<?php
/************************************************************************/
/* Maximus CMS: Web Portal System                                       */
/* ==============================                                       */
/*                                                                      */
/* Copyright (c) 2002 - 2007                                            */
/* http://www.php-maximus.org                                           */
/* dev@php-maximus.org                                                  */
/*                                                                      */
/* This program is free software. You can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 2 of the License.       */
/************************************************************************/
/* Based on PHP-NUKE: Web Portal System                                 */
/************************************************************************/
/* Portage Coppermine Photo Gallery                                     */
/************************************************************************/
defined('MAXIMUS') or require_once("mainfile.php");

$pagetitle = "- Coppermine";

define('IN_COPPERMINE', true);
define('RATEPIC_PHP', true);

switch($func) {
default:
incoh();
require('modules/Coppermine/include/init.inc.php');


// Check if required parameters are present
if (!isset($_GET['pic']) || !isset($_GET['rate'])) cpg_die(CRITICAL_ERROR, $lang_errors['param_missing'], __FILE__, __LINE__);

$pic  = secure( $_GET['pic'], 'num', 1, 'sec' );
$rate = secure( $_GET['rate'], 'num', 1, 'sec' );

$rate = min($rate, 5);
$rate = max($rate, 0);
// If user does not accept script's cookies, we don't accept the vote
if (!isset($_COOKIE[$CONFIG['cookie_name'] . '_data'])) {
    header('Location: modules.php?name=Coppermine&op=displayimage&amp;pos=' . (- $pic));
    exit;
}
// If referer is not displayimage.php we don't accept the vote
if (!eregi("displayimage",$_SERVER["HTTP_REFERER"])){
    header('Location: modules.php?name=Coppermine&op=displayimage.php?pos=' . (- $pic));
    exit;
}

// Retrieve picture/album information & check if user can rate picture
$sql = "SELECT a.votes as votes_allowed, p.votes as votes, pic_rating ".
	   "FROM `".TABLE_CPG_PICTURES."` AS p, `".TABLE_CPG_ALBUMS."` AS a ".
	   "WHERE p.aid = a.aid AND `pid` = '$pic' LIMIT 1";
$result = $GLOBALS['db']->sql_query($sql);
if (!$GLOBALS['db']->sql_numrows($result)) cpg_die(CRITICAL_ERROR, $lang_errors['non_exist_ap'], __FILE__, __LINE__);
$row = $GLOBALS['db']->sql_fetchrow($result);
$GLOBALS['db']->sql_free($result);
if (!USER_CAN_RATE_PICTURES || $row['votes_allowed'] == 'NO') cpg_die(ERROR, $lang_errors['perm_denied'], __FILE__, __LINE__);


// Clean votes older votes
$curr_time = time();
$clean_before = $curr_time - $CONFIG['keep_votes_time'] * 86400;
$sql = "DELETE ". "FROM `".TABLE_CPG_VOTES."` ".  "WHERE `vote_time` < '$clean_before'";
$result = $GLOBALS['db']->sql_query($sql);


// Check if user already rated this picture
$user_md5_id = USER_ID ? md5(USER_ID) : $USER['ID'];
$sql = "SELECT * ".  "FROM `".TABLE_CPG_VOTES."` ". "WHERE `pic_id` = '$pic' AND `user_md5_id` = '$user_md5_id'";
$result = $GLOBALS['db']->sql_query($sql);
if ($GLOBALS['db']->sql_numrows($result)) cpg_die(ERROR, $lang_rate_pic_php['already_rated'], __FILE__, __LINE__);
//Test for Self-Rating
$user  = USER_ID;
$owner = secure( $row['owner_id'], 'num', 1, 'sec' );

if (!empty($user) && $user==$owner && !USER_IS_ADMIN) cpg_die(ERROR, $lang_rate_pic_php['forbidden'], __FILE__, __LINE__);

// Update picture rating
$new_rating = round(($row['votes'] * $row['pic_rating'] + $rate * 2000)/($row['votes']+1));
$sql = "UPDATE `".TABLE_CPG_PICTURES."` ".
	   "SET `pic_rating` = '$new_rating', `votes` = votes + 1 ".
	   "WHERE `pid` = '$pic' LIMIT 1";
$result = $GLOBALS['db']->sql_query($sql);


// Update the votes table
$sql = "INSERT INTO `".TABLE_CPG_VOTES."` ".
	   "VALUES ('$pic', '$user_md5_id', '$curr_time')";
$result = $GLOBALS['db']->sql_query($sql);

$location = "modules.php?name=Coppermine&op=displayimage&pos=".(-$pic);
$header_location = ( @preg_match('/Microsoft|WebSTAR|Xitami/', getenv('SERVER_SOFTWARE')) ) ? 'Refresh: 0; URL=' : 'Location: ';
header($header_location.$location);
pageheader($lang_info,"<meta http-equiv=\"refresh\" content=\"1;url=$location\">");
msg_box($lang_info, $lang_rate_pic_php['rate_ok'], $lang_continue, $location);
pagefooter();
ob_end_flush();
incof();
break;
}