<?php

@( (bool)FALSE === strpos( $_SERVER['REQUEST_URI'], basename( __FILE__ ) ) ) OR exit( '!! ACCESS DENIED !!' );
error_reporting( _E_VALUE );


/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | myPHPNuke Version 188_8 RC2                                          |
// +----------------------------------------------------------------------+
// | License: GNU/GPL - http://www.gnu.org/copyleft/gpl.html              |
// +----------------------------------------------------------------------+
// | Support: http://myphpnuke.com/                                       |
// +----------------------------------------------------------------------+
// | Author: myPHPNuke Dev Team                                           |
// +----------------------------------------------------------------------+
// | Copyright: © 2001-2004 myPHPNuke Dev Team                            |
// +----------------------------------------------------------------------+
// $Id: reviews.php,v 1.8.2.6 2004/08/15 12:58:04 kirilt Exp $

######################################################################
# PHP-NUKE: Web Portal System REVIEWS Add-on
# ==========================================
#
# Add-on Copyright (c) 2000 by Jeff Lambert (jeffx@qchc.com)
# http://www.qchc.com
#
# This module is the main administration part for the reviews add-on
#
######################################################################

checkAccess( 'modules', array( 'reviews' ) );

/*********************************************************/
/* REVIEWS Block Functions                               */
/*********************************************************/

function mod_main($title, $description)
{
    global $mpnTables,$phpEx;

    mysql_query("update ".$mpnTables['reviews_main']." set title='$title', description='$description'");

    $_SERVER['F_LIB'] -> redirectRequest( 'admin.php?op=reviews' );

}

function reviews()
{
    global $hlpfile, $admin, $mpnTables,$phpEx;
    include ("header.$phpEx");
    $hlpfile = getHelpFile("reviews.html");
    GraphicAdmin($hlpfile);
    $resultrm = mysql_query("select title, description from ".$mpnTables['reviews_main']);
    list($title, $description) = mysql_fetch_row($resultrm);

    $title = stripslashes( $title );
    $description = stripslashes( $description );

    OpenTable();
    echo "
    <center>
    ".translate("Reviews Page Title:")."<br>

    <form action=\"admin.$phpEx\" method=\"post\">
    <input type=\"text\" name=\"title\" value=\"$title\" size=\"50\" maxlength=\"100\"><br><br>
    ".translate("Reviews Page Description:")."<br>
    <textarea name=\"description\" rows=\"15\" wrap=\"virtual\" cols=\"60\">$description</textarea><br><br>\n";

    // Kiril: New Sanitizer

        echo "<input type='hidden' name='stripit_form' value='title|description' />\n";
        echo "<input type='hidden' name='mpn_sectype' value='2' />\n";

    // End Sanitizer

    echo "<input type=\"hidden\" name=\"op\" value=\"mod_main\">
    <input class=\"button\" type=\"submit\" value=\"".translate("Save Changes")."\">
    </form></center>";
    CloseTable();
    echo "<br>";
    OpenTable();
    echo "<font size=\"3\"><b>".translate("Reviews Waiting for Validation")."</b><br></font>";
    $result = mysql_query("select * from ".$mpnTables['reviews_add']." order by id");
    $numrows = mysql_num_rows($result);
    if ($numrows>0)
    {
        while(list($id, $date, $title, $text, $reviewer, $email, $score, $url, $url_title) = mysql_fetch_row($result))
        {
            // Kiril: New Sanitizer

            $sanity_ary = compact( 'date', 'title', 'text', 'reviewer', 'email', 'score', 'url', 'url_title' );
            $_SERVER['SAN'] -> slashIT( $sanity_ary );
            extract( $sanity_ary );

            // Adjust Formatting

            echo "<form action=\"admin.$phpEx\" method=\"post\">";
            echo "<hr><br><table border=\"0\" cellpadding=\"1\" cellspacing=\"2\">";
            echo "<tr><td><font color=\"Blue\">".translate("Reviews_Add ID:")."</td><td><font color=\"Black\"><b>$id</b></td></tr>";
            echo "<input type=\"hidden\" name=\"id\" value=\"$id\">";
            echo "<tr><td>".translate("Date:")."</td><td><input type=\"text\" name=\"date\" value=\"$date\" size=\"8\" maxlength=\"10\"></td></tr>";
            echo "<tr><td>".translate("Product Title:")."</td><td><input type=\"text\" name=\"title\" value=\"$title\" size=\"25\" maxlength=\"40\"></td></tr>";
            echo "<tr><td>".translate("Text:")."</td><td><textarea class=\"textbox\" name=\"text\" rows=\"6\" wrap=\"virtual\" cols=\"40\">$text</textarea></td></tr>";
            echo "<tr><td>".translate("Reviewer:")."</td><td><input type=\"text\" name=\"reviewer\" value=\"$reviewer\" size=\"25\" maxlength=\"20\"></td></tr>";
            echo "<tr><td>".translate("Email:")."</td><td><input type=\"text\" name=\"email\" value=\"$email\" size=\"40\" maxlength=\"30\"></td></tr>";
            echo "<tr><td>".translate("Score:")."</td><td><input type=\"text\" name=\"score\" value=\"$score\" size=\"3\" maxlength=\"2\"></td></tr>";
            if ($url != "")
            {
                echo "<tr><td>".translate("Related Link:")."</td><td><input type=\"text\" name=\"url\" value=\"$url\" size=\"25\" maxlength=\"100\"></td></tr>";
                echo "<tr><td>".translate("Link title:")."</td><td><input type=\"text\" name=\"url_title\" value=\"$url_title\" size=\"25\" maxlength=\"50\"></td></tr>";
            }
            echo "<tr><td>".translate("Cover image:")."</td><td><input type=\"text\" name=\"cover\" size=\"25\" maxlength=\"100\"><br><i>Store your 150*150 image in images/covers</i></td></tr></table>";

            // Kiril: New Sanitizer

        addFormatOption();

        echo "<input type='hidden' name='clickit_form' value='text' />\n";
        echo "<input type='hidden' name='stripit_form' value='date|title|reviewer|email|score|url|url_title|cover' />\n";
        echo "<input type='hidden' name='mpn_sectype' value='2' />\n";

        // End New Saintizer

            echo "<input type=\"hidden\" name=\"op\" value=\"add_review\"><input class=\"button\" type=\"submit\" value=\"Add Review\"> - [ <a href=\"admin.$phpEx?op=deleteNotice&id=$id&table_name=".$mpnTables['reviews_add']."&op_back=reviews\">".translate("Delete this notice")."</a> ]</form><p>";
        }
    } else {
        echo "<br>".translate("No reviews to add")."<p>";
    }
    echo "<a href=\"reviews.$phpEx?op=write_review\">".translate("Click here to write a review.")."</a><br>";
    CloseTable();
    mysql_free_result($result);
    echo "<p>";
    OpenTable();
        echo "<font size=\"3\"><b>".translate("Delete / Modify a review")."</b></font><p>";
        echo "".translate("You can simply delete/modify reviews by browsing")." <a href=\"reviews.$phpEx\">reviews.$phpEx</a> ".translate("as admin.")."<br>";
    CloseTable();
    echo "<br />";
    OpenTable();
    echo "<center>Reviews add-on from Jeff Lambert, <a href=\"mailto:jeffx@qchc.com\">jeffx@qchc.com</a><br />\n";
    echo "For the latest version of this script and for more scripts, go to <a href=\"http://www.qchc.com\">www.qchc.com</a><br /></center>\n";
    CloseTable();
    include ("footer.$phpEx");
}

function add_review($id, $date, $title, $text, $reviewer, $email, $score, $cover, $url, $url_title)
{
        global $mpnTables,$phpEx;

        mysql_query("insert into ".$mpnTables['reviews']." values (NULL, '$date', '$title', '$text', '$reviewer', '$email', '$score', '$cover', '$url', '$url_title', '1')");
        mysql_query("delete from ".$mpnTables['reviews_add']." WHERE id = $id");

        $_SERVER['F_LIB'] -> redirectRequest( 'admin.php?op=reviews' );
}

switch ($op){

        case "reviews":
        reviews();
        break;

        case "add_review":
        add_review($id, $date, $title, $text, $reviewer, $email, $score, $cover, $url, $url_title);
        break;

        case "mod_main":
        mod_main($title, $description);
        break;
}

?>
