comment.php

<?php
/*
 * e107 website system
 *
 * Copyright (C) 2008-2010 e107 Inc (e107.org)
 * Released under the terms and conditions of the
 * GNU General Public License (http://www.gnu.org/licenses/gpl.txt)
 *
 * Comment handling generic interface
 *
 * $URL$
 * $Id$
 */


/**
 *	@package    e107
 *	@subpackage	user
 *	@version 	$Id$;
 *
 *	Display comments
 */

require_once('class2.php');
e107::includeLan(e_LANGUAGEDIR.e_LANGUAGE.'/lan_'.e_PAGE);

	if (!empty(e107::getPref('comments_disabled')))
	{
		exit;
	}


if(e_AJAX_REQUEST) // TODO improve security
{

	if(!ANON && !USER)
	{
		exit;
	}
	
	$ret = array();
	
	// Comment Pagination 
	if(varset($_GET['mode']) == 'list' && vartrue($_GET['id']) && vartrue($_GET['type']))
	{
		$clean_type = preg_replace("/[^\w\d]/","",$_GET['type']);
		
		$tmp = e107::getComment()->getComments($clean_type,intval($_GET['id']),intval($_GET['from']));
		echo $tmp['comments'];
		exit;
	}
	

	if(varset($_GET['mode']) == 'reply' && vartrue($_POST['itemid']))
	{	
		$status 		= e107::getComment()->replyComment($_POST['itemid']);	
		$ret['msg'] 	= COMLAN_332; 
		$ret['error'] 	= ($status) ? false : true;
		$ret['html']	= $status;
		echo json_encode($ret);
		exit; 	
	}
	
	
	if(varset($_GET['mode']) == 'delete' && !empty($_POST['id']) && ADMIN)
	{
		$status 		= e107::getComment()->deleteComment($_POST['id'],$_POST['table'],$_POST['itemid']);
		$ret['msg'] 	= ($status) ? 'Ok' : COMLAN_332; 
		$ret['error'] 	= ($status) ? false : true;
		echo json_encode($ret);
		exit; 	
	}
	
	if(varset($_GET['mode']) == 'approve' && vartrue($_POST['itemid']) && ADMIN)
	{
		$status 		= e107::getComment()->approveComment($_POST['itemid']);		
		$ret['msg'] 	= ($status) ? COMLAN_333 : COMLAN_334; 
		$ret['error'] 	= ($status) ? false : true;
		$ret['html']	= COMLAN_335;
		echo json_encode($ret);
		exit; 	
	}
	
		
	if(!vartrue($_POST['comment']) && varset($_GET['mode']) == 'submit')
	{
		$ret['error'] 	= true;
		$ret['msg'] 	= COMLAN_336." - ".implode(" ",$_GET);
		echo json_encode($ret);
		exit; 	
	}

	// Update Comment 
	if(e107::getPref('allowCommentEdit') && varset($_GET['mode']) == 'edit' && vartrue($_POST['comment']) && vartrue($_POST['itemid']))
	{			
		$error = e107::getComment()->updateComment($_POST['itemid'],$_POST['comment']);
		
		$ret['error'] 	= ($error) ? true : false;
		$ret['msg'] 	= ($error) ? $error : COMLAN_337;
		
		echo json_encode($ret);
		exit;	
	}
	
	// Insert Comment and return rendered html. 
	if(!empty($_POST['comment'])) // ajax render comment
	{
		$pid 				= intval(varset($_POST['pid'], 0)); // ID of the specific comment being edited (nested comments - replies)
		$row 				= array();
		$authName           = e107::getParser()->filter($_POST['author_name'], 'str');
		$clean_authorname 	= vartrue($authName,USERNAME);
		$clean_comment 		= e107::getParser()->toText($_POST['comment']);
		$clean_subject 		= e107::getParser()->filter($_POST['subject'],'str');
		$clean_table        = e107::getParser()->filter($_POST['table'],'str');
		
		$_SESSION['comment_author_name'] = $clean_authorname;
		
		$row['comment_pid'] 		= $pid;
		$row['comment_item_id']		= intval($_POST['itemid']);
		$row['comment_type']		= e107::getComment()->getCommentType($tp->toDB($clean_table,true));
		$row['comment_subject'] 	= $tp->toDB($clean_subject);
		$row['comment_comment'] 	= $tp->toDB($clean_comment);
		$row['user_image'] 			= USERIMAGE;
		$row['user_id']				= (USERID) ? USERID : 0;
		$row['user_name'] 			= USERNAME;
		$row['comment_author_name'] = $tp->toDB($clean_authorname);
		$row['comment_author_id'] 	= (USERID) ? USERID : 0;
		$row['comment_datestamp'] 	= time();
		$row['comment_blocked']		= (check_class($pref['comments_moderate']) ? 2 : 0);
		$row['comment_share']		= ($_POST['comment_share']);
		
		$newid = e107::getComment()->enter_comment($row);
	
		
	//	$newid = e107::getComment()->enter_comment($clean_authorname, $clean_comment, $_POST['table'], intval($_POST['itemid']), $pid, $clean_subject);
	
		if(is_numeric($newid) && ($_GET['mode'] == 'submit'))
		{
			
			$row['comment_id']			= $newid; 		
			$width = ($pid) ? 1 : 0;
			
			$ret['html'] = "\n<!-- Appended -->\n<li>";

			/**
			 * Fix for issue e107inc/e107#3154 (Comments not refreshing on submission)
			 * Missing 6th argument ($subject) caused an exception
			 */
			$ret['html'] .= e107::getComment()->render_comment($row,'comments','comment', (int) $_POST['itemid'], $width, $tp->toDB($clean_subject));
			$ret['html'] .= "</li>\n<!-- end Appended -->\n";
			
			$ret['error'] = false;	
			
		}
		else
		{
			$ret['error'] = true;
			$ret['msg'] = $newid;			
		}
		
		echo json_encode($ret);
	}
	exit;
}

require_once(e_HANDLER."news_class.php"); // FIXME shouldn't be here. 
require_once(e_HANDLER."comment_class.php");
define("PAGE_NAME", LAN_COMMENTS);

if (!e_QUERY)
{
	header('location: '.e_BASE.'index.php');
	exit;
}

$cobj = new comment;
$temp_query = explode(".", e_QUERY);
$action = $temp_query[0];			// Usually says 'comment' - may say 'reply'
$table = $temp_query[1];			// Table containing item associated with comment(s)
$id  = intval(varset($temp_query[2], 0));	// ID of item associated with comments (e.g. news ID)
											// For reply with nested comments, its the ID of the comment
$nid = intval(varset($temp_query[3], ""));	// Action - e.g. 'edit'. Or news ID for reply with nested comments
$xid = intval(varset($temp_query[4], ""));	// ID of target comment
global $comment_edit_query;
$comment_edit_query = $temp_query[0].".".$temp_query[1].".".$temp_query[2];
unset($temp_query);

$redirectFlag = 0;
if (isset($_POST['commentsubmit']) || isset($_POST['editsubmit']))
{	// New comment, or edited comment, being posted.
	if(!ANON && !USER)
	{
		e107::redirect();
		exit;
	}

	switch ($table)
	{
		case 'poll' :
			if (!$sql->select("polls", "poll_title", "`poll_id` = '{$id}' AND `poll_comment` = 1")) 
			{
				e107::redirect();
				exit;
			}
			break;
		case 'news' :
			if (!$sql->select("news", "news_allow_comments", "`news_id` = '{$id}' AND `news_allow_comments` = 0")) 
			{
				e107::redirect();
				exit;
			}
			break;
		case 'user' :
			if (!$sql->select('user', 'user_name', '`user_id` ='.$id)) 
			{
				e107::redirect();
				exit;
			}
			break;
	}

	$pid = intval(varset($_POST['pid'], 0));				// ID of the specific comment being edited (nested comments - replies)
	$editpid = intval(varset($_POST['editpid'], 0));		// ID of the specific comment being edited (in-line comments)

	$clean_authorname = $_POST['author_name'];
	$clean_comment = $_POST['comment'];
	$clean_subject = $_POST['subject'];

	$cobj->enter_comment($clean_authorname, $clean_comment, $table, $id, $pid, $clean_subject);
	if ($table == "news")
	{
		e107::getCache()->clear("news");
	}
	else
	{
		e107::getCache()->clear("comment.php?{$table}.{$id}");
	}

	if($editpid)
	{
		$redirectFlag = $id;
		/*		$redir = preg_replace("#\.edit.*#si", "", e_QUERY);
		header('Location: '.e_SELF.'?{$redir}');
		exit;  */
	}
}


if (isset($_POST['replysubmit']))
{	// Reply to nested comment being posted
	if ($table == "news" && !$sql->select("news", "news_allow_comments", "news_id='{$nid}' "))
	{
		e107::redirect();
		exit;
	}
	else
	{
		$row = $sql->fetch();
		if (!$row['news_id'])
		{
			$pid = (isset($_POST['pid']) ? $_POST['pid'] : 0);
			$pid = intval($pid);

			$clean_authorname = $_POST['author_name'];
			$clean_comment = $_POST['comment'];
			$clean_subject = $_POST['subject'];

			$cobj->enter_comment($clean_authorname, $clean_comment, $table, $nid, $pid, $clean_subject);
			e107::getCache()->clear("comment.php?{$table}.{$id}");
		}
		$redirectFlag = $nid;
	}
}

if ($redirectFlag)
{	// Need to go back to original page

	// Check for core tables first
	switch ($table)
	{
		case "news" :
			header('Location: '.e107::getUrl()->create('news/view/item', 'id='.$redirectFlag));
			exit;
		case "poll" :
			echo "<script>document.location.href='".e_HTTP."comment.php?comment.{$table}.{$redirectFlag}'</script>\n";
			exit;
		case "download" :
			echo "<script>document.location.href='".e_HTTP."download.php?view.{$redirectFlag}'</script>\n";
			exit;
		case "page" :
			echo "<script>document.location.href='".e_HTTP."page.php?{$redirectFlag}'</script>\n";
			exit;
		case 'user' :
			echo "<script>document.location.href='".e107::getUrl()->create('user/profile/view', 'id='.$redirectFlag)."'</script>\n";
			exit;
	}

	// Check plugin e_comment.php files
	$plugin_redir = false;
	$e_comment = $cobj->get_e_comment();
	if ($table == $e_comment[$table]['eplug_comment_ids'])
	{
		$plugin_redir = TRUE;
		$reply_location = str_replace('{NID}', $redirectFlag, $e_comment[$table]['reply_location']);
	}
	
	if ($plugin_redir)
	{
		echo "<script>document.location.href='{$reply_location}'</script>\n";
		exit;
	}
	
	// No redirect found if we get here.
}

$comment_ob_start = FALSE;
if ($action == "reply")
{
	if (!$pref['nested_comments'])
	{
		header('Location: '.e_BASE.'comment.php?comment.{$table}.{$nid}');
		exit;
	}
	
	$query = "`comment_id` = '{$id}' LIMIT 0,1";
	
	if ($sql->select("comments", "comment_subject", "`comment_id` = '{$id}'"))
	{
		$comments = $sql->fetch();
		$subject = $comments['comment_subject'];
		$subject_header = $tp->toHTML($comments['comment_subject']);
	}

	if ($subject == "")
	{
		switch ($table)
		{
			case 'news' :
				if (!$sql->select("news", "news_title", "news_id='{$nid}' "))
				{ 
					e107::redirect();
					exit;
				}
				else
				{
					$news = $sql->fetch();
					$subject = $news['news_title'];
					$title = COMLAN_100;
				}
				break;
			case 'poll' :
				if (!$sql->select("polls", "poll_title", "poll_id='{$nid}' "))
				{
					e107::redirect();
					exit;
				}
				else
				{
					$poll = $sql->fetch();
					$subject = $poll['poll_title'];
					$title = COMLAN_101;
				}
				break;
			case 'download' :
				if ($sql->select('download','download_name',"download_id={$nid} "))
				{
					$row = $sql->fetch();
					$subject = $row['download_name'];
					$title = COMLAN_106;
				}
				else
				{
					e107::redirect();
					exit;
				}
				break;
			case 'user' :
				if ($sql->select('user','user_name',"user_id={$nid} "))
				{
					$row = $sql->fetch();
					$subject = $row['user_name'];
					$title = COMLAN_12;
				}
				else
				{
					e107::redirect();
					exit;
				}
				break;
		}
	}
	define('e_PAGETITLE', COMLAN_102.$subject.($title ? ' / '.$title : '')." / ".LAN_COMMENTS);
	require_once(HEADERF);
}
elseif ($action == 'comment')
{  //  Default code if not reply

	// Check cache
	if ($cache = e107::getCache()->retrieve("comment.php?{$table}.{$id}"))
	{
		require_once(HEADERF);
		echo $cache;
		require_once(FOOTERF);
		exit;
	}
	else
	{
		switch ($table)
		{
			case 'news' :
				/*if(!empty($pref['trackbackEnabled']))
				{
					$query = "SELECT COUNT(tb.trackback_pid) AS tb_count, n.*, u.user_id, u.user_name, u.user_customtitle, nc.category_name, nc.category_icon FROM #news AS n
					LEFT JOIN #user AS u ON n.news_author = u.user_id
					LEFT JOIN #news_category AS nc ON n.news_category = nc.category_id
					LEFT JOIN #trackback AS tb ON tb.trackback_pid  = n.news_id
					WHERE n.news_class REGEXP '".e_CLASS_REGEXP."'
					AND n.news_id={$id}
					AND n.news_allow_comments=0
					GROUP by n.news_id";
				}
				else
				{*/
					$query = "SELECT n.*, u.user_id, u.user_name, u.user_customtitle, nc.category_name, nc.category_icon FROM #news AS n
					LEFT JOIN #user AS u ON n.news_author = u.user_id
					LEFT JOIN #news_category AS nc ON n.news_category = nc.category_id
					WHERE n.news_class REGEXP '".e_CLASS_REGEXP."'
					AND n.news_id={$id}
					AND n.news_allow_comments=0";
			//	}

				if (!$sql->gen($query))
				{
					e107::redirect();
					exit;
				}
				else
				{
					$news = $sql->fetch();
					$subject = $tp->toForm($news['news_title']);
					define("e_PAGETITLE", "{$subject} - ".COMLAN_100." / ".LAN_COMMENTS);
					require_once(HEADERF);
					ob_start();
					$comment_ob_start = TRUE;
					$ix = new news;
					$ix->render_newsitem($news, "extend"); // extend so that news-title-only news text is displayed in full when viewing comments.
					$field = $news['news_id'];
				}
				break;
			case 'poll' :
				if (!$sql->select("polls", "*", "poll_id='{$id}'"))
				{
					e107::redirect();
					exit;
				}
				else
				{
					$row = $sql->fetch();
					$comments_poll = $row['poll_comment'];
					$subject = $row['poll_title'];
					define("e_PAGETITLE", $subject.' - '.COMLAN_101." / ".LAN_COMMENTS);
					$poll_to_show = $id;				// Need to pass poll number through to display routine
					require_once(HEADERF);
					require(e_PLUGIN."poll/poll_menu.php");
					$field = $row['poll_id'];
					if(!$comments_poll)
					{
						require_once(FOOTERF);
						exit;
					}
				}
				break;
			case 'download' :
				if ($sql->select('download','download_name',"download_id={$id} "))
				{
					$row = $sql->fetch();
					$subject = $row['download_name'];
					$title = COMLAN_106;
					$field = $id;
					require_once(HEADERF);
				}
				else
				{
					e107::redirect();
					exit;
				}
				break;
			case 'user' :
				if ($sql->select('user','user_name',"user_id={$id} "))
				{
					$row = $sql->fetch();
					$subject = $row['user_name'];
					//$title = 'Edit comment about user';
					$field = $id;
					require_once(HEADERF);
				}
				else
				{
					e107::redirect();
					exit;
				}
				break;
			default :		// Hope its a plugin table
				$e_comment = $cobj->get_e_comment();
				if ($table == $e_comment[$table]['eplug_comment_ids'])
				{
					if ($sql->select($e_comment[$table]['db_table'],$e_comment[$table]['db_title'],$e_comment[$table]['db_id']."={$id} "))
					{
						$row = $sql->fetch();
						$subject = $row[$e_comment[$table]['db_title']];
						$title = $e_comment[$table]['plugin_name'];
						$field = $id;
						require_once(HEADERF);
					}
					else
					{
						e107::redirect();
						exit;
					}
				}
				else
				{	// Error - emit some debug code
					require_once(HEADERF);
					if (E107_DEBUG_LEVEL)
					{
						echo "Comment error: {$table}  Field: {$e_comment['db_id']}  ID {$id}   Title: {$e_comment['db_title']}<br />";
						echo "<pre>";
						var_dump($e_comment);
						echo "</pre>"; 
					}
					else
					{
						e107::redirect();
						exit;
					}
				}
		}
	}
}
else
{	// Invalid action - just exit
	e107::redirect();
	exit;
}
/*
if(isset($pref['trackbackEnabled']) && $pref['trackbackEnabled'] && $table == 'news')
{
	echo "<span class='smalltext'><b>".$pref['trackbackString']."</b> ".SITEURLBASE.e_PLUGIN_ABS."trackback/trackback.php?pid={$id}</span>";
}*/

$field = ($field ? $field : ($id ? $id : ""));			// ID of associated source item
$width = (isset($width) && $width ? $width : "");
$cobj->compose_comment($table, $action, $field, $width, $subject, $rate=FALSE);
/*
if(isset($pref['trackbackEnabled']) && $pref['trackbackEnabled'] && $table == 'news')
{
	if($sql->select("trackback", "*", "trackback_pid={$id}"))
	{
		$tbArray = $sql -> db_getList();

		if (file_exists(THEME."trackback_template.php")) 
		{
			require_once(THEME."trackback_template.php");
		}
		else 
		{
			require_once(e_CORE."templates/trackback_template.php");
		}

		$text = "";

		foreach($tbArray as $row)
		{
			$scArray = array(
				'TITLE'     => $row['trackback_title'],
				'EXCERPT'   => $row['trackback_excerpt'],
				'BLOGNAME'  => "<a href='{$row['trackback_url']}' rel='external'>{$row['trackback_blogname']}</a>"
			);
			
			$text .= $tp->parseTemplate($TRACKBACK, false, $scArray);
		}

		if($TRACKBACK_RENDER_METHOD)
		{
			$ns->tablerender("<a name='track'></a>".COMLAN_315, $text);
		}
		else
		{
			echo "<a name='track'></a>".$text;
		}
	}
	else
	{
		echo "<a name='track'></a>".COMLAN_316;
	}
	if (ADMIN && getperms("B")) 
	{
		echo "<div style='text-align:right'><a href='".e_PLUGIN_ABS."trackback/modtrackback.php?".$id."'>".COMLAN_317."</a></div><br />";
	}
}*/


//if (!strstr(e_QUERY, "poll"))
// If output buffering started, cache the result
if ($comment_ob_start)
{
	$cache = ob_get_contents();
	e107::getCache()->set("comment.php?{$table}.{$field}", $cache);
	ob_end_flush(); // dump the buffer we started
}

require_once(FOOTERF);