<?php
error_reporting (E_ALL ^ E_NOTICE);
/*********************************************
* ------------ *
* | News.php | *
* ------------ *
* PHPNews - 1.1.1 Release *
* Open Source Project started by Pierce Ward *
* *
* Software Distributed at: *
* [url]http://newsphp.sourceforge.net[/url] *
* ========================================== *
* (c) 2003 Pierce Ward (Big P) *
* All rights reserved. *
* ========================================== *
* This program has been written under the *
* terms of the GNU General Public Licence as *
* published by the Free Software Foundation. *
* *
* The GNU GPL can be found in gpl.txt *
*********************************************/
/* Get the absolute path for including files */
$path = __FILE__;
$path = str_replace('news.php', '', $path);
include_once($path . 'settings.php');
/* Don't edit - Connects to DB */
$dbcon = mysql_connect($db_server, $db_user, $db_passwd);
mysql_select_db($db_name);
/* Grabs Settings and puts it in an Array */
$result = mysql_query('SELECT variable,value FROM ' . $db_prefix . 'settings');
$dbQueries++;
$Settings = array();
while ($row = mysql_fetch_array($result))
{
$Settings[$row['0']] = $row['1'];
}
$lang = $Settings['language'];
/* Opens language file */
if(!file_exists($path . 'languages/' . $lang . '.lng'))
{
include_once($path . 'languages/en_GB.lng');
}
else
{
include_once($path . 'languages/' . $lang . '.lng');
}
$language = $lng;
if(!isset($_GET['action']))
{
news();
}
else if($_GET['action'] == 'fullnews')
{
fullNews();
}
else if($_GET['action'] == 'post')
{
post();
}
else if($_GET['action'] == 'showcat' && isset($_GET['catid']))
{
showCat();
}
function news()
{
global $Settings, $language, $path, $db_prefix;
/* Prints JavaScript for Send to Friend Link */
if ($Settings['enablestf'] == 1)
{
?>
<script type="text/javascript">
<!--
function sendtof(desktopURL)
{
desktop = window.open(desktopURL, "SendToFriend", "toolbar=no,location=no,status=no,menubar=no,scrollbars=yes,width=400,height=275,resizable=no");
}
// -->
</script>
<?
}
/* Set up Previous/Next links if enabled */
if ($Settings['enableprevnext'] == 1)
{
/* If we're on the first page set defaults */
if (!isset($_GET['prevnext']) || $_GET['prevnext'] == 0)
{
$_GET['prevnext'] = 0;
$nextpage = $_GET['prevnext'] + $Settings['numtoshow'];
$previouspage = $_GET['prevnext'];
/* Find total number of News Posts */
$numPosts = mysql_query('SELECT count(*) as total FROM ' . $db_prefix . 'news');
$var = mysql_fetch_assoc($numPosts);
if ($var['total'] > $Settings['numtoshow'])
{
$include = 1;
}
}
/* Otherwise calculate prev/next links */
else if (isset($_GET['prevnext']) && is_Numeric($_GET['prevnext']))
{
$previouspage = $_GET['prevnext'] - $Settings['numtoshow'];
/* Find total number of News Posts */
$numPosts = mysql_query('SELECT count(*) as total FROM ' . $db_prefix . 'news');
$var = mysql_fetch_assoc($numPosts);
/* If the number of posts is greater, there's enough room for another page */
if ($var['total'] > ($_GET['prevnext'] + $Settings['numtoshow']))
{
$nextpage = $_GET['prevnext'] + $Settings['numtoshow'];
}
else
{
$nextpage = 0;
}
/* Include Previous/Next Template */
$include = 1;
}
}
else
{
$_GET['prevnext'] = 0;
}
/* Get information about the News Post */
$SQL_query = mysql_query('SELECT id,posterid,postername,time,subject,titletext,maintext,catid FROM ' . $db_prefix . 'news ORDER BY id DESC LIMIT ' . $_GET['prevnext'] . ', ' . $Settings['numtoshow'] . '');
while($news = mysql_fetch_array($SQL_query))
{
/* Set Variables */
$time = strftime($Settings['timeformat'], $news['time']);
$subject = $news['subject'];
$titletext = $news['titletext'];
/* Find out who made the post (keeps track of usernames) */
$query = mysql_query('SELECT username,email,avatar FROM ' . $db_prefix . 'posters WHERE id = ' . $news['posterid'] . ' OR username = \'' . $news['postername'] . '\'');
$row = mysql_fetch_array($query);
$username = $row['username'];
/* Print Comments if enabled */
if ($Settings['enablecomments'] == 1)
{
$query2 = mysql_query('SELECT count(*) as total FROM ' . $db_prefix . 'comments WHERE mid = ' . $news['id'] . '');
$var = mysql_fetch_assoc($query2);
$comments = '<a href="' . $PHP_SELF . '?action=fullnews&showcomments=1&id=' . $news['id'] . '">' . $language['CONTENT_NEWSCOMMENTS'] . ' (' . $var['total'] . ')</a>';
}
/* If Categories are enabled... */
if ($Settings['enablecats'] == 1)
{
$cat_query = mysql_query('SELECT * FROM ' . $db_prefix . 'categories WHERE id = ' . $news['catid'] . '');
$cat = mysql_fetch_array($cat_query);
if ($news['catid'] != 0)
{
if ($cat['catname'] != '')
{
$category = '<a href="' . $PHP_SELF . '?action=showcat&catid=' . $cat['id'] . '">' . $cat['catname'] . '</a>';
}
if ($cat['caticon'] != '')
{
$caticon = '<img src="' . $cat['caticon'] . '" border="0" alt="' . $cat['catname'] . '" />';
}
}
}
if (!$username)
{
$username = $news['postername'];
}
if ($Settings['enableavatars'] == 1)
{
if($row['avatar'] != '')
{
$avatar = '<img src="' . $row['avatar'] . '" border="0" alt="' . $username . '\'s avatar" />';
}
else
{
$avatar = '';
}
}
if ($row['email'] != '')
{
$username = '<a href="mailto:' . $row['email'] . '">' . $username . '</a>';
}
else
{
$username = $username;
}
/* Display link to show comments & news if enabled */
if ($news['maintext'] != '' && $Settings['showcominnews'] == 1 && $Settings['enablecomments'] == 1)
{
$maintext = '<a href="' . $PHP_SELF . '?action=fullnews&showcomments=1&id=' . $news['id'] . '">' . $language['CONTENT_NEWSFULLSTORY'] . '</a>';
}
else if ($news['maintext'] != '')
{
$maintext = '<a href="' . $PHP_SELF . '?action=fullnews&id=' . $news['id'] . '">' . $language['CONTENT_NEWSFULLSTORY'] . '</a>';
}
else
{
$maintext = '';
}
if ($Settings['enablestf'] == 1)
{
$sendtofriend = '<a href="javascript:sendtof(\'' . $Settings['phpnewsurl'] . 'sendtofriend.php?mid=' . $news['id'] . '\')">' . $language['CONTENT_NEWSSTFLINK'] . '</a>';
}
echo '<a name="' , $news['id'] , '"><!--' , $news['id'] , '--></a>' , "\n";
include($path . 'templates/news_temp.php');
echo "\n";
/* Clear Variables */
$category = '';
$caticon = '';
}
/* If previous/next links are enabled, include the template */
if ($Settings['enableprevnext'] == 1 && $include == 1)
{
include($path . 'templates/prevnext_temp.php');
echo "\n";
}
}
function fullNews()
{
global $Settings, $language, $path, $showcomments, $db_prefix;
$SQL_query = mysql_query('SELECT posterid,postername,time,subject,titletext,maintext,catid FROM ' . $db_prefix . 'news WHERE id = ' . $_GET['id'] . '');
if (!$_GET['id'])
{
echo '<b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_GENERALERROR'];
}
else if (!mysql_numrows($SQL_query))
{
echo '<b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_NOTEXISTS'];
}
else
{
/* Prints JavaScript for Send to Friend Link */
if ($Settings['enablestf'] == 1)
{
?>
<script type="text/javascript">
<!--
function sendtof(desktopURL)
{
desktop = window.open(desktopURL, "SendToFriend", "toolbar=no,location=no,status=no,menubar=no,scrollbars=yes,width=400,height=275,resizable=no");
}
// -->
</script>
<?
}
/* Put News Post Info into an Array */
$news = mysql_fetch_array($SQL_query);
/* Set the Variables */
$time = strftime($Settings['shorttimeformat'], $news['time']);
$subject = $news['subject'];
$titletext = $news['titletext'];
$maintext = $news['maintext'];
/* Find out who made the post */
$query = mysql_query('SELECT username,email,avatar FROM ' . $db_prefix . 'posters WHERE id = ' . $news['posterid'] . ' OR username = \'' . $news['postername'] . '\'');
$row = mysql_fetch_array($query);
$username = $row['username'];
$email = $row['email'];
/* Print Comments if enabled */
if ($Settings['enablecomments'] == 1)
{
$query2 = mysql_query('SELECT count(*) as total FROM ' . $db_prefix . 'comments WHERE mid = ' . $_GET['id'] . '');
$var = mysql_fetch_assoc($query2);
$comments = '<a href="' . $PHP_SELF . '?action=fullnews&showcomments=1&id=' . $_GET['id'] . '">' . $language['CONTENT_NEWSCOMMENTS'] . ' (' . $var['total'] . ')</a>';
}
/* If Categories are enabled... */
if ($Settings['enablecats'] == 1)
{
$cat_query = mysql_query('SELECT * FROM ' . $db_prefix . 'categories WHERE id = ' . $news['catid'] . '');
$cat = mysql_fetch_array($cat_query);
if ($news['catid'] != 0)
{
$category = '<a href="' . $PHP_SELF . '?action=showcat&catid=' . $cat['id'] . '">' . $cat['catname'] . '</a>';
if ($cat['caticon'] != '' && is_array($cat))
{
$caticon = '<img src="' . $cat['caticon'] . '" border="0" alt="' . $cat['catname'] . '" />';
}
else
{
$caticon = '';
}
}
}
if ($Settings['enableavatars'] == '1' && $row['avatar'] != '')
{
$avatar = '<img src="' . $row['avatar'] . '" border="0" alt="' . $username . '\'s avatar" />';
}
if (!$username)
{
$username = $news['postername'];
}
if ($email != '')
{
$username = '<a href="mailto:' . $email . '">' . $username . '</a>';
}
else
{
$username = $username;
}
if ($Settings['enablestf'] == 1)
{
$sendtofriend = '<a href="javascript:sendtof(\'' . $Settings['phpnewsurl'] . 'sendtofriend.php?mid=' . $_GET['id'] . '\')">' . $language['CONTENT_NEWSSTFLINK'] . '</a>';
}
include($path . 'templates/fullnews_temp.php');
}
/* Include the Comments */
if ($_GET['showcomments'] == 1 && $Settings['enablecomments'] ==1)
{
comments();
}
}
function comments()
{
global $_SERVER, $Settings, $language, $path, $db_prefix;
/* Check if a News post with this ID exists */
$exists = mysql_query('SELECT id FROM ' . $db_prefix . 'news WHERE id = \'' . $_GET['id'] . '\'');
if ($Settings['enablecomments'] != 1)
{
echo '<b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_DISABLED'];
}
else if (mysql_numrows($exists) == 0)
{
echo '<b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_NOTEXISTS'];
}
else
{
/* Order comments */
if ($Settings['showoldcomfirst'] != 1)
{
$order = ' DESC';
}
/* Get the data for all the Comments */
$com_Query = mysql_query('SELECT time,name,message,email,website FROM ' . $db_prefix . 'comments WHERE mid = ' . $_GET['id'] . ' ORDER by id' . $order . '');
while ($comment = mysql_fetch_array($com_Query))
{
$time = strftime($Settings['shorttimeformat'], $comment['time']);
$message = $comment['message'];
if ($comment['website'] != "")
{
$link = '[<a href="' . $comment['website'] . '">' . $language['CONTENT_NEWSWEBSITE'] . '</a>]';
}
else
{
$link = '';
}
/* Censor comment if it is enabled */
if ($Settings['enablecensor'] == 1)
{
$comment['name'] = censor($comment['name']);
$message = censor($message);
}
if ($comment['email'] != '')
{
$name = '<a href="mailto:' . $comment['email'] . '">' . $comment['name'] . '</a>';
}
else
{
$name = $comment['name'];
}
/* Include Template for Added Comments */
include($path . 'templates/comments_temp.php');
}
/* Check if User is banned from making Comments */
$isBanned = checkUserIP($_SERVER['REMOTE_ADDR']);
/* If the person is banned, print warning message */
if ($isBanned == 1)
{
echo '<br /><b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_BANNED'];
}
else
{
/* Otherwise, print the form and include the template for adding comments */
echo '
<form action="?action=post" method="post">
<input type="hidden" name="mid" value="' , $_GET['id'] , '" />' , "\n";
include($path . 'templates/comment_temp.php');
echo '
</form>' , "\n";
}
}
}
function showCat()
{
global $Settings, $language, $path, $db_prefix;
/* Display Category News if it's enabled */
if ($Settings['enablecats'] != 1)
{
echo '<b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_DISABLED'];
}
else
{
/* Prints JavaScript for Send to Friend Link */
if ($Settings['enablestf'] == 1)
{
?>
<script type="text/javascript">
<!--
function sendtof(desktopURL)
{
desktop = window.open(desktopURL, "SendToFriend", "toolbar=no,location=no,status=no,menubar=no,scrollbars=yes,width=400,height=275,resizable=no");
}
// -->
</script>
<?
}
/* Set up Previous/Next links if enabled */
if ($Settings['enableprevnext'] == 1)
{
/* If we're on the first page set defaults */
if (!isset($_GET['prevnext']) || $_GET['prevnext'] == 0)
{
$_GET['prevnext'] = 0;
$nextpage = $_GET['prevnext'] + $Settings['numtoshowcat'];
$previouspage = $_GET['prevnext'];
/* Find total number of News Posts */
$numPosts = mysql_query('SELECT count(*) as total FROM ' . $db_prefix . 'news WHERE catid=' . $_GET['catid'] . '');
$var = mysql_fetch_assoc($numPosts);
/* Only Include Previous/Next links if there is another page! */
if ($var['total'] > $Settings['numtoshowcat'])
{
$include = 1;
}
}
/* Otherwise calculate prev/next links */
else if (isset($_GET['prevnext']) && is_Numeric($_GET['prevnext']))
{
$previouspage = $_GET['prevnext'] - $Settings['numtoshowcat'];
/* Find total number of News Posts */
$numPosts = mysql_query('SELECT count(*) as total FROM ' . $db_prefix . 'news WHERE catid=' . $_GET['catid'] . '');
$var = mysql_fetch_assoc($numPosts);
/* If the number of posts is greater, there's enough room for another page */
if ($var['total'] > ($_GET['prevnext'] + $Settings['numtoshowcat']))
{
$nextpage = $_GET['prevnext'] + $Settings['numtoshowcat'];
}
else
{
$nextpage = 0;
}
/* Include Previous/Next Template */
$include = 1;
}
}
else
{
$_GET['prevnext'] = 0;
}
$SQL_query = mysql_query('SELECT id,posterid,postername,time,subject,titletext,maintext,catid FROM ' . $db_prefix . 'news WHERE catid = ' . $_GET['catid'] . ' ORDER by id DESC LIMIT ' . $_GET['prevnext'] . ', ' . $Settings['numtoshowcat'] . '');
while($news = mysql_fetch_array($SQL_query))
{
/* Set Variables */
$time = strftime($Settings['timeformat'], $news['time']);
$subject = $news['subject'];
$titletext = $news['titletext'];
/* Find out who made the post (keeps track of usernames) */
$query = mysql_query('SELECT username,email,avatar FROM ' . $db_prefix . 'posters WHERE id = ' . $news['posterid'] . ' OR username = \'' . $news['postername'] . '\'');
$row = mysql_fetch_array($query);
$username = $row['username'];
/* Print Comments if enabled */
if ($Settings['enablecomments'] == 1)
{
$query2 = mysql_query('SELECT count(*) as total FROM ' . $db_prefix . 'comments WHERE mid = ' . $news['id'] . '');
$var = mysql_fetch_assoc($query2);
$comments = '<a href="' . $PHP_SELF . '?action=fullnews&showcomments=1&id=' . $news['id'] . '">' . $language['CONTENT_NEWSCOMMENTS'] . ' (' . $var['total'] . ')</a>';
}
$cat_query = mysql_query('SELECT * FROM ' . $db_prefix . 'categories WHERE id = ' . $news['catid'] . '');
$cat = mysql_fetch_array($cat_query);
$category = '<a href="' . $PHP_SELF . '?action=showcat&catid=' . $cat['id'] . '">' . $cat['catname'] . '</a>';
if ($cat['caticon'] != '')
{
$caticon = '<img src="' . $cat['caticon'] . '" border="0" alt="' . $cat['catname'] . '" />';
}
else
{
$caticon = '';
}
if (!$username)
{
$username = $news['postername'];
}
if ($Settings['enableavatars'] == 1)
{
if($row['avatar'] != '')
{
$avatar = '<img src="' . $row['avatar'] . '" border="0" alt="' . $username . '\'s avatar" />';
}
else
{
$avatar = '';
}
}
if ($row['email'] != '')
{
$username = '<a href="mailto:' . $row['email'] . '">' . $username . '</a>';
}
else
{
$username = $username;
}
/* Display link to show comments & news if enabled */
if ($news['maintext'] != '' && $Settings['showcominnews'] == 1 && $Settings['enablecomments'] == 1)
{
$maintext = '<a href="' . $PHP_SELF . '?action=fullnews&showcomments=1&id=' . $news['id'] . '">' . $language['CONTENT_NEWSFULLSTORY'] . '</a>';
}
else if ($news['maintext'] != '')
{
$maintext = '<a href="' . $PHP_SELF . '?action=fullnews&id=' . $news['id'] . '">' . $language['CONTENT_NEWSFULLSTORY'] . '</a>';
}
else
{
$maintext = '';
}
if ($Settings['enablestf'] == 1)
{
$sendtofriend = '<a href="javascript:sendtof(\'' . $Settings['phpnewsurl'] . 'sendtofriend.php?mid=' . $news['id'] . '\')">' . $language['CONTENT_NEWSSTFLINK'] . '</a>';
}
include($path . 'templates/news_temp.php');
echo "\n";
}
/* If previous/next links are enabled, include the template */
if ($Settings['enableprevnext'] == 1 && $include == 1)
{
$catid = $_GET['catid'];
include($path . 'templates/prevnextcat_temp.php');
echo "\n";
}
}
}
function post()
{
global $_SERVER, $language, $Settings, $db_prefix;
/* Clean up */
$_POST['name'] = str_replace(array('&', '"', '<', '>', '|'), array('&', '"', '<', '>', '|'), trim($_POST['name']));
$_POST['message'] = str_replace(array('&', '"', '<', '>', '|'), array('&', '"', '<', '>', '|'), trim($_POST['message']));
$_POST['email'] = trim($_POST['email']);
$_POST['email'] = strip_tags($_POST['email']);
$_POST['website'] = trim($_POST['website']);
$_POST['website'] = strip_tags($_POST['website']);
/* Make sure set amount of time has passed since last post by this person */
$query = mysql_query('SELECT time FROM ' . $db_prefix . 'comments WHERE ip = \'' . $_SERVER['REMOTE_ADDR'] . '\' ORDER by id DESC LIMIT 1');
$result = mysql_fetch_array($query);
/* Make sure there are no problems with the Post */
if ($Settings['enablecomments'] != 1)
{
echo '<b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_DISABLED'];
}
else if (!$_POST['mid'])
{
echo '<b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_GENERALERROR'];
}
else if (time()-$result['time'] < $Settings['floodprotection'])
{
echo '<b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_ERRORWAIT'];
}
/* Check if it's a valid email */
else if ($_POST['email'] != '' && !eregi('^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$', $_POST['email']))
{
echo '<b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_ERROREMAIL'];
}
else if (!$_POST['message'])
{
echo '<b>' , $language['CONTENT_ERROR'] , '</b>: ' , $language['CONTENT_SENDTOFRIENDMSG'];
}
/* Everything is okay! */
else
{
/* Set final defaults */
if($_POST['website'] == 'http://')
{
$_POST['website'] = '';
}
if (!$_POST['name'])
{
$_POST['name'] = 'Guest';
}
$time = time();
mysql_query('INSERT INTO ' . $db_prefix . 'comments (ip,mid,time,name,message,email,website) VALUES (\'' . $_SERVER['REMOTE_ADDR'] . '\', \'' . $_POST['mid'] . '\', \'' . $time . '\', \'' . $_POST['name'] . '\', \'' . $_POST['message'] . '\', \'' . $_POST['email'] . '\', \'' . $_POST['website'] . '\')');
/* Display the comments */
$_GET['showcomments'] = 1;
$_GET['id'] = $_POST['mid'];
fullnews();
}
}
/* Censors Comments */
function censor($text)
{
global $Settings;
static $goodword, $badword;
/* Checks if good/bad words list has already been done (stored in static variable to increase speed) */
if (!is_array($goodword))
{
$badword = array();
$goodword = array();
/* Format the censor list */
$array = explode('|', $Settings['censorlist']);
/* Put the list of words in Arrays */
foreach ($array as $i)
{
list($badword[], $goodword[]) = explode('=', $i);
}
}
/* Replace bad words with clean words */
for($i = 0; $i < count($goodword); $i++)
{
$text = preg_replace('/' . preg_quote($badword[$i], '/') . '/i', $goodword[$i], $text);
}
/* Return the censored text */
return $text;
}
/* Checks Banned IPs */
function checkUserIP($ip)
{
global $db_prefix;
/* Search the 'banned' table for occurences of this IP */
$query = mysql_query('SELECT * FROM ' . $db_prefix . 'banned WHERE ip = \'' . $ip . '\'');
$request = mysql_fetch_array($query);
/* If the User is banned, return a 1 */
if ($request['isbanned'] == 1)
{
return 1;
}
else
{
return 0;
}
}
?>