engelsystem/includes/pages/user_news.php

<?php

/**
 * @return string
 */
function user_news_comments_title()
{
    return _('News comments');
}

/**
 * @return string
 */
function news_title()
{
    return _('News');
}

/**
 * @return string
 */
function meetings_title()
{
    return _('Meetings');
}

/**
 * @return string
 */
function user_meetings()
{
    global $display_news;

    $html = '<div class="col-md-12"><h1>' . meetings_title() . '</h1>' . msg();

    if (isset($_REQUEST['page']) && preg_match('/^[0-9]{1,}$/', $_REQUEST['page'])) {
        $page = $_REQUEST['page'];
    } else {
        $page = 0;
    }

    $news = sql_select("
        SELECT *
        FROM `News`
        WHERE `Treffen`=1
        ORDER BY `Datum`DESC
        LIMIT " . sql_escape($page * $display_news) . ", " . sql_escape($display_news)
    );
    foreach ($news as $entry) {
        $html .= display_news($entry);
    }

    $dis_rows = ceil(sql_num_query('SELECT * FROM `News`') / $display_news);
    $html .= '<div class="text-center">' . '<ul class="pagination">';
    for ($i = 0; $i < $dis_rows; $i++) {
        if (isset($_REQUEST['page']) && $i == $_REQUEST['page']) {
            $html .= '<li class="active">';
        } elseif (!isset($_REQUEST['page']) && $i == 0) {
            $html .= '<li class="active">';
        } else {
            $html .= '<li>';
        }
        $html .= '<a href="' . page_link_to('user_meetings') . '&page=' . $i . '">' . ($i + 1) . '</a></li>';
    }
    $html .= '</ul></div></div>';

    return $html;
}

/**
 * @param array $news
 * @return string
 */
function display_news($news)
{
    global $privileges, $page;

    $html = '';
    $html .= '<div class="panel' . ($news['Treffen'] == 1 ? ' panel-info' : ' panel-default') . '">';
    $html .= '<div class="panel-heading">';
    $html .= '<h3 class="panel-title">' . ($news['Treffen'] == 1 ? '[Meeting] ' : '') . ReplaceSmilies($news['Betreff']) . '</h3>';
    $html .= '</div>';
    $html .= '<div class="panel-body">' . ReplaceSmilies(nl2br($news['Text'])) . '</div>';

    $html .= '<div class="panel-footer text-muted">';
    if (in_array('admin_news', $privileges)) {
        $html .= '<div class="pull-right">'
            . button_glyph(page_link_to('admin_news') . '&action=edit&id=' . $news['ID'], 'edit', 'btn-xs')
            . '</div>';
    }
    $html .= '<span class="glyphicon glyphicon-time"></span> ' . date('Y-m-d H:i', $news['Datum']) . '&emsp;';

    $user_source = User($news['UID']);

    $html .= User_Nick_render($user_source);
    if ($page != 'news_comments') {
        $html .= '&emsp;<a href="' . page_link_to('news_comments') . '&nid=' . $news['ID'] . '">'
            . '<span class="glyphicon glyphicon-comment"></span> '
            . _('Comments') . ' &raquo;</a> '
            . '<span class="badge">'
            . sql_num_query("SELECT * FROM `NewsComments` WHERE `Refid`='" . sql_escape($news['ID']) . "'")
            . '</span>';
    }
    $html .= '</div>';
    $html .= '</div>';
    return $html;
}

/**
 * @return string
 */
function user_news_comments()
{
    global $user;

    $html = '<div class="col-md-12"><h1>' . user_news_comments_title() . '</h1>';
    if (
        isset($_REQUEST['nid'])
        && preg_match('/^[0-9]{1,}$/', $_REQUEST['nid'])
        && sql_num_query("SELECT * FROM `News` WHERE `ID`='" . sql_escape($_REQUEST['nid']) . "' LIMIT 1") > 0
    ) {
        $nid = $_REQUEST['nid'];
        list($news) = sql_select("SELECT * FROM `News` WHERE `ID`='" . sql_escape($nid) . "' LIMIT 1");
        if (isset($_REQUEST['text'])) {
            $text = preg_replace("/([^\p{L}\p{P}\p{Z}\p{N}\n]{1,})/ui", '', strip_tags($_REQUEST['text']));
            sql_query("
                INSERT INTO `NewsComments` (`Refid`, `Datum`, `Text`, `UID`)
                VALUES (
                    '" . sql_escape($nid) . "',
                    '" . date("Y-m-d H:i:s") . "',
                    '" . sql_escape($text) . "',
                    '" . sql_escape($user["UID"]) . "'
                )
            ");
            engelsystem_log('Created news_comment: ' . $text);
            $html .= success(_('Entry saved.'), true);
        }

        $html .= display_news($news);

        $comments = sql_select("SELECT * FROM `NewsComments` WHERE `Refid`='" . sql_escape($nid) . "' ORDER BY 'ID'");
        foreach ($comments as $comment) {
            $user_source = User($comment['UID']);

            $html .= '<div class="panel panel-default">';
            $html .= '<div class="panel-body">' . nl2br($comment['Text']) . '</div>';
            $html .= '<div class="panel-footer text-muted">';
            $html .= '<span class="glyphicon glyphicon-time"></span> ' . $comment['Datum'] . '&emsp;';
            $html .= User_Nick_render($user_source);
            $html .= '</div>';
            $html .= '</div>';
        }

        $html .= '<hr /><h2>' . _('New Comment:') . '</h2>';
        $html .= form([
            form_textarea('text', _('Message'), ''),
            form_submit('submit', _('Save'))
        ], page_link_to('news_comments') . '&nid=' . $news['ID']);
    } else {
        $html .= _('Invalid request.');
    }

    return $html . '</div>';
}

/**
 * @return string
 */
function user_news()
{
    global $display_news, $privileges, $user;

    $html = '<div class="col-md-12"><h1>' . news_title() . '</h1>' . msg();

    if (isset($_POST['text']) && isset($_POST['betreff']) && in_array('admin_news', $privileges)) {
        if (!isset($_POST['treffen']) || !in_array('admin_news', $privileges)) {
            $_POST['treffen'] = 0;
        }
        sql_query("
            INSERT INTO `News` (`Datum`, `Betreff`, `Text`, `UID`, `Treffen`)
            VALUES (
                '" . sql_escape(time()) . "',
                '" . sql_escape($_POST["betreff"]) . "',
                '" . sql_escape($_POST["text"]) . "',
                '" . sql_escape($user['UID']) . "',
                '" . sql_escape($_POST["treffen"]) . "'
            )
        ");
        engelsystem_log('Created news: ' . $_POST['betreff'] . ', treffen: ' . $_POST['treffen']);
        success(_('Entry saved.'));
        redirect(page_link_to('news'));
    }

    if (isset($_REQUEST['page']) && preg_match('/^[0-9]{1,}$/', $_REQUEST['page'])) {
        $page = $_REQUEST['page'];
    } else {
        $page = 0;
    }

    $news = sql_select("
        SELECT *
        FROM `News`
        ORDER BY `Datum`
        DESC LIMIT " . sql_escape($page * $display_news) . ", " . sql_escape($display_news)
    );
    foreach ($news as $entry) {
        $html .= display_news($entry);
    }

    $dis_rows = ceil(sql_num_query('SELECT * FROM `News`') / $display_news);
    $html .= '<div class="text-center">' . '<ul class="pagination">';
    for ($i = 0; $i < $dis_rows; $i++) {
        if (isset($_REQUEST['page']) && $i == $_REQUEST['page']) {
            $html .= '<li class="active">';
        } elseif (!isset($_REQUEST['page']) && $i == 0) {
            $html .= '<li class="active">';
        } else {
            $html .= '<li>';
        }
        $html .= '<a href="' . page_link_to('news') . '&page=' . $i . '">' . ($i + 1) . '</a></li>';
    }
    $html .= '</ul></div>';

    if (in_array('admin_news', $privileges)) {
        $html .= '<hr />';
        $html .= '<h2>' . _('Create news:') . '</h2>';

        $html .= form([
            form_text('betreff', _('Subject'), ''),
            form_textarea('text', _('Message'), ''),
            form_checkbox('treffen', _('Meeting'), false, 1),
            form_submit('submit', _('Save'))
        ]);
    }
    return $html . '</div>';
}