--- typo3conf/ext/sk_pagecomments/pi1/class.tx_skpagecomments_pi1.php.orig	2007-05-23 13:13:09.859436861 +0000
+++ typo3conf/ext/sk_pagecomments/pi1/class.tx_skpagecomments_pi1.php	2007-05-23 21:04:03.479818861 +0000
@@ -75,12 +75,29 @@
         
         
         
+		$pidList = $this->pi_getPidList($this->cObj->data['pages'],$this->conf["recursive"]);
+		if (isset($conf["pidList"])) $pidList = $conf["pidList"];
+
+
         
         $this->pageid = $GLOBALS['TSFE']->id; //page-id
-		$pidList = $this->pi_getPidList($this->cObj->data['pages'],$this->conf["recursive"]);
+				$this->orig_pageid = $this->pageid;
+
+				if ($this->conf['pageid'])
+				{
+					$pageids = split(",", $this->conf['pageid']);
+					$pageids[] = $this->pageid;
+
+					$this->pageid = implode(",", $pageids);
+
+					$pidList = split(",", $pidList);
+					$pidList = array_merge($pidList, $pageids);
+
+					$pidList = implode(",", $pidList);
+				}
+
 		$this->pi_USER_INT_obj = 1;  // Disable caching
 		
-		if (isset($conf["pidList"])) $pidList = $conf["pidList"];
 		
 		$err=array();
 		$content=$errormsg='';
@@ -131,12 +148,12 @@
         }
         
 		//Get Rec-count
-        
-		$result=$GLOBALS['TYPO3_DB']->exec_SELECTquery('count(*)','tx_skpagecomments_comments','pageid="'.$this->pageid.'" AND pid IN('.$pidList.') AND hidden="0" AND deleted="0"'.$addWhere);
+
+		$result=$GLOBALS['TYPO3_DB']->exec_SELECTquery('count(*)','tx_skpagecomments_comments','pageid IN ('.$this->pageid.') AND pid IN('.$pidList.') AND hidden="0" AND deleted="0"'.$addWhere);
 		$row=$GLOBALS['TYPO3_DB']->sql_fetch_row($result);
 		$reccount=$row[0];
-		
-        $result=$GLOBALS['TYPO3_DB']->exec_SELECTquery('count(*)','tx_skpagecomments_comments','pageid="'.$this->pageid.'" AND pid IN('.$pidList.') AND hidden="0" AND deleted="0" AND parentId="0"'.$addWhere);
+
+        $result=$GLOBALS['TYPO3_DB']->exec_SELECTquery('count(*)','tx_skpagecomments_comments','pageid IN ('.$this->pageid.') AND pid IN('.$pidList.') AND hidden="0" AND deleted="0" AND parentId="0"'.$addWhere);
 		$row=$GLOBALS['TYPO3_DB']->sql_fetch_row($result);
 		$parentcount=$row[0];
 		
@@ -147,14 +164,14 @@
 			
              if($this->conf['bindToGETvar']) {          
                  $lconf=array_merge($this->conf['formLink.'],array(
-                    'parameter' => $this->pageid,
+                    'parameter' => $this->orig_pageid,
                     'additionalParams' => $this->URLParamsArray.'&'.$this->prefixId.'[showComments]=1',
                     'section' => ($this->conf['useSectionFormLink'] ? 'CommentStart' : ''),
                 ));
                $l=$this->cObj->typolink('|',$lconf);   
             } else {
                 $lconf=array_merge($this->conf['formLink.'],array(
-                    'parameter' => $this->pageid,
+                    'parameter' => $this->orig_pageid,
                     'additionalParams' => '&'.$this->prefixId.'[showComments]=1',
                     'section' => ($this->conf['useSectionFormLink'] ? 'CommentStart' : ''),
                 ));
@@ -180,7 +197,7 @@
                 $insertArr['comment']=$this->piVars['comment']; 
 				$insertArr['crdate']=time();
 				$insertArr['tstamp']=time();
-				$insertArr['pageid']=$this->pageid;
+				$insertArr['pageid']=$this->orig_pageid;
 				$insertArr['pid']=$pidList;
 				if ($GLOBALS['TSFE']->fe_user->user['uid'] > 0) {
 					$insertArr['feuser_uid'] = $GLOBALS['TSFE']->fe_user->user['uid'];
@@ -236,7 +253,7 @@
 					$GLOBALS['TYPO3_DB']->exec_INSERTquery('tx_skpagecomments_comments',$insertArr);
                     $insertId=$GLOBALS['TYPO3_DB']->sql_insert_id();
                     if($this->conf['emailNewMessage']==1 && $this->conf['emailAddress'] && $this->conf['emailFrom']) {
-                         $link='http://'.t3lib_div::getIndpEnv('HTTP_HOST').'/'.$this->pi_getPageLink($this->pageid);
+                         $link='http://'.t3lib_div::getIndpEnv('HTTP_HOST').'/'.$this->pi_getPageLink($this->orig_pageid);
                          if($this->conf['bindToGETvar']) {
                             //add extra parameter
                             $prefix = strpos($link,'?') ? '&' : '?';
@@ -274,7 +291,7 @@
             
             $number=array();
             $i=1;         
-            $result=$GLOBALS['TYPO3_DB']->exec_SELECTquery('uid','tx_skpagecomments_comments','pageid="'.$this->pageid.'" AND pid IN('.$pidList.') AND hidden="0" AND deleted="0"'.$addWhere,'crdate asc');
+            $result=$GLOBALS['TYPO3_DB']->exec_SELECTquery('uid','tx_skpagecomments_comments','pageid in ('.$this->pageid.') AND pid IN('.$pidList.') AND hidden="0" AND deleted="0"'.$addWhere,'crdate asc');
             while($temp = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($result)) {  
                 $this->number[$temp['uid']]=$i++;
             }   
@@ -284,7 +301,7 @@
             $order='uid asc';
 			$limit=$this->conf['maxRecords']>0 ? $this->conf['maxRecords'] : '';
 			
-            $result=$GLOBALS['TYPO3_DB']->exec_SELECTquery('*','tx_skpagecomments_comments','pageid="'.$this->pageid.'" AND pid IN('.$pidList.') AND hidden="0" AND deleted="0"'.$addWhere,$order,$limit);
+            $result=$GLOBALS['TYPO3_DB']->exec_SELECTquery('*','tx_skpagecomments_comments','pageid in ('.$this->pageid.') AND pid IN('.$pidList.') AND hidden="0" AND deleted="0"'.$addWhere,$order,$limit);
             
 			if($reccount>0) {
 				if($this->conf['showCount']==1) {
@@ -328,7 +345,7 @@
                     $subpartArray['###FORMLINK###']='';
                     if($this->conf['bindToGETvar']) {          
                          $lconf=array_merge($this->conf['formLink.'],array(
-                            'parameter' => $this->pageid,
+                            'parameter' => $this->orig_pageid,
                             'additionalParams' => $this->URLParamsArray.'&'.$this->prefixId.'[showComments]=1&'.$this->prefixId.'[showForm]=1',
                             'section' => ($this->conf['useSectionFormLink'] ? 'CommentForm' : ''),
                         ));
@@ -339,7 +356,7 @@
                         }
                     } else {
                         $lconf=array_merge($this->conf['formLink.'],array(
-                            'parameter' => $this->pageid,
+                            'parameter' => $this->orig_pageid,
                             'additionalParams' => '&'.$this->prefixId.'[showComments]=1&'.$this->prefixId.'[showForm]=1',
                             'section' => ($this->conf['useSectionFormLink'] ? 'CommentForm' : ''),
                         ));
@@ -440,6 +457,15 @@
 		
 		return $this->pi_wrapInBaseClass($this->conf['showFormOnTop']==1 ? $form.$content : $content.$form);
 	}
+
+	function showFields($name, $value)
+	{
+		if (isset($this->conf['blind.'][$name]) && $this->conf['blind.'][$name] == 1)
+		{
+			return "";
+		}
+		return $value;
+	}
     
     function renderComment($temp,$level=0,$list='') {
         if($level==-1) {
@@ -457,9 +483,12 @@
         } else {
             $list=$this->cObj->getSubpart($this->subpart['comments'],'###ANSWERLIST###');
         }
-        $markerArray['###DATEPHRASE###']=sprintf($this->pi_getLL('wrote'),date($this->conf['dateFormat'],$temp['crdate']));
-       
-        $markerArray['###DATE###']=date($this->conf['dateFormat'],$temp['crdate']);
+        $markerArray['###DATEPHRASE###']=sprintf($this->pi_getLL('wrote'),$this->showDate($this->conf['dateFormat'],$temp['crdate']));
+
+       	$markerArray['###DATE###']=$this->showDate($this->conf['dateFormat'], $temp['crdate']);
+
+
+
         $markerArray['###NAME###']=$this->cObj->stdWrap($temp['name'],$this->conf['commentName.']);
         $markerArray['###NUMBER###']='<a name="comment'.$temp['uid'].'" title="ID: '.$temp['uid'].'">'.$this->cObj->stdWrap($this->number[$temp['uid']],$this->conf['commentNumber.']).'</a>'; 
         $markerArray['###MARGIN###']=$this->conf['answerMargin']*$level; 
@@ -475,24 +504,31 @@
         if($temp['homepage']!='') {
             $this->conf['homepageLink.']['parameter']=$GLOBALS['TSFE']->id; #$temp['homepage'];   
             $this->conf['homepageLink.']['additionalParams']='&'.$this->prefixId.'[goto]='.$temp['uid'];
-            $linkWrapArray['###HOMEPAGELINKWRAP###']=explode('|',$this->cObj->typolink('|',$this->conf['homepageLink.']));
+            $linkWrapArray['###HOMEPAGELINKWRAP###']=$this->showFields('homepage', explode('|',$this->cObj->typolink('|',$this->conf['homepageLink.'])));
         }
-        $markerArray['###EMAIL###']=$this->cObj->stdWrap($temp['email'],$this->conf['commentEmail.']);
-        $markerArray['###HOMEPAGE###']=$temp['homepage']!=''?$this->cObj->stdWrap($temp['homepage'],$this->conf['commentHomepage.']):'';
+        $markerArray['###EMAIL###']=$this->showFields('email', $this->cObj->stdWrap($temp['email'],$this->conf['commentEmail.']) );
+				$homepage = $temp['homepage']!=''?$this->cObj->stdWrap($temp['homepage'],$this->conf['commentHomepage.']):'';
+				
+        $markerArray['###HOMEPAGE###']=$this->showFields('homepage', $homepage);
         $markerArray['###COMMENT###']=$this->displayComment($temp['comment']);
+
+				if (!is_array($this->conf['answerLink.']))
+				{
+					$this->conf['answerLink.'] = array();
+				}
        
         
         if($this->conf['allowAnswer']) {
             if($this->conf['bindToGETvar']) {          
                  $lconf=array_merge($this->conf['answerLink.'],array(
-                    'parameter' => $this->pageid,
+                    'parameter' => $this->orig_pageid,
                     'additionalParams' => $this->URLParamsArray.'&'.$this->prefixId.'[answer]='.$temp['uid'],
                     'section' => ($this->conf['useSectionFormLink'] ? 'CommentForm' : ''),
                 ));
                $l=$this->cObj->typolink($this->cObj->stdWrap($this->pi_getLL('answer'),$this->conf['answer.']),$lconf); 
             } else {
                 $lconf=array_merge($this->conf['answerLink.'],array(
-                    'parameter' => $this->pageid,
+                    'parameter' => $this->orig_pageid,
                     'additionalParams' => '&'.$this->prefixId.'[answer]='.$temp['uid'],
                     'section' => ($this->conf['useSectionFormLink'] ? 'CommentForm' : ''),
                 ));
@@ -503,9 +539,13 @@
         	$l = $this->cObj->typolink($this->cObj->stdWrap($this->pi_getLL('registerinfo'),$this->conf['registerInfo.']),$lconf);
         	
         }
-        $markerArray['###ANSWER###']=$l;           
+        $markerArray['###ANSWER###']=$this->showFields('answer', $l);           
+
+				if ($markerArray['###COMMENT###'] != '')
+				{
+        	$content=$this->cObj->substituteMarkerArrayCached($list,$markerArray,$subpartArray,$linkWrapArray);  
+				}
 		
-        $content=$this->cObj->substituteMarkerArrayCached($list,$markerArray,$subpartArray,$linkWrapArray);  
          
         //has childs ?
         if($level!=-1 && is_array($this->childs[$temp['uid']])) {
@@ -519,6 +559,9 @@
         
     }
     function smileys() {
+
+			if (!isset($this->conf['blind.']['smileys']) || (isset($this->conf['blind.']['smileys']) && $this->conf['blind.']['smileys'] != 1))
+			{
         $res=t3lib_extMgm::siteRelPath('sk_pagecomments').'res/smileys/';
         $GLOBALS['TSFE']->additionalHeaderData['sk_pagecomments_smileys'] = '
 					<script type="text/javascript">
@@ -552,33 +595,39 @@
 			<a class="noul" href="javascript:dosmilie(\':surprised:\')"><img src="'.$res.'icon_surprised.gif" alt="Surprised" border="0" /></a>
 			</div>';
         return $smile;
+			}
+			return "";
 		
     }
     
     function displayComment($comment) {
+			if (!isset($this->conf['blind.']['smileys']) || (isset($this->conf['blind.']['smileys']) && $this->conf['blind.']['smileys'] != 1))
+			{
         $res=t3lib_extMgm::siteRelPath('sk_pagecomments').'res/smileys/';   
         $comment = str_replace(":)",'<img src="'.$res.'icon_smile.gif" alt="smile" class="smilie" border="0" />',$comment);
-	    $comment = str_replace(";)",'<img src="'.$res.'icon_wink.gif" alt="zwinker" class="smilie" border="0" />',$comment);
-	    $comment = str_replace(":D",'<img src="'.$res.'icon_biggrin.gif" alt="big green" class="smilie" border="0" />',$comment);
-	    $comment = ereg_replace(":biggrin:", '<img src="'.$res.'icon_biggrin.gif" alt="Big Grins" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":confused:", '<img src="'.$res.'icon_confused.gif" alt="Confused" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":cool:", '<img src="'.$res.'icon_cool.gif" alt="Cool" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":cry:", '<img src="'.$res.'icon_cry.gif" alt="Cry" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":eek:", '<img src="'.$res.'icon_eek.gif" alt="Eek" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":evil:", '<img src="'.$res.'icon_evil.gif" alt="Evil" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":frown:", '<img src="'.$res.'icon_frown.gif" alt="Frown" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":mad:", '<img src="'.$res.'icon_mad.gif" alt="Mad" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":mrgreen:", '<img src="'.$res.'icon_mrgreen.gif" alt="Mr. Green" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":neutral:", '<img src="'.$res.'icon_neutral.gif" alt="Neutral" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":razz:", '<img src="'.$res.'icon_razz.gif" alt="Razz" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":redface:", '<img src="'.$res.'icon_redface.gif" alt="Redface" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":rolleyes:", '<img src="'.$res.'icon_rolleyes.gif" alt="Rolleyes" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":sad:", '<img src="'.$res.'icon_sad.gif" alt="Sad" class="smilie" border="0" />', $comment);
-	    $comment = ereg_replace(":surprised:", '<img src="'.$res.'icon_surprised.gif" alt="Surprised" class="smilie" border="0" />', $comment);
+	    	$comment = str_replace(";)",'<img src="'.$res.'icon_wink.gif" alt="zwinker" class="smilie" border="0" />',$comment);
+	    	$comment = str_replace(":D",'<img src="'.$res.'icon_biggrin.gif" alt="big green" class="smilie" border="0" />',$comment);
+	    	$comment = ereg_replace(":biggrin:", '<img src="'.$res.'icon_biggrin.gif" alt="Big Grins" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":confused:", '<img src="'.$res.'icon_confused.gif" alt="Confused" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":cool:", '<img src="'.$res.'icon_cool.gif" alt="Cool" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":cry:", '<img src="'.$res.'icon_cry.gif" alt="Cry" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":eek:", '<img src="'.$res.'icon_eek.gif" alt="Eek" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":evil:", '<img src="'.$res.'icon_evil.gif" alt="Evil" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":frown:", '<img src="'.$res.'icon_frown.gif" alt="Frown" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":mad:", '<img src="'.$res.'icon_mad.gif" alt="Mad" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":mrgreen:", '<img src="'.$res.'icon_mrgreen.gif" alt="Mr. Green" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":neutral:", '<img src="'.$res.'icon_neutral.gif" alt="Neutral" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":razz:", '<img src="'.$res.'icon_razz.gif" alt="Razz" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":redface:", '<img src="'.$res.'icon_redface.gif" alt="Redface" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":rolleyes:", '<img src="'.$res.'icon_rolleyes.gif" alt="Rolleyes" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":sad:", '<img src="'.$res.'icon_sad.gif" alt="Sad" class="smilie" border="0" />', $comment);
+	    	$comment = ereg_replace(":surprised:", '<img src="'.$res.'icon_surprised.gif" alt="Surprised" class="smilie" border="0" />', $comment);
+			}
 	    
 	    
 	    //Zeilenumbrüche umwandeln
-	    $comment=preg_replace('/\r\n|\r|\n/', "<br />", trim($comment));
+			$comment=$this->disableXSS($comment);
+	   	$comment=preg_replace('/\r\n|\r|\n/', "<br />", trim($comment));
 
 	    //Links umwandeln
 	    #$comment=preg_replace("/http:\/\/(.+?)[[:space:]]/si"," <a href=\"http://$1\" target=\"_blank\">$1</a> ",$comment);
@@ -586,6 +635,31 @@
         
         return $this->cObj->stdWrap($comment,$this->conf['comment.']);
     }
+
+		function showDate($format, $time)
+		{
+				if (preg_match("/%/", $format))
+				{
+        	return strftime($format, $time);
+				}
+				else
+				{
+       		return date($format, $time);
+				}
+		}
+
+		function disableXSS($content)
+		{
+			$content = preg_replace("/<script.*>.*/i", "", $content);
+			$content = preg_replace("/<\/script.*>.*/i", "", $content);
+			$content = preg_replace("/<style.*>.*/i", "", $content);
+			$content = preg_replace("/<\/style.*>.*/i", "", $content);
+			$content = preg_replace("/<vbscript.*>.*/i", "", $content);
+			$content = preg_replace("/<\/vbscript.*>.*/i", "", $content);
+			$content = preg_replace('`(on[ a-z]+|style)=`', '', $content);
+			return $content;
+		}
+		
     
     function cleanUrlPars($arr) {
         $u='';