<?php
/**
 * @version $Id: ajax.php v2.0 $
 * @package PBDigg
 * @copyright Copyright (C) 2007 - 2008 PBDigg.com. All Rights Reserved.
 * @license PBDigg is free software and use is subject to license terms
 */

define('PB_CSCRIPT', 'ajax');
require_once('include/common.inc.php');
require_once(PBDIGG_ROOT.'include/validate.func.php');
require_once(PBDIGG_ROOT.'data/cache/cache_reg.php');
$response = array('0','');

if ($type && ($_PBDEV['CK_HASH'] == $verifyhash))
{
	switch ($type)
	{
		case 'ckusername':
			$username = addslashes(convert_encoding('UTF-8', $db_charset, trim($_GET['username'])));
			$namelen = strlen($username);
			if (($namelen < $reg_minname) || ($namelen > $reg_maxname))
			{
				$response[1] = $u_message['username_length_error'];
				break;
			}
			$fc = array ("\\","&","'","\"","/","*",",","<",">","\r","\t","\n","#","$","(",")","%","@","+","?",";","^"," ");
			foreach ($fc as $value)
			{
				if (strpos($username, $value) !== FALSE)
				{
					$response[1] = $u_message['u_fchar_exist'];
					break 2;
				}
			}
			$banwords = explode(',', $reg_bannames);
			if ($reg_bannames)
			{
				foreach ($banwords as $value)
				{
					if (strpos($username, $value) !== FALSE)
					{
						$response[1] = $u_message['u_banword_exist'];
						break 2;
					}
				}
			}
			$rs = $DB->db_fetch_one_array("SELECT COUNT(*) num FROM {$db_prefix}members WHERE username = '".$username."'");
			if ($rs['num'])
			{
				$response[1] = $u_message['username_exist'];
				break;
			}
			$response[0] = '1';
			break;
		case 'ckemail':
			$email = trim($_GET['email']);
			if (!isEMAIL($email))
			{
				$response[1] = $u_message['email_format_error'];
				break;
			}
			$rs = $DB->db_fetch_one_array("SELECT COUNT(*) num FROM {$db_prefix}members WHERE email = '$email'");
			if ($rs['num'])
			{
				$response[1] = $u_message['email_exist'];
				break;
			}
			$response[0] = '1';
			break;
		case 'ckcaptcha':
			if (ckgdcode($captcha))
			{
				$response[0] = '1';
			}
			else
			{
				$response[1] = $u_message['checkcode_error'];
			}
			break;
		case 'comment':
			if ($pb_reposttime)
			{
				$pb_lastcomment = gCookie('pb_lastcomment');
				if ($pb_lastcomment)
				{
					$seperateTime = $timestamp - $pb_lastcomment;
				}
				else
				{
					$seperateTime = 31536000;
				}
				if ($seperateTime < $pb_reposttime)
				{
					$response[1] = $u_message['refresh_limit'];
					break;
				}
				sCookie('pb_lastcomment', $timestamp, 1);
			}
			$comment = trim(stripslashes($_POST['comment']));
			$tid = intval($tid);
			if (empty($tid))
			{
				$response[1] = $u_message['illegal_tid'];
				break;
			}
			$allowcomment = $allowcomment && ($pb_ifcomment || $customer['adminid'] == '1');
			if (!$allowcomment)
			{
				$response[1] = $u_message['comment_nopermission'];
				break;
			}
			$comment = addslashes(convert_encoding('UTF-8', $db_charset, $comment));
			$comment = ($allowhtml) ? SafeConvert($comment) : HConvert($comment);
			if ($ck = checkComment($comment))
			{
				$response[1] = $ck;
				break;
			}
			if ($pb_gdcheck['comment'] && !ckgdcode($captcha))
			{
				$response[1] = $u_message['checkcode_error'];
				break;
			}
			$rs = $DB->db_fetch_one_array("SELECT t.cid, ti.iflock FROM {$db_prefix}threads t LEFT JOIN {$db_prefix}tinfo ti USING (tid) WHERE t.tid = $tid");
			if (!$rs || $rs['iflock'] || !array_key_exists($rs['cid'], $categories) || (!$allowsort && !$categories[$rs['cid']]['status']))
			{
				$response[1] = $u_message['thread_action_failed'];
				break;
			}
			@require(PBDIGG_ROOT.'data/cache/cache_singlecate_'.$rs['cid'].'.php');
			$cid = $singlecate['parcids'].$rs['cid'];
			$pb_creditdb = explode("\t", $pb_creditdb);
			$ifcheck = (($pb_tcheck && !$customer['adminid']) || ($pb_anonnews && !$customer['uid'])) ? 0 : 1;
			$SQL = "INSERT INTO {$db_prefix}comments (cid, tid, author, uid, content, ifcheck, postdate, postip, digg, diggdate, bury, burydate) 
					VALUES (".$rs['cid'].", $tid, '".$customer['username']."', '".$customer['uid']."', '$comment', $ifcheck, '$timestamp', '".$_PBDEV['PB_IP']."', 0, 0, 0, 0)";
			$DB->db_query($SQL);
			$rid = $DB->db_insertID();
			if ($customer['uid'])
			{
				$SQL = "UPDATE {$db_prefix}memberdata m, {$db_prefix}threads t, {$db_prefix}categories c 
						SET m.commentnum = m.commentnum + 1, m.lastcomment = '$timestamp', m.currency = m.currency + " . $pb_creditdb[1] .", t.comments = t.comments + 1, commentdate = '$timestamp', c.cnum = c.cnum + 1 
						WHERE t.tid = '$tid' 
						AND c.cid IN ($cid) 
						AND m.uid = '".$customer['uid']."'";
				$DB->db_query($SQL);
			}
			else
			{
				$SQL = "UPDATE {$db_prefix}threads t, {$db_prefix}categories c 
						SET t.comments = t.comments + 1, c.cnum = c.cnum + 1, t.commentdate = '$timestamp' 
						WHERE t.tid = '$tid' 
						AND c.cid IN ($cid)";
				$DB->db_query($SQL);
			}
			$DB->db_query('UPDATE '.$db_prefix.'sitestat SET comnum = comnum + 1 WHERE id = 1');
			if ($ifcheck)
			{
				$response[0] = '1-1';
				$response[1] = $u_message['comment_success'];
				$content = '<div id="comment_'.$rid.'" class="comment_body"><div id="comment_head_'.$rid.'" class="comment_head"><div class="comment_digg">' .
						'<span onclick="checkAction(\''.$_PBENV['PB_URL'].'manage.php?action=del&amp;type=comment&amp;rid='.$rid.'\',\''.$ui_message['del'].'\')" class="altspan">['.$ui_message['del'].']</span>' .
						'<span onclick="editcomment(\''.$rid.'\')" class="altspan">['.$ui_message['edit'].']</span>';
				if ($customer['adminid'])
				{
					$content .= '<span onclick="checkAction(\''.$_PBENV['PB_URL'].'manage.php?action=lock&amp;type=comment&amp;rid='.$rid.'&amp;tid='.$tid.'\',\''.$ui_message['lock'].'\')" class="altspan">['.$ui_message['lock'].']</span>';
				}
				$content .= '<span id="comment_digg_'.$rid.'">0</span>&nbsp;';
				if ($allowdigg)
				{
					$content .= '<a href="javascript:void(0);" onclick="digg(\''.$rid.'\', \'comment\', \'digg\')" id="comment_digg_do_'.$rid.'">['.$ui_message['digg'].']</a>&nbsp;';
				}
				else
				{
					$content .= '<a href="'.$_PBENV['PB_URL'].'login.php">['.$ui_message['digg'].']</a>&nbsp;';
				}
				$content .= '<span id="comment_bury_'.$rid.'">0</span>&nbsp;';
				if ($allowbury)
				{
					$content .= '<a href="javascript:void(0);" onclick="digg(\''.$rid.'\', \'comment\', \'bury\')" id="comment_bury_do_'.$rid.'">['.$ui_message['bury'].']</a>&nbsp;';
				}
				else
				{
					$content .= '<a href="'.$_PBENV['PB_URL'].'login.php">['.$ui_message['bury'].']</a>&nbsp;';
				}
				if ($allowcomment)
				{
					$content .= '<span onclick="recomment(\''.$rid.'\',\''.$customer['username'].'\')" class="altspan">['.$ui_message['quote'].']</span>';
				}
				if (!$customer['username'])
				{
					if ($pb_anonnick)
					{
						$customer['username'] = $pb_anonnick;
					}
					else
					{
						$customer['username'] = $pb_sitename.$u_message['net_friend'];
					}
				}
				$postdate = formatPostTime($timestamp);
				$content .= '</div><div class="comment_userimg"><strong><a href="'.$customer['uurl'].'">'.$customer['username'].'</a></strong>&nbsp;'.$ui_message['postby'].' '.$postdate.
						'</div></div><div class="comment_user_img"><img src="'.$customer['avatar'].'" alt="'.$customer['username'].'" class="small_user_avatar" />&nbsp;</div><div id="comment_content_'.$rid.'" class="comment_content">'.$comment.'</div></div>';
				require_once(PBDIGG_ROOT.'include/ubb.func.php');
				$content = preg_replace('/(?:\r\n|\n\r|\r|\n)/i', '<br />', UBB2HTML($content, 'comment'));
				$response[2] = convert_encoding($db_charset, 'UTF-8', $content);
			}
			else
			{
				$response[0] = '1-0';
				$response[1] = $u_message['comment_ready_check'];
				$response[2] = '';
			}
			clearcache('show', $tid, TRUE);
			sCookie('pb_lastcomment', $timestamp);
			break;
		case 'digg':
			if (!$pb_ifdigg)
			{
				$response[1] = $u_message['digg_closed'];
				break;
			}
			$id = intval($id);
			$pb_creditdb = explode("\t", $pb_creditdb);
			if ($customer['uid'])
			{
				$tdigg = $customer['tdigg'];
				$cdigg = $customer['cdigg'];
			}
			else
			{
				if ($pbdcookie = gCookie('pb_digg'))
				{
					list($tdigg, $cdigg) = explode('|', $pbdcookie);
				}
			}
			if ($action == 'article')
			{
				$db_table = 'threads';
				$diggcredit = $pb_creditdb[4];
				$SQL = "SELECT cid, tid, digg, ifcheck 
						FROM {$db_prefix}threads 
						WHERE tid = '$id'";
				$rs = $DB->db_fetch_one_array($SQL);
				if ($rs && $rs['ifcheck'] && (strpos($tdigg, $rs['tid']) === FALSE) && ($allowsort || $categories[$rs['cid']]['status']))
				{
					$DB->db_query("UPDATE {$db_prefix}threads SET digg = digg + 1, diggdate = $timestamp WHERE tid = $id");
				}
				else
				{
					$response[1] = $u_message['digg_failed'];
					break;
				}
				if ($customer['uid'])
				{
					strlen($tdigg) > 2000 && $tdigg = '';
					$tdigg .= ','.$id;
					$DB->db_query("UPDATE {$db_prefix}memberdata SET diggnum = diggnum + 1, tdigg = '".$tdigg."', currency = currency + $diggcredit WHERE uid = ".$customer['uid']);
					$DB->db_query("INSERT INTO {$db_prefix}tdata (cid, tid, uid, type) VALUES(".$rs['cid'].", ".$rs['tid'].", ".$customer['uid'].", 'digg')");
				}
				else
				{
					sCookie('pb_digg', $tdigg.','.$id.'|'.$cdigg, 86400);
				}
				$response[0] = '1';
				$response[1] = $u_message['digg_success'];
				$response[2] = $rs['digg'] + 1;
				break;
			}
			else
			{
				$db_table = 'comments';
				$diggcredit = $pb_creditdb[5];
				$SQL = "SELECT c.rid, c.cid, c.tid, c.digg, c.ifcheck cifcheck, t.ifcheck tifcheck 
						FROM {$db_prefix}comments c, {$db_prefix}threads t 
						WHERE c.rid = $id 
						AND c.tid = t.tid";
				$rs = $DB->db_fetch_one_array($SQL);
				if ($rs && $rs['cifcheck'] && $rs['tifcheck'] && (strpos($cdigg, $rs['rid']) === FALSE) && ($allowsort || $categories[$rs['cid']]['status']))
				{
					$DB->db_query("UPDATE {$db_prefix}comments SET digg = digg + 1, diggdate = $timestamp WHERE rid = $id");
				}
				else
				{
					$response[1] = $u_message['digg_failed'];
					break;
				}
				if ($customer['uid'])
				{
					strlen($cdigg) > 2000 && $cdigg = '';
					$cdigg .= ','.$id;
					$DB->db_query("UPDATE {$db_prefix}memberdata SET diggnum = diggnum + 1, cdigg = '".$cdigg."', currency = currency + $diggcredit WHERE uid = ".$customer['uid']);
					$DB->db_query("INSERT INTO {$db_prefix}cdata (cid, tid, rid, uid, type) VALUES(".$rs['cid'].", ".$rs['tid'].", ".$rs['rid'].", ".$customer['uid'].", 'digg')");
				}
				else
				{
					sCookie('pb_digg', $tdigg.'|'.$cdigg.','.$id, 86400);
				}
				$response[0] = '1';
				$response[1] = $u_message['digg_success'];
				$response[2] = $rs['digg'] + 1;
			}
			break;
		case 'bury':
			if (!$pb_ifbury)
			{
				$response[1] = $u_message['bury_closed'];
				break;
			}
			$id = intval($id);
			$pb_creditdb = explode("\t", $pb_creditdb);
			if ($customer['uid'])
			{
				$tbury = $customer['tbury'];
				$cbury = $customer['cbury'];
			}
			else
			{
				if ($pbdcookie = gCookie('pb_bury'))
				{
					list($tbury, $cbury) = explode('|', $pbbcookie);
				}
			}
			if ($action == 'article')
			{
				$db_table = 'threads';
				$diggcredit = $pb_creditdb[6];
				$SQL = "SELECT cid, tid, bury, ifcheck 
						FROM {$db_prefix}threads 
						WHERE tid = '$id'";
				$rs = $DB->db_fetch_one_array($SQL);
				if ($rs && $rs['ifcheck'] && (strpos($tbury, $rs['tid']) === FALSE) && ($allowsort || $categories[$rs['cid']]['status']))
				{
					$DB->db_query("UPDATE {$db_prefix}threads SET bury = bury + 1, burydate = $timestamp WHERE tid = $id");
				}
				else
				{
					$response[1] = $u_message['bury_failed'];
					break;
				}
				if ($customer['uid'])
				{
					strlen($tbury) > 2000 && $tbury = '';
					$tbury .= ','.$id;
					$DB->db_query("UPDATE {$db_prefix}memberdata SET burynum = burynum + 1, tbury = '".$tbury."', currency = currency + $diggcredit WHERE uid = ".$customer['uid']);
					$DB->db_query("INSERT INTO {$db_prefix}tdata (cid, tid, uid, type) VALUES(".$rs['cid'].", ".$rs['tid'].", ".$customer['uid'].", 'bury')");
				}
				else
				{
					sCookie('pb_bury', $tbury.','.$id.'|'.$cbury, 86400);
				}
				$response[0] = '1';
				$response[1] = $u_message['bury_success'];
				$response[2] = $rs['bury'] + 1;
				break;
			}
			else
			{
				$db_table = 'comments';
				$diggcredit = $pb_creditdb[7];
				$SQL = "SELECT c.rid, c.cid, c.tid, c.bury, c.ifcheck cifcheck, t.ifcheck tifcheck 
						FROM {$db_prefix}comments c, {$db_prefix}threads t 
						WHERE c.rid = $id 
						AND c.tid = t.tid";
				$rs = $DB->db_fetch_one_array($SQL);
				if ($rs && $rs['cifcheck'] && $rs['tifcheck'] && (strpos($cbury, $rs['rid']) === FALSE) && ($allowsort || $categories[$rs['cid']]['status']))
				{
					$DB->db_query("UPDATE {$db_prefix}comments SET bury = bury + 1, burydate = $timestamp WHERE rid = $id");
				}
				else
				{
					$response[1] = $u_message['bury_failed'];
					break;
				}
				if ($customer['uid'])
				{
					strlen($cbury) > 2000 && $cbury = '';
					$cbury .= ','.$id;
					$DB->db_query("UPDATE {$db_prefix}memberdata SET burynum = burynum + 1, cbury = '".$cbury."', currency = currency + $diggcredit WHERE uid = ".$customer['uid']);
					$DB->db_query("INSERT INTO {$db_prefix}cdata (cid, tid, rid, uid, type) VALUES(".$rs['cid'].", ".$rs['tid'].", ".$rs['rid'].", ".$customer['uid'].", 'bury')");
				}
				else
				{
					sCookie('pb_bury', $tbury.'|'.$cbury.','.$id, 86400);
				}
				$response[0] = '1';
				$response[1] = $u_message['bury_success'];
				$response[2] = $rs['bury'] + 1;
			}
			break;

		case 'editcomment':
			$rid = intval($rid);
			$editcomment = $DB->db_fetch_one_array('SELECT rid, cid, tid, uid, content, ifcheck FROM '.$db_prefix.'comments WHERE rid = '.$rid);
			if ($editcomment && ($alloweditatc || ($editcomment['uid'] == $customer['uid'] && $customer['uid'] != '0')))
			{
				$response[0] = '1';
				$response[1] = $editcomment['content'];
			}
			else
			{
				$response[1] = $u_message['comment_action_error'];
			}
			break;
		case 'sendeditcomment':
			$comment = trim(stripslashes($_POST['comment']));
			$rid = intval($rid);
			$SQL = 'SELECT uid, content 
					FROM '.$db_prefix.'comments 
					WHERE rid = '.$rid;
			$editcomment = $DB->db_fetch_one_array($SQL);
			if ($editcomment && ($alloweditatc || ($editcomment['uid'] == $customer['uid'] && $customer['uid'] != '0')))
			{
				$comment = addslashes(convert_encoding('UTF-8', $db_charset, $comment));
				$comment = ($allowhtml) ? SafeConvert($comment) : HConvert($comment);
				if ($ck = checkComment($comment))
				{
					$response[1] = $ck;
					break;
				}
				if (stripslashes($comment) == $editcomment['content'])
				{
					$response[0] = '1';
					$response[1] = $u_message['comment_edit_success'];
					$response[2] = convert_encoding($db_charset, 'UTF-8', UBB2HTML($comment, 'comment'));
					break;
				}
				$DB->db_query("UPDATE {$db_prefix}comments SET content = '$comment' WHERE rid = $rid");
				$response[0] = '1';
				$response[1] = $u_message['comment_edit_success'];
				require_once(PBDIGG_ROOT.'include/ubb.func.php');
				$response[2] = convert_encoding($db_charset, 'UTF-8', UBB2HTML($comment, 'comment'));
			}
			else
			{
				$response[1] = $u_message['comment_action_error'];
			}
			break;
		default:
			$response[1] = $u_message['parameter_error'];
			break;
	}
}
$response[1] = convert_encoding($db_charset, 'UTF-8', $response[1]);

if (function_exists('json_encode'))
{
	$response = json_encode($response);
}
else
{
   require_once(PBDIGG_ROOT.'include/json.class.php');
   $json = new Services_JSON;
   $response = $json->encode($response);
}
echo $response;
exit;
?>
