/**
 * Redirects users to ?event=jmd_dashboard upon login (unless they were
 * loading another event).
 */
function jmd_dashboard_login()
{
    global $siteurl;
    if (gps('p_password') && !gps('event')) {
        txp_status_header("302 Found");
        header("Location: http://{$siteurl}/textpattern/?event=jmd_dashboard");
        exit;
    }
}

function rss()
{
    global $prefs, $thisarticle;
    extract($prefs);
    extract(doSlash(gpsa(array('category', 'section', 'limit', 'area'))));
    $area = gps('area');
    $sitename .= $section ? ' - ' . $section : '';
    $sitename .= $category ? ' - ' . $category : '';
    $out[] = tag(doSpecial($sitename), 'title');
    $out[] = tag(hu, 'link');
    $out[] = tag(doSpecial($site_slogan), 'description');
    $articles = array();
    if (!$area or $area == 'article') {
        $sfilter = $section ? "and Section = '" . $section . "'" : '';
        $cfilter = $category ? "and (Category1='" . $category . "' or Category2='" . $category . "')" : '';
        $limit = $limit ? $limit : $rss_how_many;
        $limit = min($limit, max(100, $rss_how_many));
        $frs = safe_column("name", "txp_section", "in_rss != '1'");
        if ($frs) {
            foreach ($frs as $f) {
                $query[] = "and Section != '" . doSlash($f) . "'";
            }
        }
        $query[] = $sfilter;
        $query[] = $cfilter;
        $rs = safe_rows_start("*, unix_timestamp(Posted) as uPosted, ID as thisid", "textpattern", "Status = 4 " . join(' ', $query) . "and Posted < now() order by Posted desc limit {$limit}");
        if ($rs) {
            while ($a = nextRow($rs)) {
                extract($a);
                populateArticleData($a);
                $a['posted'] = $uPosted;
                $Body = !$syndicate_body_or_excerpt ? $thisarticle['body'] : $thisarticle['excerpt'];
                $Body = !trim($Body) ? $thisarticle['body'] : $Body;
                $Body = str_replace('href="/', 'href="' . hu, $Body);
                $Body = preg_replace("/href=\\\"#(.*)\"/", "href=\"" . permlinkurl($a) . "#\\1\"", $Body);
                $Body = rss_safe_hed($Body);
                $Body = preg_replace(array('/</', '/>/', "/'/", '/"/'), array('&lt;', '&gt;', '&#039;', '&quot;'), $Body);
                // encode bare ampersands
                $Body = preg_replace("/&(?![#0-9]+;|\\w+;)/i", '&amp;', $Body);
                $uTitle = $url_title ? $url_title : stripSpace($Title);
                $uTitle = htmlspecialchars($uTitle, ENT_NOQUOTES);
                if ($show_comment_count_in_feed) {
                    $count = $comments_count > 0 ? ' [' . $comments_count . ']' : '';
                } else {
                    $count = '';
                }
                $Title = doSpecial($Title) . $count;
                $permlink = permlinkurl($a);
                $item = tag(strip_tags($Title), 'title') . n . tag($Body, 'description') . n . tag($permlink, 'link');
                $articles[$ID] = tag($item, 'item');
                $etags[$ID] = strtoupper(dechex(crc32($articles[$ID])));
                $dates[$ID] = $uPosted;
            }
        }
    } elseif ($area == 'link') {
        $cfilter = $category ? "category='{$category}'" : '1';
        $limit = $limit ? $limit : $rss_how_many;
        $limit = min($limit, max(100, $rss_how_many));
        $rs = safe_rows_start("*", "txp_link", "{$cfilter} order by date desc limit {$limit}");
        if ($rs) {
            while ($a = nextRow($rs)) {
                extract($a);
                $item = tag(doSpecial($linkname), 'title') . n . tag(doSpecial($description), 'description') . n . tag(doSpecial($url), 'link');
                $articles[$id] = tag($item, 'item');
                $etags[$id] = strtoupper(dechex(crc32($articles[$id])));
                $dates[$id] = $date;
            }
        }
    }
    //turn on compression if we aren't using it already
    if (extension_loaded('zlib') && ini_get("zlib.output_compression") == 0 && ini_get('output_handler') != 'ob_gzhandler' && !headers_sent()) {
        @ob_start("ob_gzhandler");
    }
    $last = fetch('unix_timestamp(val)', 'txp_prefs', 'name', 'lastmod');
    $expires = gmdate('D, d M Y H:i:s \\G\\M\\T', time() + 3600 * 1);
    header("Expires: {$expires}");
    $hims = serverset('HTTP_IF_MODIFIED_SINCE');
    $imsd = $hims ? strtotime($hims) : 0;
    if ($imsd >= $last) {
        txp_status_header("304 Not Modified");
        exit;
    }
    header("Last-Modified: " . gmdate('D, d M Y H:i:s \\G\\M\\T', $last));
    if (is_callable('apache_request_headers')) {
        $headers = apache_request_headers();
        if (isset($headers["A-IM"])) {
            $canaim = strpos($headers["A-IM"], "feed");
        } else {
            $canaim = false;
        }
    } else {
        $canaim = false;
    }
    $hinm = stripslashes(serverset('HTTP_IF_NONE_MATCH'));
    $cutarticles = false;
    if ($canaim !== false) {
        foreach ($articles as $id => $thing) {
            if (strpos($hinm, $etags[$id]) !== false) {
                unset($articles[$id]);
                $cutarticles = true;
//.........这里部分代码省略.........

//.........这里部分代码省略.........
                if (trim($summary)) {
                    $e['summary'] = tag(n . escape_cdata($summary) . n, 'summary', t_html);
                }
                $articles[$ID] = tag(n . t . t . join(n . t . t, $e) . n . $cb, 'entry');
                $etags[$ID] = strtoupper(dechex(crc32($articles[$ID])));
                $dates[$ID] = $uLastMod;
            }
        }
    } elseif ($area == 'link') {
        $cfilter = $category ? "category='" . $category . "'" : '1';
        $limit = $limit ? $limit : $rss_how_many;
        $limit = intval(min($limit, max(100, $rss_how_many)));
        $rs = safe_rows_start("*", "txp_link", "{$cfilter} order by date desc, id desc limit {$limit}");
        if ($rs) {
            while ($a = nextRow($rs)) {
                extract($a);
                $e['title'] = tag(htmlspecialchars($linkname), 'title', t_html);
                $e['content'] = tag(n . htmlspecialchars($description) . n, 'content', t_html);
                $url = preg_replace("/^\\/(.*)/", "https?://{$siteurl}/\$1", $url);
                $url = preg_replace("/&((?U).*)=/", "&\\1=", $url);
                $e['link'] = '<link' . r_relalt . t_texthtml . ' href="' . $url . '" />';
                $e['issued'] = tag(safe_strftime('w3cdtf', strtotime($date)), 'published');
                $e['modified'] = tag(gmdate('Y-m-d\\TH:i:s\\Z', strtotime($date)), 'updated');
                $e['id'] = tag('tag:' . $mail_or_domain . ',' . $feed_time . ':' . $id, 'id');
                $articles[$id] = tag(n . t . t . join(n . t . t, $e) . n, 'entry');
                $etags[$id] = strtoupper(dechex(crc32($articles[$id])));
                $dates[$id] = $date;
            }
        }
    }
    if (!empty($articles)) {
        //turn on compression if we aren't using it already
        if (extension_loaded('zlib') && ini_get("zlib.output_compression") == 0 && ini_get('output_handler') != 'ob_gzhandler' && !headers_sent()) {
            @ob_start("ob_gzhandler");
        }
        handle_lastmod();
        $hims = serverset('HTTP_IF_MODIFIED_SINCE');
        $imsd = $hims ? strtotime($hims) : 0;
        if ($imsd >= $last) {
            txp_status_header("304 Not Modified");
            exit;
        }
        header("Last-Modified: " . gmdate('D, d M Y H:i:s \\G\\M\\T', $last));
        if (is_callable('apache_request_headers')) {
            $headers = apache_request_headers();
            if (isset($headers["A-IM"])) {
                $canaim = strpos($headers["A-IM"], "feed");
            } else {
                $canaim = false;
            }
        } else {
            $canaim = false;
        }
        $hinm = stripslashes(serverset('HTTP_IF_NONE_MATCH'));
        $cutarticles = false;
        if ($canaim !== false) {
            foreach ($articles as $id => $thing) {
                if (strpos($hinm, $etags[$id])) {
                    unset($articles[$id]);
                    $cutarticles = true;
                    $cut_etag = true;
                }
                if ($dates[$id] < $imsd) {
                    unset($articles[$id]);
                    $cutarticles = true;
                    $cut_time = true;
                }
            }
        }
        if (isset($cut_etag) && isset($cut_time)) {
            header("Vary: If-None-Match, If-Modified-Since");
        } else {
            if (isset($cut_etag)) {
                header("Vary: If-None-Match");
            } else {
                if (isset($cut_time)) {
                    header("Vary: If-Modified-Since");
                }
            }
        }
        $etag = @join("-", $etags);
        if (strstr($hinm, $etag)) {
            header("HTTP/1.1 304 Not Modified");
            exit;
        }
        if ($etag) {
            header('ETag: "' . $etag . '"');
        }
        if ($cutarticles) {
            //header("HTTP/1.1 226 IM Used");
            //This should be used as opposed to 200, but Apache doesn't like it.
            //http://intertwingly.net/blog/2004/09/11/Vary-ETag/ says that the status code should be 200.
            header("Cache-Control: no-store, im");
            header("IM: feed");
        }
        $out = array_merge($out, $articles);
        header('Content-type: application/atom+xml; charset=utf-8');
        return chr(60) . '?xml version="1.0" encoding="UTF-8"?' . chr(62) . n . '<feed xml:lang="' . $language . '" xmlns="http://www.w3.org/2005/Atom">' . join(n, $out) . '</feed>';
    }
}

//.........这里部分代码省略.........
                extract($a);
                $item = tag(doSpecial($linkname), 'title') . n . tag(doSpecial($description), 'description') . n . tag(doSpecial($url), 'link') . n . tag(safe_strftime('rfc822', $uDate), 'pubDate');
                $articles[$id] = tag($item, 'item');
                $etags[$id] = strtoupper(dechex(crc32($articles[$id])));
                $dates[$id] = $date;
            }
        }
    }
    if (!$articles) {
        if ($section) {
            if (safe_field('name', 'txp_section', "name in ('" . join("','", $section) . "')") == false) {
                txp_die(gTxt('404_not_found'), '404');
            }
        } elseif ($category) {
            switch ($area) {
                case 'link':
                    if (safe_field('id', 'txp_category', "name = '{$category}' and type = 'link'") == false) {
                        txp_die(gTxt('404_not_found'), '404');
                    }
                    break;
                case 'article':
                default:
                    if (safe_field('id', 'txp_category', "name in ('" . join("','", $category) . "') and type = 'article'") == false) {
                        txp_die(gTxt('404_not_found'), '404');
                    }
                    break;
            }
        }
    } else {
        //turn on compression if we aren't using it already
        if (extension_loaded('zlib') && ini_get("zlib.output_compression") == 0 && ini_get('output_handler') != 'ob_gzhandler' && !headers_sent()) {
            // make sure notices/warnings/errors don't fudge up the feed
            // when compression is used
            $buf = '';
            while ($b = @ob_get_clean()) {
                $buf .= $b;
            }
            @ob_start('ob_gzhandler');
            echo $buf;
        }
        handle_lastmod();
        $hims = serverset('HTTP_IF_MODIFIED_SINCE');
        $imsd = $hims ? strtotime($hims) : 0;
        if (is_callable('apache_request_headers')) {
            $headers = apache_request_headers();
            if (isset($headers["A-IM"])) {
                $canaim = strpos($headers["A-IM"], "feed");
            } else {
                $canaim = false;
            }
        } else {
            $canaim = false;
        }
        $hinm = stripslashes(serverset('HTTP_IF_NONE_MATCH'));
        $cutarticles = false;
        if ($canaim !== false) {
            foreach ($articles as $id => $thing) {
                if (strpos($hinm, $etags[$id]) !== false) {
                    unset($articles[$id]);
                    $cutarticles = true;
                    $cut_etag = true;
                }
                if ($dates[$id] < $imsd) {
                    unset($articles[$id]);
                    $cutarticles = true;
                    $cut_time = true;
                }
            }
        }
        if (isset($cut_etag) && isset($cut_time)) {
            header("Vary: If-None-Match, If-Modified-Since");
        } else {
            if (isset($cut_etag)) {
                header("Vary: If-None-Match");
            } else {
                if (isset($cut_time)) {
                    header("Vary: If-Modified-Since");
                }
            }
        }
        $etag = @join("-", $etags);
        if (strstr($hinm, $etag)) {
            txp_status_header('304 Not Modified');
            exit(0);
        }
        if ($cutarticles) {
            //header("HTTP/1.1 226 IM Used");
            //This should be used as opposed to 200, but Apache doesn't like it.
            //http://intertwingly.net/blog/2004/09/11/Vary-ETag/ says that the status code should be 200.
            header("Cache-Control: no-store, im");
            header("IM: feed");
        }
    }
    $out = array_merge($out, $articles);
    header("Content-Type: application/rss+xml; charset=utf-8");
    if (isset($etag)) {
        header('ETag: "' . $etag . '"');
    }
    return '<?xml version="1.0" encoding="utf-8"?>' . n . '<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom">' . n . tag(join(n, $out), 'channel') . n . '</rss>';
}

/**
 * Send a text/javascript response
 *
 * @param string $out
 * @since 4.4
 */
function send_script_response($out = '')
{
    static $headers_sent = false;
    if (!$headers_sent) {
        ob_clean();
        header('Content-Type: text/javascript; charset=utf-8');
        txp_status_header('200 OK');
        $headers_sent = true;
    }
    echo ";\n" . $out . ";\n";
}

//.........这里部分代码省略.........
            $time = " AND Posted <= " . now('posted');
    }
    if (!$expired) {
        $time .= " AND (" . now('expires') . " <= Expires OR Expires = " . NULLDATETIME . ")";
    }
    $custom = '';
    if ($customFields) {
        foreach ($customFields as $cField) {
            if (isset($atts[$cField])) {
                $customPairs[$cField] = $atts[$cField];
            }
        }
        if (!empty($customPairs)) {
            $custom = buildCustomSql($customFields, $customPairs);
        }
    }
    // Allow keywords for no-custom articles. That tagging mode, you know.
    if ($keywords) {
        $keys = doSlash(do_list_unique($keywords));
        foreach ($keys as $key) {
            $keyparts[] = "FIND_IN_SET('" . $key . "', Keywords)";
        }
        $keywords = " AND (" . join(' or ', $keyparts) . ")";
    }
    if ($q and $searchsticky) {
        $statusq = " AND Status >= " . STATUS_LIVE;
    } elseif ($id) {
        $statusq = " AND Status >= " . STATUS_LIVE;
    } else {
        $statusq = " AND Status = " . intval($status);
    }
    $where = "1 = 1" . $statusq . $time . $search . $id . $category . $section . $excerpted . $month . $author . $keywords . $custom . $frontpage;
    // Do not paginate if we are on a custom list.
    if (!$iscustom and !$issticky) {
        $grand_total = safe_count('textpattern', $where);
        $total = $grand_total - $offset;
        $numPages = ceil($total / $pageby);
        $pg = !$pg ? 1 : $pg;
        $pgoffset = $offset + ($pg - 1) * $pageby;
        // Send paging info to txp:newer and txp:older.
        $pageout['pg'] = $pg;
        $pageout['numPages'] = $numPages;
        $pageout['s'] = $s;
        $pageout['c'] = $c;
        $pageout['context'] = 'article';
        $pageout['grand_total'] = $grand_total;
        $pageout['total'] = $total;
        global $thispage;
        if (empty($thispage)) {
            $thispage = $pageout;
        }
        if ($pgonly) {
            return;
        }
    } else {
        $pgoffset = $offset;
    }
    // Preserve order of custom article ids unless 'sort' attribute is set.
    if (!empty($atts['id']) && empty($atts['sort'])) {
        $safe_sort = "FIELD(id, " . join(',', $ids) . ")";
    } else {
        $safe_sort = doSlash($sort);
    }
    $rs = safe_rows_start("*, UNIX_TIMESTAMP(Posted) AS uPosted, UNIX_TIMESTAMP(Expires) AS uExpires, UNIX_TIMESTAMP(LastMod) AS uLastMod" . $match, 'textpattern', "{$where} ORDER BY {$safe_sort} LIMIT " . intval($pgoffset) . ", " . intval($limit));
    // Get the form name.
    if ($q and !$iscustom and !$issticky) {
        $fname = $searchform ? $searchform : 'search_results';
    } else {
        $fname = !empty($listform) ? $listform : $form;
    }
    if ($rs) {
        $count = 0;
        $last = numRows($rs);
        $articles = array();
        while ($a = nextRow($rs)) {
            ++$count;
            populateArticleData($a);
            global $thisarticle, $uPosted, $limit;
            $thisarticle['is_first'] = $count == 1;
            $thisarticle['is_last'] = $count == $last;
            // Article form preview.
            if (txpinterface === 'admin' && ps('Form')) {
                doAuth();
                if (!has_privs('form')) {
                    txp_status_header('401 Unauthorized');
                    exit(hed('401 Unauthorized', 1) . graf(gTxt('restricted_area')));
                }
                $articles[] = parse(gps('Form'));
            } elseif ($allowoverride and $a['override_form']) {
                $articles[] = parse_form($a['override_form']);
            } else {
                $articles[] = $thing ? parse($thing) : parse_form($fname);
            }
            // Sending these to paging_link(); Required?
            $uPosted = $a['uPosted'];
            unset($GLOBALS['thisarticle']);
        }
        return doLabel($label, $labeltag) . doWrap($articles, $wraptag, $break, $class);
    }
}

function textpattern()
{
    global $pretext, $microstart, $prefs, $qcount, $qtime, $production_status, $txptrace, $siteurl, $has_article_tag;
    $has_article_tag = false;
    callback_event('textpattern');
    if ($pretext['status'] == '404') {
        txp_die(gTxt('404_not_found'), '404');
    }
    if ($pretext['status'] == '410') {
        txp_die(gTxt('410_gone'), '410');
    }
    $html = safe_field('user_html', 'txp_page', "name='" . doSlash($pretext['page']) . "'");
    if (!$html) {
        txp_die(gTxt('unknown_section'), '404');
    }
    // useful for clean urls with error-handlers
    txp_status_header('200 OK');
    trace_add('[' . gTxt('page') . ': ' . $pretext['page'] . ']');
    set_error_handler("tagErrorHandler");
    $pretext['secondpass'] = false;
    $html = parse($html);
    $pretext['secondpass'] = true;
    trace_add('[ ~~~ ' . gTxt('secondpass') . ' ~~~ ]');
    $html = parse($html);
    // the function so nice, he ran it twice
    if ($prefs['allow_page_php_scripting']) {
        $html = evalString($html);
    }
    // make sure the page has an article tag if necessary
    if (!$has_article_tag and $production_status != 'live' and (!empty($pretext['id']) or !empty($pretext['c']) or !empty($pretext['q']) or !empty($pretext['pg']))) {
        trigger_error(gTxt('missing_article_tag', array('{page}' => $pretext['page'])));
    }
    restore_error_handler();
    header("Content-type: text/html; charset=utf-8");
    echo $html;
    if (in_array($production_status, array('debug', 'testing'))) {
        $microdiff = getmicrotime() - $microstart;
        echo n, comment('Runtime:    ' . substr($microdiff, 0, 6));
        echo n, comment('Query time: ' . sprintf('%02.6f', $qtime));
        echo n, comment('Queries: ' . $qcount);
        echo maxMemUsage('end of textpattern()', 1);
        if (!empty($txptrace) and is_array($txptrace)) {
            echo n, comment('txp tag trace: ' . n . str_replace('--', '­­', join(n, $txptrace)) . n);
        }
        // '­­' is *no* tribute to Kajagoogoo, but an attempt to avoid prematurely terminating HTML comments
    }
    callback_event('textpattern_end');
}

function db_down()
{
    // 503 status might discourage search engines from indexing or caching the error message
    txp_status_header('503 Service Unavailable');
    $error = mysql_error();
    return <<<eod
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
\t<meta http-equiv="content-type" content="text/html; charset=utf-8" />
\t<title>Untitled</title>
</head>
<body>
<p align="center" style="margin-top:4em">Database unavailable.</p>
<!-- {$error} -->
</body>
</html>
eod;
}

/**
 * Validates the sent login form and creates a session.
 *
 * During the reset request procedure, it is conceivable to verify the
 * token as soon as it's presented in the URL, but that would:
 *  a) require refactoring code similarities in both p_confirm and p_alter branches
 *  b) require some way (e.g. an Exception) to signal back to doLoginForm() that
 *     the token is bogus so the 'change your password' form is not displayed.
 *  c) leak information about the validity of a token, thus allowing rapid brute-force
 *     attempts.
 *
 * The inconvenience of a real user following an expired token and being told so
 * after they've set a password is a small price to pay for the improved security
 * and reduction of attack surface that validating after submission affords.
 *
 * @todo  Could the checks be done via a (reusable) Validator()?
 *
 * @return string A localised feedback message
 * @see    doLoginForm()
 */
function doTxpValidate()
{
    global $logout, $txp_user;
    $p_userid = ps('p_userid');
    $p_password = ps('p_password');
    $p_reset = ps('p_reset');
    $p_alter = ps('p_alter');
    $p_set = ps('p_set');
    $stay = ps('stay');
    $p_confirm = gps('confirm');
    $logout = gps('logout');
    $message = '';
    $pub_path = preg_replace('|//$|', '/', rhu . '/');
    if (cs('txp_login') && strpos(cs('txp_login'), ',')) {
        $txp_login = explode(',', cs('txp_login'));
        $c_hash = end($txp_login);
        $c_userid = join(',', array_slice($txp_login, 0, -1));
    } else {
        $c_hash = '';
        $c_userid = '';
    }
    if ($logout) {
        setcookie('txp_login', '', time() - 3600);
        setcookie('txp_login_public', '', time() - 3600, $pub_path);
    }
    if ($c_userid && strlen($c_hash) === 32) {
        // Cookie exists.
        // @todo Improve security by using a better nonce/salt mechanism. md5 and uniqid are bad.
        $r = safe_row("name, nonce", 'txp_users', "name = '" . doSlash($c_userid) . "' AND last_access > DATE_SUB(NOW(), INTERVAL 30 DAY)");
        if ($r && $r['nonce'] && $r['nonce'] === md5($c_userid . pack('H*', $c_hash))) {
            // Cookie is good.
            if ($logout) {
                // Destroy nonce.
                safe_update('txp_users', "nonce = '" . doSlash(md5(uniqid(mt_rand(), true))) . "'", "name = '" . doSlash($c_userid) . "'");
            } else {
                // Create $txp_user.
                $txp_user = $r['name'];
            }
            return $message;
        } else {
            txp_status_header('401 Your session has expired');
            setcookie('txp_login', $c_userid, time() + 3600 * 24 * 365);
            setcookie('txp_login_public', '', time() - 3600, $pub_path);
            $message = array(gTxt('bad_cookie'), E_ERROR);
        }
    } elseif ($p_userid && $p_password) {
        // Incoming login vars.
        $name = txp_validate($p_userid, $p_password);
        if ($name !== false) {
            $c_hash = md5(uniqid(mt_rand(), true));
            $nonce = md5($name . pack('H*', $c_hash));
            safe_update('txp_users', "nonce = '" . doSlash($nonce) . "'", "name = '" . doSlash($name) . "'");
            setcookie('txp_login', $name . ',' . $c_hash, $stay ? time() + 3600 * 24 * 365 : 0, null, null, null, LOGIN_COOKIE_HTTP_ONLY);
            setcookie('txp_login_public', substr(md5($nonce), -10) . $name, $stay ? time() + 3600 * 24 * 30 : 0, $pub_path);
            // Login is good, create $txp_user.
            $txp_user = $name;
            return '';
        } else {
            sleep(3);
            txp_status_header('401 Could not log in with that username/password');
            $message = array(gTxt('could_not_log_in'), E_ERROR);
        }
    } elseif ($p_reset) {
        // Reset request.
        sleep(3);
        include_once txpath . '/lib/txplib_admin.php';
        $message = $p_userid ? send_reset_confirmation_request($p_userid) : '';
    } elseif ($p_alter || $p_set) {
        // Password change/set confirmation.
        sleep(3);
        global $sitename;
        $pass = ps('p_password');
        $type = $p_alter ? 'password_reset' : 'account_activation';
        if (trim($pass) === '') {
            $message = array(gTxt('password_required'), E_ERROR);
        } else {
            $hash = gps('hash');
            $selector = substr($hash, SALT_LENGTH);
            $tokenInfo = safe_row("reference_id, token, expires", 'txp_token', "selector = '" . doSlash($selector) . "' AND type='{$type}'");
            if ($tokenInfo) {
//.........这里部分代码省略.........

/**
 * Returns an error page.
 *
 * This function is used to return a bailout page when resolving database connections fails.
 * Sends a HTTP 503 error status and displays the last logged MySQL error message.
 *
 * @return string HTML5 document
 * @access private
 */
function db_down()
{
    // 503 status might discourage search engines from indexing or caching the error message.
    txp_status_header('503 Service Unavailable');
    $error = mysql_error();
    return <<<eod
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <title>Database unavailable</title>
</head>
<body>
    <p>Database unavailable.</p>
    <!-- {$error} -->
</body>
</html>
eod;
}

//.........这里部分代码省略.........
                $dates[$id] = $date;
            }
        }
    }
    if (!$articles) {
        if ($section) {
            if (safe_field('name', 'txp_section', "name = '{$section}'") == false) {
                txp_die(gTxt('404_not_found'), '404');
            }
        } elseif ($category) {
            switch ($area) {
                case 'link':
                    if (safe_field('id', 'txp_category', "name = '{$category}' and type = 'link'") == false) {
                        txp_die(gTxt('404_not_found'), '404');
                    }
                    break;
                case 'article':
                default:
                    if (safe_field('id', 'txp_category', "name = '{$category}' and type = 'article'") == false) {
                        txp_die(gTxt('404_not_found'), '404');
                    }
                    break;
            }
        }
    } else {
        //turn on compression if we aren't using it already
        if (extension_loaded('zlib') && ini_get("zlib.output_compression") == 0 && ini_get('output_handler') != 'ob_gzhandler' && !headers_sent()) {
            // make sure notices/warnings/errors don't
            // fudge up the feed when compression is used
            $buf = '';
            while ($b = @ob_get_clean()) {
                $buf .= $b;
            }
            @ob_start('ob_gzhandler');
            echo $buf;
        }
        handle_lastmod();
        $hims = serverset('HTTP_IF_MODIFIED_SINCE');
        $imsd = $hims ? strtotime($hims) : 0;
        if (is_callable('apache_request_headers')) {
            $headers = apache_request_headers();
            if (isset($headers["A-IM"])) {
                $canaim = strpos($headers["A-IM"], "feed");
            } else {
                $canaim = false;
            }
        } else {
            $canaim = false;
        }
        $hinm = stripslashes(serverset('HTTP_IF_NONE_MATCH'));
        $cutarticles = false;
        if ($canaim !== false) {
            foreach ($articles as $id => $thing) {
                if (strpos($hinm, $etags[$id]) !== false) {
                    unset($articles[$id]);
                    $cutarticles = true;
                    $cut_etag = true;
                }
                if ($dates[$id] < $imsd) {
                    unset($articles[$id]);
                    $cutarticles = true;
                    $cut_time = true;
                }
            }
        }
        if (isset($cut_etag) && isset($cut_time)) {
            header("Vary: If-None-Match, If-Modified-Since");
        } else {
            if (isset($cut_etag)) {
                header("Vary: If-None-Match");
            } else {
                if (isset($cut_time)) {
                    header("Vary: If-Modified-Since");
                }
            }
        }
        $etag = @join("-", $etags);
        if (strstr($hinm, $etag)) {
            txp_status_header('304 Not Modified');
            exit(0);
        }
        if ($etag) {
            header('ETag: "' . $etag . '"');
        }
        if ($cutarticles) {
            //header("HTTP/1.1 226 IM Used");
            //This should be used as opposed to 200, but Apache doesn't like it.
            //http://intertwingly.net/blog/2004/09/11/Vary-ETag/ says that the status code should be 200.
            header("Cache-Control: no-store, im");
            header("IM: feed");
        }
    }
    $out = array_merge($out, $articles);
    header('Content-type: application/' . ($atom ? 'atom' : 'rss') . '+xml; charset=utf-8');
    if ($atom) {
        return chr(60) . '?xml version="1.0" encoding="UTF-8"?' . chr(62) . n . '<feed xml:lang="' . $language . '" xmlns="http://www.w3.org/2005/Atom">' . n . join(n, $out) . '</feed>';
    } else {
        return '<?xml version="1.0" encoding="utf-8"?>' . n . '<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom">' . n . tag(join(n, $out), 'channel') . n . '</rss>';
    }
}

    #	Serve resource requests...
    #===========================================================================
    switch (gps('sed_resources')) {
        case 'sed_sf_write_js':
            require_privs('article');
            _sed_sf_write_js();
            break;
        case 'sed_sf_section_js':
            require_privs('section');
            _sed_sf_section_js();
            break;
        case 'update_data_format':
            # Only for upgrades from v2 to v3+ of the plugin.
            _sed_sf_upgrade_storage_format();
            $uri = 'http://' . $GLOBALS['siteurl'] . '/textpattern/index.php?event=prefs';
            txp_status_header("302 Found");
            header("Location: {$uri}");
            exit;
            break;
        default:
            break;
    }
}
function _sed_sf_get_max_field_number()
{
    static $max;
    if (!isset($max)) {
        if (is_callable('glz_all_custom_fields')) {
            $result = glz_all_custom_fields();
            $max = count($result);
            #

/**
 * Returns an error page.
 *
 * This function is used to return a bailout page when resolving database
 * connections fails. Sends a HTTP 503 error status and displays the last logged
 * MySQL error message.
 *
 * @return string HTML5 document
 * @access private
 */
function db_down()
{
    global $DB;
    // 503 status might discourage search engines from indexing or caching the
    // error message.
    txp_status_header('503 Service Unavailable');
    if (is_object($DB)) {
        $error = txpspecialchars(mysqli_error($DB->link));
    } else {
        $error = '$DB object is not available.';
    }
    return <<<eod
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <title>Database unavailable</title>
</head>
<body>
    <p>Database unavailable.</p>
    <!-- {$error} -->
</body>
</html>
eod;
}

}
if (!defined("txpinterface")) {
    die('If you just updated and expect to see your site here, please also update the files in your main installation directory.' . ' (Otherwise note that publish.php cannot be called directly.)');
}
include_once txpath . '/lib/txplib_db.php';
include_once txpath . '/lib/txplib_html.php';
include_once txpath . '/lib/txplib_forms.php';
include_once txpath . '/lib/txplib_misc.php';
include_once txpath . '/lib/admin_config.php';
include_once txpath . '/publish/taghandlers.php';
include_once txpath . '/publish/log.php';
include_once txpath . '/publish/comment.php';
//	set_error_handler('myErrorHandler');
ob_start();
// useful for clean urls with error-handlers
txp_status_header('200 OK');
// start the clock for runtime
$microstart = getmicrotime();
// check the size of the url request
bombShelter();
// get all prefs as an array
$prefs = get_prefs();
// add prefs to globals
extract($prefs);
// set a higher error level during initialization
set_error_level(@$production_status == 'live' ? 'testing' : @$production_status);
// use the current URL path if $siteurl is unknown
if (empty($siteurl)) {
    $prefs['siteurl'] = $siteurl = $_SERVER['HTTP_HOST'] . rtrim(dirname($_SERVER['SCRIPT_NAME']), '/');
}
if (empty($path_to_site)) {

function mem_form($atts, $thing = '')
{
    global $sitename, $prefs, $file_max_upload_size, $mem_form_error, $mem_form_submit, $mem_form, $mem_form_labels, $mem_form_values, $mem_form_default, $mem_form_type, $mem_form_thanks_form, $mem_glz_custom_fields_plugin;
    extract(mem_form_lAtts(array('form' => '', 'thanks_form' => '', 'thanks' => graf(mem_form_gTxt('submitted_thanks')), 'label' => '', 'type' => '', 'redirect' => '', 'redirect_form' => '', 'class' => 'memForm', 'file_accept' => '', 'max_file_size' => $file_max_upload_size, 'form_expired_msg' => mem_form_gTxt('form_expired'), 'show_error' => 1, 'show_input' => 1), $atts));
    if (empty($type) or empty($form) && empty($thing)) {
        trigger_error('Argument not specified for mem_form tag', E_USER_WARNING);
        return '';
    }
    $out = '';
    $mem_form_type = $type;
    $mem_form_default = array();
    callback_event('mem_form.defaults');
    unset($atts['show_error'], $atts['show_input']);
    $mem_form_id = md5(serialize($atts) . preg_replace('/[\\t\\s\\r\\n]/', '', $thing));
    $mem_form_submit = ps('mem_form_id') == $mem_form_id;
    $nonce = doSlash(ps('mem_form_nonce'));
    $renonce = false;
    if ($mem_form_submit) {
        safe_delete('txp_discuss_nonce', 'issue_time < date_sub(now(), interval 10 minute)');
        if ($rs = safe_row('used', 'txp_discuss_nonce', "nonce = '{$nonce}'")) {
            if ($rs['used']) {
                unset($mem_form_error);
                $mem_form_error[] = mem_form_gTxt('form_used');
                $renonce = true;
                $_POST['mem_form_submit'] = TRUE;
                $_POST['mem_form_id'] = $mem_form_id;
                $_POST['mem_form_nonce'] = $nonce;
            }
        } else {
            $mem_form_error[] = $form_expired_msg;
            $renonce = true;
        }
    }
    if ($mem_form_submit and $nonce and !$renonce) {
        $mem_form_nonce = $nonce;
    } elseif (!$show_error or $show_input) {
        $mem_form_nonce = md5(uniqid(rand(), true));
        safe_insert('txp_discuss_nonce', "issue_time = now(), nonce = '{$mem_form_nonce}'");
    }
    $form = $form ? fetch_form($form) : $thing;
    $form = parse($form);
    if (!$mem_form_submit) {
        # don't show errors or send mail
    } elseif (mem_form_error()) {
        if ($show_error or !$show_input) {
            $out .= mem_form_display_error();
            if (!$show_input) {
                return $out;
            }
        }
    } elseif ($show_input and is_array($mem_form)) {
        if ($mem_glz_custom_fields_plugin) {
            // prep the values
            glz_custom_fields_before_save();
        }
        callback_event('mem_form.spam');
        /// load and check spam plugins/
        $evaluator =& get_mem_form_evaluator();
        $is_spam = $evaluator->is_spam();
        if ($is_spam) {
            return mem_form_gTxt('spam');
        }
        $mem_form_thanks_form = $thanks_form ? fetch_form($thanks_form) : $thanks;
        safe_update('txp_discuss_nonce', "used = '1', issue_time = now()", "nonce = '{$nonce}'");
        $result = callback_event('mem_form.submit');
        if (mem_form_error()) {
            $out .= mem_form_display_error();
            $redirect = false;
        }
        $thanks_form = $mem_form_thanks_form;
        unset($mem_form_thanks_form);
        if (!empty($result)) {
            return $result;
        }
        if (mem_form_error() and $show_input) {
            // no-op, reshow form with errors
        } else {
            if ($redirect) {
                $_POST = array();
                while (@ob_end_clean()) {
                }
                $uri = hu . ltrim($redirect, '/');
                if (empty($_SERVER['FCGI_ROLE']) and empty($_ENV['FCGI_ROLE'])) {
                    txp_status_header('303 See Other');
                    header('Location: ' . $uri);
                    header('Connection: close');
                    header('Content-Length: 0');
                } else {
                    $uri = htmlspecialchars($uri);
                    $refresh = mem_form_gTxt('refresh');
                    if (!empty($redirect_form)) {
                        $redirect_form = fetch_form($redirect_form);
                        echo str_replace('{uri}', $uri, $redirect_form);
                    }
                    if (empty($redirect_form)) {
                        echo <<<END
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
\t<title>{$sitename}</title>
//.........这里部分代码省略.........

            unset($GLOBALS[$_txpfoo], ${$_txpfoo});
        }
    }
}
define("txpinterface", "public");
// Save server path to site root.
if (!isset($here)) {
    $here = dirname(__FILE__);
}
// Pull in config unless configuration data has already been provided (multi-headed use).
if (!isset($txpcfg['table_prefix'])) {
    // Use buffering to ensure bogus whitespace in config.php is ignored.
    ob_start(null, 2048);
    include '../private/config.php';
    ob_end_clean();
}
if (!defined('txpath')) {
    define("txpath", realpath(dirname(__FILE__) . '/../../../textpattern'));
}
include txpath . '/lib/constants.php';
include txpath . '/lib/txplib_misc.php';
if (!isset($txpcfg['table_prefix'])) {
    txp_status_header('503 Service Unavailable');
    exit('config.php is missing or corrupt.  To install Textpattern, visit <a href="./setup/">textpattern/setup/</a>');
}
// custom caches, et cetera?
if (isset($txpcfg['pre_publish_script'])) {
    require $txpcfg['pre_publish_script'];
}
include txpath . '/publish.php';
textpattern();