<?php

/*
	[SupeSite/X-Space] (C)2001-2006 Comsenz Inc.
	»Ø¸´ÆÀÂÛ´¦Àí

	$RCSfile: batch.comment.php,v $
	$Revision: 1.30 $
	$Date: 2006/10/23 06:36:53 $
*/

include_once('./include/main.inc.php');
include_once(S_ROOT.'./include/common.inc.php');
include_once(S_ROOT.'./language/batch.lang.php');

$action = empty($_GET['action'])?'':$_GET['action'];

if(submitcheck('submitcomment', 1)) {

	getcookie(1);
	$author = $_SGLOBAL['supe_username'];
	if(empty($_SGLOBAL['supe_uid'])) {
		if(empty($_SCONFIG['allowguest'])) {
			messagebox('error', 'no_login', geturl('action/login'));
		}
		if(!empty($_POST['nickname'])) {
			$author = addslashes(cutstr(shtmlspecialchars(stripslashes($_POST['nickname'])), 15));
		}
	}
	
	if(empty($_POST['itemid'])) $_POST['itemid'] = 0;
	$_POST['itemid'] = intval($_POST['itemid']);
	if(empty($_POST['itemid'])) {
		messagebox('error', 'system_error');
	}
	
	$_POST['message'] = shtmlspecialchars(trim($_POST['message']));
	if(strlen($_POST['message']) < 2 || strlen($_POST['message']) >5000) {
		messagebox('error', 'message_length_error');
	}
	
	$query = $_SGLOBAL['db']->query('SELECT i.*, it.typename, it.viewperm, it.replyperm, it.getattachperm FROM '.tname('spaceitems').' i LEFT JOIN '.tname('itemtypes').' it ON it.typeid=i.itemtypeid WHERE i.itemid=\''.$_POST['itemid'].'\' AND i.allowreply=\'1\' AND i.folder=\'1\' AND i.tid=\'0\'');
	if($item = $_SGLOBAL['db']->fetch_array($query)) {
		if($item['type'] != 'news') {
			if(!checkfriend($item['replyperm'], $item['uid'])) {
				messagebox('error', 'no_reply');
			}
		}
	} else {
		messagebox('error', 'no_reply');
	}
	
	$_POST['rates'] = intval($_POST['rates']);
	if($item['uid'] == $_SGLOBAL['supe_uid']) $_POST['rates'] = 0;
	if($_POST['rates'] < -5 || $_POST['rates'] > 5) {
		$_POST['rates'] = 0;
	}
	if(!empty($_POST['rates'])) {
		if(empty($_SGLOBAL['supe_uid'])) {
			$query = $_SGLOBAL['db']->query('SELECT COUNT(*) FROM '.tname('spacecomments').' WHERE itemid='.$item['itemid'].' AND ip=\''.$_SGLOBAL['onlineip'].'\' AND rates!=0');
		} else {
			$query = $_SGLOBAL['db']->query('SELECT COUNT(*) FROM '.tname('spacecomments').' WHERE itemid='.$item['itemid'].' AND authorid='.$_SGLOBAL['supe_uid'].' AND rates!=0');
		}
		if($_SGLOBAL['db']->result($query, 0)) {
			messagebox('error', 'rates_repeat');
		}
	}
	
	$setsqlarr = array(
		'itemid' => $item['itemid'],
		'type' => $item['type'],
		'uid' => $item['uid'],
		'authorid' => $_SGLOBAL['supe_uid'],
		'author' => $author,
		'ip' => $_SGLOBAL['onlineip'],
		'dateline' => $_SGLOBAL['timestamp'],
		'rates' => $_POST['rates'],
		'message' => $_POST['message']
	);
	inserttable('spacecomments', $setsqlarr);
	
	if($_POST['rates']>0) {
		$goodrate = $_POST['rates'];
		$badrate = 0;
	} elseif($_POST['rates'] < 0) {
		$goodrate = 0;
		$badrate = 0 - $_POST['rates'];
	} else {
		$goodrate = 0;
		$badrate = 0;
	}
	$_SGLOBAL['db']->query('UPDATE '.tname('spaceitems').' SET lastpost='.$_SGLOBAL['timestamp'].', replynum=replynum+1,goodrate=goodrate+'.$goodrate.',badrate=badrate+'.$badrate.' WHERE itemid='.$item['itemid']);
	
	if($item['type'] != 'news') clearspacecache($item['uid'], 'spacecomment');
	
	$url = geturl("uid/$item[uid]/action/viewspace/itemid/$item[itemid]/php/1");

	messagebox('ok', 'succeed', $url);

} elseif($action == 'view') {

	$itemid = empty($_GET['itemid'])?0:intval($_GET['itemid']);
	if(empty($itemid)) showxml('parameter error');
	$perpage = 20;
	$commentlist = array();
	$multipage = '';
	$page = empty($_GET['page'])?1:intval($_GET['page']);
	$page = ($page<2)?1:$page;
	$start = ($page-1)*$perpage;

	$query = $_SGLOBAL['db']->query('SELECT * FROM '.tname('spaceitems').' WHERE itemid=\''.$itemid.'\' AND folder=\'1\' AND tid=\'0\'');
	if(!$item = $_SGLOBAL['db']->fetch_array($query)) showxml('parameter error');
	$listcount = $item['replynum'] + $item['trackbacknum'];
	if($listcount) {
		$query = $_SGLOBAL['db']->query('SELECT u.*, c.* FROM '.tname('spacecomments').' c LEFT JOIN '.tname('userspaces').' u ON u.uid=c.authorid WHERE c.itemid=\''.$itemid.'\' ORDER BY c.dateline DESC LIMIT '.$start.','.$perpage);
		while ($value = $_SGLOBAL['db']->fetch_array($query)) {
			$value['photo'] = getphoto($value['authorid'], $value['photo']);
			$value['message'] = snl2br($value['message']);
			$commentlist[] = $value;
		}
		$multipage = multi($listcount, $perpage, $page, 'PAGE');
	}

	if($multipage) {
		$multipage = preg_replace("/\"PAGE\?page\=(\d+?)\"/", '"javascript:;" onclick="javascript:showcomment(\\1);"', $multipage);
	}

	$html = "";
	
	if($commentlist) {
		foreach ($commentlist as $value) {
			if(empty($value['spacename'])) {
				if($value['url']) {
					$value['photo'] = S_URL.'/images/system/pic_trackback.gif';
					$value['subject'] = "{$blang[quote]}<a href=\"$value[url]\" target=\"_blank\">$value[subject]</a>,";
				}
				$value['photo'] = "<img src=\"$value[photo]\" class=\"xspace-signavatar xspace-imgstyle\" alt=\"TrackBack\" />";
			} else {
				$url = geturl("uid/$value[authorid]/action/space/domain/$value[domain]");
				$value['photo'] = "<a href=\"".$url."\" target=\"_blank\"><img src=\"$value[photo]\" class=\"xspace-signavatar xspace-imgstyle\" alt=\"".$value['spacename']."\" /></a>";
				$value['author'] = "<a href=\"".$url."\" target=\"_blank\">$value[author]</a>";
			}
			$value['dateline'] = sgmdate($value['dateline']);

			if(empty($value['rates'])) {
				$ratestr = '';
			} else {
				$ratestr = ' <span class="xspace-smalltxt">'.$blang['dorate'].$value['rates'].$blang['creditunit'].'</span>';
			}

			$html .= "
			<dl id=\"xspace-comment{$value[id]}\">
			<dt>
			$value[photo]
			<a href=\"javascript:;\" onclick=\"javascript:deletecomment($value[cid]);\" class=\"xspace-del\">$blang[delete]</a>
			$value[author]
			$value[subject]
			<span class=\"xspace-smalltxt\">{$blang[publish]}$value[dateline]</span>$ratestr
			</dt>
			<dd>
			$value[message]
			</dd>
			</dl>
			";
		}
		$html .= "<div id=\"xspace-multipage-div\" class=\"xspace-multipage\">$multipage</div>";
	} else {
		$html .= "<div id=\"xspace-multipage-div\" class=\"xspace-multipage\">$blang[message_no_reply]</div>";
	}
	
	showxml($html);

} elseif ($action == 'delete') {

	getcookie(1);
	$cid = empty($_GET['cid'])?0:intval($_GET['cid']);
	if(empty($cid) || empty($_SGLOBAL['supe_uid'])) showxml($blang['message_no_permission']);
	
	$query = $_SGLOBAL['db']->query('SELECT * FROM '.tname('spacecomments').' WHERE cid=\''.$cid.'\' AND uid=\''.$_SGLOBAL['supe_uid'].'\'');
	if($value = $_SGLOBAL['db']->fetch_array($query)) {
		deletetable('spacecomments', array('cid'=>$cid));

		if($value['rates']>0) {
			$goodrate = $value['rates'];
			$badrate = 0;
		} elseif($value['rates'] < 0) {
			$goodrate = 0;
			$badrate = 0 - $value['rates'];
		} else {
			$goodrate = 0;
			$badrate = 0;
		}
		$_SGLOBAL['db']->query('UPDATE '.tname('spaceitems').' SET replynum=replynum-1,goodrate=goodrate-'.$goodrate.',badrate=badrate-'.$badrate.' WHERE itemid='.$value['itemid']);

		if($value['type'] != 'news') clearspacecache($_SGLOBAL['supe_uid'], 'spacecomment');
		showxml($blang['message_delete_ok']);
	} else {
		showxml($blang['message_no_permission']);
	}
}

?>