<?

require_once("include/bittorrent.php");
dbconn(false);

loggedinorreturn();

if ($CURUSER) {
        $ss_a = @mysql_fetch_assoc(@mysql_query("SELECT `uri` FROM `stylesheets` WHERE `id`=" . $CURUSER["stylesheet"]));
        if ($ss_a) $GLOBALS["ss_uri"] = $ss_a["uri"];
    }

    if (!$GLOBALS["ss_uri"]) {
        ($r = mysql_query("SELECT `uri` FROM `stylesheets` WHERE `default`='yes'")) or die(mysql_error());
        ($a = mysql_fetch_assoc($r)) or die(mysql_error());
        $GLOBALS["ss_uri"] = $a["uri"];
        }
		
if ($CURUSER["shoutboxpos"] == 'no')
stderr("Sorry...", "You are not authorized to post in the shoutbox.  (<a href=\"inbox.php#up\">Read Your Inbox</a>)");

if (isset($_GET['del']))
{
if (is_numeric($_GET['del']))
{
$query = "SELECT * FROM shoutbox WHERE id=".$_GET['del'];
$result = mysql_query($query);
}
else {
echo "<center>Invalid message ID</center>";
exit;}

$row = mysql_fetch_row($result);

if ( (get_user_class() >= UC_MODERATOR) )
{
$query = "DELETE FROM shoutbox WHERE id=".$_GET['del'];
mysql_query($query);
}
}
//deleting messages

if (isset($_GET['del']))
{
if (is_numeric($_GET['del']))
{
$query = "SELECT * FROM shoutbox WHERE id=".$_GET['del'];
$result = mysql_query($query);
}
else {echo "invalid msg id STOP TRYING TO INJECT SQL TIT HEAD";exit;
}

$row = mysql_fetch_row($result);

if ( (get_user_class() >= UC_MODERATOR) )
{
$query = "DELETE FROM shoutbox WHERE id=".$_GET['del'];
mysql_query($query);
}
}
// EDIT SHOUT ?
if (isset($_GET['edit']) && get_user_class() >= UC_MODERATOR && is_valid_id($_GET['edit']))
{	
	$sql=sql_query("SELECT id,text FROM shoutbox2 WHERE id=".sqlesc($_GET['edit']));
	$res=mysql_fetch_array($sql);
	?>
	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
	<html xmlns="http://www.w3.org/1999/xhtml">
	<meta http-equiv="Pragma" content="no-cache">
	<meta http-equiv="expires" content="0">
	<head profile="http://gmpg.org/xfn/11">
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<style type="text/css">
	#specialbox{
	border: 1px solid gray;
	width: 600px;
	background: #FBFCFA;
	font: 11px verdana, sans-serif;
	color: #443;
	padding: 3px;	outline: none;
	}

	#specialbox:focus{
	border: 1px solid black;
	}
	.btn {
	cursor:pointer;
	border:outset 1px #ccc;
	background:#999;
	color:#666;
	font-weight:bold;
	padding: 1px 2px;
	background:url(pic/formbg.gif) repeat-x left top;
	}	
	</style>
	</head>
	<body bgcolor=#F5F4EA>
	<?php
	echo '<form method=post action=shoutbox.php>';
	echo '<input type=hidden name=id value='.(int)$res['id'].'>';
	echo '<textarea name=text rows=3 id=specialbox>'.htmlspecialchars($res['text']).'</textarea>';
	echo '<input type=submit name=save value=save class=btn>';
	echo '</form></body></html>';
	die;
}
// UPDATE SHOUT?
if (isset($_POST['text']) && get_user_class() >= UC_MODERATOR && is_valid_id($_POST['id']))
{
	$text = trim($_POST['text']);
	$id = (int)$_POST['id'];
	if (isset($text) && isset($id) && is_valid_id($id))
		sql_query("UPDATE shoutbox SET text = ".sqlesc($text)." WHERE id=".sqlesc($id));
}

?>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"></head><body topmargin="0" leftmargin="0" background="http://the-darksides.ath.cx/Baiken.jpg">

<html><head>
<title>Wemmser Box</title>
<META HTTP-EQUIV=REFRESH CONTENT="60; URL=shoutbox.php">
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<style type="text/css">

A {color: #FF0000; font-weight: bold; }
A:hover {color: #FFFFFF ;}

switch ($CURUSER["bgshout"])
{
  case "1" : $background = "1.jpg";
             break;
  case "2" : $background = "2.jpg";
             break;
  case "3" : $background = "3.jpg";
             break;
  case "4" : $background = "4.jpg";
             break;
  case "5" : $background = "5.jpg";
             break;
  case "6" : $background = "6.jpg";
             break;
  case "7" : $background = "7.jpg";
             break;
}

.small {background-attachment: fixed; background-image: url(http://i279.photobucket.com/albums/kk135/sakulnipon/lucifer.jpg); font-size: 11pt;font-weight: bold; font-family: Microsoft Sans Serif;color: #999999 ; }
.date {font-size: 8pt;color: #CCCCCC  ;}
</style>

<STYLE>
BODY {
SCROLLBAR-3DLIGHT-COLOR: #0000FF  ;
SCROLLBAR-ARROW-COLOR: #0000FF  ;
SCROLLBAR-DARKSHADOW-COLOR: white;
SCROLLBAR-BASE-COLOR: white;
}
</STYLE>

<html><head>
<title>Shoutbox</title>
<meta http-equiv="refresh" content="30; url=shoutbox.php">
<link rel="stylesheet" href="<?=$GLOBALS["PIC_BASE_URL"] . $GLOBALS["ss_uri"] . "/" . $GLOBALS["ss_uri"]?>.css" type="text/css">
</head>

<body>
<!--<body bgcolor=#FF0000  >--!>

<?



if ($CURUSER["shoutpost"] != "yes")
{
         stdmsg("Sorry...", "Es ist Dir nicht gestattet, in der Shoutbox zu posten!");
         stdfoot();
         exit;
}
if($_GET["sent"]=="yes")
{

$userid=$CURUSER["id"];
$username=$CURUSER["username"];
$date=time();
$text=trim($_GET["shbox_text"]);
$r = @mysql_query("SELECT * FROM users WHERE id=$CURUSER[id]");
$user = mysql_fetch_array($r);

if ($user["shoutanfang"] != "")
$text= "".$user[shoutanfang] . sqlesc($text) . $user[shoutende]."";

mysql_query("INSERT INTO shoutbox (id, userid, username, date, text) VALUES ('id'," . sqlesc($userid) . ", " . sqlesc($username) . ", $date, " . sqlesc($text) . ")") or sqlerr(__FILE__, __LINE__);
}

$res = mysql_query("SELECT * FROM shoutbox ORDER BY date DESC LIMIT 70") or sqlerr(__FILE__, __LINE__);
if (mysql_num_rows($res) == 0)
print("\n");
else
{
print("<table border=0 cellspacing=0 cellpadding=2 width='100%' align='left' class='small'>\n");

while ($arr = mysql_fetch_assoc($res))
{
$res2 = mysql_query("SELECT username,class,avatar,donor,title,enabled,warned FROM users WHERE id=$arr[userid]") or sqlerr(__FILE__, __LINE__);
$arr2 = mysql_fetch_assoc($res2);




if (get_user_class() >= UC_MODERATOR) {
$del="[<a href=/shoutbox.php?del=".$arr[id].">Lö.</a>]";
$pm = "<span class='date'>[<a target=_blank href=messages.php?action=send&receiver=$arr[userid]>pm</a>]</span>\n";

}

print("<tr><td><a href='userdetails.php?id=".$arr["userid"]."' target='_top'><font class=" .get_class_color($arr2["class"]) . ">" . $arr["username"] . "</font></a> <span class='date'>(".strftime("%d.%m. %H:%M",$arr["date"]).")</span>: ".format_comment($arr["text"])." $del</td></tr>\n");

}

print("</table>");

}

?>
<body background="<?=$background?>"> 
</body>
</html>