<?php


require "include/bittorrent.php";

dbconn();
loggedinorreturn();

if (get_user_class() < UC_SYSOP)
    stderr("Error", "Permission denied.");

$action = $_GET["action"];
// Delete News Item    //////////////////////////////////////////////////////
if ($action == 'delete') {
    $newsid = $_GET["newsid"];
    if (!is_valid_id($newsid))
        stderr("Error", "Ungültige News-ID - Code 1.");

    $returnto = $_GET["returnto"];

    $sure = $_GET["sure"];
    if (!$sure)
        stderr("News-Eintrag löschen", "Willst Du wirklich einen News-Eintrag löschen? Klicke\n" . "<a href=\"news.php?action=delete&newsid=$newsid&returnto=$returnto&sure=1\">hier</a>, wenn Du Dir sicher bist.");

    mysql_query("DELETE FROM news WHERE id=$newsid") or sqlerr(__FILE__, __LINE__);

    if ($returnto != "")
        header("Location: $returnto");
    else
        $warning = "Der News-Eintrag wurde erfolgreich gelöscht.";
} 
// Add News Item    /////////////////////////////////////////////////////////
if ($action == 'add') {
    $title = $_POST["title"];
    if (!$title)
        stderr("Fehler", "Der Titel darf nicht leer sein!");

    $body = $_POST["body"];
    if (!$body)
        stderr("Fehler", "Der Beitrag darf nicht leer sein!");

    $added = $_POST["added"];
    if (!$added)
        $added = sqlesc(get_date_time());

    mysql_query("INSERT INTO news (userid, added, title, body) VALUES (" . $CURUSER['id'] . ", $added, " . sqlesc(stripslashes($title)) . ", " . sqlesc(stripslashes($body)) . ")") or sqlerr(__FILE__, __LINE__);
    if (mysql_affected_rows() == 1)
        $warning = "News-Beitrag erfolgreich hinzugefügt.";
    else
        stderr("Fehler", "Gerade ist irgendetwas merkwürdiges passiert.");
} 
// Edit News Item    ////////////////////////////////////////////////////////
if ($action == 'edit') {
    $newsid = $_GET["newsid"];

    if (!is_valid_id($newsid))
        stderr("Fehler", "Ungültige News-ID - Code 2.");

    $res = mysql_query("SELECT * FROM news WHERE id=$newsid") or sqlerr(__FILE__, __LINE__);

    if (mysql_num_rows($res) != 1)
        stderr("Fehler", "Kein News-Eintrag mit der ID $newsid vorhanden.");

    $arr = mysql_fetch_array($res);

    if ($_SERVER['REQUEST_METHOD'] == 'POST') {
        $title = $_POST["title"];
        if (!$title)
            stderr("Fehler", "Der Titel darf nicht leer sein!");
    
        $body = $_POST['body'];
        if ($body == "")
            stderr("Fehler", "Der Beitrag darf nicht leer sein!");

        $title = sqlesc(stripslashes($title));
        $body = sqlesc(stripslashes($body));

        $editedat = sqlesc(get_date_time());

        mysql_query("UPDATE news SET title=$title,body=$body WHERE id=$newsid") or sqlerr(__FILE__, __LINE__);

        $returnto = $_POST['returnto'];

        if ($returnto != "")
            header("Location: $returnto");
        else
            $warning = "Der News-Beitrag wurde erfolgreich geändert.";
    } else {
        $returnto = $_GET['returnto'];
        stdhead();
        begin_frame("News-Beitrag bearbeiten", false, "600px;");
        if ($warning)
            print("<p><font size=-3>($warning)</font></p>");
        print("<form method=\"post\" name=\"newsedit\" action=\"news.php?action=edit&newsid=$newsid\"><input type=\"hidden\" name=\"returnto\" value=\"$returnto\">\n");
        begin_table("TRUE");
        print("<tr><td class=\"tableb\">Titel:</td><td class=\"tablea\"><input type=\"text\" name=\"title\" size=\"80\" maxlength=\"255\" value=\"". htmlspecialchars(stripslashes($arr["title"])) ."\"></td></tr>\n");
        print("<tr><td class=\"tableb\">Text:</td><td class=\"tablea\">\n");
        textbbcode("newsedit","body","". htmlspecialchars(stripslashes($arr["body"])) ."");
        print("(<b>HTML</b> ist nicht erlaubt)</td></tr>");
        print("<tr><td class=\"tableb\" colspan=\"2\"><div align=center><input type=submit value='Okay' class=btn></div></td></tr>\n");
        end_table();
        print("</form>\n");
        end_frame();
?>
<script type="text/javascript">
_editor_url = "/htmlarea/";
_editor_lang = "de";
</script>
<script type="text/javascript" src="/htmlarea/htmlarea.js"></script>
<script type="text/javascript">
HTMLArea.replace("newseditor")
</script>
<?php	
        stdfoot();
        die;
    } 
} 
// Other Actions and followup    ////////////////////////////////////////////
stdhead("Site news");
begin_frame("<img src=\"".$GLOBALS["PIC_BASE_URL"]."news_add.png\" width=\"22\" height=\"22\" alt=\"News hinzufügen\" title=\"News hinzufügen\" style=\"vertical-align: middle;border:none\"> Neuen News-Beitrag schreiben", false, "600px;");
if ($warning)
    print("<p><font size=-3>($warning)</font></p>");
print("<form method=\"post\" name=\"add\" action=\"news.php?action=add\">\n");
begin_table("TRUE");
print("<tr><td class=\"tableb\">Titel:</td><td class=\"tablea\"><input type=\"text\" name=\"title\"  size=\"80\" maxlength=\"255\"></td></tr>\n");
print("<tr><td class=\"tableb\">Text:</td><td class=\"tablea\">\n");
textbbcode("add","body","". htmlspecialchars(stripslashes($arr["body"])) .""); 
print("(<b>HTML</b> ist nicht erlaubt)</td></tr>");
print("<tr><td class=\"tableb\" colspan=\"2\"><div align=center><input type=submit value='Okay' class=btn></div></td></tr>\n");
end_table();
print("</form>\n");
?>
<script type="text/javascript">
_editor_url = "/htmlarea/";
_editor_lang = "de";
</script>
<script type="text/javascript" src="/htmlarea/htmlarea.js"></script>
<script type="text/javascript">
HTMLArea.replace("newseditor")
</script>
<?php	
end_frame();
////////////////////////////LCD Laufband by SoBe///////////////////////////////////
begin_frame("Neuen Laufband schreiben", false, "600px;");
print("<form method=\"post\" name=edit action=\"editindex.php\">");
 print("<table class=\"tableinborder\"  width=\"100%\" border=\"0\" cellspacing=\"1\" cellpadding=\"4\">");
 
 $res1 = mysql_query("SELECT * FROM home") or sqlerr(__FILE__, __LINE__);
 $row1 = mysql_fetch_assoc($res1);
 $id=$row1["id"];
 $index=htmlspecialchars($row1["text"]);
 print("<input type=\"hidden\" name=\"id\" value=\"$id\">\n");
 print("<tr><td align=center class=\"tablea\"><center><input type=\"text\" name=\"ititle\"  size=\"110\" value=\"$index\"></center></td></tr></table><br>\n");
 print("<div align=center><input type=submit value='Ändern' class=btn></div>\n");
end_frame();
////////////////////////////LCD Laufband by SoBe///////////////////////////////////
$res = mysql_query("SELECT * FROM news ORDER BY added DESC") or sqlerr(__FILE__, __LINE__);

if (mysql_num_rows($res) > 0) {
    begin_frame("News bearbeiten", false, "650px;");

    while ($arr = mysql_fetch_array($res)) {
        $newsid = $arr["id"];
        $title = htmlspecialchars($arr["title"]);
        $body = $arr["body"];
        $userid = $arr["userid"];
        $added = $arr["added"] . " (vor " . (get_elapsed_time(sql_timestamp_to_unix_timestamp($arr["added"]))) . ")";

        $res2 = mysql_query("SELECT username, donor FROM users WHERE id = $userid") or sqlerr(__FILE__, __LINE__);
        $arr2 = mysql_fetch_array($res2);

        $postername = $arr2["username"];

        if ($postername == "")
            $by = "unknown[$userid]";
        else
            $by = "<a href=userdetails.php?id=$userid><b>$postername</b></a>" .
            ($arr2["donor"] == "yes" ? "<img src=\"".$GLOBALS["PIC_BASE_URL"]."donor.png\" alt='Donor'>" : "");

        begin_table(TRUE);
        print("<tr><td class=tablecat>");
        print("<b>$title</b><br>");
        print("$added&nbsp;---&nbsp;by&nbsp$by");
        print(" - [<a href=?action=edit&newsid=$newsid><b>Ändern</b></a>]");
        print(" - [<a href=?action=delete&newsid=$newsid><b>Löschen</b></a>]");
        print("</td></tr>\n");
        print("<tr valign=top><td class=tablea>". format_comment($arr['body']) . "</td></tr>\n");
        end_table();
    } 
    end_frame();
} else
    stdmsg("Sorry", "No news available!");
stdfoot();
die;

?>