newcomment.php

   1 <?php
   2 /*=====================================================================*\
   3 || ################################################################### ||
   4 || # [#]app[#] [#]version[#]
   5 || # --------------------------------------------------------------- # ||
   6 || # All parts of this file are ©2003-[#]year[#] Iris Studios, Inc. No     # ||
   7 || # part of this file may be reproduced in any way: part or whole.  # ||
   8 || # --------------------------------------------------------------- # ||
   9 || # ©2003 - [#]year[#] Iris Studios, Inc. | http://www.iris-studios.com   # ||
  10 || ################################################################### ||
  11 \*=====================================================================*/
  12
  13 require_once('./global.php');
  14
  15 if (!($bugsys->userinfo['permissions'] & CANPOSTCOMMENTS))
  16 {
  17         echo 'no permission';
  18         exit;
  19 }
  20
  21 // ###################################################################
  22
  23 if (empty($_REQUEST['do']))
  24 {
  25         $_REQUEST['do'] = 'add';
  26 }
  27
  28 // ###################################################################
  29
  30 if ($_POST['do'] == 'insert')
  31 {
  32         sanitize(array('bugid' => INT, 'comment' => STR));
  33
  34         $vars['comment_parsed'] = $vars['comment'];
  35
  36         if (!$bugsys->options['allowhtml'])
  37         {
  38                 $vars['comment_parsed'] = htmlspecialcharslike($vars['comment_parsed']);
  39         }
  40
  41         $DB_sql->query("
  42                 INSERT INTO " . TABLE_PREFIX . "comment
  43                         (bugid, userid, dateline, comment, comment_parsed)
  44                 VALUES
  45                         ($vars[bugid], " . $bugsys->userinfo['userid'] . ",
  46                         " . time() . ", '" . addslasheslike($vars['comment']) . "',
  47                         '" . addslasheslike(nl2br($vars['comment_parsed'])) . "'
  48                 )"
  49         );
  50
  51         echo 'comment inserted';
  52 }
  53
  54 // ###################################################################
  55
  56 if ($_REQUEST['do'] == 'add')
  57 {
  58         sanitize(array('bugid' => INT));
  59
  60         if (!$vars['bugid'])
  61         {
  62                 echo 'alert: bad bug';
  63                 exit;
  64         }
  65
  66         $bug = $DB_sql->query_first("SELECT bug.*, comment.comment FROM " . TABLE_PREFIX . "bug LEFT JOIN " . TABLE_PREFIX . "comment AS comment ON (bug.bugid = comment.bugid) WHERE bug.bugid = $vars[bugid]");
  67         if (!$bug)
  68         {
  69                 echo 'alert: bad bug';
  70                 exit;
  71         }
  72
  73         echo "<div><strong>New comment for:</strong> <em>$bug[summary]</em></div>";
  74         echo '<form name="newcomment" method="post" action="newcomment.php"><input type="hidden" name="do" value="insert" /><input type="hidden" name="bugid" value="' . $bug['bugid'] . '" />';
  75         echo '<div><strong>Comment:</strong></div><textarea name="comment" cols="100" rows="35"></textarea>';
  76         echo '<div><input type="submit" name="submit" value="Add Comment" /></form>';
  77
  78         echo '<br /><br /><table border="1" cellspacing="2" cellpadding="4" width="100%"><tr style="background-color:#EEEEEE"><td><strong>Summary Report:</strong> ' . $bug['summary'] . '</td></tr>';
  79         echo '<tr><td>' . $bug['comment'] . '</td></tr></table>';
  80 }
  81
  82 /*=====================================================================*\
  83 || ###################################################################
  84 || # $HeadURL$
  85 || # $Id$
  86 || ###################################################################
  87 \*=====================================================================*/
  88 ?>