Файл: vsime.com/fotos/inc/foto_form.php
Строк: 312
<?
include('inc/selectar_form.php');
$count_komm=mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]'"));
if ($count_komm > 0)
{
$last_komm = mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' ORDER BY `time` DESC LIMIT 1"));
$ank_last_komm = profile($last_komm['id_user']);
}
if(isset($_GET['mdelete']) && ($ank['id']==$user['id'] && isset($user) || isset($moderate_foto) && $user['level'] > $ank['level']))$mdelete=1;
if(isset($mdelete) && isset($_POST['m_d_okey']))
{
if (hsc($_POST['mdp'])==$mdp)
{
foreach ($_POST as $key => $value)
{
if (preg_match('#^mdelelte_komm_([0-9]*)$#',$key,$kid) && $value='1')
{
if (mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `id` = '$kid[1]' LIMIT 1"))!=0)
{
$komm=mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `id` = '$kid[1]' LIMIT 1"));
mysqli_query($dbi, "DELETE FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `id` = '$komm[id]'");
}
}
}
} else hacked_by_Killer();
}
if (isset($_GET['delete_foto']))
{
if ($ank['id']==$user['id'] && isset($user) || isset($moderate_foto) && $user['level'] > $ank['level'])
{
if(isset($_POST['submited']))
{
if (hsc($_POST['mdp'])==$mdp)
{
mysqli_query($dbi, "DELETE FROM `foto_komm` WHERE `id_foto` = '$foto[id]'");
mysqli_query($dbi, "DELETE FROM `foto` WHERE `id` = '$foto[id]' AND `type` = 'foto'");
mysqli_query($dbi, "DELETE FROM `files_zone` WHERE `id_file` = '$foto[id]' AND `type` = 'foto'");
mysqli_query($dbi, "DELETE FROM `files_comm` WHERE `id_file` = '$foto[id]' AND `type` = 'foto'");
mysqli_query($dbi, "DELETE FROM `lenta` WHERE `id_object` = '$foto[id]' AND `type` = 'foto'");
unlink(H."system/files/fotos/d$dir[id]/".$foto['id'].".dat");
if (!mysqli_result("SELECT COUNT(*) FROM `foto` WHERE `type` = 'foto' AND `id_dir` = '$dir[id]'"))rmdir(H."system/files/fotos/d$dir[id]");
locon(" ?dir=$foto[id_dir]");
exit;
} else hacked_by_Killer();
}
echo "<form method='POST'>n";
echo "Подтвердите удаление фото<br/>n";
echo "<input type='submit' name='submited' value='Удалить'> <a href='?foto=$foto[id]'>Отмена</a>n";
echo "<input type='hidden' name='mdp' value='$mdp' />n";
echo "</form>n";
}
else
{
$error[] = "У Вас нет прав для удаления фото!";
show_errors();
}
ex_foot();
}
if (isset($_GET['edit_foto']))
{
if (isset($user) || $ank['id']==$user['id'] || isset($moderate_foto) && $user['level'] > $ank['level'])
{
if(isset($_POST['submited']) && isset($_POST['name']) && isset($_POST['desc']))
{
if (hsc($_POST['mdp'])==$mdp)
{
$name=$_POST['name'];
$desc=$_POST['desc'];
if(mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `foto` WHERE `name` = '$name' AND `id` != '$foto[id]' AND `type` = 'foto' AND `ras` = '$foto[ras]' AND `id_dir` = '$dir[id]'"))!=0)$error[]="Такая папка уже есть";
if(strlen2($name)>50 || strlen2($name)<1)$error[]="Название не должно быть пустым и не больше 50-ти символов";
if(strlen2($desc)>512)$error[]="Описание должно быть не больше 512-ти символов";
if(!preg_match("#^([A-zА-я0-9-_() ])+$#ui", $name))$error[]='В названии присутствуют запрещенные символы';
$name=my_esc($name);
$desc=my_esc($desc);
if (!isset($error))
{
if (mysqli_result("SELECT COUNT(*) FROM `files_zone` WHERE `id_file` = '$foto[id]' AND `type` = 'foto'")!=0) {
mysqli_query($dbi, "UPDATE `files_zone` SET `name` = '$name.$foto[ras]' WHERE `id_file` = '$foto[id]' AND `type` = 'foto'");
}
mysqli_query($dbi, "UPDATE `foto` SET `name` = '$name', `desc` = '$desc' WHERE `id` = '$foto[id]' AND `type` = 'foto'");
locon("?foto=$foto[id]");
exit;
}
} else hacked_by_Killer();
}
show_errors();
echo "<form method='POST'>n";
echo "Название:<br/>n";
if (is_file(H.'i/file_type/'.$foto['ras'].'.png'))echo "<img src='/i/file_type/$foto[ras].png' alt='$foto[ras]' />n";
else echo "<img src='/i/file_type/file.png' alt='foto' />n";
echo " <input type='text' style='width: 80%' name='name' value='".input_value($foto['name'])."'".title_link('Введите новое название фото').">.".hsc($foto['ras'])."<br/>n";
echo "Описание:<br />n";
echo "<textarea name='desc' rows='6' cols='17' style='width:85%'".title_link('Введите новое описание фото').">".input_value($foto['desc'])."</textarea><br />n";
echo "<input type='submit' name='submited' value='Сохранить'> <a href='?foto=$foto[id]'>Назад</a>n";
echo "<input type='hidden' name='mdp' value='$mdp' />n";
echo "</form>n";
echo "<div class='mod_grad'>n";
echo "$config[code_delete] <a href='?foto=$foto[id]&delete_foto'>Удалить фото</a><br />n";
echo "</div>n";
}
else
{
$error[] = "У Вас нет прав для редактирования фото!";
show_errors();
}
ex_foot();
}
if(isset($mdelete) && isset($_POST['m_sk_okey']))
{
if (hsc($_POST['mdp'])==$mdp)
{
foreach ($_POST as $key => $value)
{
if (preg_match('#^mdelelte_komm_([0-9]*)$#',$key,$kid) && $value='1')
{
if (mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `id` = '$kid[1]' LIMIT 1"))!=0)
{
$komm=mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `id` = '$kid[1]' LIMIT 1"));
mysqli_query($dbi, "UPDATE `foto_komm` SET `sk` = '".($komm['sk']==0?1:0)."', `sk_user` = '$user[id]' WHERE `id_foto` = '$foto[id]' AND `id` = '$komm[id]'");
}
}
}
} else hacked_by_Killer();
}
if(isset($_GET['reply']) && mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `id` = '".intval($_GET['reply'])."'"))!=0)
{
$komm=mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `id` = '".intval($_GET['reply'])."'"));
$ank2=profile($komm['id_user']);
echo "<div class='list'>n";
echo "<div class='left'>n";
echo show_avatar($ank2['id'], 'small');
echo "</div>n";
echo "<div class='overfl_hid'>n";
echo profile_icon($ank2['id']).profile_nick($ank2['id'], 1).profile_medal($ank2['id']);
echo "<br />n";
echo output_text($komm['msg'], $ank2['id'])."n";
echo "</div>n";
echo "<div class='clear'></div>n";
echo "</div>n";
if (isset($user))
{
input_bbs();
echo "<div class=list><form method='post' action='?foto=$foto[id]'>n";
echo "<textarea name='msg' id='textarea' rows='5' cols='17' style='width: 95%' placeholder='Введите свой ответ...'></textarea><br />n";
echo "<input type='hidden' name='reply' value='$ank2[id]'>n";
echo "<input type='hidden' name='komm_reply' value='$komm[id]'>n";
echo "<input type='hidden' name='mdp' value='$mdp' />n";
echo "<input value="Отправить" type="submit" /> <a href='?foto=$foto[id]'>Назад</a>n";
echo "</form></div>n";
} else echo "<div class='main'>$config[code_add] <a href='/login.php'>Добавить комментарий</a></div>n";
ex_foot();
}
if(isset($_GET['edit']) && mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `id` = '".intval($_GET['edit'])."'"))!=0)
{
$komm=mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `id` = '".intval($_GET['edit'])."'"));
$ank2=profile($komm['id_user']);
if(isset($user) && ($user['id']==$ank2['id'] && $komm['time']>time()-600))
{
if(isset($_POST['msg']))
{
if (hsc($_POST['mdp'])==$mdp)
{
$msg=$_POST['msg'];
if (strlen2($msg)>1024){$error[]='Сообщение слишком длинное';}
if (strlen2($msg)<1){$error[]='Короткое сообщение';}
if(!isset($error))
{
mysqli_query($dbi, "UPDATE `foto_komm` SET `msg` = '".my_esc($msg)."' WHERE `id_foto` = '$foto[id]' AND `id` = '$komm[id]'");
locon(" ?foto=$foto[id]");
}
} else hacked_by_Killer();
}
show_errors();
input_bbs();
echo "<form method='post' action='?foto=$foto[id]&edit=$komm[id]'>n";
echo "<textarea name='msg' id='textarea' rows='5' cols='17' style='width: 95%' placeholder='Введите комментарий...'>".input_value($komm['msg'])."</textarea><br />n";
echo "<input value="Отправить" type="submit" /> <a href='?foto=$foto[id]'>Назад</a>n";
echo "<input type='hidden' name='mdp' value='$mdp' />n";
echo "</form>n";
ex_foot();
}
}
if (isset($_POST['msg']) && isset($user))
{
if (hsc($_POST['mdp'])==$mdp)
{
$msg=$_POST['msg'];
if (strlen2($msg)>1024){$error[]='Сообщение слишком длинное';}
if (strlen2($msg)<1){$error[]='Короткое сообщение';}
if (@$ank_last_komm['id']==$user['id'] && my_esc($msg)==@$last_komm['msg']){$error[]='Ваше сообщение повторяет предыдущее';}
if(!isset($error))
{
if(isset($_POST['reply']) && profile(intval(@$_POST['reply']), 1))
{
$reply_user=profile(intval($_POST['reply']));
$komm_reply=mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `id_user` = '$reply_user[id]' AND `id` = '".intval($_POST['komm_reply'])."'"));
$reply=1;
}
$array_journal = array();
$query_komm = mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE `id_foto` = '$foto[id]' ORDER BY `time` ASC");
while ($post_komm = mysqli_fetch_array($query_komm))
{
if ($post_komm['id_user'] != $ank['id'] && $post_komm['id_user'] != $user['id'])$array_journal["$post_komm[id_user]"] = $post_komm['id'];
}
foreach ($array_journal as $key => $value)
{
$ank_journal = profile($key);
$komm_journal = mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE `id` = '$value'"));
if (!mysqli_result("SELECT COUNT(*) FROM `journal` WHERE `id_kont` = '$ank_journal[id]' AND `cat` = 'fotos' AND `type` = 'komm' AND `id_object2` = '$foto[id]'"))mysqli_query($dbi, "INSERT INTO `journal` (`id_kont`, `time`, `cat`, `type`, `id_object`, `id_object2`) values('$ank_journal[id]', '$time', 'fotos', 'komm', '$komm_journal[id]', '$foto[id]')");
else mysqli_query($dbi, "UPDATE `journal` SET `time` = '$time', `read` = '0', `id_object` = '$komm_journal[id]' WHERE `id_kont` = '$ank_journal[id]' AND `cat` = 'fotos' AND `type` = 'komm' AND `id_object2` = '$foto[id]'");
}
mysqli_query($dbi, "INSERT INTO `foto_komm` (`id_user`, `id_foto`, `time`, `msg`".(isset($reply)?", `id_reply`, `reply_msg`":null).") values('$user[id]', '$foto[id]', '$time', '".my_esc($msg)."'".(isset($reply)?", '$reply_user[id]', '$komm_reply[msg]'":null).")");
locon(" ?foto=$foto[id]");
}
} else hacked_by_Killer();
}
if (($ank['id']==$user['id'] && isset($user) || isset($moderate_foto) && $user['level'] > $ank['level']) && isset($_GET['delete']) && mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id` = '".intval($_GET['delete'])."' AND `id_foto` = '$foto[id]' LIMIT 1"))!=0)
{
if (hsc($_GET['mdp'])==$mdp)
{
mysqli_query($dbi, "DELETE FROM `foto_komm` WHERE$skp `id` = '".intval($_GET['delete'])."' AND `id_foto` = '$foto[id]' LIMIT 1");
locon(" ?foto=$foto[id]");
} else hacked_by_Killer();
}
if (mysqli_result("SELECT COUNT(*) FROM `files_zone` WHERE `id_file` = '$foto[id]' AND `type` = 'foto'")!=0)
{
if (isset($_GET['delete_fzone']) && ($ank['id']==$user['id'] && isset($user) || isset($moderate_foto) && $user['level'] > $ank['level']))
{
if (isset($_POST['submited']))
{
if (hsc($_POST['mdp'])==$mdp)
{
mysqli_query($dbi, "DELETE FROM `files_zone` WHERE `id_file` = '$foto[id]' AND `type` = 'foto'");
locon(" ?foto=$foto[id]");
exit;
} else hacked_by_Killer();
}
echo "<form method='POST'>n";
echo "Подтвердите удаление файла из Зоны файлов<br/>n";
echo "<input type='submit' name='submited' value='Удалить'> <a href='?foto=$foto[id]'>Отмена</a>n";
echo "<input type='hidden' name='mdp' value='$mdp' />n";
echo "</form>n";
ex_foot();
}
$file_zone = mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `files_zone` WHERE `id_file` = '$foto[id]' AND `type` = 'foto'"));
if ($file_zone['id_dir'] == 0)
{
$dir_zone = array();
$dir_zone['show'] = 'Корневая папка';
} else {
$dir_zone = mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `files_zone` WHERE `id` = '$file_zone[id_dir]' AND `type` = 'dir'"));
$dir_zone['show'] = "<a href='/files_zone/?dir=$dir_zone[id]'>".hsc($dir_zone['name'])."</a>";
if (mysqli_result("SELECT COUNT(*) FROM `files_zone` WHERE `id` = '$dir_zone[id_dir]' AND `type` = 'dir'")!=0)
{
$dir_zone2 = mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `files_zone` WHERE `id` = '$dir_zone[id_dir]' AND `type` = 'dir'"));
$dir_zone['show'] = "<a href='/files_zone/?dir=$dir_zone2[id]'>".hsc($dir_zone2['name'])."<a> / ".$dir_zone['show'];
}
}
echo "<div class='main'>n";
if ($ank['id']==$user['id'] && isset($user) || isset($moderate_foto) && $user['level'] > $ank['level'])echo "<span class='right'>".($ank['id'] == $user['id']?"<a href='?act=fzone&id=$foto[id]'>$config[code_move]</a> ":NULL)."<a href='?foto=$foto[id]&delete_fzone'>$config[code_delete]</a></span>n";
echo "<img src='/i/dir_type/dir_zone.png' /> Зона файлов: $dir_zone[show]<br />n";
echo "</div>n";
}
echo "<div class='list'>n";
echo "<div class='mediaspace'>n";
if (is_file(H.'/i/file_type/'.$foto['ras'].'.png'))echo "<img src='/i/file_type/$foto[ras].png' alt='$foto[ras]' />n";
else echo "<img src='/i/file_type/file.png' alt='foto' />n";
echo " <b class='none'>".hsc($foto['name'])."</b>.".hsc($foto['ras'])."n";
if ($ank['id']==$user['id'] && isset($user) || isset($moderate_foto) && $user['level'] > $ank['level'])if ($config['web']==true)echo "<span class='right'><a href='?foto=$foto[id]&edit_foto'>$config[code_edit]</a>".($ank['id']==$user['id'] && isset($user) || isset($moderate_foto) && $user['level'] > $ank['level']?" <a href='?foto=$foto[id]&delete_foto'>$config[code_delete]</a>":NULL)."</span>n";
echo "<br />n";
echo "</div>";
echo "<div class='freespace'>n";
echo ffs_screen($foto['id'], 'foto', WapWeb_show(128,256), WapWeb_show(128,256));
echo "</div>n";
if ($foto['desc']!=NULL)echo output_text($foto['desc'], $ank['id'])."<br />n";
echo "<img src='/i/site/download.png' /> <a href='/fotos/download/".md5($foto['id'])."/$unique_code/$mdp/".hsc($foto['name']).".".hsc($foto['ras'])."'".title_link('Скачать фото').">Скачать</a> (".size_file($foto['size']).")<br />n";
echo "</div>n";
echo "<div class='list'>n";
echo "<img src='/i/site/avatar.png' /> Выгрузил: n";
echo profile_nick($ank['id'], 1);
echo " (".vremja($foto['time']).")n";
echo "<br />n";
if (isset($_GET['foto_replace']) && ($ank['id']==$user['id'] && isset($user)))
{
if (isset($_SESSION['fotos_multi_select']))
{
if (!in_array($foto['id'], $_SESSION['fotos_multi_select']))$_SESSION['fotos_multi_select'][] = $foto['id'];
} else {
$_SESSION['fotos_multi_select'] = array();
$_SESSION['fotos_multi_select'][] = $foto['id'];
}
locon(" ?dir=$dir[id]");
exit();
}
else echo "<img src='/i/dir_type/dir.png' /> Папка: <a href='?dir=$dir[id]".($dir['id']==0?"&id=$ank[id]":NULL)."'>".hsc($dir['name'])."</a> ".($ank['id']==$user['id'] && isset($user)?" [<a href='?foto=$foto[id]&foto_replace'><span style='text-decoration: underline;'>Переместить</span></a>]":NULL)."<br />";
echo "</div>n";
echo "<div class='main'>n";
if (mysqli_result("SELECT COUNT(*) FROM `files_zone` WHERE `id_file` = '$foto[id]' AND `type` = 'foto'")==0 && $ank['id'] == $user['id'] && isset($user))echo "<img src='/i/site/toFZ.png' /> <a href='?act=fzone&id=$foto[id]'>В зону</a><br />n";
echo "<img src='/i/site/share.png' /> <a href='?act=share&id=$foto[id]'>Отправить другу</a><br />n";
echo "</div>n";
include('inc/foto_komm_form.php');
echo "<div class='foot'>n";
echo image_back()." <a href='?dir=$dir[id]".($dir['id']==0?"&id=$ank[id]":NULL)."'>Список фото</a>n";
echo "</div>n";
ex_foot();
?>