<?php

require("connectdb.php");
require("corrurl.php");
include("admin/validate.php");

//stupid FLoC counter-thingy
header('Permissions-Policy: interest-cohort=()');

function htmlize($string) {
	return htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
}


function doAds($adId) {
	global $http;
	if ($http!="https") {
		$adIds=array("7156777357", "9916575011");
		?>
		<script type="text/javascript"><!--
		google_ad_client = "ca-pub-6055011648930388";
		/* an ad */
		google_ad_slot = "<?php echo $adIds[$adId]?>";
		google_ad_width = 468;
		google_ad_height = 60;
		//-->
		</script>
		<script type="text/javascript"
		src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
		</script>
		<?php
	}
}

function doNewAd() {
	return;
	?>
	<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
	<!-- singlebigad -->
	<ins class="adsbygoogle"
	     style="display:inline-block;width:728px;height:90px"
	     data-ad-client="ca-pub-6055011648930388"
	     data-ad-slot="3668631373"></ins>
	<script>
	(adsbygoogle = window.adsbygoogle || []).push({});
	</script>
	<?php
}

$art=""; $page="";
if (isset($_REQUEST["art"])) $art=$_REQUEST["art"];
if (isset($_REQUEST["page"])) $page=$_REQUEST["page"];
//catch invalid page
if (!is_numeric($page)) $page=1;

//Use https apis when using https
if (isset($_SERVER["HTTPS"])) $http="https"; else $http="http";

//catch invalid article
if ($art=="") $art="main";
$r=mysqli_query($sqllink, "SELECT * FROM `articles` WHERE `dir`='".mysqli_real_escape_string($sqllink, $art)."'");
if (mysqli_num_rows($r)==0) {
    header("Location: /");
}
//fetch metadata
$meta=mysqli_fetch_assoc($r);
if ($page<1 || $page>$meta["pages"]) $page=1;


//Log
if (!(isset($_SERVER["HTTP_X_MOZ"]) && $_SERVER["HTTP_X_MOZ"] == "prefetch")) {
    $fr="";
    if (isset($_REQUEST["amp;f"])) $fr=$_REQUEST["amp;f"]; //silly twitter client :X
    if (isset($_REQUEST["f"])) $fr=$_REQUEST["f"];
    if (isset($_REQUEST["from"])) $fr=$_REQUEST["from"];
    $sql = 'INSERT INTO `logs` (`date`, `art`, `ip`, `page`, `referrer`, `from`, `ua`) ';
    $sql.= "VALUES ('".time()."', '".mysqli_real_escape_string($sqllink, $meta["dir"])."' ,";
    $sql.= " '".$_SERVER["REMOTE_ADDR"]."', ";
    $sql.= " '".mysqli_real_escape_string($sqllink, $page)."', ";
    if (isset($_SERVER["HTTP_REFERER"])) $ref=$_SERVER["HTTP_REFERER"]; else $ref="";
    $sql.= " '".mysqli_real_escape_string($sqllink, $ref)."', ";
    $sql.= " '".mysqli_real_escape_string($sqllink, $fr)."', ";
    $sql.= " '".mysqli_real_escape_string($sqllink, $_SERVER["HTTP_USER_AGENT"])."')";
    mysqli_query($sqllink, $sql);

	$res=mysqli_query($sqllink, "UPDATE `refs` SET `count`=`count`+1 WHERE `art`='".mysqli_real_escape_string($sqllink, $meta["dir"])."'
		 AND `page`='".mysqli_real_escape_string($sqllink, $page)."'
		 AND `ref`='".mysqli_real_escape_string($sqllink, $ref)."'
		 AND `tag`='".mysqli_real_escape_string($sqllink, $fr)."'");
	if (!$res) die("updating: ".mysqli_error($sqllink));
	if (mysqli_affected_rows($sqllink)==0) {
		$q="INSERT INTO `refs` (`art`, `page`, `tag`, `ref`, `count`) VALUES (
			'".mysqli_real_escape_string($sqllink, $meta["dir"])."', 
			'".intval($page)."', 
			'".mysqli_real_escape_string($sqllink, $fr)."', 
			'".mysqli_real_escape_string($sqllink, $ref)."', '1')";
//		echo $q."\n";
		$res=mysqli_query($sqllink, $q);
		if (!$res) die("inserting: ".mysqli_error($sqllink));
	}


}

//Experiment: new or old ad?
$doNewAds=true; //!(hexdec(substr(md5($_SERVER["REMOTE_ADDR"]),1,2))&1);

$testversion=false;

//Handle comment posts
if (isset($_POST["comment"])) {
    if ($cmterror=="" && strlen($_POST["comment"])<10) $cmterror="Please enter some <i>real</i> text, not the few keystrokes you just tried.";
    if ($cmterror=="" && strlen($_POST["name"])<2) $cmterror="Please leave a name.";
    $s=$_REQUEST["capval"]^0xaaaaaaa;
    if ($cmterror=="" && $s<time()-(60*10)) $cmterror="Please retry the captcha.";
    $s=$s^0xaaaaaaa;
    $ctxt=substr(md5($s."siekrut"),2,5);
    $fld=$_REQUEST["capfld"];
    if (strlen($fld)<4) $fld="capfld";
    if ($cmterror=="" && $ctxt!=strtolower($_REQUEST["$fld"])) $cmterror="Please retry the captcha.";
    if ($cmterror=="") {
		$sql = 'INSERT INTO `comments` (`artdir`, `name`, `date`, `comment`)'.
			"VALUES ('".mysqli_real_escape_string($sqllink, $art)."', '".mysqli_real_escape_string($sqllink, $_REQUEST["name"])."', '".time()."', '".mysqli_real_escape_string($sqllink, $_REQUEST["comment"])."')";
		mysqli_query($sqllink, $sql) || die(mysqli_error($sqllink));;
		header("Location: ?art=".htmlize($art)."&page=$page#cmt".mysqli_insert_id($sqllink));
		exit(0);
    } else {
		$faillog="Erroneous comment!\n";
		$faillog.="Name: ".$_POST["name"]."\n";
		$faillog.="Captcha: want=".$ctxt." got=".$_REQUEST["captcha"]."\n";
		$faillog.="Art: ".$art."\n";
		$faillog.="IP: ".$_SERVER["REMOTE_ADDR"]."\n";
		$faillog.="Comment follows:\n".$_REQUEST["name"]."\n.\n\n";
		$failfile=fopen("/tmp/faillog.log", "a");
		fputs($failfile, $faillog);
		fclose($failfile);
	}
}
$desc=explode("|",$meta["pagenames"]);
$pdesc=$desc[$page-1];

?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" 
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Sprites mods - <?php echo $meta["title"]?> - <?php echo $pdesc?></title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<link rel="stylesheet" type="text/css" href="style/style-new.css" />
<link rel="stylesheet" type="text/css" href="style/print.css" media="print" />
<link href="/video_js/video-js.css" rel="stylesheet" />
<link type="application/rss+xml" rel="alternate" title="Sprites Mods" href="https://spritesmods.com/rss.php" />
</head>
<body>

<div id="header"><span id="sitename"><span id="sitenamebig">SpritesMods</span>.com</span><h1><?php echo $meta["title"]?> - <?php echo $pdesc?></h1></div>


<div id="left">
<p />
<?php
//Build the menu from the db info
$r=mysqli_query($sqllink, "SELECT * FROM `articles` WHERE `parent`='0' LIMIT 1");
$p=mysqli_fetch_assoc($r);
echo '<a href="?art='.$p["dir"].'">'.$p["title"].'</a><br />';
$r=mysqli_query($sqllink, "SELECT * FROM `articles` WHERE `parent`='".mysqli_real_escape_string($sqllink, $p["id"])."' ORDER BY `order`");
echo '<ul id="mainmenu">';
while($p=mysqli_fetch_assoc($r)) {
    echo '<li><a href="?art='.$p["dir"].'">'.$p["title"].'</a>';
    if ($p["id"]==$meta["parent"] || $p["id"]==$meta["id"]) {
	//Decollapse subgroup too
	echo '<ul id="submenu">';
	$sr=mysqli_query($sqllink, "SELECT * FROM `articles` WHERE `parent`='".mysqli_real_escape_string($sqllink, $p["id"])."' ORDER BY `order`");
	while($sp=mysqli_fetch_assoc($sr)) {
	    echo '<li><a href="?art='.$sp["dir"].'">'.$sp["title"].'</a></li>';
	}	
	echo "</ul>";
    }
    echo "</li>";
}
echo "</ul>";
?>
</div>

<div id="right">
<div id="righttop">
<?php
//Build contents menu
$desc=explode("|",$meta["pagenames"]);
for ($x=0; $x<$meta["pages"]; $x++) {
    echo "<p />";
    if ($page!=$x+1) echo '<a href="?art='.$meta["dir"].'&amp;page='.($x+1).'">';
    echo "<strong>Page ".($x+1)."</strong><br />";
    if ($page!=$x+1) echo '</a>';
    echo $desc[$x];
    if ($meta["comments"]==1 && $x==$meta["pages"]-1) {
	echo " (+ discussion / remarks)";
    }
}
/*
if ($meta["ads"]==1 && !$testversion) {
    echo "<br /><br /><br />";
    $x=rand(1,3);
    readfile("ad2v$x.inc");
}
*/
?>
<p>
</p>
</div>
<div id="rightbottom">
<p>
Do you like my hacking? If so, please consider leaving something in the<br />
</p>
<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_donations">
<input type="hidden" name="business" value="AWHK8LYRDDS3C">
<input type="hidden" name="lc" value="GB">
<input type="hidden" name="item_name" value="Spritesmods.com">
<input type="hidden" name="no_note" value="0">
<input type="hidden" name="cn" value="Remarks">
<input type="hidden" name="no_shipping" value="1">
<input type="hidden" name="rm" value="1">
<input type="hidden" name="return" value="http://spritesmods.com/?art=main&amp;thanks=1">
<input type="hidden" name="currency_code" value="EUR">
<input type="hidden" name="bn" value="PP-DonationsBF:donate.png:NonHosted">
<input type="image" src="<?php echo $http?>://spritesmods.com/donate.png" border="0" name="submit" alt="PayPal, de veilige en complete manier van online betalen.">
<!--
<img alt="" border="0" src="https://www.paypalobjects.com/nl_NL/i/scr/pixel.gif" width="1" height="1">
-->
</form>

<p>
Fediverse (Mastodon etc): <a href="https://fedi.spritesmods.com/fedi/sprite_tm" rel="me">@sprite_tm@fedi. spritesmods.com</a>
</p>
</div>
</div>
<div id="center">
<?php
 $f=fopen($meta["dir"]."/content.".$page,"r");
 if ($f===FALSE) die("Error!");
 $r=fgets($f);
 echo "<p><h1>$r</h1>\n";
 if ($meta["ads"]==1 && !$testversion) {
	if (!$doNewAds) doAds(0);
 }
 echo "</p>\n";
 echo "<!-- google_ad_section_start -->\n";
// fpassthru($f);
 $pagect="";
 while(!feof($f)) {
    $pagect.=fread($f,102400);
 }

 if (isset($_SERVER["HTTPS"])) {
    $repfrom=array("http://meuk.spritesserver.nl/");
    $repto=array("https://meuk.spritesserver.nl/");
    $pagect=str_replace($repfrom, $repto, $pagect);
 }

 echo eval("?>$pagect");
 echo "<!-- google_ad_section_end -->\n";
 fclose($f);
 if ($meta["ads"]==1 && !$testversion) {
    echo "<p>";
    if ($doNewAds) doNewAd(); else doAds(1);
    echo "</p>";
 }
 echo "<p id=\"prevnext\">";
 if (intval($page)>1) echo '<a href="?art='.htmlize($art).'&amp;page='.($page-1).'">&laquo Prev</a>';
 echo "&nbsp;".$page."&nbsp;";
 if (intval($page)<$meta["pages"]) echo '<a href="?art='.htmlize($art).'&amp;page='.($page+1).'">Next &raquo;</a>';
 echo "</p>";

 if ($page==$meta["pages"] && $meta["comments"]==1) {
    if (isset($_REQUEST["showall"]) && $_REQUEST["showall"]=="") {
	$r=mysqli_query($sqllink, "SELECT * FROM `comments` WHERE `artdir`='".mysqli_real_escape_string($sqllink, $meta["dir"])."' ORDER BY `date` DESC LIMIT 10"); //
	$no=mysqli_num_rows($r);
	if ($no==10) {
	    echo "<p /><strong>Last ".$no." comments</strong> ";
	    echo  '<a href="?art='.$meta["dir"].'&amp;page='.$page.'&amp;showall=true">Show all</a>';
	} else {
	    echo "<p /><strong>".mysqli_num_rows($r)." comments</strong>";
	}
    } else {
	$r=mysqli_query($sqllink, "SELECT * FROM `comments` WHERE `artdir`='".mysqli_real_escape_string($sqllink, $meta["dir"])."' ORDER BY `date` DESC");
	echo "<p /><strong>".mysqli_num_rows($r)." comments</strong>";
    }
    while ($c=mysqli_fetch_assoc($r)) {
	echo '<a id="cmtid'.$c["id"].'"></a>';
	echo '<div class="comment"><strong>'.htmlize($c["name"])." wrote at ".date("j M Y, G.i",$c["date"]).':</strong>';
	echo '<p>'.htmlize($c["comment"]).'</p></div>';
    }
    $s=time()^0xaaaaaaa;
    $ctxt=substr(md5($s."siekrut"),2,5);
    $ctxt=hexdec($ctxt)^0xeadbeef;

?>
<a id="leavecmt"></a>
<div class="comment">
<?php
    if (isset($cmterror) && $cmterror!="") {
	echo '<span class="error">'.$cmterror.'</span><br />';
    }
	$name="";
	if (isset($_REQUEST["name"])) $name=$_REQUEST["name"];
?>
Leave a comment:<form method="post" action="?#leavecmt">
<p>
<input type="hidden" name="page" value="<?php echo $page?>" />
<input type="hidden" name="art" value="<?php echo htmlize($art)?>" />
<input type="hidden" name="capval" value="<?php echo $s?>" />
Your name:<br />
<input type="text" name="name" value="<?php echo htmlize($name)?>" /><br />
What does this picture say?<br />
<img src="captcha/captcha.php?secret=<?php echo $ctxt?>" alt="Sorry, this is a captcha" /><br />
<?php
 $fn=rand(100000, 999999);
 $fn=strtr($fn, "0123456789", "abdeghjkxz");
 $com="";
 if (isset($_REQUEST["comment"])) $com=$_REQUEST["comment"]
?>
<input type="hidden" name="capfld" value="<?php echo $fn?>" />
<input type="text" name="<?php echo $fn?>" /><br />
Your comment:<br />
<textarea name="comment" rows="5" cols="60"><?php echo htmlize($com)?></textarea><br />
<input type="submit" name="postcomment" value="Comment" />
</p>
</form>
</div>
<?php
 }
echo '<br /><div class="copy">&copy; 2006-'.date('Y').' Sprite_tm - <a href="?art=contact&amp;af='.$meta["title"].'">Contact</a></div>';
include("admin/pagedetails.php");
?>
</div>
</body>
</html>
