<?php 
require("common_begin.php");

$lst = Listopia::getInstance();

$result = array();

if ($lst->isLoggedIn())
{
  $messageContent = base64_decode($_POST['msg']);
  $listID  = $_POST['list'];
  $authKey = $_POST['auth'];

  $result['result'] = "";

  if ($lst->isUserOnProbation())
  {
      $result['result'] = "You're on probation, can't add anything";
  }

  // check our inputs
  else if (!isset($messageContent) || $messageContent === FALSE)
  {
    $result['result'] = "No post data sent";
  }
  else if (!isset($listID) || !$lst->listIDIsValid($listID))
  {
    $result['result'] = "Missing or invalid list ID " . $listID;
  }  
  else if (!isset($authKey) || $authKey != $_COOKIE[__LAUTH_KEY__])
  {
    $result['result'] = "Incorrect auth key";
  }
  else if (strlen($messageContent) < 2)
  {
    $result['result'] = "Post is too small";
  }  
  // we're okay to plug this in
  else
  {
    $isImageList = $lst->isImageList($listID);
    if ($isImageList)
    {
      $newPostContent = $messageContent;
      
      if (!isContentImageStream($messageContent, $lst->Database()))
      {
        $result['result'] = "This isn't an image";
      }
    }
    else
    {
      if (strlen($messageContent) > 1000)
      {
        $result['result'] = "Post is too big";
      }
      if (isContentImageStream($messageContent, $lst->Database()))
      {
        $result['result'] = "Invalid post contents";
      }
      
      $newPostContent = htmlspecialchars($messageContent);
      
      // check this isn't a duplicate - note we check against the string after running it through
      // mysql_real_escape_string(), which is what the ListopiaDB class does for us during insert/update
      $query = $lst->Database()->select(array(
                          'fields' => 't_items.item_list',
                          'table' => 't_items',
                          'condition' => 't_items.item_list = '.((int)$listID).' and t_items.item_blurb = "' . $lst->Database()->escape_string($newPostContent) . '"',
                          'limit' => 1
                          ));
      if (!empty($query[0]))
      {
        $result['result'] = "Duplicate post!";
      }
    }
    
    // no problems so far
    if ($result['result'] == '')
    {
      $date = date("Y-m-d H:i:s", time());

      $data = array(
        'item_list'         => array(((int)$listID)),
        'item_blurb'        => $newPostContent,
        'item_createdby'    => array(Session::getInstance()->gl_userid),
        'item_extra'        => ($isImageList ? 'image' : ''),
        'item_created'      => $date
      );
      $insertResult = $lst->Database()->insert('t_items', $data);
      
      if (isset($insertResult))
      {
        $result['success'] = true;
        
        // update the list's update time
        $data = array(
          'list_updated'    => $date
        );
        $okB = $lst->Database()->update('t_lists', $data, 't_lists.list_id = ' . ((int)$listID));
      }
        
      $result['result'] = $insertResult;
      
      $lst->pushPublish("New Post");
    }
  }
}
else
{
  $result['result'] = "Not logged in";
}

echo json_encode($result);

require("common_end.php");

