Your IP : 216.73.216.240
<?php
/**
* Joomla! component sexypolling
*
* @version $Id: addanswer.php 2012-04-05 14:30:25 svn $
* @author 2GLux.com
* @package Sexy Polling
* @subpackage com_sexypolling
* @license GNU/GPL
*
*/
// no direct access
define('_JEXEC',true);
defined('_JEXEC') or die('Restircted access');
/*
* This is external PHP file and used on AJAX calls, so it has not "defined('_JEXEC') or die;" part.
*/
error_reporting(0);
define( 'DS', DIRECTORY_SEPARATOR );
define('JPATH_BASE', dirname(__FILE__).DS.'..'.DS.'..' );
session_start();
header('Content-type: application/json');
require_once ( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once ( JPATH_BASE .DS.'includes'.DS.'framework.php' );
$app = JFactory::getApplication('site');
$app->initialise();
$db = JFactory::getDBO();
//get user groups
$levels = array();
$groups = array();
$user = JFactory::getUser();
$user_id = $user->get('id');
jimport( 'joomla.access.access' );
$groups = JAccess::getGroupsByUser($user_id);
$date_now = strtotime("now");
$datenow = date("Y-m-d H:i:s", $date_now);
$datenow_sql = date("Y-m-d", $date_now);
//get ip address
$REMOTE_ADDR = null;
if(isset($_SERVER['REMOTE_ADDR'])) { $REMOTE_ADDR = $_SERVER['REMOTE_ADDR']; }
elseif(isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $REMOTE_ADDR = $_SERVER['HTTP_X_FORWARDED_FOR']; }
elseif(isset($_SERVER['HTTP_CLIENT_IP'])) { $REMOTE_ADDR = $_SERVER['HTTP_CLIENT_IP']; }
elseif(isset($_SERVER['HTTP_VIA'])) { $REMOTE_ADDR = $_SERVER['HTTP_VIA']; }
else { $REMOTE_ADDR = 'Unknown'; }
$ip = $REMOTE_ADDR;
//get post data
$polling_id = (int)$_POST['polling_id'];
$autopublish = (int)$_POST['autopublish'];
$writeinto = (int)$_POST['writeinto'];
$answer = mysql_real_escape_string(strip_tags($_POST['answer']));
$answer = preg_replace('/sexydoublequestionmark/','??',$answer);
//get poll options
$query = "SELECT * FROM `#__sexy_polls` WHERE `id` = '$polling_id'";
$db->setQuery( $query );
$poll_options = $db->loadAssoc();
$ipcount = $poll_options["ipcount"];
$voting_period = $poll_options["voting_period"];
//check token
if (!JRequest::checkToken() && $poll_options["checktoken"] == 1) {
echo '[{"invalid":"invalid_token"}]';
exit();
}
$countryname = (!isset($_POST['country_name']) || $_POST['country_name'] == '' || $_POST['country_name'] == '-' ) ? 'Unknown' : mysql_real_escape_string($_POST['country_name']);
$cityname = (!isset($_POST['city_name']) || $_POST['city_name'] == '' || $_POST['city_name'] == '-' ) ? 'Unknown' : mysql_real_escape_string($_POST['city_name']);
$regionname = (!isset($_POST['region_name']) || $_POST['region_name'] == '' || $_POST['region_name'] == '-' ) ? 'Unknown' : mysql_real_escape_string($_POST['region_name']);
$countrycode = (!isset($_POST['country_code']) || $_POST['country_code'] == '' || $_POST['country_code'] == '-' ) ? 'Unknown' : mysql_real_escape_string($_POST['country_code']);
//check ipcount security
$query = "SELECT COUNT( sv.ip )
FROM `#__sexy_answers` sa
JOIN `#__sexy_votes` sv ON sv.id_answer = sa.id
AND DATE_FORMAT(sv.date, '%Y-%m-%d') = '$datenow_sql'
AND sv.ip = '$ip'
WHERE sa.id_poll = '$polling_id'
";
$db->setQuery($query);
$count_votes = $db->loadResult();
$ipcountchecked = true;
if($ipcount != 0 && $count_votes >= $ipcount)
$ipcountchecked = false;
//make additional checkings
$voting_enabled = true;
if($poll_options["votechecks"] == 1) {
//check ACL to vote
function if_contain($array1,$array2) {
if(is_array($array2))
foreach($array1 as $val) {
if(in_array($val,$array2))
return true;
}
return false;
}
//check ACL to add answer
$add_answer_permissions_id =$poll_options["answerpermission"];
$query = "SELECT `rules` FROM #__viewlevels WHERE id = '$add_answer_permissions_id'";
$db->setQuery($query);
$db->query();
$levels = explode(',',str_replace(array('[',']'),'',$db->loadResult()));
if(!if_contain($levels,$groups) && $poll_options["checkacl"] == 1)
$voting_enabled = false;
$voting_permission_id = $poll_options["voting_permission"];
$query = "SELECT `rules` FROM #__viewlevels WHERE id = '$voting_permission_id'";
$db->setQuery($query);
$db->query();
$levels = explode(',',str_replace(array('[',']'),'',$db->loadResult()));
if(!if_contain($levels,$groups) && $poll_options["checkacl"] == 1)
$voting_enabled = false;
$registration_to_vote_required = ( in_array(2,$levels) || in_array(3,$levels) || in_array(6,$levels) || in_array(8,$levels) ) ? true : false;
//check start,end dates
if($poll_options["date_start"] != '0000-00-00' && $date_now < strtotime($poll_options["date_start"]))
$voting_enabled = false;
if($poll_options["date_end"] != '0000-00-00' && $date_now > strtotime($poll_options["date_end"]))
$voting_enabled = false;
//check user_id
if($registration_to_vote_required) {
$query = "SELECT sv.`ip`,sv.`date` FROM #__sexy_votes sv JOIN #__sexy_answers sa ON sa.id_poll = '$polling_id' WHERE sv.id_answer = sa.id AND sv.id_user = '$user_id' ORDER BY sv.`date` DESC LIMIT 1";
$db->setQuery($query);
$db->query();
$num_rows = $db->getNumRows();
$row = $db->loadAssoc();
if($num_rows > 0) {
$datevoted = strtotime($row['date']);
$hours_diff = ($date_now - $datevoted) / 3600;
if($voting_period == 0 || ($hours_diff < $voting_period)) {
$voting_enabled = false;
}
}
}
else {
//check ip
$query = "SELECT sv.`ip`,sv.`date` FROM #__sexy_votes sv JOIN #__sexy_answers sa ON sa.id_poll = '$polling_id' WHERE sv.id_answer = sa.id AND sv.ip = '$ip' ORDER BY sv.`date` DESC LIMIT 1";
$db->setQuery($query);
$db->query();
$num_rows = $db->getNumRows();
$row = $db->loadAssoc();
if($num_rows > 0) {
$datevoted = strtotime($row['date']);
$hours_diff = ($date_now - $datevoted) / 3600;
if($voting_period == 0 || ($hours_diff < $voting_period)) {
$voting_enabled = false;
}
}
//check cookie
if (isset($_COOKIE["sexy_poll_$polling_id"])) {
$voting_enabled = false;
}
}
}
if(($writeinto == 1 || $autopublish == 0) && $voting_enabled) {
$published = $autopublish == 1 ? 1 : 0;
$query = "INSERT INTO `#__sexy_answers` (`id_poll`,`name`,`published`,`created`) VALUES ('$polling_id','$answer','$published','$datenow')";
$db->setQuery($query);
$db->query();
$insert_id = $db->insertid();
if($ipcountchecked) {
$query = "INSERT INTO `#__sexy_votes` (`id_answer`,`id_user`,`ip`,`date`,`country`,`city`,`region`,`countrycode`) VALUES ('$insert_id','$user_id','$ip','$datenow','$countryname','$cityname','$regionname','$countrycode')";
$db->setQuery($query);
$db->query();
//set the cookie
if($voting_period == 0) {
$expire = time()+(60*60*24*365*2);//2 years
setcookie("sexy_poll_$polling_id", $date_now, $expire, '/');
}
else {
$expire_time = (float)$voting_period*60*60;
$expire = (int)(time()+$expire_time);
setcookie("sexy_poll_$polling_id", $date_now, $expire, '/');
}
}
}
else {
$insert_id = 0;
}
$ans = str_replace('\\','',htmlspecialchars(stripslashes($answer),ENT_QUOTES));
echo '[{"answer": "'.$ans.'", "id" : "'.$insert_id.'"}]';
//echo $answer;
jexit();
?>