<?php
// Somery, a weblogging script by Robin de Graaf, copyright 2001-2006
// Somery is distributed under the Artistic License (see LICENSE.txt)
//
// ADMIN/SYSTEM/FUNCTIONS.PHP > 08-03-2006
 
// execute some stuff
extract($_POST);
extract($_GET);
mysql_connect($sqlhost, $sqluser, $sqlpass);
mysql_select_db($sqldb);
skinset();
loaduser();
 
$localver = "0.4.6";
 
// functions for the admin system, gathering data
function format_date($raw_date, $format="Y-m-d H:i:s",$tz) {
    global $prefix, $settings;
    ereg("(....)-(..)-(..) (..):(..):(..)",$raw_date,$reg);
    return date($format, mktime($reg[4],$reg[5],$reg[6],$reg[2],$reg[3],$reg[1])+($tz*3600));
}
 
function whitelist($word) {
    global $prefix;
    if ($word) {
        $result = mysql_query("SELECT * FROM ".$prefix."additionals WHERE calltitle = '$word'");
        $total = mysql_num_rows($result);
        if ($total == 0) { 
            return 0;
        } else {
            return 1;
        }
    } else {
        return 0;
    }
}
 
function skinset() {
    global $prefix, $skindir;
    $result = mysql_query("SELECT * FROM ".$prefix."settings");
    while($row=mysql_fetch_object($result)) {
        $skindir = $row->skindir;
    }
    $skindir = "skins/".$skindir;
    return;
}
 
function loadsettings() {
    global $prefix, $settings;
    $result = mysql_query("SELECT * FROM ".$prefix."settings");
    while($row=mysql_fetch_object($result)) {
        $settings['setskin'] = $row->skindir;
        $settings['startlevel'] = $row->startlevel;
        $settings['gmt'] = $row->gmt;
        $settings['dateformat'] = $row->dateformat;
        $settings['timeformat'] = $row->timeformat;
        $settings['startstatus'] = $row->startstatus;
        $settings['registration'] = $row->registration;
        $settings['comments'] = $row->comments;
        $settings['noposts'] = $row->noposts;
        $settings['archive'] = $row->archive;
        $settings['more'] = $row->more;
        $settings['nocomments'] = $row->nocomments;
    }
    return;
}
 
function loaduser($username="") {
    global $userdata, $prefix;
    if ($username) {
        $result = mysql_query("SELECT * FROM ".$prefix."users WHERE username = '$username'");
        while($row=mysql_fetch_object($result)) {
            $userdata['username'] = $row->username;
            $userdata['password'] = $row->password;
            $userdata['level'] = $row->level;
        }
    }
    return $userdata;
}
 
function loadprofile($username="",$profile) {
    global $prefix;
    if ($username && $profile) {
        $result = mysql_query("SELECT $profile FROM ".$prefix."profile WHERE username = '$username'");
        while($row=mysql_fetch_object($result)) {
            $text = $row->$profile;
        }
    }
    return $text;
}
 
// functions for the skin system
function menu() {
    global $checkauth,$prefix,$userdata;
    if ($checkauth) {
        echo "<a href='index.php'>index</a> - ";
        echo "<a href='profile.php'>profile</a> - ";
        echo "<a href='notes.php'>notes</a> - ";
        if ($userdata['level'] >= 1) echo "<a href='articles.php'>articles</a> - ";
        echo "<a href='team.php'>team</a> - ";
        if ($userdata['level'] >= 3) echo "<a href='additionals.php'>additionals</a> - ";
        if ($userdata['level'] >= 3) echo "<a href='settings.php'>settings</a> - ";
        if ($userdata['level'] >= 2) echo "<a href='categories.php'>categories</a> - ";
        echo "<a href='login.php?a=logout'>logout</a> ";
    } elseif (!$checkauth) {
        $result = mysql_query("SELECT * FROM ".$prefix."settings");
        while($row=mysql_fetch_object($result)) {
            $settings['registration'] = $row->registration;
        }
        if ($settings['registration'] == 0) echo "you're not logged in";
        if ($settings['registration'] == 1) echo "<a href='register.php'>register</a>";
    }
}
 
// functions for formatting
function debbcode($text) {
    $text = ereg_replace("\[b\]|\[/b\]|\[i\]|\[/i\]|\[u\]|\[/u\]|\[img\]|\[/img\]|\[quote\]|\[/quote\]|\[email\]|\[/email\]|\[url\]|\[/url\]","", $text);
    return $text;
}
 
function bbcode($text,$type=0) {
    $text = ereg_replace("\r\r", "</p><p>", $text);
    $text = ereg_replace("\r\n\r\n", "</p><p>", $text);
    $text = ereg_replace("\n\n", "</p><p>", $text);
    $text = ereg_replace("\n", "<br />", $text);
 
    $text = preg_replace("/\[quote\](.+?)\[\/quote\]/is", "<blockquote><b>Quote:</b><br />\\1</blockquote>", $text);
    $text = preg_replace("/\[center\](.+?)\[\/center\]/is", "</p><center>\\1</center><p>", $text);
    $text = preg_replace("/\[b\](.+?)\[\/b\]/is", "<b>\\1</b>", $text);
    $text = preg_replace("/\[i\](.+?)\[\/i\]/is", "<i>\\1</i>", $text);
    $text = preg_replace("/\[u\](.+?)\[\/u\]/is", "<u>\\1</u>", $text);
    if ($type != 1) $text = preg_replace("/\[img\](.+?)\[\/img\]{1}/is", "<img src='\\1' border='0' alt=''>", $text);
    $text = preg_replace("/\[email\](.+?)\[\/email\]{1}/is", "<a href='mailto:\\1'>\\1</a>", $text);
 
    $text = preg_replace("/\[url=([^<]+?)\](.+?)\[\/url\]{1}/is", "<a href='\\1'>\\2</a>", $text);
    $text = preg_replace("/\[url\](.+?)\[\/url\]{1}/is", "<a href='\\1'>\\1</a>", $text);
    $text = preg_replace("/\[newurl=([^<]+?)\](.+?)\[\/newurl\]{1}/is", "<a href='\\1' target='_blank'>\\2</a>", $text);
    $text = preg_replace("/\[newurl\](.+?)\[\/newurl\]{1}/is", "<a href='\\1' target='_blank'>\\1</a>", $text);
    return $text;
}
 
function cleanstring($text) {
    $text = ereg_replace("[\x27]","'",trim($text));
    $text = ereg_replace("[\x22]","&quot;",trim($text));
    strip_tags($text);
    $text = ereg_replace(">","&gt;",$text);
    $text = ereg_replace("<","&lt;",$text);
    $text = preg_replace("[\x5c\]","",$text);
    return $text;
}
 
// functions for the output engine
function archive($output="%",$type="title",$dtype="d/m/Y") {
    global $total,$arow,$prefix,$p,$settings,$PHP_SELF;
    if ($settings['archive'] != "0") { $limit = " LIMIT ".$settings['archive']; }
    $result = mysql_query("SELECT * FROM ".$prefix."articles WHERE status = '1' ORDER BY aid DESC$limit");
    while($row=mysql_fetch_object($result)) {
        if ($type == "date") $more = "<a href='".$PHP_SELF."?p=".$row->aid."&c=1'>".debbcode(date($dtype,strtotime($row->date)))."</a>";
        if ($type == "title") $more = "<a href='".$PHP_SELF."?p=".$row->aid."&c=1'>".debbcode($row->title)."</a>";
        if ($type == "td") $more = "<a href='".$PHP_SELF."?p=".$row->aid."&c=1'>".debbcode(date($dtype,strtotime($row->date)))." - ".strtolower(debbcode($row->title))."</a>";
        $info=eregi_replace("\%",$more,$output);
        echo $info;
    }
    if (!$result) echo "empty";
}
 
function exportadd($word,$type="body",$dtype="d/m/Y H:i") {
    global $prefix, $settings;
    $result = mysql_query("SELECT * FROM ".$prefix."additionals WHERE calltitle = '$word'");
    while($row=mysql_fetch_object($result)) {
        if ($type == "body") {
            $body = cleanstring($row->body);
            $body = bbcode($body);
            echo $body;
        } elseif ($type == "title") {
            $body = cleanstring($row->title);
            $body = bbcode($body);
            echo $body;
        } elseif ($type == "calltitle") {
            $body = cleanstring($row->calltitle);
            $body = bbcode($body);
            echo $body;
        } elseif ($type == "created") {
            $body = format_date($row->created, $settings['dateformat']." ".$settings['timeformat'], $settings['gmt']);
            echo $body;
        } elseif ($type == "modified") {
            $body = format_date($row->modified, $settings['dateformat']." ".$settings['timeformat'], $settings['gmt']);
            echo $body;
        }
    }
}
 
function prevnext($next="newer posts",$divider=" - ",$previous="older posts") {
    global $total,$arow,$prefix,$p,$settings,$PHP_SELF,$offset;
 
    if (!$offset) { $offset = 0; }
 
    $offsetnext = $offset - $settings['noposts'];
    $offsetprev = $offset + $settings['noposts'];
 
      if ($offsetnext < 0) {
        $next = "no newer posts";
    } else {
        $next = "<a href='index.php?offset=$offsetnext'>$next</a>";
    }
 
    $resultz = mysql_query("SELECT * FROM ".$prefix."articles WHERE status = '1'");
    $totalz = mysql_num_rows($resultz);
 
    $change = $totalz - $settings['noposts'];
 
    if ($offset >= $change) {
        $prev = "no older posts";
    } else {
        $prev = "<a href='index.php?offset=$offsetprev'>$previous</a>";
    }
 
    echo $next.$divider.$prev;
}
 
function getauthor($item) {
    global $settings, $row, $prefix;
    $result2 = mysql_query("SELECT * FROM ".$prefix."profile WHERE username = '".$row->username."'");
    while($row2=mysql_fetch_object($result2)) {
        echo $row2->$item;
    }
}
 
function getadate() {
    global $row, $prefix, $settings;
    echo format_date($row->datetime, $settings['dateformat'], $settings['gmt']);
}
 
function getatime() {
    global $row, $prefix, $settings;
    echo format_date($row->datetime, $settings['timeformat'], $settings['gmt']);
}
 
function permalink() {
    global $settings, $row, $prefix, $PHP_SELF;
    echo "<a href=\"$PHP_SELF?p=$row->aid&amp;c=1\">$row->title</a>";
}
 
function body() {
    global $settings, $row, $prefix, $p, $PHP_SELF;
    $body = cleanstring($row->body);
    $body = bbcode($body);
    if (!$p) {
        echo $body."</p>";
    } elseif ($p && $row->show_body == 1) {
        echo $body."</p>";
    }
    if ($row->more && !$p) {
        echo "<p><a href=\"$PHP_SELF?p=$row->aid&amp;c=1\">".$settings[more]."</a></p>";
    } elseif ($row->more && $p) {
        $more = cleanstring($row->more);
        $more = bbcode($more);
        echo "<p>".$more."</p>";
    }
}
 
function commentlink ($none="no comment",$single="1 comment",$more="% comments") {
    global $row, $prefix, $settings, $PHP_SELF;
    if ($settings[comments] == 1 && $row->show_comments == 1) {
    $count = mysql_query("SELECT * FROM ".$prefix."comments WHERE parentid = $row->aid");
    $total = mysql_num_rows($count);
    if ($total == 0) echo "<a href=\"$PHP_SELF?p=$row->aid&amp;c=1#comments\">$none</a>";
    if ($total == 1) echo "<a href=\"$PHP_SELF?p=$row->aid&amp;c=1#comments\">$single</a>";
    if ($total > 1) {
        $t="$total";
        $more=eregi_replace("\%",$t,$more);
        echo "<a href=\"$PHP_SELF?p=$row->aid&amp;c=1#comments\">$more</a>";
    }
    } else {
    echo $settings[nocomments];
    }
}
 
function getarticle($item) {
    global $settings, $row, $prefix;
    $result2 = mysql_query("SELECT * FROM ".$prefix."articles WHERE aid = '".$row->aid."'");
    while($row2=mysql_fetch_object($result2)) {
        echo $row2->$item;
    }
}
 
function getcomment($item) {
    global $settings, $c_row, $prefix, $dtr;
    $result2 = mysql_query("SELECT * FROM ".$prefix."comments WHERE coid = '".$c_row->coid."'");
    while($row2=mysql_fetch_object($result2)) {
        if ($item == "date") {
            echo format_date($row2->datetime, "d/m/Y", $settings['gmt']);
        }
        if ($item == "time") {
            echo format_date($row2->datetime, "H:i", $settings['gmt']);
        }
        if ($item != "date" && $item != "time") echo $row2->$item;
    }
}
 
function category () {
    global $row, $prefix;
    $result2 = mysql_query("SELECT * FROM ".$prefix."categories WHERE cid = '".$row->category."'");
    while($row2=mysql_fetch_object($result2)) {
        echo $row2->category;
    }
}
 
function catlink () {
    global $row, $PHP_SELF;
    echo "$PHP_SELF?cat=$row->category";
}
 
function userlink () {
    global $row, $PHP_SELF;
    echo "$PHP_SELF?user=$row->username";
}
 
function comment() {
    global $settings, $c_row, $prefix, $p;
    $result2 = mysql_query("SELECT * FROM ".$prefix."comments WHERE coid = '".$c_row->coid."'");
    while($row2=mysql_fetch_object($result2)) {
        $comment = cleanstring($row2->comment);
        $comment = bbcode($comment,1);
        echo $comment;
    }
}
 
?>

<?php
// Somery, a weblogging script by Robin de Graaf, copyright 2001-2006
// Somery is distributed under the Artistic License (see LICENSE.txt)
//
// ADMIN/ARTICLES.PHP > 08-03-2006
 
$start = TRUE; 
include("system/include.php"); 
if ($checkauth) { 
 
loadsettings();
 
if ($userdata['level'] >= 1) {
 
if (!$action) {
?>
<a name='top'></a>
<strong>Add a new article - <a href="articles.php#active">Active articles</a>/<a href="articles.php#hidden">Hidden articles</a></strong><br />
<table><tr><td><form method="post" action="articles.php"><input type="hidden" name="action" value="post"></td></tr></table>
<table>
<tr><td width=175>Author</td><td><?php echo $user; ?></td></tr>
<tr><td width=175>Article title</td><td><input size=50 name='title' type='text'></td></tr>
<tr><td width=175>Post in category</td><td><select name='category'>
<?php
    $query = "SELECT * FROM ".$prefix."categories ORDER BY cid";
    $result = mysql_query($query);while($row=mysql_fetch_object($result)) {
    echo "<option value='$row->cid'>$row->category";
} ?>
</select></td></tr>
<tr><td width=175 valign=top>Article body</td><td><textarea name='body' rows=12 cols=50></textarea></td></tr>
<tr><td width=175 valign=top>Article more</td><td><textarea name='more' rows=12 cols=50></textarea></td></tr>
<tr><td width=175>Show body after more</td><td><input type='checkbox' name='showbody' CHECKED></td></tr>
<tr><td width=175>Enable comments</td><td><input type='checkbox' name='comments' CHECKED></td></tr>
<?php
if ($settings[startstatus] == 1) $d = " CHECKED";
?>
<tr><td width=175>Article visible<br><br></td><td><input type='checkbox' name='status'<?php echo $d; ?>><br><br></td></tr>
<tr><td width=175>Save changes</td><td><input type='submit' value='proceed'></td></tr>
</table><br>
<?php
 
    $result = mysql_query("SELECT * FROM ".$prefix."articles WHERE status = '1' ORDER BY aid DESC");
    $total = mysql_num_rows($result);
    echo "<a name='active'></a><table width=\"100%\"><tr><td colspan=\"2\"><b>Active articles (".$total.") - <a href='articles.php#top'>Back to top</a></b></td></tr>";
    while($row=mysql_fetch_object($result)) {
        $resultc = mysql_query("SELECT * FROM ".$prefix."comments WHERE parentid = '".$row->aid."'");
        $totalc = mysql_num_rows($resultc);
 
        echo "<tr><td>";
        if ($user == $row->username || $userdata['level'] >= 3) {
            echo "<a href='articles.php?action=edit&aid=$row->aid'>".debbcode($row->title)."</a>";
        } else {
            echo debbcode($row->title);
        }
        echo " by ".$row->username." (<a href='articles.php?action=comview&aid=$row->aid'>comments: ".$totalc."</a>)</td><td width=\"75\">";
        getadate();
        echo "</tr>";
    }
    if (!$total) echo "<tr><td width=100%>None</td></tr>";
    echo "</table><br>";
 
    $result = mysql_query("SELECT * FROM ".$prefix."articles WHERE status = '0' ORDER BY aid DESC");
    $total = mysql_num_rows($result);
    echo "<a name='hidden'></a><table><tr><td><b>Hidden articles (".$total.") - <a href='articles.php#top'>Back to top</a></b></td></tr>";
    while($row=mysql_fetch_object($result)) {
        $resultc = mysql_query("SELECT * FROM ".$prefix."comments WHERE parentid = '".$row->aid."'");
        $totalc = mysql_num_rows($resultc);
 
        echo "<tr><td width=100%><a href='articles.php?action=edit&aid=$row->aid'>".debbcode($row->title)."</a> by ".$row->username." (<a href='articles.php?action=comview&aid=$row->aid'>comments: ".$totalc."</a>)</td></tr>";
    }
    if (!$total) echo "<tr><td width=100%>None</td></tr>";
    echo "</table>";
} elseif ($action == "post") {
    $title = debbcode($title);
    $title = cleanstring($title);
    $body = cleanstring($body);
    $more = cleanstring($more);
    $body = addslashes($body);
    $more = addslashes($more);
    if ($showbody) { $showbody = 1; } else { $showbody = 0; }
    if ($comments) { $comments = 1; } else { $comments = 0; }
    if ($status) { $status = 1; } else { $status = 0; }
 
    if (!$title && !$err) { echo $error[11]; $err = 1; }
    if (!$body && !$err) { echo $error[12]; $err = 1; }
 
    if (!$err) {
        $result = mysql_query("INSERT INTO ".$prefix."articles (username,title,body,more,category,datetime,status,show_comments,show_body) VALUES ('".$userdata['username']."','$title','$body','$more','$category','".date("Y-m-d H:i:s")."','$status','$comments','$showbody')");
           echo "Article posted, redirecting...<meta http-equiv=Refresh content=1;URL='articles.php'>";
    }
} elseif ($action == "edit") {
    $result = mysql_query("SELECT * FROM ".$prefix."articles WHERE aid = '$aid'");
    while($row=mysql_fetch_object($result)) {
    if ($user == $row->username || $userdata['level'] >= 3) {
 
        if ($row->status) $status = " CHECKED";
        if ($row->show_comments) $comments = " CHECKED";
        if ($row->show_body) $showbody = " CHECKED";
        ?>
        <b>Edit an article</b><br>
        <table><tr><td><form method="post" action="articles.php"><input type="hidden" name="action" value="update"><input type="hidden" name="aid" value="<?php echo $aid;?>"></td></tr></table>
        <table>
        <tr><td width=175>Article title</td><td><input size=50 name='title' type='text' value='<?php echo $row->title;?>'></td></tr>
        <tr><td width=175>Post in category</td><td><select name='category'>
        <?php
            $resultcat = mysql_query("SELECT * FROM ".$prefix."categories ORDER BY cid");while($rowc=mysql_fetch_object($resultcat)) {
            if ($rowc->cid == $row->category) {
                echo "<option value='$rowc->cid' SELECTED>$rowc->category";
            } else {
                echo "<option value='$rowc->cid'>$rowc->category";
            }
        } ?>
        </select></td></tr>
        <tr><td width=175 valign=top>Article body</td><td><textarea name='body' rows=9 cols=50><?php echo $row->body;?></textarea></td></tr>
        <tr><td width=175 valign=top>Article more</td><td><textarea name='more' rows=9 cols=50><?php echo $row->more;?></textarea></td></tr>
        <tr><td width=175>Show body when using more</td><td><input type='checkbox' name='showbody'<?php echo $showbody;?>></td></tr>
        <tr><td width=175>Enable comments</td><td><input type='checkbox' name='comments'<?php echo $comments;?>></td></tr>
        <tr><td width=175>Article visible after editing</td><td><input type='checkbox' name='status'<?php echo $status;?>></td></tr>
        <tr><td width=175><br>Delete this post</td><td><br><input type='checkbox' name='delete'></td></tr>
        <tr><td width=175>Save changes</td><td><input type='submit' value='proceed'></td></tr>
        </table><br>
        <?php
    } else { echo "You're not allowed to do that"; }
    }
} elseif ($action == "update") {
    if ($delete) {
        $result = mysql_q