~pollka-devs/pollka/trunk

<?php

# GPLv3 - http://www.gnu.org/copyleft/gpl.html

# By Melissa Draper melissa@meldraweb.com

#pull in other includes

include_once('includes/rfc3696.php');

if ( ! empty($_POST) ) {

	#insert votes

	#make a record of the voter so we can prevent recidivist voting

	#get the ip address

	$host = $_SERVER['REMOTE_ADDR'];

	#and email so we can try prevent fraud

	$email = mysql_real_escape_string($_POST['email']);//no SQL injection here thanks

        $result = mysql_query("SELECT * FROM voter WHERE email = '$email'")

        or die('Could not select question data: '  . mysql_error());

        while ( $row = mysql_fetch_array($result) ) {

		echo "The address '$email' has already voted.";

		die();

	}

	if (is_rfc3696_valid_email_address($_POST['email'])) {

		#insert voter details

		mysql_query("INSERT INTO voter (iphost, email)

		VALUES ('$host', '$email')") or die('Could not insert voter info: ' . mysql_error());

		mysql_query("SET CHARACTER SET utf8");

		mysql_query("SET NAMES utf8");

	        $result = mysql_query("SELECT * FROM questions")

        	or die('Could not select data: '  . mysql_error());

		$token = md5(microtime() . rand());

		$to = $_POST['email'];

		$subject = "Your World Play Day 2010 Photo Competition Vote";

		$message = "Hello!\n\nYour voting token is: " . $token . "\n\nYou *must* visit:\n\nhttp://".$conf['poll_site']."/token.php?token=" . $token . "\n\nto complete your vote.\n\nThanks!";

		$from = "no-reply@elkbuntu.net";

		$headers = "From: $from";

		mail($to,$subject,$message,$headers);

        	$i = 1;

        	while ( $row = mysql_fetch_array($result) ) {

			$vote_value = $_POST['vote' . $i];

			$question_id = $row['question_id'];

			mysql_query("INSERT INTO prevote (question_id, prevote_value, prevote_token)

	                VALUES ('$question_id', '$vote_value', '$token')") or die('Could not insert vote answers: ' . mysql_error());

                	$i++; 

        	}

		if ( ! empty($_POST['fave']) ) {

			$fave_id = $_POST['fave'];

        	        mysql_query("INSERT INTO prevote (question_id, prevote_value, prevote_token)

                	VALUES ('$fave_id', '1', '$token')") or die('Could not insert vote answers: ' . mysql_error());

		}

		#announce the success

		echo "Thanks for voting. Your confirmation token will appear in the inbox of the email you gave us.<br/>You <b>MUST</b> follow the instructions to make your vote count!";

		$result = mysql_query("SELECT * FROM questions")

        	or die('Could not select question data: '  . mysql_error());

	        while ( $row = mysql_fetch_array($result) ) {

			$question_id = $row['question_id'];

			$result2 = mysql_query("SELECT * FROM votes WHERE question_id = $question_id")

	                or die('Could not select question data: '  . mysql_error());

			while ( $row2 = mysql_fetch_array($result2) ) {

			}

		}

	} else {

		echo "Unsatisfactory email offering. Vote failed!";

	}

} else {

	$result = mysql_query("SELECT * FROM questions")

	or die('Could not select question data: '  . mysql_error());  

	$voteitems = null;

	$i = 1;

	$fave = '(optional) My absolute favourite is: <select name="fave"><option>None</option>';

	while ( $row = mysql_fetch_array($result) ) {

        if(file_exists($row['question_text'])){

            $content = '<a href="pics/full/' . $row['question_text'] . '"><img src="pics/thumbs/' . $row['question_text'] . '"></a>';

        } else {

            $content = $row['question_text'];

        }

		$voteitems .= '<div class="item"><div class="itemtitle">Photo #' . $i . ':</div><div class="itemauthor">' . $row['question_author'] . '</div><div class="itembody">' . $content . '</div><div class="itemvote"><select name="vote' . $i . '"><option value="0">Please choose:</option><option value="1">I like this photo (+1)</option><option value="0">I do not like this photo (+0)</option></select></div></div><br/>';

                $fave .= '<option value="' . $row['question_id'] . '">' . $row['question_author'] . '</option>';

		$i++;

	}

	$fave .= '</select><br/><br/>'; 

	$voteaudit = 	'Please sign with your email address:

			<input type="text" name="email" /><br/>

			<span style="font-style:italic; color:#666;">We hate spam and love privacy; this is for vote authorisation and private auditing purposes only.</span><br/>

			<input type="submit" value="Submit" />';

}

#close off mysql connection

mysql_close($con);

?>

<html>

	<head>

		<title><?php echo $conf['poll_name']; ?></title>

		<link rel="stylesheet" type="text/css" href="style.css" /> 

	</head>

	<body>

		<?php echo $conf['poll_intro']; ?>

		<form name="input" action="index.php" method="post">

			<?php if ( ! empty($voteitems) ) { echo $voteitems; } ?>

			<?php if ( ! empty($fave) && $conf['fave_status'] == 'active') { echo $fave; } ?>

			<?php if ( ! empty($voteaudit) ) { echo $voteaudit; } ?>

		</form> 

	</body>

</html>