<?
include "header.php";
if(isset($_POST['task'])) { $task = $_POST['task']; } elseif(isset($_GET['task'])) { $task = $_GET['task']; } else { $task = "main"; }

//SET PRIVACY SETTINGS
if($is_admin_logged_in == "yes") {
$privacy = "AND (privacy='0' OR privacy='1' OR privacy='2' OR privacy='3')";
} elseif($user_status == "owner" | $user_status == "admin" | $user_status == "member" | $user_status == "site_owner") {
$privacy = "AND (privacy='0' OR privacy='1' OR privacy='2' OR privacy='3')";
} elseif($owner_group_info[allow_friends] == "1" & $is_logged_in == "yes" & $user_status == "guest" & $is_friend == "yes") {
$privacy = "AND (privacy='1' OR privacy='2' OR privacy='3')";
} elseif($is_logged_in == "yes") {
$privacy = "AND (privacy='2' OR privacy='3')";
} else {
$privacy = "AND privacy='3'";
}

// IF PRIVACY FEATURE IS DISABLED BY ADMIN
if($owner_group_info[allow_privacy] != 1) {
$privacy = "AND (privacy='0' OR privacy='1' OR privacy='2' OR privacy='3')";
}


if(isset($_POST['task'])) { $task = $_POST['task']; } elseif(isset($_GET['task'])) { $task = $_GET['task']; } else { $task = "main"; }
if(isset($_POST['e_id'])) { $e_id = $_POST['e_id']; } elseif(isset($_GET['e_id'])) { $e_id = $_GET['e_id']; } else { exit(); }
if(isset($_POST['c_id'])) { $c_id = $_POST['c_id']; } elseif(isset($_GET['c_id'])) { $c_id = $_GET['c_id']; } else { exit(); }
if(mysql_num_rows(mysql_query("SELECT e_id FROM bhost_entries WHERE e_id='$e_id' AND w_id='$weblog_info[w_id]' $privacy")) != 1) { exit(); }
if(mysql_num_rows(mysql_query("SELECT c_id FROM bhost_comments WHERE c_id='$c_id' AND e_id='$e_id' AND w_id='$weblog_info[w_id]'")) != 1) { exit(); }
$entry_info = mysql_fetch_assoc(mysql_query("SELECT * FROM bhost_entries WHERE e_id='$e_id' AND w_id='$weblog_info[w_id]' $privacy"));
$comment_info = mysql_fetch_assoc(mysql_query("SELECT * FROM bhost_comments WHERE c_id='$c_id' AND e_id='$e_id' AND w_id='$weblog_info[w_id]'"));


$is_error = "no";
$error = "";
if($owner_group_info[allow_friends] == "1" & $weblog_info[show_comments] == "1" & ($user_status != "owner" & $user_status != "admin" & $user_status != "member" & $user_status != "site_owner") & $is_admin_logged_in != "yes" & ($is_logged_in == "no" | ($user_status == "guest" & $is_friend != "yes"))) {
  $is_error = "yes";
  $error = "<b>$edit_comment1</b><br>$edit_comment2 <a href='login.php?w=$weblog_info[weblog]&e_id=$e_id&c_id=$c_id&ref=3'>$edit_comment3</a>.";
  $icon = "./images/key.gif";
} elseif($weblog_info[show_comments] == "2" & $is_logged_in == "no" & $is_admin_logged_in != "yes") {
  $is_error = "yes";
  $error = "<b>$edit_comment1</b><br>$edit_comment4 <a href='login.php?w=$weblog_info[weblog]&e_id=$e_id&c_id=$c_id&ref=3'>$edit_comment3</a>.";
  $icon = "./images/key.gif";
} elseif($entry_info[comments] == "0") {
  $is_error = "yes";
  $error = "<b>$edit_comment5</b><br>$edit_comment6";
  $icon = "./images/error.gif";
} elseif($owner_group_info[allow_comments] == "0" | $weblog_info[show_comments] == "0") { 
  $is_error = "yes"; 
  $error = "<b>$edit_comment5</b><br>$edit_comment7"; 
  $icon = "./images/error.gif";
} elseif(($weblog_info[manage_comments] == "0" | $weblog_info[manage_comments] == "2") & ($user_status != "owner" & $user_status != "admin" & $user_status != "member" & $user_status != "site_owner") & $is_admin_logged_in != "yes") {
  $is_error = "yes"; 
  $error = "<b>$edit_comment8</b><br>$edit_comment9"; 
  $icon = "./images/error.gif";
} elseif($is_logged_in != "yes" & $is_admin_logged_in != "yes") {
  $is_error = "yes";
  $error = "<b>$edit_comment1</b><br>$edit_comment4 <a href='login.php?w=$weblog_info[weblog]&e_id=$e_id&c_id=$c_id&ref=3'>$edit_comment3</a>.";
  $icon = "./images/key.gif";
} elseif(($user_info[username] != $comment_info[username] | $user_info[u_id] != $comment_info[author_u_id]) & ($user_status != "owner" & $user_status != "admin" & $user_status != "member" & $user_status != "site_owner") & $is_admin_logged_in != "yes") {
  $is_error = "yes"; 
  $error = "<b>$edit_comment1</b><br>$edit_comment10 <a href='login.php?w=$weblog_info[weblog]&e_id=$e_id&c_id=$c_id&ref=3'>$edit_comment3</a>"; 
  $icon = "./images/key.gif";
}


if($is_error == "yes") {
echo $head;
echo "
<div class='float' style='padding-right: 2px;'><img src='$icon' border='0'></div>
<div>$error</div>
";
echo $foot;
exit();
}



if($task == "cancel") {
$url = url("entry", "$weblog_info[weblog]", "", "$e_id", "", "", "#c$c_id");
header("Location: $url");
exit();
}

//SET ERROR VARIABLES
$is_error = "no";
$error = "";

$title = $comment_info[title];
$contents = str_replace("<br>", "\n", $comment_info[contents]);
$contents = str_replace("<!--StartEdit-->".between("<!--StartEdit-->", "<!--EndEdit-->", $contents)."<!--EndEdit-->", "", $contents);


if($task == "doedit") {
if($is_admin_logged_in != "yes") { if($is_logged_in == "yes") { $username = "<a href=\'".url("profile", "", "$user_info[username]")."\'>$user_info[username]</a>"; } else { $username = $user_info[username]; } } else { $username = "Administrator"; }
$title = str_replace("&amp;", "&", htmlspecialchars($_POST['title'], ENT_QUOTES));
$contents = str_replace("&amp;", "&", str_replace("\n", "<br>", htmlspecialchars($_POST['contents'], ENT_QUOTES)));
$nickname = str_replace("&amp;", "&", htmlspecialchars($_POST['nickname'], ENT_QUOTES));

if(str_replace(" ", "", $title) == "") { $title = "<i>$edit_comment11</i>"; }
if(str_replace(" ", "", $contents) == "") {
 $is_error = "yes";
 $error = "$edit_comment12";
}

if($is_error != "yes") {

// CENSOR BAD WORDS
$bad_words = explode(",", trim($admin_info[banned_badwords]));
$bad_words_replace = explode(",", trim($admin_info[banned_badwords_replace]));
$contents = str_replace($bad_words, $bad_words_replace, $contents);
$title = str_replace($bad_words, $bad_words_replace, $title);

$contents .= "<!--StartEdit--><br><br><font style=\'font-size: 8pt;\'><i>$edit_comment20 $username $edit_comment21 ".cdate("$weblog_info[format_date]", time())." $edit_comment22 ".cdate("$weblog_info[format_time]", time())."</i></font><!--EndEdit-->";
mysql_query("UPDATE bhost_comments SET username='$nickname', title='$title', contents='$contents' WHERE w_id='$weblog_info[w_id]' AND e_id='$e_id' AND c_id='$c_id'");
$url = url("entry", "$weblog_info[weblog]", "", "$e_id", "", "", "#c$c_id");
header("Location: $url");
exit();
}}



echo $head;
echo "
<script language=\"JavaScript\" type=\"text/javascript\">
<!--
function fill() {
window.document.preview.contents.value = window.document.info.contents.value;
window.document.preview.title.value = window.document.info.title.value;
if(window.document.info.nickname) {
window.document.preview.nickname.value = window.document.info.nickname.value;
}
}
//-->
</script>
<h2>$edit_comment13</h2>
"; show_error($error); echo "
<br>
<table cellpadding='0' cellspacing='0' class='form'>
<form action='edit_comment.php' method='POST' name='info'>
<tr>
<td class='form1'>$edit_comment14</td>
<td class='form2'>

  <table cellpadding='0' cellspacing='0'>
  <tr>
  <td><input type='radio' name='from' value='1' CHECKED></td>
  <td>"; if($comment_info[author_u_id] == "0") { echo "<input type='text' name='nickname' value='$comment_info[username]'>"; } else { echo "Registered User: <b>$comment_info[username]</b><input type='hidden' name='nickname' value='$comment_info[username]'>"; } echo " 
  </td>
  </tr>
  </table></td></tr>

<tr>
<td class='form1'>$edit_comment15</td>
<td class='form2'><input type='text' class='text' name='title' maxlength='150' size='50' value='$title'></td>
</tr>
<tr>
<td class='form1'>$edit_comment16</td>
<td class='form2'><textarea rows='7' cols='52' name='contents'>$contents</textarea></td>
</tr>
</table>

<br>

<table cellpadding='0' cellspacing='0'>
<tr>
<td>
<input type='submit' class='button' value='$edit_comment17'>&nbsp;
<input type='hidden' name='task' value='doedit'>
<input type='hidden' name='w' value='$weblog_info[weblog]'>
<input type='hidden' name='e_id' value='$e_id'>
<input type='hidden' name='c_id' value='$c_id'>
<input type='hidden' name='IP' value='".$_SERVER['REMOTE_ADDR']."'>
</td>
</form>
<form action='previewcomment.php#c$c_id' method='POST' target='_blank' name='preview'>
<td>
<input type='submit' name='submit' class='button' value='$edit_comment18' onClick='fill();'>&nbsp;
<input type='hidden' name='from' value='1'>
<input type='hidden' name='nickname' value=''>
<input type='hidden' name='title' value=''>
<input type='hidden' name='contents' value=''>
<input type='hidden' name='w' value='$weblog_info[weblog]'>
<input type='hidden' name='e_id' value='$e_id'>
<input type='hidden' name='c_id' value='$c_id'>
</td>
</form>
<form action='post_comment.php' method='POST'>
<td>
<input type='submit' class='button' value='$edit_comment19'>
<input type='hidden' name='task' value='cancel'>
<input type='hidden' name='w' value='$weblog_info[weblog]'>
<input type='hidden' name='e_id' value='$e_id'>
<input type='hidden' name='c_id' value='$c_id'>
</td>
</form>
</tr>
</table>
";




echo $foot;
?>