name = $name;
$this->msg = $msg;
$this->valid = $valid;
}
}
class UserRemarks
{
var $imageID; //unique image ID for database
var $script; //page to reload when form data sent
var $respath; //path to BPP 'res' folder
var $table; //name of database table
var $adminMode; //switch for admin mode
var $option; //action to be taken
var $code = ''; //CAPTCHA code
function UserRemarks($imageID, $script, $respath)
{
$this->script=setScript($script);
$this->respath = $respath;
$this->code=createRandomValue();
$this->table = getTableName();
if( $imageID!=NULL )
$this->setImageId($imageID);
$this->option = "1"; // 1 = nothing, just list remarks
$this->option = (IsSet($_POST["go"])) ? "2" : $this->option; // 2 = add new remark
$this->option = (IsSet($_POST["savechanges"])) ? "3" : $this->option; // 3 = save changes
if (IsSet($_POST['filter']) ) //remarks filter drop down menu set
$this->adminMode = true;
if( IsSet($_POST['exitadmin']) ) //exit admin mode button clicked
$this->adminMode = false;
}
function executeAction()
{
switch ($this->option)
{
case 1: //just display remarks
if ($this->adminMode)
adminMode($this->script,$this->imageID,$this->table);
else
showAllPhotoRemarks($this->table,$this->imageID,$this->script,$this->respath,$this->code);
break;
case 2: //add remark
$valid=true;
if ($_POST["author"]==ADMIN_USER)
{
if ($_POST["remark"] != ADMIN_PASSWD)
{ //display error if password incorrect
echo("
".MSG_INVALID_LOGIN."
");
$valid=false;
}
else //username and password valid
{
if (USE_CAPTCHA)
$valid= validateCAPTCHA() ? true : false;
}
if ($valid)
{
$this->adminMode = true;
adminMode($this->script,$this->imageID,$this->table);
}
else
showAllPhotoRemarks($this->table,$this->imageID,$this->script,$this->respath,$this->code);
}
else //name not ADMIN USER
{
$remarkEntry = validateEntry();
if ($remarkEntry->valid)
addPhotoRemark($this->table, $this->imageID, $remarkEntry);
showAllPhotoRemarks($this->table,$this->imageID,$this->script,$this->respath,$this->code);
}
break;
case 3: // save changes
saveChanges($this->table,$this->script);
$this->adminMode = true;
adminMode($this->script,$this->imageID,$this->table);
break;
}
}
function displayRemarksIfNotEmpty()
{
if(fetchRemarksCount($this->table, $this->imageID, 0)>0 )
echo("showRemarks();"); //call javascript to show remarks section
}
function forceDisplayRemarksIfNecessary()
{
if ( ($this->adminMode) OR ($this->option==2) )
{
echo("showRemarks();");
echo("bringRemarksToTop();");
}
}
function setImageId($imageID)
{
// $this->imageID = addslashes($imageID);
$this->imageID = $imageID;
}
function showRemarksCount()
{
echo(fetchRemarksCount($this->table, $this->imageID, 0) );
}
} //end of class UserRemarks
function addPhotoRemark($table, $imageID, $remarkEntry)
{
$remarkEntry->name = quote_smart($remarkEntry->name); //escape necessary characters
$remarkEntry->msg = quote_smart($remarkEntry->msg);
$imageID = quote_smart($imageID);
$query = "insert into $table (imageID, name, date, msg, ip1, approved, refer) VALUES($imageID,$remarkEntry->name, NOW(), $remarkEntry->msg, '".gethostbyaddr($_SERVER["REMOTE_ADDR"])."',";
if (USE_MODERATION)
$query .= "'N'" ;
else
$query .= "'Y'";
$query .= ",'".addslashes($_SERVER["HTTP_REFERER"])."')";
$error = doQuery($query,"Add Remark",$sql);
if (!$error)
{
if (USE_MODERATION)
echo("
".MSG_MODERATION."
");
if (NOTIFY) // send notification email if enabled
sendNotification($imageID, $remarkEntry->name, $remarkEntry->msg);
}
unset($_POST['author']); //empty variables so add remarks form is empty
unset($_POST['remark']);
}
function adminMode($script,$imageID,$table)
{
$return_array=setupFilter($imageID,$table);
$filter=$return_array[0];
$selectquery=$return_array[1];
$countquery=$return_array[2];
$error = doQuery($countquery,"count in adminmode",$sql);
$row = fetchArray($sql);
$numTotalRemarks= $row[0];
freeResult($sql);
displayAdminConsole($filter,$numTotalRemarks,$script);
if ($numTotalRemarks!=0)
{
$error = doQuery($selectquery,"select all in adminmode",$sql);
while($row=fetchArray($sql))
{
$id = $row["id"];
$imageID = str_replace("/","/\n",$row["imageID"]);
$date = $row["date"];
$name = $row["name"];
$msg = $row["msg"];
$ip1 = $row["ip1"];
$approved = $row["approved"];
$deleted = "N";
displayMainFormSegment($id,$imageID,$date,$name,$msg,$ip1,$approved,$deleted);
} //end while
echo( "\n\t" );
freeResult($sql);
}
}
function checkForGDLibrary()
{
//if CAPTCHA enabled, check for GD support
if (USE_CAPTCHA)
{
if (!function_exists("imagecreate"))
{
$msg = "\n
";
$msg .= "\n\tThe CAPTCHA feature requires that the PHP engine have the GD library installed. ";
$msg .= "\n\t\tThis webserver does not appear to support the CAPTCHA feature. ";
$msg .= "\n\t\tPlease regenerate this album after unselecting the CAPTCHA feature.";
$msg .= "\n\t";
$msg .= "\n
";
echo ($msg);
}
}
}
function cleanEntries($name,$msg)
{
//filter most html tags in entries and close unbalanced allowed tags
//create allowable opening html tags array
$open_tag[1]=""; //permit bold and italics
$open_tag[2]="";
$open_tag[3]="";
$open_tag[4]="";
$allowable_tags=""; //initialize and build allowable html tags string
foreach ($open_tag as $tag) {$allowable_tags=$allowable_tags.$tag."" );
//display administrator console
echo("\n\t
");
echo("\n\t
");
echo("\n\t
");
echo("\n\t\t
".MSG_ADMIN_CONSOLE.":
");
if ($numTotalRemarks!=0)
echo("\n\t\t
".MSG_DELETE_ALL_REMARKS."
");
else
echo("\n\t\t
");
echo("\n\t
");
echo("\n\t
");
echo("\n\t\t
".MSG_ADMIN_FILTER."");
echo("\n\t\t
");
if (USE_MODERATION && $numTotalRemarks!=0)
echo("\n\t\t
".MSG_APPROVE_ALL_REMARKS."
");
else
echo("\n\t\t
");
echo("\n\t
");
echo("\n\t
");
echo("\n\t ");
echo("\n\t\t");
if ($numTotalRemarks != 0)
echo("\n\t\t");
echo("\n\t
");
}
function displayMainFormSegment($id,$imageID,$date,$name,$msg,$ip1,$approved,$deleted)
{
echo("\n\t
");
echo( "\n\t " );
echo( "\n\t
");
echo( "\n\t\t
");
echo( "\n\t\t
".MSG_DATE_TIME."
");
echo( "\n\t\t
");
echo( "\n\t\t
");
echo( "\n\t\t
");
echo( "\n\t\t
");
if ($deleted !="N")
echo("\n\t\t
".MSG_DELETE_REMARK_THIS_PAGE."
");
else
echo("\n\t\t
".MSG_DELETE_REMARK_THIS_PAGE."
");
echo( "\n\t\t
");
echo( "\n\t\t
");
echo( "\n\t\t
".MSG_REMARK_AUTHOR."
");
echo( "\n\t\t
");
echo( "\n\t\t
");
echo( "\n\t\t
");
echo( "\n\t\t
");
if (USE_MODERATION)
{
if ($approved !="N")
echo("\n\t\t
".MSG_REMARK_APPROVED."
");
else
echo("\n\t\t
".MSG_REMARK_APPROVED."
");
}
else
echo("\n\t\t
");
echo( "\n\t\t
");
echo( "\n\t\t
");
echo( "\n\t\t
".MSG_REMARK_CONTENT."
");
echo( "\n\t\t
".MSG_IMAGE_ID."
");
echo( "\n\t\t
");
echo( "\n\t\t
");
echo("\n\t\t
" );
echo( "\n\t\t
$imageID
");
echo( "\n\t\t
");
echo( "\n\t
");
echo("\n\t
");
}
function encryptDecrypt($strMessage)
{
//Function : encrypt/decrypt a string message v.1.0 without a known key
//Author : Aitor Solozabal Merino (spain)
//Email : aitor-3@euskalnet.net
//Date : 01-04-2005
$lenStrMessage=strlen($strMessage);
$strEncryptedMessage="";
FOR ($position = 0;$position<$lenStrMessage;$position++)
{
$strEncryptedMessage .= chr((ord(substr($strMessage, $position, 1))) ^ ((255+(($lenStrMessage +$position)+1)) % 255));
}
return $strEncryptedMessage;
}
function fetchDate($date)
{
return( date(DATEFMT, strtotime($date)).DATE_SUFFIX );
}
function fetchRemarksCount($table, $id, $selection)
{
switch ($selection)
{
case 1: //all remarks
$query="select count(*) from $table where (imageID=\"$id\" )";
break;
case 2: //unapproved remarks
$query="select count(*) from $table where (imageID=\"$id\" AND approved =\"N\" )";
break;
default: //approved remarks
$query="select count(*) from $table where (imageID=\"$id\" AND (approved =\"Y\" OR approved is null) )";
break;
}
$error = doQuery($query,"Select in fetchRemarksCount()",$sql);
$row = fetchArray($sql);
$numOfRows= $row[0];
freeResult($sql);
return $numOfRows;
}
function getTableName()
{
$bad_chars = "!@#$%^&*()+<>?{}|[]\:,.-= "; //translate non-allowed characters to '_'
return strtolower(strtr(DB_TABLE_NAME, $bad_chars, str_repeat("_", strlen($bad_chars))));
}
function reportError($errloc, $errno, $errmsg)
{
if ($errno != 0)
{
$msg = "\n
";
$msg .= "\n\tA database error has occurred!!";
$msg .= "\n\tPlease report the following error details to site administrators:";
$msg .= "\n\t
";
$msg .= "\n\t\t
Error location: $errloc
";
$msg .= "\n\t\t
Error no.: $errno
";
$msg .= "\n\t\t
Error message: $errmsg
";
$msg .= "\n\t
";
$msg .= "\n
";
echo ($msg);
return true;
}
else
return false;
}
function saveChanges($table,$script)
{
$nameArray=$_POST['name'];
$msgArray=$_POST['msg'];
$approvedArray=isSET($_POST['approved']) ? $_POST['approved'] : array();
$deleteArray=isSET($_POST['delete']) ? $_POST['delete'] : array();
$dateArray=$_POST['date'];
$imageIdArray=$_POST['imageID'];
$idArray=$_POST['id'];
$keyArray=array_keys($nameArray);
foreach ($keyArray as $key) //step through keys
{
$query="select * from $table where id=$key";
$error = doQuery($query,"Select in Save Changes",$sql);
$row = fetchArray($sql);
$id = $row["id"];
$imageID = $row["imageID"];
$date = $row["date"];
$name = $row["name"];
$msg = $row['msg'];
$ip1 = $row["ip1"];
$approved = $row["approved"];
if(IsSet($deleteArray[$key])) //remark marked for deletion
{
$query="delete from $table where id = '$id'";
$error = doQuery($query,"Delete remark for photo",$sql);
}
if(IsSet($nameArray[$key]))
$name=$nameArray[$key];
if(IsSet($msgArray[$key]))
$msg=$msgArray[$key];
$approved = (IsSet($approvedArray[$key])) ? "Y" : "N";
//if moderation disabled, remarks is approved
if (!USE_MODERATION) $approved="Y";
//clean up $name,$msg
$nameMsg=cleanEntries($name,$msg);
$name=$nameMsg[0];
$msg=$nameMsg[1];
//update entry
$query="update $table SET name= '$name' , msg= '$msg' , approved= '$approved' where id = '$id'";
$error = doQuery($query,"Update in Save Changes",$sql);
}//end foreach ($keyArray as $key)
echo("
".MSG_CHANGES_SAVED."
");
echo( "\n" );
}
function sendNotification($imageID, $name, $msg)
{
$notification_msg = "\n".NOTIFY_PHOTO_ID.": ".$imageID."\n".NOTIFY_AUTHOR.": ".$name."\n".NOTIFY_MSG.":\n"."\n".$msg;
$x = mail(NOTIFY_TO, NOTIFY_SUB, $notification_msg, "From: ".NOTIFY_FROM);
}
function setupFilter($imageID,$table)
{
//remarks filter dropdown menu
$filter[1]="\n\t\t\t";
$filter[2]="\n\t\t\t";
if (USE_MODERATION)
{
$filter[3]="\n\t\t\t";
$filter[4]="\n\t\t\t";
}
//locate album name
$albumName=substr($imageID,0,strpos($imageID,'/'));
$whereSubclause="LEFT(imageID,instr(imageID,\"/\")-1)";
$selectedFilter = IsSet($_POST['filter']) ? $_POST['filter'] : MSG_ALL_REMARKS_THIS_PAGE;
switch ($selectedFilter) //set 'selected' option
{
case MSG_ALL_REMARKS_THIS_PAGE:
$countquery="select count(*) from $table where (imageID=\"$imageID\" )";
$selectquery="select * from $table where (imageID=\"$imageID\" ) order by date DESC";
$filter[1] = str_replace("option","option selected",$filter[1]);
break;
case MSG_ALL_REMARKS_THIS_ALBUM:
$countquery="select count(*) from $table where $whereSubclause=\"$albumName\"";
$selectquery="select * from $table where $whereSubclause=\"$albumName\" order by date DESC";
$filter[2] = str_replace("option","option selected",$filter[2]);
break;
case MSG_ALL_UNAPPROVED_REMARKS_THIS_PAGE:
$countquery="select count(*) from $table where (imageID=\"$imageID\" AND approved =\"N\" )";
$selectquery="select * from $table where (imageID=\"$imageID\" AND approved =\"N\" ) order by date DESC";
$filter[3] = str_replace("option","option selected",$filter[3]);
break;
case MSG_ALL_UNAPPROVED_REMARKS_THIS_ALBUM:
$countquery="select count(*) from $table where (approved =\"N\" AND $whereSubclause=\"$albumName\")";
$selectquery="select * from $table where (approved =\"N\" AND $whereSubclause=\"$albumName\") order by date DESC";
$filter[4] = str_replace("option","option selected",$filter[4]);
break;
}
$returnArray=array(0=>$filter,1=>$selectquery,2=>$countquery);
return $returnArray;
}
function setScript($script)
{
//replace blanks with %20 and apostrophe with %27 to ensure valid URL
$temp = str_replace(" ", "%20", $script);
return ( str_replace("'", "%27", $temp) );
}
function showAllPhotoRemarks($table,$imageID,$script,$respath,$code) //displays the remarks
{
checkForGDLibrary();
$numTotalRemarks = fetchRemarksCount($table, $imageID, 1);
$numApprovedRemarks = fetchRemarksCount($table, $imageID, 0);
$numOfRows = $numApprovedRemarks; //default to displaying only approved remarks
if (USE_MODERATION) //display # of unapproved remarks
{
$numUnapprovedRemarks = fetchRemarksCount($table, $imageID, 2);
if ($numUnapprovedRemarks > 0)
echo("
");
}
//display remark
if( $numOfRows>0 ) //if there is data in the table for this image
{
$query="select * from $table where (imageID=\"$imageID\" AND (approved =\"Y\" OR approved is null) ) order by date DESC";
$error = doQuery($query,"Select in showAllPhotoRemarks()",$sql);
while( $row=fetchArray($sql))
{
$msg = str_replace("\n"," ",$row["msg"]);
$name = $row["name"];
$approved = ($row["approved"] == "N") ? false : true;
echo("\n