<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<?php
error_reporting(0); // 生产环境建议关闭，调试时可改为 E_ALL
ini_set('display_errors', 1); // 开启错误显示，方便调试

require_once('include/config.php');
session_start();

// --- 1. 定义 GetIP 函数 (防止未定义) ---
if (!function_exists('GetIP')) {
    function GetIP() {
        if (!empty($_SERVER["HTTP_CLIENT_IP"])) {
            $cip = $_SERVER["HTTP_CLIENT_IP"];
        } elseif (!empty($_SERVER["HTTP_X_FORWARDED_FOR"])) {
            $cip = $_SERVER["HTTP_X_FORWARDED_FOR"];
        } elseif (!empty($_SERVER["REMOTE_ADDR"])) {
            $cip = $_SERVER["REMOTE_ADDR"];
        } else {
            $cip = 'unknown';
        }
        preg_match("/[\d\.]{7,15}/", $cip, $cips);
        return !empty($cips[0]) ? $cips[0] : 'unknown';
    }
}

// --- 2. 简单的黑名单检查 (直接写在这里，不依赖外部文件) ---
// 获取当前 IP
$current_ip = GetIP();
// 检查数据库 (假设 config.php 定义了 $db)
if (isset($db)) {
    $sql_check = "SELECT ip FROM blacklists"; // 确认表名
    $res_check = mysqli_query($db, $sql_check);
    if ($res_check) {
        while ($row = mysqli_fetch_assoc($res_check)) {
            if ($row['ip'] == $current_ip) {
                header("Location: https://www.wkun.com/book");
                exit;
            }
        }
    }
}

// --- 3. 原有业务逻辑 ---
if(isset($_GET['act']) && $_GET['act']=='index_keting')
{
    if(empty($_POST['username'])){
       echo "<script>window.alert('给自己想个名字吧');window.history.back();</script>";
       exit;
    }
    if(empty($_POST['content'])){
       echo "<script>window.alert('还是要写点什么吧');window.history.back();</script>";
       exit;
    }
    
    // 初始化变量
    $refs = '';
    $user_img = '';
    $verify = '';

    if( isset($_GET['ref']) && $_GET['ref'] =='m' ){
        $refs = '来自<a href="../m" title="来自 WKUN 移动版" target="_blank">移动WKUN</a>';
    } else if ( isset($_GET['ref']) && $_GET['ref'] =='yourname' ) {
        $refs='来自<a href="../m" title="来自本人移动端发布" target="_blank">本人发布</a>';
        $user_img='<img src="images/six/wangkun2026.jpg"/>';
        $verify='<img src="images/six/icon_v.svg"/>';
    }

    // --- 4. PHP 8.0 兼容：修复 strpos ---
    $mycontent = $_POST['content'];
    $hasLink = false;
    if((strpos($mycontent,"<a href=") !== false) or (strpos($mycontent,"</a>") !== false) or (strpos($mycontent,"[url=http://") !== false) or (strpos($mycontent,"[/url]") !== false) or (strpos($mycontent,"[url") !== false) or (strpos($mycontent,"http://") !== false))
    {	
        $hasLink = true;
    }

    if($hasLink) {	
        echo "<script>window.alert('发布失败！请检查是否包含非法内容...');window.history.back();</script>";
        exit;
    }
    else {
        // 图片上传
        if (!empty($_FILES['Filedata']['name']) ) {  
            $targetFolder = './images/upload'; 
            $tempFile = $_FILES['Filedata']['tmp_name'];
            $fileParts = pathinfo($_FILES['Filedata']['name']);
            $name = time().rand(11111,55555).'.'.$fileParts['extension'];
            $targetFile = $targetFolder . '/' . $name;
            $fileTypes = array('jpg','JPG','jpeg','JPEG','gif','GIF','png','PNG'); 
            
            if (in_array($fileParts['extension'],$fileTypes)) {
                 move_uploaded_file($tempFile,$targetFile);
            }
            $_POST['img']=$name;
        } 
        
        // --- 5. PHP 8.0 兼容：修复 mysqli_query 缺少 $db ---
        $sql = "insert into book(username,content,posttime,ip,img,dream,user_img,verify) values('".$_POST['username']."','".nl2br(htmlspecialchars($_POST['content']))."','".date("Y-m-d H:i:s")."','".GetIP()."','".$_POST['img']."','".$refs."','".$user_img."','".$verify."')";

        $result = mysqli_query($db, $sql);

        if (!$result) {
            die("发布失败，数据库错误：" . mysqli_error($db));
        }

        setcookie('uu',$_POST['username'],time()+60*60*24*7);
        die("<script>window.alert('发布成功，你可点击名字，只看自己发布的。');window.location.href='index.php';</script>");
    }
}
?>