<?php


#############################################################################
#                              Site@School
# Site@School is a website management system designed for schools.
#
# About Site@School:
# Original Idea: Mark de Haan (mark@starwave.nl)
# PHP coding & Design: Mark de Haan (mark@starwave.nl)
# Comissioned by: Stadsdeel de Baarsjes, Amsterdam, Netherlands
############################################################################
# view_ads.php: coded by Fred Stuurman (fc.stuurman@hccnet.nl)
# last changed 14/02/2006  , version: 2.4
#$Id: view_ads.php,v 1.2 2006/10/15 19:08:54 fstuurman Exp $ 
############################################################################
#                        LICENSE INFORMATION
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
##############################################################################
if (!defined('IN_SAS'))
{
	die("Hacking attempt");
}

if (IsSet ($_GET['suboption']))
{
	$suboption = $_GET['suboption'];
}

if (IsSet ($_POST['name']))
{
	$name = sql_addslashes($_POST['name']);
	$name = htmlspecialchars(strip_tags($name)); //remove html tags
}

if (IsSet ($_POST['email']))
{
	$email = sql_addslashes($_POST['email']);
	$email = htmlspecialchars(strip_tags($email)); //remove html tags
}

if (IsSet ($_POST['message']))
{
	$message = sql_addslashes($_POST['message']);
	$message = htmlspecialchars(strip_tags($message)); //remove html tags
}

function address2text($address)
{
	// address2text -- convert email address to text; more difficult to harvest
	// Peter Fokker - 2004-03-13 - peter (at) berestijn (dot) nl ;-)
	$at = "at";
	$dot = "dot";
	return str_replace("@", " ($at) ", str_replace(".", " ($dot) ", $address));
} // address2text

function check_email($str)
{
	//returns 1 if valid email, 0 if not
	if (ereg("^.+@.+\\..+$", $str))
	{
		return 1;
	}
	else
	{
		return 0;
	}
}

load_language($cmsdir . '/', 'sn_ads'); //load language file

$query = "SELECT dbtables FROM $table_modules WHERE location='sn_ads'"; // getting the table names
$result = mysql_query($query) or die_script($query, mysql_error());
$moduletables = mysql_result($result, 0);
unset ($query);
unset ($result);
$moduletables = explode(",", $moduletables);
$table_adtext = "$moduletables[0]";

$date_format = $sas_config['dateformat'];

switch ($suboption) // start of switch
{
	default :
		$query = "SELECT ad_id, name, email, ad_text, UNIX_TIMESTAMP(date) FROM $table_adtext WHERE initial = 1 ORDER BY ad_id DESC";
		$result = mysql_query($query) or die_script($query, mysql_error());

		print $sas_config['ads_disclaimer'];
		print "<center><input type=\"button\" value=\"" . $sas_lang['ads_module_add'] . "\" 
				onClick=\"javascript:parent.location='index.php?section=$section&page=$page&suboption=add';\"></b></a></center><br>";

		while ($ad_list = mysql_fetch_array($result))
		{
			print "<center><table border=\"1\" cellpadding=\"0\" cellspacing=\"0\" style=\"border-collapse: collapse\" bordercolor=\"#00000\" width=\"550\"><tr><td>
						       <table width=\"100%\" border=\"0\">";
			$date1 = strftime($date_format, $ad_list[4]);
			print "<tr>
						              <td align=\"left\"><img src=\"$cmsdir/graphics/pin.gif\"></td>
						              <td align=\"right\"><b>" . $sas_lang['ads_date'] . "</b>$date1</td>
						       </tr>";
			print "<tr>
						              <td align=\"right\" width=\"65\"><b>" . $sas_lang['ads_module_name'] . "</b></td>
						              <td>$ad_list[1]
						              </td>
						       <tr>";
			print "<tr>
						              <td align=\"right\"><b>" . $sas_lang['ads_module_email'] . "</b></td>
						              <td>" . address2text($ad_list[2]) . "</td>
						       <tr>";
			$ad_text = str_replace("\n", "<br>", $ad_list[3]);
			print "<tr>
						              <td valign=\"top\" align=\"right\"><b>" . $sas_lang['ads_module_text'] . "</b></td>
						              <td>$ad_text
						              </td>
						       <tr>";
			print "</td></tr></table></table></center><br>";
		}
		break;

	case add :
		$welcometext = $sas_config['ads_welcome_text'];

		print "<TABLE align=\"center\" height=\"100\" cellspacing=\"0\" cellpadding=\"2\" id=\"dashed\" width=\"550\" border=\"0\">
				        <TR>
				        	<TD valign=\"top\">$welcometext
				        		<form name=\"mainform\" ACTION=\"index.php?section=$section&page=$page&suboption=save\" METHOD=\"post\">       
				        <br>
				        <TABLE cellspacing=\"0\" cellpadding=\"4\" border=\"0\">
				        <TR>
				        	<TD id=\"text\" valign=\"top\" width=\"110\" align=\"right\"><B>" . $sas_lang['ads_module_name'] . " (*)</B></TD>
				        	<TD><INPUT TYPE=\"text\" NAME=\"name\" id=\"input\" size=\"40\" value=\"$name\"></TD>
				        </TR>
				        <TR>
				        	<TD id=\"text\" valign=\"top\" align=\"right\"><B>" . $sas_lang['ads_module_email'] . " (*)</B></TD>
				        	<TD><INPUT TYPE=\"text\" NAME=\"email\" id=\"input\" size=\"40\" value=\"$email\"></TD>
				        </TR>
				        <TR>
				        	<TD id=\"text\" valign=\"top\" align=\"right\"><B>" . $sas_lang['ads_module_text'] . " (*)</B></TD>
				        	<TD><TEXTAREA NAME=\"message\" ROWS=\"6\" COLS=\"50\" id=\"input\">$message</TEXTAREA></TD>
				        </TR>
				        <TR><td>&nbsp;</td><TD>" . $sas_lang['required_fields'] . "</TD></TR>
				        </TABLE>
				        		<br>
				        		<center>
				        		<INPUT TYPE=\"submit\" id=\"input\" value=\"" . $sas_lang['save'] . "\">
				        		</center>		
				        		</form>
				        	</TD>
				        </TR>
				        </TABLE>";
		break;

	case save :
		$error = 0;
		if ($name == "")
		{
			print stripslashes($sas_lang['ads_module_noname']); //Error message when no name
			$error = 1;
		}
		elseif ((IsSet ($_POST['email'])) and (($email == "") or (check_email($email) == 0)))
		{
			print stripslashes($sas_lang['ads_module_noemail']); //Error message when no email
			$error = 1;
		}
		elseif ($message == "")
		{
			print stripslashes($sas_lang['ads_module_notext']); //Error message when no comment
			$error = 1;
		}

		if ($error == 0)
		{
			if (!get_magic_quotes_gpc()) //if magic quotes are off add slash
			{
				$message = addslashes($message);
			}

			//if($sas_config['ads_check_before_post'] == 1 ) 			//do we publish directly
			//{
			//$initial = 0 ;
			//}
			//else
			//{
			$initial = 1;
			//}
			mysql_query("INSERT INTO $table_adtext (ad_id, email, ad_text, date, name, initial) 
							VALUES (NULL, '$email', '$message', NOW(), '$name', '$initial')");
			mysql_query("DELETE from $table_adtext WHERE date < current_date() - INTERVAL $sas_config[ads_expiration_days] day"); //delete old entries
			// set the last update date for the page
			$date1 = date("Y-m-d H:i:s");
			mysql_query("UPDATE $table_pages SET lastupdate='$date1' WHERE id='$page'");

			if ($sas_config['ads_email'] != "")
			{
				$date1 = date("d-m-Y - H:i:s");
				$subject = "$sitename: " . $sas_lang['ads_module_added'];
				$message_to_sent = "<html><body>
														 <b><font size=4>" . $sas_lang['ads_module_mailtext'] . "&nbsp;" . $sitename . "</font></b><br>
														 <div style='margin-top:-320px'>
														 <table width=80%>
														 <tr>
														 <td width=10%>" . $sas_lang['ads_module_date'] . " </td>
														 <td><b>$date1</b></td>
														 </tr><tr>
														 <td>" . $sas_lang['ads_module_name'] . " </td>
														 <td><b>$name</b></td>
														 </tr><tr>
														 <td>" . $sas_lang['ads_module_email'] . " </td>
														 <td><b>$email</b></td>
														 </tr><tr>
														 <td valign=top>" . $sas_lang['ads_module_text'] . " </td>
														 <td><b>$message </b></td>
														 </tr><tr>
														 <td>IP:</td>
														 <td><b>$ip</b></td>
														 </tr></table>
														 </body></html>";
				$message_to_sent = stripslashes(nl2br($message_to_sent));
				require ("$cmsdir/core/class.phpmailer.php"); //use the phpmailer class
				$mail = new PHPMailer();
				$mail->From = $email; //email address of submitter
				$mail->FromName = $sitename;
				$mail->Subject = $subject;
				$mail->Body = $message_to_sent;
				$mail->IsHTML(true);
				$mail->AddAddress($sas_config['ads_email']); //add email address ads owner.
				$mail->Send();
			}
			echo "<script language='javascript'>window.location = 'index.php?section=$section&page=$page'</script>";
		}
		else
		{
			print "\n<p><form name=\"mainform\" ACTION=\"index.php?section=$section&page=$page&suboption=add\" METHOD=\"post\">\n";
			print "<input type=\"hidden\" name=\"name\" value=\"$name\">\n";
			print "<input type=\"hidden\" name=\"email\" value=\"$email\">\n";
			print "<input type=\"hidden\" name=\"message\" value=\"$message\">\n";
			print "<INPUT TYPE=\"submit\" value=\"" . $sas_lang['goback'] . "\"></form>\n";
		}
		break;
}
?>