<?php
/*
Te Doen:
-process_output ombouwen naar bbcode
-Opmaak.. errm... maken
*/
// include ("/var/www/abbc/abbc.lib.php");
function process_output($in) {
    return htmlentities(stripslashes($in));
//    return abbc_proc($in);
}
 include("config.php");
 $dbc=mysqli_connect($CFG_DBSERVER,$CFG_DBUSER,$CFG_DBPWD);
 mysqli_select_db($dbc, $CFG_DB);
 $admin=0;
 if (isset($_COOKIE["fotopwd"]) && $_COOKIE["fotopwd"]==$CFG_PWDMD5) $admin=1;
 $foto=$_REQUEST["foto"]??"";
 $album=$_REQUEST["album"]??"";
 $action=$_REQUEST["action"]??"";
 if ($action=="login") {
    setcookie("fotopwd",md5($_REQUEST["password"]),time()+(60*60));
    header("Location: ?");
 }
 if ($action=="post") {
    if ($_REQUEST["name"]=="") die("Please enter a name.");
    if ($_REQUEST["mail"]=="") die("Please enter a e-mail-adress.");
    if ($_REQUEST["text"]=="") die("Your posting is empty.");
    setcookie("foto_name",$_REQUEST["name"],time()+(60*60*24*30));
    setcookie("foto_mail",$_REQUEST["mail"],time()+(60*60*24*30));
    $r_mail=mysqli_real_escape_string($dbc, $_REQUEST["mail"]);
    $r_name=mysqli_real_escape_string($dbc, $_REQUEST["name"]);
    $r_text=mysqli_real_escape_string($dbc, $_REQUEST["text"]);
    $spam=false;
    $t=$_REQUEST["t"]+102456;
    if ($t-5>time()) $spam=true;
    if ($t<time()-(30*60)) $spam=true;
    if (stristr($_REQUEST["text"],"<a href")!==false) $spam=true;
    if (!$spam) {
	$res=mysqli_query($dbc, "INSERT INTO `comments` (`foto`,`date`,`mail`,`nick`,`text`) VALUES ('".$foto."','".time()."','".$r_mail."','".$r_name."','".$r_text."')") or die(mysqli_error($dbc));
    }
    header("Location: ?album=".$album."&foto=".$foto);
 }
 ?>
<head><title><?php echo $CFG_TITLE;?></title></head>
<body>
<?php
 $frompic=intval($_REQUEST["from"]??"0");
 $topic=$frompic+30;
 if ($frompic<0) $frompic=0;

 if ($action=="chgtags" && $admin!=0) {
    $res=mysqli_query($dbc, "SELECT * FROM `albums` WHERE 1") or die(mysqli_error($dbc));
    while ($r=mysqli_fetch_array($res)) {
		mysqli_query($dbc, "UPDATE `albums` SET `tag`='".mysqli_real_escape_string($dbc, $_REQUEST["tag_".$r["id"]])."' WHERE `id`='".mysqli_real_escape_string($dbc, $r[id])."'") or die(mysqli_error($dbc));

    }     
 }
 if ($action=="update-albums" && $admin!=0) {
    $dir=opendir("foto");
    while ($d=readdir($dir)) {
	$d=mysqli_real_escape_string($dbc, $d);
	if ($d!="." && $d!="..") {
	    $res=mysqli_query($dbc, "SELECT * FROM `albums` WHERE `name`='$d'") or die(mysqli_error($dbc));
	    if (!mysqli_fetch_array($res)) {
		echo "Creating album $d...<br>";
		mysqli_query($dbc, "INSERT INTO `albums` (`name`,`tag`) VALUES ('".$d."','')") or die(mysqli_error($dbc));
	    }
	}
    }
 }
 if (($action=="update-fotos" && $admin!=0) || ($_GET["doupdate"]??"")=="jagraag") {
    $res=mysqli_query($dbc, "SELECT * FROM `albums` WHERE `id`='".mysqli_real_escape_string($dbc, $album)."'") or die(mysqli_error($dbc)); //'
    $a=mysqli_fetch_assoc($res);
    $f=explode(' ',$a["fotos"]);
    $dir=opendir("foto/".$a["name"]);
    echo "foto/".$a["name"]."<br>";
    while ($d=readdir($dir)) {
	if (strpos(strtolower($d),".jpg")!=FALSE && substr(strtolower($d),0,4)!="tmb-") {
	    echo "$d";
	    $res=mysqli_query($dbc, "SELECT * FROM `fotos` WHERE `album`='".mysqli_real_escape_string($dbc, $album)."' AND `file`='".mysqli_real_escape_string($dbc, $d)."'") or die(mysqli_error($dbc)); //'
	    if (!mysqli_fetch_array($res)) {
		echo " is new.";
		$res=mysqli_query($dbc, "INSERT INTO `fotos` (`album`,`file`,`visible`,`tag`,`prio`) VALUES ('".mysqli_real_escape_string($dbc, $album)."','".mysqli_real_escape_string($dbc, $d)."','1','','0')") or die(mysqli_error($dbc));
	    }
	    if (!file_exists("foto/".$a["name"].'/tmb-'.$d)) {
		echo " -> No thumbnail yet. Creating tmb-".$d."...<br>";
		set_time_limit(30);
		flush();
		chdir("foto/".$a["name"]."/");
		system("exiftran -a -i ".$d);
		$img=imagecreatefromjpeg($d);
		chdir("../..");
		$maxx=500; $maxy=600;
		//$maxx=400; $maxy=300;
		$sy=imagesy($img);
		$sx=imagesx($img);
		if ($sx>$maxx) {
		    $sy=($maxx/$sx)*$sy;
		    $sx=$maxx; 
		}
		if ($sy>$maxy) {
		    $sx=($maxy/$sy)*$sx;
		    $sy=$maxy; 
		}
		$tmb=imagecreatetruecolor($sx,$sy);
		imagecopyresampled($tmb,$img,0,0,0,0,$sx,$sy,imagesx($img),imagesy($img));
		imagejpeg($tmb,"foto/".$a["name"].'/tmb-'.$d,95);
	    }
	    echo "<br>";
	}
    }
 }
 if ($action=='update-tags' && $admin!=0) {
    $res=mysqli_query($dbc, "SELECT * FROM `albums` WHERE `id`='".$album."'") or die(mysqli_error($dbc)); //'
    $a=mysqli_fetch_assoc($res);
    $res=mysqli_query($dbc, "SELECT * FROM `fotos` WHERE `album`='".$album."' LIMIT $frompic,30");
    $rethumb=0;
    while ($v=mysqli_fetch_assoc($res)) {
	if (isset($_REQUEST["vis_".$v["id"]])) $vs=1; else $vs=0;
	if (isset($_REQUEST["nobr_".$v["id"]])) $nbr=1; else $nbr=0;
	if (isset($_REQUEST["rotl_".$v["id"]])) {
	    system('exiftran -i -p -2 "foto/'.$a["name"].'/'.$v["file"].'" "foto/'.$a["name"].'/tmb-'.$v["file"].'"');
	    echo htmlentities('exiftran -i -p -2 "foto/'.$a["name"].'/'.$v["file"].'" "foto/'.$a["name"].'/tmb-'.$v["file"].'"').'<br>';
	}
	if (isset($_REQUEST["rotr_".$v["id"]])) {
	    system('exiftran -i -p -9 "foto/'.$a["name"].'/'.$v["file"].'" "foto/'.$a["name"].'/tmb-'.$v["file"].'"');
	    echo htmlentities('exiftran -p -9 "foto/'.$a["name"].'/'.$v["file"].'" "foto/'.$a["name"].'/tmb-'.$v["file"].'"').'<br>';
	}
//	echo $vs."<br>";
	mysqli_query($dbc, "UPDATE `fotos` SET `tag`='".mysqli_real_escape_string($dbc, $_REQUEST["tag-".$v["id"]])."', `visible`='".$vs."', `nobr`='".$nbr."', `pos`='".$_REQUEST["pos_".$v["id"]]."' WHERE `id`='".$v["id"]."'") or die(mysqli_error($dbc)); //'
    }
 }
 if ($album=="") {
     echo '<form method="post"><input type="hidden" name="action" value="login"><input type="password" name="password"><input type="submit" value="login"></form><br>';
    $res=mysqli_query($dbc, "SELECT * FROM `albums` WHERE 1") or die(mysqli_error($dbc)); 
    if ($admin!=0) echo '<form method="post"><input type="hidden" name="action" value="chgtags">';
    while ($album=mysqli_fetch_assoc($res)) {
	if ($admin==0) {
	    if ($album["tag"]!="INVISIBLE") {
		echo '<a href="?album='.$album["id"].'">'.$album["name"].'</a> - '.process_output($album["tag"])."<br>\n";
	    }
	} else {
	    echo '<a href="?album='.$album["id"].'">'.$album["name"].'</a> - ';
	    echo '<textarea rows="8" cols="80" name="tag_'.$album["id"].'">'.$album["tag"]."</textarea><br>\n";
	}
    }
    if ($admin!=0) echo '<input type="submit" value="Update tags"></form><form method="post"><input type="hidden" name="action" value="update-albums"><input type="submit" value="Reload albums"></form>';
 } else if ($foto=="") {
    echo '<center>';
    if ($frompic>0) echo '<a href="?album='.$album.'&from='.($frompic-30).'">Prev page &lt;-</a> ';
    echo '<a href="?">Up</a> <a href="?album='.$album.'&from='.($frompic+30).'">-&gt; Next page</a><br>';
    $res=mysqli_query($dbc, "SELECT * FROM `albums` WHERE `id`='".$album."'") or die(mysqli_error($dbc)); //'
    $a=mysqli_fetch_assoc($res);
    echo "<b>".$a["name"]."</b><br><i>".$a["tag"]."</i><br><br>\n";
    if ($admin==0) $visclause=" AND `visible`='1'"; else  $visclause='';
    $res=mysqli_query($dbc, "SELECT * FROM `fotos` WHERE `album`='".$album."'".$visclause." ORDER BY `pos`,`file` LIMIT $frompic,30") or die(mysqli_error($db)); //'
    if ($admin!=0) echo '<form method="post"><input type="hidden" name="action" value="update-tags"><input type="hidden" name="album" value="'.$album.'">';
    while ($v=mysqli_fetch_assoc($res)) {
	echo '<a href="foto/'.$a["name"].'/'.$v["file"].'"><img src="foto/'.$a["name"].'/tmb-'.$v["file"].'"></a>';
	if ($v["nobr"]==0) echo "<br>";
	if ($admin!=0) {
	    echo '<font size="-2">[url=https://meuk.spritesserver.nl/foto/foto/'.$a["name"].'/'.$v["file"].'][img]https://meuk.spritesserver.nl/foto/foto/'.$a["name"].'/tmb-'.$v["file"].'[/img][/url]</font><br>';
	    echo '<font size="-2">&lt;a href="https://meuk.spritesserver.nl/foto/foto/'.$a["name"].'/'.$v["file"].'"&gt;&lt;img src="https://meuk.spritesserver.nl/foto/foto/'.$a["name"].'/tmb-'.$v["file"].'" /&gt;&lt;/a&gt;</font><br>';
	    if ($v["visible"]!=0) $c=" CHECKED"; else $c="";
	    if ($v["nobr"]!=0) $d="CHECKED"; else $d="";
    	    echo '<input type="checkbox" name="vis_'.$v["id"].'" value="1"'.$c.'>Visible';
	    echo '<input type="checkbox" name="nobr_'.$v["id"].'" value="1"'.$d.'>NoBR';
	    echo '<input type="checkbox" name="rotl_'.$v["id"].'" value="1"><img src="rotl.jpeg">';
	    echo '<input type="checkbox" name="rotr_'.$v["id"].'" value="1"><img src="rotr.jpeg">';
	    echo ' Pos: <input type="text" name="pos_'.$v["id"].'" value="'.$v["pos"].'"><br>';
	    echo '<textarea name="tag-'.$v["id"].'" rows=4 cols=80>'.$v["tag"]."</textarea><br><br>";
	} else {
	    echo process_output($v["tag"]);
	    if ($v["nobr"]==0) echo "<br>";
	}
/*
	if ($v["nobr"]==0) {
	    $cmt=mysql_query("SELECT * FROM `comments` WHERE `foto`='".$v["id"]."'") or die(mysql_error()); //'
	    $s=mysql_num_rows($cmt)==1?"":"s";
	    echo '<a href="?album='.$album.'&foto='.$v["id"].'&from='.$frompic.'">'.mysql_num_rows($cmt).' comment'.$s.'</a><br>';
	}
*/
    }
    if ($admin!=0) {
	echo '<input type="submit" value="Verander tags"></form>';
	echo '<form method="post">';
	echo '<input type="hidden" name="action" value="update-fotos">';
	echo '<input type="hidden" name="album" value="'.$a["id"].'">';
	echo '<input type="submit" value="Update db">';
	echo '</form>';
    }
    echo '<a href="?album='.$album.'&from='.($frompic-30).'">&lt;-</a> <a href="?">Up</a> <a href="?album='.$album.'&from='.($frompic+30).'">-&gt;</a><br>';
    echo '</center>';
 } else {
    $res=mysqli_query($dbc, "SELECT * FROM `albums` WHERE `id`='".$album."'") or die(mysqli_error($dbc));
    $a=mysqli_fetch_array($res);
    $res=mysqli_query($dbc, "SELECT * FROM `fotos` WHERE `id`='".$foto."' ORDER BY `prio`") or die(mysqli_error($dbc));
    $v=mysqli_fetch_array($res);
    echo '<a href="?album='.$album.'&from='.$frompic.'">Terug naar gallerij</a> -- <a href="?">Terug naar hoofdmenu</a><br>';
    echo '<a href="foto/'.$a["name"].'/'.$v["file"].'"><img src="foto/'.$a["name"].'/tmb-'.$v["file"].'"></a><br>';
    echo '<i>'.process_output($v["tag"]).'</i><br><br><u>Commentaar:</u><br>';
    $res=mysqli_query($dbc, "SELECT * FROM `comments` WHERE `foto`='".$foto."'") or die(mysqli_error($dbc));
    while ($c=mysqli_fetch_assoc($res)) {
	echo '<font size="-1">Door '.$c["nick"].' op '.date('D M j Y H:i T',$c['date']).'</font><br>';
	echo process_output($c["text"])."<br><br>";
    }
    echo '<b>Reply:</b>';
    echo '<form method="post"><input type="hidden" name="action" value="post">';
    echo 'Name: <input type="text" name="name" value="'.$_COOKIE["foto_name"].'"> E-mail: <input type="text" name="mail" value="'.$_COOKIE["foto_mail"].'"><br>';
    echo '<textarea name="text" wrap="virtual" rows="8" cols="80"></textarea>';
    echo '<input type="hidden" name="from" value="'.$frompic.'">';
    echo '<input type="hidden" name="t" value="'.(time()-102456).'">';
    echo '<br><input type="submit" value="Post" accesskey="s"></form>';
 }
 ?>