root/trunk/redirectors/pollvote.php

<?php

/**
 * Package: Spam Board 5
 * File: redirectors/pollvote.php
 * Description: Popup to show a poll's result or actually vote
 *
 * Copyright (C) 2007, 2008, 2009 Hannes Schueller
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, version 3 of the
 * License.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program (see LICENCE). If not,
 * see <http://www.gnu.org/licenses/>.
 **/

// called independently from index
require_once('../includes/config/settings.php');

// load classes on demand
function __autoload($class) {
    global $SETTINGS;
    if (is_file($SETTINGS['fspath'] . 'classes/pages/' . $class . '.php')) {
        require_once($SETTINGS['fspath'] . 'classes/pages/' . $class . '.php');
    } elseif (is_file($SETTINGS['fspath'] . 'classes/misc/' . $class . '.php')) {
        require_once($SETTINGS['fspath'] . 'classes/misc/' . $class . '.php');
    } else { die('Class ' . $class . ' not found.'); }
}

// initialize global warnings array
$WARNINGS = Array();

// import version number
require_once($SETTINGS['fspath'] . 'includes/config/version.php');
// bots definition
require_once($SETTINGS['fspath'] . 'includes/config/bots.php');
// formatting object
$F = new Format();
require($SETTINGS['fspath'] . 'includes/lang/' . $SETTINGS['language'] . '.php');
// open database connection
$C = new Connection();
Member::session();
if (isset($_SESSION['lang']) && $_SESSION['lang'] != '') {
    include($SETTINGS['fspath'] . 'includes/lang/' . $_SESSION['lang'] . '.php');
}
// translate passed variables to local identifiers
require($SETTINGS['fspath'] . 'includes/input.php');

// page start
$_pref = '../';
$html = Page::start();

switch (isset($INPUT['showresults'])) {
    // don't modify any votes, but just show the results so far
    case 'yes':
        // check if user has permission; required: read; independent from id
        if (Member::checkRights('Pollvote', 'r')) {
            // permission granted
            // get poll info
            $q = $C->prepare('SELECT topictitle FROM ' . $SETTINGS['dbtableprefix'] . 'topics WHERE poll=:id');
            $q->bindParam(':id', $INPUT['id'], PDO::PARAM_INT, 12);
            $s = $q->execute();
            $row_q = $q->fetchAll();
            $q = NULL;;
            $q2 = $C->prepare('SELECT * FROM ' . $SETTINGS['dbtableprefix'] . 'polls WHERE pollid=:id');
            $q2->bindParam(':id', $INPUT['id'], PDO::PARAM_INT, 12);
            $s2 = $q2->execute();
            if ($s && $s2) {
                $row_title = $row_q[0]['topictitle'];
                $row = $q2->fetchObject();
                $q2 = NULL;;
                // heading
                $html->body->addChild('h2', $row_title);
                $div = $html->body->addChild('div', $LANG['Results'] . ':');
                $div->addAttribute('class', 'pollheaders');
                // assemble data for the results table
                $table = new Table('poll');
                $pollchoices = split("\n", $row->pollchoices);
                $pollvotes = split("\n", $row->pollvotes);
                // count total votes
                $i = 0;
                while ($pollvotes[$i] != '') {
                    $totalpollvotes = $totalpollvotes + $pollvotes[$i];
                    $i++;
                }
                $i = 0;
                while ($pollchoices[$i]) {
                    if ($totalpollvotes > 0) {
                        // calculate percentage for this option
                        $percentage = round($pollvotes[$i] * 100 / $totalpollvotes, 0);
                    }
                    // write this option to table
                    $table->addRow(Array($pollchoices[$i], '<td valign="middle"><img src="../images/pollbar.png" width="' . $percentage . '" height="16" alt="' . $percentage . '%" /></td>', '<td align="right">' . $percentage . '%</td>', '<td align="right">(' . $pollvotes[$i] . ' ' . $word_votes . ')</td>'));
                    $i++;
                }
                // add table to tree
                $div = $html->body->addChild('div');
                $div->addAttribute('class', 'pollbody');
                $div->addElement($table->get());
                $div = $html->body->addChild('div');
                $div->addAttribute('class', 'pollbottom');
                $div = $html->body->addChild('div');
                $div->addAttribute('align', 'center');
                $a = $div->addChild('a', $LANG['Close_Window']);
                $a->addAttribute('href', 'javascript:self.close()');
            } else {
                $q2->closeCursor();
                $div = $html->body->addChild('div', $LANG['error_id']);
                $div->addAttribute('class', 'message');
            }
        } else {
            $div = $html->body->addChild('div', $LANG['error_permission_denied']);
            $div->addAttribute('class', 'message');
        }
    break;
    // try to add vote
    default:
        // check if user has permission; required: write; independent from id
        if (Member::checkRights('Pollvote', 'w') && isset($_SESSION['memberid']) && $_SESSION['memberid'] > 0) {
            // permission granted
            $q = $C->prepare('SELECT t.closed, p.pollid, p.pollchoices, p.pollvotes, p.pollvoters FROM ' . $SETTINGS['dbtableprefix'] . 'polls AS p INNER JOIN ' . $SETTINGS['dbtableprefix'] . 'topics AS t ON t.poll = p.pollid WHERE p.pollid = :id');
            $q->bindParam(':id', $INPUT['poll'], PDO::PARAM_INT, 12);
            if ($q->execute()) {
                $row = $q->fetchObject();
                $q = NULL;
                // check if topic is closed
                if ($row->closed == 0) {
                    // check if logged in member already voted
                    $pollvoters = split("\n", $row->pollvoters);
                    $i = 0; $voted = 0;
                    while ($pollvoters[$i] != '') {
                        if ($_SESSION['memberid'] == $pollvoters[$i]) {
                            $voted = 1;
                        }
                        $i++;
                    }
                    if ($voted === 0) {
                        // not voted yet -> add vote
                        $pollvotes = split("\n", $row->pollvotes);
                        $pollvotes[$INPUT['vote']]++;
                        $row->pollvotes = implode("\n", $pollvotes);
                        $row->pollvoters .= $_SESSION['memberid'] . "\n";
                        // update database
                        $q = $C->prepare('UPDATE ' . $SETTINGS['dbtableprefix'] . 'polls SET pollvotes=:votes, pollvoters=:voters WHERE pollid=:id');
                        $q->bindParam(':votes', $row->pollvotes, PDO::PARAM_STR);
                        $q->bindParam(':voters', $row->pollvoters, PDO::PARAM_STR);
                        $q->bindParam(':id', $INPUT['poll'], PDO::PARAM_INT, 12);
                        $q->execute();
                        $q = NULL;
                        // close database connection
                        $C = NULL;
                        session_write_close();
                        session_start();
                        // refresh topic
                        header('Location: ' . $SETTINGS['webpath'] . $F->link('topic') . 'id=' . $INPUT['topic'] . '&page=' . $INPUT['page'] . '&' . strip_tags(SID));
                        // some message in case redirecting failed
                        $div = $html->body->addChild('div', str_replace(Array('%topic%', '%page%'), Array($INPUT['topic'], $INPUT['page']), $LANG['voting_successful']));
                        $div->addAttribute('class', 'message');
                    } else {
                        // someone trying to vote more than once
                        $div = $html->body->addChild('div', $LANG['error_already_voted']);
                        $div->addAttribute('class', 'message');
                    }
                } else {
                    // no voting on closed topics
                    $div = $html->body->addChild('div', $LANG['error_topic_closed']);
                    $div->addAttribute('class', 'message');
                }
            } else {
                // call error
                $q->closeCursor();
                $div = $html->body->addChild('div', $LANG['error_id']);
                $div->addAttribute('class', 'message');
            }
        } else {
            // not allowed
            $div = $html->body->addChild('div', $LANG['error_permission_denied']);
            $div->addAttribute('class', 'message');
        }
    break;
}

// page output
Page::send($html);

?>