<!--#include file="conn.asp"-->
<!--#include file="z_dgconn.asp"-->
<!-- #include file="inc/const.asp" -->
<!--#include file="inc/dv_loadcache.asp"-->
<%
If Not IsObject(Conn) Then ConnectionDatabase
dim sql,rs,founderr,i,errmsg
founderr=false
Dvbbs.LoadTemplates("")

'---------------------
' write by 绿水青山
' 本插件经由 cyp2 修改适应DVBBS7.0.0
'---------------------
	dvbbs.stats="点歌控制面板"
	dvbbs.nav()
	Dvbbs.Head_var 2,0,"",""

	dim isfull
	isfull=false		
	dvbbs.FoundIsChallenge=false

	if dvbbs.userid=0 then
		errmsg=errmsg+"<br>"+"<li>客人不可以查阅点歌列表"
		errmsg=errmsg+"<br>"+"<li>请先<a href=login.asp><font color=blue>登录</font></a>,还没有<a href=reg.asp><font color=blue>注册</font></a>"
		call dvbbs_error()
		response.end
	end if
%>
		<table cellpadding=3 cellspacing=1 border=0 align=center class=tableborder1>
			<tr>
				<th><a href=z_dglistall.asp><font color=white><b>所有点歌列表</b></font></a></th>
				<th><a href=z_dglistme.asp><font color=white><b>我的点歌列表</b></font></a></th>
				<th><a href=z_dgwrite.asp><font color=white><b>我要点歌</b></font></a></th>
			</tr>
			<tr>
				<td class=tablebody2 align=center valign=middle colspan="3">点手歌曲祝福你的好友</td>
			</tr>
		</table>
		<br>
<% 
dim lincept,lcontent,lmedianame,lurl
dim successmsg

'=====================================================
'BY 凌峰 ,修正点歌漏洞.增加JS脚本检测函数和格式检查.
'=====================================================
lincept=FilterJS(replace(Request.Form("incept"),"'",""))
lcontent=FilterJS(replace(Request.Form("content"),"'",""))
lcontent=replace(server.htmlencode(lcontent),chr(13)," ")
lmedianame=FilterJS(replace(Request.Form("medianame"),"'",""))
lurl=Request.Form("url")
lurl=FilterJS(replace(lurl,"'","''"))

If Not CheckExt(lurl) Then
	errmsg=errmsg+"<br>"+"<li>未支持的歌曲格式,请检查歌曲连接!"	
	dvbbs.FoundIsChallenge=true
end if
'=====================================================

if lincept="" then 
	errmsg=errmsg+"<br>"+"<li>请输入接收用户名"
	dvbbs.founderr=true
else
	if instr(lincept,"全体会员")>0 then
		lincept="全体会员"
		isfull=true
	else 	
		lincept=split(lincept,"|")
		if ubound(lincept)>=5 then
			errmsg=errmsg+"<br>"+"<li>最多只能发送给5个用户"
			dvbbs.FoundIsChallenge=true
		end if
	end if	
end if
if lmedianame="" then 
	errmsg=errmsg+"<br>"+"<li>请输入歌曲名"
	dvbbs.FoundIsChallenge=true
end if
if lurl="" or lurl="http://" then 
	errmsg=errmsg+"<br>"+"<li>请正确输入音乐地址"
	dvbbs.FoundIsChallenge=true
end if
if lcontent="" then 
	errmsg=errmsg+"<br>"+"<li>请输入祝福语"	
	dvbbs.FoundIsChallenge=true
end if
if len(lmedianame)>50 then '--------------判断名字
	errmsg=errmsg+"<br>"+"<li>歌曲名不能多于50字"
	dvbbs.FoundIsChallenge=true	
end if
if len(lcontent)>200 then '--------------判断名字
	errmsg=errmsg+"<br>"+"<li>祝福语不能多于200字"
	dvbbs.FoundIsChallenge=true	
end if
if dvbbs.FoundIsChallenge then
	call dvbbs_error()
        'dvbbs.AddErrCode(6)
	'Dvbbs.Showerr()
	response.end
end if
	dim haverr      '是否有不存在的用户『绿水青山』
	haverr=false
	call updata()
	call CloseDB()
	call success()
	call dvbbs.activeonline()
	call dvbbs.footer()
'===================================
sub updata()
	dim ii

	if isfull then
			set rs=server.createobject("adodb.recordset")
			sql="select * from media" 
			rs.open sql,connDG,3,2
			rs.addnew
			rs("sender")=dvbbs.membername
			rs("incept")=lincept
			rs("sendtime")=now()
			rs("content")=lcontent
			rs("medianame")=lmedianame
			rs("url")=lurl
			rs.update
			rs.close
			set rs=nothing
			errmsg=""
			successmsg="<li>点歌祝福已成功发出!<br><li>你向论坛所有的会员发送了点歌祝福<br><br>"	
	else	
		for ii=0 to ubound(lincept)
			set rs=server.createobject("adodb.recordset")
			sql="select username from [dv_user] where username='"&lincept(ii)&"'"
			rs.open sql,conn,1,1
			if rs.eof and rs.bof then
				errmsg=errmsg+"<br>"+"<li>论坛没有<font color=red>["&lincept(ii)&"]</font>这个用户"
				haverr=true
			else
				rs.close
				set rs=server.createobject("adodb.recordset")
				sql="select * from [dv_user] where username='"&dvbbs.membername&"'"
				rs.open sql,conn,1,3 
				if rs("userWealth")<100 then  '此处判断使用点歌必须拥有的最低资产标准，可自行修改为你所需要的
					errmsg=errmsg+"您的社区币已经低于<font color=#FF0000>100</font>元，不能再点歌了。每点一首歌将花费您<font color=#FF0000>20</font>元社区币<br>"
					haverr=true
				else
				rs("userWealth")=rs("userWealth")-20   '此处判断使用点歌所花费金钱标准，可自行修改为你所需要的
				rs.update
				rs.close
				
				sql="select * from media" 
				rs.open sql,connDG,3,2
				rs.addnew
				rs("sender")=dvbbs.membername
				rs("incept")=lincept(ii)
				rs("sendtime")=now()
				rs("content")=lcontent
				rs("medianame")=lmedianame
				rs("url")=lurl
				rs.update
				rs.close
				set rs=nothing
				
				dim sender,title,body
				sender=dvbbs.membername
				title="送给您的祝福"
				body="[color=green]"&dvbbs.membername&"[/color] 点了一首歌 [color=navy]"&lmedianame&"[/color] 给你！"&chr(10)&"祝福语：[color=blue]"&lcontent&"[/color] "&chr(10)&"[B][URL=Z_dglistme.asp]点击这里查看点歌[/URL][/B]"
				sql="insert into dv_message(incept,sender,title,content,sendtime,flag,issend) values('"&lincept(ii)&"','"&sender&"','"&title&"','"&body&"',"&SqlNowString&",0,1)"
				conn.Execute(sql)
				successmsg=successmsg+"<br><li>点歌祝福已成功发出!系统已向<font color=green>["&lincept(ii)&"]</font>发出短消息通知，并自动扣除您<font color=#FF0000>20</font>元社区币！"
				end if
			end if	
		next
	end if		
end sub

'=======================================================
'BY 凌峰 ,修正点歌漏洞.增加JS脚本检测函数和格式检查函数
'=======================================================
Function FilterJS(v)
	If  Not Isnull(V) Then
		Dim t
		Dim re
		Dim reContent
		Set re=new RegExp
		re.IgnoreCase =True
		re.Global=True
		re.Pattern="(&#)"
		t=re.Replace(v,"<I>&#</I>")
		re.Pattern="(script)"
		t=re.Replace(t,"<I>script</I>")
		re.Pattern="(js:)"
		t=re.Replace(t,"<I>js:</I>")
		re.Pattern="(value)"
		t=re.Replace(t,"<I>value</I>")
		re.Pattern="(about:)"
		t=re.Replace(t,"<I>about:</I>")
		re.Pattern="(file:)"
		t=re.Replace(t,"<I>file:</I>")
		re.Pattern="(Document.cookie)"
		t=re.Replace(t,"<I>Documents.cookie</I>")
		re.Pattern="(vbs:)"
		t=re.Replace(t,"<I>vbs:</I>")
		re.Pattern="(on(mouse|Exit|error|click|key))"
		t=re.Replace(t,"<I>on$2</I>")
		FilterJS=t
		Set Re=Nothing
	End If 
End Function

Function CheckExt(Name)
	if Not Isnull(Name) Then
		dim temp
		temp = LCase(Right(Name,4))
		if Instr(temp,"mp3") <> 0 then
			CheckExt = True
		ElseIf Instr(temp,"mid") <> 0 then
			CheckExt = True
		ElseIf Instr(temp,"avi") <> 0 then
			CheckExt = True
		ElseIf Instr(temp,"wav") <> 0 then
			CheckExt = True
		ElseIf Instr(temp,"wma") <> 0 then
			CheckExt = True
		ElseIf Instr(temp,"swf") <> 0 then
			CheckExt = True
		ElseIf Instr(temp,"mpg") <> 0 then
			CheckExt = True
		ElseIf Instr(temp,"ram") <> 0 then
			CheckExt = True
		ElseIf Instr(temp,"asf") <> 0 then
			CheckExt = True
		ElseIf Instr(temp,"ra") <> 0 then
			CheckExt = True
		ElseIf Instr(temp,"rm") <> 0 then
			CheckExt = True
		Else
			CheckExt = False
		End If
	End If
End Function
'====================================================
'函数结束
'===================================================

sub success()
%>
	<table cellpadding=3 cellspacing=1 border=0 align=center class=tableborder1>
		<tr> 
		        <th colspan="2" width="100%"><b>点歌发送情况</b></th>
		</tr>
		<tr> 
		  <td width="100%" class=tablebody1><%if haverr then%><b>操作结果:</b><br><br><%=errmsg%><br><%=successmsg%><%else%><b>操作成功:</b><br><br><%=successmsg%><%end if%></td>
		</tr>
		<tr align="center"> 
		  <td width="100%" class=tablebody2>
			<a href="javascript:history.go(-1)"> << 返回上一页</a>
		  </td>
		</tr>  
	</table>
<%
end sub
%>