gosora/routes.go

/*
*
*	Gosora Route Handlers
*	Copyright Azareal 2016 - 2018
*
 */
package main

import (
	"log"
	//"fmt"
	"bytes"
	"html"
	"io"
	"net/http"
	"strconv"
	"strings"
	"time"

	"./common"
	"./query_gen/lib"
)

// A blank list to fill out that parameter in Page for routes which don't use it
var tList []interface{}

//var nList []string
var successJSONBytes = []byte(`{"success":"1"}`)
var cacheControlMaxAge = "max-age=" + strconv.Itoa(day) // TODO: Make this a config value

// HTTPSRedirect is a connection handler which redirects all HTTP requests to HTTPS
type HTTPSRedirect struct {
}

func (red *HTTPSRedirect) ServeHTTP(w http.ResponseWriter, req *http.Request) {
	dest := "https://" + req.Host + req.URL.Path
	if len(req.URL.RawQuery) > 0 {
		dest += "?" + req.URL.RawQuery
	}
	http.Redirect(w, req, dest, http.StatusTemporaryRedirect)
}

// GET functions
func routeStatic(w http.ResponseWriter, r *http.Request) {
	//log.Print("Outputting static file '" + r.URL.Path + "'")
	file, ok := staticFiles[r.URL.Path]
	if !ok {
		if dev.DebugMode {
			log.Print("Failed to find '" + r.URL.Path + "'")
		}
		w.WriteHeader(http.StatusNotFound)
		return
	}
	h := w.Header()

	// Surely, there's a more efficient way of doing this?
	t, err := time.Parse(http.TimeFormat, h.Get("If-Modified-Since"))
	if err == nil && file.Info.ModTime().Before(t.Add(1*time.Second)) {
		w.WriteHeader(http.StatusNotModified)
		return
	}
	h.Set("Last-Modified", file.FormattedModTime)
	h.Set("Content-Type", file.Mimetype)
	//Cache-Control: max-age=31536000
	h.Set("Cache-Control", cacheControlMaxAge)
	h.Set("Vary", "Accept-Encoding")
	//http.ServeContent(w,r,r.URL.Path,file.Info.ModTime(),file)
	//w.Write(file.Data)
	if strings.Contains(h.Get("Accept-Encoding"), "gzip") {
		h.Set("Content-Encoding", "gzip")
		h.Set("Content-Length", strconv.FormatInt(file.GzipLength, 10))
		io.Copy(w, bytes.NewReader(file.GzipData)) // Use w.Write instead?
	} else {
		h.Set("Content-Length", strconv.FormatInt(file.Length, 10)) // Avoid doing a type conversion every time?
		io.Copy(w, bytes.NewReader(file.Data))
	}
	//io.CopyN(w, bytes.NewReader(file.Data), staticFiles[r.URL.Path].Length)
}

// Deprecated: Test route for stopping the server during a performance analysis
/*func routeExit(w http.ResponseWriter, r *http.Request, user User) RouteError{
	db.Close()
	os.Exit(0)
}*/

// TODO: Make this a static file somehow? Is it possible for us to put this file somewhere else?
// TODO: Add a sitemap
// TODO: Add an API so that plugins can register disallowed areas. E.g. /guilds/join for plugin_guilds
func routeRobotsTxt(w http.ResponseWriter, r *http.Request) RouteError {
	_, _ = w.Write([]byte(`User-agent: *
Disallow: /panel/
Disallow: /topics/create/
Disallow: /user/edit/
Disallow: /accounts/
`))
	return nil
}

func routeOverview(w http.ResponseWriter, r *http.Request, user User) RouteError {
	headerVars, ferr := UserCheck(w, r, &user)
	if ferr != nil {
		return ferr
	}
	BuildWidgets("overview", nil, headerVars, r)

	pi := common.Page{"Overview", user, headerVars, tList, nil}
	if preRenderHooks["pre_render_overview"] != nil {
		if runPreRenderHook("pre_render_overview", w, r, &user, &pi) {
			return nil
		}
	}

	err := templates.ExecuteTemplate(w, "overview.html", pi)
	if err != nil {
		return InternalError(err, w, r)
	}
	return nil
}

func routeCustomPage(w http.ResponseWriter, r *http.Request, user User) RouteError {
	headerVars, ferr := UserCheck(w, r, &user)
	if ferr != nil {
		return ferr
	}

	name := r.URL.Path[len("/pages/"):]
	if templates.Lookup("page_"+name) == nil {
		return NotFound(w, r)
	}
	BuildWidgets("custom_page", name, headerVars, r)

	pi := common.Page{"Page", user, headerVars, tList, nil}
	if preRenderHooks["pre_render_custom_page"] != nil {
		if runPreRenderHook("pre_render_custom_page", w, r, &user, &pi) {
			return nil
		}
	}

	err := templates.ExecuteTemplate(w, "page_"+name, pi)
	if err != nil {
		return InternalError(err, w, r)
	}
	return nil
}

func routeTopics(w http.ResponseWriter, r *http.Request, user User) RouteError {
	headerVars, ferr := UserCheck(w, r, &user)
	if ferr != nil {
		return ferr
	}
	BuildWidgets("topics", nil, headerVars, r)

	// TODO: Add a function for the qlist stuff
	var qlist string
	group, err := gstore.Get(user.Group)
	if err != nil {
		log.Printf("Group #%d doesn't exist despite being used by User #%d", user.Group, user.ID)
		return LocalError("Something weird happened", w, r, user)
	}

	// TODO: Make CanSee a method on *Group with a canSee field?
	var canSee []int
	if user.IsSuperAdmin {
		canSee, err = fstore.GetAllVisibleIDs()
		if err != nil {
			return InternalError(err, w, r)
		}
	} else {
		canSee = group.CanSee
	}

	// We need a list of the visible forums for Quick Topic
	var forumList []Forum
	var argList []interface{}

	for _, fid := range canSee {
		forum := fstore.DirtyGet(fid)
		if forum.Name != "" && forum.Active {
			if forum.ParentType == "" || forum.ParentType == "forum" {
				// Optimise Quick Topic away for guests
				if user.Loggedin {
					fcopy := forum.Copy()
					// TODO: Add a hook here for plugin_guilds
					forumList = append(forumList, fcopy)
				}
			}
			// ? - Should we be showing plugin_guilds posts on /topics/?
			// ? - Would it be useful, if we could post in social groups from /topics/?
			argList = append(argList, strconv.Itoa(fid))
			qlist += "?,"

		}
	}

	// ! Need an inline error not a page level error
	if qlist == "" {
		return NotFound(w, r)
	}
	qlist = qlist[0 : len(qlist)-1]

	topicCountStmt, err := qgen.Builder.SimpleCount("topics", "parentID IN("+qlist+")", "")
	if err != nil {
		return InternalError(err, w, r)
	}

	var topicCount int
	err = topicCountStmt.QueryRow(argList...).Scan(&topicCount)
	if err != nil {
		return InternalError(err, w, r)
	}

	// Get the current page
	page, _ := strconv.Atoi(r.FormValue("page"))

	// Calculate the offset
	var offset int
	lastPage := (topicCount / config.ItemsPerPage) + 1
	if page > 1 {
		offset = (config.ItemsPerPage * page) - config.ItemsPerPage
	} else if page == -1 {
		page = lastPage
		offset = (config.ItemsPerPage * page) - config.ItemsPerPage
	} else {
		page = 1
	}

	var topicList []*TopicsRow
	stmt, err := qgen.Builder.SimpleSelect("topics", "tid, title, content, createdBy, is_closed, sticky, createdAt, lastReplyAt, lastReplyBy, parentID, postCount, likeCount", "parentID IN("+qlist+")", "sticky DESC, lastReplyAt DESC, createdBy DESC", "?,?")
	if err != nil {
		return InternalError(err, w, r)
	}

	argList = append(argList, offset)
	argList = append(argList, config.ItemsPerPage)

	rows, err := stmt.Query(argList...)
	if err != nil {
		return InternalError(err, w, r)
	}
	defer rows.Close()

	var reqUserList = make(map[int]bool)
	for rows.Next() {
		topicItem := TopicsRow{ID: 0}
		err := rows.Scan(&topicItem.ID, &topicItem.Title, &topicItem.Content, &topicItem.CreatedBy, &topicItem.IsClosed, &topicItem.Sticky, &topicItem.CreatedAt, &topicItem.LastReplyAt, &topicItem.LastReplyBy, &topicItem.ParentID, &topicItem.PostCount, &topicItem.LikeCount)
		if err != nil {
			return InternalError(err, w, r)
		}

		topicItem.Link = buildTopicURL(nameToSlug(topicItem.Title), topicItem.ID)

		forum := fstore.DirtyGet(topicItem.ParentID)
		topicItem.ForumName = forum.Name
		topicItem.ForumLink = forum.Link

		//topicItem.CreatedAt = relativeTime(topicItem.CreatedAt)
		topicItem.RelativeLastReplyAt = relativeTime(topicItem.LastReplyAt)

		if vhooks["topics_topic_row_assign"] != nil {
			runVhook("topics_topic_row_assign", &topicItem, &forum)
		}
		topicList = append(topicList, &topicItem)
		reqUserList[topicItem.CreatedBy] = true
		reqUserList[topicItem.LastReplyBy] = true
	}
	err = rows.Err()
	if err != nil {
		return InternalError(err, w, r)
	}

	// Convert the user ID map to a slice, then bulk load the users
	var idSlice = make([]int, len(reqUserList))
	var i int
	for userID := range reqUserList {
		idSlice[i] = userID
		i++
	}

	// TODO: What if a user is deleted via the Control Panel?
	userList, err := users.BulkGetMap(idSlice)
	if err != nil {
		return InternalError(err, w, r)
	}

	// Second pass to the add the user data
	// TODO: Use a pointer to TopicsRow instead of TopicsRow itself?
	for _, topicItem := range topicList {
		topicItem.Creator = userList[topicItem.CreatedBy]
		topicItem.LastUser = userList[topicItem.LastReplyBy]
	}

	pi := TopicsPage{"All Topics", user, headerVars, topicList, forumList, config.DefaultForum}
	if preRenderHooks["pre_render_topic_list"] != nil {
		if runPreRenderHook("pre_render_topic_list", w, r, &user, &pi) {
			return nil
		}
	}
	err = RunThemeTemplate(headerVars.ThemeName, "topics", pi, w)
	if err != nil {
		return InternalError(err, w, r)
	}
	return nil
}

func routeForum(w http.ResponseWriter, r *http.Request, user User, sfid string) RouteError {
	page, _ := strconv.Atoi(r.FormValue("page"))

	// SEO URLs...
	halves := strings.Split(sfid, ".")
	if len(halves) < 2 {
		halves = append(halves, halves[0])
	}
	fid, err := strconv.Atoi(halves[1])
	if err != nil {
		return PreError("The provided ForumID is not a valid number.", w, r)
	}

	headerVars, ferr := ForumUserCheck(w, r, &user, fid)
	if ferr != nil {
		return ferr
	}

	if !user.Perms.ViewTopic {
		return NoPermissions(w, r, user)
	}

	// TODO: Fix this double-check
	forum, err := fstore.Get(fid)
	if err == ErrNoRows {
		return NotFound(w, r)
	} else if err != nil {
		return InternalError(err, w, r)
	}

	BuildWidgets("view_forum", forum, headerVars, r)

	// Calculate the offset
	var offset int
	// TODO: Does forum.TopicCount take the deleted items into consideration for guests?
	lastPage := (forum.TopicCount / config.ItemsPerPage) + 1
	if page > 1 {
		offset = (config.ItemsPerPage * page) - config.ItemsPerPage
	} else if page == -1 {
		page = lastPage
		offset = (config.ItemsPerPage * page) - config.ItemsPerPage
	} else {
		page = 1
	}

	// TODO: Move this to *Forum
	rows, err := stmts.getForumTopicsOffset.Query(fid, offset, config.ItemsPerPage)
	if err != nil {
		return InternalError(err, w, r)
	}
	defer rows.Close()

	// TODO: Use something other than TopicsRow as we don't need to store the forum name and link on each and every topic item?
	var topicList []*TopicsRow
	var reqUserList = make(map[int]bool)
	for rows.Next() {
		var topicItem = TopicsRow{ID: 0}
		err := rows.Scan(&topicItem.ID, &topicItem.Title, &topicItem.Content, &topicItem.CreatedBy, &topicItem.IsClosed, &topicItem.Sticky, &topicItem.CreatedAt, &topicItem.LastReplyAt, &topicItem.LastReplyBy, &topicItem.ParentID, &topicItem.PostCount, &topicItem.LikeCount)
		if err != nil {
			return InternalError(err, w, r)
		}

		topicItem.Link = buildTopicURL(nameToSlug(topicItem.Title), topicItem.ID)
		topicItem.RelativeLastReplyAt = relativeTime(topicItem.LastReplyAt)

		if vhooks["forum_trow_assign"] != nil {
			runVhook("forum_trow_assign", &topicItem, &forum)
		}
		topicList = append(topicList, &topicItem)
		reqUserList[topicItem.CreatedBy] = true
		reqUserList[topicItem.LastReplyBy] = true
	}
	err = rows.Err()
	if err != nil {
		return InternalError(err, w, r)
	}

	// Convert the user ID map to a slice, then bulk load the users
	var idSlice = make([]int, len(reqUserList))
	var i int
	for userID := range reqUserList {
		idSlice[i] = userID
		i++
	}

	// TODO: What if a user is deleted via the Control Panel?
	userList, err := users.BulkGetMap(idSlice)
	if err != nil {
		return InternalError(err, w, r)
	}

	// Second pass to the add the user data
	// TODO: Use a pointer to TopicsRow instead of TopicsRow itself?
	for _, topicItem := range topicList {
		topicItem.Creator = userList[topicItem.CreatedBy]
		topicItem.LastUser = userList[topicItem.LastReplyBy]
	}

	pi := ForumPage{forum.Name, user, headerVars, topicList, forum, page, lastPage}
	if preRenderHooks["pre_render_view_forum"] != nil {
		if runPreRenderHook("pre_render_view_forum", w, r, &user, &pi) {
			return nil
		}
	}
	err = RunThemeTemplate(headerVars.ThemeName, "forum", pi, w)
	if err != nil {
		return InternalError(err, w, r)
	}
	return nil
}

func routeForums(w http.ResponseWriter, r *http.Request, user User) RouteError {
	headerVars, ferr := UserCheck(w, r, &user)
	if ferr != nil {
		return ferr
	}
	BuildWidgets("forums", nil, headerVars, r)

	var err error
	var forumList []Forum
	var canSee []int
	if user.IsSuperAdmin {
		canSee, err = fstore.GetAllVisibleIDs()
		if err != nil {
			return InternalError(err, w, r)
		}
		//log.Print("canSee ", canSee)
	} else {
		group, err := gstore.Get(user.Group)
		if err != nil {
			log.Printf("Group #%d doesn't exist despite being used by User #%d", user.Group, user.ID)
			return LocalError("Something weird happened", w, r, user)
		}
		canSee = group.CanSee
		//log.Print("group.CanSee ", group.CanSee)
	}

	for _, fid := range canSee {
		// Avoid data races by copying the struct into something we can freely mold without worrying about breaking something somewhere else
		var forum = fstore.DirtyGet(fid).Copy()
		if forum.ParentID == 0 && forum.Name != "" && forum.Active {
			if forum.LastTopicID != 0 {
				//topic, user := forum.GetLast()
				//if topic.ID != 0 && user.ID != 0 {
				if forum.LastTopic.ID != 0 && forum.LastReplyer.ID != 0 {
					forum.LastTopicTime = relativeTime(forum.LastTopic.LastReplyAt)
				} else {
					forum.LastTopicTime = ""
				}
			} else {
				forum.LastTopicTime = ""
			}
			if hooks["forums_frow_assign"] != nil {
				runHook("forums_frow_assign", &forum)
			}
			forumList = append(forumList, forum)
		}
	}

	pi := ForumsPage{"Forum List", user, headerVars, forumList}
	if preRenderHooks["pre_render_forum_list"] != nil {
		if runPreRenderHook("pre_render_forum_list", w, r, &user, &pi) {
			return nil
		}
	}
	err = RunThemeTemplate(headerVars.ThemeName, "forums", pi, w)
	if err != nil {
		return InternalError(err, w, r)
	}
	return nil
}

func routeTopicID(w http.ResponseWriter, r *http.Request, user User) RouteError {
	var err error
	var page, offset int
	var replyList []ReplyUser

	page, _ = strconv.Atoi(r.FormValue("page"))

	// SEO URLs...
	halves := strings.Split(r.URL.Path[len("/topic/"):], ".")
	if len(halves) < 2 {
		halves = append(halves, halves[0])
	}

	tid, err := strconv.Atoi(halves[1])
	if err != nil {
		return PreError("The provided TopicID is not a valid number.", w, r)
	}

	// Get the topic...
	topic, err := getTopicUser(tid)
	if err == ErrNoRows {
		return NotFound(w, r)
	} else if err != nil {
		return InternalError(err, w, r)
	}
	topic.ClassName = ""
	//log.Printf("topic: %+v\n", topic)

	headerVars, ferr := ForumUserCheck(w, r, &user, topic.ParentID)
	if ferr != nil {
		return ferr
	}
	if !user.Perms.ViewTopic {
		//log.Printf("user.Perms: %+v\n", user.Perms)
		return NoPermissions(w, r, user)
	}

	BuildWidgets("view_topic", &topic, headerVars, r)

	topic.ContentHTML = parseMessage(topic.Content, topic.ParentID, "forums")
	topic.ContentLines = strings.Count(topic.Content, "\n")

	// We don't want users posting in locked topics...
	if topic.IsClosed && !user.IsMod {
		user.Perms.CreateReply = false
	}

	postGroup, err := gstore.Get(topic.Group)
	if err != nil {
		return InternalError(err, w, r)
	}

	topic.Tag = postGroup.Tag
	if postGroup.IsMod || postGroup.IsAdmin {
		topic.ClassName = config.StaffCSS
	}
	topic.RelativeCreatedAt = relativeTime(topic.CreatedAt)

	// TODO: Make a function for this? Build a more sophisticated noavatar handling system?
	if topic.Avatar != "" {
		if topic.Avatar[0] == '.' {
			topic.Avatar = "/uploads/avatar_" + strconv.Itoa(topic.CreatedBy) + topic.Avatar
		}
	} else {
		topic.Avatar = strings.Replace(config.Noavatar, "{id}", strconv.Itoa(topic.CreatedBy), 1)
	}

	// Calculate the offset
	lastPage := (topic.PostCount / config.ItemsPerPage) + 1
	if page > 1 {
		offset = (config.ItemsPerPage * page) - config.ItemsPerPage
	} else if page == -1 {
		page = lastPage
		offset = (config.ItemsPerPage * page) - config.ItemsPerPage
	} else {
		page = 1
	}

	tpage := TopicPage{topic.Title, user, headerVars, replyList, topic, page, lastPage}

	// Get the replies..
	rows, err := stmts.getTopicRepliesOffset.Query(topic.ID, offset, config.ItemsPerPage)
	if err == ErrNoRows {
		return LocalError("Bad Page. Some of the posts may have been deleted or you got here by directly typing in the page number.", w, r, user)
	} else if err != nil {
		return InternalError(err, w, r)
	}
	defer rows.Close()

	replyItem := ReplyUser{ClassName: ""}
	for rows.Next() {
		err := rows.Scan(&replyItem.ID, &replyItem.Content, &replyItem.CreatedBy, &replyItem.CreatedAt, &replyItem.LastEdit, &replyItem.LastEditBy, &replyItem.Avatar, &replyItem.CreatedByName, &replyItem.Group, &replyItem.URLPrefix, &replyItem.URLName, &replyItem.Level, &replyItem.IPAddress, &replyItem.LikeCount, &replyItem.ActionType)
		if err != nil {
			return InternalError(err, w, r)
		}

		replyItem.UserLink = buildProfileURL(nameToSlug(replyItem.CreatedByName), replyItem.CreatedBy)
		replyItem.ParentID = topic.ID
		replyItem.ContentHtml = parseMessage(replyItem.Content, topic.ParentID, "forums")
		replyItem.ContentLines = strings.Count(replyItem.Content, "\n")

		postGroup, err = gstore.Get(replyItem.Group)
		if err != nil {
			return InternalError(err, w, r)
		}

		if postGroup.IsMod || postGroup.IsAdmin {
			replyItem.ClassName = config.StaffCSS
		} else {
			replyItem.ClassName = ""
		}

		// TODO: Make a function for this? Build a more sophisticated noavatar handling system? Do bulk user loads and let the UserStore initialise this?
		if replyItem.Avatar != "" {
			if replyItem.Avatar[0] == '.' {
				replyItem.Avatar = "/uploads/avatar_" + strconv.Itoa(replyItem.CreatedBy) + replyItem.Avatar
			}
		} else {
			replyItem.Avatar = strings.Replace(config.Noavatar, "{id}", strconv.Itoa(replyItem.CreatedBy), 1)
		}

		replyItem.Tag = postGroup.Tag
		replyItem.RelativeCreatedAt = relativeTime(replyItem.CreatedAt)

		// We really shouldn't have inline HTML, we should do something about this...
		if replyItem.ActionType != "" {
			switch replyItem.ActionType {
			case "lock":
				replyItem.ActionType = "This topic has been locked by <a href='" + replyItem.UserLink + "'>" + replyItem.CreatedByName + "</a>"
				replyItem.ActionIcon = "&#x1F512;&#xFE0E"
			case "unlock":
				replyItem.ActionType = "This topic has been reopened by <a href='" + replyItem.UserLink + "'>" + replyItem.CreatedByName + "</a>"
				replyItem.ActionIcon = "&#x1F513;&#xFE0E"
			case "stick":
				replyItem.ActionType = "This topic has been pinned by <a href='" + replyItem.UserLink + "'>" + replyItem.CreatedByName + "</a>"
				replyItem.ActionIcon = "&#x1F4CC;&#xFE0E"
			case "unstick":
				replyItem.ActionType = "This topic has been unpinned by <a href='" + replyItem.UserLink + "'>" + replyItem.CreatedByName + "</a>"
				replyItem.ActionIcon = "&#x1F4CC;&#xFE0E"
			default:
				replyItem.ActionType = replyItem.ActionType + " has happened"
				replyItem.ActionIcon = ""
			}
		}
		replyItem.Liked = false

		if vhooks["topic_reply_row_assign"] != nil {
			runVhook("topic_reply_row_assign", &tpage, &replyItem)
		}
		replyList = append(replyList, replyItem)
	}
	err = rows.Err()
	if err != nil {
		return InternalError(err, w, r)
	}

	tpage.ItemList = replyList
	if preRenderHooks["pre_render_view_topic"] != nil {
		if runPreRenderHook("pre_render_view_topic", w, r, &user, &tpage) {
			return nil
		}
	}
	err = RunThemeTemplate(headerVars.ThemeName, "topic", tpage, w)
	if err != nil {
		return InternalError(err, w, r)
	}
	return nil
}

func routeProfile(w http.ResponseWriter, r *http.Request, user User) RouteError {
	headerVars, ferr := UserCheck(w, r, &user)
	if ferr != nil {
		return ferr
	}

	var err error
	var replyCreatedAt time.Time
	var replyContent, replyCreatedByName, replyRelativeCreatedAt, replyAvatar, replyTag, replyClassName string
	var rid, replyCreatedBy, replyLastEdit, replyLastEditBy, replyLines, replyGroup int
	var replyList []ReplyUser

	// SEO URLs...
	halves := strings.Split(r.URL.Path[len("/user/"):], ".")
	if len(halves) < 2 {
		halves = append(halves, halves[0])
	}

	pid, err := strconv.Atoi(halves[1])
	if err != nil {
		return LocalError("The provided User ID is not a valid number.", w, r, user)
	}

	var puser *User
	if pid == user.ID {
		user.IsMod = true
		puser = &user
	} else {
		// Fetch the user data
		puser, err = users.Get(pid)
		if err == ErrNoRows {
			return NotFound(w, r)
		} else if err != nil {
			return InternalError(err, w, r)
		}
	}

	// Get the replies..
	rows, err := stmts.getProfileReplies.Query(puser.ID)
	if err != nil {
		return InternalError(err, w, r)
	}
	defer rows.Close()

	for rows.Next() {
		err := rows.Scan(&rid, &replyContent, &replyCreatedBy, &replyCreatedAt, &replyLastEdit, &replyLastEditBy, &replyAvatar, &replyCreatedByName, &replyGroup)
		if err != nil {
			return InternalError(err, w, r)
		}

		group, err := gstore.Get(replyGroup)
		if err != nil {
			return InternalError(err, w, r)
		}

		replyLines = strings.Count(replyContent, "\n")
		if group.IsMod || group.IsAdmin {
			replyClassName = config.StaffCSS
		} else {
			replyClassName = ""
		}

		if replyAvatar != "" {
			if replyAvatar[0] == '.' {
				replyAvatar = "/uploads/avatar_" + strconv.Itoa(replyCreatedBy) + replyAvatar
			}
		} else {
			replyAvatar = strings.Replace(config.Noavatar, "{id}", strconv.Itoa(replyCreatedBy), 1)
		}

		if group.Tag != "" {
			replyTag = group.Tag
		} else if puser.ID == replyCreatedBy {
			replyTag = "Profile Owner"
		} else {
			replyTag = ""
		}

		replyLiked := false
		replyLikeCount := 0
		replyRelativeCreatedAt = relativeTime(replyCreatedAt)

		// TODO: Add a hook here

		replyList = append(replyList, ReplyUser{rid, puser.ID, replyContent, parseMessage(replyContent, 0, ""), replyCreatedBy, buildProfileURL(nameToSlug(replyCreatedByName), replyCreatedBy), replyCreatedByName, replyGroup, replyCreatedAt, replyRelativeCreatedAt, replyLastEdit, replyLastEditBy, replyAvatar, replyClassName, replyLines, replyTag, "", "", "", 0, "", replyLiked, replyLikeCount, "", ""})
	}
	err = rows.Err()
	if err != nil {
		return InternalError(err, w, r)
	}

	ppage := ProfilePage{puser.Name + "'s Profile", user, headerVars, replyList, *puser}
	if preRenderHooks["pre_render_profile"] != nil {
		if runPreRenderHook("pre_render_profile", w, r, &user, &ppage) {
			return nil
		}
	}

	err = template_profile_handle(ppage, w)
	if err != nil {
		return InternalError(err, w, r)
	}
	return nil
}

func routeLogin(w http.ResponseWriter, r *http.Request, user User) RouteError {
	headerVars, ferr := UserCheck(w, r, &user)
	if ferr != nil {
		return ferr
	}
	if user.Loggedin {
		return LocalError("You're already logged in.", w, r, user)
	}
	pi := Page{"Login", user, headerVars, tList, nil}
	if preRenderHooks["pre_render_login"] != nil {
		if runPreRenderHook("pre_render_login", w, r, &user, &pi) {
			return nil
		}
	}
	err := templates.ExecuteTemplate(w, "login.html", pi)
	if err != nil {
		return InternalError(err, w, r)
	}
	return nil
}

// TODO: Log failed attempted logins?
// TODO: Lock IPS out if they have too many failed attempts?
// TODO: Log unusual countries in comparison to the country a user usually logs in from? Alert the user about this?
func routeLoginSubmit(w http.ResponseWriter, r *http.Request, user User) RouteError {
	if user.Loggedin {
		return LocalError("You're already logged in.", w, r, user)
	}
	err := r.ParseForm()
	if err != nil {
		return LocalError("Bad Form", w, r, user)
	}

	uid, err := auth.Authenticate(html.EscapeString(r.PostFormValue("username")), r.PostFormValue("password"))
	if err != nil {
		return LocalError(err.Error(), w, r, user)
	}

	userPtr, err := users.Get(uid)
	if err != nil {
		return LocalError("Bad account", w, r, user)
	}
	user = *userPtr

	var session string
	if user.Session == "" {
		session, err = auth.CreateSession(uid)
		if err != nil {
			return InternalError(err, w, r)
		}
	} else {
		session = user.Session
	}

	auth.SetCookies(w, uid, session)
	if user.IsAdmin {
		// Is this error check reundant? We already check for the error in PreRoute for the same IP
		// TODO: Should we be logging this?
		log.Printf("#%d has logged in with IP %s", uid, user.LastIP)
	}
	http.Redirect(w, r, "/", http.StatusSeeOther)
	return nil
}

func routeRegister(w http.ResponseWriter, r *http.Request, user User) RouteError {
	headerVars, ferr := UserCheck(w, r, &user)
	if ferr != nil {
		return ferr
	}
	if user.Loggedin {
		return LocalError("You're already logged in.", w, r, user)
	}
	pi := Page{"Registration", user, headerVars, tList, nil}
	if preRenderHooks["pre_render_register"] != nil {
		if runPreRenderHook("pre_render_register", w, r, &user, &pi) {
			return nil
		}
	}
	err := templates.ExecuteTemplate(w, "register.html", pi)
	if err != nil {
		return InternalError(err, w, r)
	}
	return nil
}

func routeRegisterSubmit(w http.ResponseWriter, r *http.Request, user User) RouteError {
	headerLite, _ := SimpleUserCheck(w, r, &user)

	err := r.ParseForm()
	if err != nil {
		return LocalError("Bad Form", w, r, user)
	}

	username := html.EscapeString(r.PostFormValue("username"))
	if username == "" {
		return LocalError("You didn't put in a username.", w, r, user)
	}
	email := html.EscapeString(r.PostFormValue("email"))
	if email == "" {
		return LocalError("You didn't put in an email.", w, r, user)
	}

	password := r.PostFormValue("password")
	if password == "" {
		return LocalError("You didn't put in a password.", w, r, user)
	}
	if password == username {
		return LocalError("You can't use your username as your password.", w, r, user)
	}
	if password == email {
		return LocalError("You can't use your email as your password.", w, r, user)
	}

	err = weakPassword(password)
	if err != nil {
		return LocalError(err.Error(), w, r, user)
	}

	confirmPassword := r.PostFormValue("confirm_password")
	log.Print("Registration Attempt! Username: " + username) // TODO: Add more controls over what is logged when?

	// Do the two inputted passwords match..?
	if password != confirmPassword {
		return LocalError("The two passwords don't match.", w, r, user)
	}

	var active bool
	var group int
	switch headerLite.Settings["activation_type"] {
	case 1: // Activate All
		active = true
		group = config.DefaultGroup
	default: // Anything else. E.g. Admin Activation or Email Activation.
		group = config.ActivationGroup
	}

	uid, err := users.Create(username, password, email, group, active)
	if err == errAccountExists {
		return LocalError("This username isn't available. Try another.", w, r, user)
	} else if err != nil {
		return InternalError(err, w, r)
	}

	// Check if this user actually owns this email, if email activation is on, automatically flip their account to active when the email is validated. Validation is also useful for determining whether this user should receive any alerts, etc. via email
	if site.EnableEmails {
		token, err := GenerateSafeString(80)
		if err != nil {
			return InternalError(err, w, r)
		}
		_, err = stmts.addEmail.Exec(email, uid, 0, token)
		if err != nil {
			return InternalError(err, w, r)
		}

		if !SendValidationEmail(username, email, token) {
			return LocalError("We were unable to send the email for you to confirm that this email address belongs to you. You may not have access to some functionality until you do so. Please ask an administrator for assistance.", w, r, user)
		}
	}

	session, err := auth.CreateSession(uid)
	if err != nil {
		return InternalError(err, w, r)
	}

	auth.SetCookies(w, uid, session)
	http.Redirect(w, r, "/", http.StatusSeeOther)
	return nil
}

// TODO: Set the cookie domain
func routeChangeTheme(w http.ResponseWriter, r *http.Request, user User) RouteError {
	//headerLite, _ := SimpleUserCheck(w, r, &user)
	err := r.ParseForm()
	if err != nil {
		return PreError("Bad Form", w, r)
	}

	// TODO: Rename isJs to something else, just in case we rewrite the JS side in WebAssembly?
	isJs := (r.PostFormValue("isJs") == "1")

	newTheme := html.EscapeString(r.PostFormValue("newTheme"))

	theme, ok := themes[newTheme]
	if !ok || theme.HideFromThemes {
		// TODO: Should we be logging this?
		log.Print("Bad Theme: ", newTheme)
		return LocalErrorJSQ("That theme doesn't exist", w, r, user, isJs)
	}

	// TODO: Store the current theme in the user's account?
	/*if user.Loggedin {
		_, err = stmts.changeTheme.Exec(newTheme, user.ID)
		if err != nil {
			return InternalError(err, w, r)
		}
	}*/

	cookie := http.Cookie{Name: "current_theme", Value: newTheme, Path: "/", MaxAge: year}
	http.SetCookie(w, &cookie)

	if !isJs {
		http.Redirect(w, r, "/", http.StatusSeeOther)
	} else {
		_, _ = w.Write(successJSONBytes)
	}
	return nil
}

// TODO: We don't need support XML here to support sitemaps, we could handle those elsewhere
var phraseLoginAlerts = []byte(`{"msgs":[{"msg":"Login to see your alerts","path":"/accounts/login"}]}`)

func routeAPI(w http.ResponseWriter, r *http.Request, user User) RouteError {
	w.Header().Set("Content-Type", "application/json")
	err := r.ParseForm()
	if err != nil {
		return PreErrorJS("Bad Form", w, r)
	}

	action := r.FormValue("action")
	if action != "get" && action != "set" {
		return PreErrorJS("Invalid Action", w, r)
	}

	module := r.FormValue("module")
	switch module {
	case "dismiss-alert":
		asid, err := strconv.Atoi(r.FormValue("asid"))
		if err != nil {
			return PreErrorJS("Invalid asid", w, r)
		}

		_, err = stmts.deleteActivityStreamMatch.Exec(user.ID, asid)
		if err != nil {
			return InternalError(err, w, r)
		}
	case "alerts": // A feed of events tailored for a specific user
		if !user.Loggedin {
			w.Write(phraseLoginAlerts)
			return nil
		}

		var msglist, event, elementType string
		var asid, actorID, targetUserID, elementID int
		var msgCount int

		err = stmts.getActivityCountByWatcher.QueryRow(user.ID).Scan(&msgCount)
		if err == ErrNoRows {
			return PreErrorJS("Couldn't find the parent topic", w, r)
		} else if err != nil {
			return InternalErrorJS(err, w, r)
		}

		rows, err := stmts.getActivityFeedByWatcher.Query(user.ID)
		if err != nil {
			return InternalErrorJS(err, w, r)
		}
		defer rows.Close()

		for rows.Next() {
			err = rows.Scan(&asid, &actorID, &targetUserID, &event, &elementType, &elementID)
			if err != nil {
				return InternalErrorJS(err, w, r)
			}
			res, err := buildAlert(asid, event, elementType, actorID, targetUserID, elementID, user)
			if err != nil {
				return LocalErrorJS(err.Error(), w, r)
			}
			msglist += res + ","
		}

		err = rows.Err()
		if err != nil {
			return InternalErrorJS(err, w, r)
		}

		if len(msglist) != 0 {
			msglist = msglist[0 : len(msglist)-1]
		}
		_, _ = w.Write([]byte(`{"msgs":[` + msglist + `],"msgCount":` + strconv.Itoa(msgCount) + `}`))
		//log.Print(`{"msgs":[` + msglist + `],"msgCount":` + strconv.Itoa(msgCount) + `}`)
	//case "topics":
	//case "forums":
	//case "users":
	//case "pages":
	// This might not be possible. We might need .xml paths for sitemaps
	/*case "sitemap":
	if format != "xml" {
		PreError("You can only fetch sitemaps in the XML format!",w,r)
		return
	}*/
	default:
		return PreErrorJS("Invalid Module", w, r)
	}
	return nil
}