Code:

$action=$_GET['xnewsaction'];
$deftemplate=GetDefaultTemplate();
$xout='';
if (!empty($_COOKIE['xnews-apskin'])){$template=$_COOKIE['xnews-apskin'];}
if (isset($_GET['xnews-template'])){$template=$_GET['xnews-template'];setcookie('xnews-apskin',$template);}
if (empty($template)){$template=$deftemplate;}
$xwrapper=file_get_contents($script['paths']['file']."templates/$template/content-wrapper.html");
if (empty($action))
{

  if (!isset($authorlist)){$authorlist=$_GET['xnews-authorlist'];}
  if (!isset($catlist)){$catlist=$_GET['xnews-catlist'];}
  $newsfiles=GetArchList($script['news']['sort']);
  $num=0;
  $newstpl=file_get_contents($script['paths']['file']."templates/$template/news-article.html");
  $news_wrapper=file_get_contents($script['paths']['file']."templates/$template/news-wrapper.html");
  if (count($newsfiles)>0)
  {
  foreach ($newsfiles as $i=>$line)
  {
     $news=GetNews($line,$catlist,$authorlist,$script['news']['show_first'],$script['news']['sort'],"");
     if (count($news)>0)
     {
     foreach ($news as $j=>$article)
      {
        $xout.=SkinNewsArticle($article,$newstpl);
        $num++;
        if ($num==$script['news']['show_first'])
        {
         break;
        }
      }
     }
      if ($num==$script['news']['show_first'])
      {
        break;
      }
  }
  }
  $news_wrapper=str_replace("{NEWS}",$xout,$news_wrapper);
  $xout=$news_wrapper;

} else if ($action=='getcomments')
 {
   $range=$_GET['range'];
   if ($range==''){$range='1-25';}
   $newsid=$_GET['newsid'];
   $newsarch=$_GET['newsarch'];
   $comments=GetComments($newsarch,$newsid,$range);
   $article=FullNews($newsarch,$newsid,'');
   $wrapper=SkinCommentsPage($article,$comments,$template,$_SERVER['SCRIPT_NAME'],$range);
   $content=str_replace("{notice}",'',$wrapper);
   $xout.=$content;
   unset($content);

 }
 else if ($action=='addcomment')
 {
   if ($script['comments']['enabled']!="ON")
   {
    $wrapper=SkinMessage('$__msg_commentsdisabled',$template);
    $xout.=$wrapper;
   }else
   {
   $author=$_POST['author'];
   $email=$_POST['email'];
   $comment=$_POST['comment'];
   $newsid=$_GET['newsid'];
   $newsarch=$_GET['newsarch'];
   if (empty($author) or empty($comment) or !VerifyCaptcha() or !VerifyCommentLength())
   {
     $notice='';
     if (empty($author)){$notice='$__msg_forgotname';}
     if (empty($comment)){if ($notice==''){$notice='$__msg_forgotcomment';}else {$notice.='<BR />$__msg_forgotcomment';}}
     if (!VerifyCaptcha()){if ($notice==''){$notice='$__msg_wrongcaptcha';}else {$notice.='<BR />$__msg_wrongcaptcha';}}
     if (!VerifyCommentLength()){if ($notice==''){$notice='$__msg_longcomment';}else {$notice.='<BR />$__msg_longcomment';}}
     $comments=GetComments($newsarch,$newsid,$range);
     $article=FullNews($newsarch,$newsid,'');
     $wrapper=SkinCommentsPage($article,$comments,$template,$_SERVER['SCRIPT_NAME'],'1-25');
     $content=str_replace("{notice}",$notice,$wrapper);
     $xout.=$content;
   }
  else {
     $post=1;
     if (IsUser($author))
     {
       if ($author!=$_COOKIE['xusername']){$post=0;}
        else
        {
         if (ValidateLogin($author,$_COOKIE['xpassword'])==1)
         {
          $post=1;
         }
        else
        {
         $post=0;
        }
       }
     }
    if ($post==1)
    {
     PostComment($newsarch,$newsid,$author,$email,$comment);
     $wrapper=SkinMessage(LanguageField('msg_commentposted',''),$template);
     $wrapper=str_replace("{LINK}",$_SERVER['SCRIPT_NAME']."?xnewsaction=getcomments&newsarch=".$newsarch."&newsid=".$newsid,$wrapper);
     $xout.=$wrapper;
    } else
    {
     $xout.= SkinMessage(LanguageField('msg_requirelogin',''),$template);
     $xout=str_replace('{REGNICK}',$author,$xout);
    }
   }
  }
 }
else if ($action=='fullnews')
{
  $newsid=$_GET['newsid'];
  $newsarch=$_GET['newsarch'];
  $article=FUllNews($newsarch,$newsid,'');
  $tpl=file_get_contents($script['paths']['file']."templates/$template/full-news-article.html");
  $c=SkinFullNewsArticle($article,$tpl);
  $xout.=$c;
}

if ($script['rss']['enabled']=="YES")
{
$feedlinkcode='<a href="'.$script['paths']['url'].'news.xml"><img src="'.$script['paths']['url'].'inc/img/rss.gif" border="0"></a>';
$feedlinkcode.='<a href="http://fusion.google.com/add?feedurl='.$script['paths']['url'].'news.xml"><img src="'.$script['paths']['url'].'inc/img/rss-google.gif" border="0"></a>';
$feedlinkcode.='<a href="http://e.my.yahoo.com/config/cstore?.opt=content&.url='.$script['paths']['url'].'news.xml"><img src="'.$script['paths']['url'].'inc/img/rss-yahoo.gif" border="0"></a>';
$xout=str_replace("{FEEDLINKS}",$feedlinkcode,$xout);
}
$xout=str_replace("{FEEDLINKS}","",$xout);
$xwrapper=str_replace("{CONTENT}",$xout,$xwrapper);
$xout=$xwrapper;
OutputWrapper($xout,1);
unset($content,$wrapper,$action,$xout);

?>

Code:

$_GET['xnews-catlist']= 2;