<?
include_once("./_common.php");

// 090710
if (substr_count($wr_content, "&#") > 50) {
    alert("您编辑的内容中包含非法字符！");
    exit;
}

@include_once("$board_skin_path/write_comment_update.head.skin.php");

$g4[title] = $wr_subject . "输入评论";

$w = $_POST["w"];
$wr_name  = strip_tags($_POST["wr_name"]);
$wr_email = strip_tags($_POST["wr_email"]);

// 游客状态
if (!$is_member)
{
    if (!trim($wr_name))
        alert("请输入作者名称");
}

if ($w == "c" || $w == "cu") 
{
    if ($member[mb_level] < $board[bo_comment_level]) 
        alert("您没有发表评论权限");
} 
else
    alert("w 传递错误"); 

// session检查
// 4.00.15 - 修复修改评论时检测时间的问题
if ($w == "c" && $_SESSION["ss_datetime"] >= ($g4[server_time] - $config[cf_delay_sec]) && !$is_admin) 
    alert("请勿短时间内连续发表评论内容！");

set_session("ss_datetime", $g4[server_time]);

// 相同内容检查
$sql = " select MD5(CONCAT(wr_ip, wr_subject, wr_content)) as prev_md5 from $write_table ";
if ($w == "cu")
    $sql .= " where wr_id <> '$comment_id' ";
$sql .= " order by wr_id desc limit 1 ";
$row = sql_fetch($sql);
$curr_md5 = md5($_SERVER[REMOTE_ADDR].$wr_subject.$wr_content);
// 修改之前版本不能判断修改模式的bug
//if ($row[prev_md5] == $curr_md5 && !$is_admin)
if ($row[prev_md5] == $curr_md5 && $w != 'cu' && !$is_admin)
    alert("请勿连续发表相同内容");

$wr = get_write($write_table, $wr_id);
if (!$wr[wr_id]) 
    alert("您访问的内容不存在或由于违反相关规定已被系统删除"); 

// 认证码
//include_once ("./norobot_check.inc.php");

if (!$is_member) {
    if ($w=='' || $w=='c') {
        $key = get_session("captcha_keystring");
        session_unregister("captcha_keystring");
        if (!($key && $key == $_POST[wr_key])) {
            alert("访问途径错误！");
        }
    }
}


// IE设定错误时
// 开启此选项后所有客户端执行代码都不能执行
//if (!trim($_POST["wr_content"])) die ("请输入内容");

if ($member[mb_id]) 
{
    $mb_id = $member[mb_id];
    // 4.00.13 - 开启实名显示时出现的错误
    $wr_name = $board[bo_use_name] ? $member[mb_name] : $member[mb_nick];
    $wr_password = $member[mb_password];
    $wr_email = $member[mb_email];
    $wr_homepage = $member[mb_homepage];
} 
else 
{
    $mb_id = "";
    $wr_password = sql_password($wr_password);
}

if ($w == "c") // 发表评论
{
    /*
    if ($member[mb_point] + $board[bo_comment_point] < 0 && !$is_admin)
        alert("您当前积分:(".number_format($member[mb_point]).")不够支付发表评论所需的积分：(".number_format($board[bo_comment_point]).").\\n\\n请赚取更多积分后重试！");
    */
    // 开启积分功能后会员积分在-0以后出现的错误
    $tmp_point = ($member[mb_point] > 0) ? $member[mb_point] : 0;
    if ($tmp_point + $board[bo_comment_point] < 0 && !$is_admin)
        alert("您当前积分：(".number_format($member[mb_point]).")不够支付发表评论所需的积分：(".number_format($board[bo_comment_point]).").\\n\\n请赚取更多积分后重试！");

    // 回复评论
    if ($comment_id) 
    {
        $sql = " select wr_id, wr_comment, wr_comment_reply from $write_table 
                  where wr_id = '$comment_id' ";
        $reply_array = sql_fetch($sql);
        if (!$reply_array[wr_id])
            alert("没有找到需要回复的评论\\n\\n可能在您编辑回复时该内容已被删除");

        $tmp_comment = $reply_array[wr_comment];

        if (strlen($reply_array[wr_comment_reply]) == 5)
            alert("已达到最大回复限制\\n\\n最多允许5层评论");

        $reply_len = strlen($reply_array[wr_comment_reply]) + 1;
        if ($board[bo_reply_order]) {
            $begin_reply_char = "A";
            $end_reply_char = "Z";
            $reply_number = +1;
            $sql = " select MAX(SUBSTRING(wr_comment_reply, $reply_len, 1)) as reply 
                       from $write_table 
                      where wr_parent = '$wr_id' 
                        and wr_comment = '$tmp_comment'
                        and SUBSTRING(wr_comment_reply, $reply_len, 1) <> '' ";
        } 
        else 
        {
            $begin_reply_char = "Z";
            $end_reply_char = "A";
            $reply_number = -1;
            $sql = " select MIN(SUBSTRING(wr_comment_reply, $reply_len, 1)) as reply 
                       from $write_table 
                      where wr_parent = '$wr_id' 
                        and wr_comment = '$tmp_comment'
                       and SUBSTRING(wr_comment_reply, $reply_len, 1) <> '' ";
        }
        if ($reply_array[wr_comment_reply]) 
            $sql .= " and wr_comment_reply like '$reply_array[wr_comment_reply]%' ";
        $row = sql_fetch($sql);

        if (!$row[reply])
            $reply_char = $begin_reply_char;
        else if ($row[reply] == $end_reply_char) // A~Z 26
            alert("已达到最大回复限制\\n\\n最多允许回复26层");
        else
            $reply_char = chr(ord($row[reply]) + $reply_number);

        $tmp_comment_reply = $reply_array[wr_comment_reply] . $reply_char;
    }
    else 
    {
        $sql = " select max(wr_comment) as max_comment from $write_table 
                  where wr_parent = '$wr_id' and wr_is_comment = 1 ";
        $row = sql_fetch($sql);
        //$row[max_comment] -= 1;
        $row[max_comment] += 1;
        $tmp_comment = $row[max_comment];
        $tmp_comment_reply = "";
    }

    $sql = " insert into $write_table
                set ca_name = '$wr[ca_name]',
                    wr_option = '$wr_secret',
                    wr_num = '$wr[wr_num]',
                    wr_reply = '',
                    wr_parent = '$wr_id',
                    wr_is_comment = '1',
                    wr_comment = '$tmp_comment',
                    wr_comment_reply = '$tmp_comment_reply',
                    wr_subject = '$wr_subject',
                    wr_content = '$wr_content',
                    mb_id = '$mb_id',
                    wr_password = '$wr_password',
                    wr_name = '$wr_name',
                    wr_email = '$wr_email',
                    wr_homepage = '$wr_homepage',
                    wr_datetime = '$g4[time_ymdhis]',
                    wr_last = '',
                    wr_ip = '$_SERVER[REMOTE_ADDR]',
                    wr_1 = '$wr_1',
                    wr_2 = '$wr_2',
                    wr_3 = '$wr_3',
                    wr_4 = '$wr_4',
                    wr_5 = '$wr_5',
                    wr_6 = '$wr_6',
                    wr_7 = '$wr_7',
                    wr_8 = '$wr_8',
                    wr_9 = '$wr_9',
                    wr_10 = '$wr_10' ";
    sql_query($sql);

    $comment_id = mysql_insert_id();

    // 增加评论并更新时间
    sql_query(" update $write_table set wr_comment = wr_comment + 1, wr_last = '$g4[time_ymdhis]' where wr_id = '$wr_id' ");

    // 新内容 INSERT
    //sql_query(" insert into $g4[board_new_table] ( bo_table, wr_id, wr_parent, bn_datetime ) values ( '$bo_table', '$comment_id', '$wr_id', '$g4[time_ymdhis]' ) ");
    sql_query(" insert into $g4[board_new_table] ( bo_table, wr_id, wr_parent, bn_datetime, mb_id ) values ( '$bo_table', '$comment_id', '$wr_id', '$g4[time_ymdhis]', '$member[mb_id]' ) ");

    // 评论计数+1
    sql_query(" update $g4[board_table] set bo_count_comment = bo_count_comment + 1 where bo_table = '$bo_table' ");

    // 增加积分
    insert_point($member[mb_id], $board[bo_comment_point], "$board[bo_subject] {$wr_id}-{$comment_id} 发表评论", $bo_table, $comment_id, '评论');

    // 发送邮件
    if ($config[cf_email_use] && $board[bo_use_email])
    {
        // 获取管理员信息
        $super_admin = get_admin("super");
        $group_admin = get_admin("group");
        $board_admin = get_admin("board");

        $wr_subject = get_text(stripslashes($wr[wr_subject]));
        $wr_content = nl2br(get_text(stripslashes("----- 主题内容 -----\n\n$wr[wr_subject]\n\n\n----- 评论 -----\n\n$wr_content")));

        $warr = array( ""=>"发表", "u"=>"编辑", "r"=>"回复", "c"=>"评论", "cu"=>"编辑评论" );
        $str = $warr[$w];

        $subject = "'{$board[bo_subject]}' 论坛有新的{$str}内容";
        // 4.00.15 - 邮件地址链接修改
        $link_url = "$g4[url]/$g4[bbs]/board.php?bo_table=$bo_table&wr_id=$wr_id&$qstr#c_{$comment_id}";

        include_once("$g4[path]/lib/mailer.lib.php");

        ob_start();
        include_once ("./write_update_mail.php");
        $content = ob_get_contents();
        ob_end_clean();

        $array_email = array();
        // 论坛管理员邮件
        if ($config[cf_email_wr_board_admin]) $array_email[] = $board_admin[mb_email];
        // 版块管理员邮件
        if ($config[cf_email_wr_group_admin]) $array_email[] = $group_admin[mb_email];
        // 网站管理员邮件
        if ($config[cf_email_wr_super_admin]) $array_email[] = $super_admin[mb_email];

        // 系统选项开启邮件通知功能时
        if (strstr($wr[wr_option], "mail") && $wr[wr_email]) {
            // 文章选项开启邮件通知功能时
            if ($config[cf_email_wr_write]) $array_email[] = $wr[wr_email];

            // 给所有评论会员发送邮件
            if ($config[cf_email_wr_comment_all]) {
                $sql = " select distinct wr_email from $write_table
                          where wr_email not in ( '$wr[wr_email]', '$member[mb_email]', '' )
                            and wr_parent = '$wr_id' ";
                $result = sql_query($sql);
                while ($row=sql_fetch_array($result))
                    $array_email[] = $row[wr_email];
            }
        }

        // 删除重复邮件地址
        $unique_email = array_unique($array_email);
        $unique_email = array_values($unique_email);
        for ($i=0; $i<count($unique_email); $i++) {
            mailer($wr_name, $wr_email, $unique_email[$i], $subject, $content, 1);
        }
    }
} 
else if ($w == "cu") // 编辑评论
{ 
    $sql = " select mb_id, wr_comment, wr_comment_reply from $write_table 
              where wr_id = '$comment_id' ";
    $comment = $reply_array = sql_fetch($sql);
    $tmp_comment = $reply_array[wr_comment];

    $len = strlen($reply_array[wr_comment_reply]);
    if ($len < 0) $len = 0; 
    $comment_reply = substr($reply_array[wr_comment_reply], 0, $len);
    //print_r2($GLOBALS); exit;

    if ($is_admin == "super") // 管理员通过 
        ; 
    else if ($is_admin == "group") { // 版块管理员 
        $mb = get_member($comment[mb_id]); 
        if ($member[mb_id] == $group[gr_admin]) { // 检查是否属于自己权限
            if ($member[mb_level] >= $mb[mb_level]) // 检查是否越权 
                ; 
            else 
                alert("您没有权限修改此评论内容，Code:1001"); 
        } else 
            alert("您没有权限修改此评论内容，Code:1000"); 
    } else if ($is_admin == "board") { // 论坛管理
        $mb = get_member($comment[mb_id]); 
        if ($member[mb_id] == $board[bo_admin]) { // 检查是否属于自己权限
            if ($member[mb_level] >= $mb[mb_level]) // 检查是否越权 
                ; 
            else 
                alert("您没有权限修改此评论内容，Code:1001"); 
        } else 
            alert("您没有权限修改此评论内容，Code:1000"); 
    } else if ($member[mb_id]) { 
        if ($member[mb_id] != $comment[mb_id]) 
            alert("您没有修改权限！"); 
    } 

    $sql = " select count(*) as cnt from $write_table
              where wr_comment_reply like '$comment_reply%'
                and wr_id <> '$comment_id'
                and wr_parent = '$wr_id'
                and wr_comment = '$tmp_comment' 
                and wr_is_comment = 1 ";
    $row = sql_fetch($sql);
    if ($row[cnt] && !$is_admin)
        alert("已有关联评论内容，不能进行删除操作");

    $sql_ip = "";
    if (!$is_admin)
        $sql_ip = " , wr_ip = '$_SERVER[REMOTE_ADDR]' ";

    $sql_secret = "";
    if ($wr_secret)
        $sql_secret = " , wr_option = '$wr_secret' ";

    $sql = " update $write_table
                set wr_subject = '$wr_subject',
                    wr_content = '$wr_content',
                    wr_1 = '$wr_1',
                    wr_2 = '$wr_2',
                    wr_3 = '$wr_3',
                    wr_4 = '$wr_4',
                    wr_5 = '$wr_5',
                    wr_6 = '$wr_6',
                    wr_7 = '$wr_7',
                    wr_8 = '$wr_8',
                    wr_9 = '$wr_9',
                    wr_10 = '$wr_10',
                    wr_option = '$wr_option'
                    $sql_ip
                    $sql_secret
              where wr_id = '$comment_id' ";
    sql_query($sql);
}

// 执行用户代码
@include_once("$board_skin_path/write_comment_update.skin.php");
@include_once("$board_skin_path/write_comment_update.tail.skin.php");

goto_url("./board.php?bo_table=$bo_table&wr_id=$wr[wr_parent]&page=$page" . $qstr . "&cwin=$cwin#c_{$comment_id}");
?>
