*/
if(!defined('MTC')) define('MTC','MTC'); // used for all POST/GET vars and CSS classes
// The MTC main class
class MTC {
// DB connection
var $db_host = 'localhost';
var $db_user = 'mtc';
var $db_pass = 'mtc';
var $db_name = 'mtc';
// web path to the class file
var $self = 'mtc.class.php';
// antispam
var $blacklist = 'blacklist.txt';
var $captcha = true;
var $audio = false;
var $showmail = false;
// output
var $addcss = true;
var $target = '';
// admin stuff
var $adminpass = '';
var $notify = '';
var $gravopts = '&rating=R';
// language strings
var $lang = array(
'name' => 'Your Name:',
'email' => 'Your E-Mail:',
'web' => 'Website (optional):',
'captcha' => 'Security Code:',
'comment' => 'Your two Cents:',
'info' => 'No HTML allowed. URLs will be linked with nofollow attribute. Whitespace is preserved.',
'audio' => 'Click to hear the security code spelled.',
'nofield' => 'Sorry, you need to fill all necessary fields!',
'noemail' => 'Sorry, this mail address doesn\'t look valid.',
'noweb' => 'Sorry, this web address doesn\'t look valid.',
'nocaptcha' => 'Sorry, the security code was wrong.',
'nospam' => 'Sorry, spamming is not allowed here.',
);
// you may want to change this for more secure captchas
var $secret = 'CHANGEME!';
// internal only
var $db_link;
var $captchafnt;
var $audiodir = '';
var $message = '';
var $page = '';
var $seedlen = 0;
var $seedpos = 0;
/**
* Constructor
*/
function MTC(){
// set some defaults
$this->captchafnt = glob(dirname(__FILE__).'/MTC/fonts/*.ttf');
$this->audiodir = dirname(__FILE__).'/MTC/audio/';
}
/**
* Initialize variables
*/
function setup(){
// auto set the secret (for lazy ones)
$this->secret .= $_SERVER['HTTP_USER_AGENT'];
$this->secret .= $_SERVER['SERVER_SOFTWARE'];
$this->secret .= __FILE__;
$this->secret = md5($this->secret);
// use initialized random generator to create two secret numbers
srand(hexdec(substr($this->secret,0,6))); // init random generator
$this->seedpos = rand(0,4);
$this->seedlen = rand(3,5);
srand(); // make generator random again
}
/**
* To be called in the head section. Handles intializing
* and POST/GET variables
*/
function init($page = ''){
$this->setup();
if(!$page){
$this->page = $_SERVER['PHP_SELF'];
}else{
$this->page = $page;
}
if($this->target){
$this->target = 'target="'.$this->target.'"';
}
// we do not touch other's variables
if(get_magic_quotes_gpc() && !defined('MAGIC_QUOTES_STRIPPED')){
if (!empty($_POST[MTC])) $this->_remove_magic_quotes($_POST[MTC]);
if (!empty($_GET[MTC])) $this->_remove_magic_quotes($_GET[MTC]);
if (!empty($_REQUEST[MTC])) $this->_remove_magic_quotes($_REQUEST[MTC]);
}
echo $this->print_css();
if($_POST[MTC]['do'] == 'add'){
$this->_add_comment();
}else if($_POST[MTC]['do'] == 'del'){
$this->_del_comment();
}
}
/**
* return the number of comments
*/
function comment_count($page=''){
if(!$page) $page = $this->page;
$page = md5($page);
$sql = "SELECT COUNT(*) as cnt
FROM mtc_comments
WHERE page = '$page'";
$handle = $this->_get_dbhandle();
if(!$handle) return false;
$result = mysql_query($sql,$handle);
$row = mysql_fetch_assoc($result);
mysql_free_result($result);
return $row['cnt'];
}
/**
* List available comments
*/
function comments($page=''){
if(!$page) $page = $this->page;
$page = md5($page);
$sql = "SELECT id, name, mail, web, text, date
FROM mtc_comments
WHERE page = '$page'
ORDER BY date";
$handle = $this->_get_dbhandle();
if(!$handle) return;
$result = mysql_query($sql,$handle);
while ($row = mysql_fetch_assoc($result)) {
$this->format_comment($row);
}
mysql_free_result($result);
}
/**
* Show the form to add new comments
*/
function comment_form(){
echo '
';
$this->_print_message();
echo '';
echo '
';
}
/**
* Defines how a comment is printed. You may want to tweak this, but using CSS should be
* enough usually
*/
function format_comment($row){
static $number = 0;
$number++;
$md5 = md5($row['mail']);
$obf = strtr($row['mail'],array('@' => ' [at] ', '.' => ' [dot] ', '-' => ' [dash] '));
$text = htmlspecialchars($row['text']);
$text = preg_replace('/\t/',' ',$text);
$text = preg_replace('/ /',' ',$text);
$text = preg_replace_callback('/((https?|ftp):\/\/[\w-?&;:#~=\.\/\@]+[\w\/])/ui',
array($this,'_format_link'),$text);
$text = nl2br($text);
$opts = str_replace('@MD5@',$md5,$this->gravopts);
echo '
';
}
/**
* Connect to the database and return a handle
*/
function _get_dbhandle(){
if($this->link) return $this->link;
$this->link = @mysql_connect($this->db_host, $this->db_user, $this->db_pass);
if(!$this->link){
$this->message .= 'Could not connect to database: '.mysql_error();
return false;
}
if(!@mysql_select_db($this->db_name)){
$this->message .= 'Could not select database';
return false;
}
return $this->link;
}
/**
* Uses a regular expresion to check if a given mail address is valid
*
* May not be completly RFC conform!
*
* @link http://www.webmasterworld.com/forum88/135.htm
*
* @param string $email the address to check
* @return bool true if address is valid
*/
function _isvalid_mail($email){
return eregi("^[0-9a-z]([+-_.]?[0-9a-z])*@[0-9a-z]([-.]?[0-9a-z])*\\.[a-z]{2,4}$", $email);
}
/**
* Spamcheck against wordlist
*
* Checks the wikitext against a list of blocked expressions
* returns true if the text contains any bad words
*
* @author Andreas Gohr
*/
function _check_blacklist($text){
if(!@file_exists($this->blacklist)) return false;
$blockfile = file($this->blacklist);
//how many lines to read at once (to work around some PCRE limits)
if(version_compare(phpversion(),'4.3.0','<')){
//old versions of PCRE define a maximum of parenthesises even if no
//backreferences are used - the maximum is 99
//this is very bad performancewise and may even be too high still
$chunksize = 40;
}else{
//read file in chunks of 600 - this should work around the
//MAX_PATTERN_SIZE in modern PCRE
$chunksize = 200;
}
while($blocks = array_splice($blockfile,0,$chunksize)){
$re = array();
#build regexp from blocks
foreach($blocks as $block){
$block = preg_replace('/#.*$/','',$block);
$block = trim($block);
if(empty($block)) continue;
$re[] = $block;
}
if(preg_match('#('.join('|',$re).')#si',$text)) return true;
}
return false;
}
/**
* remove magic quotes recursivly
*
* @author Andreas Gohr
*/
function _remove_magic_quotes(&$array) {
if(!is_array($array)) return;
foreach (array_keys($array) as $key) {
if (is_array($array[$key])) {
remove_magic_quotes($array[$key]);
}else {
$array[$key] = stripslashes($array[$key]);
}
}
}
/**
* Escape a given string as hex entities
*/
function _hexescape($string){
$encode = '';
for ($x=0; $x < strlen($string); $x++) $encode .= '&#x' . bin2hex($string{$x}).';';
return $encode;
}
/**
* Escape a given string as url entities
*/
function _urlescape($string){
$encode = '';
for ($x=0; $x < strlen($string); $x++) $encode .= '%' . bin2hex($string{$x});
return $encode;
}
/**
* Simple XOR encryption
*
* @author Dustin Schneider
* @link http://www.phpbuilder.com/tips/item.php?id=68
*/
function x_Encrypt($string, $key){
for($i=0; $icaptcha_image();
}elseif($_REQUEST['MTC']['do'] == 'audio'){
$mtc = new MTC();
$mtc->captcha_audio();
}
//Setup VIM: ex: et ts=4 enc=utf-8 :
?>
';
echo ''.$number.'';
echo '