<?php

if ( ! @include_once( './mainfile.php' ) ) { exit( '!! INCLUDE ERROR. ACCESS DENIED !!' ); }
error_reporting( _E_VALUE );


/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | myPHPNuke Version 188_8 RC2                                          |
// +----------------------------------------------------------------------+
// | License: GNU/GPL - http://www.gnu.org/copyleft/gpl.html              |
// +----------------------------------------------------------------------+
// | Support: http://myphpnuke.com/                                       |
// +----------------------------------------------------------------------+
// | Author: myPHPNuke Dev Team                                           |
// +----------------------------------------------------------------------+
// | Copyright: © 2001-2004 myPHPNuke Dev Team                            |
// +----------------------------------------------------------------------+
// $Id: module.guestbook.php,v 1.24.2.8 2004/06/12 17:33:33 ajvwaay Exp $


class Guestbook {

    function getTotal($id, $type) {
        global $mpnTables;
        switch($type) {
            case 'users':
                $sql = "SELECT count(*) AS total FROM ".$mpnTables['guestbook']." WHERE guest_poster = '$id'";
                break;
            case 'all':
                $sql = "SELECT count(*) AS total FROM ".$mpnTables['guestbook'];
                break;
        }
        if(!$result = mysql_query($sql)) {
            return "ERROR";
        }
        if(!$myrow = mysql_fetch_array($result)) {
            return "0";
        }
        return $myrow['total'];
    }

    function show() {
        global $mpnTables,$phpEx, $mpn_anonymous_id;
        global $sitename;
        global $guests_per_page, $anonymous;
        global $bgcolor1, $bgcolor2, $bgcolor3, $textcolor1, $textcolor2;
        global $start;
        global $guest_allow_html, $guest_allow_bbcode, $guest_allow_smilies;
        global $guests_images_path, $guests_images_subject, $guests_images_icons;

        $total_guests = $this->getTotal('0', 'all');
        if($total_guests > $guests_per_page) {
            $times = 0;
            for($x = 0; $x < $total_guests; $x += $guests_per_page) {
                $times++;
            }
            $pages = $times;
        } else {
            $pages = 1;
        }
        echo "<table border='0' width='100%'><tr><td align='left'>";
        echo "<font size='1'>";
        echo "<a href='index.$phpEx'>$sitename</a> <span style='font-weight:bold;color:#ff0000'>&raquo;&raquo;</span> <a  href='guestbook.$phpEx'>".translate("Guestbook")."</a>";
        echo "</font>";
        echo "</td><td align='right'>";
        echo "<font size='2'>";
        echo "<a href='guestbook.$phpEx?op=addguest'>" .translate("Sign the Guestbook")."</a>";
        echo "</font>";
        echo "</td></tr>";
        echo "<tr><td colspan='2'>";

        if($total_guests > $guests_per_page) {
            echo "<table border='0' width='100%' align='center'>";
            $times = 1;
            $pcount = ($start / $guests_per_page) + 1;
            echo "<tr><td align='center'>".translate("Goto Page: ")."";
            for($x = 0; $x < $total_guests; $x += $guests_per_page) {
                if($times == $pcount) {
                    echo "$times";
                } else {
                    echo "<a href='guestbook.$phpEx?start=$x'>$times</a>";
                }
                if (($x + $guests_per_page) < $total_guests) {
                    echo " | ";
                }
                $times++;
            }
            echo "</td></tr></table>\n";
        }

        if (!$start) {
            $start = 0;
        }
        $sql = "SELECT * FROM ".$mpnTables['guestbook']." ORDER BY guest_id DESC LIMIT $start, $guests_per_page";
        if (!$result = mysql_query($sql)) {
            // EMPTY
        }
        if (!mysql_num_rows($result)) {
            echo "<table border='0' cellpadding='1' cellpadding='0' align='center' valign='top' width='100%'><tr><td>\n";
            echo "<table border='0' cellpadding='3' cellpadding='1' width='100%'>\n";
            echo "<tr bgcolor='$bgcolor2'>\n";
            echo "<td width='20'><b><font color='$textcolor1'>" . translate("Icon") . "</font></b></td>\n";
            echo "<td width='450'><b><font color='$textcolor1'>" . translate("Title") . "</font></b></td>\n";
            echo "<td width='120' align='center'><b><font color='$textcolor1'>" . translate("Date") . "</font></b></td>\n";

            // if admin or poster show action

            $table_colspan = 3;

            if ( _MPN_ADMIN )
            {
                echo "<td width='100' align='center'><b><font color='$textcolor1'>" . translate("Action") . "</font></b></td>\n";
                $table_colspan = 4;
            }

            echo "</tr>";
            echo "<tr>\n";

            echo "<td bgcolor='$bgcolor3' align='center' valign='middle' colspan='$table_colspan'>";
            echo "<b><font color='$textcolor1'>" . translate("There are no messages in the guestbook!") . "</font></b>\n";
            echo "</td>";
            echo "</tr>\n";
            echo "</table>\n";
            echo "</td></tr></table>";
            echo "<br />";
        }
        while ($myrow = mysql_fetch_array($result))
        {
            $posterdata = getPosterData( NULL, $myrow[3] );

            echo "<table border='0' cellpadding='1' cellpadding='0' align='center' valign='top' width='100%'><tr><td>\n";
            echo "<table border='0' cellpadding='3' cellpadding='1' width='100%'>\n";
            echo "<tr bgcolor='$bgcolor2'>\n";
            echo "<td width='20'><b><font color='$textcolor1'>" . translate("Icon") . "</font></b></td>\n";
            echo "<td width='450'><b><font color='$textcolor1'>" . translate("Title") . "</font></b></td>\n";
            echo "<td width='120' align='center'><b><font color='$textcolor1'>" . translate("Date") . "</font></b></td>\n";
            // if admin or poster show action
            if ( _MPN_ADMIN || ( $myrow[3] == $GLOBALS['uinf']['uid'] && $GLOBALS['uinf']['uid'] > 1 ) ) {
                echo "<td width='100' align='center'><b><font color='$textcolor1'>" . translate("Action") . "</font></b></td>\n";
            }
            echo "</tr>";
            echo "<tr>\n";
            echo "<td bgcolor='$bgcolor3' align='center' valign='middle'>";
            if ($myrow[6] != "") {
                echo "<img src='$guests_images_subject/$myrow[6]'>";
            } else {
                echo "<img src='images/forum/icons/posticon.gif'>";
            }
            echo "</td>";

            echo "<td bgcolor='$bgcolor3' align='left' valign='top'>$myrow[1]</td>";

            // echo "<td bgcolor='$bgcolor3\" align=\"LEFT\" valign=\"TOP\">" . $myrow[5] . "</td>";
            echo "<td bgcolor='$bgcolor3' align='center' valign='top'>";


            echo strftime(translate("forumdatestring2"),strtotime($myrow[4]));
            //echo formatTimeStamp($myrow[4]);
            echo "</td>";
            // if admin or poster show action
            if ( _MPN_ADMIN || ( $myrow[3] == $GLOBALS['uinf']['uid'] && $GLOBALS['uinf']['uid'] > 1 ) ) {
                echo "<td bgcolor='$bgcolor3' valign='top' align='center'>";
                echo "<a href='guestbook.$phpEx?op=editguest&id=$myrow[0]'>" .translate("Edit")."</a>";
                echo "&nbsp;|&nbsp";
                echo "<a href='guestbook.$phpEx?op=delguest&id=$myrow[0]'>" .translate("Delete")."</a>";
                echo "</td>";
            }
            echo "</tr>\n";
            if ( _MPN_ADMIN || ( $myrow[3] == $GLOBALS['uinf']['uid'] && $GLOBALS['uinf']['uid'] > 1 ) ) {
                $table_colspan = 4;
            } else {
                $table_colspan = 3;
            }
            echo "<td bgcolor='$bgcolor3' align='left' valign='top' colspan='$table_colspan'>";
            echo "<table width='100%' border=0><tr><td>";

            $guestmess = stripslashes( $myrow[2] );

            // Kiril: New Sanitizer

            if ( $_SERVER['F_LIB'] -> checkPostDate( $myrow[4] ) )
            {
                $guestmess = $_SERVER['SAN'] -> sanitizeLegacyContent( $guestmess );
            }

            $_SERVER['SAN'] -> formatPost( $guestmess, $posterdata['user_sig'] );

            // End New Saintizer

            echo "<div class='bbcode_msg'>$guestmess</div>\n";

            echo "</td></tr><tr><td align='right'>";
            echo "---&nbsp;";
            if ($myrow[3] != $mpn_anonymous_id && isset($posterdata['uname'])) {

                echo "<a href='user.$phpEx?op=userinfo&uname=" . $posterdata["uname"] . "' target='_blank'>";
                echo $posterdata['uname'];
                echo "</a>";
               if ( _MPN_ADMIN ) {
                    if (isset($myrow[7]) || $myrow[7] != "") {
                        echo "&nbsp;&nbsp;(IP: " . $myrow[7] .")";
                    }
                }
            } else {
               echo $anonymous;
            }
            echo "</td></tr></table>";
            echo "</td>";
            echo "</tr>\n";
            echo "</table>\n";
            echo "</td></tr></table>";
            echo "<br />";
        }
        echo "</td></tr></table>";
    }

function showInterface() {
        global $mpnTables,$phpEx, $mpn_anonymous_id;
        global $sitename, $id, $anonymous;
        global $bgcolor1, $bgcolor2, $bgcolor3, $textcolor1, $textcolor2;
        global $guest_allow_html, $guest_allow_bbcode, $guest_allow_smilies, $guests_per_page;
        global $guests_images_path, $guests_images_subject, $guests_images_icons;

        $anon_link = " (<a href='user.php?op=register'>" .translate("Register")."</a> / <a href='user.$phpEx'>" .translate("Login")."</a> " .translate("to sign your name!").")";

        $poster_id = $GLOBALS['uinf']['uid'];
        $poster_nickname = ( $GLOBALS['uinf']['uid'] == $mpn_anonymous_id )
                         ? ( $GLOBALS['uinf']['uname'] . $anon_link )
                         : ( $GLOBALS['uinf']['uname'] );


       if (isset($id)) {
           $sql = "SELECT * FROM ".$mpnTables['guestbook']." WHERE guest_id = $id";
            if (!$result = mysql_query($sql)) {
                $stop = 1;
            }
            if ($myrow = mysql_fetch_array($result))
            {
                if (! _MPN_ADMIN ) {
                    if ($myrow[3] != $GLOBALS['uinf']['uid']) {
                        $stop = 1;
                   }
                }
                if (!isset($stop))
                {
                    $guest_id = $id;
                    $guest_title = stripslashes( $myrow[1] );
                    $guest_body = stripslashes( $myrow[2] );

                     // BBConversion( $body, $encode, $edited = FALSE, $editby = '' )

                    $guest_body = $GLOBALS['bbencoder'] -> BBConversion( $myrow[2], FALSE );

                    $guest_poster = $myrow[3];
                    $guest_time = strftime(translate("forumdatestring2"),strtotime($myrow[4]));
                    $guest_views = $myrow[5];
                    $guest_image = $myrow[6];
                    $guest_ip = $myrow[7];
                    $posterdata = getPosterData( NULL, $guest_poster );
                    $poster_id = $posterdata['uid'];
                    $poster_nickname = $posterdata['uname'];
                }
            } else {
                $stop = 1;
            }
        }
        else
        {
            $guest_id = $guest_title = $guest_body = $guest_poster = $guest_time = $guest_views = $guest_image = $guest_ip = null;
        }


        if (!isset($stop)) {
            echo "<table border='0' width='100%'><tr><td align='left'>";
            echo "<font size='1'>";
            echo "<a href='index.$phpEx'>$sitename</a>  <span style='font-weight:bold;color:#ff0000'>&raquo;&raquo;</span>  <a href='guestbook.$phpEx'>".translate("Guestbook") ."</a>";
            echo "</font>";
            echo "</td></tr>";
            echo "<tr><td align='left'>";
            echo "<form action='guestbook.$phpEx' method='post'>";
            echo "<table border='0' cellpadding='1' cellpadding='0' align='center' valign='top' width='100%'><tr><td>\n";
            echo "<table border='0' cellpadding='3' cellpadding='1' width='100%'>\n";
            echo "<tr bgcolor='$bgcolor2' align='left'>\n";
            echo "<tr align='left'>";
            echo "<td  bgcolor='$bgcolor3'  width='25%'><b>".translate("Nickname: ")."<b></td>";
            echo "<td  bgcolor='$bgcolor3'>";
            echo "<input class='textbox' type='hidden' name='guest_poster' size='25' maxlength='40' value='$poster_id'>\n";
            echo $poster_nickname;
            echo "</td></tr> \n";
            echo "<tr align='left'>";
            echo "<td  bgcolor='$bgcolor3' width='25%'><b>" . translate("Title: ") . "</b></td>";
            echo "<td  bgcolor='$bgcolor3'><input class='textbox' type='text' name='guest_title' size='50' maxlength='100' value=\"$guest_title\"></td>";

            echo "</tr>";
            echo "<tr align='left'>";
            echo "<td  bgcolor='$bgcolor3' width='25%' valign='top'><b>" . translate("Message Icon: ") . "</b></td>";
            echo "<td  bgcolor='$bgcolor3'>";
            $handle=opendir("./$guests_images_subject");

            while (false !== ($file = readdir($handle)))
            {
                if (preg_match('/(.gif|.jpg|.jpeg|.png)$/i', $file))
                {
                    $filelist[] = $file;
                }
            }

            asort($filelist);
            $cntrow = 0;

            foreach($filelist as $key => $file)
            {
                echo '<input type="radio" value="' . $file . '" name="guest_image"';
                if ($key == 0 || $file == $guest_image)
                {
                    echo ' checked';
                }

                echo '>&nbsp;';
                echo '<img src="./images/forum/subject/' . $file . '" border="0">&nbsp;';

                if ( $cntrow == 7 )
                {
                   echo '<br>';
                   $cntrow = 0;
                }
                else
                {
                   $cntrow++;
                }
           }

            echo "</td>";
            echo "</tr>";
            echo "<tr align='left'>";
            echo "<td bgcolor='$bgcolor3' width='25%' valign='top'><b>" . translate("Message: ") . "</b><br /><br />";
            echo "<font size='-1'>";
            echo "HTML : ";
            if($guest_allow_html == 1) {
                echo "On<br />\n";
            } else {
                echo "Off<br />\n";
            }
            echo "<a href='bbcode_ref.php' target='blank'>BBCode</a> : ";
            if($guest_allow_bbcode == 1) {
                echo "On<br />\n";
            } else {
                echo "Off<br />\n";
            }
            echo "<a href='bb_smilies.php' target='blank'>Smilies</a> : ";
            if($guest_allow_smilies == 1) {
                echo "On<br />\n";
            } else {
                echo "Off<br />\n";
            }
            echo "</font>";
            echo "</td>";
            echo "<td  bgcolor='$bgcolor3'>\n";

            echo "<textarea class='textbox' name='guest_body' rows='10' cols='65' wrap='virtual'>";
            //$guest_body = str_replace("<br />", "\n", $guest_body);
            echo $guest_body;
            echo "</textarea></td>";
            echo "</tr>";
            if (($guest_allow_html > 0) || ($guest_allow_bbcode > 0) || ($guest_allow_smilies > 0)) {
                echo "<tr align='left'>";
                echo "<td  bgcolor='$bgcolor3' width='25%'><b>" . translate("Options: ") . "</b></td>";
                echo "<td  bgcolor='$bgcolor3'>";
                if($guest_allow_html == 1) {
                    echo "<input type='checkbox' name='html'>" . translate("Disable HTML on this entry") . "<br />";
                }
                if($guest_allow_smilies == 1) {
                    echo "<input type='checkbox' name='smilies'>" . translate("Disable") . " <a href='bb_smilies.php' target='_blank'><i>" . translate("Smilies") . "</i></a> ".translate("on this entry") . "<br />";
                }

                if($guest_allow_bbcode == 1) {
                    echo "<input type='checkbox' name='bbcode'>" . translate("Disable") . " <a href='bbcode_ref.php' target='_blank'><i>" . translate("BBCode") . "</i></a> ".translate("on this entry") . "<br />";
                }

                addFormatOption( TRUE );

                echo "</td>";
                echo "</tr>";
            }
            echo "<tr>";
            echo "<td  bgcolor='$bgcolor3' colspan='2' align='center'>";
            echo "<input type='hidden' name='op' value='saveguest'>";
            if ($id != "") {
                echo "<input type='hidden' name='id' value='$guest_id'>";
            }

            // Kiril: New Sanitizer

            echo "<input type='hidden' name='clickit_form' value='guest_body' />\n";
            echo "<input type='hidden' name='stripit_form' value='guest_title' />\n";
            echo "<input type='hidden' name='mpn_encode' value='1' />\n";
            echo "<input type='hidden' name='mpn_sectype' value='1' />\n";

            // End New Saintizer

            echo "<input class='button' type='submit' name='submit' value='" .translate("Submit")."'>&nbsp;<input class='button' type='reset' value='" .translate("Reset")."'>";
            echo "&nbsp;<input class='button' type='submit' name='cancel' value='" . translate("Cancel Post") . "'>";
            echo "</form>";
            echo "</tr>";
            echo "</td></tr></table>";
            echo "</td></tr></table>";
            echo "<tr><td colspan='2'>";
            echo "</td></tr></table>";
        } else {
            echo "<center>".translate("Sorry you are not allowed to EDIT this Guestbook entry!")."<br /><a href='guestbook.$phpEx'>".translate("Click here to return to the Guestbook.")."</center></a>";
        }
    }

    function save() {
        global $mpnTables,$phpEx,$HTTP_POST_VARS;
        global $sitename, $mpn_new_guestbook_notify;
        global $guests_per_page, $anonymous,$adminmail;
        global $bgcolor1, $bgcolor2, $bgcolor3, $textcolor1, $textcolor2;
        global $guest_allow_html, $guest_allow_bbcode, $guest_allow_smilies;
        global $guests_images_path, $guests_images_subject, $guests_images_icons;

        global $REMOTE_ADDR, $serv_offset, $mailmethod, $smtp;

        $guest_poster = $HTTP_POST_VARS['guest_poster'];
        $guest_title = $HTTP_POST_VARS['guest_title'];
        $guest_body = $HTTP_POST_VARS['guest_body'];
        $guest_image = $HTTP_POST_VARS['guest_image'];

        if (isset($HTTP_POST_VARS['id']))
        {
            $id = $HTTP_POST_VARS['id'];
        }
        else
        {
            $id = null;
        }

        if($guest_title == '')  {
            $stop=1;
        }
        if($guest_body == '') {
            $stop=1;
        }

        if ( isset( $id ) && ( $id != 0 ) || ($id != "") )
        {
            $guest_id = $id;
        }

        if (!isset($stop))
        {
             // BBConversion( $body, $encode, $edited = FALSE, $editby = '' )

            $guest_body = $GLOBALS['bbencoder'] -> BBConversion( $guest_body, TRUE );

            $guest_body = addslashes( $guest_body );
            $guest_title = addslashes( $guest_title );
            $guest_ip = $REMOTE_ADDR;

            $guest_views = 0;
            if (isset($guest_id) && $guest_id > 0)
            {
                $timtim = date("Y-m-d H:i",mktime(date("H")+$serv_offset));
                $sql = "UPDATE ".$mpnTables['guestbook']." SET guest_title='$guest_title', guest_body='$guest_body', guest_poster='$guest_poster', guest_time='$timtim', guest_views='$guest_views', guest_image='$guest_image', guest_ip='$guest_ip' WHERE (guest_id = '$guest_id')";
                if(!$result = mysql_query($sql)) {
                    echo "Error#: " . mysql_errno() ."<br />";
                    echo "Error: ". mysql_error() . "<br />";
                    die("<font size='+1'>Error:</font><font size='2'><ul>Could not enter data into the database. Please go back and try again.</ul></font>");
                }
                echo "<center>".translate("Your Guestbook entry has been updated")."<p><a href='guestbook.$phpEx'>".translate("Click here to view your post.")."</center></a>";
            }
            else
            {

                $timtim = date("Y-m-d H:i",mktime(date("H")+$serv_offset));
                $sql = "INSERT INTO ".$mpnTables['guestbook']." (guest_title, guest_body, guest_poster, guest_time, guest_views, guest_image, guest_ip) VALUES ('$guest_title', '$guest_body', '$guest_poster', '$timtim', '$guest_views', '$guest_image', '$guest_ip')";
                if(!$result = mysql_query($sql)) {
                    echo "Error#: " . mysql_errno() ."<br />";
                    echo "Error: ". mysql_error() . "<br />";
                    die("<font size='+1'>Error:</font><font size='2'><ul>Could not enter data into the database. Please go back and try again.</ul></font>");
                }
                if ($mpn_new_guestbook_notify == 1) {
                                    require_once('class.phpmailer.php');
                                    $mail = new phpmailer();

                                    /* SET MAIL DELIVERY OPTIONS */
                                    $mail->IsHTML(true);
                                    if ($mailmethod == "0") {
                                        $mail->IsMail();
                                    } else {
                                        $mail->IsSMTP();
                                        $mail->Host = $smtp;
                                    }

                    $message  = translate("A new message has been posted to the Guestbook: ") . "\n\n";
                                    $message .= "<a href=\"" . _MPN_ROOT_URI . "guestbook.php\" target=\"_blank\">".stripslashes($guest_title)."</a>";
                                    $subject = translate("New message in the Guestbook on ").$sitename;
                                    $mail->From = $adminmail;
                                    $mail->FromName = $sitename . translate(' Mailer');
                                    $mail->AddAddress($adminmail);
                                    $mail->Subject = stripslashes($subject);
                                    $mail->Body = nl2br( stripslashes($message) );
                                    $mail->AltBody = strip_tags( stripslashes($message) );
                                    $mail->Send();
                }
                Header ("Location:guestbook.$phpEx");
            }
        } else {
            echo translate("You must provide subject and message to post your Guestbook entry.");
        }
    }

    function delete() {
        global $mpnTables,$phpEx;
        global $sitename;
        global $guests_per_page, $anonymous;
        global $bgcolor1, $bgcolor2, $bgcolor3, $textcolor1, $textcolor2;
        global $guest_allow_html, $guest_allow_bbcode, $id, $confirm;
        global $guests_images_path, $guests_images_subject, $guests_images_icons;

        if (isset($id)) {
            $sql = "SELECT * FROM ".$mpnTables['guestbook']." WHERE guest_id = $id";
            if (!$result = mysql_query($sql)) {
                $stop = 1;
            }
            if ($myrow = mysql_fetch_array($result))
            {
                if ( ! _MPN_ADMIN ) {

                    if (($myrow[3] != $GLOBALS['uinf']['uid']) || ($myrow[3] == $mpn_anonymous_id)) {
                        $stop = 1;
                    }
                }
            }
        }
        if (!isset($stop)) {
            if ($confirm == "yes") {
                $sql = "DELETE FROM ".$mpnTables['guestbook']." WHERE guest_id = $id";
                if (!$result = mysql_query($sql)) {
                   $stop = 1;
                }
                if (!isset($stop)) {
                    echo "<center>".translate("Your Guestbook entry has been deleted")."<p><a href='guestbook.$phpEx'>".translate("Click here to return to the Guestbook.")."</center></a>";
                } else {
                    echo "<center>".translate("Error! Your Guestbook entry could not be deleted")."<p><a href='guestbook.$phpEx'>".translate("Click here to return to the Guestbook.")."</center></a>";
                }
            } else {
                echo "<center>";
                echo translate("Do you really want to DELETE this Guestbook entry?");
                echo "<p>";
                echo "[ <a href='guestbook.$phpEx?op=delguest&id=$id&confirm=yes'>" . translate("YES") . "</a> | <a href='guestbook.$phpEx'>" . translate("NO") ."</a> ]";
                echo "</center>";
            }
        } else {
            echo "<center>".translate("Sorry you are not allowed to DELETE this Guestbook entry!")."<p><a href='guestbook.$phpEx'>".translate("Click here to return to the Guestbook.")."</center></a>";
        }
    }
}

?>
