One Hat Cyber Team

View File Name : comments.php

<?php

/*
||==========================================================
||		Fusion News 3.x
||----------------------------------------------------------
|| File Version	: $Id: comments.php 212 2008-02-22 20:44:43Z xycaleth $
|| Contact	: xycaleth@gmail.com
|| Copyright:	: (c) 2006 - 2008, FusionNews.net
|| License Info	: http://www.gnu.org/copyleft/gpl.html
||==========================================================
*/

if ( !defined ('FNEWS_ROOT_PATH') )
{
	if ( isset ($_GET['fn_action']) )
	{
		if ( $_GET['fn_action'] != 'confirm' )
		{
			die ('<p>You should view the comments by including it through news.php, e.g.:</p><p><code>&lt;?php<br /><br />$fn_mode = \'comments\';<br />include \'news/news.php\';<br /><br />?&gt;</code></p>');
		}
		else
		{
			define ('FNEWS_ROOT_PATH', str_replace ('\\', '/', dirname (__FILE__)) . '/');
			include_once FNEWS_ROOT_PATH . 'common.php';
		}
	}
	else
	{
		die ('<p>You should view the comments by including it through news.php, e.g.:</p><p><code>&lt;?php<br /><br />$fn_mode = \'comments\';<br />include \'news/news.php\';<br /><br />?&gt;</code></p>');
	}
}

$id = ( isset ($VARS['fn_id']) ) ? intval ($VARS['fn_id']) : 0;
$action = ( isset ($VARS['fn_action']) ) ? $VARS['fn_action'] : '';

if ( !function_exists ('parse_comments') )
{
	function parse_comments ( &$comment_text, &$comment_author, $comment_email )
	{
		global $cbwordwrap, $wwwidth, $bbc, $htc, $wfcom, $comallowbr, $smilcom;
		
		if ( $cbwordwrap )
		{
			$comment_text = fusion_wordwrap ($comment_text, $wwwidth);
		}

		if ( $wfcom )
		{
			$comment_text = filterbadwords ($comment_text);
		}

		// HTML tags
		if ( $htc )
		{
			$comment_text = unhtmlentities ($comment_text);
			$comment_text = str_replace ('<?', '&lt;?', $comment_text);
		}
		if ( $smilcom )
		{
			$comment_text = InsertSmillies ($comment_text);
		}
		//bbcode
		if ( $bbc )
		{
			$comment_text = InsertBBCode ($comment_text);
		}

		$comment_text = str_replace( "&amp;", "&", $comment_text);
		if ( $comallowbr )
		{
			$comment_text = str_replace(" &br;", "<br />", $comment_text);
			$comment_text = str_replace("&br;", "<br />", $comment_text);
		}
		else
		{
			$comment_text = str_replace(" &br;", "", $comment_text);
			$comment_text = str_replace("&br;", '', $comment_text);
		}

		if ( !empty ($comment_email) )
		{
			$comment_author = '<a href="mailto:' . $comment_email . '">' . $comment_author . '</a>';
		}
	}
}

if ( !headers_sent() )
{
	header ('Last-Modified: ' . gmdate ('D, d M Y H:i:s') . ' GMT');
	header ('Cache-Control: no-cache, must-revalidate');
	header ('Pragma: no-cache');
}

if ( $action == 'confirm' )
{
	$fus_sid = ( isset ($VARS['fn_sid']) ) ? $VARS['fn_sid'] : '';
	if ( empty ($fus_sid) )
	{
		exit;
	}
	
	header ('Content-Type: image/png');
	header ('Cache-control: no-cache, no-store');
	
	$color = array ('black', 'grey', 'white');
	$image = imagecreatetruecolor (175, 80);

	$color['black'] = imagecolorallocate ($image, 0x00, 0x00, 0x00);
	$color['grey']	= imagecolorallocate ($image, 0x4B, 0x4B, 0x4B);
	$color['white'] = imagecolorallocate ($image, 0xFF, 0xFF, 0xFF);

	imagefill ($image, 0, 0, $color['white']);

	$mt = microtime();
	list ($sec, $msec) = explode (' ', $mt);
	mt_srand ($sec * $msec);

	$confirm_code = array();
	for ( $i = 0; $i < 5; $i++ )
	{
		$x = mt_rand (1, 10);
		$confirm_code[] = ( $x % 2 ) ? chr (mt_rand (48, 57)) : chr (mt_rand (65, 90));
	}

	for ( $i = 0; $i < 10; $i++ )
	{
		imageline ($image, mt_rand (5, 80), mt_rand (5, 75), mt_rand (90, 170), mt_rand (5, 75), imagecolorallocate ($image, mt_rand (200, 255), mt_rand(200, 255), mt_rand(200, 255)));
	}

	$i = 10;
	foreach ( $confirm_code as $letter )
	{
		$rand_size = mt_rand (16, 32);
		$rand_angle= mt_rand (-30, 30);
		
		imagettftext ($image,
				$rand_size,
				$rand_angle,
				$i, 50,
				imagecolorallocate ($image, mt_rand (145, 230), mt_rand(145, 230), mt_rand(145, 230)),
				FNEWS_ROOT_PATH . 'news/fonts/VeraMono.ttf',
				$letter);
		$i += 30;
	}

	for ( $i = 0; $i < 10; $i++ )
	{
		imageline ($image, mt_rand (5, 80), mt_rand (5, 75), mt_rand (90, 170), mt_rand (5, 75), imagecolorallocate ($image, mt_rand (200, 255), mt_rand(200, 255), mt_rand(200, 255)));
	}
	
	imagepng ($image);
	imagedestroy ($image);
	
	$confirm_code = implode ('', $confirm_code);
	
	$file = file (FNEWS_ROOT_PATH . 'sessions.php');
	array_shift ($file);
	
	$updated = false;
	$current_time = time();
	$user_ip = getip();
	$data = '<?php die (\'' . $error1 . '\'); ?>' . "\n";
	foreach ( $file as $value )
	{
		if ( empty ($value) )
		{
			continue;
		}
		
		list ($sessid, $code, $newsid, $ip, $last_visit) = explode ('|<|', $value);
		
		if ( $sessid == $fus_sid )
		{
			continue;
		}
		else if ( (($last_visit + 600) >= $current_time) && ($ip != $user_ip) )
		{
			$data .= $value;
		}
	}
	
	$data .= $fus_sid . '|<|' . $confirm_code . '|<|' . $id . '|<|' . $user_ip . '|<|' . $current_time . '|<|' . "\n";
	safe_write ('sessions.php', 'wb', $data);

	exit;
}

if ( !$id )
{
	echo $com10;
	echo get_template('com_footer.php', TRUE);
	return;
}

$news_tmpl = get_template ('news_temp.php', false);
if ( strpos ($news_tmpl, '{nrc}') === false || strpos ($news_tmpl, '{comments}') === false )
{
	return;
}

// free up some memory
unset ($news_tmpl);

if ( checkifbanned (getip()) )
{
	echo $com3;
	return;
}

echo get_template('com_header.php', TRUE);

if ( !$action )
{
	if ( !file_exists (FNEWS_ROOT_PATH . 'news/news.' . $id . '.php') )
	{
		echo $com11;
		echo get_template('com_footer.php', TRUE);
		return;
	}
	
	$session_id = create_security_id();
	
	$file = file(FNEWS_ROOT_PATH . 'news/news.' . $id . '.php');
	array_shift ($file);
	$news_info = parse_news_to_view ($file[0]);
	array_shift ($file);
	
	$fn_page = 1;
	
	$start = 0;
	$end = sizeof ($file);
	$pagination = NULL;
	$next_page = NULL;
	$prev_page = NULL;
	$qs = clean_query_string();
	$qs = '&amp;fn_incl=' . $fn_incl . $qs;
	if ( $comments_pages && $comments_per_page > 0 )
	{
		$fn_page = ( isset ($_GET['fn_page']) ) ? intval ($_GET['fn_page']) : $fn_page;
		$fn_page = ( $fn_page < 1 ) ? 1 : $fn_page;
		
		for ( $i = 0, $j = 1; $i < $end; $i += $comments_per_page, $j++ )
		{
			if ( !empty ($pagination) )
			{
				$pagination .= '&nbsp;';
			}
			
			if ( $j != $fn_page )
			{
				$pagination .= '<a href="?fn_mode=comments&amp;fn_id=' . $id . '&amp;fn_page=' . $j . $qs . '">' . $j . '</a>';
			}
			else
			{
				$pagination .= '<b>' . $j . '</b>';
			}
		}
		
		if ( $end > 0 )
		{
			$prev_page = ( ($fn_page - 1) >= 1 ) ? '<a href="?fn_mode=comments&amp;fn_id=' . $id . '&amp;fn_page=' . ($fn_page - 1) . $qs . '">$1</a>' : '$1';
			$next_page = ( ($fn_page + 1) <= ceil ($end / $comments_per_page) ) ? '<a href="?fn_mode=comments&amp;fn_id=' . $id . '&amp;fn_page=' . ($fn_page + 1) . $qs . '">$1</a>' : '$1';
		}
		
		$start = $comments_per_page * ($fn_page - 1);
		$end = $start + $comments_per_page;
		$end = ( $end > sizeof ($file) ) ? sizeof ($file) : $end;
	}

	//replace user variables
	$temp_short = get_template ('com_fulltemp.php', true);
	$temp_short .= '<script src="' . $furl . '/jsfunc.js" type="text/javascript"></script>' . "\n";
	$temp_short = str_replace ('{post_id}', $news_info['post_id'], $temp_short);
	$temp_short = str_replace ('{subject}', $news_info['subject'], $temp_short);
	$temp_short = str_replace ('{description}', $news_info['description'], $temp_short);
	$temp_short = str_replace ('{user}', $news_info['writer'], $temp_short);
	$temp_short = str_replace ('{date}', $news_info['date'], $temp_short);
	$temp_short = str_replace ('{send}', $news_info['link_tell_friend'], $temp_short);
	$temp_short = str_replace ('{news}', $news_info['news'], $temp_short);
	$temp_short = str_replace ('{fullstory}', $news_info['fullnews'], $temp_short);
	$temp_short = str_replace ('{icon}', $news_info['icon'], $temp_short);
	$temp_short = str_replace ('{nrc}', $news_info['nrc'], $temp_short);
	$temp_short = str_replace ('{com}', $news_info['link_comments'], $temp_short);
	$temp_short = str_replace ('{cat_id}', $news_info['cat_id'], $temp_short);
	$temp_short = str_replace ('{cat_name}', $news_info['cat_name'], $temp_short);
	$temp_short = str_replace ('{cat_icon}', $news_info['cat_icon'], $temp_short);
	$temp_short = str_replace ('{pagination}', $pagination, $temp_short);
	$temp_short = preg_replace ('#{prev_page&\#124;(.+)}#U', $prev_page, $temp_short);
	$temp_short = preg_replace ('#{next_page&\#124;(.+)}#U', $next_page, $temp_short);
	
	$count = 0;
	$comment_template = get_template ('com_temp.php', true);
	$comments = NULL;
	
	$file = array_reverse ($file);
	foreach ( $file as $comment_data )
	{
		list ($comment_ip, $comment_validated, $comment_text, $comment_author, $comment_email, $comment_timestamp, $comment_id) = explode ('|<|', $comment_data);
		if ( !$comment_validated )
		{
			// Can't use this comment at all
			continue;
		}
		
		if ( $count < $start || $count >= $end )
		{
			// Valid comment, but not to be displayed on this post.
			$count++;
			continue;
		}
		
		parse_comments ($comment_text, $comment_author, $comment_email);
		$comment = $comment_template;
		$comment = str_replace ('{poster}', $comment_author, $comment);
		$comment = str_replace ('{comment}', $comment_text, $comment);
		$comment = str_replace ('{date}', date ($datefor, $comment_timestamp), $comment);
		$comment = str_replace ('{posterip}', $comment_ip, $comment);
		$comments .= $comment;
		
		$count++;
	}
	
	if ( empty ($comments) )
	{
		$comments = $com12;
	}

	$extras = show_extras ('comment_form', 'comment', $smilcom, $bbc);
	$box = $extras . '<textarea id="comment" name="comment" rows="$2" cols="$1"></textarea>';
	$temp_short = str_replace('{comments}', $comments, $temp_short);
	$temp_short = str_replace('[form]', '<form action="?fn_mode=comments&amp;fn_action=post&amp;fn_id=' . $id . $qs . '" method="post" id="comment_form">', $temp_short);
	$temp_short = str_replace('[/form]', '</form>', $temp_short);
	$temp_short = str_replace('[buttons]', '<input type="hidden" name="confirm_id" value="' . $session_id . '" /><input type="submit" id="com_Submit" value="' . $com15 . '" />' . "\n" . '<input type="reset" value="' . $com16 . '" />', $temp_short);
	
	$comlen = NULL;
	if ( $comlength <= 0 )
	{
		$temp_short = str_replace('[comlen]', '', $temp_short);
	}
	else
	{
		$comment_too_long = sprintf ($com17, $comlength);
		$comlen .= <<< html
<script type="text/javascript">
//<![CDATA[
document.getElementById('comment').onkeyup = Calcul;
document.getElementById('comment').onkeydown = Calcul;
function Calcul ( e )
{
	var maxchars = $comlength;
	var comment = document.getElementById('comment');
	var comment_length = comment.value.length;
	var characters_left = maxchars - comment_length;
	
	if ( comment_length > maxchars )
	{
		comment.value = comment.value.substring (0, maxchars);
		characters_left = 0;
		alert("$comment_too_long");
	}
	
	document.getElementById('chars').value = characters_left;
}
//]]>
</script>
html;
		$temp_short = str_replace('[comlen]', '<input id="chars" name="chars" size="5" value="' . $comlength . '" disabled="disabled" />', $temp_short);
	}
	
	$temp_short = preg_replace ('/\[pwfld,\s*([0-9]+)\]/i', '<input type="password" size="$1" name="pass" />', $temp_short);
	$temp_short = preg_replace ('/\[namefld,\s*([0-9]+)\]/i', '<input type="text" size="$1" name="name" id="name" />', $temp_short);
	$temp_short = preg_replace ('/\[mailfld,\s*([0-9]+)\]/i', '<input type="text" size="$1" name="email" />', $temp_short);
	$temp_short = preg_replace ('/\[comfld,\s*([0-9]+),\s*([0-9]+)]/i', $box, $temp_short);
	
	// Image verification
	if ( $com_captcha )
	{
		$temp_short = str_replace ('[securityimg]', '<img src="' . $furl . '/comments.php?fn_id=' . $id . '&amp;fn_action=confirm&amp;fn_sid=' . $session_id . '" alt="CAPTCHA" id="captcha" />', $temp_short);
		$temp_short = str_replace ('[securityfld]', '<input type="text" name="code" size="5" maxlength="5" />', $temp_short);
	}
	else
	{
		$temp_short = str_replace ('[securityimg]', '', $temp_short);
		$temp_short = str_replace ('[securityfld]', '', $temp_short);
	}

	$comlen .= "<script type=\"text/javascript\">\n";
	$comlen .= "//<![CDATA[\n";
	$comlen .= "document.getElementById('com_Submit').onclick = Check;\n";
	$comlen .= "function Check(e)\n";
	$comlen .= "{\n";
	$comlen .= "\tvar msg = document.getElementById('comment');\n";
	$comlen .= "\t\tif ((msg.value.length == 0) || (document.getElementById('name').value.length == 0)) {\n";
	$comlen .= "\t\t\talert(\"$com18\");\n";
	$comlen .= "\t\t\treturn false;\n";
	$comlen .= "\t}\n";
	$comlen .= "\telse {\n";
	if ( $comlength > 0)
	{
		$comlen .= 'if (msg.value.length > ' . $comlength . ') document.getElementById(\'comment\').value = msg.value.substring(0, ' . $comlength . ');';
	}
	$comlen .= "\t\treturn true;\n";
	$comlen .= "\t}\n";
	$comlen .= "}\n";
	$comlen .= "//]]>\n";
	$comlen .= "</script>\n";

	$temp_short .= $comlen;
	echo $temp_short;
}
//---------------

//Post Comment
elseif($action == 'post')
{  /*id Post comment*/
	$comment	= ( isset ($VARS["comment"]) ) ? trim ($VARS['comment']) : '';
	$name		= ( isset ($VARS['name']) ) ? trim(substr( $VARS["name"], 0, 40)) : '';
	$email		= ( isset ($VARS["email"]) ) ? $VARS['email'] : '';
	$pass		= ( isset ($VARS['pass']) ) ? trim (substr ($VARS['pass'], 0, 40)) : '';
	$code		= ( isset ($VARS['code']) ) ? $VARS['code'] : '';
	$confirm_id	= ( isset ($VARS['confirm_id']) ) ? $VARS['confirm_id'] : '';

	if ( $com_captcha && !check_security_code ($code, $confirm_id, $id) )
	{
		echo $com13;
	}
	else if ( !$name || !$comment )
	{
		echo $com1;
	}
	else if ( $comlength > 0 && strlen ($comment) > $comlength )
	{
		printf ($com14, $comlength);
	}
	else if ( !valid_email ($email) && $email != '' )
	{
		echo $com2;
	}
	elseif ( checkifflooding (getip(), $id) )
	{
		echo $com4 . ' ' . $floodtime . ' ' . $com5;
	}
	else
	{
		$news_user = 0;
		$passok = 0;
	
		$file = file (FNEWS_ROOT_PATH . 'users.php');
		array_shift ($file);
		
		foreach ( $file as $value )
		{
			list ($fuser, $fnick, $femail, $ficon, $ftimeoffset, $fpass, $le) = explode ('|<|', $value);
			if ( $name == $fuser || $name == $fnick )
			{
				$news_user = 1;
				if ( md5 ($pass) == $fpass )
				{
					$name = $fnick;
					$passok = 1;
					if ( !$email )
					{
						$femail = explode ('=', $femail);
						if ( $femail[0] )
						{
							$email = $femail[1];
						}
					}
				}
			}
		}
		
		if ( $passok == $news_user )
		{
			$ip = getip();
			
			if ( $comallowbr )
			{
				$comment = str_replace("\n", "&br;", $comment);
			}
			else
			{
				$comment = str_replace("\n", "&nbsp;", $comment);
			}
			
			$comment = str_replace("\r", "", $comment);
			$time = time();
			mt_srand((double)microtime()*1000000);
			$random = "com" . mt_rand();
			$file = file (FNEWS_ROOT_PATH . 'news/news.' . $id . '.php');
			$file[count($file)] = $ip . '|<|' . ($com_validation ? 0 : 1) . '|<|' . $comment . '|<|' . $name . '|<|' . $email . '|<|' . $time . '|<|' . $random . '|<|' . "\n";

			list($news_short,$news_full,$news_writer,$news_subject,$news_description,$news_categories,$news_date,$news_comment_count) = explode("|<|", $file[1]);
			
			if ( !$com_validation )
			{
				$news_comment_count++;
			}
			
			$file[1] = $news_short."|<|".$news_full."|<|".$news_writer."|<|".$news_subject."|<|".$news_description . '|<|' . $news_categories."|<|".$news_date."|<|".$news_comment_count."|<|$id|<|\n";
			$data = implode ('', $file);
			
			safe_write ('news/news.' . $id . '.php', 'wb', $data);
			safe_write ('flood.php', 'ab', $ip . '=' . $time . '=' . $id);
			
			//buildnews();

			echo <<< html
<script type="text/javascript">
//<![CDATA[
setTimeout ('window.location="{$_SERVER['HTTP_REFERER']}"', 3000);
//]]>
</script>
html;

			if ( $com_validation )
			{
				echo $com6a;
			}
			else
			{
				echo $com6 . ' <a href="' . $_SERVER['HTTP_REFERER'] . '">' . $com7 . '</a>';
			}
		}
		else
		{
			echo $com8;
		}
	}
}

echo get_template('com_footer.php', TRUE);

?>