<?
/*
=====================================================
 Volkov NET!! - by SaNcHeS Group 
-----------------------------------------------------
 http://AllForCS.RU/
-----------------------------------------------------
 Copyright (c) 2009 SaNcHeS Group
=====================================================
 Данный код защищен авторскими правами
=====================================================
 Файл: sms.php
-----------------------------------------------------
 Назначение: Отправка SMS
=====================================================
*/
print <<<vivod
<table align="center" cellpadding="0" cellspacing="0">
<tr>
<td width="600">
<p>
vivod;

if ($_GET['event']=='answer' and is_numeric($_GET['id'])){
if ($_POST['delme']){
@$sql=mysql_query("DELETE FROM `m3_sms`  WHERE `to` = '$username' AND `id` = '$_GET[id]';") or die(mysql_error());
@mysql_free_result($sql);
header("Location: sms.php");
exit;}

@$sql=mysql_query("SELECT * FROM `m3_sms` WHERE `to` = '$username' AND `id` = '$_GET[id]';") or die(mysql_error());
if ($sql && @mysql_num_rows($sql)>0){
while ($row = @mysql_fetch_array($sql, MYSQL_ASSOC)){
$msg=str_replace("<br>","\r\n",unsafe_str($row['message']));
$msg=" >".str_replace("\n"," >",$msg)."\n\n";

echo "<br><br><br>
<body onload='document.forms[0].mess.focus();'>
<form name='new_sms' action='sms.php?event=send' method='post'>
<table style='border-collapse:collapse;' align='center' cellpadding='0' cellspacing='0' width='400'>
                <tr>
                    <td width='47' nowrap>
                        <p align='left'>Кому:</p>
                    </td>
                    <td>
                            <p align='left'><input type='text' name='to' value='$row[from]' maxlength='15'> <b>[<a href=\"javascript:na_open_window('Users', 'sms.php?event=list', 150, 200, 220, 300, 0, 0, 0, 0, 0)\">Список</a>]</b></p>
                    </td>
                </tr>
                <tr>
                    <td width='47' height='25' nowrap>
                        <p>Тема:</p>
                    </td>
                    <td>
                            <p align='left'><input type='text' name='subj' value='Re: ".unsafe_str($row['subject'])."' maxlength='50' size='46'></p>
                    </td>
                </tr>
                <tr>
                    <td width='47' valign='top'>
                        <p>&nbsp;</p>
                    </td>
                    <td>
                            <p><textarea name='mess' rows='8' cols='66'>$msg</textarea></p>
                    </td>
                </tr>
                <tr>
                    <td width='47' height='25' valign='top'>
                        <p>&nbsp;</p>
                    </td>
                    <td>
                            <p align='right'><input type='reset' name='rezet' value='Сбросит'>
                            <input type='submit' name='send' value='Отправить'></p>
                    </td>
                </tr>
            </table>
</form>

";
}}

}

if ($_GET['event']=='view' and is_numeric($_GET['id'])){

@$sql=mysql_query("UPDATE `m3_sms` SET `read` = '1' WHERE `to` = '$username' AND `id` = '$_GET[id]';") or die(mysql_error());
@mysql_free_result($sql);
@$sql=mysql_query("SELECT * FROM `m3_sms` WHERE `to` = '$username' AND `id` = '$_GET[id]';") or die(mysql_error());
if ($sql && @mysql_num_rows($sql)>0){
while ($row = @mysql_fetch_array($sql, MYSQL_ASSOC)){

if ($row[subject] == ""){$row[subject]="без темы";}
print "<form name='inbox' action='sms.php?event=answer&id=$_GET[id]' method='post'>
<table bgcolor='#FFFCF9' style='border-collapse:collapse;' cellpadding='7' cellspacing='0' width='100%'><tr><td style='border-width:1; border-color:black; border-style:solid;'>
<p><b>От:</b>&nbsp;$row[from]<br>
<b>Тема:</b>&nbsp;".unsafe_str($row['subject'])."<br>
<b>Дата:</b>&nbsp;$row[date]</p>
</td></tr></table><br>
<table bgcolor='#FFFCF9' style='border-collapse:collapse;' cellpadding='7' cellspacing='0' width='100%'><tr><td style='border-width:1; border-color:black; border-style:solid;'>
<p>".unsafe_str($row['message'])."</p>
</td></tr></table>
<p align=right><input type='submit' name='delme' value='Удалить'> <input type='submit' name='answer' value='Ответить'></p>
</form>";

}}
}

if ($_GET['event']=='send' && $_POST['send']){

$n_to=safe_str($_POST['to']);
$n_subject=safe_str($_POST['subj']);
$n_date=date("d.m.Y");
$n_ip=$HTTP_SERVER_VARS["REMOTE_ADDR"];
$n_from=$username;
$n_mess=safe_str($_POST['mess']);
if (strlen($n_mess)<2){echo "<center>Сообщение слишком короткое.</center>";exit;}
if (strlen($n_mess)>10000){echo "<center>Сообщение слишком длинное.</center>";exit;}

@$sql=mysql_query("SELECT * FROM `m3_users` WHERE `login` = '$n_to' LIMIT 1;") or die (mysql_error());
if ($sql && @mysql_num_rows($sql)>0){
@$sender=mysql_query("INSERT INTO `m3_sms` (`to`, `from`, `date`, `ip`, `subject`, `message`) VALUES ('$n_to', '$n_from', '$n_date', '$n_ip', '$n_subject', '$n_mess');") or die (mysql_error());
echo "<center>Сообщение отправлено.</center>";
}else{
echo "<center>Пользователь с таким именем не найден.</center>";}
@mysql_free_result();
@mysql_close();
}

if ($_GET['event']=='new'){
if (isset($_GET['to']) && safe_login($_GET['to'])==1){$toto=$_GET['to'];}
print "<br><br><br>
<form name=\"new_sms\" action=\"sms.php?event=send\" method=\"post\">
<table style=\"border-collapse:collapse;\" align=\"center\" cellpadding=\"0\" cellspacing=\"0\" width=\"400\">
                <tr>
                    <td width=\"47\" nowrap>
                        <p align=\"left\">Кому:</p>
                    </td>
                    <td>
                            <p align=\"left\"><input type=\"text\" name=\"to\" value=\"$toto\" maxlength=\"15\"> <b>[<a href=\"javascript:na_open_window('Users', 'sms.php?event=list', 150, 200, 220, 300, 0, 0, 0, 0, 0)\">Список</a>]</b></p>
                    </td>
                </tr>
                <tr>
                    <td width=\"47\" height=\"25\" nowrap>
                        <p>Тема:</p>
                    </td>
                    <td>
                            <p align=\"left\"><input type=\"text\" name=\"subj\" maxlength=\"50\" size=\"46\"></p>
                    </td>
                </tr>
                <tr>
                    <td width=\"47\" valign=\"top\">
                        <p>&nbsp;</p>
                    </td>
                    <td>
                            <p><textarea name=\"mess\" rows=\"8\" cols=\"66\"></textarea></p>
                    </td>
                </tr>
                <tr>
                    <td width=\"47\" height=\"25\" valign=\"top\">
                        <p>&nbsp;</p>
                    </td>
                    <td>
                            <p align=\"right\"><input type=\"reset\" name=\"rezet\" value=\"Сбросит\">
                            <input type=\"submit\" name=\"send\" value=\"Отправить\"></p>
                    </td>
                </tr>
            </table>
</form>";


}

if ($_GET['event'] == 'delete' && $_POST['btn_del']){
for ($i=0; $i<count($_POST)-1; $i++) {
@mysql_query("DELETE FROM `m3_sms` WHERE `id` = '".pos($_POST)."' AND `to` = '$username';");
next($_POST);
}

@header("Location: sms.php");

}

if (!$_GET['event']){

print <<<vivod
<p style="border-collapse:collapse;" align="left"><b>[<a href="?event=new">Новое сообщение</a>]</b></p>
<form name="mass_del" action="sms.php?event=delete" method="post">
<table style="border-collapse:collapse;" align="center" cellpadding="0" cellspacing="0" width="100%">
<tr bgcolor="#DFDFDF">
<td width="25" nowrap style="border-width:1; border-color:rgb(51,51,51); border-style:solid;">
<p align="center"><b>№</b></p>
</td>
<td width="130" style="border-width:1; border-color:rgb(51,51,51); border-style:solid;">
<p align="left"><b>&nbsp;от</b></p>
</td>
<td style="border-width:1; border-color:rgb(51,51,51); border-style:solid;">
<p align="left"><b>&nbsp;тема письма</b></p>
</td>
<td width="85" style="border-width:1; border-color:rgb(51,51,51); border-style:solid;">
<p align="center"><b>дата</b></p>
</td>
<td width="30" style="border-width:1; border-color:rgb(51,51,51); border-style:solid;">
</td>
</tr>
vivod;

@$sql = @mysql_query("SELECT * FROM `m3_sms` WHERE `to` = '".$username."' ORDER BY `id` DESC;") or die (mysql_error());
if ($sql && @mysql_num_rows($sql)>0){
while ($row = @mysql_fetch_array($sql, MYSQL_ASSOC)){
$i++;
if ($row['subject'] == ""){$row['subject']="без темы";}
if ($row['read'] == 0){$color="red";}else{$color="";}
print"<tr bgcolor=\"#FEFDF5\">
<td width=\"25\" nowrap style=\"border-width:1; border-color:rgb(51,51,51); border-style:solid;\">
<p align=\"center\"><a href='?event=view&id=$row[id]'>$i</a></p>
</td>
<td width=\"130\" style=\"border-width:1; border-color:rgb(51,51,51); border-style:solid;\">
<p>&nbsp;$row[from]</p>
</td>
<td nowrap style=\"border-width:1; border-color:rgb(51,51,51); border-style:solid;\">
<p>&nbsp;<a href='?event=view&id=$row[id]'><font color=$color>".unsafe_str($row['subject'])."</font></a></p>
</td>
<td width=\"85\" style=\"border-width:1; border-color:rgb(51,51,51); border-style:solid;\">
<p align=\"center\">$row[date]</p>
</td>
<td width=\"30\" style=\"border-width:1; border-color:rgb(51,51,51); border-style:solid;\">
<p align=\"center\"><input type=\"checkbox\" value=\"$row[id]\" name=\"$row[id]\"></p>
</td>
</tr>";
}}else{
print <<<vivod
<tr bgcolor="#FEFDF5">
<td width="25" nowrap style="border-width:1; border-color:rgb(51,51,51); border-style:solid;">
<p align="center">x</p>
</td>
<td width="130" style="border-width:1; border-color:rgb(51,51,51); border-style:solid;">
<p>&nbsp;----------</p>
</td>
<td nowrap style="border-width:1; border-color:rgb(51,51,51); border-style:solid;">
<p>&nbsp;----------</a></p>
</td>
<td width="85" style="border-width:1; border-color:rgb(51,51,51); border-style:solid;">
<p align="center">xx.xx.xxxx</p>
</td>
<td width="30" style="border-width:1; border-color:rgb(51,51,51); border-style:solid;">
<p align="center"></p>
</td>
</tr>
vivod;
}

print <<<vivod
</table>
<p align="right"><input type="reset" name="rezet" value="Сбросить">
<input type="submit" name="btn_del" value="Удалить выбранные"></p>
</form>
vivod;



}

?>