<?php

/************************************************************************/
/* XAlbum Version 0.9.8                                                 */
/* ==================================================================== */
/* This program is free software. You can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 2 of the License.       */
/************************************************************************/

/*----------- ENDE DER EINSTELLUNGEN - END OF SETTINGS -----------*/

// START - Added by WarpSpeed (Marco Wiesler) @ 31.12.2003
// This will avoid that someone can inject php code from outside your site
if( isset($_GET['basepath']) || isset($_GET['adminpath']) ) 
{ 
Header("Location: index.php"); 
die(); 
}
// END - Added by WarpSpeed (Marco Wiesler) @ 31.12.2003

function navigationPic($name, $gid, $pid, $orderby) {
        global
                $baseurl,
                $basepath,
                $font,
                $prefix,
                $postcardverz
        ;

        $orderbyA = convertorderbyin($orderby);
        $sql = "SELECT pid, name FROM $prefix"._4nalbum_pictures." where gid=$gid ORDER BY $orderbyA";
        $res = mysql_query($sql);

        $max = mysql_num_rows($res);
        $ind = getPos($res, $pid);
        if ($ind>0) {
                $prev = mysql_result($res, $ind-1, 0);
                $pname = mysql_result($res, $ind-1, 1);
        }
        if ($ind<$max-1) {
                $next = mysql_result($res, $ind+1, 0);
                $nname = mysql_result($res, $ind+1, 1);
        }

        $out = '<p align="center">';
        /*$out .= '<font class="'.$font['normal'].'">&lt;&lt; </font>';
        if ($prev)
                $out .= '<a class="'.$font['normal'].'" href="'.$baseurl.'&amp;do=showpic&amp;gid='.$gid.'&amp;pid='.$prev.'&amp;orderby='.$orderby.'">'._GALPREV.'</a><font class="'.$font['normal'].'"> | </font>';
        else
                $out .= '<font class="'.$font['normal'].'">'._GALPREV.'</font> <font class="content"> | </font>';
        if ($next)
                $out .= '<a class="'.$font['normal'].'" href="'.$baseurl.'&amp;do=showpic&amp;gid='.$gid.'&amp;pid='.$next.'&amp;orderby='.$orderby.'">'._GALNEXT.'</a>';
        else
                $out .= '<font class="'.$font['normal'].'">'._GALNEXT.' </font>';
        $out .= '<font class="'.$font['normal'].'"> &gt;&gt;</font>';
        */
        if ($prev)
                $out .= '<a class="'.$font['normal'].'" href="'.$baseurl.'&amp;do=showpic&amp;gid='.$gid.'&amp;pid='.$prev.'&amp;orderby='.$orderby.'"><img src="'.$basepath.'/images/left.gif" alt="'._GALPREV.'" border="0" align="middle "></a><font class="'.$font['normal'].'"> ';
        else
                $out .= '<img src="'.$basepath.'/images/left.gif" alt="'._GALPREV.'" border="0" align="middle "> ';

      $out .= '<font class="'.$font['title'].'"> - '.$name.' - </font>';

        if ($next)
                $out .= '<a class="'.$font['normal'].'" href="'.$baseurl.'&amp;do=showpic&amp;gid='.$gid.'&amp;pid='.$next.'&amp;orderby='.$orderby.'"><img src="'.$basepath.'/images/right.gif" alt="'._GALNEXT.'" border="0" align="middle "></a>';
        else
                $out .= '<img src="'.$basepath.'/images/right.gif" alt="'._GALNEXT.'" border="0" align="middle ">';

        $out .= '</p>';
        return $out;
}


function displayPicturePic($row, $size) {
        global
                $gallerypath,
                $postcardverz
        ;
        $template = $row[displaytag];
        $template = str_replace('<:FILENAME:>', "$gallerypath/$row[galloc]/$row[img]", $template);
        if($size[0] > 600 || ($row[filetype] != 1 && $size[0] == 320))
        {        $size[1] = 600 * ($size[1]/$size[0]); $size[0] = 600;        }
        $template = str_replace('<:WIDTH:>', $size[0], $template);
        $template = str_replace('<:HEIGHT:>', $size[1], $template);
        $template = str_replace('<:DESCRIPTION:>', $row[description], $template);
        return $template;
}

function displayDescriptionPic($row) {
        global
                $bgcolor1,
                $bgcolor2,
                $font
        ;
        if ($row[description]!="")
        return '<table border="0" bgcolor="'.$bgcolor2.'" cellpadding="2" cellspacing="2" width="80%" align="center">'
                .'<tr>'
                .'<td align="left" bgcolor="'.$bgcolor2.'" valign="top" width="100"><font class="content">'._GALDESCRIPTION.'&nbsp;</font></td>'
                .'<td align="left" bgcolor="'.$bgcolor1.'" valign="top"><font class="'.$font['normal'].'">'.$row[description].'</font></td>'
                .'</tr>'
                .'</table>'
        ;
        else return "";
}

function displaySizePic($row, $size) {
        global
                $gallerypath,
                $font
        ;
        return '<font class="content'.$font['normal'].'b>'.underscoreTospace($row[name]).'</b></font><br><font class="'.$font['normal'].'">['.$size[0].' x '.$size[1].' '.substr($row[img],strrpos($row[img], '.')+1).']</font>';
}

function displaySubmitterPic($row) {
        global
                $bgcolor1,
                $bgcolor2,
                $font,
                $prefix,
                $postcardverz
        ;
        $result = mysql_query("SELECT * FROM $prefix"._users." where uname='".$row[submitter]."'");
        if(mysql_numrows($result)>0) {
                $row[submitter] = '<a href="modules.php?name=Your_Account&op=userinfo&amp;uname='.$row[submitter].'" target="_blank">'.$row[submitter].'</a>';
        }
        return '<table border="0" bgcolor="'.$bgcolor2.'" cellPadding="2" cellSpacing="2" width="160">'
                .'<tr>'
                .'<td width="50" align="left" bgcolor="'.$bgcolor2.'"><font class="'.$font['tiny'].'">'._GALSUBMITTER.'</font></td>'
                .'<td width="110" align="left" bgcolor="'.$bgcolor1.'"><font class="'.$font['tiny'].'">'.$row[submitter].'</font></td>'
                .'</tr>'
        ;
}

function displayDateAddedPic($row) {
        global
                $bgcolor1,
                $bgcolor2,
                $font
        ;
        return '<tr>'
                .'<td width="50" align="left" bgcolor="'.$bgcolor2.'"><font class="'.$font['tiny'].'">'._GALADDED.'</font></td>'
                .'<td width="110" align="left" bgcolor="'.$bgcolor1.'"><font class="'.$font['tiny'].'">'.strftime(_GALDATEBRIEF, $row[unix_time]).'</font></td>'
                .'</tr>'
        ;
}


function displayHitsPic($row) {
        global
                $bgcolor1,
                $bgcolor2,
                $font
        ;
        return '<tr>'
                .'<td width="50" align="left" bgcolor="'.$bgcolor2.'"><font class="'.$font['tiny'].'">'._GALHITS.'</font></td>'
                .'<td width="110" align="left" bgcolor="'.$bgcolor1.'"><font class="'.$font['tiny'].'">'.$row[counter].'</font></td>'
                .'</tr>'
        ;
}


function displayRatePic($row) {
        global
                $galleryvar,
                $bgcolor1,
                $bgcolor2,
                        $font,
                $postcardverz
        ;
        if(!$galleryvar['allowrate']) {
                return;
        }
        return '<tr>'
                .'<td width="50" align="left" bgcolor="'.$bgcolor2.'"><font class="'.$font['tiny'].'">'._GALVOTES.'</font></td>'
                .'<td width="110" align="left" bgcolor="'.$bgcolor1.'" ><font class="'.$font['tiny'].'">'.$row[votes].'</font></td>'
                .'</tr>'
                .'<tr>'
                .'<td width="50" align="left" bgcolor="'.$bgcolor2.'"><font class="'.$font['tiny'].'">'._GALRATING.'</font></td>'
                .'<td width="110" align="left" bgcolor="'.$bgcolor1.'"><font class="'.$font['tiny'].'">'.$row[rate].'</font></td>'
                .'</tr>'
                .'</table>'
        ;
}

function displayRatingBarPic($row, $orderby) {
        global
                $galleryvar,
                $user,
                $baseurl,
                $imagepath,
                $font,
                $postcardverz
        ;
        if(!$galleryvar['allowrate']) {
                return;
        }
        if(!$galleryvar['anonrate'] || $user) {
                return  '<form action="'.$baseurl.'&amp;do=Vote" method="post">'
                        .'<input type="hidden" name="pid" value="'.$row[pid].'">'
                        .'<input type="hidden" name="orderby" value="'.$orderby.'">'
                        .'<table width="160" border="0" cellpadding="2" cellspacing="1" align="center">'
                        .'<tr>'
                        .'<td align="right" valign="middle">'
                        .'<select name="rate">'
                        .'<option value="1">1</option>'
                        .'<option value="2">2</option>'
                        .'<option value="3">3</option>'
                        .'<option value="4">4</option>'
                        .'<option value="5">5</option>'
                        .'<option value="6">6</option>'
                        .'<option value="7">7</option>'
                        .'<option value="8">8</option>'
                        .'<option value="9">9</option>'
                        .'<option value="10" selected>10</option>'
                        .'</select>'
                        .'</td>'
                        .'<td align="left" valign="middle">'
                        .'<input src="'.$imagepath.'/rate.jpg" type="image">'
                        .'</td>'
                        .'</tr>'
                        .'</table>'
                        .'</form>'
                ;
        }
        else {
                return '<font class="'.$font['tiny'].'">'._GALMEMBERSRATE.'</font>';
        }
}

function displayCommentsPic($pid, $orderby) {
   global
           $adminpath,
           $user,
        $baseurl,
        $admin,
        $imagepath,
        $prefix,
        $bgcolor1,
        $bgcolor2,
        $font,
        $postcardverz
   ;

   include("$adminpath/config.php");

        $out = '<br><br><center>';
        $out .= '<i><font class="'.$font['title'].'">'._GALCOMMPOST.'</font><br><br></center></i>';

        $result3 = mysql_query("select cid, pid, comment, date, name, member from $prefix"._4nalbum_comments." where pid=$pid order by date ASC");
        if (mysql_num_rows($result3) == 0) {
                $out .= '<p align="center"><font class="content">'._GALNOCOMM.'</font></p><br>';
        }
        else {
                $out .= '<TABLE border="0" bgcolor="'.$bgcolor2.'" cellPadding="2" cellSpacing="2" width="80%" align="center">';

                while(list($cid, $cpid, $comment, $date, $name, $member) = mysql_fetch_array($result3)) {
                        if ($member)
                                $poster = '<a class="'.$font['normal'].'" href="modules.php?name=Your_Account&op=userinfo&amp;uname='.$name.'">'.underscoreTospace($name).'</a>';
                        else
                                $poster =  '<font class="'.$font['normal'].'">'.underscoreTospace($name).'</font>';

                          $out .= '<TR>';

                $out .= '  <TD align="left" bgColor="'.$bgcolor2.'" vAlign="top" width="100"><font class="'.$font['normal'].'">'.$poster.'</font></TD>'
                        .'  <TD align="left" bgColor="'.$bgcolor1.'" vAlign="top"><font class="'.$font['normal'].'">('.substr($date,0,10).'): '.$comment.'</font></TD>';

                if (is_admin($admin))
                        $out .= '  <TD align="center" width="30"><a href="'.$baseurl.'&amp;do=deletecomment&amp;cid='.$cid.'&amp;pid='.$pid.'&amp;orderby='.$orderby.'" onClick="return confirm(\''._GALSURE2DELETECOMMENT.'\')">'
                             .'<img src="'.$imagepath.'/delete.gif" border="0" alt="'._DELETE.'"></a></td>';

                $out .= '</TR>';
                } //while
                $out .= '</TABLE>';
        }
        print '<br><br>';
        if (is_user($user)) {
                $userdata=cookiedecode($user);
                $out .=
                '<p align="center"><form action="'.$baseurl.'" method="POST">'
                .'<input type="hidden" name="do" value="Post">'
                .'<font class="'.$font['title'].'">'._GALNAME.'</font>&nbsp;<b>'.$userdata[1].'</b>'
                       .'<input type="hidden" name="gname" value="'.$userdata[1].'">'
                       .'<input type="hidden" name="member" value="1"><br>'
                .'<font class="'.$font['title'].'">'._GALCOMMENT.'</font><br>'
                  .'<input class="textbox" type="text" name="comment" size="70" maxlength="70"><br>'
                  .'<input class="textbox" type="hidden" name="pid" value="'.$pid.'">&nbsp;'
                  .'<input type="submit" value="Post">'
                .'</form>'
                .'<font class="option">'._GALNOTE.'</font></p>';
        }
        elseif (!$galleryvar['anoncomments']) {
                $out .=
                '<p align="center"><form action="'.$baseurl.'" method="post">'
                .'<input type="hidden" name="do" value="Post">'
                .'<font class="'.$font['title'].'">'._GALNAME.'</font><br>'
                     .'<input type="text" SIZE="20" MAXLENGTH="20" name="gname">'
                     .'<input type="hidden" name="member" value="0">'
                     .'<br><font class="'.$font['title'].'">'._GALCOMMENT.'</font><br>'
                .'<input class="textbox" type="text" name="comment" size="70" maxlength="70"><br>'
                .'<input class="textbox" type="hidden" name="pid" value="'.$pid.'">&nbsp;'
                .'<input type="submit" value="Post">'
                .'</form>'
                .'<font class="option">'._GALNOTE.'</font></p>';
        }
        else {
                $out .= '<p align="center"><font class="'.$font['tiny'].'">'._GALREGISTER."</font></p>";
        }
  return $out;
}

function getPos($res, $pid) {
        $i=0;
        while ($row=mysql_fetch_array($res)) {
                if ($row[pid] == $pid)
                        return $i;
                $i++;
        }
}


function rateCollector($pid, $rate) {
    global
            $cookiePrefix,
            $HTTP_COOKIE_VARS,
            $adminpath,
        $prefix,
        $postcardverz
    ;

    include ("$adminpath/config.php");

    // Fix for lamers that like to cheat on polls
    $ip = getenv("REMOTE_ADDR");
    $past = time()-1800;
    mysql_query("DELETE FROM $prefix"._4nalbum_rate_check." WHERE time < $past");
    $result = mysql_query("SELECT ip, pid FROM $prefix"._4nalbum_rate_check." WHERE pid=$pid");
    list($ips, $pids) = mysql_fetch_row($result);
    $ctime = time();
    if (($ip == $ips) && ($pid == $pids)) {
        $voteValid = 0;
    } else {
        mysql_query("INSERT INTO $prefix"._4nalbum_rate_check." (ip, time, pid) VALUES ('$ip', '$ctime', '$pid')");
        $voteValid = 1;
    }
    // Fix end

    if($setRateCookies>0) {
        // we have to check for cookies, so get timestamp of this rate
        list($time) = mysql_fetch_row(mysql_query("SELECT date FROM $prefix"._4nalbum_pictures." WHERE pid=$pid"));
        $timeStamp = formatTimestamp($time);
        $cookieName = $cookiePrefix.$timeStamp;
        // check if cookie exists
        if($HTTP_COOKIE_VARS["$cookieName"] == "1") {
            // cookie exists, invalidate this vote
            echo $warn = "You already voted today!";
            $voteValid = 0;
        } else {
            // cookie does not exist yet, set one now
            $cvalue = 1;
            setcookie("$cookieName",$cvalue,time()+86400);
        }
    }
    // update database if the vote is valid
    if($voteValid>0) {
        mysql_query("update $prefix"._4nalbum_pictures." set votes=votes+1, rate=(rate*(votes-1) + $rate)/votes where pid=$pid");
    }

    // a lot of browsers can't handle it if there's an empty page
    print '<html><head></head><body></body></html>';

}

function showpic($pid, $orderby) {
        global
                $adminpath,
                $basepath,
                $prefix,
                $gallerypath,
                $user,
                $admin,
                $baseurl,
                $galleryvar,
                $font,
                $PHP_SELF,
                $postcardverz
        ;

        include("$adminpath/config.php");
        include("$adminpath/postcardverz.php");

        if(!isset($orderby) || $orderby=="")
                $orderby = $galleryvar['defaultsortmedia'];

        $prow = mysql_fetch_array(mysql_query("SELECT p.*, UNIX_TIMESTAMP(p.date) AS unix_time, c.galloc, c.visible, t.templatePictures, t.templateCSS, f.displaytag, f.filetype, f.description AS description_media FROM $prefix"._4nalbum_pictures." AS p LEFT JOIN $prefix"._4nalbum_categories." AS c ON c.gallid=p.gid LEFT JOIN $prefix"._4nalbum_template_types." AS t ON t.id=c.template LEFT JOIN $prefix"._4nalbum_media_types." AS f ON f.extension=p.extension WHERE pid=$pid"));

        $ok=0;
        switch ($prow[visible]) {
                case 0:
                        if (is_admin($admin))
                                $ok=1;
                        break;
                case 1:
                        if (is_user($user) || is_admin($admin))
                                $ok=1;
                        break;
                default:
                        $ok=1;
                        break;
        }

        if ($ok) {
                galleryHeader();
                OpenTable();

                if($prow[filetype] == 1) {
                        $size = @getimagesize("$gallerypath/$prow[galloc]/$prow[img]");
                }
                else {
                        $size[0] = $prow[width];
                        $size[1] = $prow[height];
                        $size[2] = $prow[description_media];
                        $size[3] = "width=\"size[0]\" height=\"size[1]\"";
                }
                $navtree = navigationTree($prow[gid], $prow[pid]);
                $navpic = navigationPic($prow[name], $prow[gid], $prow[pid], $orderby);
                $navgall = navigationGall();

                $iname = displaySizePic($prow, $size);
                $img = displayPicturePic($prow, $size);
                $date = displayDateAddedPic($prow);
                $submitter = displaySubmitterPic($prow);
                $hits = displayHitsPic($prow);
                $rate = displayRatePic($prow);
                $ratingbar = displayRatingBarPic($prow, $orderby);
                $description = displayDescriptionPic($prow);

                if ($galleryvar['allowcomments'])
                        $comments = displayCommentsPic($prow[pid], $orderby);
                //
                if ($galleryvar['allowpostcard']) {
                       $path = substr($PHP_SELF, 0, strlen($PHP_SELF) - strlen("/modules.php"));
                if($prow[filetype] == 1) {
                                $postcard = "<a class=\"".$font['normal']."\" href=\"#\"  onMouseOver=\"window.status='eCard';return true\" onMouseOut=\"window.status='';return true\" onClick=\"window.open('$postcardverz/index.php?picture=$path/$gallerypath/$prow[galloc]/$prow[img]','$target','width=$postcardwidth,height=$postcardheight,directories=no,location=no,menubar=no,scrollbars=yes,status=no,toolbar=no,left=10,top=10,screenx=50,Screeny=50');return false\">
                                  <img src=\"$imagepath/mailcard.gif\" border=\"0\" align=\"left\" alt=\""._GALPOSTCARD."\">
                                   "._GALPOSTCARD."
                                  </a>";
                         }
                }
                if ($galleryvar['allowprint'] && $prow[filetype] == 1)  {
                        // No Margin Pop Up Window Version 1.0 : Credits to Dodo : http://www.regretless.com
                              $dir="../album/$prow[galloc]/"; // the directory where your image's at with "/" at the end, leave it                                      // blank if you are calling the image from the same directory
                        $pic="$prow[img]"; // your image file name
                        $width="$prow[width]"; // image width
                        $height="$prow[height]"; // image height
                        $target++; // leave this alone
                        $nmdir="$basepath/public/"; // the directory where your nmimage.php's at with "/" at the end
                        // leave it blank if you are calling the image from the same directory

                        $print = "<A class=\"".$font['normal']."\" HREF=\"#\" onMouseOver=\"window.status='pop up';return true\" onMouseOut=\"window.status='';return true\" onClick=\"window.open('$nmdir";
                        $print .= "nmimage.php?z=$dir$pic&width=$width&height=$height','$target','width=$width,height=$height,directories=no,location=no,menubar=no,scrollbars=no,status=no,toolbar=no,resizable=no,left=0,top=0,screenx=50,screeny=50');return false\">";
                        $print .= "<img src=\"$imagepath/print.gif\" border=\"0\" align=\"left\" alt=\""._GALPRINTMEDIA."\">"._GALPRINTMEDIA."</a><br><br><br><br>";
                }

                if ($galleryvar['allowdownload']) {
                        $thefile = substr($prow[img], 0, strrpos($prow[img],'.'));
                        $zipfile = $thefile.".zip";
                        $gzfile = $prow[img].".gz";
                        if ($galleryvar['downloadmode']=="zip")
                                $thefile = $zipfile;
                        elseif ($galleryvar['downloadmode']=="gz")
                                $thefile = $gzfile;
                        $download = "<a class=\"".$font['tiny']."\" href=\"$baseurl&amp;do=getit&amp;url=$prow[galloc]/$thefile&amp;filename=$thefile\"><img src=\"$imagepath/hit.gif\" border=\"0\" align=\"middle\" alt=\"Download this Media\" ></a> <a class=\"content\" href=\"$baseurl&amp;do=getit&amp;url=$prow[galloc]/$thefile&amp;filename=$thefile\"> "._GALDOWNLOADMEDIA."</a>";
                }
                //
                $template = $prow[templatePictures];
                $template = str_replace('<:IMAGE:>', $img, $template);
                $template = str_replace('<:DESCRIPTION:>', $description, $template);
                $template = str_replace('<:RATE:>', $rate, $template);
                $template = str_replace('<:RATINGBAR:>', $ratingbar, $template);
                $template = str_replace('<:SUBMITTER:>', $submitter, $template);
                $template = str_replace('<:NAMESIZE:>', $iname, $template);
                $template = str_replace('<:COMMENTS:>', $comments, $template);
                $template = str_replace('<:HITS:>', $hits, $template);
                $template = str_replace('<:DATE:>', $date, $template);
                // raw data
                $template = str_replace('<:RAWIMAGE:>', $prow[img], $template);
                $template = str_replace('<:RAWIMAGESIZE:>', $size[3], $template);
                $template = str_replace('<:RAWIMAGEWIDTH:>', $size[0], $template);
                $template = str_replace('<:RAWIMAGEHEIGHT:>', $size[1], $template);
                $template = str_replace('<:RAWDESCRIPTION:>', $prow[description], $template);
                $template = str_replace('<:RAWRATE:>', $prow[rate], $template);
                $template = str_replace('<:RAWVOTES:>', $prow[votes], $template);
                $template = str_replace('<:RAWSUBMITTER:>', $prow[submitter], $template);
                $template = str_replace('<:RAWNAME:>', $prow[name], $template);
                $template = str_replace('<:RAWHITS:>', $prow[hist], $template);
                $template = str_replace('<:RAWDATEBRIEF:>', strftime(_GALBRIEFDATE, $prow[unix_time]), $template);
                $template = str_replace('<:POSTCARD:>', $postcard, $template);
                $template = str_replace('<:PRINT:>', $print, $template);
                $template = str_replace('<:DOWNLOAD:>', $download, $template);

                print "$navgall $navtree";
                print "$navpic $template";
                CloseTable();
                galleryFooter();
        } // If OK
}
?>