<?
define('IN_PHPBB', true);
$phpbb_root_path = '';
include($phpbb_root_path . 'extension.inc');
include($phpbb_root_path . 'common.'.$phpEx);
include($phpbb_root_path . 'includes/bbcode.'.$phpEx);

//
// Start session management
//
$userdata = session_pagestart($user_ip, PAGE_INDEX);
init_userprefs($userdata);
//
// End session management
//

if ( !$userdata['session_logged_in'] )
{
       $redirect = ( isset($post_id) ) ? "index.php" : "index.php";
       $redirect .= ( isset($start) ) ? "&start=$start" : '';
       $header_location = ( @preg_match("/Microsoft|WebSTAR|Xitami/", getenv("SERVER_SOFTWARE")) ) ? "Refresh: 0; URL=" : "Location: ";
       header($header_location . append_sid("../phpBB/login.$phpEx?redirect=$redirect", true));
       exit;
}
// Don't want others to look while I'm testing.  Less they potentially mess something up.
else if ($userdata['username'] != "DarkUnderlord")
{
       die('You are not Authorised to view this page. <BR> Leave now, or my army of munchkins will attack you.');
}

// By default, only show 10 posts unless ?posts= has been set.
$posts = ( isset($_GET['posts']) ) ? intval($_GET['posts']) : 10;
?>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<TITLE>Peek-a-boo!</TITLE>
<META content="text/html; charset=windows-1252" http-equiv="Content-Type">
</HEAD>
<BODY>

<TABLE width="100%" border="0" align="center" CellPadding="0" CellSpacing="2">
<TR>
	<TD>
        <form method="POST" action="<?php echo($_SERVER['REQUEST_URI']) ?>">
	<TABLE border="0" align="center" CellPadding="5" CellSpacing="0">
	<TR>
	     <TD><b>Username: </b></TD>
             <TD>
	     <?
			$select_username = (isset($_POST['select_username'])) ? $_POST['select_username'] : 0;

	             // Populate this combo box with the username and ID data from phpbb_users.
	             $query = "SELECT
                     	          user_id,
                     	          username
                               FROM " . USERS_TABLE . "
                               WHERE user_posts >= $posts
                               ORDER BY username ASC";

			if ( !($result = $db->sql_query($query)) )
			{
				$error = mysql_error();
				die('SQL Error - Error retrieving data on line 60.' . $error);
			}

	             // Create the USERNAME combo box
	           	echo "<SELECT NAME='select_username'>";
			while($row = $db->sql_fetchrow($result))
	             {
	                     echo "
				<OPTION VALUE='" . $row['user_id'] . "'";
			     // If we just selected a user, show that name in the combo box.
			     if ($row["user_id"] == $select_username)
                             {
                                    echo "selected";
			     }
                             echo ">" . $row["username"] . "</OPTION>";
	             }
	             echo "</SELECT>";
	     ?>
	     </TD>
	     <TD align="center"><input type="Submit" name="action" value="From"></TD>
	     <TD align="center"><input type="Submit" name="action" value="To"></TD>
	</TR>
	</TABLE>
        </form>
	</TD>
</TR>
<TR>
	<TD><BR><BR></TD>
</TR>

<?
// If we are looking at messages TO or FROM this user.
if ((strtolower($_POST['action']) == "from") or (strtolower($_POST['action']) == "to"))
{
	$UserID = $_POST['select_username'];

	if (strtolower($_POST['action']) == "from")
        {
	        $query = "SELECT
	                        privmsgs_id,
	                        privmsgs_from_userid,
	                        privmsgs_to_userid,
	                        privmsgs_date,
	                        privmsgs_subject
	                  FROM " . PRIVMSGS_TABLE . "
	                  WHERE privmsgs_from_userid=$UserID
	                  ORDER BY privmsgs_date DESC";
	}
        else if (strtolower($_POST['action']) == "to")
        {
	        $query = "SELECT
	                        privmsgs_id,
	                        privmsgs_from_userid,
	                        privmsgs_to_userid,
	                        privmsgs_date,
	                        privmsgs_subject
	                  FROM " . PRIVMSGS_TABLE . "
	                  WHERE privmsgs_to_userid=$UserID
	                  ORDER BY privmsgs_date DESC";
	}
	else
	{
		die('Ain\'t no soup in your bowl.');
	}

	if ( !($result_query = $db->sql_query($query)) )
	{
		die('SQL Error - Error retrieving data on line 122.');
	}

	echo '<tr><td><h1>Messages: ' . $db->sql_numrows($result_query) . '</h1></td></tr>';

	while($row = $db->sql_fetchrow($result_query))
        {
	        echo "<TR><TD><b>From: </b>";

		// Figure out who the message is FROM.
		$query_from = "SELECT username 
				FROM " . USERS_TABLE . " 
				WHERE user_id = " . $row["privmsgs_from_userid"];

		if ( !($result = $db->sql_query($query_from)) )
		{
			die('SQL Error - Error retrieving data on line 133. ' . $query_from);
		}
	
		$row_from = $db->sql_fetchrow($result);
		echo $row_from["username"];
                echo "<BR>";

                // Figure out who the message is TO.
	        echo "<b>To: </b>";
                        $query_to = "SELECT username 
					FROM " . USERS_TABLE . " 
					WHERE user_id= " . $row['privmsgs_to_userid'];
			if ( !($result = $db->sql_query($query_to)) )
			{
				die('SQL Error - Error retrieving data on line 157.');
			}
			$row_to = $db->sql_fetchrow($result);
                        echo $row_to["username"];
                echo "<BR>";
	        echo "<b>Date: </b>" . date("d-M-Y", $row["privmsgs_date"]) . "<BR>";
	        echo "<b>Subject: </b>{$row["privmsgs_subject"]}<BR>";

                // Display the message and de-code the BBCode.
	        echo "<b>Message: </b><BR>";
                        $query_message = "SELECT privmsgs_text 
						FROM " . PRIVMSGS_TEXT_TABLE . " 
						WHERE privmsgs_text_id= " . $row['privmsgs_id'];
			if ( !($result = $db->sql_query($query_message)) )
			{
				die('SQL Error - Error retrieving data on line 170.');
			}
			$row_message = $db->sql_fetchrow($result);
	                $bbcode_uid = $row['bbcode_uid'];
	                if ( $bbcode_uid != '' )
	                {
	                        $row_message['privmsgs_text'] = ( $board_config['allow_bbcode'] ) ? bbencode_second_pass($row_message['privmsgs_text'], $bbcode_uid) : preg_replace('/\:[0-9a-z\:]+\]/si', ']', $row_message['privmsgs_text']);
	                }
                        $row_message['privmsgs_text'] = str_replace ("\n","<BR>", $row_message['privmsgs_text']);
	                $row_message['privmsgs_text'] = str_replace ("&gt;",">", $row_message['privmsgs_text']);
	                $row_message['privmsgs_text'] = str_replace ("&lt;","<", $row_message['privmsgs_text']);
	                $row_message['privmsgs_text'] = str_replace ("&quot;","\"", $row_message['privmsgs_text']);
	                $row_message['privmsgs_text'] = str_replace ("&amp;","&", $row_message['privmsgs_text']);
                        echo $row_message["privmsgs_text"];

                echo "<BR><HR><TR><TD>";
        }
}
?>
</TABLE>
</BODY
</HTML>