<?php

if ( ! @include_once( './mainfile.php' ) ) { exit( '!! INCLUDE ERROR. ACCESS DENIED !!' ); }
error_reporting( _E_VALUE );


/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | myPHPNuke Version 188_8 RC2                                          |
// +----------------------------------------------------------------------+
// | License: GNU/GPL - http://www.gnu.org/copyleft/gpl.html              |
// +----------------------------------------------------------------------+
// | Support: http://myphpnuke.com/                                       |
// +----------------------------------------------------------------------+
// | Author: myPHPNuke Dev Team                                           |
// +----------------------------------------------------------------------+
// | Copyright: © 2001-2004 myPHPNuke Dev Team                            |
// +----------------------------------------------------------------------+
// $Id: pollcomments.php,v 1.19.2.6 2004/08/27 16:02:54 kirilt Exp $




/************************************************************************/
/* PHP-NUKE: Web Portal System                                          */
/* ===========================                                          */
/*                                                                      */
/* Copyright (c) 2001 by Francisco Burzi (fburzi@ncc.org.ve)            */
/* http://phpnuke.org                                                   */
/*                                                                      */
/* This program is free software. You can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 2 of the License.       */
/************************************************************************/

/*if ( _MPN_USER )
{
    $tmp = cookiedecode();

    if ( $tmp[10] > $commentlimit )
    {
        $commentlimit = $tmp[10];
    }
    unset( $tmp );
}
*/
$commentlimit = $GLOBALS['uinf'][10];

function modone()
{
    global $moderate,$phpEx;

    if ( ( _MPN_ADMIN && $moderate == 1 ) || ( _MPN_USER && $moderate == 2 ) )
    {
        echo "<form class='t-left' action=\"pollcomments.$phpEx\" method=\"post\">";
    }
}

function modtwo($tid, $score, $reason)
{
    global $moderate, $reasons;

   if ( ( _MPN_ADMIN && $moderate == 1 ) || ( _MPN_USER && $moderate == 2 ) )
   {
        echo " | <select name=dkn$tid>";

        for($i=0; $i<sizeof($reasons); $i++)
        {
            echo "<option value=\"$score:$i\">$reasons[$i]</option>\n";
        }

        echo "</select>";
    }
}

function modthree($pollID, $mode = 'thread', $order = 0, $thold=0)
{
    global $moderate, $uimages;


    if ( ( _MPN_ADMIN && $moderate == 1 ) || ( _MPN_USER && $moderate == 2 ) )
    {
        echo "<input type=hidden name=pollID value=$pollID><input type=hidden name=mode value=$mode><input type=hidden name=order value=$order><input type=hidden name=thold value=$thold>
            <input type=hidden name=op value=moderate>
            <input class=\"button\" type=\"submit\" value=\"" . translate('Moderate') . "\"></form>";
    }
}


function navbar( $pollID, $title, $thold=0, $mode="thread", $order=0 )
{
    global $mpnTables,$phpEx;
    global $bgcolor1, $bgcolor2, $textcolor1, $textcolor2;

    $query = mysql_query("select pollID FROM ".$mpnTables['pollcomments']." where pollID=$pollID");

    $count = ( ! $query ) ? ( 0 ) : ( mysql_num_rows( $query ) );

    $result = mysql_query("select pollTitle from ".$mpnTables['poll_desc']." where pollID=$pollID");

    list( $title ) = mysql_fetch_row( $result);
    echo "<table border='0' cellspacing='1' cellpadding='2' summary=''>\n";

    if( $title )
    {
        echo "<tr><td bgcolor=\"$bgcolor2\" align='center'><font size=1 color=\"$textcolor1\">\"$title\" | ";

        if( _MPN_USER )
        {
                echo "<a href='user.php'>".translate("Configure")."</a>";
        } else {
                echo "<a href='user.php'>".translate("Login/Create Account")."</a>";
        }

        if(( $count == 1) )
        {
        echo " | <B>$count</B> ".translate("comment")."</font>";
        } else {
        echo " | <B>$count</B> ".translate("comment")."s</font>";
        }

        echo "</td></tr>\n";
    } ?>

   <tr><td bgcolor="<?php echo"$bgcolor1"; ?>" align="center">
    <?php echo "<form method=\"get\" action=\"." . $_SERVER['PHP_SELF'] . "\">"; ?>
    <input type="hidden" name="op" value=<?php echo $_REQUEST['op']; ?> />
    <font color="<?php echo"$textcolor2"; ?>"><?php echo translate("Threshold"); ?></font>
    <select name=thold>
    <option value="-1" <?php if ($thold == -1) { echo "selected=\"selected\""; } ?>>-1</option>
    <option value="0" <?php if ($thold == 0) { echo "selected=\"selected\""; } ?>>0</option>
    <option value="1" <?php if ($thold == 1) { echo "selected=\"selected\""; } ?>>1</option>
    <option value="2" <?php if ($thold == 2) { echo "selected=\"selected\""; } ?>>2</option>
    <option value="3" <?php if ($thold == 3) { echo "selected=\"selected\""; } ?>>3</option>
    <option value="4" <?php if ($thold == 4) { echo "selected=\"selected\""; } ?>>4</option>
    <option value="5" <?php if ($thold == 5) { echo "selected=\"selected\""; } ?>>5</option>
    </select>

    <select name=mode>

    <option value="nocomments" <?php if ($mode == 'nocomments') { echo "selected=\"selected\""; } ?>><?php echo translate("No Comments"); ?></option>
    <option value="nested" <?php if ($mode == 'nested') { echo "selected=\"selected\""; } ?>>
    <?php echo translate("Nested"); ?></option>
    <option value="flat" <?php if ($mode == 'flat') { echo "selected=\"selected\""; } ?>><?php echo translate("Flat"); ?></option>
    <option value="thread" <?php if (!isset($mode) || $mode=='thread' || $mode=="") { echo "selected=\"selected\""; } ?>><?php echo translate("Thread"); ?></option>

    </select>

    <select name=order>

   <option value="0" <?php if (!$order) { echo "selected=\"selected\""; } ?>><?php echo translate("Oldest First"); ?></option>
   <option value="1" <?php if ($order==1) { echo "selected=\"selected\""; } ?>><?php echo translate("Newest First"); ?></option>
   <option value="2" <?php if ($order==2) { echo "selected=\"selected\""; } ?>><?php echo translate("Highest Scores First"); ?></option>

   </select>
    <input class='button' type=submit value=<?php echo translate("Refresh"); ?> />
    <input type=hidden name=pollID value=<?php echo "$pollID"; ?> />

    </form>

    </td></tr><tr><td bgcolor="<?php echo"$bgcolor2"; ?>" align=center>

    <font size=1><?php echo translate("The comments are owned by the poster. We aren't responsible for their content."); ?>
    </font></td></tr></table><?php

    echo "<br /><br />\n";
}

function DisplayKids ($tid, $mode, $order=0, $thold=0, $level=0, $dummy=0, $tblwidth=99)
{
    global $datetime, $bgcolor1, $reasons, $anonymous, $anonpost, $commentlimit;
    global $mpnTables,$phpEx, $bgcolor2, $textcolor1;
    $comments = 0;

    $result = mysql_query("select tid, pid, pollID, date, name, email, url, host_name, subject, comment, score, reason from ".$mpnTables['pollcomments']." where pid = $tid order by date, tid");
    if ($mode == 'nested')
    {
        /* without the tblwidth variable, the tables run of the screen with netscape
           in nested mode in long threads so the text can't be read. */
        while (list($r_tid, $r_pid, $r_pollID, $r_date, $r_name, $r_email, $r_url, $r_host_name, $r_subject, $r_comment, $r_score, $r_reason) = mysql_fetch_row($result)) {

            // Kiril: New Sanitizer

            $sanity_ary = compact( 'r_subject', 'r_comment' );
            $_SERVER['SAN'] -> slashIT( $sanity_ary );
            extract( $sanity_ary );

            $_SERVER['SAN'] -> adjustFormat( $r_comment, 3, 10 );
            unset( $sanity_ary );

            // End New Saintizer

            if($r_score >= $thold) {
                if (!isset($level)) {
                } else {
                    if (!$comments) {
                        //echo "<ul>";
                        $tblwidth -= 5;
                    }
                }
                $comments++;
                if (!eregi("[a-z0-9]",$r_name)) $r_name = $anonymous;
                if (!eregi("[a-z0-9]",$r_subject)) $r_subject = "[".translate("No Subject")."]";
            // enter hex color between first two appostrophe for second alt bgcolor
                $r_bgcolor = ($dummy%2)?"":$bgcolor2;

                echo "<a name=\"$r_tid\">";
                echo "<table width=90% border=0><tr bgcolor=\"$r_bgcolor\"><td>";

                formatTimestamp($r_date);

                if ($r_email && $r_email != '')
                {
                    echo "<b>$r_subject</b>";

                    if( !isset( $GLOBALS['uinf'][7] ) )
                    {
                        echo "(".translate("Score: ")."$r_score";

                        if($r_reason>0) echo ", $reasons[$r_reason]";

                        echo ")";
                    }

                    echo "<br />".translate("by")." <a href=\"mailto:$r_email\">$r_name</a> <b>($r_email)</b> ".translate("on")." $datetime";

                } else {
                    echo "<b>$r_subject</b> ";
                    if(!isset($GLOBALS['uinf'][7])) {
                        echo "(".translate("Score: ")."$r_score";
                        if($r_reason>0) echo ", $reasons[$r_reason]";
                        echo ")";
                    }
                    echo "<br />".translate("by")." $r_name ".translate("on")." $datetime";
                }

                if ($r_name != $anonymous)
                {
                    echo "<br />(<a href=\"user.$phpEx?op=userinfo&uname=$r_name\">".translate("User Info")."</a>) ";
                }

                if (eregi("http://",$r_url)) { echo "<a href=\"$r_url\" target=\"window\">$r_url</a> "; }
                echo "</td></tr><tr><td>";

                if ( strlen( $r_comment ) > $commentlimit )
                {
                    $c_pos = strpos( $r_comment, '</', $commentlimit );
                    $c_delim = strpos( $r_comment, '>', $c_pos );

                    $endpos = ( (bool)FALSE !== ( $c_delim = strpos( $r_comment, '>', $c_pos ) ) ) ? ( $c_delim ) : ( $commentlimit );

                     echo substr( $r_comment, 0, $endpos )."<br /><br /><b><a href=\"pollcomments.$phpEx?pollID=$r_pollID&tid=$r_tid&mode=$mode&order=$order&thold=$thold\">".translate("Read the rest of this comment...")."</a></b>";
                }
                else
                {
                    echo $r_comment;
                }

                echo "</td></tr></table>";

                echo "<div class='indent15'>\n";

                    if ($anonpost == 1 || _MPN_ADMIN || _MPN_USER )
                    {
                        echo "[ <a href=\"pollcomments.$phpEx?op=Reply&pid=$r_tid&pollID=$r_pollID&mode=$mode&order=$order&thold=$thold\">".translate("Reply")."</a>";
                    }
                    modtwo($r_tid, $r_score, $r_reason);

                    echo " ]";

                    echo "<br /><br />\n";

                    DisplayKids($r_tid, $mode, $order, $thold, $level+1, $dummy+1, $tblwidth);

                echo "</div>\n";


            }
        }
    } elseif ($mode == 'flat') {
        while (list($r_tid, $r_pid, $r_pollID, $r_date, $r_name, $r_email, $r_url, $r_host_name, $r_subject, $r_comment, $r_score, $r_reason) = mysql_fetch_row($result)) {

            // Kiril: New Sanitizer

            $sanity_ary = compact( 'r_subject', 'r_comment' );
            $_SERVER['SAN'] -> slashIT( $sanity_ary );
            extract( $sanity_ary );

            $_SERVER['SAN'] -> adjustFormat( $r_comment, 3, 10 );
            unset( $sanity_ary );

            // End New Saintizer

            if($r_score >= $thold) {
                if (!eregi("[a-z0-9]",$r_name)) $r_name = $anonymous;
                if (!eregi("[a-z0-9]",$r_subject)) $r_subject = "[".translate("No Subject")."]";
                echo "<a name=\"$r_tid\">";
                echo "<hr><table width=99% border=0><tr bgcolor=\"$bgcolor1\"><td>";
                formatTimestamp($r_date);
                if ($r_email && $r_email != '' ) {
                    echo "<b>$r_subject</b> ";
                    if(!isset($GLOBALS['uinf'][7])) {
                        echo "(".translate("Score: ")."$r_score";
                        if($r_reason>0) echo ", $reasons[$r_reason]";
                        echo ")";
                    }
                    echo "<br />".translate("by")." <a href=\"mailto:$r_email\">$r_name</a> <b>($r_email)</b> ".translate("on")." $datetime";
                 } else {
                    echo "<b>$r_subject</b> ";
                    if(!isset($GLOBALS['uinf'][7])) {
                        echo "(".translate("Score: ")."$r_score";
                        if($r_reason>0) echo ", $reasons[$r_reason]";
                        echo ")";
                    }
                    echo "<br />".translate("by")." $r_name ".translate("on")." $datetime";
                }
                if ($r_name != $anonymous) { echo "<br />(<a href=\"user.$phpEx?op=userinfo&uname=$r_name\">".translate("User Info")."</a>) "; }
                if (eregi("http://",$r_url)) { echo "<a href=\"$r_url\" target=\"window\">$r_url</a> "; }
                echo "</td></tr><tr><td>";


                if ( strlen( $r_comment ) > $commentlimit )
                {
                    $c_pos = strpos( $r_comment, '</', $commentlimit );
                    $c_delim = strpos( $r_comment, '>', $c_pos );

                    $endpos = ( (bool)FALSE !== ( $c_delim = strpos( $r_comment, '>', $c_pos ) ) ) ? ( $c_delim ) : ( $commentlimit );

                     echo substr( $r_comment, 0, $endpos )."<br /><br /><b><a href=\"pollcomments.$phpEx?pollID=$r_pollID&tid=$r_tid&mode=$mode&order=$order&thold=$thold\">".translate("Read the rest of this comment...")."</a></b>";
                }
                else
                {
                    echo $r_comment;
                }

                echo "</td></tr></table>\n";

                echo "<div class='indent15'>\n";

                    echo "[ <a href=\"pollcomments.$phpEx?op=Reply&pid=$r_tid&pollID=$r_pollID&mode=$mode&order=$order&thold=$thold\">".translate("Reply")."</a>";

                    modtwo($r_tid, $r_score, $r_reason);

                    echo " ]";

                    echo "<br /><br />\n";

                    DisplayKids($r_tid, $mode, $order, $thold);

                echo "</div>\n";
            }
        }
    } else {
        while (list($r_tid, $r_pid, $r_pollID, $r_date, $r_name, $r_email, $r_url, $r_host_name, $r_subject, $r_comment, $r_score, $r_reason) = mysql_fetch_row($result)) {

            // Kiril: New Sanitizer

            $sanity_ary = compact( 'r_subject', 'r_comment' );
            $_SERVER['SAN'] -> slashIT( $sanity_ary );
            extract( $sanity_ary );

            $_SERVER['SAN'] -> adjustFormat( $r_comment, 3, 10 );
            unset( $sanity_ary );

            // End New Saintizer


            if($r_score >= $thold)
            {

                /*if (!isset($level)) {
                } else {
                    if (!$comments) {
                        echo "<ul>";
                    }
                }*/

                $comments++;

                if (!eregi("[a-z0-9]",$r_name)) $r_name = $anonymous;
                if (!eregi("[a-z0-9]",$r_subject)) $r_subject = "[".translate("No Subject")."]";

                formatTimestamp($r_date);

                echo "<div class='indent15'>\n";

                    echo "<ul><li><a href=\"pollcomments.$phpEx?op=showreply&tid=$r_tid&pollID=$r_pollID&pid=$r_pid&mode=$mode&order=$order&thold=$thold#$r_tid\">$r_subject</a> ".translate("by")." $r_name ".translate("on")." $datetime</li></ul>";

                    echo "<br /><br />\n";

                    DisplayKids($r_tid, $mode, $order, $thold, $level+1, $dummy+1);

                echo "</div>\n";
            }
        }
    }

    /*if ($level && $comments) {
        echo "</ul>";
    }*/

}

function DisplayBabies ($tid, $level=0, $dummy=0) {
    global $datetime, $anonymous, $mpnTables,$phpEx;
    $comments = 0;
    $result = mysql_query("select tid, pid, pollID, date, name, email, url, host_name, subject, comment, score, reason from ".$mpnTables['pollcomments']." where pid = $tid order by date, tid");
    while (list($r_tid, $r_pid, $r_pollID, $r_date, $r_name, $r_email, $r_url, $r_host_name, $r_subject, $r_comment, $r_score, $r_reason) = mysql_fetch_row($result))
    {
        // Kiril: New Sanitizer

        $sanity_ary = compact( 'r_subject', 'r_comment' );
        $_SERVER['SAN'] -> slashIT( $sanity_ary );
        extract( $sanity_ary );

        $_SERVER['SAN'] -> adjustFormat( $r_comment, 3, 10 );
        unset( $sanity_ary );

        // End New Saintizer


        /*if (!isset($level)) {
        } else {
            if (!$comments) {
                echo "<ul>";
            }
        }*/

        $comments++;

        if (!eregi("[a-z0-9]",$r_name)) { $r_name = $anonymous; }
        if (!eregi("[a-z0-9]",$r_subject)) { $r_subject = "[".translate("No Subject")."]"; }

        formatTimestamp($r_date);

        echo "<br /><br />\n";

        echo "<ul><li><a href=\"pollcomments.$phpEx?op=showreply&tid=$r_tid&mode=$mode&order=$order&thold=$thold\">$r_subject</a> ".translate("by")." $r_name ".translate("on")." $datetime</li></ul>";

        echo "<br /><br />\n";

        DisplayBabies($r_tid, $level+1, $dummy+1);
    }

    /*if ($level && $comments) {
        echo "</ul>";
    }*/
}

function DisplayTopic ($pollID, $pid=0, $tid=0, $mode="thread", $order=0, $thold=0, $level=0, $nokids=0) {
    global $hr, $datetime, $commentlimit, $anonymous, $reasons, $anonpost, $foot1, $foot2, $foot3, $foot4;
    global $mpnTables,$phpEx, $bgcolor1;

    // trini0 [09-18-2003]: Im reaching here, hope its ok...

    $count_times = 0;

    $q = "select tid, pid, pollID, date, name, email, url, host_name, subject, comment, score, reason from ".$mpnTables['pollcomments']." where pollID=$pollID and pid=$pid";
    if($thold != "") {
        $q .= " and score>=$thold";
    } else {
        $q .= " and score>=0";
    }
    if ($order==1) $q .= " order by date desc";
    if ($order==2) $q .= " order by score desc";
    $something = mysql_query("$q");
    $num_tid = mysql_num_rows($something);
        if (!isset($title))
        {
            $title = null;
        }

    if ($pid != 0)
    {
        include_once("header.$phpEx");
    }

    navbar($pollID, $title, $thold, $mode, $order);

    //OpenTable();

    modone();
    while ($count_times < $num_tid) {
        list($tid, $pid, $pollID, $date, $name, $email, $url, $host_name, $subject, $comment, $score, $reason) = mysql_fetch_row($something);

        // Kiril: New Sanitizer

        $sanity_ary = compact( 'subject', 'comment' );
        $_SERVER['SAN'] -> slashIT( $sanity_ary );
        extract( $sanity_ary );

        $_SERVER['SAN'] -> adjustFormat( $comment, 3, 10 );
        unset( $sanity_ary );

        // End New Saintizer

        if ($name == "") { $name = $anonymous; }
        if ($subject == "") { $subject = "[".translate("No Subject")."]"; }

        echo "<a name=\"$tid\">";
        echo "<table width=99% border=0><tr bgcolor=\"$bgcolor1\"><td width=500>";
        formatTimestamp($date);
        if ($email && $email != '') {
            echo "<b>$subject</b> ";
            if(!isset($GLOBALS['uinf'][7])) {
                echo "(".translate("Score: ")."$score";
                if($reason>0) echo ", $reasons[$reason]";
                echo ")";
            }
            echo "<br />".translate("by")." <a href=\"mailto:$email\">$name</a> <b>($email)</b> ".translate("on")." $datetime";
        } else {
            echo "<b>$subject</b> ";
            if(!isset($GLOBALS['uinf'][7])) {
                echo "(".translate("Score: ")."$score";
                if($reason>0) echo ", $reasons[$reason]";
                echo ")";
            }
            echo "<br />".translate("by")." $name ".translate("on")." $datetime";
        }

    // If you are admin you can see the Poster IP address (you have this right, no?)
    // with this you can see who is flaming you... ha-ha-ha

        if ($name != $anonymous) { echo "<br />(<a href=\"user.$phpEx?op=userinfo&uname=$name\">".translate("User Info")."</a>) "; }
        if (eregi("http://",$url)) { echo "<a href=\"$url\" target=\"window\">$url</a> "; }

        if( _MPN_ADMIN ) {
            $result= mysql_query("select host_name from ".$mpnTables['pollcomments']." where tid='$tid'");
            list($host_name) = mysql_fetch_row($result);
            echo "<br /><b>(IP: $host_name)</b>";
        }

        echo "</td></tr><tr><td>";

        if ( strlen( $comment ) > $commentlimit )
        {
            $c_pos = strpos( $comment, '</', $commentlimit );
            $c_delim = strpos( $comment, '>', $c_pos );

            $endpos = ( (bool)FALSE !== ( $c_delim = strpos( $comment, '>', $c_pos ) ) ) ? ( $c_delim ) : ( $commentlimit );

             echo substr( $comment, 0, $endpos )."<br /><br /><b><a href=\"pollcomments.$phpEx?pollID=$pollID&tid=$tid&mode=$mode&order=$order&thold=$thold\">".translate("Read the rest of this comment...")."</a></b>";
        }
        else
        {
            echo $comment;
        }

        echo "</td></tr></table>";

        echo "<div class='indent15'>\n";

            if ( $anonpost == 1 || _MPN_ADMIN || _MPN_USER )
            {
                echo "[ <a href=\"pollcomments.$phpEx?op=Reply&pid=$tid&pollID=$pollID&mode=$mode&order=$order&thold=$thold\">".translate("Reply")."</a>";
            }
            else
            {
                echo "[ " .translate("No Comments Allowed for Anonymous, please <a href='user.php'>register</a>")." ";
            }

            if ($pid != 0)
            {
                list($erin) = mysql_fetch_row(mysql_query("select pid from ".$mpnTables['pollcomments']." where tid=$pid"));
                echo "| <a href=\"pollbooth.$phpEx?op=results&pollID=$pollID&pid=$erin&mode=$mode&order=$order&thold=$thold\">".translate("Parent")."</a>";
            }

            modtwo($tid, $score, $reason);


            if( _MPN_ADMIN )
            {
            echo " | <a href=\"admin.$phpEx?op=RemovePollComment&tid=$tid&pollID=$pollID\">".translate("Delete")."</a> ]</font>";
            } else {
                echo " ]";
            }

            echo "<br /><br />\n";



            DisplayKids($tid, $mode, $order, $thold, $level);



        //echo "</ul>";
        if($hr) echo "<hr noshade size=1>";

        $count_times += 1;
    }

    modthree($pollID, $mode, $order, $thold);

    echo "</div>\n";

    if (!isset($subject))
    {
        $subject = null;
    }

    //CloseTable();

    if ( $pid==0 )
    {
        return array($pollID, $pid, $subject);
    }
    else
    {
        include("footer.$phpEx");
    }
}

function singlecomment($tid, $pollID, $mode, $order, $thold) {
    global $phpEx;
//  include_once("mainfile.$phpEx");
    include("header.$phpEx");
    OpenTable();
    global $datetime, $bgcolor1, $bgcolor2, $bgcolor3, $anonpost, $anonymous;
    global $mpnTables, $textcolor1;
    $deekayen = mysql_query("select date, name, email, url, subject, comment, score, reason from ".$mpnTables['pollcomments']." where tid=$tid and pollID=$pollID");
    list($date, $name, $email, $url, $subject, $comment, $score, $reason) = mysql_fetch_row($deekayen);

    // Kiril: New Sanitizer

    $sanity_ary = compact( 'subject', 'comment' );
    $_SERVER['SAN'] -> slashIT( $sanity_ary );
    extract( $sanity_ary );

    $_SERVER['SAN'] -> adjustFormat( $comment, 3, 10 );
    unset( $sanity_ary );

    // End New Saintizer


    $titlebar = "<b>$subject</b>";
    if($name == "") $name = $anonymous;
    if($subject == "") $subject = "[".translate("No Subject")."]";
    modone();
    echo "<table width=99% border=0><tr bgcolor=\"$bgcolor1\"><td width=500>";
    formatTimestamp($date);
    if($email && $email != '') echo "<b>$subject</b> (".translate("Score: ")."$score)<br />".translate("by")." <a href=\"mailto:$email\">$name</a> <b>($email)</b></font> ".translate("on")." $datetime";
    else echo "<b>$subject</b> (".translate("Score: ")."$score)<br />".translate("by")." $name ".translate("on")." $datetime";

    echo "</td></tr><tr><td>$comment</td></tr></table>\n";

    echo "<br /><br />\n";

    echo "[ <a href=\"pollcomments.$phpEx?op=Reply&pid=$tid&pollID=$pollID&mode=$mode&order=$order&thold=$thold\">".translate("Reply")."</a> | <a href=\"pollBooth.$phpEx?op=results&pollID=$pollID&mode=$mode&order=$order&thold=$thold\">Root</a>";

    modtwo($tid, $score, $reason);

    echo " ]";

    echo "<br /><br />\n";

    modthree($pollID, $mode, $order, $thold);

    CloseTable();

    include("footer.$phpEx");
}

function reply ($pid, $pollID, $mode, $order, $thold)
{
    global $phpEx, $AllowableHTML, $anonymous, $bgcolor1, $bgcolor2, $textcolor1;

    include("header.$phpEx");
    OpenTable();

    global $mpnTables;

        $date = $temp_comment = $comment = $notes = null;

    if($pid!=0)
    {
        list($date, $name, $email, $url, $subject, $comment, $score) = mysql_fetch_row(mysql_query("select date, name, email, url, subject, comment, score from ".$mpnTables['pollcomments']." where tid=$pid"));

        $sanity_ary = compact( 'subject', 'comment' );

    } else {
        list($subject) = mysql_fetch_row(mysql_query("select pollTitle FROM ".$mpnTables['poll_desc']." where pollID=$pollID"));

        $sanity_ary = compact( 'temp_comment', 'comment', 'notes' );

        }

        // Kiril: New Sanitizer

        $_SERVER['SAN'] -> slashIT( $sanity_ary );
        extract( $sanity_ary );

        $prev_comment = $comment;
        $_SERVER['SAN'] -> adjustFormat( $prev_comment, 3, 10 );

        // End New Saintizer


    if(isset( $comment ) && $comment == "") $comment = $temp_comment;
    $titlebar = "<b>$subject</b>";
    if(isset($name) && $name == "") $name = $anonymous;
    if($subject == "") $subject = "[".translate("No Subject")."]";
    echo "<table width=99% border=0><tr bgcolor=\"$bgcolor1\"><td>";
    formatTimestamp($date);
    echo "<b>$subject</b>";
    echo "</td></tr><tr><td><br />$temp_comment $prev_comment $notes</td></tr></table><hr>";

    if(!isset($pid) || !isset($pollID)) { echo "Something is not right. This message is just to keep things from messing up down the road"; exit(); }
    if($pid == 0) {
        list($subject) = mysql_fetch_row(mysql_query("select pollTitle from ".$mpnTables['poll_desc']." where pollID=$pollID"));
    } else {
        list($subject) = mysql_fetch_row(mysql_query("select subject from ".$mpnTables['pollcomments']." where tid=$pid"));
    }

    $subject = stripslashes( $subject );

    echo "<form action=\"pollcomments.$phpEx\" method=post>";
    echo "<FONT color=\"$textcolor1\"><B>".translate("Your Name")."</B></FONT> ";
    if ( _MPN_USER )
    {
        echo "<a href='user.php'>" . $GLOBALS['uinf'][1] . "</a> [ <a href=\"user.$phpEx?op=logout\">".translate("Logout")."</a> ]";
    } else {
        echo "$anonymous"; $xanonpost=1;
    }

    echo "<br /><br />\n";

    echo "<FONT color=\"$textcolor1\"><B>".translate("Subject")."</B></FONT><br />";
    if (!eregi("Re:",$subject)) $subject = "Re: $subject";
    echo "<INPUT class=textbox TYPE=\"text\" NAME=\"subject\" SIZE=50 maxlength=60 value=\"$subject\"><br /><br />";
    echo "<FONT color=\"$textcolor1\"><B>".translate("Comment")."</B><br />"
        ."<TEXTAREA class=textbox wrap=virtual cols=70 rows=20 name=comment></TEXTAREA><br />\n";


/*        <font size=2>".translate("Allowed HTML:")."<br />";
        while (list($key,)= each($AllowableHTML)) echo " &lt;".$key."&gt;";*/


        echo "<br />";
    if ( _MPN_USER ) { echo "<INPUT type=checkbox name=xanonpost> ".translate("Post Anonymously")."<br />"; }

    // Kiril: New Sanitizer

    addFormatOption();

    echo "<input type='hidden' name='clickit_form' value='comment' />\n";
    echo "<input type='hidden' name='stripit_form' value='subject' />\n";
    echo "<input type='hidden' name='mpn_sectype' value='1' />\n";

    // End Sanitizer


    echo "<INPUT type=\"hidden\" name=\"pid\" value=\"$pid\">"
        ."<INPUT class=textbox type=\"hidden\" name=\"pollID\" value=\"$pollID\"><INPUT type=\"hidden\" name=\"mode\" value=\"$mode\">"
        ."<INPUT class=textbox type=\"hidden\" name=\"order\" value=\"$order\"><INPUT type=\"hidden\" name=\"thold\" value=\"$thold\">"
        ."<INPUT class='button' type=submit name=op value=\"" . translate("Preview") . "\"> "
        ."<INPUT class='button' type=submit name=op value=\"" . translate("Ok!") . "\">\n";

         /*<SELECT name=\"posttype\"><OPTION value=\"exttrans\">".translate("Extrans (html tags to text)")."<OPTION value=\"html\" >".translate("HTML Formatted")."<OPTION value=\"plaintext\" SELECTED>".translate("Plain Old Text")."</SELECT>*/

         echo "</FORM><br />";

        CloseTable();
    include("footer.$phpEx");
}

function replyPreview ($pid, $pollID, $subject, $comment, $xanonpost, $mode, $order, $thold, $posttype) {
    global $phpEx, $bgcolor2, $AllowableHTML, $textcolor1;

    include("header.$phpEx");
    OpenTable();
    global $anonymous;

    // Kiril: New Sanitizer

    $prev_comment = $comment;
    $_SERVER['SAN'] -> adjustFormat( $prev_comment, 3, 10 );

    // End New Saintizer


    if (!isset($pid) || !isset($pollID)) { echo "Something is not right with passing a variable to this function. This message is just to keep things from messing up down the road"; exit(); }

    echo "<table width=99% border=0><tr><td>";
    echo "<b>$subject</b>";
    echo "<br />".translate("by")." ";
    if ( _MPN_USER ) echo $GLOBALS['uinf'][1];
    else echo $anonymous;
    echo "".translate(" on...")."</td></tr><tr><td>";

/*  if($posttype=="exttrans") echo nl2br(htmlspecialchars($comment));
    elseif($posttype=="plaintext") echo nl2br($comment);else*/


    echo $prev_comment;

    echo "</td></tr></table><br />";

    echo "<hr>";

    echo "<form action=\"pollcomments.$phpEx\" method=post><FONT color=\"$textcolor1\"><B>".translate("Your Name")."</B></FONT> ";
    if ( _MPN_USER ) echo "<a href='user.php'>" . $GLOBALS['uinf'][1] . "</a> [ <a href=\"user.$phpEx?op=logout\">".translate("Logout")."</a> ]";
    else echo "$anonymous";

    echo "<br /><br />\n";

    echo "<FONT color=\"$textcolor1\"><B>".translate("Subject")."</B></FONT><br />"
        ."<INPUT class=textbox TYPE=\"text\" NAME=\"subject\" SIZE=50 maxlength=60 value=\"$subject\"><br /><br />"
        ."<FONT color=\"$textcolor1\"><B>".translate("Comment")."</B></FONT><br />"
       ."<TEXTAREA class=textbox wrap=virtual cols=70 rows=20 name=comment>$comment</TEXTAREA><br /><br />";
        /*echo"<font size=2>".translate("Allowed HTML:")."<br />";
        while (list($key,)= each($AllowableHTML)) echo " &lt;".$key."&gt;";*/
        echo "<br />";
        if ($xanonpost)
        {
            echo "<INPUT type=checkbox name=xanonpost checked> ".translate("Post Anonymously")."<br />";
        }
        elseif ( _MPN_USER )
        {
            echo "<INPUT type=checkbox name=xanonpost> ".translate("Post Anonymously")."<br />";
        }

        // Kiril: New Sanitizer

        addFormatOption();

        echo "<input type='hidden' name='clickit_form' value='comment' />\n";
        echo "<input type='hidden' name='stripit_form' value='subject' />\n";
        echo "<input type='hidden' name='mpn_sectype' value='1' />\n";

        // End Sanitizer

    echo "<INPUT type=\"hidden\" name=\"pid\" value=\"$pid\">"
        ."<INPUT type=\"hidden\" name=\"pollID\" value=\"$pollID\"><INPUT type=\"hidden\" name=\"mode\" value=\"$mode\">"
        ."<INPUT type=\"hidden\" name=\"order\" value=\"$order\"><INPUT type=\"hidden\" name=\"thold\" value=\"$thold\">"
        ."<INPUT class='button' type=submit name=op value=\"Preview\"> "
        ."<INPUT class='button' type=submit name=op value=\"Ok!\">\n";

        /*<SELECT name=\"posttype\"><OPTION value=\"exttrans\"";
        if($posttype=="exttrans") echo" SELECTED";
        echo  ">".translate("Extrans (html tags to text)")."<OPTION value=\"html\"";;
        if($posttype=="html") echo" SELECTED";
        echo ">".translate("HTML Formatted")."<OPTION value=\"plaintext\"";
        if(($posttype!="exttrans") && ($posttype!="html")) echo" SELECTED";
        echo ">".translate("Plain Old Text")."</SELECT>*/

        echo "</FORM><br />";
    CloseTable();
    include("footer.$phpEx");
}

function CreateTopic ($xanonpost, $subject, $comment, $pid, $pollID, $host_name, $mode, $order, $thold, $posttype) {

    global $EditedMessage, $adminmail, $mpn_new_pollcomment_notify, $sitename;
    global $mpnTables, $phpEx, $smtp, $mailmethod;

    // Kiril: Start Sanitizer

    $sanity_ary = compact( 'subject', 'comment' );
    $_SERVER['SAN'] -> slashIT( $sanity_ary, TRUE );
    extract( $sanity_ary );
    unset( $sanity_ary );

    // End Sanitizer

    if ( _MPN_USER && (!$xanonpost))
    {
        $name = $GLOBALS['uinf']["uname"];
        $email = $GLOBALS['uinf']["femail"];
        $url = $GLOBALS['uinf']["url"];
        $score = 1;
    } else {
        $name = ""; $email = ""; $url = "";
        $score = 0;
    }

    $ip = getenv("REMOTE_HOST");
    if (empty($ip)) {
        $ip = getenv("REMOTE_ADDR");
    }
//begin fake thread control
    list($fake) = mysql_fetch_row(mysql_query("select count(*) from ".$mpnTables['poll_desc']." where pollID=$pollID"));
    mysql_query("LOCK TABLES pollcomments WRITE");
//begin duplicate control
    list($tia) = mysql_fetch_row(mysql_query("select count(*) from ".$mpnTables['pollcomments']." where pid='$pid' and pollID='$pollID' and subject='$subject' and comment='$comment'"));
//begin troll control
    if( _MPN_USER )
    {
        list($troll) = mysql_fetch_row(mysql_query("select count(*) from ".$mpnTables['pollcomments']." where (score=-1) and (name='" . $GLOBALS['uinf']['uname'] . "') and (to_days(now()) - to_days(date) < 3)"));
    } elseif(!$score) {
        list($troll) = mysql_fetch_row(mysql_query("select count(*) from ".$mpnTables['pollcomments']." where (score=-1) and (host_name='$ip') and (to_days(now()) - to_days(date) < 3)"));
    }
    if((!$tia) && ($fake == 1) && ($troll < 6)) {
        mysql_query("insert into ".$mpnTables['pollcomments']." values (NULL, '$pid', '$pollID', now(), '$name', '$email', '$url', '$ip', '$subject', '$comment', '$score', '0')");
    } else {
        mysql_query("UNLOCK TABLES");
        include("header.$phpEx");
        OpenTable();
        if($tia) echo "Duplicate.  Did you submit twice?<br /><br /><a href=\"pollBooth.$phpEx?op=results&pollID=$pollID\">Back to Poll</a>";
        elseif($troll > 5) echo "This account or IP has been temporarily disabled.
                This means that either this IP, or
                user account has been moderated down more than 5 times in
                the last few hours.  If you think this is unfair,
                you should contact the admin.  If you
                are being a troll, now is the time for you to either
                grow up, or change your IP.<br /><br /><a href=\"pollBooth.$phpEx?pollID=$pollID\">Back to Poll</a>";
        elseif($fake == 0) echo "According to my records, the topic you are trying
                to reply to does not exist. If you're just trying to be
                annoying, well then too bad.";
                CloseTable();
        include("footer.$phpEx");
        exit;
    }
    mysql_query("UNLOCK TABLES");

        if ($mpn_new_pollcomment_notify == "1") {
            require_once('class.phpmailer.php');
            $mail = new phpmailer();

            /* SET MAIL DELIVERY OPTIONS */
            $mail->IsHTML(true);
            if ($mailmethod == "0") {
                $mail->IsMail();
            } else {
                $mail->IsSMTP();
                $mail->Host = $smtp;
            }
            $message = translate('A new pollcomment regarding ') . stripslashes($subject) . translate(' was posted');
            $subject = translate('New pollcomment on ') . $sitename;
//            if ($author != "") $message .= translate(' by ') . $author;

            $message .= "\n\n";
            $message .= '<a href="' . _MPN_ROOT_URI . 'pollBooth.php?op=results&pollID=' . $pollID . '" target="_blank">' . _MPN_ROOT_URI . 'pollBooth.php?op=results&pollID=' . $pollID . '</a>';

            $mail->From = $adminmail;
            $mail->FromName = $sitename . translate(' Mailer');
            $mail->AddAddress($adminmail);
            $mail->Subject = stripslashes($subject);
            $mail->Body = nl2br( stripslashes($message) );
            $mail->AltBody = strip_tags( stripslashes($message) );
            $mail->Send();
        }

    $_SERVER['F_LIB'] -> redirectRequest( 'pollBooth.php?op=results&pollID=' . $pollID );
}

if (!isset($op))
{
    $op = null;
}

switch($op) {

    case "Reply":
        if (!isset($mode))
        {
            $mode = null;
        }

        if (!isset($order))
        {
            $order = null;
        }

        if (!isset($thold))
        {
            $thold = null;
        }

        reply($pid, $pollID, $mode, $order, $thold);
        break;

    case translate("Preview"):
        if (!isset($xanonpost))
        {
            $xanonpost = null;
        }

        replyPreview ($pid, $pollID, $subject, $comment, $xanonpost, $mode, $order, $thold, $posttype);
        break;

    case translate("Ok!"):

        if ( ! isset( $xanonpost ) ) { $xanonpost = NULL; }
        if ( ! isset( $host_name ) ) { $host_name = NULL; }

        CreateTopic($xanonpost, $subject, $comment, $pid, $pollID, $host_name, $mode, $order, $thold, $posttype);
        break;

    case "moderate":

      if (_MPN_ADMIN || $moderate == 2)
      {
          while(list($tdw, $emp) = each($HTTP_POST_VARS))
          {
                if (eregi("dkn",$tdw))
              {
                  $emp = explode(":", $emp);

                    if($emp[1] != 0)
                  {
                      $tdw = ereg_replace("dkn", "", $tdw);

                      $q = "UPDATE ".$mpnTables['pollcomments']." SET";
                      $update = false;

                        if(($emp[1] == 9) && ($emp[0]>=0))
                      {
                          # Overrated
                          $q .= " score=score-1 where tid=$tdw";
                          $update = true;
                     }
                      elseif (($emp[1] == 10) && ($emp[0]<=4))
                      {
                           # Underrated
                           $q .= " score=score+1 where tid=$tdw";
                           $update = true;
                      }
                      elseif (($emp[1] > 4) && ($emp[0]<=4))
                      {
                          $q .= " score=score+1, reason=$emp[1] where tid=$tdw";
                          $update = true;
                      }
                      elseif (($emp[1] < 5) && ($emp[0] > -1))
                      {
                         $q .= " score=score-1, reason=$emp[1] where tid=$tdw";
                         $update = true;
                      }
                      elseif (($emp[0] == -1) || ($emp[0] == 5))
                      {
                          $q .= " reason=$emp[1] where tid=$tdw";
                          $update = true;
                      }

//                      if(strlen($q) > 20) mysql_query("$q");
                      if ($update === true)
                      {
                          mysql_query("$q");
                      }
                    }
                }
            }
        }
        $_SERVER['F_LIB'] -> redirectRequest( 'pollBooth.php?op=results&pollID=' . $pollID );

        break;

    case "showreply":
        DisplayTopic($pollID, $pid, $tid, $mode, $order, $thold);
        break;

    default:
        if ((isset($tid)) && (!isset($pid))) {
            singlecomment($tid, $pollID, $mode, $order, $thold);
        } else {
            if(!isset($pid)) $pid=0;
                if (!isset($tid))
                {
                    $tid = null;
                }

                if (!isset($mode))
                {
                    $mode = null;
                }

                if (!isset($order))
                {
                    $order = null;
                }

                if (!isset($thold))
                {
                    $thold = null;
                }

            DisplayTopic($pollID, $pid, $tid, $mode, $order, $thold);
        }
        break;
}

?>
