<?php

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Version 1.0.2 (Coblynau)

 * Copyright (C) 2006-2007 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 *

 */

  // Set up gzip encoding before any output is sent

  $aggressive_optimize_html = false;

  global $do_gzip;

  $do_gzip = true;

  if(isset($_SERVER['PATH_INFO'])) $v = $_SERVER['PATH_INFO'];

  elseif(isset($_GET['title'])) $v = $_GET['title'];

  else $v = '';

  if ( isset($_GET['nocompress']) )

    $aggressive_optimize_html = false;

  error_reporting(E_ALL);

  // if(!strstr($v, 'CSS') && !strstr($v, 'UploadFile') && !strstr($v, 'DownloadFile')) // These pages are blacklisted because we can't have debugConsole's HTML output disrupting the flow of header() calls and whatnot

  // {

  //   $do_gzip = ( function_exists('gzcompress') && ( isset($_SERVER['HTTP_ACCEPT_ENCODING']) && strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') ) ) ? true : false;

  //   // Uncomment the following line to enable debugConsole (requires PHP 5 or later)

  //   // define('ENANO_DEBUG', '');

  // }

  if(defined('ENANO_DEBUG')) $do_gzip = false;

  if($aggressive_optimize_html || $do_gzip)

  {

    ob_start();

  }

  require('includes/common.php');

  global $db, $session, $paths, $template, $plugins; // Common objects

  if(!isset($_GET['do'])) $_GET['do'] = 'view';

  switch($_GET['do'])

  {

    default:

      die_friendly('Invalid action', '<p>The action "'.$_GET['do'].'" is not defined. Return to <a href="'.makeUrl($paths->page).'">viewing this page\'s text</a>.</p>');

      break;

    case 'view':

      // echo PageUtils::getpage($paths->page, true, ( (isset($_GET['oldid'])) ? $_GET['oldid'] : false ));

      $rev_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 );

      $page = new PageProcessor( $paths->cpage['urlname_nons'], $paths->namespace, $rev_id );

      $page->send_headers = true;

      $pagepass = ( isset($_REQUEST['pagepass']) ) ? sha1($_REQUEST['pagepass']) : '';

      $page->password = $pagepass;

      $page->send(true);

      break;

    case 'comments':

      $template->header();

      $sub = ( isset ($_GET['sub']) ) ? $_GET['sub'] : false;

      switch($sub)

      {

        case 'admin':

        default:

          $act = ( isset ($_GET['action']) ) ? $_GET['action'] : false;

          $id = ( isset ($_GET['id']) ) ? intval($_GET['id']) : -1;

          echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace, $act, Array('id'=>$id));

          break;

        case 'postcomment':

          if(empty($_POST['name']) ||

             empty($_POST['subj']) ||

             empty($_POST['text'])

             ) { echo 'Invalid request'; break; }

          $cid = ( isset($_POST['captcha_id']) ) ? $_POST['captcha_id'] : false;

          $cin = ( isset($_POST['captcha_input']) ) ? $_POST['captcha_input'] : false;

          PageUtils::addcomment($paths->cpage['urlname_nons'], $paths->namespace, $_POST['name'], $_POST['subj'], $_POST['text'], $cin, $cid); // All filtering, etc. is handled inside this method

          echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace);

          break;

        case 'editcomment':

          if(!isset($_GET['id']) || ( isset($_GET['id']) && !preg_match('#^([0-9]+)$#', $_GET['id']) )) { echo '<p>Invalid comment ID</p>'; break; }

          $q = $db->sql_query('SELECT subject,comment_data,comment_id FROM '.table_prefix.'comments WHERE comment_id='.$_GET['id']);

          if(!$q) $db->_die('The comment data could not be selected.');

          $row = $db->fetchrow();

          $db->free_result();

          $row['subject'] = str_replace('\'', ''', $row['subject']);

          echo '<form action="'.makeUrl($paths->page, 'do=comments&amp;sub=savecomment').'" method="post">';

          echo "<br /><div class='tblholder'><table border='0' width='100%' cellspacing='1' cellpadding='4'>

                  <tr><td class='row1'>" . $lang->get('comment_postform_field_subject') . "</td><td class='row1'><input type='text' name='subj' value='{$row['subject']}' /></td></tr>

                  <tr><td class='row2'>" . $lang->get('comment_postform_field_comment') . "</td><td class='row2'><textarea rows='10' cols='40' style='width: 98%;' name='text'>{$row['comment_data']}</textarea></td></tr>

                  <tr><td class='row1' colspan='2' class='row1' style='text-align: center;'><input type='hidden' name='id' value='{$row['comment_id']}' /><input type='submit' value='" . $lang->get('etc_save_changes') . "' /></td></tr>

                </table></div>";

          echo '</form>';

          break;

        case 'savecomment':

          if(empty($_POST['subj']) || empty($_POST['text'])) { echo '<p>Invalid request</p>'; break; }

          $r = PageUtils::savecomment_neater($paths->cpage['urlname_nons'], $paths->namespace, $_POST['subj'], $_POST['text'], (int)$_POST['id']);

          if($r != 'good') { echo "<pre>$r</pre>"; break; }

          echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace);

          break;

        case 'deletecomment':

          if(!empty($_GET['id']))

          {

            PageUtils::deletecomment_neater($paths->cpage['urlname_nons'], $paths->namespace, (int)$_GET['id']);

          }

          echo PageUtils::comments_html($paths->cpage['urlname_nons'], $paths->namespace);

          break;

      }

      $template->footer();

      break;

    case 'edit':

      if(isset($_POST['_cancel'])) { header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break; }

      if(isset($_POST['_save'])) {

        $e = PageUtils::savepage($paths->cpage['urlname_nons'], $paths->namespace, $_POST['page_text'], $_POST['edit_summary'], isset($_POST['minor']));

        header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break;

      }

      $template->header();

      if(isset($_POST['_preview']))

      {

        $text = $_POST['page_text'];

        echo PageUtils::genPreview($_POST['page_text']);

      }

      echo '

        <form action="'.makeUrl($paths->page, 'do=edit').'" method="post" enctype="multipart/form-data">

        <br />

        <textarea name="page_text" rows="20" cols="60" style="width: 97%;">'.$text.'</textarea><br />

        <br />

        ';

      if($paths->wiki_mode)

      echo '<br />

        </form>

      ';

      if ( getConfig('wiki_edit_notice') == '1' )

      {

        $notice = getConfig('wiki_edit_notice_text');

        echo RenderMan::render($notice);

      }

      $template->footer();

      break;

    case 'viewsource':

      $template->header();

      $text = RenderMan::getPage($paths->cpage['urlname_nons'], $paths->namespace, 0, false, false, false, false);

      echo '

        <form action="'.makeUrl($paths->page, 'do=edit').'" method="post">

        <br />

        <textarea readonly="readonly" name="page_text" rows="20" cols="60" style="width: 97%;">'.$text.'</textarea>';

      echo '<br />

        </form>

      ';

      $template->footer();

      break;

    case 'history':

      $hist = PageUtils::histlist($paths->cpage['urlname_nons'], $paths->namespace);

      $template->header();

      echo $hist;

      $template->footer();

      break;

    case 'rollback':

      $id = (isset($_GET['id'])) ? $_GET['id'] : false;

      if(!$id || !preg_match('#^([0-9]+)$#', $id)) die_friendly('Invalid action ID', '<p>The URL parameter "id" is not an integer. Exiting to prevent nasties like SQL injection, etc.</p>');

      $rb = PageUtils::rollback( (int) $id );

      $template->header();

      echo '<p>'.$rb.' <a href="'.makeUrl($paths->page).'">Return to the page</a>.</p>';

      $template->footer();

      break;

    case 'catedit':

      if(isset($_POST['__enanoSaveButton']))

      {

        unset($_POST['__enanoSaveButton']);

        $val = PageUtils::catsave($paths->cpage['urlname_nons'], $paths->namespace, $_POST);

        if($val == 'GOOD')

        {

          header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break;

        } else {

          die_friendly('Error saving category information', '<p>'.$val.'</p>');

        }

      }

      elseif(isset($_POST['__enanoCatCancel']))

      {

        header('Location: '.makeUrl($paths->page)); echo '<html><head><title>Redirecting...</title></head><body>If you haven\'t been redirected yet, <a href="'.makeUrl($paths->page).'">click here</a>.'; break;

      }

      $template->header();

      $c = PageUtils::catedit_raw($paths->cpage['urlname_nons'], $paths->namespace);

      echo $c[1];

      $template->footer();

      break;

    case 'moreoptions':

      $template->header();

      $template->footer();

      break;

    case 'protect':

      if (!isset($_REQUEST['level'])) die_friendly('Invalid request', '<p>No protection level specified</p>');

      if(!empty($_POST['reason']))

      {

        if(!preg_match('#^([0-2]*){1}$#', $_POST['level'])) die_friendly('Error protecting page', '<p>Request validation failed</p>');

        PageUtils::protect($paths->cpage['urlname_nons'], $paths->namespace, intval($_POST['level']), $_POST['reason']);

      }

      $template->header();

      ?>

      <form action="<?php echo makeUrl($paths->page, 'do=protect'); ?>" method="post">

        <input type="hidden" name="level" value="<?php echo $_REQUEST['level']; ?>" />

        <p><input type="text" name="reason" size="40" /><br />

             switch($_REQUEST['level'])

             {

               case '0':

                 break;

               case '1':

                 break;

               case '2':

                 break;

               default:

                 echo 'None;</b> Warning: request validation will fail after clicking submit<b>';

             }

           ?></b></p>

      </form>

      <?php

      $template->footer();

      break;

    case 'rename':

      if(!empty($_POST['newname']))

      {

        $r = PageUtils::rename($paths->cpage['urlname_nons'], $paths->namespace, $_POST['newname']);

      }

      $template->header();

      ?>

      <form action="<?php echo makeUrl($paths->page, 'do=rename'); ?>" method="post">

        <p><input type="text" name="newname" size="40" /></p>

      </form>

      <?php

      $template->footer();    

      break;

    case 'flushlogs':

      if(isset($_POST['_downthejohn']))

      {

        $template->header();

          $result = PageUtils::flushlogs($paths->cpage['urlname_nons'], $paths->namespace);

        $template->footer();

        break;

      }

      $template->header();

        ?>

        <form action="<?php echo makeUrl($paths->page, 'do=flushlogs'); ?>" method="post">

        </form>

        <?php

      $template->footer();

      break;

    case 'delvote':

      if(isset($_POST['_ballotbox']))

      {

        $template->header();

        $result = PageUtils::delvote($paths->cpage['urlname_nons'], $paths->namespace);

        $template->footer();

        break;

      }

      $template->header();

        ?>

        <form action="<?php echo makeUrl($paths->page, 'do=delvote'); ?>" method="post">

        </form>

        <?php

      $template->footer();

      break;

    case 'resetvotes':

      if(isset($_POST['_youmaylivealittlelonger']))

      {

        $template->header();

          $result = PageUtils::resetdelvotes($paths->cpage['urlname_nons'], $paths->namespace);

        $template->footer();

        break;

      }

      $template->header();

        ?>

        <form action="<?php echo makeUrl($paths->page, 'do=resetvotes'); ?>" method="post">

        </form>

        <?php

      $template->footer();

      break;

    case 'deletepage':

      if(isset($_POST['_adiossucker']))

      {

        $reason = ( isset($_POST['reason']) ) ? $_POST['reason'] : false;

        if ( empty($reason) )

        else

        {

          $template->header();

            $result = PageUtils::deletepage($paths->cpage['urlname_nons'], $paths->namespace, $reason);

          $template->footer();

          break;

        }

      }

      $template->header();

        ?>

        <form action="<?php echo makeUrl($paths->page, 'do=deletepage'); ?>" method="post">

           <?php if ( isset($error) ) echo "<p>$error</p>"; ?>

        </form>

        <?php

      $template->footer();

      break;

    case 'setwikimode':

      if ( isset($_POST['finish']) )

      {

        $level = intval($_POST['level']);

        if ( !in_array($level, array(0, 1, 2) ) )

        {

          die_friendly('Invalid request', '<p>Level not specified</p>');

        }

        $q = $db->sql_query('UPDATE '.table_prefix.'pages SET wiki_mode=' . $level . ' WHERE urlname=\'' . $db->escape($paths->cpage['urlname_nons']) . '\' AND namespace=\'' . $paths->namespace . '\';');

        if ( !$q )

          $db->_die();

      }

      else

      {

        $template->header();

        if(!isset($_GET['level']) || ( isset($_GET['level']) && !preg_match('#^([0-9])$#', $_GET['level']))) die_friendly('Invalid request', '<p>Level not specified</p>');

          $level = intval($_GET['level']);

          if ( !in_array($level, array(0, 1, 2) ) )

          {

            die_friendly('Invalid request', '<p>Level not specified</p>');

          }

        echo '<form action="' . makeUrl($paths->page, 'do=setwikimode', true) . '" method="post">';

        echo '<input type="hidden" name="finish" value="foo" />';

        echo '<input type="hidden" name="level" value="' . $level . '" />';

        ?>

        <?php

        echo '</form>';

        $template->footer();

      }

      break;

    case 'diff':

      $template->header();

      $id1 = ( isset($_GET['diff1']) ) ? (int)$_GET['diff1'] : false;

      $id2 = ( isset($_GET['diff2']) ) ? (int)$_GET['diff2'] : false;

      if(!$id1 || !$id2) { echo '<p>Invalid request.</p>'; $template->footer(); break; }

      if(!preg_match('#^([0-9]+)$#', (string)$_GET['diff1']) ||

         !preg_match('#^([0-9]+)$#', (string)$_GET['diff2']  )) { echo '<p>SQL injection attempt</p>'; $template->footer(); break; }

      echo PageUtils::pagediff($paths->cpage['urlname_nons'], $paths->namespace, $id1, $id2);

      $template->footer();

      break;

    case 'detag':

      if ( $session->user_level < USER_LEVEL_ADMIN )

      {

      }

      if ( $paths->page_exists )

      {

      }

      $q = $db->sql_query('DELETE FROM '.table_prefix.'tags WHERE page_id=\'' . $db->escape($paths->cpage['urlname_nons']) . '\' AND namespace=\'' . $paths->namespace . '\';');

      if ( !$q )

        $db->_die('Detag query, index.php:'.__LINE__);

      break;

    case 'aclmanager':

      $data = ( isset($_POST['data']) ) ? $_POST['data'] : Array('mode' => 'listgroups');

      PageUtils::aclmanager($data);

      break;

  }

  //

  // Optimize HTML by replacing newlines with spaces (excludes <pre>, <script>, and <style> blocks)

  //

  if ($aggressive_optimize_html)

  {

    // Load up the HTML

    $html = ob_get_contents();

    ob_end_clean();

    $html = aggressive_optimize_html($html);

    // Re-enable output buffering to allow the Gzip function (below) to work

    ob_start();

    // Done, send it to the user

    echo( $html );

  }

  $db->close();  

  gzip_output();

?>