--- mainfile.php 2004-05-06 15:42:01.000000000 +0200 +++ ../../public_html/gnuheter-arbete/mainfile.php 2004-06-01 15:39:50.000000000 +0200 @@ -27,378 +27,152 @@ # $Id: mainfile.php,v 1.50 2004/05/06 13:42:01 pawal Exp $ if (ereg("/mainfile\.php$",$SCRIPT_NAME)) { - header("Location: index.php"); - die(); + header("Location: index.php"); + die(); } $query_string = getenv ("QUERY_STRING"); if (preg_match ("/UNION|FROM|OUTFILE|nuke_authors|nuke_users/i", $query_string)) { - die ("Thank you! Your data have been logged and sent to the administrator of this site!"); + die ("Thank you! Your data have been logged and sent to the administrator of this site!"); } if (!isset($config)) { include("config.php"); } $mainfile = 1; +function check_user($user) +{ + setcookie('user',''); + + $user = base64_decode($user); + $cookieuser = explode(":", $user); + $cookie[11]=urldecode($cookie[11]); + return $cookie; + + $userArray = cookiedecode($user); + $claimedUser = $userArray[1]; + $claimedPass = $userArray[2]; + if (($claimedUser == '') and ($claimedPass == '')) + return false; # inte inloggad + + dbconnect(); + $sql = "SELECT COUNT(*) FROM users ". + "WHERE uname='".addslashes($claimedUser)."' ". + "AND pass='".addslashes($claimedPass)."'"; + $result = mysql_query($sql); + $resultarray = mysql_fetch_array($result); + $resultcounter = $resultarray[0]; + mysql_free_result($result); + + if ($resultcounter == 1) + return true; # inloggad, inget skumt + + $errmsg = 'Du har råkat ut för något märkligt! Antagligen '; + $errmsg.= 'gör du något dumt på egen hand, eller så har du '; + $errmsg.= 'en gammal cookie som ligger och skräpar. Radera '; + $errmsg.= 'dina cookies och försök igen.'; + die($errmsg); # Skumt! + +} + function dbconnect() { - global $dbhost,$dbname,$dbuname,$dbpass; - mysql_pconnect($dbhost, $dbuname, $dbpass); - @mysql_select_db("$dbname") or die ("Unable to select database"); + global $dbhost,$dbname,$dbuname,$dbpass; + mysql_pconnect($dbhost, $dbuname, $dbpass); + @mysql_select_db("$dbname") or die ("Unable to select database"); } function counter() { - dbconnect(); - mysql_query("UPDATE vars SET value=value+1 where name='totalhits'"); + dbconnect(); + mysql_query("UPDATE vars SET value=value+1 where name='totalhits'"); } function cookiedecode($user) { - global $cookie; - $user = base64_decode($user); - $cookie = explode(":", $user); - $cookie[11]=urldecode($cookie[11]); - return $cookie; + global $cookie; + $user = base64_decode($user); + $cookie = explode(":", $user); + $cookie[11]=urldecode($cookie[11]); + return $cookie; } function isRealUser($user) { - $userArray = cookiedecode($user); - $claimedUser = $userArray[1]; - $claimedPass = $userArray[2]; - if (($claimedUser == '') and ($claimedPass == '')) - return false; # inte inloggad - - dbconnect(); - $sql = "SELECT COUNT(*) FROM users ". - "WHERE uname='".addslashes($claimedUser)."' ". - "AND pass='".addslashes($claimedPass)."'"; - $result = mysql_query($sql); - $resultarray = mysql_fetch_array($result); - $resultcounter = $resultarray[0]; - mysql_free_result($result); - - if ($resultcounter == 1) - return true; # inloggad, inget skumt - - $errmsg = 'Du har råkat ut för något märkligt! Antagligen '; - $errmsg.= 'gör du något dumt på egen hand, eller så har du '; - $errmsg.= 'en gammal cookie som ligger och skräpar. Radera '; - $errmsg.= 'dina cookies och försök igen.'; - die($errmsg); # Skumt! + $userArray = cookiedecode($user); + $claimedUser = $userArray[1]; + $claimedPass = $userArray[2]; + if (($claimedUser == '') and ($claimedPass == '')) + return false; # inte inloggad + + dbconnect(); + $sql = "SELECT COUNT(*) FROM users ". + "WHERE uname='".addslashes($claimedUser)."' ". + "AND pass='".addslashes($claimedPass)."'"; + $result = mysql_query($sql); + $resultarray = mysql_fetch_array($result); + $resultcounter = $resultarray[0]; + mysql_free_result($result); + + if ($resultcounter == 1) + return true; # inloggad, inget skumt + + $errmsg = 'Du har råkat ut för något märkligt! Antagligen '; + $errmsg.= 'gör du något dumt på egen hand, eller så har du '; + $errmsg.= 'en gammal cookie som ligger och skräpar. Radera '; + $errmsg.= 'dina cookies och försök igen.'; + die($errmsg); # Skumt! } function getusrinfo($user) { - global $userinfo; - $user2 = base64_decode($user); - dbconnect(); - $user3 = explode(":", $user2); - $sql = "SELECT uid, name, uname, email, femail, url, ". - "pass, storynum, umode, uorder, thold, noscore, bio, ". - "ublockon, ublock, theme, commentmax, sig FROM users ". - "WHERE uname='{$user3[1]}' AND pass='{$user3[2]}'"; - $result = mysql_query($sql); - if(mysql_num_rows($result)==1) { - $userinfo = mysql_fetch_array($result); - } else { - echo "A problem occured
"; - } - return $userinfo; + global $userinfo; + if (!isset($user) || $user == "") + return; + $user = base64_decode($user); + dbconnect(); + $user = explode(":", $user); + $sql = "SELECT uid, name, uname, email, femail, url, ". + "pass, storynum, umode, uorder, thold, noscore, bio, ". + "ublockon, ublock, theme, commentmax, sig, status FROM users ". + "WHERE uname='{$user[1]}' AND pass='{$user[2]}'"; + $result = mysql_query($sql); + if(mysql_num_rows($result)==1) { + $userinfo = mysql_fetch_array($result); + } + else + { + if (isset($user) && $user != "") setcookie('user',''); + return; + } + $userinfo[sig] = urldecode($userinfo[sig]); + return $userinfo; } function rmflags() { - global $cookie; - if (isset($cookie[4])) { $rmflags = "&mode=$cookie[4]"; } else { - $rmflags = "&mode=thread"; } - if (isset($cookie[5])) { $rmflags .= "&order=$cookie[5]"; } else { - $rmflags .= "&order=0"; } - if (isset($cookie[6])) { $rmflags .= "&thold=$cookie[6]"; } else { - $rmflags .= "&thold=0"; } - return $rmflags; + global $cookie; + if (isset($cookie[4])) { $rmflags = "&mode=$cookie[4]"; } else { + $rmflags = "&mode=thread"; } + if (isset($cookie[5])) { $rmflags .= "&order=$cookie[5]"; } else { + $rmflags .= "&order=0"; } + if (isset($cookie[6])) { $rmflags .= "&thold=$cookie[6]"; } else { + $rmflags .= "&thold=0"; } + return $rmflags; } function store_referer() { - global $httpref, $httprefmax, $HTTP_REFERER, $HTTP_HOST; - if ($httpref > 0) { - if(!$HTTP_REFERER or - ereg("unknown",$HTTP_REFERER) or - ereg($HTTP_HOST, $HTTP_REFERER)) { - } else { - mysql_query("insert into referer values(NULL, '$HTTP_REFERER')"); - } - $result = mysql_query("SELECT COUNT(*) FROM referer"); - list($numrows) = mysql_fetch_row($result); - if($numrows >= $httprefmax) { - mysql_query("DELETE FROM referer"); - } - } + global $httpref, $httprefmax, $HTTP_REFERER, $HTTP_HOST; + if ($httpref > 0) { + if(!$HTTP_REFERER or + ereg("unknown",$HTTP_REFERER) or + ereg($HTTP_HOST, $HTTP_REFERER)) { + } else { + mysql_query("insert into referer values(NULL, '$HTTP_REFERER')"); + } + $result = mysql_query("SELECT COUNT(*) FROM referer"); + list($numrows) = mysql_fetch_row($result); + if($numrows >= $httprefmax) { + mysql_query("DELETE FROM referer"); + } + } } function removecrlf($string) { - return strtr($string, "\015\012", ' '); -} - -function urlWithProtocol($url) { - if (!eregi('^(f|ht)tp:', $url)) - $url = "http://$url"; - - if ($url == 'http://') - $url = ''; - - $url = preg_replace('/(\s|"|\'|\\\\)/', '', $url); - - return $url; -} - -function wordlinks($doc) { - return preg_replace - ('%\[\s*'. # [ - '([a-z0-9]+)\s*'. # (wordlink) - ':\s*'. # : - '([^][<>\\\\]+?)'. # (själva ordet) - '\s*\]%ei', # ] - 'wordlinksProc("\\1", "\\2")', - $doc); -} - -function wordlinksProc($name, $str) { - global $wordlinks; - - $str = stripslashes($str); - $strenc = $str; - - $url = $wordlinks[$name]['url']; - if ($url == '') - return '*felaktig ordlänk*'; - - switch ($wordlinks[$name]['enc']) { - case 'susning': - $strenc = wordlinksEncodingSusning($str); - break; - case 'jargon': - $strenc = wordlinksEncodingJargon($str); - break; - case 'urlencode': - $strenc = urlencode($str); - break; - } - - $url = ereg_replace(' WORD ', $strenc, $url); - $url = "$str"; - return $url; -} - -function wordlinksEncodingSusning($str) { - $str = preg_replace('/^([a-z])/e', "strtoupper('\\1')", $str); - $str = urlencode($str); - $str = ereg_replace('_', '%5F', $str); - $str = ereg_replace('\+', '_', $str); - $str = ereg_replace('%2F', '/', $str); - return $str; -} - -function wordlinksEncodingJargon($str) { - $str = ereg_replace(' ', '-', $str); - $str = ereg_replace('[/@~*?]', '', $str); - $str = ereg_replace('&', 'amp;', $str); - $str = urlencode($str); - return $str; -} - -function nowordlinkshtml($str) { - return strip_tags(wordlinks($str)); -} - -function nowordlinksshow($str) { - $str = htmlspecialchars($str); - $str = ereg_replace('\[', '[', $str); - $str = ereg_replace('\]', ']', $str); - return $str; -} - -function ampersand($str) { - $str = str_replace("&", "&", $str); - $str = eregi_replace("&(#x?[0-9a-f]+;)", "&\\1", $str); - $str = eregi_replace("&([a-z][a-z0-9]+;)", "&\\1", $str); - return $str; -} - -function printAllowedHTML() { - global $allowed_html; - - echo "Tillåten HTML:
\n"; - - foreach ($allowed_html as $onekey => $oneval) { - echo "<$onekey"; - - foreach ($oneval as $twokey => $twoval) - echo " $twokey="; - - echo '> '; - } - - echo "
\n"; -} - -function new_check_html($string, $strip = '') { - -# Den här funktionen ser till att bara godkända HTML-element och deras -# godkända HTML-attribut får förekomma i $string. Man måste ha tagit bort -# eventuella slashes från magic quotes innan man anropar den här funktionen. - - global $allowed_html; - - $string = ampersand($string); - - if ($strip == 'nohtml') - return strip_tags($string); - - $allow = ''; - foreach ($allowed_html as $htmlkey => $htmlvar) - $allow .= "<$htmlkey>"; - - $string = strip_tags($string, $allow); - return new_check_html_split($string); -} - -function new_check_html_split($string) { - -# Den här funktionen letar upp HTML-taggar, delar upp dem i element och alla -# attribut, och anropar new_check_html_attr. - - $string = preg_replace('%<\s*'. - '(/?[a-z]+)'. # element - '([^>]*)'. # alla attribut - '>%ei', - "new_check_html_attr('\\1', '\\2')", $string); - return $string; -} - -function new_check_html_attr($element, $attr) { - -# Den här funktionen tar bort alla attribut, om elementet inte ska ha några. -# Om det ska det går den igenom attributlistan och delar noggrant upp den i -# attribut, som sedan kontrolleras mot $allowed_html. - - global $allowed_html; - - $attr = stripslashes($attr); - -# Kolla om elementet ska ha några attribut alls. - - if (count($allowed_html[strtolower($element)]) == 0) - return "<$element>"; - - -# Dela upp attributen, och lagra i $attrarr. - - $attr = preg_replace('/javascript\s*:\s*/i', '', $attr); - - $attrarr = array(); - $mode = 0; - $attrname = ''; - - while (strlen($attr) != 0) - { - $working = 0; # anger om operationen har lyckats eller inte - - switch ($mode) - { - case 0: # attributnamn, exempelvis href - - if (preg_match('/^([a-z]+)/i', $attr, $match)) - { - $attrname = $match[1]; - $working = $mode = 1; - $attr = preg_replace('/^[a-z]+/i', '', $attr); - } - - break; - - - case 1: # lika med eller bara tomt ("selected") - - if (preg_match('/^\s*=\s*/', $attr)) # lika med - { - $working = 1; $mode = 2; - $attr = preg_replace('/^\s*=\s*/', '', $attr); - break; - } - - if (preg_match('/^\s+/', $attr)) # tomt - { - $working = 1; $mode = 0; - $attrarr[] = array - ('name' => $attrname, - 'whole' => $attrname); - $attr = preg_replace('/^\s+/', '', $attr); - } - - break; - - - case 2: # attributvärde, exempelvis en URL efter href= - - if (preg_match('/^("[^"]*")(\s+|$)/', $attr, $match)) - # "värde" - { - $attrarr[] = array - ('name' => $attrname, - 'whole' => "$attrname=$match[1]"); - $working = 1; $mode = 0; - $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); - break; - } - - if (preg_match("/^('[^']*')(\s+|$)/", $attr, $match)) - # 'värde' - { - $attrarr[] = array - ('name' => $attrname, - 'whole' => "$attrname=$match[1]"); - $working = 1; $mode = 0; - $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); - break; - } - - if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) - # värde - { - $attrarr[] = array - ('name' => $attrname, - 'whole' => "$attrname=\"$match[1]\""); - $working = 1; $mode = 0; - $attr = preg_replace("%^[^\s\"']+(\s+|$)%", - '', $attr); - } - - break; - } - - if ($working == 0) - # inte välformad, ta bort t o m nästa mellanslag - { - $attr = preg_replace('/^\S*\s*/', '', $attr); - $mode = 0; - } - } # while - - - if ($mode == 1) - # specialfall, om attributen slutar med ett tomt attribut som "selected" - $attrarr[] = array - ('name' => $attrname, - 'whole' => $attrname); - - -# Gå igenom $attrarr, och spara endast de tillåtna attributen för det -# här elementet. - - $attr2 = ''; - - foreach ($attrarr as $arreach) - if ($allowed_html[strtolower($element)][strtolower($arreach['name'])] - == 1) - $attr2 .= ' '.$arreach['whole']; - - - return "<$element$attr2>"; + return strtr($string, "\015\012", ' '); } /*********************************************************/ @@ -406,110 +180,110 @@ /*********************************************************/ function formatTimestamp($time) { - global $datetime,$locale; - setlocale (LC_TIME, "$locale"); - ereg ("([0-9]{4})-([0-9]{1,2})-([0-9]{1,2}) ([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2})", $time, $datetime); - $datetime = strftime("%e %b %Y %H.%M", mktime($datetime[4],$datetime[5],$datetime[6],$datetime[2],$datetime[3],$datetime[1])); - $datetime = ucfirst($datetime); - return($datetime); + global $datetime,$locale; + setlocale (LC_TIME, "$locale"); + ereg ("([0-9]{4})-([0-9]{1,2})-([0-9]{1,2}) ([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2})", $time, $datetime); + $datetime = strftime("%e %b %Y %H.%M", mktime($datetime[4],$datetime[5],$datetime[6],$datetime[2],$datetime[3],$datetime[1])); + $datetime = ucfirst($datetime); + return($datetime); } function formatAidHeader($aid) { - $holder = mysql_query("SELECT url, email FROM authors where aid='$aid'"); - if (!$holder) { - echo mysql_errno(). ": ".mysql_error(). "
"; exit(); - } - list($url, $email) = mysql_fetch_row($holder); - if (isset($url)) { - echo "$aid"; - } elseif (isset($email)) { - echo "$aid"; - } else { - echo $aid; - } + $holder = mysql_query("SELECT url, email FROM authors where aid='$aid'"); + if (!$holder) { + echo mysql_errno(). ": ".mysql_error(). "
"; exit(); + } + list($url, $email) = mysql_fetch_row($holder); + if (isset($url)) { + echo "$aid"; + } elseif (isset($email)) { + echo "$aid"; + } else { + echo $aid; + } } function oldNews() { - global $locale,$oldnum,$storynum; - $storynum = (int) $storynum; - $oldnum = (int) $oldnum; - $boxstuff = ""; - $boxTitle = "Tidigare artiklar"; - $rmflags = rmflags(); + global $locale,$oldnum,$storynum; + $storynum = (int) $storynum; + $oldnum = (int) $oldnum; + $boxstuff = ""; + $boxTitle = "Tidigare artiklar"; + $rmflags = rmflags(); $sql = "SELECT sid, title, time, comments ". - "FROM stories ORDER BY time ". - "DESC LIMIT $storynum,$oldnum"; - $result = mysql_query($sql); - $vari = 0; - while(list($sid, $title, $time, $comments) = mysql_fetch_row($result)) { - $title = nowordlinkshtml($title); - setlocale (LC_TIME, "$locale"); - ereg ("([0-9]{4})-([0-9]{1,2})-([0-9]{1,2}) ([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2})", $time, $datetime2); - $datetime2 = strftime("%A, %e %B", mktime($datetime2[4],$datetime2[5],$datetime2[6],$datetime2[2],$datetime2[3],$datetime2[1])); - $datetime2 = ucfirst($datetime2); - if ($time2 == $datetime2) { - $boxstuff .= "• $title ". - "($comments)
\n"; - } else { - if(!$a) { - $boxstuff .= "$datetime2
• ". - "$title ". - "($comments)
\n"; - $time2 = $datetime2; - $a = 1; - } else { - $boxstuff .= "
$datetime2
• ". - "$title ". - "($comments)
\n"; - $time2 = $datetime2; - } - } - $vari++; - if ($vari == $oldnum) { - if (isset($cookie[3])) $storynum = $cookie[3]; else $storynum = $storyhome; - $min = $oldnum + $storynum; - $boxstuff .= "

". - "Äldre artiklar

\n"; - } - - } - if($boxstuff!="") - themesidebox($boxTitle, $boxstuff, "oldNewsBox"); + "FROM stories ORDER BY time ". + "DESC LIMIT $storynum,$oldnum"; + $result = mysql_query($sql); + $vari = 0; + while(list($sid, $title, $time, $comments) = mysql_fetch_row($result)) { + $title = nowordlinkshtml($title); + setlocale (LC_TIME, "$locale"); + ereg ("([0-9]{4})-([0-9]{1,2})-([0-9]{1,2}) ([0-9]{1,2}):([0-9]{1,2}):([0-9]{1,2})", $time, $datetime2); + $datetime2 = strftime("%A, %e %B", mktime($datetime2[4],$datetime2[5],$datetime2[6],$datetime2[2],$datetime2[3],$datetime2[1])); + $datetime2 = ucfirst($datetime2); + if ($time2 == $datetime2) { + $boxstuff .= "• $title ". + "($comments)
\n"; + } else { + if(!$a) { + $boxstuff .= "$datetime2
• ". + "$title ". + "($comments)
\n"; + $time2 = $datetime2; + $a = 1; + } else { + $boxstuff .= "
$datetime2
• ". + "$title ". + "($comments)
\n"; + $time2 = $datetime2; + } + } + $vari++; + if ($vari == $oldnum) { + if (isset($cookie[3])) $storynum = $cookie[3]; else $storynum = $storyhome; + $min = $oldnum + $storynum; + $boxstuff .= "

". + "Äldre artiklar

\n"; + } + + } + if($boxstuff!="") + themesidebox($boxTitle, $boxstuff, "oldNewsBox"); } function mainblock() { - $result = mysql_query("SELECT title, content FROM mainblock"); - while(list($title, $content) = mysql_fetch_array($result)) { - $content = nl2br($content); - themesidebox($title, $content); - } + $result = mysql_query("SELECT title, content FROM mainblock"); + while(list($title, $content) = mysql_fetch_array($result)) { + $content = nl2br($content); + themesidebox($title, $content); + } } function rightblocks() { - $result = mysql_query("SELECT title, content FROM rblocks"); - while(list($title, $content) = mysql_fetch_array($result)) { - $content = nl2br($content); - themesidebox($title, $content); - } + $result = mysql_query("SELECT title, content FROM rblocks"); + while(list($title, $content) = mysql_fetch_array($result)) { + $content = nl2br($content); + themesidebox($title, $content); + } } function leftblocks() { - $result = mysql_query("SELECT title, content FROM lblocks"); - while(list($title, $content) = mysql_fetch_array($result)) { - $content = nl2br($content); - themesidebox($title, $content); - } + $result = mysql_query("SELECT title, content FROM lblocks"); + while(list($title, $content) = mysql_fetch_array($result)) { + $content = nl2br($content); + themesidebox($title, $content); + } } function eventblock() { $sql = "SELECT id,title,CONCAT(DAYOFMONTH(evfrom),'/',MONTH(evfrom)) ". - "FROM gevents WHERE evto>=NOW() ORDER BY evfrom LIMIT 10"; + "FROM gevents WHERE evto>=NOW() ORDER BY evfrom LIMIT 10"; $result = mysql_query($sql); - while (list($id,$title,$evfrom) = mysql_fetch_array($result)) { - $content.= "• $evfrom $title
\n"; - } - themesidebox("Kalender",$content); + while (list($id,$title,$evfrom) = mysql_fetch_array($result)) { + $content.= "• $evfrom $title
\n"; + } + themesidebox("Kalender",$content); } function diaryblock() { @@ -517,8 +291,8 @@ "FROM diary ORDER BY time DESC LIMIT 10"; $result = mysql_query($sql); while (list($did,$aid,$diarydate) = mysql_fetch_array($result)) { - if ($aid == "mpawlo" or $aid == "pawal") $symbol = " -> "; else $symbol = ""; - $content.="• $diarydate $symbol $aid
\n"; + if ($aid == "mpawlo" or $aid == "pawal") $symbol = " -> "; else $symbol = ""; + $content.="• $diarydate $symbol $aid
\n"; } $content.= "
". "De 20 senaste
\n"; @@ -526,27 +300,27 @@ } function adminblock() { - $result = mysql_query("SELECT title, content FROM adminblock"); - while(list($title, $content) = mysql_fetch_array($result)) { - $content = nl2br($content); - themesidebox($title, $content); - } + $result = mysql_query("SELECT title, content FROM adminblock"); + while(list($title, $content) = mysql_fetch_array($result)) { + $content = nl2br($content); + themesidebox($title, $content); + } } function loginbox() { - $title = "$sitename Login"; - $boxstuff .= "
"; - $boxstuff .= "
Nickname
\n"; - $boxstuff .= "
\n"; - $boxstuff .= "Lösenord
\n"; - $boxstuff .= "
\n"; - $boxstuff .= "Tillbaka till startsidan.
\n"; - $boxstuff .= ""; - $boxstuff .= "

\n"; - $boxstuff .= "Har du inget konto ännu?\n"; - $boxstuff .= "Du kan skapa ett konto, så kan du ändra\n"; + $title = "$sitename Login"; + $boxstuff .= ""; + $boxstuff .= "
Nickname
\n"; + $boxstuff .= "
\n"; + $boxstuff .= "Lösenord
\n"; + $boxstuff .= "
\n"; + $boxstuff .= "Tillbaka till startsidan.
\n"; + $boxstuff .= ""; + $boxstuff .= "

\n"; + $boxstuff .= "Har du inget konto ännu?\n"; + $boxstuff .= "Du kan skapa ett konto, så kan du ändra\n"; $boxstuff .= "dina inställningar och skriva dagbok, till exempel.\n"; - $boxstuff .= "
\n"; + $boxstuff .= "
\n"; themesidebox($title, $boxstuff); } @@ -565,7 +339,7 @@ $boxContent .= ""; $boxContent .= ""; $result = mysql_query("SELECT pollTitle, voters FROM poll_desc " - ."WHERE sid='$sid'"); + ."WHERE sid='$sid'"); list($pollTitle, $voters) = mysql_fetch_row($result); $boxTitle = "Undersökning"; $boxContent .= "$pollTitle

\n"; @@ -576,7 +350,7 @@ list($optionText,$optionCount,$voteID) = $row; if ($optionText) { $boxContent .= " $optionText
\n"; + . "value=\"$voteID\">$optionText
\n"; } } $boxContent .= "
Röster: $voters" - . "Kommentarer:$numcom"; + . "Kommentarer:$numcom"; } else { $boxContent .= "Röster: $voters"; } @@ -601,161 +375,161 @@ } function pollLatest() { - dbconnect(); - $result = mysql_query("SELECT MAX(sid) FROM poll_data"); - $sid = mysql_fetch_row($result); - return($sid[0]); + dbconnect(); + $result = mysql_query("SELECT MAX(sid) FROM poll_data"); + $sid = mysql_fetch_row($result); + return($sid[0]); } function pollNewest() { - $sid = pollLatest(); - pollMain($sid); + $sid = pollLatest(); + pollMain($sid); } function pollCollector($sid, $voteID, $forwarder) { - global $maxOptions, $setCookies, $cookiePrefix, $HTTP_COOKIE_VARS; - dbconnect(); - $voteValid = "1"; - - if($setCookies>0) { - // we have to check for cookies, so get timestamp of this poll - $result = mysql_query("SELECT timeStamp FROM poll_desc WHERE sid='$sid'"); - $object = mysql_fetch_object($result); - $timeStamp = $object->timeStamp; - $cookieName = $cookiePrefix.$timeStamp; - - // check if cookie exists - if($HTTP_COOKIE_VARS["$cookieName"] == "1") { - // cookie exists, invalidate this vote - $warn = "You already voted today!"; - $voteValid = "0"; - } else { - // cookie does not exist yet, set one now - $cvalue = "1"; - setcookie("$cookieName",$cvalue,time()+86400); - } - } - - // update database if the vote is valid - if($voteValid>0) { - @mysql_query("UPDATE poll_data SET optionCount=optionCount+1 WHERE (sid='$sid') AND (voteID='$voteID')"); - @mysql_query("UPDATE poll_desc SET voters=voters+1 WHERE sid='$sid'"); - Header("Location: $forwarder"); - } else { - Header("Location: $forwarder"); - } - // a lot of browsers can't handle it if there's an empty page - echo ""; + global $maxOptions, $setCookies, $cookiePrefix, $HTTP_COOKIE_VARS; + dbconnect(); + $voteValid = "1"; + + if($setCookies>0) { + // we have to check for cookies, so get timestamp of this poll + $result = mysql_query("SELECT timeStamp FROM poll_desc WHERE sid='$sid'"); + $object = mysql_fetch_object($result); + $timeStamp = $object->timeStamp; + $cookieName = $cookiePrefix.$timeStamp; + + // check if cookie exists + if($HTTP_COOKIE_VARS["$cookieName"] == "1") { + // cookie exists, invalidate this vote + $warn = "You already voted today!"; + $voteValid = "0"; + } else { + // cookie does not exist yet, set one now + $cvalue = "1"; + setcookie("$cookieName",$cvalue,time()+86400); + } + } + + // update database if the vote is valid + if($voteValid>0) { + @mysql_query("UPDATE poll_data SET optionCount=optionCount+1 WHERE (sid='$sid') AND (voteID='$voteID')"); + @mysql_query("UPDATE poll_desc SET voters=voters+1 WHERE sid='$sid'"); + Header("Location: $forwarder"); + } else { + Header("Location: $forwarder"); + } + // a lot of browsers can't handle it if there's an empty page + echo ""; } function pollList() { - dbconnect(); - $result = mysql_query("SELECT sid, pollTitle, timeStamp, voters FROM poll_desc ORDER BY timeStamp"); - $counter = 0; - $rmflags = rmflags(); - html_page_head(); - echo "
Tidigare undersökningar

\n"; - echo "
"; - while($object = mysql_fetch_object($result)) { - $resultArray[$counter] = array($object->sid, $object->pollTitle, $object->timeStamp, $object->voters); - $counter++; - } - for ($count = 0; $count < count($resultArray); $count++) { - $id = $resultArray[$count][0]; - $pollTitle = $resultArray[$count][1]; - $voters = $resultArray[$count][3]; - echo("• $pollTitle\n"); - echo("(Resultat - $voters röster.)
\n"); - } - html_page_foot(); - echo "
\n"; + dbconnect(); + $result = mysql_query("SELECT sid, pollTitle, timeStamp, voters FROM poll_desc ORDER BY timeStamp"); + $counter = 0; + $rmflags = rmflags(); + html_page_head(); + echo "
Tidigare undersökningar

\n"; + echo "
"; + while($object = mysql_fetch_object($result)) { + $resultArray[$counter] = array($object->sid, $object->pollTitle, $object->timeStamp, $object->voters); + $counter++; + } + for ($count = 0; $count < count($resultArray); $count++) { + $id = $resultArray[$count][0]; + $pollTitle = $resultArray[$count][1]; + $voters = $resultArray[$count][3]; + echo("• $pollTitle\n"); + echo("(Resultat - $voters röster.)
\n"); + } + html_page_foot(); + echo "
\n"; } function pollResults($sid) { - global $maxOptions, $BarScale, $resultTableBgColor, $resultBarFile, $setCookies; - if (!isset($sid)) $sid = 1; - dbconnect(); - - $result = mysql_query("SELECT sid, pollTitle, timeStamp FROM poll_desc WHERE sid='$sid'"); - $holdtitle = mysql_fetch_row($result); - echo "
$holdtitle[1]

"; - - mysql_free_result($result); - - $result = mysql_query("SELECT SUM(optionCount) AS SUM FROM poll_data WHERE sid='$sid'"); - $sum = (int)mysql_result($result, 0, "SUM"); - mysql_free_result($result); - - echo ""; - - // cycle through all options - for($i = 1; $i <= $maxOptions; $i++) { - // select next vote option - $result = mysql_query("SELECT sid, optionText, optionCount, voteID FROM poll_data WHERE (sid='$sid') AND (voteID='$i')"); - $object = mysql_fetch_object($result); - - if(is_object($object)) { - $optionText = $object->optionText; - $optionCount = $object->optionCount; - - echo ""; - - if($optionText) { - echo ""; - - if($sum) { - $percent = 100 * $optionCount * $BarScale / $sum; - } else { - $percent = 0; - } - echo ""; + } + } + echo ""; + } + + echo "
"; - echo "$optionText"; - echo ""; - $percentInt = (int)$percent * 4; - $percent2 = (int)$percent; - - if ($percent > 0) { - echo ""; - echo "\"$percent2"; - echo ""; - } else { - echo "\"$percent2"; - echo "\"$percent2"; - echo "\"$percent2"; - } + global $maxOptions, $BarScale, $resultTableBgColor, $resultBarFile, $setCookies; + if (!isset($sid)) $sid = 1; + dbconnect(); + + $result = mysql_query("SELECT sid, pollTitle, timeStamp FROM poll_desc WHERE sid='$sid'"); + $holdtitle = mysql_fetch_row($result); + echo "
$holdtitle[1]

"; + + mysql_free_result($result); + + $result = mysql_query("SELECT SUM(optionCount) AS SUM FROM poll_data WHERE sid='$sid'"); + $sum = (int)mysql_result($result, 0, "SUM"); + mysql_free_result($result); + + echo ""; + + // cycle through all options + for($i = 1; $i <= $maxOptions; $i++) { + // select next vote option + $result = mysql_query("SELECT sid, optionText, optionCount, voteID FROM poll_data WHERE (sid='$sid') AND (voteID='$i')"); + $object = mysql_fetch_object($result); + + if(is_object($object)) { + $optionText = $object->optionText; + $optionCount = $object->optionCount; + + echo ""; + + if($optionText) { + echo ""; + + if($sum) { + $percent = 100 * $optionCount * $BarScale / $sum; + } else { + $percent = 0; + } + echo ""; - } - } - echo ""; - } - - echo "
"; + echo "$optionText"; + echo ""; + $percentInt = (int)$percent * 4; + $percent2 = (int)$percent; + + if ($percent > 0) { + echo ""; + echo "\"$percent2"; + echo ""; + } else { + echo "\"$percent2"; + echo "\"$percent2"; + echo "\"$percent2"; + } printf(" %.2f %% (%d)", $percent, $optionCount); - echo "

"; - echo "
Totalt antal röster: $sum
"; - if($setCookies>0) { - echo "Vi tillåter endast en röst per person per dag

\n"; - } else { - echo "

"; - } - - $booth = $sid; - echo "[ Röstningsbås | "; - echo "Andra undersökningar ]\n"; - echo "
\n"; - return(1); + echo "

"; + echo "
Totalt antal röster: $sum
"; + if($setCookies>0) { + echo "Vi tillåter endast en röst per person per dag

\n"; + } else { + echo "

"; + } + + $booth = $sid; + echo "[ Röstningsbås | "; + echo "Andra undersökningar ]\n"; + echo "
\n"; + return(1); } function getTopic($topic=0) { - if ($topic) { - $sql = "SELECT topictext, topicimage, topicname FROM topics WHERE topicid='$topic'"; - $result = mysql_query($sql); - $topicinfo = mysql_fetch_row($result); - } else { - $topicinfo = array("alla ämnen","AllTopics.png","alla"); - } - return $topicinfo; + if ($topic) { + $sql = "SELECT topictext, topicimage, topicname FROM topics WHERE topicid='$topic'"; + $result = mysql_query($sql); + $topicinfo = mysql_fetch_row($result); + } else { + $topicinfo = array("alla ämnen","AllTopics.png","alla"); + } + return $topicinfo; } @@ -792,17 +566,17 @@ function stripslashes_array($content = array()) { $rs = array(); while (list($key,$val) = each($content)) { - $rs[$key] = stripslashes($val); + $rs[$key] = stripslashes($val); } return $rs; } function FixQuotes ($what = "") { - $what = ereg_replace("'","''",$what); - while (eregi("\\\\'", $what)) { - $what = ereg_replace("\\\\'","'",$what); - } - return $what; + $what = ereg_replace("'","''",$what); + while (eregi("\\\\'", $what)) { + $what = ereg_replace("\\\\'","'",$what); + } + return $what; } # quote the slashes for mysql (missing php function?) @@ -852,15 +626,15 @@ if (preg_match_all('/([A-Za-zÅÄÖåäö]+)/', $spell_text, $matches)) { foreach ($matches[0] as $match) { if ($match == "SPELLWORD") { - continue; - } - if (! pspell_check ($pspell_link, $match)) { - $tooltip = "Inga förslag."; - if ($suggestions = join(', ', pspell_suggest($pspell_link, $match))) { - $tooltip = " title='Förslag: $suggestions'"; - $allwords[$match] = $tooltip; - } - $text = preg_replace("/(^|[^A-Za-zÅÄÖåäö]+)($match)([^A-Za-zÅÄÖåäö]+|$)/", "$1$2$3", $text); + continue; + } + if (! pspell_check ($pspell_link, $match)) { + $tooltip = "Inga förslag."; + if ($suggestions = join(', ', pspell_suggest($pspell_link, $match))) { + $tooltip = " title='Förslag: $suggestions'"; + $allwords[$match] = $tooltip; + } + $text = preg_replace("/(^|[^A-Za-zÅÄÖåäö]+)($match)([^A-Za-zÅÄÖåäö]+|$)/", "$1$2$3", $text); } } } @@ -930,4 +704,394 @@ return $rss; } + +/*********************************************************/ +/* wordlinks and html functions */ +/*********************************************************/ + +function urlWithProtocol($url) { + if (!eregi('^(f|ht)tp:', $url)) + $url = "http://$url"; + + if ($url == 'http://') + $url = ''; + + $url = preg_replace('/(\s|"|\'|\\\\)/', '', $url); + + return $url; +} + +function wordlinks($doc) { + return preg_replace + ('%\[\s*'. # [ + '([a-z0-9]+)\s*'. # (wordlink) + ':\s*'. # : + '([^][<>\\\\]+?)'. # (själva ordet) + '\s*\]%ei', # ] + 'wordlinksProc("\\1", "\\2")', + $doc); +} + +function wordlinksProc($name, $str) { + global $wordlinks; + + $str = stripslashes($str); + $strenc = $str; + + $url = $wordlinks[$name]['url']; + if ($url == '') + return '*felaktig ordlänk*'; + + switch ($wordlinks[$name]['enc']) { + case 'susning': + $strenc = wordlinksEncodingSusning($str); + break; + case 'jargon': + $strenc = wordlinksEncodingJargon($str); + break; + case 'urlencode': + $strenc = urlencode($str); + break; + } + + $url = ereg_replace(' WORD ', $strenc, $url); + $url = "$str"; + return $url; +} + +function wordlinksEncodingSusning($str) { + $str = preg_replace('/^([a-z])/e', "strtoupper('\\1')", $str); + $str = urlencode($str); + $str = ereg_replace('_', '%5F', $str); + $str = ereg_replace('\+', '_', $str); + $str = ereg_replace('%2F', '/', $str); + return $str; +} + +function wordlinksEncodingJargon($str) { + $str = ereg_replace(' ', '-', $str); + $str = ereg_replace('[/@~*?]', '', $str); + $str = ereg_replace('&', 'amp;', $str); + $str = urlencode($str); + return $str; +} + +function nowordlinkshtml($str) { + return strip_tags(wordlinks($str)); +} + +function nowordlinksshow($str) { + $str = htmlspecialchars($str); + $str = ereg_replace('\[', '[', $str); + $str = ereg_replace('\]', ']', $str); + return $str; +} + +function ampersand($str) { + $str = str_replace("&", "&", $str); + $str = eregi_replace("&(#x?[0-9a-f]+;)", "&\\1", $str); + $str = eregi_replace("&([a-z][a-z0-9]+;)", "&\\1", $str); + return $str; +} + +function printAllowedHTML() { + global $allowed_html; + + echo "Tillåten HTML:
\n"; + + foreach ($allowed_html as $onekey => $oneval) { + echo "<$onekey"; + + foreach ($oneval as $twokey => $twoval) + echo " $twokey="; + + echo '> '; + } + + echo "
\n"; +} + +function new_check_html($string, $strip = '') { + +# Den här funktionen ser till att bara godkända HTML-element och deras +# godkända HTML-attribut får förekomma i $string. Man måste ha tagit bort +# eventuella slashes från magic quotes innan man anropar den här funktionen. + + global $allowed_html; + + $string = ampersand($string); + + if ($strip == 'nohtml') + return strip_tags($string); + + $allow = ''; + foreach ($allowed_html as $htmlkey => $htmlvar) + $allow .= "<$htmlkey>"; + + $string = strip_tags($string, $allow); + return new_check_html_split($string); +} + +function new_check_html_split($string) { + +# Den här funktionen letar upp HTML-taggar, delar upp dem i element och alla +# attribut, och anropar new_check_html_attr. + + $string = preg_replace('%<\s*'. + '(/?[a-z]+)'. # element + '([^>]*)'. # alla attribut + '>%ei', + "new_check_html_attr('\\1', '\\2')", $string); + return $string; +} + +function new_check_html_attr($element, $attr) { + +# Den här funktionen tar bort alla attribut, om elementet inte ska ha några. +# Om det ska det går den igenom attributlistan och delar noggrant upp den i +# attribut, som sedan kontrolleras mot $allowed_html. + + global $allowed_html; + + $attr = stripslashes($attr); + +# Kolla om elementet ska ha några attribut alls. + + if (count($allowed_html[strtolower($element)]) == 0) + return "<$element>"; + + +# Dela upp attributen, och lagra i $attrarr. + + $attr = preg_replace('/javascript\s*:\s*/i', '', $attr); + + $attrarr = array(); + $mode = 0; + $attrname = ''; + + while (strlen($attr) != 0) + { + $working = 0; # anger om operationen har lyckats eller inte + + switch ($mode) + { + case 0: # attributnamn, exempelvis href + + if (preg_match('/^([a-z]+)/i', $attr, $match)) + { + $attrname = $match[1]; + $working = $mode = 1; + $attr = preg_replace('/^[a-z]+/i', '', $attr); + } + + break; + + + case 1: # lika med eller bara tomt ("selected") + + if (preg_match('/^\s*=\s*/', $attr)) # lika med + { + $working = 1; $mode = 2; + $attr = preg_replace('/^\s*=\s*/', '', $attr); + break; + } + + if (preg_match('/^\s+/', $attr)) # tomt + { + $working = 1; $mode = 0; + $attrarr[] = array + ('name' => $attrname, + 'whole' => $attrname); + $attr = preg_replace('/^\s+/', '', $attr); + } + + break; + + + case 2: # attributvärde, exempelvis en URL efter href= + + if (preg_match('/^("[^"]*")(\s+|$)/', $attr, $match)) + # "värde" + { + $attrarr[] = array + ('name' => $attrname, + 'whole' => "$attrname=$match[1]"); + $working = 1; $mode = 0; + $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); + break; + } + + if (preg_match("/^('[^']*')(\s+|$)/", $attr, $match)) + # 'värde' + { + $attrarr[] = array + ('name' => $attrname, + 'whole' => "$attrname=$match[1]"); + $working = 1; $mode = 0; + $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); + break; + } + + if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) + # värde + { + $attrarr[] = array + ('name' => $attrname, + 'whole' => "$attrname=\"$match[1]\""); + $working = 1; $mode = 0; + $attr = preg_replace("%^[^\s\"']+(\s+|$)%", + '', $attr); + } + + break; + } + + if ($working == 0) + # inte välformad, ta bort t o m nästa mellanslag + { + $attr = preg_replace('/^\S*\s*/', '', $attr); + $mode = 0; + } + } # while + + + if ($mode == 1) + # specialfall, om attributen slutar med ett tomt attribut som "selected" + $attrarr[] = array + ('name' => $attrname, + 'whole' => $attrname); + + +# Gå igenom $attrarr, och spara endast de tillåtna attributen för det +# här elementet. + + $attr2 = ''; + + foreach ($attrarr as $arreach) + if ($allowed_html[strtolower($element)][strtolower($arreach['name'])] + == 1) + $attr2 .= ' '.$arreach['whole']; + + + return "<$element$attr2>"; +} + +### +# +# Wiki formatting functions +# +### + +function pre_parse($in) +{ + $in = preg_replace("/&/", "&", $in); # enocode & as & + $in = preg_replace("/\"/s", """, $in); # tolka bort citationstecken + $in = preg_replace("/'/s", "'", $in); # tolka bort apostrofer + $in = preg_replace("//s", ">", $in); # bli av med > + $in = preg_replace("/\\$/s", "$", $in); # tolka bort dollar + $in = preg_replace("/[\s]*[\n\r]{2,}[\s]*[\n\r]{2,}[\s]*/m", ">>", $in); + $in = preg_replace("/[\n\r]+/", ">", $in); # make newlines consistent (1) + $in = preg_replace("/[\s]+/", " ", $in); # not more than one space + $in = preg_replace("/>/", "\n", $in); # make newlines consistent (2) + return $in; +} + +function parse($in) +{ + $in = "\n".$in."\n"; + $in = preg_replace("/\n!!!!!!(.*?)\n/", "
$1
\n", $in); # header size 6 + $in = preg_replace("/\n!!!!!(.*?)\n/", "
$1
\n", $in); # header size 5 + $in = preg_replace("/\n!!!!(.*?)\n/", "

$1

\n", $in); # header size 4 + $in = preg_replace("/\n!!!(.*?)\n/", "

$1

\n", $in); # header size 3 + $in = preg_replace("/\n!!(.*?)\n/", "

$1

\n", $in); # header size 2 + $in = preg_replace("/\n!(.*?)\n/", "

$1

\n", $in); # header size 1 + $in = preg_replace("/__(.*?)__/", "$1", $in); # strong text, prefered + $in = preg_replace("/((')*)'''(([A-Z0-9a-z\s]|.*)*?)'''/", '\\2\\3', $in); # strong text, compatibility + $in = preg_replace("/@@(.*?)@@/", "$1", $in); # strong text, compatibility 2 + $in = preg_replace("/''(.*?)''/", "$1", $in); # emphasized text + $in = preg_replace("/===(.*?)===/", "

$1

", $in); # header size 3 + $in = preg_replace("/==(.*?)==/", "

$1

", $in); # header size 3 +#$in = preg_replace("/([0-9]+)/", '\\1\\2', $in); + $in = preg_replace + ('%\[\s*'. # [ + '([a-z0-9]+)\s*'. # (wordlink) + ':\s*'. # : + '([^][<>\\\\]+?)'. # (själva ordet) + '\s*\]%ei', # ] + 'wordlinksProc("\\1", "\\2")', + $in); + $in = preg_replace("/\[\[\s*([^][<>\\\\]+?)\s*(\|\s*([^][<>\\\\]+?)?\s*)?\]\]/e", "wikiLink(\"$1\", \"$3\")", $in); # wikilinks + $in = preg_replace('/((http|ftp|gopher|https)(:\/\/)([^][<>\\\\]+?)\.(jpeg|jpg|gif|png))()/', '', $in); # images + $in = preg_replace('/\[\s*((http|ftp|gopher|https)(:\/\/)([^][<>\\\\]+?))\s*(\|\s*([^][<>\\\\]+?)?\s*)?\]/e', 'externLink("\\1", "\\6")', $in); # wikilinks + $in = preg_replace("/\n{2,}/", "\n

\n

\n", $in); + $in = preg_replace('/\s*\/{4,}\s*/', "\n
\n", $in); # //// ->
+ for ($i = 1; $i <= 12; $i++) # support for lists, up to twelve level + { + $in = preg_replace('/(\n\\*{'.$i.',}.+)+/', "

", $in); # support for unordered lists + $in = preg_replace('/(\n#{'.$i.',}.+)+/', "
    $0\n
", $in); # support for ordered lists + $in = preg_replace('/(\n:{'.$i.',}.+)+/', "", $in); # support for ordered lists + } + $in = preg_replace('/^[\\*#]+(.*)(\<\/ul\>)?\n/m', "
  • $1
  • ", $in); # listitems + $in = preg_replace('/^:+(.*)(\<\/ul\>)?\n/m', "
  • $1
  • ", $in); #indrag + $in = preg_replace("/\s*-{4,}\s*/", "
    ", $in); # ---- ->
    +// $in = preg_replace("/__(.*?)__/", "$1", $in); # smaller text + + $in = preg_replace("/""(.*?)""/s", "»\\1«", $in); # quoted text + $in = preg_replace("/([-+±\/*\.,0-9a-z]*)\^([-+·×\(\)\.,0-9a-z]*)/", '\\1\\2', $in); # 54^12 + $in = "

    ".$in."

    "; + return $in; +} + +function wikiLink($str, $str2 = "") +{ + global $userinfo; + if ($str2 == "") $str2 = $str; + dbconnect(); + $wurl="/"; //import config instead + $res = normLink($str); + # check wether word exist... + $result = mysql_query("SELECT rev FROM nimm WHERE ord = '$res'"); + if (mysql_num_rows($result)>0) + $end = "$str2"; + else + { + if ($userinfo[uname]!="") + $end = "$str2"; + else + $end = $str2; + } + return $end; +} + +function externLink($str, $str2 = "") +{ + if ($str2 == "") $str2 = $str; + dbconnect(); + return "$str2"; +} + +function normLink($str) +{ + $res = pre_parse($str); + $res = preg_replace('/>/', '>',$res); # reinsert < + $res = preg_replace('/</', '<',$res); # and > in link + $res = preg_replace('/\s/', '_',$res); # Get rid of spaces and replace with underscore (_) + return strtoupper($res{0}).strtolower(substr($res, 1)); +} + +function denormLink($res) +{ + $res = preg_replace('/>/', '>',$res); # reinsert < + $res = preg_replace('/<;/', '<',$res); # and > in link + $res = preg_replace('/_/', ' ',$res); # Get rid of spaces and replace with underscore (_) + return strtolower($res); +} + +function dewhite($in) +{ + return $in;#preg_replace('/[\s]*[\n\r]{2,}[\s]*[\n\r]{2,}[\s]*/m', "\n\n", $in); +## return preg_replace("/[ \t\n\r]{1,}/m", " ", $out); +} + ?>