editcomment.php

   1 <?php
   2 /*=====================================================================*\
   3 || ################################################################### ||
   4 || # [#]app[#] [#]version[#]
   5 || # --------------------------------------------------------------- # ||
   6 || # All parts of this file are ©2003-[#]year[#] Iris Studios, Inc. No     # ||
   7 || # part of this file may be reproduced in any way: part or whole.  # ||
   8 || # --------------------------------------------------------------- # ||
   9 || # ©2003 - [#]year[#] Iris Studios, Inc. | http://www.iris-studios.com   # ||
  10 || ################################################################### ||
  11 \*=====================================================================*/
  12
  13 require_once('./global.php');
  14
  15 sanitize(array('commentid' => INT));
  16
  17 $comment = $DB_sql->query_first("
  18         SELECT comment.*, user.email, user.showemail, user.displayname
  19         FROM " . TABLE_PREFIX . "comment AS comment
  20         LEFT JOIN " . TABLE_PREFIX . "user AS user
  21                 ON (comment.userid = user.userid)
  22         WHERE comment.commentid = $vars[commentid]"
  23 );
  24
  25 if (!$comment)
  26 {
  27         echo 'alert: bad comment';
  28         exit;
  29 }
  30
  31 $bug = $DB_sql->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = $comment[bugid]");
  32
  33 if (!((can_perform('caneditown') AND $bugsys->userinfo['userid'] == $comment['userid']) OR can_perform('caneditothers')))
  34 {
  35         echo 'no permission';
  36         exit;
  37 }
  38
  39 // ###################################################################
  40
  41 if (empty($_REQUEST['do']))
  42 {
  43         $_REQUEST['do'] = 'edit';
  44 }
  45 /*
  46 #*# do these later after we work out some kind of permission system
  47 // ###################################################################
  48
  49 if ($_REQUEST['do'] == 'kill')
  50 {
  51         // run code to remove item in database
  52 }
  53
  54 // ###################################################################
  55
  56 if ($_REQUEST['do'] == 'delete')
  57 {
  58         // display delete confirmation message
  59 }*/
  60
  61 // ###################################################################
  62
  63 if ($_POST['do'] == 'update')
  64 {
  65         sanitize(array('comment' => STR));
  66
  67         if (!$vars['comment'])
  68         {
  69                 echo 'you need to enter some text';
  70                 exit;
  71         }
  72
  73         $vars['comment_parsed'] = $vars['comment'];
  74
  75         if (!$bugsys->options['allowhtml'])
  76         {
  77                 $vars['comment_parsed'] = htmlspecialcharslike($vars['comment_parsed']);
  78         }
  79
  80         $DB_sql->query("
  81                 UPDATE " . TABLE_PREFIX . "comment
  82                 SET comment = '" . addslasheslike($vars['comment']) . "',
  83                         comment_parsed = '" . addslasheslike(nl2br($vars['comment_parsed'])) . "'
  84                 WHERE commentid = $vars[commentid]"
  85         );
  86
  87         echo 'comment saved';
  88 }
  89
  90 // ###################################################################
  91
  92 if ($_REQUEST['do'] == 'edit')
  93 {
  94         echo "<div><strong>Bug:</strong> $bug[summary]</div>";
  95         echo "<div><strong>Comment posted on:</strong> " . datelike('standard', $comment['dateline']) . "</div>";
  96         echo "<div><strong>Comment posted by:</strong> " . construct_user_display($comment) . "</div>";
  97         echo '<form name="editcomment" method="post" action="editcomment.php"><input type="hidden" name="do" value="update" /><input type="hidden" name="commentid" value="' . $comment['commentid'] . '" />';
  98         echo '<div><strong>Comment:</strong></div><textarea name="comment" cols="100" rows="35">' . htmlspecialcharslike($comment['comment']) . '</textarea>';
  99         echo '<div><input type="submit" name="submit" value="Save Changes" /></div></form>';
 100 }
 101
 102 /*=====================================================================*\
 103 || ###################################################################
 104 || # $HeadURL$
 105 || # $Id$
 106 || ###################################################################
 107 \*=====================================================================*/
 108 ?>