<?php
define('AJAX','1');
require_once('global.php');
require_once(R_P.'require/forum.php');

$groupid == 'guest' && Showmsg('not_login');
empty($fid) && Showmsg('undefined_action');

$foruminfo = $db->get_one('SELECT f.*,fe.forumset FROM pw_forums f LEFT JOIN pw_forumsextra fe ON fe.fid=f.fid WHERE f.fid='.pwEscape($fid)." AND f.type<>'category'");
!$foruminfo && Showmsg('data_error');
wind_forumcheck($foruminfo);
$forumset = unserialize($foruminfo['forumset']);
/*
* 獲取管理權限
*/
$isGM = CkInArray($windid,$manager);
$isBM = admincheck($foruminfo['forumadmin'],$foruminfo['fupadmin'],$windid);
if (!$isGM && $groupid != 3 && !$isBM && !$foruminfo['allowvisit']) {
	forum_creditcheck();
}
if ($forumset['allowtime'] && !allowcheck($forumset['allowtime'],$t['hours'],'') && !$isGM && !pwRights($isBM,'allowtime')) {
	Showmsg('forum_allowtime');
}
list($db_openpost,$db_poststart,$db_postend) = explode("\t",$db_openpost);
if ($db_openpost == 1 && $groupid != 3 && $groupid != 4) {
	if ($db_poststart < $db_postend && ($t['hours'] < $db_poststart || $t['hours'] >= $db_postend)) {
		Showmsg('post_openpost');
	} elseif ($db_poststart > $db_postend && ($t['hours'] < $db_poststart && $t['hours'] >= $db_postend)) {
		Showmsg('post_openpost');
	}
}
if ($groupid == 6 || getstatus($winddb['userstatus'],1)) {
	$pwSQL = '';
	$flag  = 0;
	$bandb = $delban = array();
	$query = $db->query("SELECT * FROM pw_banuser WHERE uid=".pwEscape($winduid));
	while ($rt = $db->fetch_array($query)) {
		if ($rt['type'] == 1 && $timestamp - $rt['startdate'] > $rt['days']*86400) {
			$delban[] = $rt['id'];
		} elseif ($rt['fid'] == 0 || $rt['fid'] == $fid) {
			$bandb[$rt['fid']] = $rt;
		} else {
			$flag = 1;
		}
	}
	$delban && $db->update('DELETE FROM pw_banuser WHERE id IN('.pwImplode($delban).')');
	($groupid == 6 && !isset($bandb[0])) && $pwSQL .= "groupid='-1',";
	if (getstatus($winddb['userstatus'],1) && !isset($bandb[$fid]) && !$flag) {
		$pwSQL .= 'userstatus=userstatus&(~1),';
	}
	if ($pwSQL = rtrim($pwSQL,',')) {
		$db->update('UPDATE pw_members SET $pwSQL WHERE uid='.pwEscape($winduid));
	}
	if ($bandb) {
		$bandb = current($bandb);
		if ($bandb['type'] == 1) {
			$s_date = get_date($bandb['startdate']);
			$e_date = $bandb['startdate'] + $bandb['days']*86400;
			$e_date = get_date($e_date);
			Showmsg('ban_info1');
		} else {
			if ($bandb['type'] == 3) {
				Cookie('force',$winduid);
				Showmsg('ban_info3');
			} else {
				Showmsg('ban_info2');
			}
		}
	}
}
if (GetCookie('force') && $winduid != GetCookie('force')) {
	$force = GetCookie('force');
	$bandb = $db->get_one('SELECT type FROM pw_banuser WHERE uid='.pwEscape($force).' AND fid=0');
	if ($bandb['type'] == 3) {
		Showmsg('ban_info3');
	} else {
		Cookie('force','',0);
	}
}
if ($groupid == '7') {
	Showmsg('post_check');
}
if ($db_postallowtime && $timestamp-$winddb['regdate']<$db_postallowtime*60) {
	Showmsg('post_newrg_limit');
}
$userlastptime = $groupid != 'guest' ?  $winddb['lastpost'] : GetCookie('userlastptime');
$tdtime  >= $winddb['lastpost'] && $winddb['todaypost'] = 0;
$montime >= $winddb['lastpost'] && $winddb['monthpost'] = 0;

if ($_G['postlimit'] && $winddb['todaypost'] >= $_G['postlimit']) {
	Showmsg('post_gp_limit');
}
list(,,$postq)	= explode("\t",$db_qcheck);
InitGP(array('action'));

if ($action == 'modify') {

	InitGP(array('pid','article'));
	if (is_numeric($pid)) {
		$pw_posts = GetPtable('N',$tid);
		$atcdb = $db->get_one('SELECT tid,aid,author,authorid,icon,postdate,subject,ifsign,leaveword,ifconvert,content,anonymous'
						. ' FROM '.$pw_posts
						. ' WHERE pid='.pwEscape($pid)
						. ' AND tid='.pwEscape($tid)
						. ' AND fid='.pwEscape($fid));
		!$atcdb['tid'] && Showmsg('illegal_tid');
		$ptable = substr($pw_posts,8);
	} else {
		$pw_tmsgs = GetTtable($tid);
		$atcdb = $db->get_one('SELECT t.tid,t.icon,t.author,t.authorid,t.subject,t.postdate,t.locked,t.anonymous,t.ptable,tm.aid,tm.ifsign,tm.content'
						. ' FROM pw_threads t LEFT JOIN '.$pw_tmsgs.' tm USING(tid)'
						. ' WHERE t.tid='.pwEscape($tid)
						. ' AND fid='.pwEscape($fid));
		!$atcdb['tid'] && Showmsg('illegal_tid');
		$ptable = $atcdb['ptable'];
	}
	if (!$isGM && !pwRights($isBM,'deltpcs')) {
		if ($groupid == 'guest' || $atcdb['authorid'] != $winduid) {
			Showmsg('modify_noper');
		} elseif ($atcdb['locked']%3 > 0) {
			Showmsg('modify_locked');
		}
	}
	if ($winduid != $atcdb['authorid'] && $groupid != 3 && $groupid != 4) {
		$authordb = $db->get_one('SELECT groupid FROM pw_members WHERE uid='.pwEscapse($atcdb['authorid']));
		if (($authordb['groupid'] == 3 || $authordb['groupid'] == 4)) {
			Showmsg('modify_admin');
		}
	}
	if ($_G['edittime'] && ($timestamp - $atcdb['postdate']) > $_G['edittime'] * 60) {
		Showmsg('modify_timelimit');
	}
	if (empty($_POST['step'])) {

		$atcdb['anonymous'] && $atcdb['author'] = $db_anonymousname;
		$atc_content = str_replace(array('<','>','&nbsp;'),array('&lt;','&gt;',' '),$atcdb['content']);
		if(strpos($atc_content,$db_bbsurl) !== false){
			$atc_content = str_replace('p_w_picpath',$db_picpath,$atc_content);
			$atc_content = str_replace('p_w_upload',$db_attachname,$atc_content);
		}
		$atc_title = $atcdb['subject'];
		require_once PrintEot('ajax');ajax_footer();

	} else {

		PostCheck(1,($db_gdcheck & 4) && $winddb['postnum'] < $db_postgd,$winddb['postnum'] < $postq);
		if (@include(D_P."data/bbscache/wordsfb.php")) {
			foreach ($wordsfb as $key => $value) {
				$banword = (string) stripslashes($key);
				if (strpos($_POST['atc_title'],$banword) !== false) {
					Showmsg('title_wordsfb');
				} elseif (strpos($_POST['atc_content'],$banword) !== false) {
					Showmsg('content_wordsfb');
				}
			}
			foreach ($replace as $key => $value) {
				$banword = (string) stripslashes($key);
				if (strpos($_POST['atc_title'],$banword) !== false) {
					Showmsg('post_wordsfb');
				}
			}
		}
		list(,,$downloadmoney,$downloadimg) = explode("\t",$forumset['uploadset']);
		require_once('require/postfunc.php');
		require_once(R_P.'require/bbscode.php');
		$atc_usesign = $atcdb['ifsign'];
		list($atc_title,$atc_content,$ifconvert,$ifwordsfb) = check_data('modify');

		if (file_exists(D_P."data/style/$skin.php") && strpos($skin,'..')===false) {
			@include(D_P."data/style/$skin.php");
		} else {
			@include(D_P."data/style/wind.php");
		}
		if ($groupid != 3 && $atcdb['postdate'] + 300 < $timestamp) {
			$altername = $atcdb['anonymous'] && $windid==$atcdb['author'] ? $db_anonymousname : $windid;
			$timeofedit= get_date($timestamp);
			$alterinfo = getLangInfo('post','edit_post');
		} else {
			$alterinfo = '';
		}
		if ($winduid != $authorid) {
			/**
			* 管理員編輯帖子的安全日記
			*/
			require_once(R_P.'require/writelog.php');
			$log = array(
				'type'      => 'edit',
				'username1' => $atcdb['author'],
				'username2' => $windid,
				'field1'    => $fid,
				'field2'    => '',
				'field3'    => '',
				'descrip'   => 'edit_descrip',
				'timestamp' => $timestamp,
				'ip'        => $onlineip,
				'tid'		=> $tid,
				'forum'		=> $foruminfo['name'],
				'subject'	=> substrs($atc_title,28),
				'reason'	=> 'edit article'
			);
			writelog($log);
		}
		$aids = array();
		if ($atcdb['aid']) {
			$aids = attachment($atc_content);
		}
		$leaveword = $atcdb['leaveword'] ? leaveword($atcdb['leaveword']) : '';
		$content   = convert($atc_content.$leaveword,$db_windpost);
		$ifconvert = $content == $atc_content.$leaveword ? 1 : 2;
		if (is_numeric($pid)) {
			$pwSQL = pwSqlSingle(array(
				'subject'	=> $atc_title,
				'alterinfo'	=> $alterinfo,
				'content'	=> $atc_content,
				'ifconvert'	=> $ifconvert,
				'ifwordsfb'	=> $ifwordsfb
			));
			$db->update("UPDATE $pw_posts SET $pwSQL WHERE pid=".pwEscape($pid));
		} else {
			$db->update('UPDATE pw_threads SET subject='.pwEscape($atc_title).' WHERE tid='.pwEscape($tid));
			$pwSQL = pwSqlSingle(array(
				'alterinfo'	=> $alterinfo,
				'ifconvert'	=> $ifconvert,
				'ifwordsfb'	=> $ifwordsfb,
				'content'	=> $atc_content
			));
			$db->update("UPDATE $pw_tmsgs SET $pwSQL WHERE tid=".pwEscape($tid));
		}
		if (strpos($content,'[p:') !== false || strpos($content,'[s:') !== false) {
			$content = showface($content);
		}
		if ($atcdb['ifsign'] < 2) {
			$content = str_replace("\n",'<br />',$content);
		}
		if ($ifwordsfb == 0) {
			$content = addslashes(wordsfb(stripslashes($content)));
		}
		$creditnames = pwCreditNames();
		if ($aids) {
			$attachs = unserialize(stripslashes($atcdb['aid']));
			if (is_array($attachs)) {
				if ($winduid == $read['authorid'] || $isGM || pwRights($isBM,'delattach')) {
					$dfadmin = 1;
				} else {
					$dfadmin = 0;
				}
				foreach ($attachs as $at) {
					if (!in_array($at['aid'], $aids)) {
						continue;
					}
					$atype = '';
					$rat = array();
					if ($at['type'] == 'img' && $at['needrvrc'] == 0 && (!$downloadimg || !$downloadmoney || $_G['allowdownload'] == 2)) {
						$a_url = geturl($at['attachurl'],'show');
						if (is_array($a_url)) {
							$atype = 'pic';
							$dfurl = '<br>'.cvpic($a_url[0], 1, $db_windpost['picwidth'], $db_windpost['picheight'], $at['ifthumb']);
							$rat = array('aid' => $at['aid'], 'img' => $dfurl, 'dfadmin' => $dfadmin, 'desc' => $at['desc']);
						} elseif ($a_url == 'imgurl') {
							$atype = 'picurl';
							$rat = array('aid' => $at['aid'], 'name' => $at['name'], 'dfadmin' => $dfadmin, 'verify' => md5("showimg{$tid}{$read[pid]}{$fid}{$at[aid]}{$db_hash}"));
						}
					} else {
						$atype = 'downattach';
						if ($at['needrvrc'] > 0) {
							!$at['ctype'] && $at['ctype'] = $at['special'] == 2 ? 'money' : 'rvrc';
							$at['special'] == 2 && $db_sellset['price'] > 0 && $at['needrvrc'] = min($at['needrvrc'], $db_sellset['price']);
						}
						$rat = array('aid' => $at['aid'], 'name' => $at['name'], 'size' => $at['size'], 'hits' => $at['hits'], 'needrvrc' => $at['needrvrc'], 'special' => $at['special'], 'cname' => $creditnames[$at['ctype']], 'type' => $at['type'], 'dfadmin' => $dfadmin, 'desc' => $at['desc'], 'ext' => strtolower(substr(strrchr($at['name'],'.'),1)));
					}
					if ($atype) {
						$content = attcontent($content, $atype, $rat);
					}
				}
			}
		}
		$alterinfo && $content.="<div id=\"alert_$pid\" style=\"color:gray;margin-top:30px\">[ $alterinfo ]</div>";
		$atcdb['icon'] = $atcdb['icon'] ? "<img src=\"$imgpath/post/emotion/$atcdb[icon].gif\" align=\"left\" border=\"0\" />" : '';
		echo "success\t".stripslashes($atcdb['icon']."&nbsp;".$atc_title)."\t".str_replace(array("\r","\t"), array("",""), stripslashes($content));
		ajax_footer();
	}
} elseif ($action == 'quote') {

	if ($foruminfo['allowrp'] && !$isGM && !allowcheck($foruminfo['allowrp'],$groupid,$winddb['groups'],$fid,$winddb['reply'])) {
		Showmsg('reply_forum_right');
	}
	if (!$foruminfo['allowrp'] && !$isGM && $_G['allowrp'] == 0) {
		Showmsg('reply_group_right');
	}
	InitGP(array('pid','article','page'));

	if ($article == '0') {
		$pw_tmsgs = GetTtable($tid);
		$S_sql = ',tm.ifsign,tm.content,m.uid,m.groupid,m.userstatus';
		$J_sql = "LEFT JOIN $pw_tmsgs tm ON tm.tid=t.tid LEFT JOIN pw_members m ON t.authorid=m.uid";
	} else {
		$S_sql = $J_sql = '';
	}
	$tpcarray = $db->get_one("SELECT t.fid,t.locked,t.ifcheck,t.author,t.authorid,t.subject,t.postdate,t.ifshield,t.anonymous,t.ptable $S_sql FROM pw_threads t $J_sql WHERE t.tid=".pwEscape($tid));
	$pw_posts = GetPtable($tpcarray['ptable']);

	if ($tpcarray['fid'] != $fid) {
		Showmsg('illegal_tid');
	}
	if ($forumset['lock'] && !$isGM && $timestamp - $tpcarray['postdate'] > $forumset['lock'] * 86400 && !pwRights($isBM,'replylock')) {
		Showmsg('forum_locked');
	}
	if (!$isGM && !$isBM && !$tpcarray['ifcheck']) {
		Showmsg('reply_ifcheck');
	}
	if (!$isGM && $tpcarray['locked']%3<>0 && !pwRights($isBM,'replylock')) {
		Showmsg('reply_lockatc');
	}

	require_once(R_P.'require/bbscode.php');
	if ($article == '0') {
		$atcarray = $tpcarray;
	} else {
		!is_numeric($pid) && Showmsg('illegal_tid');
		$atcarray = $db->get_one("SELECT p.author,p.subject,p.postdate,p.content,p.ifshield,p.anonymous,m.uid,m.groupid,m.userstatus FROM $pw_posts p LEFT JOIN pw_members m ON p.authorid=m.uid WHERE p.pid=".pwEscape($pid));
	}
	if ($atcarray['ifshield'] == '1') {
		$atcarray['content'] = shield('shield_article');
	} elseif ($atcarray['ifshield'] == '2') {
		$atcarray['content'] = shield('shield_del_article');
	} elseif (isban($atcarray,$fid)) {
		$atcarray['content'] = shield('ban_article');
	}
	$old_author = $atcarray['anonymous'] ? $db_anonymousname : $atcarray['author'];
	$replytitle = $atcarray['subject'];
	$wtof_oldfile = get_date($atcarray['postdate']);
	$old_content = $atcarray['content'];
	$old_content = preg_replace("/\[hide=(.+?)\](.+?)\[\/hide\]/is",getLangInfo('post','hide_post'),$old_content);
	$old_content = preg_replace("/\[post\](.+?)\[\/post\]/is",getLangInfo('post','post_post'),$old_content);
	$old_content = preg_replace("/\[sell=(.+?)\](.+?)\[\/sell\]/is",getLangInfo('post','sell_post'),$old_content);
	$old_content = preg_replace("/\[quote\](.*)\[\/quote\]/is","",$old_content);

	$bit_content = explode("\n",$old_content);
	if (count($bit_content) > 5) {
		$old_content = "$bit_content[0]\n$bit_content[1]\n$bit_content[2]\n$bit_content[3]\n$bit_content[4]\n.......";
	}
	if (strpos($old_content,$db_bbsurl) !== false) {
		$old_content = str_replace('p_w_picpath',$db_picpath,$old_content);
		$old_content = str_replace('p_w_upload',$db_attachname,$old_content);
	}
	$old_content = preg_replace("/\<(.+?)\>/is","",$old_content);
	$atc_content = "[quote]".($article==0 ? getLangInfo('post','info_post_1') : getLangInfo('post','info_post_2'))."\n{$old_content} [url={$db_bbsurl}/job.php?action=topost&tid=$tid&pid=$pid][img]{$db_bbsurl}/images/back.gif[/img][/url]\n[/quote]\n";

	$replytitle =='' ? $atc_title = 'Re:'.$tpcarray['subject'] : $atc_title = 'Re:'.$replytitle;
	require_once PrintEot('ajax');ajax_footer();

} elseif ($action == 'subject') {
	(!$isGM && !pwRights($isBM,'deltpcs')) && Showmsg('undefined_action');
	$atcdb = $db->get_one('SELECT authorid,subject FROM pw_threads WHERE tid='.pwEscape($tid).' AND fid='.pwEscape($fid));
	empty($atcdb) && Showmsg('illegal_tid');
	if ($winduid != $atcdb['authorid'] && $groupid != 3 && $groupid != 4) {
		$authordb = $db->get_one('SELECT groupid FROM pw_members WHERE uid='.pwEscape($atcdb['authorid']));
		if (($authordb['groupid'] == 3 || $authordb['groupid'] == 4)) {
			Showmsg('modify_admin');
		}
	}
	if (empty($_POST['step'])) {

		$atcdb['subject'] = str_replace(array("&lt;","&gt;","\t"),array('<','>',''),$atcdb['subject']);
		echo "success\t".$atcdb['subject'];
		ajax_footer();

	} else {

		PostCheck();
		InitGP(array('atc_content'),'P');
		!$atc_content && Showmsg('content_empty');

		$db->update('UPDATE pw_threads SET subject='.pwEscape($atc_content).' WHERE tid='.pwEscape($tid));
		$rt = $db->get_one('SELECT titlefont FROM pw_threads WHERE tid='.pwEscape($tid));
		if ($rt['titlefont']) {
			$detail = explode("~",$rt['titlefont']);
			$detail[0] && $atc_content = "<font color=$detail[0]>$atc_content</font>";
			$detail[1] && $atc_content = "<b>$atc_content</b>";
			$detail[2] && $atc_content = "<i>$atc_content</i>";
			$detail[3] && $atc_content = "<u>$atc_content</u>";
		}
		echo "success\t".str_replace("\t","",$atc_content);ajax_footer();
	}
}
?>