<?php

define('IN_AJAX', true);
$ajax =& new ajax_common();

require('./common.php');

$ajax->init();

// Handle "board disabled via ON/OFF trigger"
if (file_exists(BB_DISABLED))
{
$ajax->ajax_die($bb_cfg['board_disabled_msg']);
}

// Load actions required modules
switch ($ajax->action)
{
case 'view_post':
require(INC_DIR .'bbcode.'. PHP_EXT);
break;
}

// position in $ajax->valid_actions['xxx']
define('AJAX_AUTH', 0); // 'guest', 'user', 'mod', 'admin'

$user->session_start();
$ajax->exec();

//
// Ajax
//
class ajax_common
{
var $request = array();
var $response = array();

var $valid_actions = array(
// ACTION NAME AJAX_AUTH
'edit_user_profile' => array('admin'),
'view_post' => array('guest'),
'order_vote' => array('user'),
'order_delete' => array('admin'),
'order_add' => array('user'),
'order_yes' => array('user'),
'order_abuse' => array('user'),
'view_comment' => array('user'),
'o_comment_add' => array('user'),
);

var $action = null;

/**
* Constructor
*/
function ajax_common ()
{
ob_start(array(&$this, 'ob_handler'));
header('Content-Type: text/plain');
}

/**
* Perform action
*/
function exec ()
{
global $lang;

// Exit if we already have errors
if (!empty($this->response['error_code']))
{
$this->send();
}

// Check that requested action is valid
$action = $this->action;

if (!$action || !is_string($action))
{
$this->ajax_die('no action specified');
}
else if (!$action_params =& $this->valid_actions[$action])
{
$this->ajax_die('invalid action: '. $action);
}

// Auth check
switch ($action_params[AJAX_AUTH])
{
// GUEST
case 'guest':
break;

// USER
case 'user':
if (IS_GUEST)
{
$this->ajax_die($lang['Need_to_login_first']);
}
break;

// MOD
case 'mod':
if (!(IS_MOD || IS_ADMIN))
{
$this->ajax_die($lang['Only_for_mod']);
}
$this->check_admin_session();
break;

// ADMIN
case 'admin':
if (!IS_ADMIN)
{
$this->ajax_die($lang['Only_for_admin']);
}
$this->check_admin_session();
break;

default:
trigger_error("invalid auth type for $action", E_USER_ERROR);
}

// Run action
$this->$action();

// Send output
$this->send();
}

/**
* Exit on error
*/
function ajax_die ($error_msg, $error_code = E_AJAX_GENERAL_ERROR)
{
$this->response['error_code'] = $error_code;
$this->response['error_msg'] = $error_msg;

$this->send();
}

/**
* Initialization
*/
function init ()
{
$this->request = $_POST;

if (AJAX_CHARSET)
{
array_deep($this->request, 'ajax_decode');
}

$this->action =& $this->request['action'];
}

/**
* Send data
*/
function send ()
{
$this->response['action'] = $this->action;

if (DBG_USER && SQL_DEBUG && !empty($_COOKIE['sql_log']))
{
$this->response['sql_log'] = get_sql_log();
}

// sending output will be handled by $this->ob_handler()
exit();
}

/**
* OB Handler
*/
function ob_handler ($contents)
{
if (DBG_USER)
{
if ($contents)
{
$this->response['raw_output'] = $contents;
}
}

if (AJAX_CHARSET)
{
array_deep($this->response, 'ajax_encode');
}

$response_js = bb_json_encode($this->response);

if (GZIP_OUTPUT_ALLOWED && !defined('NO_GZIP'))
{
if (UA_GZIP_SUPPORTED && strlen($response_js) > 2000)
{
header('Content-Encoding: gzip');
$response_js = gzencode($response_js, 1);
}
}

return $response_js;
}

/**
* Admin session
*/
function check_admin_session ()
{
global $user, $HTTP_POST_VARS;

if (!$user->data['session_admin'])
{
if (empty($this->request['user_password']))
{
$this->prompt_for_password();
}
else
{
$login_args = array(
'login_username' => $user->data['username'],
'login_password' => $HTTP_POST_VARS['user_password'], // $HTTP_POST_VARS - for compatibility with phpbb
);
if (!$user->login($login_args, true))
{
$this->ajax_die('Wrong password');
}
}
}
}

/**
* Prompt for password
*/
function prompt_for_password ()
{
$this->response['prompt_password'] = 1;
$this->send();
}

/**
* Edit user profile
*/
function edit_user_profile ()
{
global $db, $bb_cfg, $lang;

if (!$user_id = intval($this->request['user_id']) OR !$profiledata = get_userdata($user_id))
{
$this->ajax_die('invalid user_id');
}
if (!$field = (string) $this->request['field'])
{
$this->ajax_die('invalid profile field');
}

$table = USERS_TABLE;
$value = (string) $this->request['value'];

switch ($field)
{
case 'user_regdate':
case 'user_lastvisit':
$tz = TIMENOW + (3600 * $bb_cfg['board_timezone']);
if (($value = strtotime($value, $tz)) < $bb_cfg['board_startdate'] OR $value > TIMENOW)
{
$this->ajax_die('invalid date: '. $this->request['value']);
}
$this->response['new_value'] = bb_date($value);
break;

case 'ignore_srv_load':
$value = ($this->request['value']) ? 0 : 1;
$this->response['new_value'] = ($profiledata['user_level'] != USER || $value) ? $lang['NO'] : $lang['YES'];
break;

case 'u_up_total':
case 'u_down_total':
case 'u_up_release':
case 'u_up_bonus':
if (!IS_SUPER_ADMIN)
{
$this->ajax_die($lang['Only_for_super_admin']);
}

$table = BT_USERS_TABLE;
$value = (float) $this->request['value'];

foreach (array('KB'=>1,'MB'=>2,'GB'=>3,'TB'=>4) as $s => $m)
{
if (strpos($this->request['value'], $s) !== false)
{
$value *= pow(1024, $m);
break;
}
}
$value = sprintf('%.0f', $value);
$this->response['new_value'] = humn_size($value, null, null, ' ');

if (!$btu = get_bt_userdata($user_id))
{
require(INC_DIR .'functions_torrent.'. PHP_EXT);
generate_passkey($user_id, true);
$btu = get_bt_userdata($user_id);
}
$btu[$field] = $value;
$this->response['update_ids']['u_ratio'] = (string) get_bt_ratio($btu);
break;

default:
$this->ajax_die("invalid profile field: $field");
}

$value_sql = $db->escape($value, true);
$db->query("UPDATE $table SET $field = $value_sql WHERE user_id = $user_id LIMIT 1");

$this->response['edit_id'] = $this->request['edit_id'];
}

/**
* View post
*/
function view_post ()
{
global $user, $db, $lang;

$post_id = (int) $this->request['post_id'];

$sql = "
SELECT
p.*,
h.post_html, IF(h.post_html IS NULL, pt.post_text, NULL) AS post_text,
pt.post_subject, pt.bbcode_uid,
f.auth_read
FROM ". POSTS_TABLE ." p
INNER JOIN ". POSTS_TEXT_TABLE ." pt ON(pt.post_id = p.post_id)
LEFT JOIN ". POSTS_HTML_TABLE ." h ON(h.post_id = pt.post_id)
INNER JOIN ". FORUMS_TABLE ." f ON(f.forum_id = p.forum_id)
WHERE
p.post_id = $post_id
LIMIT 1
";

if (!$post_data = $db->fetch_row($sql))
{
$this->ajax_die($lang['Topic_post_not_exist']);
}

// Auth check
if ($post_data['auth_read'] == AUTH_REG)
{
if (IS_GUEST)
{
$this->ajax_die($lang['Need_to_login_first']);
}
}
else if ($post_data['auth_read'] != AUTH_ALL)
{
$is_auth = auth(AUTH_READ, $post_data['forum_id'], $user->data, $post_data);
if (!$is_auth['auth_read'])
{
$this->ajax_die($lang['Topic_post_not_exist']);
}
}

$this->response['post_id'] = $post_id;
$this->response['post_html'] = get_parsed_post($post_data);
}
function order_vote()
{
global $db;
$id = (int) $this->request['id'];
$db->query("UPDATE bb_order SET order_vote = order_vote+1 WHERE order_id = $id");
$vote_summ = $db->sql_query("SELECT order_vote FROM bb_order WHERE order_id = $id LIMIT 1");
while ($votes = $db->sql_fetchrow($vote_summ))
{
$votes_summ = $votes['order_vote'];
}
$this->response['vote'] = $votes_summ;
$this->response['id'] = $id;
}
function order_delete()
{
global $db;
$id = (int) $this->request['id'];
$db->query("DELETE FROM bb_order WHERE order_id = $id");
$this->response['id'] = $id;
}
function order_add()
{
global $db, $userdata, $bb_cfg, $lang;
$name = (string) $this->request['name'];
$desc = (string) $this->request['desc'];
$f_id = (int) $this->request['forum'];
if (($name == '') || ($desc == '')) ajax_die('Error');
$time = TIMENOW;
$user_id = $userdata['user_id'];
$name = $db->escape($name);
$desc = $db->escape($desc);
$vote = 0;
$html = '';
$row = $db->fetch_row("SELECT forum_name FROM ". FORUMS_TABLE ." WHERE forum_id = ".$f_id);
$db->query("INSERT bb_order SET
order_forum_id = $f_id,
order_name = '$name',
order_desc = '$desc',
order_time = $time,
order_yes = 0,
order_user_id = $user_id,
order_vote = $vote
");
$html .= '<td class="small bold w10 tCenter"><a href="viewforum.php?f='.$f_id.'">'.$row['forum_name'].'</a></td>';
$html .= '<td class="bold w30" name="hilite">'.$name.'</td>';
$html .= '<td class="w10 tCenter">'.create_date($bb_cfg['default_dateformat'], $time, $bb_cfg['board_timezone']).'</td>';
$html .= '<td class="bold w10 tCenter"><a href="profile.php?mode=viewprofile&u='.$user_id.'">'.$userdata['username'].'</a></td>';
$html .= '<td class="w10 tCenter">'.$lang['NO'].'</td>';
$html .= '<td class="bold w10 tCenter">----</td>';
$html .= '<td class="w10 tCenter bold">0</td>';
$html .= '<td class="w10 tCenter bold"><img src="'.BB_ROOT.'images/order_normal.png" /></td>';
if ($userdata['user_level'] == ADMIN) {
$html .= '<td class="w10 bold tCenter leech">X</td>';
}
$this->response['html'] = $html;
}
function order_yes()
{
global $db, $userdata, $lang;
$id = (int) $this->request['id'];
$topic_id = (int) $this->request['topic_id'];
$user_id = $userdata['user_id'];
$db->query("UPDATE bb_order SET order_yes = 1, order_user_performed_id = $user_id, order_topic_id = $topic_id WHERE order_id = $id");
$this->response['id'] = $id;
$this->response['username'] = '<a href="profile.php?mode=viewprofile&u='.$user_id.'">'.$userdata['username'].'</a>';
$this->response['html'] = '<a href="viewtopic.php?t='.$topic_id.'" class="seed bold" />'.$lang['YES'].'</b>';
}
function order_abuse()
{
global $db;
$id = (int) $this->request['id'];
$db->query("UPDATE bb_order SET order_abuse = 1 WHERE order_id = $id");
$this->response['id'] = $id;
}

function view_comment()
{
global $db, $userdata, $lang, $bb_cfg;
$order_id = (int) $this->request['or_id'];
$user_id = $userdata['user_id'];
$i = 0;
$comments = $db->query("SELECT c.*, u.username
FROM bb_order_comment AS c
LEFT JOIN bb_users AS u ON(u.user_id = c.comment_user_id)
WHERE order_id = $order_id
ORDER BY comment_time
");
$html = '<table class="forumline w100">';
while ($com = $db->sql_fetchrow($comments))
{
$i++;
$row_class = !($i % 2) ? 'row2' : 'row1';
$html .= '<tr class="'.$row_class.'">';
$html .= '<td width="10%" class="tCenter bold"><a href="profile.php?mode=viewprofile&u='.$user_id.'">'.$com['username'].'</a><br />'.create_date($bb_cfg['default_dateformat'], $com['comment_time'], $bb_cfg['board_timezone']).'</td>';
$html .= '<td width="90%">'.htmlspecialchars($com['comment']).'</td>';
$html .= '</tr>';
}
$html .= '<tr class="row3">';
$html .= '<td class="w100 bold tCenter" colspan="2">Добавить комментарий</td>';
$html .= '</tr>';
$html .= '<tr class="row1">';
$html .= '<td width="20%" class="bold">Комментарий<br /><span class="small">Использование <b>BBCode</b> и <b>HTML</b> запрещено</span></td>';
$html .= '<td width="80%" class="bold tCenter"><textarea id="ctext_'.$order_id.'" style="width: 90%; height: 100px;"></textarea></td>';
$html .= '</tr>';
$html .= '<tr>';
$html .= '<td colspan="2" class="tCenter"><input type="button" onclick="ajax.o_comment_add('.$order_id.');" value="Отправить" /></td>';
$html .= '</tr>';
$html .= '</table>';

$this->response['html'] = $html;
$this->response['or_id'] = $order_id;
}

function o_comment_add()
{
global $db, $userdata, $lang, $bb_cfg;
$order_id = (int) $this->request['id'];
$text = $this->request['text'];
if (!$text) ajax_die('Вы не ввели комментарий');
// $text = htmlentities($text);
$user_id = $userdata['user_id'];
$time = TIMENOW;
$text = $db->escape($text);
$db->query("INSERT INTO bb_order_comment SET
order_id = $order_id,
comment = '$text',
comment_time = $time,
comment_user_id = $user_id
");
$html = '<td calss="row1"><a href="profile.php?mode=viewprofile&u='.$user_id.'">'.$userdata['username'].'</a><br />'.create_date($bb_cfg['default_dateformat'], $time, $bb_cfg['board_timezone']).'</td>';
$html .= '<td calss="row1">'.htmlentities($text).'</td>';
$this->response['html'] = $html;
$this->response['id'] = $order_id;
}

}