348 lines
9.8 KiB
PHP
348 lines
9.8 KiB
PHP
<?
|
|
require_once('open_db.lib.php');
|
|
|
|
function display_stories($id = NULL) {
|
|
global $db, $is_admin, $editable, $action;
|
|
if (is_null($id))
|
|
$id = get_id();
|
|
$search = get_search_args();
|
|
$page = '';
|
|
$nolink = NULL;
|
|
|
|
if ($action == 'preview') {
|
|
global $file_src;
|
|
$date = 'Awaiting posting';
|
|
$result = get_post_data(TRUE);
|
|
$nolink = TRUE;
|
|
} else if ($action == 'submit') {
|
|
$date = 'Posted '.gmdate("Y-m-d H:i:s");
|
|
if (!$is_admin) {
|
|
$result = get_post_data(TRUE);
|
|
$nolink = TRUE;
|
|
} else {
|
|
$result = get_query($id);
|
|
}
|
|
} else {
|
|
$result = get_query($id);
|
|
}
|
|
|
|
if (count($result) == 0) {
|
|
$page .= '<div class="boxline"></div>'."\n";
|
|
if ($search) {
|
|
$page .= '<div class="box">'."\n";
|
|
$page .= '<p>No articles found.</p>
|
|
<p>Try searching again, or return to the <a
|
|
href="/">main page</a>. The search is case-insensitive, and
|
|
searches the title, author, date, and the text of each article.</p>'."\n";
|
|
$page .= '</div>'."\n";
|
|
} else {
|
|
$page .= '<div class="box">'."\n";
|
|
$page .= '<p>No articles found.</p>';
|
|
$page .= '</div>'."\n";
|
|
}
|
|
$page .= '<div class="boxline"></div>'."\n";
|
|
return $page;
|
|
}
|
|
|
|
$page .= '<div class="boxline"></div>'."\n";
|
|
foreach ($result as $entry) {
|
|
if (empty($entry['id']) && isset($_SESSION['allow_queue_image'])) {
|
|
$entry['id'] = $_SESSION['allow_queue_image'];
|
|
}
|
|
if ($entry['date'])
|
|
$date = 'Posted ' . $entry['date'];
|
|
$page .= '<div class="box">';
|
|
$page .= '<p>';
|
|
if ($is_admin && !$editable) {
|
|
$page .= '<span class="right">[<a href="/publish/edit?id='.$entry['id'].'&queue='.$entry['queue_url'].'">edit</a>]</span>';
|
|
}
|
|
if ($nolink) {
|
|
$page .= '<span class="articletitle">'.$entry['title'].'</span>';
|
|
} else if ($is_admin && $editable) {
|
|
$page .= '<a href="/publish/edit?id='.$entry['id'].'&queue='.$entry['queue_url'].'">';
|
|
$page .= '<span class="articletitle">'.$entry['title'].'</span>';
|
|
$page .= '</a>';
|
|
} else {
|
|
$page .= '<a href="/article?id='.$entry['id'].'">';
|
|
$page .= '<span class="articletitle">'.$entry['title'].'</span>';
|
|
$page .= '</a>';
|
|
}
|
|
$page .= '<br />';
|
|
if ($entry['hidden'])
|
|
$page .= '<span class="right red">[hidden]</span>';
|
|
$page .= '<span class="articleauthor">'.$entry['author'].'</span><br />';
|
|
$page .= '<span class="articledate">'.$date.'</span></p>';
|
|
if (isset($file_src)) {
|
|
$page .= '<img src="'.$file_src.'" alt="'.$entry['title'].'" />';
|
|
} else if (!empty($entry['img']) || !empty($entry['uploaded'])) {
|
|
if ($editable) {
|
|
$page .= '<img src="/display?id='.$entry['id'].'&queue='.$entry['queue_url'].'" alt="'.$entry['title'].'" />';
|
|
} else {
|
|
$page .= '<img src="/display?id='.$entry['id'].'" alt="'.$entry['title'].'" />';
|
|
}
|
|
} else {
|
|
$page .= $entry['story']."\n";
|
|
}
|
|
$page .= "</div>\n";
|
|
}
|
|
$page .= '<div class="boxline"></div>'."\n";
|
|
|
|
if (count($result) > 1)
|
|
$page .= get_pager();
|
|
|
|
return $page;
|
|
}
|
|
|
|
/*
|
|
* Return number of entries matching our request
|
|
*/
|
|
function get_count() {
|
|
global $db, $is_admin;
|
|
$search = get_search_args();
|
|
$queue = get_queue();
|
|
$table = which_table();
|
|
|
|
// if search= is defined, search....
|
|
if ($search) {
|
|
$count_query = "SELECT COUNT(*) FROM $table WHERE".
|
|
" ( title LIKE '%".$search."%'".
|
|
" OR author LIKE '%".$search."%'".
|
|
" OR date LIKE '%".$search."%'".
|
|
" OR story LIKE '%".$search."%'".
|
|
" )";
|
|
// Otherwise, fall back to default view
|
|
} else {
|
|
$count_query = "SELECT COUNT(*) FROM ".$table." WHERE 1";
|
|
}
|
|
if (!$is_admin && !$queue)
|
|
$count_query .= " AND hidden IS NOT TRUE";
|
|
$count_query .= " ;";
|
|
|
|
//echo $count_query." <br />";
|
|
$row_count = NULL;
|
|
echo $db->info;
|
|
if ($count_query) {
|
|
if ($result = $db->query($count_query)) {
|
|
$row_count = $result->fetch_row();
|
|
$result->close();
|
|
} else {
|
|
die("Error in query: $db->error");
|
|
}
|
|
}
|
|
return $row_count[0];
|
|
}
|
|
|
|
/*
|
|
* Return array of results, correctly keyed to column names.
|
|
*/
|
|
function get_query($id = NULL) {
|
|
global $db, $is_admin;
|
|
$search = get_search_args();
|
|
$sort = get_sort_arg();
|
|
$order = get_order();
|
|
$start = get_start_num();
|
|
$show = get_show_num();
|
|
$queue = get_queue();
|
|
$table = which_table();
|
|
|
|
// If id= is defined, show the corresponding application only
|
|
if (is_numeric($id)) {
|
|
if (!$is_admin && !$queue)
|
|
$query = "SELECT * FROM $table WHERE 1 AND hidden IS NOT TRUE AND id = ".$id." LIMIT 0, 1";
|
|
else
|
|
$query = "SELECT * FROM $table WHERE 1 AND id = ".$id." LIMIT 0, 1";
|
|
|
|
// if search= is defined, search....
|
|
} else if ($search) {
|
|
$query = "SELECT * FROM $table WHERE".
|
|
" ( title LIKE '%".$search."%'".
|
|
" OR author LIKE '%".$search."%'".
|
|
" OR date LIKE '%".$search."%'".
|
|
" OR story LIKE '%".$search."%'".
|
|
" )";
|
|
if (!$is_admin && !$queue)
|
|
$query .= " AND hidden IS NOT TRUE";
|
|
$query .= " ORDER BY ".$sort." " .$order." LIMIT " .$start." , ".$show." ;";
|
|
// Otherwise, fall back to default view
|
|
} else {
|
|
$query = "SELECT * FROM ".$table." WHERE 1";
|
|
if (!$is_admin && !$queue)
|
|
$query .= " AND hidden IS NOT TRUE";
|
|
$query .= " ORDER BY ".$sort." " .$order." LIMIT " .$start." , ".$show." ;";
|
|
}
|
|
|
|
//echo $query;
|
|
if ($result = $db->query($query)) {
|
|
while ($row = $result->fetch_assoc()) {
|
|
$row['queue_url'] = $queue ? 1 : 0;
|
|
$results[] = $row;
|
|
}
|
|
$result->close();
|
|
} else {
|
|
die("Error in query: $db->error");
|
|
}
|
|
return $results;
|
|
}
|
|
|
|
/*
|
|
* Return array of the POST variables we may care about
|
|
* (safer than extract($_POST))
|
|
*
|
|
* If $stripslashes is non-null, run stripslashes on the values
|
|
* Note that stripslashes turns NULL into string("")
|
|
* and int(0) into string("0")
|
|
*
|
|
* If $html is non-null, run the output through htmlspecialchars,
|
|
* to translate HTML-unsafe characters. This should only be needed
|
|
* if you're outputting back to an HTML form.
|
|
*/
|
|
function get_post_data($stripslashes = NULL, $html = NULL) {
|
|
$queue = get_queue();
|
|
$results = array();
|
|
$entry['id'] = isset($_POST['id']) ? $_POST['id'] : NULL;
|
|
$entry['title'] = isset($_POST['title']) ? $_POST['title'] : NULL;
|
|
$entry['author'] = isset($_POST['author']) ? $_POST['author'] : NULL;
|
|
$entry['email'] = isset($_POST['email']) ? $_POST['email'] : NULL;
|
|
$entry['upload'] = isset($_POST['upload']) ? $_POST['upload'] : NULL;
|
|
$entry['story'] = isset($_POST['story']) ? $_POST['story'] : NULL;
|
|
$entry['comments'] = isset($_POST['comments']) ? $_POST['comments'] : NULL;
|
|
$entry['date'] = isset($_POST['date']) ? $_POST['date'] : NULL;
|
|
$entry['hidden'] = isset($_POST['hidden']) ? $_POST['hidden'] : NULL;
|
|
$entry['uploaded'] = isset($_POST['uploaded']) ? $_POST['uploaded'] : NULL;
|
|
$entry['editor'] = isset($_POST['editor']) ? $_POST['editor'] : NULL;
|
|
$entry['remove_img'] = isset($_POST['remove_img']) ? ($_POST['remove_img'] ? 1 : 0) : NULL;
|
|
$entry['queue_url'] = $queue ? 1 : 0;
|
|
|
|
if ($stripslashes) {
|
|
$entry = array_map('stripslashes', $entry);
|
|
}
|
|
if ($html) {
|
|
$entry = array_map('map_html', $entry);
|
|
}
|
|
$results[] = $entry;
|
|
return $results;
|
|
}
|
|
function map_html($string) {
|
|
return htmlspecialchars($string, ENT_QUOTES, 'UTF-8', FALSE);
|
|
}
|
|
function unmap_html($string) {
|
|
return htmlspecialchars_decode($string, ENT_QUOTES);
|
|
}
|
|
|
|
/*
|
|
* Utility functions to sanitise data
|
|
*/
|
|
|
|
function get_id() {
|
|
global $db, $id;
|
|
if (is_numeric($id)) {
|
|
return $id;
|
|
} else if (isset($_REQUEST['id']) && is_numeric($_REQUEST['id'])) {
|
|
$id = $db->real_escape_string(stripslashes($_REQUEST['id']));
|
|
return $id;
|
|
} else {
|
|
return NULL;
|
|
}
|
|
}
|
|
|
|
function get_search_args() {
|
|
global $db;
|
|
if (isset($_GET['search'])) {
|
|
$search = $db->real_escape_string($_GET['search']);
|
|
return $search;
|
|
}
|
|
}
|
|
|
|
function get_order() {
|
|
global $db;
|
|
$order = NULL;
|
|
if (isset($_GET['order'])) {
|
|
$order = $db->real_escape_string($_GET['order']);
|
|
}
|
|
// Sort ascending by default
|
|
if ($order != "ASC" &&
|
|
$order != "DESC" &&
|
|
$order != "asc" &&
|
|
$order != "desc")
|
|
if (get_sort_arg() == "date") {
|
|
$order = "desc";
|
|
}
|
|
else $order = "asc";
|
|
return $order;
|
|
}
|
|
|
|
function get_sort_arg() {
|
|
global $db;
|
|
$sort = NULL;
|
|
if (isset($_GET['sort'])) {
|
|
$sort = $db->real_escape_string($_GET['sort']);
|
|
}
|
|
if ($sort != "author" &&
|
|
$sort != "date" &&
|
|
$sort != "title")
|
|
$sort = "date";
|
|
return $sort;
|
|
}
|
|
|
|
function get_show_num() {
|
|
global $db, $num_stories;
|
|
$show = NULL;
|
|
if (isset($_GET['show'])) {
|
|
$show = $db->real_escape_string($_GET['show']);
|
|
}
|
|
if (is_numeric($show))
|
|
return $show;
|
|
else if ($num_stories)
|
|
return $num_stories;
|
|
else // provide fallback
|
|
return 1;
|
|
}
|
|
|
|
function get_start_num() {
|
|
global $db;
|
|
$start = NULL;
|
|
if (isset($_GET['start'])) {
|
|
$start = $db->real_escape_string($_GET['start']);
|
|
}
|
|
if (!is_numeric($start))
|
|
$start = 0;
|
|
return $start;
|
|
}
|
|
|
|
/*
|
|
* Return the queue
|
|
*/
|
|
function get_queue() {
|
|
global $action, $queue;
|
|
if ($action == 'save' || $action == 'submit')
|
|
$queue = TRUE;
|
|
else if (isset($_REQUEST['queue']))
|
|
$queue = ($_REQUEST['queue'] === '1') ? TRUE : FALSE;
|
|
else if (!is_bool($queue))
|
|
$queue = FALSE;
|
|
return $queue;
|
|
}
|
|
|
|
/*
|
|
* Returns the table name
|
|
*/
|
|
function which_table($move = FALSE, $action = 'read') {
|
|
global $is_admin;
|
|
$queue = get_queue();
|
|
|
|
// Editing
|
|
if ($action == 'delete' && $move && $is_admin) {
|
|
return 'queue';
|
|
} else if ($action == 'post' && $is_admin) {
|
|
return 'xxx';
|
|
} else if ($action == 'save' || $action == 'submit') {
|
|
return 'queue';
|
|
|
|
// Viewing
|
|
} else if ($queue && ($is_admin || array_key_exists('allow_queue_image', $_SESSION))) {
|
|
return 'queue';
|
|
} else {
|
|
return 'xxx';
|
|
}
|
|
}
|