<?
/*
=====================================================
 Volkov NET!! - by SaNcHeS Group 
-----------------------------------------------------
 http://AllForCS.RU/
-----------------------------------------------------
 Copyright (c) 2009 SaNcHeS Group
=====================================================
 Данный код защищен авторскими правами
=====================================================
 Файл: sms.php
-----------------------------------------------------
 Назначение: Коментарии
=====================================================
*/
@include "./inc/config.php";
@include "./m3_admin/passwd.php";
@include("./inc/ban.php");
$wow=0;
@$username = $_COOKIE['USR'];
@$password = $_COOKIE['PWD'];
if ($username == "0" or $username == ""){$username="ass";}  /* на случай отказа массива */
$in = array_search($password, $Users);
if (empty($password) or ($in != $username)){$wow=0;}else{$wow=1;}
echo $JS_POPUP;
?>
<link rel="stylesheet" href="inc/comments.css" type="text/css">
<?
$sql_id_mp3=(int)$_GET['id'];

if ($wow == 1){
if ($_GET['del']){
@$sql_id_mp3=(int)$_GET['id_mp3'];
$m_id=(int)$_GET['del'];
@mysql_query("DELETE FROM `m3_comments` WHERE `id` = '".$m_id."' LIMIT 1;") or die (mysql_error());
print "<meta http-equiv=\"refresh\" content=\"2;url=comments.php?id=$sql_id_mp3><br><br><br><br><center>Запись удалена!</center></body></html>";
@mysql_free_result();
@mysql_close();
exit;}


if ($_GET['edit']){
@$sql_id_mp3=(int)$_GET['id_mp3'];
$m_id=(int)$_GET['edit'];
@$leet = @mysql_query("SELECT * FROM `m3_comments` WHERE `id` = '".$m_id."' LIMIT 1;") or die (mysql_error());
if ($leet && @mysql_num_rows($leet)>0){
while ($row = mysql_fetch_array($leet, MYSQL_ASSOC))
{
$add_nick=$row['nick'];
$add_mail=$row['mail'];
$add_icq=$row['icq'];
$add_text=unsafe_str($row['text']);
$add_ip=$row['ip'];

}}

echo "<form name='guest_form' action='comments.php?do=ok&event=edit&id_mp3=$sql_id_mp3' method='post'>
<p class='mb'>
<table cellpadding='0' cellspacing='0' style='mb'>
<tr>
<td nowrap width='35'>
<p align='right'>Nick:</p>
</td>
<td width='4'>
<p>&nbsp;</p>
</td>
<td nowrap>
<p><input type='text' name='g_nick' value='$add_nick' maxlength='20'></p>
</td>
<td nowrap width='10' rowspan='3'>
<p>&nbsp;</p>
</td>
<td nowrap rowspan='4'>
<p align='right'><textarea name='g_text' rows='4' cols='41'>$add_text</textarea>
<p align='right'><input type='reset' name='rezet' value='Сброс'> &nbsp;<input type='submit' name='ok' value='Изменить!'></p>

</td>
</tr>
<tr>
<td nowrap width='35'>
<p align='right'>Mail:</p>
</td>
<td width='4'>
<p>&nbsp;</p>
</td>
<td nowrap>
<p><input type='text' name='g_mail' value='$add_mail' maxlength='25'></p>
</td>
</tr>
<tr>
<td nowrap width='35'>
<p align='right'>ICQ:</p>
</td>
<td width='4'>
<p>&nbsp;</p>
</td>
<td nowrap>
<p><input type='text' name='g_icq' value='$add_icq' maxlength='9'></p>
</td>
</tr>
<tr>
<td nowrap width='35'>
<p align='right'>IP:</p><br>
</td>
<td width='4'>
<p>&nbsp;</p>
</td>
<td nowrap>
<p><input type='text' name='g_ip' value='$add_ip' maxlength='15'></p><br>
</td>
</tr>
</table>
<input type='hidden' name='g_id' value='$m_id' >
<input type='hidden' name='m3_id' value='$sql_id_mp3' >
</form>";

@mysql_free_result();
@mysql_close();
exit;}
}

if (($_GET['do']=="ok")){

$add_nick=substr(safe_str($_POST['g_nick']),0,20);
$add_mail=substr(safe_str($_POST['g_mail']),0,25);
$add_icq=substr(safe_str($_POST['g_icq']),0,10);
$add_date=date("d.m.Y");
$add_text = substr($add_text, 0, 1257);
$add_text=safe_str($_POST['g_text']);
long_detector($add_text, 35);
if (isset($_POST['g_ip'])){$add_ip=$_POST['g_ip'];}else{
$add_ip=$HTTP_SERVER_VARS["REMOTE_ADDR"];}

if ($add_nick == ""){$no=1;}
if ($add_mail != ""){if ((strrpos($add_mail,' ') > 0) || (!eregi("^[_\.0-9a-z-]+@([0-9a-z][0-9a-z-]+\.)+[a-z]{2,3}$",$add_mail))){$no=1;}}
if ($show_icq != ""){if (!is_numeric($add_icq)){$no=1;}}
if ($add_text == ""){$no=1;}
if (strstr($add_text, "не качает")){$no=1;}


if (($_GET['event'] == 'edit') AND ($wow==1))
{
$add_m3_id=(int)$_POST['m3_id'];
$add_id=(int)$_POST['g_id'];
$dobavim = "UPDATE `m3_comments` SET `nick` = '$add_nick', `mail` = '$add_mail', `icq` = '$add_icq', `text` = '$add_text', `ip` = '$add_ip' WHERE `id` = '$add_id' LIMIT 1;";
$leet = mysql_query($dobavim) or die (mysql_error());


echo "<meta http-equiv=\"refresh\" content=\"0;url=comments.php?id=$add_m3_id>";
exit;}


@$leet = @mysql_query("SELECT * FROM `m3_comments` WHERE `id_mp3` = '".$sql_id_mp3."' ORDER BY `id` DESC LIMIT 3;") or die (mysql_error());
$ii=0;
if ($leet && @mysql_num_rows($leet)>0){
while ($row = mysql_fetch_array($leet, MYSQL_ASSOC))
{
$ii=$ii+1;
if ($ii == 1){$raz=$row['ip'];}
if ($ii == 2){$dva=$row['ip'];}
if ($ii == 3){$tri=$row['ip'];}
}}
if ($add_ip == $raz and $add_ip == $dva and $add_ip == $tri){$no=1;}
@$leet = @mysql_query("SELECT * FROM `m3_ban` WHERE `ip` = '".$add_ip."';") or die (mysql_error());
if ($leet && @mysql_num_rows($leet)>0){$no=1;}
if ($no != 1){
$dobavim = "INSERT INTO `m3_comments` (id_mp3, nick, mail, icq, date, text, ip) VALUES ('".$sql_id_mp3."', '".$add_nick."', '".$add_mail."', '".$add_icq."', '".$add_date."', '".$add_text."', '".$add_ip."');";
$leet = mysql_query($dobavim) or die (mysql_error());
}

echo "<meta http-equiv=\"refresh\" content=\"0;url=".$WWW."comments.php?id=".$sql_id_mp3."\">";
exit;}


echo "<table cellpadding=\"0\" cellspacing=\"10\" width=\"100%\" height=\"100%\"><tr><td valign=\"top\"><p>
<table width=\"100%\" cellpadding=\"0\" cellspacing=\"0\">
<tr>
<td width=\"100%\" valign=\"top\">
<p><br></p>
</td>
<td width=\"300\">
<form name='guest_form' action='".$WWW."comments.php?do=ok&id=".$sql_id_mp3."' method='post'>
<p class='mb'>
<table cellpadding='0' cellspacing='0' style='mb'>
<tr>
<td nowrap width='35'>
<p align='right'>Nick:</p>
</td>
<td width='4'>
<p>&nbsp;</p>
</td>
<td nowrap>
<p><input type='text' name='g_nick' maxlength='20'></p>
</td>
<td nowrap width='10' rowspan='3'>
<p>&nbsp;</p>
</td>
<td nowrap rowspan='3'>
<p align='right'><textarea name='g_text' rows='4' cols='41'></textarea></p>
</td>
</tr>
<tr>
<td nowrap width='35'>
<p align='right'>Mail:</p>
</td>
<td width='4'>
<p>&nbsp;</p>
</td>
<td nowrap>
<p><input type='text' name='g_mail' maxlength='25'></p>
</td>
</tr>
<tr>
<td nowrap width='35'>
<p align='right'>ICQ:</p>
</td>
<td width='4'>
<p>&nbsp;</p>
</td>
<td nowrap>
<p><input type='text' name='g_icq' maxlength='9'></p>
</td>
</tr>
</table><p align='right'><input type='reset' name='rezet' value='Сброс'> &nbsp;<input type='submit' name='ok' value='Насрать!'></p>
</form>
</td>
</tr>
<tr>
<td height=\"8\" colspan=\"2\">
<p>&nbsp;</p>
</td>
</tr>
<tr>
<td colspan=\"2\">";


$sql = mysql_query("SELECT * FROM `m3_comments` WHERE `id_mp3` = '".$sql_id_mp3."' ORDER BY `id` DESC;") or die (mysql_error());
if ($sql && @mysql_num_rows($sql)>0){
// Логика построения страниц
$vse=0;
$paga=(int)$_GET['page'];
if ($_GET['page']==null or $_GET['page']==0){$paga=1;}
if (!is_numeric($paga)){exit;}
$l = $paga*$co2;
$f = $l-$co2;
while ($row = @mysql_fetch_array($sql, MYSQL_ASSOC)){
if ($vse >= $f and $vse < $l)
{
$m3_guest_date=safe_str($row['date']);
$m3_guest_nick=safe_str($row['nick']);
$m3_guest_icq=safe_str($row['icq']);
$m3_guest_mail=safe_str($row['mail']);
$m3_guest_text=unsafe_str($row['text']);
$m3_guest_ip=$row['ip'];
$m3_guest_id=$row['id'];

if ($m3_guest_icq != ""){$MYICQ="&nbsp;<a href=\"http://web.icq.com/whitepages/message_me?uin=".$m3_guest_icq."&action=message\"><img src=\"".$WWW."m3_images/icq.gif\" align=\"middle\" width=\"12\" height=\"12\" border=0></a> ";}
else{$MYICQ="";}
echo "<p class=\"mb\"><b><a>".$m3_guest_date."</a>, ".$MYICQ."<a href=\"mailto:".str_replace("@","[собака]",$m3_guest_mail)."\">".$m3_guest_nick.":</a>";
if($wow==1){echo ", [<a href=\"javascript:na_open_window('IP', 'm3_admin/ip.php?ip=$m3_guest_ip', 150, 200, 200, 25, 0, 0, 0, 0, 0)\"><font color=#FB7700>$m3_guest_ip</font></a>] [<a href='?edit=$m3_guest_id&id_mp3=$sql_id_mp3'><font color=#0F00BF>EDIT</font></a>] [<a href='?del=$m3_guest_id&id_mp3=$sql_id_mp3'><font color=#BF0000>DEL</font></a>]";}
echo "</b><br>$m3_guest_text</p>";
}
$vse=$vse+1;
}}else{echo "<p class=\"mb\"><b><a>24.05.2005</a>, &nbsp;<a href=\"\"><img src=\"".$WWW."m3_images/icq.gif\" align=\"middle\" width=\"12\" height=\"12\" border=0></a> <a href=\"mailto:\">Admin:</a></b><br>К этой песне нет комментариев! Ваш будет первым ;)</p>";}
$guestdata="";
@$paga=$vse/$co2+1;
for ($i=1;$i<$paga;$i++){if ($i == $paga){$guestdata.=" ".$i;}else{$guestdata.=" <a href='?page=".$i."&id=".$sql_id_mp3."'>".$i."</a>";}}
if ($guestdata == ""){$guestdata = "1";}
echo "<p align=\"center\" class=\"mb\"><small>".$guestdata."</small></p>";
echo "</td></tr></table></p></td></tr></table>";
@mysql_free_result();
@mysql_close();
?>