_query('INSERT INTO `messages` (`sender`, `receiver`, `added`, `subject`, `msg`, `unread`, `location`, `saved`, `poster`, `urgent`) 
                        VALUES (' . sqlesc($CURUSER['id']) . ', ' . sqlesc($to_username['id']) . ', ' . TIME_NOW . ', ' . sqlesc($subject) . ', ' . sqlesc($body) . ', \'yes\', 1, ' . sqlesc($save) . ', 0, ' . sqlesc($urgent) . ')') or sqlerr(__FILE__, __LINE__);
$mc1->delete_value('inbox_new_' . $to_username['id']);
$mc1->delete_value('inbox_new_sb_' . $to_username['id']);
//=== Check if message was forwarded
if (mysqli_affected_rows($GLOBALS["___mysqli_ston"]) === 0) {
    stderr('Error', 'Message couldn\'t be forwarded!');
}
//=== if they just have to know about it right away... send them an email (if selected if profile)
if (strpos($to_username['notifs'], '[pm]') !== false) {
    $username = htmlsafechars($CURUSER['username']);
    $body = <<<EOD
You have received a PM from {$username}!

    $draft = $message['msg'];
}
//=== print out the page
//echo stdhead('Use Draft');
$HTMLOUT .= '<h1>Use Draft: ' . $subject . '</h1>' . $top_links . $preview . '
        <form name="compose" action="pm_system.php" method="post">
        <input type="hidden" name="id" value="' . $pm_id . '" />
        <input type="hidden" name="' . $save_or_edit . '" value="1" />
        <input type="hidden" name="action" value="use_draft" />
    <table border="0" cellspacing="0" cellpadding="5" align="center" style="max-width:800px">
    <tr>
        <td class="colhead" align="left" colspan="2">use draft</td>
    </tr>
    <tr>
        <td align="right" class="one" valign="top"><span style="font-weight: bold;">To:</span></td>
        <td align="left" class="one" valign="top"><input type="text" name="to" value="' . (isset($_POST['to']) && validusername($_POST['to'], FALSE) ? htmlsafechars($_POST['to']) : 'Enter Username') . '" class="member" onfocus="this.value=\'\';" />
         [ enter the username of the member you would like to send this to ]</td>
    </tr>
    <tr>
        <td class="one" valign="top" align="right"><span style="font-weight: bold;">Subject:</span></td>
        <td class="one" valign="top" align="left"><input type="text" class="text_default" name="subject" value="' . $subject . '" /></td>
    </tr>
    <tr>
        <td class="one" valign="top" align="right"><span style="font-weight: bold;">Body:</span></td>
        <td class="one" valign="top" align="left">' . BBcode($draft, FALSE) . '</td>
    </tr>
    <tr>
        <td colspan="2" align="center" class="one">' . ($CURUSER['class'] >= UC_STAFF ? '
        <input type="checkbox" name="urgent" value="yes" ' . (isset($_POST['urgent']) && $_POST['urgent'] === 'yes' ? ' checked="checked"' : '') . ' /> 
        <span style="font-weight: bold;color:red;">Mark as URGENT!</span>' : '') . '
        <input type="submit" class="button" name="buttonval" value="preview" onmouseover="this.className=\'button_hover\'" onmouseout="this.className=\'button\'" />

     }
     //=== redirect back with messages :P
     header('Location: pm_system.php?action=edit_mailboxes' . $worked);
     die;
     break;
     //=== edit boxes
 //=== edit boxes
 case 'edit_boxes':
     //=== get info
     $res = sql_query('SELECT * FROM pmboxes WHERE userid=' . sqlesc($CURUSER['id'])) or sqlerr(__FILE__, __LINE__);
     if (mysqli_num_rows($res) === 0) {
         stderr($lang['pm_error'], $lang['pm_edmail_err1']);
     }
     while ($row = mysqli_fetch_assoc($res)) {
         //=== if name different AND safe, update it
         if (validusername($_POST['edit' . $row['id']]) && $_POST['edit' . $row['id']] !== '' && $_POST['edit' . $row['id']] !== $row['name']) {
             $name = htmlsafechars($_POST['edit' . $row['id']]);
             sql_query('UPDATE pmboxes SET name=' . sqlesc($name) . ' WHERE id=' . sqlesc($row['id']) . ' LIMIT 1') or sqlerr(__FILE__, __LINE__);
             $mc1->delete_value('get_all_boxes' . $CURUSER['id']);
             $mc1->delete_value('insertJumpTo' . $CURUSER['id']);
             $worked = '&name=1';
         }
         //=== if name is empty, delete the box(es) and send the PMs back to the inbox..
         if ($_POST['edit' . $row['id']] == '') {
             //=== get messages to move
             $remove_messages_res = sql_query('SELECT id FROM messages WHERE location=' . sqlesc($row['boxnumber']) . '  AND receiver=' . sqlesc($CURUSER['id'])) or sqlerr(__FILE__, __LINE__);
             //== move the messages to the inbox
             while ($remove_messages_arr = mysqli_fetch_assoc($remove_messages_res)) {
                 sql_query('UPDATE messages SET location=1 WHERE id=' . sqlesc($remove_messages_arr['id'])) or sqlerr(__FILE__, __LINE__);
             }
             //== delete the box

    $draft = $message['msg'];
}
//=== print out the page
//echo stdhead('Use Draft');
$HTMLOUT .= '<h1>' . $lang['pm_usedraft'] . '' . $subject . '</h1>' . $top_links . $preview . '
        <form name="compose" action="pm_system.php" method="post">
        <input type="hidden" name="id" value="' . $pm_id . '" />
        <input type="hidden" name="' . $save_or_edit . '" value="1" />
        <input type="hidden" name="action" value="use_draft" />
    33333333<table class="table table-striped">
    <tr>
        <td class="colhead" align="left" colspan="2">' . $lang['pm_usedraft1'] . '</td>
    </tr>
    <tr>
        <td class="text-right" valign="top"><span style="font-weight: bold;">' . $lang['pm_forward_to'] . '</span></td>
        <td class="text-left" valign="top"><input type="text" name="to" value="' . (isset($_POST['to']) && validusername($_POST['to'], false) ? htmlsafechars($_POST['to']) : $lang['pm_forward_user']) . '" class="member" onfocus="this.value=\'\';" />
         ' . $lang['pm_usedraft_usr'] . '</td>
    </tr>
    <tr>
        <td class="text-right" valign="top"><span style="font-weight: bold;">' . $lang['pm_send_subject'] . '</span></td>
        <td class="text-left" valign="top"><input type="text" class="text_default" name="subject" value="' . $subject . '" /></td>
    </tr>
    <tr>
        <td class="text-right" valign="top"><span style="font-weight: bold;">' . $lang['pm_send_body'] . '</span></td>
        <td class="text-left" valign="top">' . textbbcode('use_draft', 'body', $message['msg']) . '</td>
    </tr>
    <tr>
        <td colspan="2" class="text-center">' . ($CURUSER['class'] >= UC_STAFF ? '
        <input type="checkbox" name="urgent" value="yes" ' . (isset($_POST['urgent']) && $_POST['urgent'] === 'yes' ? ' checked="checked"' : '') . ' />
        <span style="font-weight: bold;color:red;">' . $lang['pm_send_mark'] . '</span>' : '') . '
        <input type="submit" class="button" name="buttonval" value="preview" onmouseover="this.className=\'button_hover\'" onmouseout="this.className=\'button\'" />