<?php
/*
=====================================================
 DataLife Engine - by SoftNews Media Group
-----------------------------------------------------
 https://dle-news.ru/
-----------------------------------------------------
 Copyright (c) 2004-2025 SoftNews Media Group
=====================================================
 This code is protected by copyright
=====================================================
 File: addradio.php
-----------------------------------------------------
 Use: Public add radio stream page
=====================================================
*/

if (!defined('DATALIFEENGINE')) {
	header("HTTP/1.1 403 Forbidden");
	header('Location: ../../');
	die("Hacking attempt!");
}

function dle_public_addradio_antispam_blocks(): array {
	global $db, $config, $member_id, $user_group, $lang;

	$question = '';
	$sec_code = '';
	$recaptcha = '';
	$extra_html = '';

	$show_question = !empty($user_group[$member_id['user_group']]['news_question']);
	$show_sec_code = false;
	$show_recaptcha = false;

	// Same logic as addnews: disable captcha/question after N posts.
	$disable_news_captcha = intval($user_group[$member_id['user_group']]['disable_news_captcha'] ?? 0);
	if ($disable_news_captcha && intval($member_id['news_num'] ?? 0) >= $disable_news_captcha) {
		$show_question = false;
		$user_group[$member_id['user_group']]['news_sec_code'] = false;
	}

	if ($show_question) {
		$q = $db->super_query("SELECT id, question FROM " . PREFIX . "_question ORDER BY RAND() LIMIT 1");
		if (!isset($q['id']) || !isset($q['question']) || !$q['question']) {
			$show_question = false;
		} else {
			$_SESSION['question'] = intval($q['id']);
			$question = htmlspecialchars(stripslashes($q['question']), ENT_QUOTES, 'UTF-8');
		}
	}

	if (!empty($user_group[$member_id['user_group']]['news_sec_code'])) {
		if (!empty($config['allow_recaptcha'])) {
			$show_recaptcha = true;

			$captcha_name = 'g-recaptcha';
			$captcha_url = "https://www.google.com/recaptcha/api.js?hl={$lang['language_code']}";

			if ($config['allow_recaptcha'] == 3) {
				$captcha_name = 'h-captcha';
				$captcha_url = "https://js.hcaptcha.com/1/api.js?hl={$lang['language_code']}";
			}

			if ($config['allow_recaptcha'] == 4) {
				$captcha_name = 'cf-turnstile';
				$captcha_url = 'https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha';
			}

			if ($config['allow_recaptcha'] == 2) {
				// Invisible reCAPTCHA v3: render script + submit hook.
				$recaptcha = '';
				$extra_html = "\n<script src=\"https://www.google.com/recaptcha/api.js?render={$config['recaptcha_public_key']}\" async defer></script>\n";
				$extra_html .= "<script>\n";
				$extra_html .= "document.addEventListener('DOMContentLoaded', function () {\n";
				$extra_html .= "  var form = document.getElementById('entryform');\n";
				$extra_html .= "  if (!form || typeof grecaptcha === 'undefined') return;\n";
				$extra_html .= "  form.addEventListener('submit', function (event) {\n";
				$extra_html .= "    if (form.dataset.recaptchaProcessed === '1') return;\n";
				$extra_html .= "    event.preventDefault();\n";
				$extra_html .= "    grecaptcha.execute('{$config['recaptcha_public_key']}', {action: 'addradio'}).then(function (token) {\n";
				$extra_html .= "      var input = document.getElementById('g-recaptcha-response');\n";
				$extra_html .= "      if (!input) {\n";
				$extra_html .= "        input = document.createElement('input');\n";
				$extra_html .= "        input.type = 'hidden';\n";
				$extra_html .= "        input.name = 'g-recaptcha-response';\n";
				$extra_html .= "        input.id = 'g-recaptcha-response';\n";
				$extra_html .= "        form.appendChild(input);\n";
				$extra_html .= "      }\n";
				$extra_html .= "      input.value = token;\n";
				$extra_html .= "      form.dataset.recaptchaProcessed = '1';\n";
				$extra_html .= "      HTMLFormElement.prototype.submit.call(form);\n";
				$extra_html .= "    });\n";
				$extra_html .= "  });\n";
				$extra_html .= "});\n";
				$extra_html .= "</script>\n";
			} else {
				$recaptcha = "<div class=\"{$captcha_name}\" data-sitekey=\"{$config['recaptcha_public_key']}\" data-theme=\"{$config['recaptcha_theme']}\" data-language=\"{$lang['language_code']}\"></div><script src=\"{$captcha_url}\" async defer></script>";
			}
		} else {
			$show_sec_code = true;
			$path = parse_url($config['http_home_url']);
			$img_src = ($path && isset($path['path'])) ? $path['path'] : '/';
			$sec_code = "<a onclick=\"reload(); return false;\" href=\"#\" title=\"{$lang['reload_code']}\"><span id=\"dle-captcha\"><img src=\"{$img_src}index.php?controller=antibot\" alt=\"{$lang['reload_code']}\" width=\"160\" height=\"80\" /></span></a>";
		}
	}

	return [
		'show_question' => $show_question,
		'question' => $question,
		'show_sec_code' => $show_sec_code,
		'sec_code' => $sec_code,
		'show_recaptcha' => $show_recaptcha,
		'recaptcha' => $recaptcha,
		'extra_html' => $extra_html,
	];
}

function dle_public_addradio_check_antispam(): array {
	global $db, $config, $member_id, $user_group, $lang;

	$errors = [];

	$news_question = !empty($user_group[$member_id['user_group']]['news_question']);
	$news_sec_code = !empty($user_group[$member_id['user_group']]['news_sec_code']);

	$disable_news_captcha = intval($user_group[$member_id['user_group']]['disable_news_captcha'] ?? 0);
	if ($disable_news_captcha && intval($member_id['news_num'] ?? 0) >= $disable_news_captcha) {
		$news_question = false;
		$news_sec_code = false;
	}

	if ($news_sec_code) {
		if (!empty($config['allow_recaptcha'])) {
			if (isset($_POST['g-recaptcha-response']) && $_POST['g-recaptcha-response']) {
				$reCaptcha = new ReCaptcha($config['recaptcha_private_key']);
				$resp = $reCaptcha->verifyResponse(get_ip(), $_POST['g-recaptcha-response']);
				if ($resp === null || !$resp->success) {
					$errors[] = $lang['recaptcha_fail'];
				}
			} else {
				$errors[] = $lang['recaptcha_fail'];
			}
		} elseif ((string)($_REQUEST['sec_code'] ?? '') != (string)($_SESSION['sec_code_session'] ?? '') || empty($_SESSION['sec_code_session'])) {
			$errors[] = $lang['recaptcha_fail'];
		}
	}

	if ($news_question) {
		if (intval($_SESSION['question'] ?? 0)) {
			$answer = $db->super_query("SELECT id, answer FROM " . PREFIX . "_question WHERE id='" . intval($_SESSION['question']) . "'");
			$answers = explode("\n", $answer['answer'] ?? '');
			$pass_answer = false;
			$question_answer = trim(dle_strtolower((string)($_POST['question_answer'] ?? '')));

			if (count($answers) && $question_answer) {
				foreach ($answers as $a) {
					$a = trim(dle_strtolower($a));
					if ($a && $a == $question_answer) {
						$pass_answer = true;
						break;
					}
				}
			}

			if (!$pass_answer) {
				$errors[] = $lang['reg_err_24'];
			}
		} else {
			$errors[] = $lang['reg_err_24'];
		}
	}

	return $errors;
}

function dle_public_addradio_build_metatags(string $content, string $fallbackTitle): array {
	global $db;

	$title = trim($fallbackTitle);
	if ($title === '') {
		$title = 'Radio';
	}

	$content = html_entity_decode($content, ENT_QUOTES, 'UTF-8');
	$content = strip_tags($content);
	$content = preg_replace('/\s+/u', ' ', $content);
	$content = trim($content);

	$description = $content !== '' ? dle_substr($content, 0, 190) : '';

	return [
		// Values returned are already escaped for direct SQL concatenation (like core modules do).
		'title' => $db->safesql(htmlspecialchars($title, ENT_QUOTES, 'UTF-8')),
		'description' => $db->safesql(htmlspecialchars($description, ENT_QUOTES, 'UTF-8')),
		'keywords' => $db->safesql(''),
	];
}

function dle_public_addradio_ensure_xfields(): void {
	// Keep in sync with admin addradio tool.
	$defaults = [
		'description' => '',
		'hint' => '',
		'category' => '',
		'allow_add_usergroups' => '',
		'allow_view_usergroups' => '',
		'storage' => -1,
		'type' => 'text',
		'default' => '',
		'not_required' => 1,
		'use_as_links' => 0,
		'use_editor' => 0,
		'safe_mode' => 0,
		'min' => '',
		'max' => '',
		'allow_multi' => 0,
		'select_separator' => '',
		'links_separator' => '',
		'image_sizes' => '',
		'image_size' => '',
		'image_max_size' => '',
		'make_watermark' => 0,
		'make_thumb' => 0,
		'thumb_size' => '',
		'max_images' => '',
		'use_opengraph' => '',
		'image_side' => '',
		'thumb_side' => '',
		'max_files' => '',
		'max_size' => '',
		'files_ext' => '',
		'file_max_size' => '',
		'is_public' => '',
		'condition' => '',
		'date_format' => '',
		'date_view_format' => '',
		'date_local' => '',
		'date_declension' => '',
		'group' => '',
		'allow_in_news' => 0,
		'lazy_load' => '',
	];

	DLEXFields::Init();

	$ensure = function (string $name, array $data) use ($defaults): void {
		$current = DLEXFields::GETField($name);
		if (is_array($current) && count($current)) {
			return;
		}
		$data = array_merge($defaults, $data);
		$data['name'] = $name;
		DLEXFields::SaveField($name, $data);
	};

	$ensure('songname', [
		'description' => 'Title',
		'type' => 'text',
		'not_required' => 0,
		'safe_mode' => 1,
	]);

	$ensure('artistsong', [
		'description' => 'Subtitle',
		'type' => 'text',
		'not_required' => 1,
		'safe_mode' => 1,
		'default' => 'Radio',
	]);

	$ensure('is_radio', [
		'description' => 'Is radio stream',
		'type' => 'yesorno',
		'not_required' => 1,
		'default' => '1',
	]);

	$ensure('radiostream', [
		'description' => 'Stream URL',
		'type' => 'text',
		'not_required' => 0,
		'safe_mode' => 1,
	]);

	$ensure('radiocover', [
		'description' => 'Cover URL',
		'type' => 'text',
		'not_required' => 1,
		'safe_mode' => 1,
	]);
}

// Page meta
$canonical = DLEUrl::BuildUrl('addradio', []);

if (!$is_logged || !$user_group[$member_id['user_group']]['allow_adds']) {
	@header("HTTP/1.1 403 Forbidden");
	msgbox($lang['all_info'], $lang['add_err_9'] ?? $lang['news_info_5']);
	return;
}

// Ensure xfields exist (safe if already present).
dle_public_addradio_ensure_xfields();

$metatags['title'] = $lang['addnews_title'] ?? 'Add Radio';

// Handle submit
if (isset($_POST['mod']) && $_POST['mod'] === 'addradio') {
	@header('X-XSS-Protection: 0;');

	$errors = [];

	if (!isset($_POST['user_hash']) || !$_POST['user_hash'] || $_POST['user_hash'] != $dle_login_hash) {
		$errors[] = $lang['sess_error'];
	}

	if (!isset($_POST['duplicateprotection']) || (isset($_SESSION['dp']['dp_' . md5($_POST['duplicateprotection'])]) && $_SESSION['dp']['dp_' . md5($_POST['duplicateprotection'])] === true)) {
		$errors[] = $lang['duplicate_protect'];
	}

	$errors = array_merge($errors, dle_public_addradio_check_antispam());

	$title_raw = isset($_POST['title']) ? trim((string)$_POST['title']) : '';
	$stream_url = isset($_POST['radiostream']) ? trim((string)$_POST['radiostream']) : '';
	$cover_url = '';
	$short_desc_raw = isset($_POST['short_desc']) ? trim((string)$_POST['short_desc']) : '';

	if ($title_raw === '') {
		$errors[] = $lang['addnews_alert'];
	} elseif (dle_strlen($title_raw) > 150) {
		$errors[] = $lang['addnews_ermax'];
	}

	if ($stream_url === '') {
		$errors[] = 'Stream URL is required';
	} elseif (!preg_match('#^https?://#i', $stream_url)) {
		$errors[] = 'Stream URL must start with http:// or https://';
	}

	if ($short_desc_raw !== '' && dle_strlen($short_desc_raw) > 300) {
		$errors[] = 'Short description must be max 300 characters';
	}

	// Optional cover upload overrides URL
	if (isset($_FILES['radiocover_file']) && is_array($_FILES['radiocover_file']) && isset($_FILES['radiocover_file']['error']) && $_FILES['radiocover_file']['error'] !== UPLOAD_ERR_NO_FILE) {
		if ($_FILES['radiocover_file']['error'] !== UPLOAD_ERR_OK) {
			$errors[] = 'Cover upload failed';
		} elseif (!isset($_FILES['radiocover_file']['tmp_name']) || !is_uploaded_file($_FILES['radiocover_file']['tmp_name'])) {
			$errors[] = 'Cover upload failed';
		} else {
			$max_size = 5 * 1024 * 1024;
			if (isset($_FILES['radiocover_file']['size']) && intval($_FILES['radiocover_file']['size']) > $max_size) {
				$errors[] = 'Cover image is too large (max 5MB)';
			}

			$img_info = @getimagesize($_FILES['radiocover_file']['tmp_name']);
			if (!$img_info || !isset($img_info['mime'])) {
				$errors[] = 'Cover file must be an image';
			} else {
				$allowed = [
					'image/jpeg' => 'jpg',
					'image/png' => 'png',
					'image/webp' => 'webp',
					'image/gif' => 'gif',
				];

				$mime = strtolower($img_info['mime']);
				if (!isset($allowed[$mime])) {
					$errors[] = 'Unsupported cover image type';
				} elseif (!count($errors)) {
					$ext = $allowed[$mime];
					$cover_dir_rel = 'uploads/posts/radio';
					$cover_dir_abs = ROOT_DIR . '/' . $cover_dir_rel;
					if (!is_dir($cover_dir_abs)) {
						@mkdir($cover_dir_abs, 0777, true);
						@chmod($cover_dir_abs, 0777);
					}
					if (!is_dir($cover_dir_abs) || !is_writable($cover_dir_abs)) {
						$errors[] = 'Cover upload directory is not writable';
					} else {
						$rand = '';
						try {
							$rand = bin2hex(random_bytes(6));
						} catch (Throwable $e) {
							$rand = md5(uniqid('', true));
						}
						$filename = 'radio_' . time() . '_' . $rand . '.' . $ext;
						$dest_abs = $cover_dir_abs . '/' . $filename;
						if (!@move_uploaded_file($_FILES['radiocover_file']['tmp_name'], $dest_abs)) {
							$errors[] = 'Failed to save cover image';
						} else {
							@chmod($dest_abs, 0666);
							$cover_url = $config['http_home_url'] . $cover_dir_rel . '/' . $filename;
						}
					}
				}
			}
		}
	}

	if (count($errors)) {
		msgbox($lang['all_info'], '<ul><li>' . implode('</li><li>', $errors) . '</li></ul>');
		return;
	}

	// Build xfields
	if (!isset($_POST['xfield']) || !is_array($_POST['xfield'])) {
		$_POST['xfield'] = [];
	}

	$_POST['xfield']['is_radio'] = '1';
	$_POST['xfield']['radiostream'] = $stream_url;
	if ($cover_url !== '') {
		$_POST['xfield']['radiocover'] = $cover_url;
	}
	$_POST['xfield']['songname'] = $title_raw;
	$_POST['xfield']['artistsong'] = 'Radio';

	// If theme/player uses mp3, keep it populated.
	if (!isset($_POST['xfield']['mp3']) || trim((string)$_POST['xfield']['mp3']) === '') {
		$_POST['xfield']['mp3'] = $stream_url;
	}

	$parsed_fields = DLEXFields::Parse();
	if (DLEXFields::$error) {
		msgbox($lang['all_info'], DLEXFields::$error);
		return;
	}

	$filecontents = $parsed_fields['filecontents'];
	$xf_search_words = $parsed_fields['search_words'];
	$all_xf_content = $parsed_fields['all_xf_content'];
	unset($parsed_fields);

	$parse = new ParseFilter();
	$parse->allow_code = false;

	$title = $parse->process(trim(strip_tags($title_raw)));
	$title_db = $db->safesql($title);
	$alt_name = $db->safesql(totranslit(stripslashes($title), true, false, $config['translit_url']));

	// Short description (plain-ish)
	$short_desc_raw = strip_tags($short_desc_raw);
	$short_desc_raw = preg_replace('/\s+/u', ' ', $short_desc_raw);
	$short_desc_raw = trim($short_desc_raw);

	$short_story = '';
	if ($short_desc_raw !== '') {
		$short_story = $parse->process($short_desc_raw);
		$short_story = $db->safesql($parse->BB_Parse($short_story));
	}

	$full_story = '';

	$approve = 1;
	if (!$user_group[$member_id['user_group']]['moderation']) {
		$approve = 0;
	}

	$allow_main = 0;
	$allow_comm = 0;
	$news_fixed = 0;
	$allow_rating = 0;
	$disable_index = 0;
	$disable_search = 0;
	$need_pass = 0;
	$allow_rss = 1;
	$allow_rss_dzen = 0;
	$allowed_country = '';
	$not_allowed_country = '';
	$related_ids = '';
	$group_regel = '';

	if (!isset($_POST['catlist']) || !is_array($_POST['catlist'])) {
		$_POST['catlist'] = [];
	}

	if (!count($_POST['catlist'])) {
		$catlist = ['0'];
	} else {
		$catlist = $_POST['catlist'];
	}

	$category_list_arr = [];
	foreach ($catlist as $value) {
		$category_id = intval($value);
		if ($category_id > 0) {
			if (isset($cat_info[$category_id]) && is_array($cat_info[$category_id])) {
				$category_list_arr[] = $category_id;
			}
		}
	}

	if (!count($category_list_arr)) {
		$category_list_arr = [0];
	}

	$catlist = $category_list_arr;
	$category_list = $db->safesql(implode(',', $category_list_arr));
	$_POST['category'] = $catlist;

	$added_time = time();
	$thistime = date("Y-m-d H:i:s", $added_time);
	$author = $member_id['name'];
	$userid = $member_id['user_id'];

	if (dle_strlen($short_story) > 12) {
		$all_xf_content = stripslashes($short_story) . ' ' . $all_xf_content;
	}

	$metatags_local = dle_public_addradio_build_metatags($all_xf_content, $title);
	$catalog_url = $db->safesql(dle_substr(htmlspecialchars(strip_tags(stripslashes($title)), ENT_QUOTES, 'UTF-8'), 0, 1));

	$db->query("INSERT INTO " . PREFIX . "_post (date, autor, short_story, full_story, xfields, title, descr, keywords, category, alt_name, allow_comm, approve, allow_main, fixed, allow_br, symbol, tags, metatitle) values ('{$thistime}', '{$author}', '{$short_story}', '{$full_story}', '{$filecontents}', '{$title_db}', '{$metatags_local['description']}', '{$metatags_local['keywords']}', '{$category_list}', '{$alt_name}', '{$allow_comm}', '{$approve}', '{$allow_main}', '{$news_fixed}', '0', '{$catalog_url}', '', '{$metatags_local['title']}')");

	$id = $db->insert_id();

	$db->query("INSERT INTO " . PREFIX . "_post_extras (news_id, allow_rate, votes, disable_index, related_ids, access, user_id, disable_search, need_pass, allow_rss, allow_rss_dzen, allowed_country, not_allowed_country) VALUES('{$id}', '{$allow_rating}', '0', '{$disable_index}', '{$related_ids}', '{$group_regel}', '{$userid}', '{$disable_search}', '{$need_pass}', '{$allow_rss}', '{$allow_rss_dzen}', '{$allowed_country}', '{$not_allowed_country}')");

	if (count($xf_search_words) && $approve) {
		$temp_array = [];
		foreach ($xf_search_words as $value) {
			$temp_array[] = "('" . $id . "', '" . $value[0] . "', '" . $value[1] . "')";
		}
		$xf_search_words_sql = implode(", ", $temp_array);
		$db->query("INSERT INTO " . PREFIX . "_xfsearch (news_id, tagname, tagvalue) VALUES " . $xf_search_words_sql);
	}

	$db->query("UPDATE " . PREFIX . "_images SET news_id='{$id}', author = '{$author}' WHERE author = '" . $db->safesql($member_id['name']) . "' AND news_id = '0'");
	$db->query("UPDATE " . PREFIX . "_files SET news_id='{$id}', author = '{$author}' WHERE author = '" . $db->safesql($member_id['name']) . "' AND news_id = '0'");
	$db->query("UPDATE " . USERPREFIX . "_users SET news_num=news_num+1 WHERE user_id='{$userid}'");

	clear_cache(['news_', 'tagscloud_', 'archives_', 'calendar_', 'topnews_', 'rss', 'stats']);

	$_SESSION['dp']['dp_' . md5($_POST['duplicateprotection'])] = true;
	$_SESSION['sec_code_session'] = 0;
	$_SESSION['question'] = false;

	if ($approve) {
		msgbox($lang['all_info'], 'Radio station added successfully.');
	} else {
		msgbox($lang['all_info'], 'Radio station submitted and is waiting for moderation.');
	}

	return;
}

// Render form
$duplicateprotection = UniqIDReal(32);

$tpl->load_template('addradio.tpl');

$tpl->set('{header-title}', htmlspecialchars($lang['addnews_title'] ?? 'Add Radio', ENT_QUOTES, 'UTF-8'));

$tpl->set('{radio-title}', isset($_POST['title']) ? htmlspecialchars((string)$_POST['title'], ENT_QUOTES, 'UTF-8') : '');
$tpl->set('{radio-stream}', isset($_POST['radiostream']) ? htmlspecialchars((string)$_POST['radiostream'], ENT_QUOTES, 'UTF-8') : '');
$tpl->set('{radio-short}', isset($_POST['short_desc']) ? htmlspecialchars((string)$_POST['short_desc'], ENT_QUOTES, 'UTF-8') : '');

// Categories (same placeholder as addnews.tpl)
// Important: CategoryNewsSelection() returns <option> list only; we must wrap it in <select>.
// Also force addnews category permission logic for parity.
$__saved_dle_module = $dle_module;
$dle_module = 'addnews';

if (isset($_POST['catlist']) && is_array($_POST['catlist']) && count($_POST['catlist'])) {
	$cat_list = array_map('intval', $_POST['catlist']);
	$categories_list = CategoryNewsSelection($cat_list, 0);
} elseif (isset($_GET['category']) && $_GET['category']) {
	$categories_list = CategoryNewsSelection(explode(',', (string)$_GET['category']), 0);
} else {
	$categories_list = CategoryNewsSelection(0, 0);
}

$dle_module = $__saved_dle_module;
unset($__saved_dle_module);

if ($config['allow_multi_category']) {
	$cats = "<select data-placeholder=\"{$lang['addnews_cat_sel']}\" name=\"catlist[]\" id=\"category\" onchange=\"if (typeof onCategoryChange === 'function') onCategoryChange(this);\" style=\"width:350px;height:140px;\" multiple=\"multiple\">";
} else {
	$cats = "<select data-placeholder=\"{$lang['addnews_cat_sel']}\" name=\"catlist[]\" id=\"category\" onchange=\"if (typeof onCategoryChange === 'function') onCategoryChange(this);\" style=\"width:350px;\">";
}

$cats .= $categories_list;
$cats .= "</select>";

$tpl->set('{category}', $cats);

$anti = dle_public_addradio_antispam_blocks();

if ($anti['show_question']) {
	$tpl->set('{question}', $anti['question']);
	$tpl->set('[question]', '');
	$tpl->set('[/question]', '');
} else {
	$tpl->set_block("'\\[question\\](.*?)\\[/question\\]'si", "");
	$tpl->set('{question}', '');
}

if ($anti['show_sec_code']) {
	$tpl->set('{sec_code}', $anti['sec_code']);
	$tpl->set('[sec_code]', '');
	$tpl->set('[/sec_code]', '');
} else {
	$tpl->set_block("'\\[sec_code\\](.*?)\\[/sec_code\\]'si", "");
	$tpl->set('{sec_code}', '');
}

if ($anti['show_recaptcha']) {
	$tpl->set('{recaptcha}', $anti['recaptcha']);
	$tpl->set('[recaptcha]', '');
	$tpl->set('[/recaptcha]', '');
} else {
	$tpl->set_block("'\\[recaptcha\\](.*?)\\[/recaptcha\\]'si", "");
	$tpl->set('{recaptcha}', '');
}

$tpl->compile('content');

$form_open = "<form method=\"post\" name=\"entryform\" id=\"entryform\" enctype=\"multipart/form-data\" action=\"\">";
$form_close = "\n<input type=\"hidden\" name=\"mod\" value=\"addradio\">";
$form_close .= "\n<input type=\"hidden\" name=\"user_hash\" value=\"" . htmlspecialchars($dle_login_hash, ENT_QUOTES, 'UTF-8') . "\">";
$form_close .= "\n<input type=\"hidden\" name=\"duplicateprotection\" value=\"" . htmlspecialchars($duplicateprotection, ENT_QUOTES, 'UTF-8') . "\">\n</form>";

$tpl->result['content'] = $form_open . $tpl->result['content'] . $form_close . ($anti['extra_html'] ?? '');

$tpl->clear();
