HTTP/1.1 403 Forbidden";
exit;
}
// "nicer" URLs:
$pathinfo = explode("/",$_SERVER['PATH_INFO']);
$command = $pathinfo[1];
$command_id = $pathinfo[2];
if ($command_id != "") {
$_GET['comment'] = $command_id;
}
//
if ($blog_script == "") { $blog_script = "index.php"; }
//
$blog_url = "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['SCRIPT_NAME'];
$blog_folder = str_replace($blog_script, "", $blog_url);
//
$one_year = time() + 31536000; // for cookies
$session_name = md5(md5($blog_name) . md5($blog_description)) . md5(md5($mysql_database) . md5($mysql_table));
session_start();
require "inc/functions.php";
$inside_blog = "1"; // important
function Protect($string) {
$string = mysql_escape_string(strip_tags(htmlspecialchars($string)));
return $string;
}
$_GET['section'] = html_entity_decode($_GET['section']);
foreach ($_GET as $name => $value) {
$_GET[$name] = Protect($value);
}
foreach ($_COOKIE as $name => $value) {
$_COOKIE[$name] = Protect($value);
}
if ($_GET['protection'] == "off" && $_SESSION[$session_name] == "1") {
// an ability to turn off protection when working with raw data (e.g. reading / writing from / to files)
$POST_protection = "off";
}
if ($POST_protection != "off") {
foreach ($_POST as $name => $value) {
if ($name != "user_name" && $name != "blog_name" && $name != "blog_description") {
$_POST[$name] = Protect($value);
} else {
$_POST[$name] = stripslashes(htmlspecialchars($value));
}
}
}
if ($_GET['captcha'] == "1") {
include "./inc/captcha.php";
exit;
}
if ($_GET['language'] != "") {
setcookie("microbloglang", $_GET['language'], $one_year);
$_COOKIE['microbloglang'] = $_GET['language'];
}
// remember commenter's name & email
if ($_POST['comment_name'] != "" && $_POST['comment_email'] != "") {
setcookie("microblogname", $_POST['comment_name'], $one_year);
setcookie("microblogemail", $_POST['comment_email'], $one_year);
}
//
if ($_COOKIE['microbloglang'] == "" AND $_GET['language'] == "") {
if ($blog_language == "") {
$set_language = "english";
} else {
$set_language = $blog_language;
}
$_COOKIE['microbloglang'] = $set_language;
}
include "./inc/{$_COOKIE['microbloglang']}.lng";
// logout / auto-logout deleted users
if ($_GET['logout'] == "1" || (getClass($_SESSION[$session_name."user"]) == 0 && $_SESSION[$session_name] == "1")) {
unset($_SESSION[$session_name]);
setcookie("microblogusername", "", time()-60000);
setcookie("microblogpassword", "", time()-60000);
unset($_COOKIE['microblogusername']);
unset($_COOKIE['microblogpassword']);
unset($_SESSION[$session_name."user"]);
}
// change style and default language
if ($_POST['action'] == $lang['change'] AND $_GET['login'] == "1" AND $_SESSION[$session_name] == "1" AND $lang['change'] != "" AND getClass($_SESSION[$session_name."user"]) == 3) {
$config = "";
if (!$fp = fopen($config_file, "w")) {
$error = true;
}
if (fwrite($fp, $config) === false) {
$error = true;
}
if (!fclose($fp)) {
$error = true;
}
if ($error === true) {
print_content("{$lang['non_writable_config1']} {$config_file} {$lang['non_writable_config2']}");
} else {
$blog_style = $_POST['style'];
}
}
// reload settings
include "{$config_file}";
//
if ($num_posts == "") { $num_posts = "10"; }
// plugin support
$plugin_counter = 0;
// protection
$temp = $_SESSION[$session_name];
$_SESSION[$session_name] = "";
if (getClass($_SESSION[$session_name."user"]) == 3) {
$_SESSION[$session_name] = "1";
}
if ($handle = opendir("plugins")) {
// List all the files
while (false !== ($file = readdir($handle))) {
if (substr($file, strlen($file)-3, 3) == "php") {
include "./plugins/{$file}";
$plugin_name = substr($file, 0, strlen($file)-4);
$plugin_list[$plugin_counter] = $plugin_name;
$plugin_output[$plugin_counter] = $plugin_name();
$plugin_counter++;
}
}
closedir($handle);
}
$_SESSION[$session_name] = $temp;
function parse_plugin_find($find) {
global $plugin_list;
global $plugin_output;
global $plugin_counter;
for ($counter = 0; $counter < $plugin_counter; $counter++) {
$find = array_merge($find, array("{{$plugin_list[$counter]}}"));
}
return $find;
}
function parse_plugin_replace($replace) {
global $plugin_list;
global $plugin_output;
global $plugin_counter;
for ($counter = 0; $counter < $plugin_counter; $counter++) {
$replace = array_merge($replace, array("{$plugin_output[$counter]}"));
}
return $replace;
}
// default style
if ($blog_style == "") { $blog_style = "MarkoBlue2"; }
function template($transform, $into, $filename) {
global $blog_style;
global $lang;
$filename = "styles/{$blog_style}/{$filename}.htm";
if(!$fd = fopen($filename, "r")) {
die("{$lang['template_error']}");
} else {
$template = fread($fd, filesize ($filename));
fclose ($fd);
$template = stripslashes($template);
for ($i = 0; $i < count ($transform); $i++) {
$template = str_replace($transform[$i], $into[$i], $template);
}
return $template;
}
}
function print_content($content, $no_container) {
global $config_file;
include "{$config_file}";
global $version;
global $sections;
global $links;
global $languages;
global $archives;
global $posttitle;
global $blog_url;
global $blog_folder;
global $pagination;
global $num_posts;
// pagination
if ($pagination == "yes") {
$query = "SELECT * FROM {$mysql_table} WHERE comment = '' AND (hide IS NULL OR hide NOT LIKE 'yes') AND section NOT LIKE '_microblog%';";
$result = mysql_query($query);
$num = mysql_numrows($result);
}
$no_pages = ceil($num/$num_posts);
$current_page = intval($_GET['page']);
if ($current_page == 0) {
$current_page = 1;
}
if ($no_pages > 1) {
if ($current_page > 1) {
$current_page_minus_one = $current_page - 1;
$pages_html = "<< ";
} else {
$pages_html = "<< ";
}
for ($p = 1; $p <= $no_pages; $p++) {
if ($p == $current_page) {
$pages_html = $pages_html . "{$p} ";
} else {
$pages_html = $pages_html . "{$p} ";
}
}
if ($current_page != $no_pages) {
$current_page_plus_one = $current_page + 1;
$pages_html = $pages_html . ">> ";
} else {
$pages_html = $pages_html . ">> ";
}
} else {
$pages_html = "";
}
if ($_GET['comment'] != "" || $_GET['section'] != "" || $_GET['login'] != "" || $_POST['search'] != "" || $_GET['month'] != "") {
$pages_html = "";
}
// end pagination
if ($posttitle != "" AND $_GET['comment'] != "") {
$html_title = $blog_name . " - " . $posttitle;
} else {
$html_title = $blog_name;
}
if ($blog_name == "") {
$blog_name = "μBlog " . $version;
$blog_description = "Marko's μBlog";
}
include "./inc/{$_COOKIE['microbloglang']}.lng";
$find = array("{html_title}","{blog_name}","{blog_index.php}","{blog_description}","{blog_folder}","{pagination}");
$replace = array($html_title,$blog_name,$blog_url,$blog_description,$blog_folder,$pages_html);
$find = parse_plugin_find($find);
$replace = parse_plugin_replace($replace);
$header = template($find, $replace, "_template_header_");
$find = array("{lang_valid_xhtml}","{lang_valid_css}","{lang_valid_rss}","{lang_administration}","{lang_login}","{lang_sections}","{lang_all}","{sections}","{lang_links}","{links}","{lang_language}","{languages}","{lang_archives}","{archives}","{blog_script}","{lang_search}","{lang_search_button}","{pagination}");
$replace = array($lang['valid_xhtml'],$lang['valid_css'],$lang['valid_rss'],$lang['administration'],$lang['login'],$lang['sections'],$lang['all'],$sections,$lang['links'],$links,$lang['language'],$languages,$lang['archives'],$archives,$blog_url,$lang['search'],$lang['search_button'],$pages_html);
$find = parse_plugin_find($find);
$replace = parse_plugin_replace($replace);
$footer = template($find, $replace, "_template_footer_");
include "./inc/{$_COOKIE['microbloglang']}.lng";
print $header;
if ($no_container == "") { print "\n"; }
print $content;
if ($no_container == "") { print "\n
\n"; } else { print "\n"; }
print $footer;
mysql_close();
exit;
}
// config file does not exists - start setup
if (filesize($config_file) == 0 || !file_exists($config_file)) {
$error = false;
if (!$fp = fopen($config_file, "w")) {
$error = true;
}
if (fwrite($fp, "") === false) {
$error = true;
}
if (!fclose($fp)) {
$error = true;
}
if ($error === true) {
print_content("{$lang['non_writable_config1']} {$config_file} {$lang['non_writable_config2']}");
} else {
$setup_mode = true;
}
$setup_content = "";
if ($setup_mode === true && $_GET['setup'] != "1") {
print_content($setup_content);
}
if ($_GET['setup'] == "1") {
if ($_POST['mysql_server'] == "" || $_POST['mysql_database'] == "" || $_POST['mysql_username'] == "" || $_POST['mysql_table'] == "") {
print_content("{$lang['missing_info']}");
}
if ($_POST['blog_name'] == "" || $_POST['blog_description'] == "" || $_POST['blog_username'] == "" || $_POST['blog_password'] == "") {
print_content("{$lang['missing_info']}");
}
mysql_connect($_POST['mysql_server'],$_POST['mysql_username'],$_POST['mysql_password']);
@mysql_select_db($_POST['mysql_database']) or print_content("{$lang['database_error']}");
// write config file:
$random = md5(rand(0,999).$_POST['blog_name'].$_POST['blog_description']);
$config = "";
$error = false;
// create table
$mysql_table = $_POST['mysql_table'];
if ($_POST['upgrade'] == "") {
$query = "CREATE TABLE `{$mysql_table}` ( `title` VARCHAR( 255 ) ,"
. ' `text` TEXT ,'
. ' `comment` VARCHAR( 255 ) ,'
. ' `timestamp` DATETIME ,'
. ' `section` VARCHAR( 255 ) ,'
. ' `hide` VARCHAR( 6 ) ,'
. ' `nocomments` VARCHAR( 6 ) ,'
. ' `email` VARCHAR( 255 ) ,'
. ' `other1` VARCHAR( 255 ) ,'
. ' `other2` VARCHAR( 255 ) ,'
. ' `other3` VARCHAR( 255 ) ,'
. ' `other4` VARCHAR( 255 ) ,'
. ' `other5` VARCHAR( 255 ) ,'
. ' `id` INT( 6 ) NOT NULL auto_increment,'
. ' PRIMARY KEY (id));';
$result = mysql_query($query);
$possible_error = mysql_error();
} else {
$result = true;
}
$_POST['blog_password'] = md5($_POST['blog_password']);
$result_debug = mysql_query("SELECT * FROM {$mysql_table};");
$upgrade_debug_num = intval(mysql_num_fields($result_debug));
if ($upgrade_debug_num <= 11) {
$query = "ALTER TABLE {$mysql_table} ADD other3 VARCHAR( 255 ) AFTER other2;";
mysql_query($query);
$query = "ALTER TABLE {$mysql_table} ADD other4 VARCHAR( 255 ) AFTER other3;";
mysql_query($query);
$query = "ALTER TABLE {$mysql_table} ADD other5 VARCHAR( 255 ) AFTER other4;";
mysql_query($query);
mysql_query("INSERT INTO {$mysql_table} (title , section , other4 , other5) VALUES ('{$_POST['blog_username']}','_microblog_user_','{$_POST['blog_password']}','3');");
} else {
$query_username = "SELECT * FROM {$mysql_table} WHERE title = '{$_POST['blog_username']}' AND section = '_microblog_user_';";
$result_username = mysql_query($query_username);
$num_username = intval(mysql_numrows($result_username));
$user_error = "";
if ($num_username > 0) {
$user_error = $lang['user_exists']." ";
} else {
mysql_query("INSERT INTO {$mysql_table} (title , section , other4 , other5) VALUES ('{$_POST['blog_username']}','_microblog_user_','{$_POST['blog_password']}','3');");
} // if ($num_username > 0)
}
if (!$result) {
print_content("{$lang['mysql_error']}: " . $possible_error);
} else {
if (!$fp = fopen($config_file, "w")) {
$error = true;
}
if (fwrite($fp, $config) === false) {
$error = true;
}
if (!fclose($fp)) {
$error = true;
}
if ($error === true) {
print_content("{$lang['non_writable_config1']} {$config_file} {$lang['non_writable_config2']}");
} else {
print_content("{$user_error}{$lang['configuration_completed']} {$lang['click_here']} ");
}
}
}
exit;
}
$login_content = "{$lang['login']}
";
// function to check login details
function checkLogin($username,$password) {
global $mysql_table;
if ($username == "" || $password == "") {
return 0;
}
$check_login = "SELECT * FROM {$mysql_table} WHERE title = '{$username}' AND other4 = '{$password}' AND section = '_microblog_user_';";
$check_result = mysql_query($check_login);
$check_num = intval(mysql_numrows($check_result));
return $check_num;
}
// function to get user's class (level)
function getClass($username) {
global $mysql_table;
global $lang;
global $mysql_server;
global $mysql_username;
global $mysql_password;
global $mysql_database;
if ($username == "") {
return 0;
}
mysql_connect($mysql_server,$mysql_username,$mysql_password);
@mysql_select_db($mysql_database) or print_content("{$lang['database_error_2']}");
$check_login = "SELECT * FROM {$mysql_table} WHERE title = '{$username}' AND section = '_microblog_user_';";
$check_result = mysql_query($check_login);
$user_class = intval(mysql_result($check_result,"0","other5"));
return $user_class;
}
// function to get post id's author
function getUser($id) {
global $mysql_table;
global $lang;
global $mysql_server;
global $mysql_username;
global $mysql_password;
global $mysql_database;
if ($id == "") {
return "";
}
mysql_connect($mysql_server,$mysql_username,$mysql_password);
@mysql_select_db($mysql_database) or print_content("{$lang['database_error_2']}");
$check_author = "SELECT * FROM {$mysql_table} WHERE id = '{$id}' AND section != '_microblog_user_';";
$check_result = mysql_query($check_author);
$author = mysql_result($check_result,"0","other4");
return $author;
}
// cookie-based login
if (checkLogin($_COOKIE['microblogusername'],$_COOKIE['microblogpassword']) == 1 && $_SESSION[$session_name] != "1") {
$_SESSION[$session_name] = "1";
$_SESSION[$session_name."user"] = $_COOKIE['microblogusername'];
}
// visitors can edit their posts if still in session
if ($visitor_edit == "yes") {
$user_session_name = $session_name . "comment" . $_GET['id'];
} else {
$user_session_name = $session_name . "nowayman";
}
// form login
if ($_GET['login'] == "1" AND $_SESSION[$session_name] != "1" AND $_SESSION[$user_session_name] != "1") {
print_content("{$lang['login_to_continue']}" . $login_content);
}
if ($_GET['login'] == "2" AND $_SESSION[$session_name] != "1") {
if (checkLogin($_POST['username'],md5($_POST['password'])) == 1) {
// login procedure
$_SESSION[$session_name] = "1";
$_SESSION[$session_name."user"] = $_POST['username'];
if ($_POST['remember'] == "yes") {
setcookie("microblogusername", $_POST['username'], $one_year);
setcookie("microblogpassword", md5($_POST['password']), $one_year);
}
} else {
print_content("{$lang['wrong_username_or_password']}" . $login_content);
}
}
// failsafe to defend against hackers
if (checkLogin($_POST['username'],md5($_POST['password'])) != 1) {
if ($_GET['login'] != "" AND $_SESSION[$session_name] != "1") {
if ($_GET['edit'] != "1" OR $_GET['post_id'] == "" OR $_GET['id'] == "") {
print_content("{$lang['login_to_continue']}" . $login_content);
}
}
}
// user is logged in
if ($_SESSION[$session_name] == "1" || $_SESSION[$user_session_name] == "1") {
// plugin admin
if ($_GET['plugin'] != "") {
if ($_GET['id'] != "") {
print_content("{$lang['login_to_continue']}" . $login_content);
}
if (getClass($_SESSION[$session_name."user"]) != 3) {
print_content($lang['no_priv']);
}
if ($_GET['help'] != "1") {
print_content($gui[$_GET['plugin']]);
} else {
print_content($help_plugin[$_GET['plugin']]);
}
}
if ($_GET['login'] == "1" || $_GET['login'] == "2") {
mysql_connect($mysql_server,$mysql_username,$mysql_password);
@mysql_select_db($mysql_database) or print_content("{$lang['database_error_2']}");
if ($_GET['edit'] == "1") {
$query = "SELECT * FROM {$mysql_table} WHERE id = '{$_GET['id']}';";
$result = mysql_query($query);
$num = mysql_numrows($result);
if ($num != "1") { print_content("{$lang['does_not_exist']}"); }
$edit_title = stripslashes(mysql_result($result,"0","title"));
$edit_text = stripslashes(mysql_result($result,"0","text"));
$edit_section = stripslashes(mysql_result($result,"0","section"));
$edit_comment = stripslashes(mysql_result($result,"0","comment"));
$edit_email = stripslashes(mysql_result($result,"0","email"));
$edit_hide = stripslashes(mysql_result($result,"0","hide"));
$edit_nocomments = stripslashes(mysql_result($result,"0","nocomments"));
$edit_other1 = stripslashes(mysql_result($result,"0","other1"));
$edit_query = "&edit=1&id={$_GET['id']}";
if ($_GET['link'] == "1") {
$edit_query = "&edit=1&link=1&id={$_GET['id']}";
}
if ($_GET['user'] == "1") {
$edit_query = "&edit=1&user=1&id={$_GET['id']}";
}
if ($_GET['post_id'] != "") {
$edit_query = "&edit=1&post_id={$_GET['post_id']}&id={$_GET['id']}";
}
}
if ($edit_section == "_microblog_link_") {
$is_link = "1";
}
if ($edit_section == "_microblog_user_") {
$is_link = "1";
}
$query = "SELECT DISTINCT section FROM {$mysql_table} WHERE comment = '' AND section NOT LIKE '_microblog%';";
$result = mysql_query($query);
$num = mysql_numrows($result);
$num_plus_one = $num + 1;
if ($_GET['edit'] != "1") {
$text_top = "{$lang['post_new_entry']}";
} else {
if ($edit_comment == "") {
$text_top = "{$lang['edit_post']}";
$text_bottom = "{$lang['delete_post']}";
} else {
$text_top = "{$lang['edit_comment']}";
$text_bottom = "{$lang['delete_comment']}";
}
}
if ($is_link == "1") {
$text_top = "{$lang['edit_link']}";
}
if ($is_link == "1") { $label = $lang['edit_link_name']; } else { $label = $lang['title']; }
$type ="text";
if ($_GET['user'] == "1" && $_GET['post_id'] == "") {
$text_top = "{$lang['edit_user']}";
$label = $lang['username'];
$lang['link_url'] = $lang['change_password'];
$type="password";
}
$post_content = "
{$text_top}
";
if ($_POST['title'] == "" || ($_POST['text'] == "" AND $_GET['user'] != "1")) {
if (($_POST['title'] != "" || ($_POST['text'] != "" AND $_GET['user'] != "1")) && $_GET['edit'] != "1") {
$_SESSION[$session_name."postTitle"] = $_POST['title'];
$_SESSION[$session_name."postText"] = $_POST['text'];
print_content($lang['missing_fields'] . " ".$lang['captcha_retry']." ");
}
if ($_GET['post'] == "1" || $_GET['edit'] == "1") {
print_content($post_content);
} else {
mysql_connect($mysql_server,$mysql_username,$mysql_password);
@mysql_select_db($mysql_database) or print_content("{$lang['database_error_2']}");
if ($_GET['remove'] != "" AND getClass($_SESSION[$session_name."user"]) == 3) {
$query = "DELETE FROM {$mysql_table} WHERE id = '{$_GET['remove']}';";
mysql_query($query);
}
$admin_menu = "{$lang['microblog_administration']} ({$_SESSION[$session_name."user"]})";
// user account list
$admin_menu = $admin_menu . "
{$lang['user_section']}
";
$query = "SELECT * FROM {$mysql_table} WHERE section = '_microblog_user_' ORDER BY id ASC;";
$result = mysql_query($query);
$num = mysql_numrows($result);
for ($i = 0; $i < $num; $i++) {
$user_name = stripslashes(mysql_result($result,$i,"title"));
$user_level = stripslashes(mysql_result($result,$i,"other5"));
switch($user_level) {
case "1": $user_level = $lang['poster']; break;
case "2": $user_level = $lang['moderator']; break;
case "3": $user_level = $lang['administrator']; break;
default: break;
}
$user_id = stripslashes(mysql_result($result,$i,"id"));
if (intval($num) > 1) { $remove = "[{$lang['remove']} ]"; } else { $remove = ""; }
$admin_menu = $admin_menu . "\n{$user_name} ({$user_level}) [{$lang['edit']} ] {$remove}{$lang['appearance']}
{$lang['plugins']}
{$name_plugin[$plugin_name]} ($description_plugin[$plugin_name]) [{$lang['help']} ]($description_plugin[$plugin_name]) [{$lang['help']} ]{$lang['logout']}
{$lang['logout']} ";
print_content($admin_menu);
}
} else {
mysql_connect($mysql_server,$mysql_username,$mysql_password);
@mysql_select_db($mysql_database) or print_content("{$lang['database_error_2']}");
if ($_GET['edit'] != "1") {
$timezone = intval($timezone);
$one = $_POST['title'];
$two = $_POST['text'];
$three = "";
$four = "DATE_ADD(NOW(), INTERVAL {$timezone} HOUR)";
$five = $_POST['section'];
$six = $_POST['hide'];
$seven = $_POST['nocomments'];
$eight = "";
$nine = $htmlarea;
$ten = "";
$eleven = $_SESSION[$session_name."user"];
$twelve = "";
if ($_POST['section'] == "_microblog_user_") {
$one = $_POST['title'];
$two = "";
$three = "";
$four = "''"; // must be '' !
$five = $_POST['section'];
$six = "";
$seven = "";
$eight = "";
$nine = "";
$ten = "";
$eleven = md5($_POST['text']);
$twelve = $_POST['user_level'];
$query = "SELECT * FROM {$mysql_table} WHERE title = '{$_POST['title']}' AND section = '_microblog_user_';";
$result = mysql_query($query);
$num = intval(mysql_numrows($result));
if ($num > 0) {
print_content($lang['user_exists']);
}
if ($_POST['title'] == "" OR $_POST['text'] == "") {
print_content($lang['missing_user_data']);
}
}
if (getClass($_SESSION[$session_name."user"]) != 3 && ($_POST['section'] == "_microblog_user_" || $_POST['section'] == "_microblog_link_")) {
print_content($lang['no_priv']);
}
$query = "INSERT INTO {$mysql_table} (title , text , comment , timestamp , section , hide , nocomments , email , other1 , other2 , other4 , other5 , id) VALUES ( '{$one}', '{$two}', '{$three}', {$four}, '{$five}', '{$six}', '{$seven}', '{$eight}', '{$nine}', '{$ten}', '{$eleven}' , '{$twelve}' , '');";
mysql_query($query);
unset($_SESSION[$session_name."postTitle"]);
unset($_SESSION[$session_name."postText"]);
$query = "SELECT * FROM {$mysql_table} WHERE title = '{$_POST['title']}' AND text = '{$_POST['text']}' ORDER BY id DESC;";
$result = mysql_query($query);
$entry_id = mysql_result($result,"0","id");
if ($nicer_urls == "") {
$entry_link = "{$blog_url}?comment={$entry_id}";
} else {
$entry_link = "{$blog_url}/post/{$entry_id}/";
}
if ($_GET['user'] == "1" || $_GET['link'] == "1") {
$entry_link = "{$blog_url}?login=1";
}
print_content("{$lang['entry_posted']} {$lang['click_here']} ");
} else {
if ($_POST['delete'] != "yes") {
$query = "SELECT * FROM {$mysql_table} WHERE id = '{$_GET['id']}';";
$result = mysql_query($query);
$num = mysql_numrows($result);
$edit_comment = stripslashes(mysql_result($result,"0","comment"));
$edit_section = stripslashes(mysql_result($result,"0","section"));
if (getClass($_SESSION[$session_name."user"]) < 2) {
if ($edit_comment != "") { $id = $edit_comment; } else { $id = $_GET['id']; }
if (getUser($id) != $_SESSION[$session_name."user"] && $_SESSION[$user_session_name] != "1") {
print_content($lang['no_priv']);
}
}
if ($edit_section == "_microblog_link_" OR $edit_section == "_microblog_user_") {
if (getClass($_SESSION[$session_name."user"]) != 3) {
print_content($lang['no_priv']);
}
}
if ($_GET['user'] != "1") {
$query = "UPDATE {$mysql_table} SET title = '{$_POST['title']}' WHERE id = '{$_GET['id']}';";
mysql_query($query);
$query = "UPDATE {$mysql_table} SET text = '{$_POST['text']}' WHERE id = '{$_GET['id']}';";
mysql_query($query);
$query = "UPDATE {$mysql_table} SET section = '{$_POST['section']}' WHERE id = '{$_GET['id']}';";
mysql_query($query);
$query = "UPDATE {$mysql_table} SET hide = '{$_POST['hide']}' WHERE id = '{$_GET['id']}';";
mysql_query($query);
$query = "UPDATE {$mysql_table} SET nocomments = '{$_POST['nocomments']}' WHERE id = '{$_GET['id']}';";
mysql_query($query);
if ($_POST['email'] != "") {
$query = "UPDATE {$mysql_table} SET email = '{$_POST['email']}' WHERE id = '{$_GET['id']}';";
mysql_query($query);
}
if ($_GET['link'] == "1") {
print_content("{$lang['entry_updated']} {$lang['click_here']} ");
}
if ($_GET['post_id'] == "") {
if ($nicer_urls == "") {
$entry_link = "{$blog_url}?comment={$_GET['id']}";
} else {
$entry_link = "{$blog_url}/post/{$_GET['id']}/";
}
print_content("{$lang['entry_updated']} {$lang['click_here']} ");
} else {
if ($nicer_urls == "") {
$entry_link = "{$blog_url}?comment={$_GET['post_id']}#{$_GET['id']}";
} else {
$entry_link = "{$blog_url}/post/{$_GET['post_id']}/#{$_GET['id']}";
}
print_content("{$lang['entry_updated']} {$lang['click_here']} ");
}
} else {
if (getClass($_SESSION[$session_name."user"]) != 3) {
print_content($lang['no_priv']);
}
if ($_POST['text'] != "") {
$_POST['text'] = md5($_POST['text']);
$query = "UPDATE {$mysql_table} SET other4 = '{$_POST['text']}' WHERE id = '{$_GET['id']}';";
mysql_query($query);
}
$query = "UPDATE {$mysql_table} SET other5 = '{$_POST['user_level']}' WHERE id = '{$_GET['id']}';";
mysql_query($query);
print_content("{$lang['entry_updated']} {$lang['click_here']} ");
}
} else {
$query = "SELECT * FROM {$mysql_table} WHERE id = '{$_GET['id']}';";
$result = mysql_query($query);
$num = mysql_numrows($result);
$edit_comment = stripslashes(mysql_result($result,"0","comment"));
$edit_section = stripslashes(mysql_result($result,"0","section"));
if (getClass($_SESSION[$session_name."user"]) < 2) {
if ($edit_comment != "") { $id = $edit_comment; } else { $id = $_GET['id']; }
if (getUser($id) != $_SESSION[$session_name."user"] && $_SESSION[$user_session_name] != "1") {
print_content($lang['no_priv']);
}
}
if ($edit_section == "_microblog_link_" OR $edit_section == "_microblog_user_") {
if (getClass($_SESSION[$session_name."user"]) != 3) {
print_content($lang['no_priv']);
}
}
if ($edit_comment == "") {
$query = "DELETE FROM {$mysql_table} WHERE id = '{$_GET['id']}';";
mysql_query($query);
$query = "DELETE FROM {$mysql_table} WHERE comment = '{$_GET['id']}';";
mysql_query($query);
} else {
$query = "DELETE FROM {$mysql_table} WHERE id = '{$_GET['id']}';";
mysql_query($query);
}
print_content("{$lang['entry_deleted']} {$lang['go_to_the_front_page']} ");
}
}
}
}
}
// main blog thingies :)
mysql_connect($mysql_server,$mysql_username,$mysql_password);
@mysql_select_db($mysql_database) or print_content("{$lang['database_error_2']}");
$query = "SELECT DISTINCT section FROM {$mysql_table} WHERE comment = '' ORDER BY section ASC;";
$result = mysql_query($query);
$num = mysql_numrows($result);
$result_debug = mysql_query("SELECT * FROM {$mysql_table};");
$upgrade_debug_num = mysql_num_fields($result_debug);
if ($upgrade_debug_num == 6) {
print_content("You have upgraded your µBlog version. You must upgrade your database to continue using it! Click here . {$section} {$section} {$link_name} {$link_name} ";
if ($handle = opendir("inc")) {
// List all the files
while (false !== ($file = readdir($handle))) {
if (substr($file, strlen($file)-3, 3) == "lng") {
$lng_name = substr($file, 0, strlen($file)-4);
$lng_label = strtoupper($file{0}) . substr($file, 1, strlen($file)-5);
if ($lng_name == $_COOKIE['microbloglang']) { $selected = "selected='selected'"; } else { $selected = ""; }
$languages = $languages . "{$lng_label} \n";
}
}
closedir($handle);
}
$languages = $languages . " ";
// languages on a seperate page
if ($_GET['languages'] == "1") {
print_content($languages);
}
// archive
$query_archive = "SELECT DISTINCT MONTH(timestamp) AS month, YEAR(timestamp) AS year FROM {$mysql_table} WHERE comment = '' AND section NOT LIKE '_microblog%' ORDER BY timestamp ASC;";
$result_archive = mysql_query($query_archive);
$num_archive = mysql_numrows($result_archive);
for ($i = 0; $i < $num_archive; $i++) {
$month = stripslashes(mysql_result($result_archive,$i,"month"));
$year = stripslashes(mysql_result($result_archive,$i,"year"));
$transform_month = array("1","2","3","4","5","6","7","8","9","10","11","12");
$into_month = array($lang['january'], $lang['february'], $lang['march'], $lang['april'], $lang['may'], $lang['june'], $lang['july'], $lang['august'], $lang['september'], $lang['october'], $lang['november'], $lang['december']);
for ($l = 0; $l < 12; $l++) {
if ($month == $transform_month[$l]) {
$month_word = $into_month[$l];
}
}
$query_num_posts = "SELECT * FROM {$mysql_table} WHERE MONTH(timestamp) = {$month} AND YEAR(timestamp) = {$year} AND comment = '' AND section NOT LIKE '_microblog%';";
$result_num_posts = mysql_query($query_num_posts);
$num_num_posts = mysql_numrows($result_num_posts);
if ($li != "yes") {
$archives = $archives . "{$month_word} {$year} ({$num_num_posts}) {$month_word} {$year} ({$num_num_posts}) {$lang['more']} ";
}
$find_more = "{more}";
$replace_more = "";
$text = str_replace($find_more, $replace_more, $text);
//
$find = array("{link}","{title}","{text}","{timestamp}","{id}","{lang_comments}","{comment_num}","{section}","{section_link}","{author}","{day}","{month}","{year}","{hour}","{minute}","{second}","{comment_link}","{view_count}");
$replace = array($_link,$title,$text,$timestamp,$id,$lang['comments'],"{$comment_num}",$section,"{$blog_url}?section={$section}",$user_name,$day,$month,$year,$hour,$minute,$second,$entry_link,$count);
$find = parse_plugin_find($find);
$replace = parse_plugin_replace($replace);
$body = $body . template($find, $replace, "_template_post_");
}
if ($_GET['comment'] != "" AND $num != "0") {
$comment_content_query = "SELECT * FROM {$mysql_table} WHERE comment = '{$_GET['comment']}' ORDER BY id ASC;";
$comment_content_result = mysql_query($comment_content_query);
$comment_content_num = mysql_numrows($comment_content_result);
$body = $body . "".$lang['captcha_retry']." ");
}
if ($_SESSION[$session_name."captcha"] == "" || !$_SESSION[$session_name."captcha"]) {
print_content($lang['captcha_error'] . " ".$lang['captcha_retry']." ");
}
}
unset($_SESSION[$session_name."captcha"]);
unset($_SESSION[$session_name."title"]);
unset($_SESSION[$session_name."text"]);
$timezone = intval($timezone);
$query = "INSERT INTO {$mysql_table} (title , text , comment , timestamp , section , hide , nocomments , email , other1 , other2 , id) VALUES ( '{$_POST['comment_title']}', '{$_POST['text']}', '{$_GET['comment']}', DATE_ADD(NOW(), INTERVAL {$timezone} HOUR), '{$_POST['comment_name']}', '', '', '{$_POST['comment_email']}', '', '{$_SERVER['REMOTE_ADDR']}', '');";
mysql_query($query);
$query = "SELECT * FROM {$mysql_table} WHERE title = '{$_POST['comment_title']}' AND text = '{$_POST['text']}' AND email = '{$_POST['comment_email']}' AND section = '{$_POST['comment_name']}' ORDER BY id DESC;";
$result_comment_id = mysql_query($query);
$last_id = mysql_result($result_comment_id,"0","id");
$user_session_name = $session_name . "comment" . $last_id;
$_SESSION[$user_session_name] = "1";
} else {
print_content("{$lang['no_commenting']}");
}
if ($visitor_edit == "yes") { $can_edit = $lang['you_can_edit'] . " "; } else { $can_edit = ""; }
print_content("{$lang['thank_you_for_your_comment']} {$can_edit}{$lang['go_back']} ");
}
else {
$_SESSION[$session_name."title"] = $_POST['comment_title'];
$_SESSION[$session_name."text"] = $_POST['text'];
print_content("{$lang['missing_fields']}" . " ".$lang['captcha_retry']." ");
}
}
}
if ($num > 0) {
print_content("{$body}", "no_container");
}
$query = "SELECT * FROM {$mysql_table} WHERE comment = '' AND section NOT LIKE '_microblog%';";
$result = mysql_query($query);
$num = mysql_numrows($result);
if ($num == "0") {
print_content("{$lang['empty_blog']} {$lang['click_here']} ");
} else {
if ($_GET['section'] == "") {
print_content("{$body} {$lang['does_not_exist']}
", "no_container"); // {$lang['does_not_exist']}
} else {
print_content("{$body} {$lang['section_does_not_exist']}
", "no_container"); // {$lang['section_does_not_exist']}
}
}
?>