OSDN Git Service

Modified for security.
[nucleus-jp/nucleus-plugins.git] / NP_gallery / trunk / gallery / comments.php
1 <?php\r
2 \r
3 class NPG_COMMENTS {\r
4 \r
5         var $itemid;\r
6         var $itemactions;\r
7         var $commentcount;\r
8         \r
9         function NPG_COMMENTS($itemid) {\r
10                 $this->itemid = intval($itemid);\r
11         }\r
12         \r
13         function setItemActions(&$itemActions) {\r
14                 $this->itemActions =& $itemActions;\r
15         }\r
16         \r
17         function showComments( & $template, $maxToShow = -1, $showNone = 1) {\r
18                 \r
19                 \r
20                 $actions = & new NPG_COMMENTACTIONS($this);\r
21                 $parser = & new PARSER($actions->getdefinedactions(), $actions);\r
22                 $actions->settemplate($template);\r
23                 $actions->setparser($parser);\r
24                 \r
25                 if ($maxToShow == 0) {\r
26                         $this->commentcount = $this->amountComments();\r
27 \r
28                 } else {\r
29                         $query = 'select * from '.sql_table('plug_gallery_comment').\r
30                                 ' where cpictureid='.intval($this->itemid).' order by ctime';\r
31                         $comments = sql_query($query);\r
32                         $this->commentcount = mysql_num_rows($comments);\r
33                         \r
34                 }\r
35         \r
36                 if($this->commentcount == 0) {\r
37                         echo __NPG_NO_COMMENTS.'<br/>';\r
38                         return 0;\r
39                 }\r
40                 if (($maxToShow != -1) && ($this->commentcount > $maxToShow)) return 0;\r
41                 \r
42                 \r
43                 //$template->readall();\r
44                 $parser->parse($template->section['COMMENT_HEADER']);\r
45                 while($comment = mysql_fetch_assoc($comments)) {\r
46                         $actions->setcurrentcomment($comment);\r
47                         $parser->parse($template->section['COMMENT_BODY']);\r
48                 }\r
49                 $parser->parse($template->section['COMMENT_FOOTER']);\r
50                 \r
51                 mysql_free_result($comments);\r
52                 return $this->commentcount;\r
53                 \r
54         }\r
55         \r
56         function amountComments() {\r
57                 $query = 'select count(*)'.\r
58                         ' from '.sql_table('plug_gallery_comment').\r
59                         ' where cpictureid='.intval($this->itemid);\r
60                 $res = sql_query($query);\r
61                 $arr = mysql_fetch_row($res);\r
62                 return $arr[0];\r
63         }\r
64         \r
65         function addComment($comment) {\r
66                 global $member,$NPG_CONF,$CONF;\r
67                 \r
68                 if ($CONF['ProtectMemNames'] && !$member->isLoggedIn() && MEMBER::isNameProtected($comment['user']))\r
69                         return _ERROR_COMMENTS_MEMBERNICK;\r
70                 \r
71                 $isvalid = $this->isValidComment($comment);\r
72                 if ($isvalid != 1)\r
73                         return $isvalid;\r
74                 \r
75                 \r
76                 $comment['host'] = gethostbyaddr(serverVar('REMOTE_ADDR'));\r
77                 $comment['ip'] = serverVar('REMOTE_ADDR');\r
78                 \r
79                 if ($member->isLoggedIn()) {\r
80                         $comment['memberid'] = $member->getID();\r
81                         $comment['user'] = '';\r
82                         $comment['userid'] = '';\r
83                 } else {\r
84                         $comment['memberid'] = 0;\r
85                 }\r
86                 \r
87                 $comment = NPG_COMMENT::prepare($comment);\r
88                 $name = addslashes($comment['user']);\r
89                 $usid = addslashes($comment['userid']);\r
90                 $body = addslashes($comment['body']);\r
91                 $host = addslashes($comment['host']);\r
92                 $ip = addslashes($comment['ip']);\r
93                 $memberid  = intval($comment['memberid']);\r
94                 $pictureid = intval($this->itemid);\r
95                 \r
96                 $query = 'insert into '.sql_table('plug_gallery_comment').\r
97                         '(cbody, cuser, cmail, chost, cip, cmemberid, ctime, cpictureid) '.\r
98                         " values ('$body','$name','$usid','$host','$ip','$memberid',NULL,$pictureid) ";\r
99                 sql_query($query);\r
100                 $commentid = mysql_insert_id();\r
101                 return true;\r
102         }\r
103         \r
104         function isValidComment($comment) {\r
105                 global $member,$manager;\r
106                 \r
107                 if (eregi('[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}',$comment['body']) != false)\r
108                         return _ERROR_COMMENT_LONGWORD;\r
109 \r
110                 // check lengths of comment\r
111                 if (strlen($comment['body'])<3)\r
112                         return _ERROR_COMMENT_NOCOMMENT;\r
113 \r
114                 if (strlen($comment['body'])>5000)\r
115                         return _ERROR_COMMENT_TOOLONG;\r
116 \r
117                 // only check username if no member logged in\r
118                 if (!$member->isLoggedIn())\r
119                         if (strlen($comment['user'])<2)\r
120                                 return _ERROR_COMMENT_NOUSERNAME;\r
121                 \r
122                 $result = 1;\r
123                 \r
124                 $manager->notify('ValidateForm', array('type' => 'comment', 'comment' => &$comment, 'error' => &$result));\r
125                 \r
126                 return $result;\r
127         }\r
128         \r
129 }\r
130 \r
131 class NPG_COMMENT extends COMMENT {\r
132 \r
133 \r
134 }\r
135 \r
136 \r
137 class NPG_COMMENTACTIONS extends BaseActions {\r
138         var $currentComment;\r
139         var $commentsObj;\r
140         var $parser;\r
141         var $template;\r
142         \r
143         function NPG_COMMENTACTIONS(&$comments) {\r
144                 $this->BaseActions();\r
145                 $this->setCommentsObj($comments);\r
146         }\r
147         \r
148         function getdefinedactions() {\r
149                 return array(\r
150                         'commentcount',\r
151                         'commentword',\r
152                         'picturelink',\r
153                         'pictureid',\r
154                         'date',\r
155                         'time',\r
156                         'commentid',\r
157                         'body',\r
158                         'memberid',\r
159                         'host',\r
160                         'ip',\r
161                         'user',\r
162                         'userid',\r
163                         'userlink',\r
164                         'userlinkraw',\r
165                         'timestamp'     );\r
166         }\r
167         \r
168         function setCommentsObj(& $cobj) { $this->commentsObj = & $cobj; }\r
169         function setparser(& $parser) { $this->parser = & $parser; }\r
170         function settemplate(& $template) { $this->template = & $template; }\r
171         function setcurrentcomment(& $comment) {\r
172                 if ($comment['cmemberid'] != 0) {\r
173                         //$comment['authtext'] = $template['COMMENTS_AUTH'];\r
174 \r
175                         $mem = MEMBER::createFromID($comment['cmemberid']);\r
176                         $comment['cuser'] = $mem->getDisplayName();\r
177                         if ($mem->getURL())\r
178                                 $comment['cuserid'] = $mem->getURL();\r
179                         else\r
180                                 $comment['cuserid'] = $mem->getEmail();\r
181 \r
182                         $comment['cuserlinkraw'] = \r
183                                 createMemberLink(\r
184                                         $comment['cmemberid'],\r
185                                         $this->commentsObj->itemActions->linkparams\r
186                                 );\r
187                 } else {\r
188 \r
189                         // create smart links\r
190                         if (isValidMailAddress($comment['userid']))\r
191                                 $comment['userlinkraw'] = 'mailto:'.$comment['userid'];\r
192                         elseif (strstr($comment['userid'],'http://') != false)\r
193                                 $comment['userlinkraw'] = $comment['userid'];\r
194                         elseif (strstr($comment['userid'],'www') != false)\r
195                                 $comment['userlinkraw'] = 'http://'.$comment['userid'];\r
196                 }\r
197 \r
198                 $this->currentComment =& $comment;\r
199 \r
200         }\r
201         \r
202         function parse_commentcount() {echo $this->commentsObj->commentcount;}\r
203         //this needs to be modified so not hardcoded\r
204         function parse_commentword() { echo 'comment';}\r
205         \r
206         function parse_picturelink() { echo generatelink('item',$this->commentsObj->itemid);}\r
207         function parse_pictureid() { echo $this->commentsObj->itemid; }\r
208         function parse_date() {\r
209                 $this->parse_timestamp('l jS of F Y');\r
210         }\r
211         \r
212         function parse_time() {\r
213                 $this->parse_timestamp('h:i:s A');\r
214         }\r
215         \r
216         function parse_commentid() {echo $this->currentComment['commentid']; }\r
217         function parse_body() { echo $this->currentComment['cbody']; }\r
218         function parse_memberid() {     echo $this->currentComment['cmemberid']; }\r
219         function parse_timestamp($format = 'l jS of F Y h:i:s A') {\r
220                 $d = $this->currentComment['ctime'];\r
221                 $d = converttimestamp($d);\r
222                 $d = date($format,$d);\r
223                 echo $d;\r
224         }\r
225         function parse_host() { echo $this->currentComment['chost']; }\r
226         function parse_ip() {   echo $this->currentComment['cip']; }\r
227         \r
228         function parse_user() { echo $this->currentComment['cuser']; }\r
229         function parse_userid() { echo $this->currentComment['cuserid']; }\r
230         function parse_userlinkraw() { echo $this->currentComment['cuserlinkraw']; }\r
231         function parse_userlink() {\r
232                 if ($this->currentComment['cuserlinkraw']) {\r
233                         echo '<a href="'.$this->currentComment['cuserlinkraw'].'" rel="nofollow">'.$this->currentComment['cuser'].'</a>';\r
234                 } else {\r
235                         echo $this->currentComment['cuser'];\r
236                 }\r
237         }\r
238         \r
239         \r
240 }\r
241 \r
242 ?>\r