// Security check:
if (strstr($id, " ") || strstr($pid, " ") || strstr($lid, " ") || strstr($mode, " ") || strstr($order, " ") || strstr($threshold, " ")) {
watchdog("error", "comment: attempt to provide malicious input through URI");
exit();
}
$cmodes = array(1 => "List - min", 2 => "List - max", 3 => "Threaded - min", 4 => "Threaded - max");
$corder = array(1 => "Date - new", 2 => "Date - old", 3 => "Rate - high", 4 => "Rate - low");
$link = ($mod) ? $mod : substr($PHP_SELF, 1, strlen($PHP_SELF) - 5);
class Comment {
function Comment($userid, $subject, $comment, $timestamp, $url, $fake_email, $score, $votes, $cid) {
$this->userid = $userid;
$this->subject = $subject;
$this->comment = $comment;
$this->timestamp = $timestamp;
$this->url = $url;
$this->fake_email = $fake_email;
$this->score = $score;
$this->votes = $votes;
$this->cid = $cid;
}
}
function comment_moderate($moderate) {
global $user, $comment_votes;
if ($user->id && $moderate) {
$none = $comment_votes[key($comment_votes)];
foreach ($moderate as $id=>$vote) {
if ($vote != $comment_votes[$none] && !user_getHistory($user->history, "c$id")) {
// Update the comment's score:
$result = db_query("UPDATE comments SET score = score $vote, votes = votes + 1 WHERE cid = $id");
// Update the user's history:
user_setHistory($user, "c$id", $vote);
}
}
}
}
function comment_settings($mode, $order, $threshold) {
global $user;
if ($user->id) {
$data[mode] = $mode;
$data[sort] = $order;
$data[threshold] = $threshold;
user_save($data, $user->id);
}
}
function comment_reply($pid, $id) {
global $allowed_html, $link, $theme, $user;
// Extract parent-information/data:
if ($pid) {
$item = db_fetch_object(db_query("SELECT comments.*, users.userid FROM comments LEFT JOIN users ON comments.author = users.id WHERE comments.cid = $pid"));
$theme->comment(new Comment($item->userid, $item->subject, $item->comment, $item->timestamp, $item->url, $item->fake_email, comment_score($comment), $comment->votes, $item->cid), "reply to this comment");
}
else {
$pid = 0;
if ($link == "story") {
$item = db_fetch_object(db_query("SELECT stories.*, users.userid FROM stories LEFT JOIN users ON stories.author = users.id WHERE stories.status != 0 AND stories.id = $id"));
$theme->article($item, "");
}
}
// Build reply form:
$output .= "
\n";
$theme->box("Reply", $output);
}
function comment_preview($pid, $id, $subject, $comment) {
global $allowed_html, $link, $theme, $user;
// Preview comment:
$theme->comment(new Comment($user->userid, $subject, $comment, time(), $user->url, $user->fake_email, "", "", ""), "reply to this comment");
// Build reply form:
$output .= "\n";
// Name field:
$output .= "\n";
$output .= " Your name: \n";
$output .= format_username($user->userid);
$output .= "
\n";
// Subject field:
$output .= "\n";
$output .= " Subject: \n";
$output .= " \n";
$output .= "
\n";
// Comment field:
$output .= "\n";
$output .= " Comment: \n";
$output .= " ". check_textarea($comment) ." \n";
$output .= " Allowed HTML tags: ". htmlspecialchars($allowed_html) .". \n";
$output .= "
\n";
// Hidden fields:
$output .= " \n";
$output .= " \n";
if (empty($subject)) {
$output .= "\n";
$output .= " Warning: you did not supply a subject .\n";
$outout .= "
\n";
}
// Preview and submit button:
$output .= "\n";
$output .= " \n";
$output .= " \n";
$output .= "
\n";
$output .= "\n";
$theme->box("Reply", $output);
}
function comment_post($pid, $id, $subject, $comment) {
global $theme, $link, $user;
// Check for duplicate comments:
$duplicate = db_result(db_query("SELECT COUNT(cid) FROM comments WHERE link = '$link' AND pid = '$pid' AND lid = '$id' AND subject = '". check_input($subject) ."' AND comment = '". check_input($comment) ."'"), 0);
if ($duplicate != 0) {
watchdog("error", "comment: attempt to insert duplicate comment");
$theme->box("duplicate comment", "duplicate comment: $duplicate");
}
else {
// Validate subject:
$subject = ($subject) ? $subject : substr($comment, 0, 29);
// Add watchdog entry:
watchdog("comment", "comment: added comment with subject '$subject'");
// Add comment to database:
db_query("INSERT INTO comments (link, lid, pid, author, subject, comment, hostname, timestamp, score) VALUES ('". check_input($link) ."', $id, $pid, '$user->id', '". check_input($subject) ."', '". check_input($comment) ."', '". getenv("REMOTE_ADDR") ."', '". time() ."', '". ($user->userid ? 1 : 0) ."')");
// Compose header:
header("Location: ". comment_uri("id=$id"));
}
}
function comment_score($comment) {
$value = ($comment->votes) ? ($comment->score / $comment->votes) : (($comment->score) ? $comment->score : 0);
return ((strpos($value, ".")) ? substr($value ."00", 0, 4) : $value .".00");
}
function comment_num_replies($id, $count = 0) {
$result = db_query("SELECT COUNT(cid) FROM comments WHERE pid = $id");
return ($result) ? db_result($result, 0) : 0;
}
function comment_num_filtered($lid, $pid) {
global $user;
$threshold = ($user->id) ? $user->threshold : "0";
$pid = ($pid) ? $pid : 0;
$result = db_query("SELECT COUNT(cid) FROM comments WHERE lid = $lid AND pid = $pid AND ((votes = 0 AND score < $threshold) OR (score / votes < $threshold))");
return ($result) ? db_result($result, 0) : 0;
}
function comment_moderation($comment) {
global $comment_votes, $op, $user;
if ($op == "reply") {
$output .= " ";
}
else if ($user->id && $user->userid != $comment->userid && !user_getHistory($user->history, "c$comment->cid")) {
$output .= "cid]\">\n";
foreach ($comment_votes as $key=>$value) $output .= " $key \n";
$output .= " \n";
}
else {
$output .= "score: ". format_data($comment->score) ." votes: ". format_data($comment->votes) ."
\n";
}
return $output;
}
function comment_controls($threshold = 1, $mode = 3, $order = 1) {
global $REQUEST_URI, $user;
$output .= "\n";
$output .= "\n";
$output .= comment_mode(($user->id ? $user->mode : $mode));
$output .= comment_order(($user->id ? $user->sort : $order));
$output .= comment_threshold(($user->id ? $user->threshold : $threshold));
$output .= " \n";
$output .= " \n";
$output .= " \n";
$output .= " \n";
return $output;
}
function comment_threshold($threshold) {
$output .= "\n";
for ($i = -1; $i < 6; $i++) {
$output .= " Filter - $i ";
}
$output .= " \n";
return $output;
}
function comment_mode($mode) {
global $cmodes;
$output .= "\n";
foreach ($cmodes as $key=>$value) {
$output .= " $value \n";
}
$output .= " \n";
return $output;
}
function comment_order($order) {
global $corder;
$output .= "\n";
foreach ($corder as $key=>$value) {
$output .= " $value \n";
}
$output .= " \n";
return $output;
}
function comment_query($link, $lid, $order, $pid = -1) {
$query .= "SELECT c.*, u.* FROM comments c LEFT JOIN users u ON c.author = u.id WHERE link = '$link' AND c.lid = $lid";
if ($pid >= 0) $query .= " AND pid = $pid";
if ($order == 1) $query .= " ORDER BY c.timestamp DESC";
else if ($order == 2) $query .= " ORDER BY c.timestamp";
else if ($order == 3) $query .= " ORDER BY c.score DESC";
else if ($order == 4) $query .= " ORDER BY c.score";
return db_query($query);
}
function comment_visible($comment, $threshold = 0) {
if ($comment->votes == 0 && $comment->score >= $threshold) return 1;
else if ($comment->votes > 0 && $comment->score / $comment->votes >= $threshold) return 1;
else return 0;
}
function comment_uri($args = 0) {
global $link, $mod;
if ($args) return ($mod) ? "module.php?mod=$mod&$args" : $link .".php?$args";
else return ($mod) ? "module.php?mod=$mod" : $link .".php";
}
function comment_link($comment, $return = 1) {
global $link, $theme;
if ($return) return "lid#$comment->cid") ."\">hlcolor2\">return | lid&pid=$comment->cid") ."\">hlcolor2\">reply to this comment ";
else return "lid&pid=$comment->cid") ."\">hlcolor2\">reply to this comment ";
}
function comment_comment($comment, $folded = 0) {
global $link, $theme;
if ($folded) $theme->comment($comment, $folded);
else print "lid&cid=$comment->cid#$comment->cid") ."\">". check_output($comment->subject) ." by ". format_username($comment->userid) ." (". $score = comment_score($comment) .") ";
}
function comment_thread_min($cid, $threshold) {
global $user, $theme;
$result = db_query("SELECT c.*, u.* FROM comments c LEFT JOIN users u ON c.author = u.id WHERE c.pid = $cid ORDER BY c.timestamp, c.cid");
print "";
while ($comment = db_fetch_object($result)) {
comment_comment($comment);
comment_thread_min($comment->cid, $threshold);
}
print " ";
}
function comment_thread_max($cid, $mode, $threshold, $level = 0, $dummy = 0) {
global $link, $theme, $user;
$result = db_query("SELECT c.*, u.* FROM comments c LEFT JOIN users u ON c.author = u.id WHERE link = '$link' AND c.pid = $cid ORDER BY c.timestamp, c.cid");
print "";
}
function comment_render($lid, $cid) {
global $link, $theme, $REQUEST_URI, $user;
// Pre-process variables:
$lid = empty($lid) ? 0 : $lid;
$cid = empty($cid) ? 0 : $cid;
$mode = ($user->id) ? $user->mode : 4;
$order = ($user->id) ? $user->sort : 1;
$threshold = ($user->id) ? $user->threshold : 3;
if ($user->id) {
// Comment control:
$theme->controls($threshold, $mode, $order);
// Print moderation form:
print "\n";
}
if ($cid > 0) {
$result = db_query("SELECT c.*, u.* FROM comments c LEFT JOIN users u ON c.author = u.id WHERE cid = $cid");
if ($comment = db_fetch_object($result)) {
$theme->comment($comment, comment_link($comment));
}
}
else {
if ($mode == 1) {
$result = comment_query($link, $lid, $order);
print "\n";
}
else if ($mode == 2) {
$result = comment_query($link, $lid, $order);
while ($comment = db_fetch_object($result)) {
if (comment_visible($comment, $threshold)) {
$theme->comment($comment, comment_link($comment, 0));
}
}
}
else if ($mode == 3) {
$result = comment_query($link, $lid, $order, 0);
while ($comment = db_fetch_object($result)) {
comment_comment($comment);
comment_thread_min($comment->cid, $threshold);
}
}
else {
$result = comment_query($link, $lid, $order, 0);
while ($comment = db_fetch_object($result)) {
comment_comment($comment, (comment_visible($comment, $threshold) ? comment_link($comment, 0) : 0));
comment_thread_max($comment->cid, $mode, $threshold, $level + 1);
}
}
}
if ($user->id) {
// Print moderation form:
print " \n";
print " \n";
print " \n";
}
}
?>