0
+ − 1 <?php
+ − 2 /*
+ − 3 Plugin Name: Runt - the Enano administration panel
+ − 4 Plugin URI: http://enanocms.org/
+ − 5 Description: Provides the page Special:Administration, which is the AJAX frontend to the various Admin:
+ − 6 Author: Dan Fuhry
+ − 7 Version: 1.0
+ − 8 Author URI: http://enanocms.org/
+ − 9 */
+ − 10
+ − 11 /*
+ − 12 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
+ − 13 * Version 1.0 release candidate 2
+ − 14 * Copyright (C) 2006-2007 Dan Fuhry
+ − 15 *
+ − 16 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
+ − 17 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
+ − 18 *
+ − 19 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ − 20 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
+ − 21 */
+ − 22
+ − 23 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 24
+ − 25 $plugins->attachHook('base_classes_initted', '
+ − 26 global $paths;
+ − 27 $paths->add_page(Array(
+ − 28 \'name\'=>\'Administration\',
+ − 29 \'urlname\'=>\'Administration\',
+ − 30 \'namespace\'=>\'Special\',
+ − 31 \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',
+ − 32 ));
+ − 33
+ − 34 $paths->add_page(Array(
+ − 35 \'name\'=>\'Manage the Sidebar\',
+ − 36 \'urlname\'=>\'EditSidebar\',
+ − 37 \'namespace\'=>\'Special\',
+ − 38 \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',
+ − 39 ));
+ − 40 ');
+ − 41
+ − 42 // function names are IMPORTANT!!! The name pattern is: page_<namespace ID>_<page URLname, without namespace>
+ − 43
+ − 44 function page_Admin_Home() {
+ − 45 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 46 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 47 {
+ − 48 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 49 return;
+ − 50 }
+ − 51
+ − 52
+ − 53 // Basic information
+ − 54 echo RenderMan::render(
+ − 55 '== Welcome to Runt, the Enano administration panel. ==
+ − 56
+ − 57 Thank you for choosing Enano as your CMS. This screen allows you to see some information about your website, plus some details about how your site is doing statistically.
+ − 58
+ − 59 Using the links on the left you can control every aspect of your website\'s look and feel, plus you can manage users, work with pages, and install plugins to make your Enano installation even better.');
+ − 60
+ − 61 // Check for the installer scripts
+ − 62 if(file_exists(ENANO_ROOT.'/install.php') || file_exists(ENANO_ROOT.'/schema.sql'))
+ − 63 {
+ − 64 echo '<div class="error-box"><b>NOTE:</b> It appears that your install.php and/or schema.sql files still exist. It is HIGHLY RECOMMENDED that you delete or rename these files, to prevent getting your server hacked.</div>';
+ − 65 }
+ − 66
+ − 67 // Inactive users
+ − 68 $q = $db->sql_query('SELECT * FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\';');
+ − 69 if($q)
+ − 70 if($db->numrows() > 0)
+ − 71 {
+ − 72 $n = $db->numrows();
+ − 73 if($n == 1) $s = $n . ' user is';
+ − 74 else $s = $n . ' users are';
+ − 75 echo '<div class="warning-box">It appears that '.$s.' awaiting account activation. You can activate those accounts by going to the <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'UserManager\'); return false;">User Manager</a>.</div>';
+ − 76 }
+ − 77 $db->free_result();
+ − 78 // Stats
+ − 79 if(getConfig('log_hits') == '1')
+ − 80 {
+ − 81 $stats = stats_top_pages(10);
+ − 82 $c = 0;
+ − 83 $cls = 'row2';
+ − 84 echo '<h3>Most requested pages</h3><div class="tblholder"><table style="width: 100%;" border="0" cellspacing="1" cellpadding="4"><tr><th>Page</th><th>Hits</th></tr>';
+ − 85 foreach($stats as $page => $count)
+ − 86 {
+ − 87 if(isset($paths->pages[$page]))
+ − 88 {
+ − 89 echo '<tr>';
+ − 90 $cls = ( $cls == 'row1' ) ? 'row2' : 'row1';
+ − 91 echo '<td class="'.$cls.'"><a href="'.makeUrl($page).'">'.$paths->pages[$page]['name'].'</a></td><td style="text-align: center;" class="'.$cls.'">'.$count.'</td>';
+ − 92 echo '</tr>';
+ − 93 }
+ − 94 }
+ − 95 echo '</table></div>';
+ − 96 }
+ − 97
+ − 98 // Security log
+ − 99 echo '<h3>Security log</h3>';
+ − 100 echo '<div class="tblholder" style="/* max-height: 500px; clip: rect(0px,auto,auto,0px); overflow: auto; */"><table border="0" cellspacing="1" cellpadding="4" width="100%">';
+ − 101 $cls = 'row2';
+ − 102 echo '<tr><th style="width: 60%;">Type</th><th>Date</th><th>Username</th><th>IP Address</th></tr>';
+ − 103 if(isset($_GET['fulllog']))
+ − 104 {
+ − 105 $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC;';
+ − 106 }
+ − 107 else
+ − 108 {
+ − 109 $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC LIMIT 5';
+ − 110 }
+ − 111 $q = $db->sql_query($l);
+ − 112 while($r = $db->fetchrow())
+ − 113 {
+ − 114 if($cls == 'row2') $cls = 'row1';
+ − 115 else $cls = 'row2';
+ − 116 echo '<tr><td class="'.$cls.'">';
+ − 117 switch($r['action']) {
+ − 118 case "admin_auth_good": echo 'Successful elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); echo "<br /><small>Authentication level: $level</small>"; } break;
+ − 119 case "admin_auth_bad": echo 'Failed administration logon'; break;
+ − 120 case "activ_good": echo 'Successful account activation'; break;
+ − 121 case "auth_good": echo 'Successful regular user logon'; break;
+ − 122 case "activ_bad": echo 'Failed account activation'; break;
+ − 123 case "auth_bad": echo 'Failed regular user logon'; break;
+ − 124 case "sql_inject": echo 'SQL injection attempt<div style="max-width: 90%; clip: rect(0px,auto,auto,0px); overflow: auto; display: block; font-size: smaller;">Offending query: ' . htmlspecialchars($r['page_text']) . '</div>'; break;
+ − 125 case "db_backup": echo 'Database backup created<br /><small>Tables: ' . $r['page_text'] . '</small>'; break;
+ − 126 case "install_enano": echo "Installed Enano version {$r['page_text']}"; break;
+ − 127 }
+ − 128 echo '</td><td class="'.$cls.'">'.date('d M Y h:i a', $r['time_id']).'</td><td class="'.$cls.'">'.$r['author'].'</td><td class="'.$cls.'" style="cursor: pointer;" onclick="ajaxReverseDNS(this);" title="Click for reverse DNS info">'.$r['edit_summary'].'</td></tr>';
+ − 129 }
+ − 130 $db->free_result();
+ − 131 echo '</table></div>';
+ − 132 if(!isset($_GET['fulllog'])) echo '<p><a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'Home&fulllog\'); return false;">Full security log</a></p>';
+ − 133
+ − 134 }
+ − 135
+ − 136 function page_Admin_GeneralConfig() {
+ − 137 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 138 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 139 {
+ − 140 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 141 return;
+ − 142 }
+ − 143
+ − 144 if(isset($_POST['submit'])) {
+ − 145
+ − 146 // Global site options
+ − 147 setConfig('site_name', $_POST['site_name']);
+ − 148 setConfig('site_desc', $_POST['site_desc']);
+ − 149 setConfig('main_page', str_replace(' ', '_', $_POST['main_page']));
+ − 150 setConfig('copyright_notice', $_POST['copyright']);
+ − 151 setConfig('contact_email', $_POST['contact_email']);
+ − 152
+ − 153 // Wiki mode
+ − 154 if(isset($_POST['wikimode'])) setConfig('wiki_mode', '1');
+ − 155 else setConfig('wiki_mode', '0');
+ − 156 if(isset($_POST['wiki_mode_require_login'])) setConfig('wiki_mode_require_login', '1');
+ − 157 else setConfig('wiki_mode_require_login', '0');
+ − 158 if(isset($_POST['editmsg'])) setConfig('wiki_edit_notice', '1');
+ − 159 else setConfig('wiki_edit_notice', '0');
+ − 160 setConfig('wiki_edit_notice_text', $_POST['editmsg_text']);
+ − 161
+ − 162 // Stats
+ − 163 if(isset($_POST['log_hits'])) setConfig('log_hits', '1');
+ − 164 else setConfig('log_hits', '0');
+ − 165
+ − 166 // Disablement
+ − 167 if(isset($_POST['site_disabled'])) { setConfig('site_disabled', '1'); setConfig('site_disabled_notice', $_POST['site_disabled_notice']); }
+ − 168 else setConfig('site_disabled', '0');
+ − 169
+ − 170 // Account activation
+ − 171 setConfig('account_activation', $_POST['account_activation']);
+ − 172
+ − 173 // W3C compliance buttons
+ − 174 if(isset($_POST['w3c-vh32'])) setConfig("w3c_vh32", "1");
+ − 175 else setConfig("w3c_vh32", "0");
+ − 176 if(isset($_POST['w3c-vh40'])) setConfig("w3c_vh40", "1");
+ − 177 else setConfig("w3c_vh40", "0");
+ − 178 if(isset($_POST['w3c-vh401'])) setConfig("w3c_vh401", "1");
+ − 179 else setConfig("w3c_vh401", "0");
+ − 180 if(isset($_POST['w3c-vxhtml10'])) setConfig("w3c_vxhtml10", "1");
+ − 181 else setConfig("w3c_vxhtml10", "0");
+ − 182 if(isset($_POST['w3c-vxhtml11'])) setConfig("w3c_vxhtml11", "1");
+ − 183 else setConfig("w3c_vxhtml11", "0");
+ − 184 if(isset($_POST['w3c-vcss'])) setConfig("w3c_vcss", "1");
+ − 185 else setConfig("w3c_vcss", "0");
+ − 186
+ − 187 // SourceForge.net logo
+ − 188 if(isset($_POST['showsf'])) setConfig('sflogo_enabled', '1');
+ − 189 else setConfig('sflogo_enabled', '0');
+ − 190 setConfig('sflogo_groupid', $_POST['sfgroup']);
+ − 191 setConfig('sflogo_type', $_POST['sflogo']);
+ − 192
+ − 193 // Comment options
+ − 194 if(isset($_POST['comment-approval'])) setConfig('approve_comments', '1');
+ − 195 else setConfig('approve_comments', '0');
+ − 196 if(isset($_POST['enable-comments'])) setConfig('enable_comments', '1');
+ − 197 else setConfig('enable_comments', '0');
+ − 198 setConfig('comments_need_login', $_POST['comments_need_login']);
+ − 199
+ − 200 // Powered by link
+ − 201 if ( isset($_POST['enano_powered_link']) ) setConfig('powered_btn', '1');
+ − 202 else setConfig('powered_btn', '0');
+ − 203
+ − 204 if(isset($_POST['dbdbutton'])) setConfig('dbd_button', '1');
+ − 205 else setConfig('dbd_button', '0');
+ − 206
+ − 207 if($_POST['emailmethod'] == 'phpmail') setConfig('smtp_enabled', '0');
+ − 208 else setConfig('smtp_enabled', '1');
+ − 209
+ − 210 setConfig('smtp_server', $_POST['smtp_host']);
+ − 211 setConfig('smtp_user', $_POST['smtp_user']);
+ − 212 if($_POST['smtp_pass'] != 'XXXXXXXXXXXX') setConfig('smtp_password', $_POST['smtp_pass']);
+ − 213
+ − 214 echo '<div class="info-box">Your changes to the site configuration have been saved.</div><br />';
+ − 215
+ − 216 }
+ − 217 echo('<form name="main" action="'.htmlspecialchars(makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module'])).'" method="post" onsubmit="if(!submitAuthorized) return false;">');
+ − 218 ?>
+ − 219 <div class="tblholder">
+ − 220 <table border="0" width="100%" cellspacing="1" cellpadding="4">
+ − 221
+ − 222 <!-- Global options -->
+ − 223
+ − 224 <tr><th colspan="2">Global site options</th></tr>
+ − 225 <tr><th colspan="2" class="subhead">These options control the entire site.</th></tr>
+ − 226
+ − 227 <tr><td class="row1" style="width: 50%;">Site name:</td> <td class="row1" style="width: 50%;"><input name="site_name" size="30" value="<?php echo getConfig('site_name'); ?>" /></td></tr>
+ − 228 <tr><td class="row2">Site description:</td> <td class="row2"><input name="site_desc" size="30" value="<?php echo getConfig('site_desc'); ?>" /></td></tr>
+ − 229 <tr><td class="row1">Main page:</td> <td class="row1"><?php echo $template->pagename_field('main_page', str_replace('_', ' ', getConfig('main_page'))); ?></td></tr>
+ − 230 <tr><td class="row2">Copyright notice shown on pages:</td><td class="row2"><input name="copyright" size="30" value="<?php echo getConfig('copyright_notice'); ?>" /></td></tr>
+ − 231 <tr><td class="row1" colspan="2">Hint: If you're using Windows, you can make a "©" symbol by holding ALT and pressing 0169 on the numeric keypad.</td></tr>
+ − 232 <tr><td class="row2">Contact e-mail<br /><small>All e-mail sent from this site will appear to have come from the address shown here.</small></td><td class="row2"><input name="contact_email" type="text" size="40" value="<?php echo htmlspecialchars(getConfig('contact_email')); ?>" /></td></tr>
+ − 233
+ − 234 <!-- Wiki mode -->
+ − 235
+ − 236 <tr><th colspan="2">Wiki mode</th></tr>
+ − 237
+ − 238 <tr>
+ − 239 <td class="row3" rowspan="2">
+ − 240 Enano can also act as a wiki, meaning anyone can edit and create pages. To enable Wiki Mode, check the box to the right.<br /><br />
+ − 241 In Wiki Mode, certain HTML tags such as <script> and <object> are disabled, and all PHP code is disabled, except if the person editing the page is an administrator.<br /><br />
+ − 242 Also, Enano keeps complete page history, which makes restoring vandalized pages easy. You can also protect pages so that they cannot be edited.
+ − 243 </td>
+ − 244 <td class="row1">
+ − 245 <input type="checkbox" name="wikimode" id="wikimode" <?php if(getConfig('wiki_mode')=='1') echo('CHECKED '); ?> /><label for="wikimode">Enable Wiki Mode</label>
+ − 246 </td>
+ − 247 </tr>
+ − 248
+ − 249 <tr><td class="row2"><label><input type="checkbox" name="wiki_mode_require_login"<?php if(getConfig('wiki_mode_require_login')=='1') echo('CHECKED '); ?>/> Only for logged in users</label></td></tr>
+ − 250
+ − 251 <tr>
+ − 252 <td class="row3" rowspan="2">
+ − 253 <b>Edit page notice</b><br />
+ − 254 When Wiki Mode is enabled, anyone can edit pages. Check the box below and enter a message to display it whenever the page editor is opened.
+ − 255 </td>
+ − 256 <td class="row1">
+ − 257 <input onclick="if(this.checked) document.getElementById('editmsg_text').style.display='block'; else document.getElementById('editmsg_text').style.display='none';" type="checkbox" name="editmsg" id="editmsg" <?php if(getConfig('wiki_edit_notice')=='1') echo('CHECKED '); ?>/> <label for="editmsg">Show a message whenever pages are edited</label>
+ − 258 </td>
+ − 259 </tr>
+ − 260
+ − 261 <tr>
+ − 262 <td class="row2">
+ − 263 <textarea <?php if(getConfig('wiki_edit_notice')!='1') echo('style="display:none" '); ?>rows="5" cols="30" name="editmsg_text" id="editmsg_text"><?php echo getConfig('wiki_edit_notice_text'); ?></textarea>
+ − 264 </td>
+ − 265 </tr>
+ − 266
+ − 267 <!-- Site statistics -->
+ − 268
+ − 269 <tr><th colspan="2">Statistics and hit counting</th></tr>
+ − 270
+ − 271 <tr>
+ − 272 <td class="row1">Enano has the ability to show statistics for every page on the site. This allows you to keep very close track of who is visiting your site, and from where.<br /><br />Unfortunately, some users don't like being logged. For this reason, you should state clearly what is logged (usually the username or IP address, current time, page name, and referer URL) in your privacy policy. If your site is primarily geared towards children, and you are a United States citizen, you are required to have a privacy policy stating exactly what is being logged under the terms of the Childrens' Online Privacy Protection Act.</td>
+ − 273 <td class="row1"><label><input type="checkbox" name="log_hits" <?php if(getConfig('log_hits') == '1') echo 'checked="checked" '; ?>/> Log all page hits</label><br /><small>This excludes special and administration pages.</small></td>
+ − 274 </tr>
+ − 275
+ − 276 <!-- Comment options -->
+ − 277
+ − 278 <tr><th colspan="2">Comment system</th></tr>
+ − 279 <tr><td class="row1"><label for="enable-comments"><b>Enable the comment system</b></label> </td><td class="row1"><input name="enable-comments" id="enable-comments" type="checkbox" <?php if(getConfig('enable_comments')=='1') echo('CHECKED '); ?>/></td></tr>
+ − 280 <tr><td class="row2"><label for="comment-approval">Require approval before article comments can be shown</label></td><td class="row2"><input name="comment-approval" id="comment-approval" type="checkbox" <?php if(getConfig('approve_comments')=='1') echo('CHECKED '); ?>/></td></tr>
+ − 281 <tr><td class="row1">Guest comment posting allowed </td><td class="row1"><label><input name="comments_need_login" type="radio" value="0" <?php if(getConfig('comments_need_login')=='0') echo 'CHECKED '; ?>/> Yes</label>
+ − 282 <label><input name="comments_need_login" type="radio" value="1" <?php if(getConfig('comments_need_login')=='1') echo 'CHECKED '; ?>/> Require visual confirmation</label>
+ − 283 <!-- Default permissions --> <label><input name="comments_need_login" type="radio" value="2" <?php if(getConfig('comments_need_login')=='2') echo 'CHECKED '; ?>/> No (require login)</label></td></tr>
+ − 284
+ − 285 <!--
+ − 286
+ − 287 READ: Do not try to enable this, backend support for it has been disabled. To edit default
+ − 288 permissions, select The Entire Website in any permissions editor window.
+ − 289
+ − 290 <tr><th colspan="2">Default permissions for pages</th></tr>
+ − 291
+ − 292 <tr>
+ − 293 <td class="row1">You can edit the default set of permissions used when no other permissions are available. Permissions set here are used when no other permissions are available. As with other ACL rules, you can assign these defaults to every user or one specific user or group.</td>
+ − 294 <td class="row1"><a href="#" onclick="ajaxOpenACLManager('__DefaultPermissions', 'Special'); return false;">Manage default permissions</a></td>
+ − 295 </tr>
+ − 296
+ − 297 -->
+ − 298
+ − 299 <!-- enanocms.org link -->
+ − 300
+ − 301 <tr>
+ − 302 <th colspan="2">Promote Enano</th>
+ − 303 </tr>
+ − 304 <tr>
+ − 305 <td class="row3">
+ − 306 If you think Enano is nice, or if you want to show your support for the Enano team, you can do so by placing a link to the Enano
+ − 307 homepage in your Links sidebar block. You absolutely don't have to do this, and you won't get degraded support if you don't. Because
+ − 308 Enano is still relatively new in the CMS world, it needs all the attention it can get - and you can easily help to spread the word
+ − 309 using this link.
+ − 310 </td>
+ − 311 <td class="row1">
+ − 312 <label>
+ − 313 <input name="enano_powered_link" type="checkbox" <?php if(getConfig('powered_btn') == '1') echo 'checked="checked"'; ?> /> Place a link to www.enanocms.org on the sidebar
+ − 314 </label>
+ − 315 </td>
+ − 316 </tr>
+ − 317
+ − 318 <!-- Site disablement -->
+ − 319
+ − 320 <tr><th colspan="2">Disable all site access</th></tr>
+ − 321
+ − 322 <tr>
+ − 323 <td class="row3" rowspan="2">Disabling the site allows you to work on the site without letting non-administrators see or use it.</td>
+ − 324 <td class="row1"><label><input onclick="if(this.checked) document.getElementById('site_disabled_notice').style.display='block'; else document.getElementById('site_disabled_notice').style.display='none';" type="checkbox" name="site_disabled" <?php if(getConfig('site_disabled') == '1') echo 'checked="checked" '; ?>/> Disable this site</label></td>
+ − 325 </tr>
+ − 326 <tr>
+ − 327 <td class="row2">
+ − 328 <div id="site_disabled_notice">
+ − 329 Message to show to users:<br />
+ − 330 <textarea name="site_disabled_notice" rows="7" cols="30"><?php echo getConfig('site_disabled_notice'); ?></textarea>
+ − 331 </div>
+ − 332 </td>
+ − 333 </tr>
+ − 334
+ − 335 <!-- Account activation -->
+ − 336
+ − 337 <tr><th colspan="2">User account activation</th></tr>
+ − 338
+ − 339 <tr>
+ − 340 <td class="row3" colspan="2">
+ − 341 If you would like to require users to confirm their e-mail addresses by way of account activation, you can enable this behavior here. If this option is set to "None", users will be able to register and use this site without confirming their e-mail addresses. If this option is set to "User", users will automatically be sent e-mails upon registration with a link to activate their accounts. And lastly, if this option is set to "Admin", users' accounts will not be active until an administrator activates the account.<br /><br />
+ − 342 You may also disable registration completely if needed.<br /><br />
+ − 343 <b>Note: because of abuse by project administrators, sending account activation e-mails will not work on SourceForge.net servers.</b>
+ − 344 </td>
+ − 345 </tr>
+ − 346
+ − 347 <tr>
+ − 348 <td class="row1">Account activation:</td><td class="row1">
+ − 349 <?php
+ − 350 echo '<label><input'; if(getConfig('account_activation') == 'disable') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="disable" /> Disable registration</label><br />';
+ − 351 echo '<label><input'; if(getConfig('account_activation') != 'user' && getConfig('account_activation') != 'admin') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="none" /> None</label>';
+ − 352 echo '<label><input'; if(getConfig('account_activation') == 'user') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="user" /> User</label>';
+ − 353 echo '<label><input'; if(getConfig('account_activation') == 'admin') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="admin" /> Admin</label>';
+ − 354 ?>
+ − 355 </td>
+ − 356 </tr>
+ − 357
+ − 358 <!-- E-mail options -->
+ − 359
+ − 360 <tr><th colspan="2">E-mail sent from the site</th></tr>
+ − 361 <tr><td class="row1">E-mail sending method:<br /><small>Try using the built-in e-mail method first. If that doesn't work, you will need to enter valid SMTP information here.</small></td>
+ − 362 <td class="row1"><label><input <?php if(getConfig('smtp_enabled') != '1') echo 'checked="checked"'; ?> type="radio" name="emailmethod" value="phpmail" />PHP's built-in mail() function</label><br />
+ − 363 <label><input <?php if(getConfig('smtp_enabled') == '1') echo 'checked="checked"'; ?> type="radio" name="emailmethod" value="smtp" />Use an external SMTP server</label></td>
+ − 364 </tr>
+ − 365 <tr><td class="row2">SMTP hostname:<br /><small>This option only applies to the external SMTP mode.</small></td>
+ − 366 <td class="row2"><input value="<?php echo getConfig('smtp_server'); ?>" name="smtp_host" type="text" size="30" /></td>
+ − 367 </tr>
+ − 368 <tr><td class="row1">SMTP credentials:<br /><small>This option only applies to the external SMTP mode.</small></td>
+ − 369 <td class="row1">Username: <input value="<?php echo getConfig('smtp_user'); ?>" name="smtp_user" type="text" size="30" /><br />
+ − 370 Password: <input value="<?php if(getConfig('smtp_password') != false) echo 'XXXXXXXXXXXX'; ?>" name="smtp_pass" type="password" size="30" /></td>
+ − 371 </tr>
+ − 372
+ − 373 <!-- SourceForge.net logo -->
+ − 374
+ − 375 <tr><th colspan="2">SourceForge.net logo</th></tr>
+ − 376
+ − 377 <tr>
+ − 378 <td colspan="2" class="row3">
+ − 379 All projects hosted by SourceForge.net are required to display an official SourceForge.net logo on their pages. If you want
+ − 380 to display a SourceForge.net logo on the sidebar, check the box below, enter your group ID, and select an image type.
+ − 381 </td>
+ − 382 </tr>
+ − 383
+ − 384 <?php
+ − 385 if(getConfig("sflogo_enabled")=='1') $c='CHECKED ';
+ − 386 else $c='';
+ − 387 if(getConfig("sflogo_groupid")) $g=getConfig("sflogo_groupid");
+ − 388 else $g='';
+ − 389 if(getConfig("sflogo_type")) $t=getConfig("sflogo_type");
+ − 390 else $t='1';
+ − 391 ?>
+ − 392
+ − 393 <tr>
+ − 394 <td class="row1">Display the SourceForge.net logo on the right sidebar</td>
+ − 395 <td class="row1"><input type=checkbox name="showsf" id="showsf" <?php echo $c; ?> /></td>
+ − 396 </tr>
+ − 397
+ − 398 <tr>
+ − 399 <td class="row2">Group ID:</td>
+ − 400 <td class="row2"><input value="<?php echo $g; ?>" type=text size=15 name=sfgroup /></td>
+ − 401 </tr>
+ − 402
+ − 403 <tr>
+ − 404 <td class="row1">Logo style:</td>
+ − 405 <td class="row1">
+ − 406 <select name="sflogo">
+ − 407 <option <?php if($t=='1') echo('SELECTED '); ?>value=1>88x31px, white</option>
+ − 408 <option <?php if($t=='2') echo('SELECTED '); ?>value=2>125x37px, white</option>
+ − 409 <option <?php if($t=='3') echo('SELECTED '); ?>value=3>125x37px, black</option>
+ − 410 <option <?php if($t=='4') echo('SELECTED '); ?>value=4>125x37px, blue</option>
+ − 411 <option <?php if($t=='5') echo('SELECTED '); ?>value=5>210x62px, white</option>
+ − 412 <option <?php if($t=='6') echo('SELECTED '); ?>value=6>210x62px, black</option>
+ − 413 <option <?php if($t=='7') echo('SELECTED '); ?>value=7>210x62px, blue</option>
+ − 414 </select>
+ − 415 </td>
+ − 416 </tr>
+ − 417
+ − 418 <!-- W3C validator buttons -->
+ − 419
+ − 420 <tr><th colspan="2">W3C compliance logos</th></tr>
+ − 421 <tr><th colspan="2" class="subhead">Enano generates (by default) Valid XHTML 1.1 code, plus valid CSS. If you want to show this off, check the appropriate boxes below.</th></tr>
+ − 422
+ − 423 <tr><td class="row1"><label for="w3c-vh32">HTML 3.2</label> </td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vh32')=='1') echo('CHECKED '); ?> id="w3c-vh32" name="w3c-vh32" /></td></tr>
+ − 424 <tr><td class="row2"><label for="w3c-vh40">HTML 4.0</label> </td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vh40')=='1') echo('CHECKED '); ?> id="w3c-vh40" name="w3c-vh40" /></td></tr>
+ − 425 <tr><td class="row1"><label for="w3c-vh401">HTML 4.01</label> </td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vh401')=='1') echo('CHECKED '); ?> id="w3c-vh401" name="w3c-vh401" /></td></tr>
+ − 426 <tr><td class="row2"><label for="w3c-vxhtml10">XHTML 1.0</label></td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vxhtml10')=='1') echo('CHECKED '); ?> id="w3c-vxhtml10" name="w3c-vxhtml10" /></td></tr>
+ − 427 <tr><td class="row1"><label for="w3c-vxhtml11">XHTML 1.1</label></td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vxhtml11')=='1') echo('CHECKED '); ?> id="w3c-vxhtml11" name="w3c-vxhtml11" /></td></tr>
+ − 428 <tr><td class="row2"><label for="w3c-vcss">CSS</label> </td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vcss')=='1') echo('CHECKED '); ?> id="w3c-vcss" name="w3c-vcss" /></td></tr>
+ − 429
+ − 430 <!-- DefectiveByDesign.org ad -->
+ − 431
+ − 432 <tr><th colspan="2">Defective By Design Anti-DRM button</th></tr>
+ − 433 <tr><td colspan="2" class="row3"><b>The Enano project is strongly against Digital Restrictions Management.</b> DRM removes the freedoms that every consumer should have: to freely copy and use digital media items they legally purchased to their own devices. Showing your opposition to DRM is as easy as checking the box below to place a link to <a href="http://www.defectivebydesign.org">DefectiveByDesign.org</a> on your sidebar.</td></tr>
+ − 434 <tr><td class="row1"><label for="dbdbutton">Help stop DRM by placing a link to DBD on the sidebar!</label></td><td class="row1"><input type="checkbox" name="dbdbutton" id="dbdbutton" <?php if(getConfig('dbd_button')=='1') echo('checked="checked" '); ?>/></td></tr>
+ − 435
+ − 436 <!-- Save button -->
+ − 437
+ − 438 <tr><th style="text-align: right" class="subhead" colspan="2"><input type=submit name=submit value="Save changes" /></th></tr>
+ − 439
+ − 440 </table>
+ − 441 </div>
+ − 442 </form>
+ − 443 <?php
+ − 444 }
+ − 445
+ − 446 function page_Admin_UploadConfig()
+ − 447 {
+ − 448 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 449 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 450 {
+ − 451 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 452 return;
+ − 453 }
+ − 454
+ − 455 if(isset($_POST['save']))
+ − 456 {
+ − 457 if(isset($_POST['enable_uploads'])) setConfig('enable_uploads', '1'); else setConfig('enable_uploads', '0');
+ − 458 if(isset($_POST['enable_imagemagick'])) setConfig('enable_imagemagick', '1'); else setConfig('enable_imagemagick', '0');
+ − 459 if(isset($_POST['cache_thumbs'])) setConfig('cache_thumbs', '1'); else setConfig('cache_thumbs', '0');
+ − 460 if(isset($_POST['file_history'])) setConfig('file_history', '1'); else setConfig('file_history', '0');
+ − 461 if(file_exists($_POST['imagemagick_path'])) setConfig('imagemagick_path', $_POST['imagemagick_path']);
+ − 462 else echo '<span style="color: red"><b>Warning:</b> the file "'.$_POST['imagemagick_path'].'" was not found, and the ImageMagick file path was not updated.</span>';
+ − 463 $max_upload = floor((float)$_POST['max_file_size'] * (int)$_POST['fs_units']);
+ − 464 setConfig('max_file_size', $max_upload.'');
+ − 465 }
+ − 466 echo '<form name="main" action="'.htmlspecialchars(makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module'])).'" method="post">';
+ − 467 ?>
+ − 468 <h3>File upload configuration</h3>
+ − 469 <p>Enano supports the ability to upload files to your website and store the files in the database. This enables you to embed images
+ − 470 and such into pages without manually writing the HTML. However, the upload feature can sometimes pose a risk to your site, as viruses
+ − 471 and executable files can sometimes be uploaded.</p>
+ − 472 <p><label><input type="checkbox" name="enable_uploads" <?php if(getConfig('enable_uploads')=='1') echo 'checked="checked"'; ?> /> <b>Enable file uploads</b></label></p>
+ − 473 <p>Maximum file size: <input name="max_file_size" onkeyup="if(!this.value.match(/^([0-9\.]+)$/ig)) this.value = this.value.substr(0,this.value.length-1);" value="<?php echo getConfig('max_file_size'); ?>" /> <select name="fs_units"><option value="1" selected="selected">bytes</option><option value="1024">KB</option><option value="1048576">MB</option></select></p>
+ − 474 <p>You can allow Enano to generate thumbnails of images automatically. This feature requires ImageMagick to work properly. If your server
+ − 475 does not have ImageMagick on it, Enano will simply make your users' browsers scale the images. In most cases this is fine, but if you
+ − 476 are uploading large (>100KB) images and embedding them inside of pages, you should try to enable ImageMagick because transferring these
+ − 477 large images many times can cost you quite a lot of bandwidth.</p>
+ − 478 <p><label><input type="checkbox" name="enable_imagemagick" <?php if(getConfig('enable_imagemagick')=='1') echo 'checked="checked"'; ?> /> Use ImageMagick to scale images</label><br />
+ − 479 Path to ImageMagick: <input type="text" name="imagemagick_path" value="<?php if(getConfig('imagemagick_path')) echo getConfig('imagemagick_path'); else echo '/usr/bin/convert'; ?>" /><br />
+ − 480 On Linux and Unix servers, the most likely options here are /usr/bin/convert and /usr/local/bin/convert. If you server runs Windows, then
+ − 481 ImageMagick is most likely to be C:\Windows\Convert.exe or C:\Windows\System32\Convert.exe.
+ − 482 </p>
+ − 483 <p>If you use ImageMagick to scale images, your server will be very busy constantly scaling images if your website is busy, and your site
+ − 484 may experience slowdowns. You can dramatically speed up this scaling process if you use a directory to cache thumbnail images.</p>
+ − 485 <p><b>Please note:</b> the cache/ directory on your server <u>must</u> be writable by the server. While this is not usually a problem on
+ − 486 Windows servers, most Linux/Unix servers will require you to CHMOD the cache/ directory to 777. See your FTP client's user guide for
+ − 487 more information on how to do this.<?php if(!is_writable(ENANO_ROOT.'/cache/')) echo ' <b>At present, it seems that the cache directory
+ − 488 is not writable. The checkbox below has been disabled to maintain the stability of Enano.</b>'; ?></p>
+ − 489 <p><label><input type="checkbox" name="cache_thumbs" <?php if(getConfig('cache_thumbs')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; elseif(!is_writable(ENANO_ROOT.'/cache/')) echo 'readonly="readonly"'; ?> /> Cache thumbnailed images</label></p>
+ − 490 <p>Lastly, you can choose whether file history will be saved. If this option is turned on, you will be able to roll back any malicious
+ − 491 changes made to uploaded files, but this requires a significant amount of database storage. You should probably leave this option
+ − 492 enabled unless you have less than 250MB of MySQL database space.</p>
+ − 493 <p><label><input type="checkbox" name="file_history" <?php if(getConfig('file_history')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; ?> /> Keep a history of uploaded files</label></p>
+ − 494 <hr style="margin-left: 1em;" />
+ − 495 <p><input type="submit" name="save" value="Save changes" style="font-weight: bold;" /></p>
+ − 496 <?php
+ − 497 echo '</form>';
+ − 498 }
+ − 499
+ − 500 function page_Admin_PluginManager() {
+ − 501 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 502 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 503 {
+ − 504 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 505 return;
+ − 506 }
+ − 507
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 508 if(isset($_GET['action']))
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 509 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 510 switch($_GET['action'])
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 511 {
0
+ − 512 case "enable":
+ − 513 setConfig('plugin_'.$_GET['plugin'], '1');
+ − 514 break;
+ − 515 case "disable":
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 516 if ( $_GET['plugin'] != 'SpecialAdmin.php' )
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 517 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 518 setConfig('plugin_'.$_GET['plugin'], '0');
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 519 }
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 520 else
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 521 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 522 echo('<h3>Error disabling plugin</h3><p>The administration panel plugin cannot be disabled.</p>');
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 523 }
0
+ − 524 break;
+ − 525 }
+ − 526 }
+ − 527 $dir = './plugins/';
+ − 528 $plugin_list = Array();
+ − 529 $system = Array();
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 530
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 531 if (is_dir($dir))
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 532 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 533 if ($dh = opendir($dir))
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 534 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 535 while (($file = readdir($dh)) !== false)
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 536 {
0
+ − 537 if(preg_match('#^(.*?)\.php$#is', $file) && $file != 'index.php')
+ − 538 {
+ − 539 if ( in_array($file, $plugins->system_plugins) )
+ − 540 {
+ − 541 $thelist =& $system;
+ − 542 continue;
+ − 543 }
+ − 544 else
+ − 545 {
+ − 546 $thelist =& $plugin_list;
+ − 547 }
+ − 548 $f = file_get_contents($dir . $file);
+ − 549 $f = explode("\n", $f);
+ − 550 $f = array_slice($f, 2, 7);
+ − 551 $f[0] = substr($f[0], 13, strlen($f[0]));
+ − 552 $f[1] = substr($f[1], 12, strlen($f[1]));
+ − 553 $f[2] = substr($f[2], 13, strlen($f[2]));
+ − 554 $f[3] = substr($f[3], 8, strlen($f[3]));
+ − 555 $f[4] = substr($f[4], 9, strlen($f[4]));
+ − 556 $f[5] = substr($f[5], 12, strlen($f[5]));
+ − 557 $thelist[$file] = Array();
+ − 558 $thelist[$file]['name'] = $f[0];
+ − 559 $thelist[$file]['uri'] = $f[1];
+ − 560 $thelist[$file]['desc'] = $f[2];
+ − 561 $thelist[$file]['auth'] = $f[3];
+ − 562 $thelist[$file]['vers'] = $f[4];
+ − 563 $thelist[$file]['aweb'] = $f[5];
+ − 564 }
+ − 565 }
+ − 566 closedir($dh);
+ − 567 }
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 568 else
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 569 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 570 echo '<div class="error-box">The plugins/ directory could not be opened.</div>';
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 571 return;
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 572 }
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 573 }
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 574 else
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 575 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 576 echo '<div class="error-box">The plugins/ directory is missing from your Enano installation.</div>';
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 577 return;
0
+ − 578 }
+ − 579 echo('<div class="tblholder"><table border="0" width="100%" cellspacing="1" cellpadding="4">
+ − 580 <tr><th>Plugin filename</th><th>Plugin name</th><th>Description</th><th>Author</th><th>Version</th><th></th></tr>');
+ − 581 $plugin_files = array_keys($plugin_list);
+ − 582 $cls = 'row2';
+ − 583 for ( $i = 0; $i < sizeof($plugin_files); $i++ )
+ − 584 {
+ − 585 $cls = ( $cls == 'row2' ) ? 'row3' : 'row2';
+ − 586 echo '<tr>
+ − 587 <td class="'.$cls.'">'.$plugin_files[$i].'</td>
+ − 588 <td class="'.$cls.'"><a href="'.$plugin_list[$plugin_files[$i]]['uri'].'">'.$plugin_list[$plugin_files[$i]]['name'].'</a></td>
+ − 589 <td class="'.$cls.'">'.$plugin_list[$plugin_files[$i]]['desc'].'</td>
+ − 590 <td class="'.$cls.'"><a href="'.$plugin_list[$plugin_files[$i]]['aweb'].'">'.$plugin_list[$plugin_files[$i]]['auth'].'</a></td>
+ − 591 <td class="'.$cls.'">'.$plugin_list[$plugin_files[$i]]['vers'].'</td>
+ − 592 <td class="'.$cls.'">';
+ − 593 if ( getConfig('plugin_'.$plugin_files[$i]) == '1' )
+ − 594 {
+ − 595 echo '<a href="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'&action=disable&plugin='.$plugin_files[$i].'">Disable</a>';
+ − 596 }
+ − 597 else
+ − 598 {
+ − 599 echo '<a href="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'&action=enable&plugin='.$plugin_files[$i].'">Enable</a>';
+ − 600 }
+ − 601 echo '</td></tr>';
+ − 602 }
+ − 603 echo '</table></div>';
+ − 604 }
+ − 605
+ − 606 function page_Admin_UploadAllowedMimeTypes()
+ − 607 {
+ − 608 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 609 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 610 {
+ − 611 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 612 return;
+ − 613 }
+ − 614
+ − 615 global $mime_types, $mimetype_exps, $mimetype_extlist;
+ − 616 if(isset($_POST['save']))
+ − 617 {
+ − 618 $bits = '';
+ − 619 $keys = array_keys($mime_types);
+ − 620 foreach($keys as $i => $k)
+ − 621 {
+ − 622 if(isset($_POST['ext_'.$k])) $bits .= '1';
+ − 623 else $bits .= '0';
+ − 624 }
+ − 625 $bits = compress_bitfield($bits);
+ − 626 setConfig('allowed_mime_types', $bits);
+ − 627 echo '<div class="info-box">Your changes have been saved.</div>';
+ − 628 }
+ − 629 $allowed = fetch_allowed_extensions();
+ − 630 ?>
+ − 631 <h3>Allowed file types</h3>
+ − 632 <p>Using the form below, you can decide which file types are allowed to be uploaded to this site.</p>
+ − 633 <?php
+ − 634 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', (( isset($_GET['sqldbg'])) ? 'sqldbg&' : '') .'module='.$paths->cpage['module']).'" method="post">';
+ − 635 $c = -1;
+ − 636 $t = -1;
+ − 637 $cl = 'row1';
+ − 638 echo "\n".' <div class="tblholder">'."\n".' <table cellspacing="1" cellpadding="2" style="margin: 0; padding: 0;" border="0">'."\n".' <tr>'."\n ";
+ − 639 foreach($mime_types as $e => $m)
+ − 640 {
+ − 641 $c++;
+ − 642 $t++;
+ − 643 if($c == 3)
+ − 644 {
+ − 645 $c = 0;
+ − 646 $cl = ( $cl == 'row1' ) ? 'row2' : 'row1';
+ − 647 echo '</tr>'."\n".' <tr>'."\n ";
+ − 648 }
+ − 649 $seed = "extchkbx_{$e}_".md5(microtime() . mt_rand());
+ − 650 $chk = (!empty($allowed[$e])) ? ' checked="checked"' : '';
+ − 651 echo " <td class='$cl'>\n <label><input id='{$seed}' type='checkbox' name='ext_{$e}'{$chk} />.{$e}\n ({$m})</label>\n </td>\n ";
+ − 652 }
+ − 653 while($c < 2)
+ − 654 {
+ − 655 $c++;
+ − 656 echo " <td class='{$cl}'></td>\n ";
+ − 657 }
+ − 658 echo '<tr><th class="subhead" colspan="3"><input type="submit" name="save" value="Save changes" /></th></tr>';
+ − 659 echo '</tr>'."\n".' </table>'."\n".' </div>';
+ − 660 echo '</form>';
+ − 661 ?>
+ − 662 <?php
+ − 663 }
+ − 664
+ − 665 function page_Admin_Sidebar()
+ − 666 {
+ − 667 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 668 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 669 {
+ − 670 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 671 return;
+ − 672 }
+ − 673
+ − 674 ?>
+ − 675 <h2>Editing and managing the Enano sidebar</h2>
+ − 676 <p>The Enano sidebar is a versatile tool when scripted correctly. You don't have to be a programmer to enjoy the features the Sidebar
+ − 677 provides; however, editing the sidebar requires a small bit of programming knowledge and an understanding of Enano's system message
+ − 678 markup language.
+ − 679 </p>
+ − 680 <p>The Enano system markup language is somewhat similar to HTML, in that it uses tags (<example>like this</example>) for the
+ − 681 main syntax. However, Enano uses curly brackets ({ and }) as opposed to less-than and greater-than signs (< and >).</p>
+ − 682 <p>Programming the Enano sidebar requires the use of two tags: {slider} and {if}. The {slider} tag is used to create a new heading
+ − 683 on the sidebar, and all text enclosed in that tag will be collapsed when the heading is clicked. To specify the text on the heading,
+ − 684 use an equals sign (=) after the "slider" text. Then insert any links (they should be wiki-formatted) to internal Enano pages and
+ − 685 external sites.</p>
+ − 686 <p>So here is what the language for the default sidebar's "Navigation" heading looks like:</p>
+ − 687 <pre>{slider=Navigation}
+ − 688 [[Main Page|Home]]
+ − 689 [[Enano:Sidebar|Edit the sidebar]]
+ − 690 {/slider}</pre>
+ − 691 <p>Pretty simple, huh? Good, now we're going to learn another common aspect of Enano programming: conditionals. The {if} tag allows you
+ − 692 to decide whether a portion of the sidebar will be displayed based on a template variable. Currently the only available conditions are
+ − 693 "user_logged_in" and "auth_admin", but more will be added soon. To use a conditional, enter {if conditional_name}, and then the
+ − 694 wiki-formatted text that you want to be under that condition, and then close the tag with {/if}. In the same way, you can reverse the
+ − 695 effect with {!if}. With {!if}, the closing tag is still {/if}, so keep that in mind. An {else} tag will be supported soon.</p>
+ − 696 <p>Now it's time for some real fun: variables. All template variables can be accessed from the sidebar. A variable is simply the
+ − 697 variable name, prefixed by a dollar sign ($). Some of the most common variables are $USERNAME, $SITE_NAME, $SITE_DESC, and $PAGE_NAME.
+ − 698 The sidebar also has some special variables that it uses for some of its links. The logout link can be added with $LOGOUT_LINK, and
+ − 699 the "change theme" button can be added with $STYLE_LINK.</p>
+ − 700 <p>So here is the Enano markup for the portion of the sidebar that contains the user tools:</p>
+ − 701 <pre>{slider=$USERNAME}
+ − 702 [[User:$USERNAME|User page]]
+ − 703 [[Special:Contributions?user=$USERNAME|My Contributions]]
+ − 704 {if user_logged_in}
+ − 705 [[Special:Preferences|Preferences]]
+ − 706 $THEME_LINK
+ − 707 {/if}
+ − 708 {if auth_admin}
+ − 709 [[Special:Administration|Administration]]
+ − 710 {/if}
+ − 711 {if user_logged_in}
+ − 712 $LOGOUT_LINK
+ − 713 {/if}
+ − 714 {!if user_logged_in}
+ − 715 Create an account
+ − 716 Log in
+ − 717 {/if}
+ − 718 {/slider}</pre>
+ − 719 <?php
+ − 720 }
+ − 721
+ − 722 function page_Admin_UserManager() {
+ − 723 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 724 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 725 {
+ − 726 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 727 return;
+ − 728 }
+ − 729
+ − 730 if(isset($_POST['go'])) {
+ − 731 // We need the user ID before we can do anything
+ − 732 $q = $db->sql_query('SELECT user_id,username,email,real_name,style,user_level FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_POST['username']) . '\'');
+ − 733 if(!$q) die('Error selecting user ID: '.mysql_error());
+ − 734 if($db->numrows() < 1) { echo('User does not exist, please enter another username.'); return; }
+ − 735 $r = $db->fetchrow();
+ − 736 $db->free_result();
+ − 737 if(isset($_POST['save']))
+ − 738 {
+ − 739 $_POST['level'] = intval($_POST['level']);
+ − 740
+ − 741 $new_level = $_POST['level'];
+ − 742 $old_level = intval($r['user_level']);
+ − 743
+ − 744 $re = $session->update_user((int)$r['user_id'], $_POST['new_username'], false, $_POST['new_pass'], $_POST['email'], $_POST['real_name'], false, $_POST['level']);
+ − 745
+ − 746 if($re == 'success')
+ − 747 {
+ − 748
+ − 749 if ( $new_level != $old_level )
+ − 750 {
+ − 751 $user_id = intval($r['user_id']);
+ − 752 // We need to update group memberships
+ − 753 if ( $old_level == USER_LEVEL_ADMIN )
+ − 754 {
+ − 755 $session->remove_user_from_group($user_id, GROUP_ID_ADMIN);
+ − 756 }
+ − 757 else if ( $old_level == USER_LEVEL_MOD )
+ − 758 {
+ − 759 $session->remove_user_from_group($user_id, GROUP_ID_MOD);
+ − 760 }
+ − 761
+ − 762 if ( $new_level == USER_LEVEL_ADMIN )
+ − 763 {
+ − 764 $session->add_user_to_group($user_id, GROUP_ID_ADMIN, false);
+ − 765 }
+ − 766 else if ( $new_level == USER_LEVEL_MOD )
+ − 767 {
+ − 768 $session->add_user_to_group($user_id, GROUP_ID_MOD, false);
+ − 769 }
+ − 770 }
+ − 771
+ − 772 echo('<div class="info-box">Your changes have been saved.</div>');
+ − 773 }
+ − 774 else
+ − 775 {
+ − 776 echo('<div class="error-box">Error saving changes: '.implode('<br />', $re).'</div>');
+ − 777 }
+ − 778 $q = $db->sql_query('SELECT user_id,username,email,real_name,style,user_level FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['username']).'\'');
+ − 779 if ( !$q )
+ − 780 {
+ − 781 die('Error selecting user ID: '.mysql_error());
+ − 782 }
+ − 783 if($db->numrows($q) < 1)
+ − 784 {
+ − 785 die('User does not exist, please enter another username.');
+ − 786 }
+ − 787 $r = mysql_fetch_object($q);
+ − 788 $db->free_result();
+ − 789 }
+ − 790 elseif(isset($_POST['deleteme']) && isset($_POST['delete_conf']))
+ − 791 {
+ − 792 $q = $db->sql_query('DELETE FROM users WHERE user_id='.$r['user_id'].';');
+ − 793 if($q)
+ − 794 {
+ − 795 echo '<div class="error-box">The user account "'.$r['username'].'" was deleted.</div>';
+ − 796 }
+ − 797 else
+ − 798 {
+ − 799 echo '<div class="error-box">The user account "'.$r['username'].'" could not be deleted due to a database error.<br /><br />'.$db->get_error().'</div>';
+ − 800 }
+ − 801 }
+ − 802 else
+ − 803 {
+ − 804 echo('
+ − 805 <h3>Edit User Info</h3>
+ − 806 <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">
+ − 807 <table border="0" style="margin-left: 0.2in;">
+ − 808 <tr><td>Username:</td><td><input type="text" name="new_username" value="'.$r['username'].'" /></td></tr>
+ − 809 <tr><td>New Password:</td><td><input type="password" name="new_pass" /></td></tr>
+ − 810 <tr><td>E-mail:</td><td><input type="text" name="email" value="'.$r['email'].'" /></td></tr>
+ − 811 <tr><td>Real Name:</td><td><input type="text" name="real_name" value="'.$r['real_name'].'" /></td></tr>
+ − 812 <tr><td>User level:</td><td><select name="level"><option '); if($r['user_level']==USER_LEVEL_CHPREF) echo('SELECTED'); echo(' value="'.USER_LEVEL_CHPREF.'">Regular User</option><option '); if($r['user_level']==USER_LEVEL_MOD) echo('SELECTED'); echo(' value="'.USER_LEVEL_MOD.'">Moderator</option><option '); if($r['user_level']==USER_LEVEL_ADMIN) echo('SELECTED'); echo(' value="'.USER_LEVEL_ADMIN.'">Administrator</option></select></td></tr>
+ − 813 <tr><td>Delete user:</td><td><input type="hidden" name="go" /><input type="hidden" name="username" value="'.$r['username'].'" /><input onclick="return confirm(\'This is your last warning.\n\nAre you sure you want to delete this user account? Even if you delete this user account, the username will be shown in page edit history, comments, and other areas of the site.\n\nDeleting a user account CANNOT BE UNDONE and should only be done in extreme circumstances.\n\nIf the user has violated the site policy, deleting the account will not prevent him from using the site, for that you need to add a new ban rule.\n\nContinue deleting this user account?\')" type="submit" name="deleteme" value="Delete this user" style="color: red;" /> <label><input type="checkbox" name="delete_conf" /> I\'m absolutely sure</label>
+ − 814 <tr><td align="center" colspan="2">
+ − 815 <input type="submit" name="save" value="Save Changes" /></td></tr>
+ − 816 </table>
+ − 817 </form>
+ − 818 ');
+ − 819 }
+ − 820 } elseif(isset($_POST['clearsessions'])) {
+ − 821 // Get the current session information so the user doesn't get logged out
+ − 822 $aes = new AESCrypt();
+ − 823 $sk = md5($session->sid_super);
+ − 824 $qb = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.$sk.'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_ADMIN);
+ − 825 if(!$qb) die('Error selecting session key info block B: '.$db->get_error());
+ − 826 if($db->numrows($qb) < 1) die('Error: cannot read admin session info block B, aborting table clear process');
+ − 827 $qa = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.md5($session->sid).'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_MEMBER);
+ − 828 if(!$qa) die('Error selecting session key info block A: '.$db->get_error());
+ − 829 if($db->numrows($qa) < 1) die('Error: cannot read user session info block A, aborting table clear process');
+ − 830 $ra = mysql_fetch_object($qa);
+ − 831 $rb = mysql_fetch_object($qb);
+ − 832 $db->free_result($qa);
+ − 833 $db->free_result($qb);
+ − 834 $db->sql_query('DELETE FROM '.table_prefix.'session_keys;');
+ − 835 $db->sql_query('INSERT INTO '.table_prefix.'session_keys( session_key,salt,user_id,auth_level,source_ip,time ) VALUES( \''.$ra->session_key.'\', \''.$ra->salt.'\', \''.$session->user_id.'\', \''.$ra->auth_level.'\', \''.$ra->source_ip.'\', '.$ra->time.' ),( \''.$rb->session_key.'\', \''.$rb->salt.'\', \''.$session->user_id.'\', \''.$rb->auth_level.'\', \''.$rb->source_ip.'\', '.$rb->time.' )');
+ − 836 echo('
+ − 837 <div class="info-box">The session key table has been cleared. Your database should be a little bit smaller now.</div>
+ − 838 ');
+ − 839 }
+ − 840 echo('
+ − 841 <h3>User Management</h3>
+ − 842 <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;">
+ − 843 <p>Username: '.$template->username_field('username').' <input type="submit" name="go" value="Go" /></p>
+ − 844 <h3>Clear session keys table</h3>
+ − 845 <p>It\'s a good idea to clean out your session keys table every once in a while, since this helps to reduce database size. During this process you will be logged off and (hopefully) logged back on automatically. The side effects of this include all users except you being logged off.</p>
+ − 846 <p><input type="submit" name="clearsessions" value="Clear session keys table" /></p>
+ − 847 </form>
+ − 848 ');
+ − 849 if(isset($_GET['action']) && isset($_GET['user']))
+ − 850 {
+ − 851 switch($_GET['action'])
+ − 852 {
+ − 853 case "activate":
+ − 854 $e = $db->sql_query('SELECT activation_key FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_GET['user']) . '\'');
+ − 855 if($e)
+ − 856 {
+ − 857 $row = $db->fetchrow();
+ − 858 $db->free_result();
+ − 859 if($session->activate_account($_GET['user'], $row['activation_key'])) { echo '<div class="info-box">The user account "'.$_GET['user'].'" has been activated.</div>'; $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE time_id=' . $db->escape($_GET['logid'])); }
+ − 860 else echo '<div class="warning-box">The user account "'.$_GET['user'].'" has NOT been activated, possibly because the account is already active.</div>';
+ − 861 } else echo '<div class="error-box">Error activating account: '.mysql_error().'</div>';
+ − 862 break;
+ − 863 case "sendemail":
+ − 864 if($session->send_activation_mail($_GET['user'])) { echo '<div class="info-box">The user "'.$_GET['user'].'" has been sent an e-mail with an activation link.</div>'; $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE time_id=' . $db->escape($_GET['logid'])); }
+ − 865 else echo '<div class="error-box">The user account "'.$_GET['user'].'" has not been activated, probably because of a bad SMTP configuration.</div>';
+ − 866 break;
+ − 867 case "deny":
+ − 868 $e = $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\' AND edit_summary=\'' . $db->escape($_GET['user']) . '\';');
+ − 869 if(!$e) echo '<div class="error-box">Error during row deletion: '.mysql_error().'</div>';
+ − 870 else echo '<div class="info-box">All activation requests for the user "'.$_GET['user'].'" have been deleted.</div>';
+ − 871 break;
+ − 872 }
+ − 873 }
+ − 874 $q = $db->sql_query('SELECT log_type, action, time_id, date_string, author, edit_summary FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\' ORDER BY time_id DESC;');
+ − 875 if($q)
+ − 876 {
+ − 877 if($db->numrows() > 0)
+ − 878 {
+ − 879 $n = $db->numrows();
+ − 880 if($n == 1) $s = $n . ' user is';
+ − 881 else $s = $n . ' users are';
+ − 882 echo '<h3>'.$s . ' awaiting account activation</h3>';
+ − 883 echo '<div class="tblholder">
+ − 884 <table border="0" cellspacing="1" cellpadding="4" width="100%">
+ − 885 <tr><th>Date of request</th><th>Requested by</th><th>Requested for</th><th colspan="3">Actions</th></tr>';
+ − 886 $cls = 'row2';
+ − 887 while($row = $db->fetchrow())
+ − 888 {
+ − 889 if($cls == 'row2') $cls = 'row1';
+ − 890 else $cls = 'row2';
+ − 891 echo '<tr><td class="'.$cls.'">'.date('F d, Y h:i a', $row['time_id']).'</td><td class="'.$cls.'">'.$row['author'].'</td><td class="'.$cls.'">'.$row['edit_summary'].'</td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=activate&user='.$row['edit_summary'].'&logid='.$row['time_id']).'">Activate now</a></td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=sendemail&user='.$row['edit_summary'].'&logid='.$row['time_id']).'">Send activation e-mail</a></td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=deny&user='.$row['edit_summary'].'&logid='.$row['time_id']).'">Deny request</a></td></tr>';
+ − 892 }
+ − 893 echo '</table>';
+ − 894 }
+ − 895 $db->free_result();
+ − 896 }
+ − 897 }
+ − 898
+ − 899 function page_Admin_GroupManager()
+ − 900 {
+ − 901 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 902 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 903 {
+ − 904 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 905 return;
+ − 906 }
+ − 907
+ − 908 if(isset($_POST['do_create_stage1']))
+ − 909 {
+ − 910 if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['create_group_name']))
+ − 911 {
+ − 912 echo '<p>The group name you chose is invalid.</p>';
+ − 913 return;
+ − 914 }
+ − 915 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 916 echo '<div class="tblholder">
+ − 917 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 918 <tr><th colspan="2">Creating group: '.$_POST['create_group_name'].'</th></tr>
+ − 919 <tr>
+ − 920 <td class="row1">Group moderator</td><td class="row1">' . $template->username_field('group_mod') . '</td>
+ − 921 </tr>
+ − 922 <tr><td class="row2">Group status</td><td class="row2">
+ − 923 <label><input type="radio" name="group_status" value="'.GROUP_CLOSED.'" checked="checked" /> Closed to new members</label><br />
+ − 924 <label><input type="radio" name="group_status" value="'.GROUP_REQUEST.'" /> Members can ask to be added</label><br />
+ − 925 <label><input type="radio" name="group_status" value="'.GROUP_OPEN.'" /> Members can join freely</label><br />
+ − 926 <label><input type="radio" name="group_status" value="'.GROUP_HIDDEN.'" /> Group is hidden</label>
+ − 927 </td></tr>
+ − 928 <tr>
+ − 929 <th class="subhead" colspan="2">
+ − 930 <input type="hidden" name="create_group_name" value="'.$_POST['create_group_name'].'" />
+ − 931 <input type="submit" name="do_create_stage2" value="Create group" />
+ − 932 </th>
+ − 933 </tr>
+ − 934 </table>
+ − 935 </div>';
+ − 936 echo '</form>';
+ − 937 return;
+ − 938 }
+ − 939 elseif(isset($_POST['do_create_stage2']))
+ − 940 {
+ − 941 if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['create_group_name']))
+ − 942 {
+ − 943 echo '<p>The group name you chose is invalid.</p>';
+ − 944 return;
+ − 945 }
+ − 946 if(!in_array(intval($_POST['group_status']), Array(GROUP_CLOSED, GROUP_OPEN, GROUP_HIDDEN, GROUP_REQUEST)))
+ − 947 {
+ − 948 echo '<p>Hacking attempt</p>';
+ − 949 return;
+ − 950 }
+ − 951 $e = $db->sql_query('SELECT group_id FROM '.table_prefix.'groups WHERE group_name=\''.$db->escape($_POST['create_group_name']).'\';');
+ − 952 if(!$e)
+ − 953 {
+ − 954 echo $db->get_error();
+ − 955 return;
+ − 956 }
+ − 957 if($db->numrows() > 0)
+ − 958 {
+ − 959 echo '<p>The group name you entered already exists.</p>';
+ − 960 return;
+ − 961 }
+ − 962 $db->free_result();
+ − 963 $q = $db->sql_query('INSERT INTO '.table_prefix.'groups(group_name,group_type) VALUES( \''.$db->escape($_POST['create_group_name']).'\', ' . intval($_POST['group_status']) . ' )');
+ − 964 if(!$q)
+ − 965 {
+ − 966 echo $db->get_error();
+ − 967 return;
+ − 968 }
+ − 969 $e = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['group_mod']).'\';');
+ − 970 if(!$e)
+ − 971 {
+ − 972 echo $db->get_error();
+ − 973 return;
+ − 974 }
+ − 975 if($db->numrows() < 1)
+ − 976 {
+ − 977 echo '<p>The username you entered could not be found.</p>';
+ − 978 return;
+ − 979 }
+ − 980 $row = $db->fetchrow();
+ − 981 $id = $row['user_id'];
+ − 982 $db->free_result();
+ − 983 $e = $db->sql_query('SELECT group_id FROM '.table_prefix.'groups WHERE group_name=\''.$db->escape($_POST['create_group_name']).'\';');
+ − 984 if(!$e)
+ − 985 {
+ − 986 echo $db->get_error();
+ − 987 return;
+ − 988 }
+ − 989 if($db->numrows() < 1)
+ − 990 {
+ − 991 echo '<p>The group ID could not be looked up.</p>';
+ − 992 return;
+ − 993 }
+ − 994 $row = $db->fetchrow();
+ − 995 $gid = $row['group_id'];
+ − 996 $db->free_result();
+ − 997 $e = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,is_mod) VALUES('.$gid.', '.$id.', 1);');
+ − 998 if(!$e)
+ − 999 {
+ − 1000 echo $db->get_error();
+ − 1001 return;
+ − 1002 }
+ − 1003 echo "<div class='info-box'>
+ − 1004 <b>Information</b><br />
+ − 1005 The group {$_POST['create_group_name']} has been created successfully.
+ − 1006 </div>";
+ − 1007 }
+ − 1008 if(isset($_POST['do_edit']) || isset($_POST['edit_do']))
+ − 1009 {
+ − 1010 // Fetch the group name
+ − 1011 $q = $db->sql_query('SELECT group_name,system_group FROM '.table_prefix.'groups WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1012 if(!$q)
+ − 1013 {
+ − 1014 echo $db->get_error();
+ − 1015 return;
+ − 1016 }
+ − 1017 if($db->numrows() < 1)
+ − 1018 {
+ − 1019 echo '<p>Error: couldn\'t look up group name</p>';
+ − 1020 }
+ − 1021 $row = $db->fetchrow();
+ − 1022 $name = $row['group_name'];
+ − 1023 $db->free_result();
+ − 1024 if(isset($_POST['edit_do']))
+ − 1025 {
+ − 1026 if(isset($_POST['edit_do']['del_group']))
+ − 1027 {
+ − 1028 if ( $row['system_group'] == 1 )
+ − 1029 {
+ − 1030 echo '<div class="error-box">The group "' . $name . '" could not be deleted because it is a system group required for site functionality.</div>';
+ − 1031 }
+ − 1032 else
+ − 1033 {
+ − 1034 $q = $db->sql_query('DELETE FROM '.table_prefix.'group_members WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1035 if(!$q)
+ − 1036 {
+ − 1037 echo $db->get_error();
+ − 1038 return;
+ − 1039 }
+ − 1040 $q = $db->sql_query('DELETE FROM '.table_prefix.'groups WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1041 if(!$q)
+ − 1042 {
+ − 1043 echo $db->get_error();
+ − 1044 return;
+ − 1045 }
+ − 1046 echo '<div class="info-box">The group "'.$name.'" has been deleted. Return to the <a href="javascript:ajaxPage(\'Admin:GroupManager\');">group manager</a>.</div>';
+ − 1047 return;
+ − 1048 }
+ − 1049 }
+ − 1050 if(isset($_POST['edit_do']['save_name']))
+ − 1051 {
+ − 1052 if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['group_name']))
+ − 1053 {
+ − 1054 echo '<p>The group name you chose is invalid.</p>';
+ − 1055 return;
+ − 1056 }
+ − 1057 $q = $db->sql_query('UPDATE '.table_prefix.'groups SET group_name=\''.$db->escape($_POST['group_name']).'\'
+ − 1058 WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1059 if(!$q)
+ − 1060 {
+ − 1061 echo $db->get_error();
+ − 1062 return;
+ − 1063 }
+ − 1064 else
+ − 1065 {
+ − 1066 echo '<div class="info-box" style="margin: 0 0 10px 0;"">
+ − 1067 The group name has been updated.
+ − 1068 </div>';
+ − 1069 }
+ − 1070 $name = $_POST['group_name'];
+ − 1071
+ − 1072 }
+ − 1073 $q = $db->sql_query('SELECT member_id FROM '.table_prefix.'group_members
+ − 1074 WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1075 if(!$q)
+ − 1076 {
+ − 1077 echo $db->get_error();
+ − 1078 return;
+ − 1079 }
+ − 1080 if($db->numrows() > 0)
+ − 1081 {
+ − 1082 while($row = $db->fetchrow($q))
+ − 1083 {
+ − 1084 if(isset($_POST['edit_do']['del_' . $row['member_id']]))
+ − 1085 {
+ − 1086 $e = $db->sql_query('DELETE FROM '.table_prefix.'group_members WHERE member_id='.$row['member_id']);
+ − 1087 if(!$e)
+ − 1088 {
+ − 1089 echo $db->get_error();
+ − 1090 return;
+ − 1091 }
+ − 1092 }
+ − 1093 }
+ − 1094 }
+ − 1095 $db->free_result();
+ − 1096 if(isset($_POST['edit_do']['add_member']))
+ − 1097 {
+ − 1098 $q = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['edit_add_username']).'\';');
+ − 1099 if(!$q)
+ − 1100 {
+ − 1101 echo $db->get_error();
+ − 1102 return;
+ − 1103 }
+ − 1104 if($db->numrows() > 0)
+ − 1105 {
+ − 1106 $row = $db->fetchrow();
+ − 1107 $user_id = $row['user_id'];
+ − 1108 $is_mod = ( isset( $_POST['add_mod'] ) ) ? '1' : '0';
+ − 1109 $q = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,is_mod) VALUES('.intval($_POST['group_edit_id']).','.$user_id.','.$is_mod.');');
+ − 1110 if(!$q)
+ − 1111 {
+ − 1112 echo $db->get_error();
+ − 1113 return;
+ − 1114 }
+ − 1115 else
+ − 1116 {
+ − 1117 echo '<div class="info-box" style="margin: 0 0 10px 0;"">
+ − 1118 The user "'.$_POST['edit_add_username'].'" has been added to this usergroup.
+ − 1119 </div>';
+ − 1120 }
+ − 1121 }
+ − 1122 else
+ − 1123 echo '<div class="warning-box"><b>The user "'.$_POST['edit_add_username'].'" could not be added.</b><br />This username does not exist.</div>';
+ − 1124 }
+ − 1125 }
+ − 1126 $sg_disabled = ( $row['system_group'] == 1 ) ? ' value="Can\'t delete system group" disabled="disabled" style="color: #FF9773" ' : ' value="Delete this group" style="color: #FF3713" ';
+ − 1127 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1128 echo '<div class="tblholder">
+ − 1129 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 1130 <tr><th>Edit group name</th></tr>
+ − 1131 <tr>
+ − 1132 <td class="row1">
+ − 1133 Group name: <input type="text" name="group_name" value="'.$name.'" />
+ − 1134 </td>
+ − 1135 </tr>
+ − 1136 <tr>
+ − 1137 <th class="subhead">
+ − 1138 <input type="submit" name="edit_do[save_name]" value="Save name" />
+ − 1139 <input type="submit" name="edit_do[del_group]" '.$sg_disabled.' />
+ − 1140 </th>
+ − 1141 </tr>
+ − 1142 </table>
+ − 1143 </div>
+ − 1144 <input type="hidden" name="group_edit_id" value="'.$_POST['group_edit_id'].'" />';
+ − 1145 echo '</form>';
+ − 1146 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1147 echo '<div class="tblholder">
+ − 1148 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 1149 <tr><th colspan="3">Edit group members</th></tr>';
+ − 1150 $q = $db->sql_query('SELECT m.member_id,m.is_mod,u.username FROM '.table_prefix.'group_members AS m
+ − 1151 LEFT JOIN '.table_prefix.'users AS u
+ − 1152 ON u.user_id=m.user_id
+ − 1153 WHERE m.group_id='.intval($_POST['group_edit_id']).'
+ − 1154 ORDER BY m.is_mod DESC, u.username ASC;');
+ − 1155 if(!$q)
+ − 1156 {
+ − 1157 echo $db->get_error();
+ − 1158 return;
+ − 1159 }
+ − 1160 if($db->numrows() < 1)
+ − 1161 {
+ − 1162 echo '<tr><td colspan="3" class="row1">This group has no members.</td></tr>';
+ − 1163 }
+ − 1164 else
+ − 1165 {
+ − 1166 $cls = 'row2';
+ − 1167 while($row = $db->fetchrow())
+ − 1168 {
+ − 1169 $cls = ( $cls == 'row1' ) ? 'row2' : 'row1';
+ − 1170 $mod = ( $row['is_mod'] == 1 ) ? 'Mod' : '';
+ − 1171 echo '<tr>
+ − 1172 <td class="'.$cls.'" style="width: 100%;">
+ − 1173 ' . $row['username'] . '
+ − 1174 </td>
+ − 1175 <td class="'.$cls.'">
+ − 1176 '.$mod.'
+ − 1177 </td>
+ − 1178 <td class="'.$cls.'">
+ − 1179 <input type="submit" name="edit_do[del_'.$row['member_id'].']" value="Remove member" />
+ − 1180 </td>
+ − 1181 </tr>';
+ − 1182 }
+ − 1183 }
+ − 1184 $db->free_result();
+ − 1185 echo '</table>
+ − 1186 </div>
+ − 1187 <input type="hidden" name="group_edit_id" value="'.$_POST['group_edit_id'].'" />';
+ − 1188 echo '</form>';
+ − 1189 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1190 echo '<div class="tblholder">
+ − 1191 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 1192 <tr>
+ − 1193 <th>Add a new member</th>
+ − 1194 </tr>
+ − 1195 <tr>
+ − 1196 <td class="row1">
+ − 1197 Username: ' . $template->username_field('edit_add_username') . '
+ − 1198 </td>
+ − 1199 </tr>
+ − 1200 <tr>
+ − 1201 <td class="row2">
+ − 1202 <label><input type="checkbox" name="add_mod" /> Is a group moderator</label> (can add and delete other members)
+ − 1203 </td>
+ − 1204 </tr>
+ − 1205 <tr>
+ − 1206 <th class="subhead">
+ − 1207 <input type="submit" name="edit_do[add_member]" value="Add user to group" />
+ − 1208 </th>
+ − 1209 </tr>
+ − 1210 </table>
+ − 1211 </div>
+ − 1212 <input type="hidden" name="group_edit_id" value="'.$_POST['group_edit_id'].'" />';
+ − 1213 echo '</form>';
+ − 1214 return;
+ − 1215 }
+ − 1216 echo '<h3>Manage Usergroups</h3>';
+ − 1217 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1218 $q = $db->sql_query('SELECT group_id,group_name FROM '.table_prefix.'groups ORDER BY group_name ASC;');
+ − 1219 if(!$q)
+ − 1220 {
+ − 1221 echo $db->get_error();
+ − 1222 }
+ − 1223 else
+ − 1224 {
+ − 1225 echo '<div class="tblholder">
+ − 1226 <table border="0" cellspacing="1" cellpadding="4" style="width: 100%;">
+ − 1227 <tr>
+ − 1228 <th>Edit an existing group</th>
+ − 1229 </tr>';
+ − 1230 echo '<tr><td class="row2"><select name="group_edit_id">';
+ − 1231 while ( $row = $db->fetchrow() )
+ − 1232 {
+ − 1233 if ( $row['group_name'] != 'Everyone' )
+ − 1234 {
+ − 1235 echo '<option value="' . $row['group_id'] . '">' . htmlspecialchars( $row['group_name'] ) . '</option>';
+ − 1236 }
+ − 1237 }
+ − 1238 $db->free_result();
+ − 1239 echo '</select></td></tr>';
+ − 1240 echo '<tr><td class="row1" style="text-align: center;"><input type="submit" name="do_edit" value="Edit group" /></td></tr>
+ − 1241 </table>
+ − 1242 </div>
+ − 1243 </form><br />';
+ − 1244 }
+ − 1245 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1246 echo '<div class="tblholder">
+ − 1247 <table border="0" cellspacing="1" cellpadding="4" style="width: 100%;">
+ − 1248 <tr>
+ − 1249 <th colspan="2">Create a new group</th>
+ − 1250 </tr>';
+ − 1251 echo '<tr><td class="row2">Group name:</td><td class="row2"><input type="text" name="create_group_name" /></td></tr>';
+ − 1252 echo '<tr><td colspan="2" class="row1" style="text-align: center;"><input type="submit" name="do_create_stage1" value="Continue >" /></td></tr>
+ − 1253 </table>
+ − 1254 </div>';
+ − 1255 echo '</form>';
+ − 1256 }
+ − 1257
+ − 1258 function page_Admin_PageManager()
+ − 1259 {
+ − 1260 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1261 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1262 {
+ − 1263 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1264 return;
+ − 1265 }
+ − 1266
+ − 1267
+ − 1268 echo '<h2>Page management</h2>';
+ − 1269
+ − 1270 if(isset($_POST['search']) || isset($_POST['select']) || ( isset($_GET['source']) && $_GET['source'] == 'ajax' )) {
+ − 1271 // The object of the game: using only the text a user entered, guess the page ID and namespace. *sigh* I HATE writing search algorithms...
+ − 1272 $source = ( isset($_GET['source']) ) ? $_GET['source'] : false;
+ − 1273 if ( $source == 'ajax' )
+ − 1274 {
+ − 1275 $_POST['search'] = true;
+ − 1276 $_POST['page_url'] = $_GET['page_id'];
+ − 1277 }
+ − 1278 if(isset($_POST['search'])) $pid = $_POST['page_url'];
+ − 1279 elseif(isset($_POST['select'])) $pid = $_POST['page_force_url'];
+ − 1280 else { echo 'Internal error selecting page search terms'; return false; }
+ − 1281 // Look for a namespace prefix in the urlname, and assign a different namespace, if necessary
+ − 1282 $k = array_keys($paths->nslist);
+ − 1283 for($i=0;$i<sizeof($paths->nslist);$i++)
+ − 1284 {
+ − 1285 $ln = strlen($paths->nslist[$k[$i]]);
+ − 1286 if(substr($pid, 0, $ln) == $paths->nslist[$k[$i]])
+ − 1287 {
+ − 1288 $ns = $k[$i];
+ − 1289 $page_id = substr($pid, $ln, strlen($pid));
+ − 1290 }
+ − 1291 }
+ − 1292 // The namespace is in $ns and the page name or ID (we don't know which yet) is in $page_id
+ − 1293 // Now, iterate through $paths->pages searching for a page with this name or ID
+ − 1294 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1295 {
+ − 1296 if(!isset($final_pid))
+ − 1297 {
+ − 1298 if ($paths->pages[$i]['urlname_nons'] == str_replace(' ', '_', $page_id)) $final_pid = str_replace(' ', '_', $page_id);
+ − 1299 elseif($paths->pages[$i]['name'] == $page_id) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1300 elseif(strtolower($paths->pages[$i]['urlname_nons']) == strtolower(str_replace(' ', '_', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1301 elseif(strtolower($paths->pages[$i]['name']) == strtolower(str_replace('_', ' ', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1302 if(isset($final_pid)) { $_POST['name'] = $paths->pages[$i]['name']; $_POST['urlname'] = $paths->pages[$i]['urlname_nons']; }
+ − 1303 }
+ − 1304 }
+ − 1305 if(!isset($final_pid)) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1306 $_POST['namespace'] = $ns;
+ − 1307 $_POST['old_namespace'] = $ns;
+ − 1308 $_POST['page_id'] = $final_pid;
+ − 1309 $_POST['old_page_id'] = $final_pid;
+ − 1310 if(!isset($paths->pages[$paths->nslist[$_POST['namespace']].$_POST['urlname']])) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1311 }
+ − 1312
+ − 1313 if(isset($_POST['page_id']) && isset($_POST['namespace']) && !isset($_POST['cancel']))
+ − 1314 {
+ − 1315 $cpage = $paths->pages[$paths->nslist[$_POST['namespace']].$_POST['old_page_id']];
+ − 1316 if(isset($_POST['submit']))
+ − 1317 {
+ − 1318 // Create a list of things to update
+ − 1319 $page_info = Array(
+ − 1320 'name'=>$_POST['name'],
+ − 1321 'urlname'=>$_POST['page_id'],
+ − 1322 'namespace'=>$_POST['namespace'],
+ − 1323 'special'=>isset($_POST['special']) ? '1' : '0',
+ − 1324 'visible'=>isset($_POST['visible']) ? '1' : '0',
+ − 1325 'comments_on'=>isset($_POST['comments_on']) ? '1' : '0',
+ − 1326 'protected'=>isset($_POST['protected']) ? '1' : '0'
+ − 1327 );
+ − 1328 // Build the query
+ − 1329 $q = 'UPDATE '.table_prefix.'pages SET ';
+ − 1330 $k = array_keys($page_info);
+ − 1331 foreach($k as $c)
+ − 1332 {
+ − 1333 $q .= $c.'=\''.$db->escape($page_info[$c]).'\',';
+ − 1334 }
+ − 1335 $q = substr($q, 0, strlen($q)-1);
+ − 1336 // Build the WHERE statements
+ − 1337 $q .= ' WHERE ';
+ − 1338 $k = array_keys($cpage);
+ − 1339 foreach($k as $c)
+ − 1340 {
+ − 1341 if($c != 'urlname_nons' && $c != 'urlname' && $c != 'really_protected') $q .= $c.'=\''.$cpage[$c].'\' AND ';
+ − 1342 elseif($c == 'urlname') $q .= $c.'=\''.$cpage['urlname_nons'].'\' AND ';
+ − 1343 }
+ − 1344 $q = substr($q, 0, strlen($q)-5) . ';';
+ − 1345 // Send the completed query to MySQL
+ − 1346 $e = $db->sql_query($q);
+ − 1347 if(!$e) $db->_die('The page data could not be updated.');
+ − 1348 // Update any additional tables
+ − 1349 $q = Array(
+ − 1350 'UPDATE '.table_prefix.'categories SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1351 'UPDATE '.table_prefix.'comments SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1352 'UPDATE '.table_prefix.'logs SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1353 'UPDATE '.table_prefix.'page_text SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1354 );
+ − 1355 foreach($q as $cq)
+ − 1356 {
+ − 1357 $e = $db->sql_query($cq);
+ − 1358 if(!$e) $db->_die('Some of the additional tables containing page information could not be updated.');
+ − 1359 }
+ − 1360 // Update $cpage
+ − 1361 $cpage = $page_info;
+ − 1362 $cpage['urlname_nons'] = $cpage['urlname'];
+ − 1363 $cpage['urlname'] = $paths->nslist[$cpage['namespace']].$cpage['urlname'];
+ − 1364 $_POST['old_page_id'] = $page_info['urlname'];
+ − 1365 $_POST['old_namespace'] = $page_info['namespace'];
+ − 1366 echo '<div class="info-box">Your changes have been saved.</div>';
+ − 1367 } elseif(isset($_POST['delete'])) {
+ − 1368 $q = Array(
+ − 1369 'DELETE FROM '.table_prefix.'categories WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1370 'DELETE FROM '.table_prefix.'comments WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1371 'DELETE FROM '.table_prefix.'logs WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1372 'DELETE FROM '.table_prefix.'page_text WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1373 );
+ − 1374 foreach($q as $cq)
+ − 1375 {
+ − 1376 $e = $db->sql_query($cq);
+ − 1377 if(!$e) $db->_die('Some of the additional tables containing page information could not be updated.');
+ − 1378 }
+ − 1379
+ − 1380 if(!$db->sql_query(
+ − 1381 'DELETE FROM '.table_prefix.'pages WHERE urlname="'.$db->escape($_POST['old_page_id']).'" AND namespace="'.$db->escape($_POST['old_namespace']).'";'
+ − 1382 )) $db->_die('The page could not be deleted.');
+ − 1383 echo '<div class="info-box">This page has been deleted.</p><p><a href="javascript:ajaxPage(\''.$paths->nslist['Admin'].'PageManager\');">Return to Page manager</a><br /><a href="javascript:ajaxPage(\''.$paths->nslist['Admin'].'Home\');">Admin home</a></div>';
+ − 1384 return;
+ − 1385 }
+ − 1386 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration'.htmlspecialchars(urlSeparator).(( isset($_GET['sqldbg']) ) ? 'sqldbg&' : '') .'module='.$paths->cpage['module']).'" method="post">';
+ − 1387 ?>
+ − 1388 <h3>Modify page: <?php echo $_POST['name']; ?></h3>
+ − 1389 <table border="0">
+ − 1390 <tr><td>Namespace:</td><td><select name="namespace"><?php $nm = array_keys($paths->nslist); foreach($nm as $ns) { if($ns != 'Special' && $ns != 'Admin') { echo '<option '; if($_POST['namespace']==$ns) echo 'selected="selected" '; echo 'value="'.$ns.'">'; if($paths->nslist[$ns] == '') echo '[No prefix]'; else echo $paths->nslist[$ns]; echo '</option>'; } } ?></select></td></tr>
+ − 1391 <tr><td>Page title:</td><td><input type="text" name="name" value="<?php echo $cpage['name']; ?>" /></td></tr>
+ − 1392 <tr><td>Page URL string:<br /><small>No spaces, and don't enter the namespace prefix (e.g. User:).<br />Changing this value is usually not a good idea, especially for templates and project pages.</small></td><td><input type="text" name="page_id" value="<?php echo $cpage['urlname_nons']; ?>" /></td></tr>
+ − 1393 <tr><td></td><td><input <?php if($cpage['comments_on']) echo 'checked="checked"'; ?> name="comments_on" type="checkbox" id="cmt" /> <label for="cmt">Enable comments for this page</label></td></tr>
+ − 1394 <tr><td></td><td><input <?php if($cpage['special']) echo 'checked="checked"'; ?> name="special" type="checkbox" id="spc" /> <label for="spc">Bypass the template engine for this page</label><br /><small>This option enables you to use your own HTML headers and other code. It is recommended that only advanced users enable this feature. As with other Enano pages, you may use PHP code in your pages, meaning you can use Enano's API on the page.</small></td></tr>
+ − 1395 <tr><td></td><td><input <?php if($cpage['visible']) echo 'checked="checked"'; ?> name="visible" type="checkbox" id="vis" /> <label for="vis">Allow this page to be shown in page lists</label><br /><small>Unchecking this checkbox prevents the page for being indexed for searching. The index is rebuilt each time a page is saved, and you can force an index rebuild by going to the page <?php echo $paths->nslist['Special']; ?>SearchRebuild.</small></td></tr>
+ − 1396 <tr><td></td><td><input <?php if($cpage['protected']) echo 'checked="checked"'; ?> name="protected" type="checkbox" id="prt" /> <label for="prt">Prevent non-administrators from editing this page</label><br /><small>This option only has an effect when Wiki Mode is enabled.</small></td></tr>
+ − 1397 <tr><td></td><td><input type="submit" name="delete" value="Delete page" style="color: red" onclick="return confirm('Do you REALLY want to delete this page?')" /></td></tr>
+ − 1398 <tr><td colspan="2" style="text-align: center;"><hr /></td></tr>
+ − 1399 <tr><td colspan="2" style="text-align: right;">
+ − 1400 <input type="hidden" name="old_page_id" value="<?php echo $_POST['old_page_id']; ?>" />
+ − 1401 <input type="hidden" name="old_namespace" value="<?php echo $_POST['old_namespace']; ?>" />
+ − 1402 <input type="Submit" name="submit" value="Save changes" style="font-weight: bold;" /> <input type="submit" name="cancel" value="Cancel changes" /></td></tr>
+ − 1403 </table>
+ − 1404 <?php
+ − 1405 echo '</form>';
+ − 1406 } else {
+ − 1407 echo '<h3>Please select a page</h3>';
+ − 1408 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1409 ?>
+ − 1410 <p>Search for page title (remember prefixes like User: and File:) <?php echo $template->pagename_field('page_url'); ?> <input type="submit" style="font-weight: bold;" name="search" value="Search" /></p>
+ − 1411 <p>Select page title from a list: <select name="page_force_url">
+ − 1412 <?php
+ − 1413 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1414 {
+ − 1415 if($paths->pages[$i]['namespace'] != 'Admin' && $paths->pages[$i]['namespace'] != 'Special') echo '<option value="'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['urlname_nons'].'">'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['name'].'</option>'."\n";
+ − 1416 }
+ − 1417 ?>
+ − 1418 </select> <input type="submit" name="select" value="Select" /></p>
+ − 1419 <?php
+ − 1420 echo '</form>';
+ − 1421
+ − 1422 }
+ − 1423 }
+ − 1424
+ − 1425 function page_Admin_PageEditor()
+ − 1426 {
+ − 1427 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1428 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1429 {
+ − 1430 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1431 return;
+ − 1432 }
+ − 1433
+ − 1434
+ − 1435 echo '<h2>Edit page content</h2>';
+ − 1436
+ − 1437 if(isset($_POST['search']) || isset($_POST['select'])) {
+ − 1438 // The object of the game: using only the text a user entered, guess the page ID and namespace. *sigh* I HATE writing search algorithms...
+ − 1439 if(isset($_POST['search'])) $pid = $_POST['page_url'];
+ − 1440 elseif(isset($_POST['select'])) $pid = $_POST['page_force_url'];
+ − 1441 else { echo 'Internal error selecting page search terms'; return false; }
+ − 1442 // Look for a namespace prefix in the urlname, and assign a different namespace, if necessary
+ − 1443 $k = array_keys($paths->nslist);
+ − 1444 for($i=0;$i<sizeof($paths->nslist);$i++)
+ − 1445 {
+ − 1446 $ln = strlen($paths->nslist[$k[$i]]);
+ − 1447 if(substr($pid, 0, $ln) == $paths->nslist[$k[$i]])
+ − 1448 {
+ − 1449 $ns = $k[$i];
+ − 1450 $page_id = substr($pid, $ln, strlen($pid));
+ − 1451 }
+ − 1452 }
+ − 1453 // The namespace is in $ns and the page name or ID (we don't know which yet) is in $page_id
+ − 1454 // Now, iterate through $paths->pages searching for a page with this name or ID
+ − 1455 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1456 {
+ − 1457 if(!isset($final_pid))
+ − 1458 {
+ − 1459 if ($paths->pages[$i]['urlname_nons'] == str_replace(' ', '_', $page_id)) $final_pid = str_replace(' ', '_', $page_id);
+ − 1460 elseif($paths->pages[$i]['name'] == $page_id) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1461 elseif(strtolower($paths->pages[$i]['urlname_nons']) == strtolower(str_replace(' ', '_', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1462 elseif(strtolower($paths->pages[$i]['name']) == strtolower(str_replace('_', ' ', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1463 if(isset($final_pid)) { $_POST['name'] = $paths->pages[$i]['name']; $_POST['urlname'] = $paths->pages[$i]['urlname_nons']; }
+ − 1464 }
+ − 1465 }
+ − 1466 if(!isset($final_pid)) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1467 $_POST['namespace'] = $ns;
+ − 1468 $_POST['page_id'] = $final_pid;
+ − 1469 if(!isset($paths->pages[$paths->nslist[$_POST['namespace']].$_POST['urlname']])) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1470 }
+ − 1471
+ − 1472 if(isset($_POST['page_id']) && !isset($_POST['cancel']))
+ − 1473 {
+ − 1474 echo '<form name="main" action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">';
+ − 1475 if(!isset($_POST['content']) || isset($_POST['revert'])) $content = RenderMan::getPage($_POST['page_id'], $_POST['namespace'], 0, false, false, false, false);
+ − 1476 else $content = $_POST['content'];
+ − 1477 if(isset($_POST['save']))
+ − 1478 {
+ − 1479 $data = $content;
+ − 1480 $id = md5( microtime() . mt_rand() );
+ − 1481
+ − 1482 $minor = isset($_POST['minor']) ? 'true' : 'false';
+ − 1483 $q='INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,page_id,namespace,page_text,char_tag,author,edit_summary,minor_edit) VALUES(\'page\', \'edit\', '.time().', \''.date('d M Y h:i a').'\', \'' . $db->escape($_POST['page_id']) . '\', \'' . $db->escape($_POST['namespace']) . '\', \''.$data.'\', \''.$id.'\', \''.$session->username.'\', \''.$db->escape(htmlspecialchars($_POST['summary'])).'\', '.$minor.');';
+ − 1484 if(!$db->sql_query($q)) $db->_die('The history (log) entry could not be inserted into the logs table.');
+ − 1485
+ − 1486 $query = 'UPDATE '.table_prefix.'page_text SET page_text=\''.$db->escape($data).'\',char_tag=\''.$id.'\' WHERE page_id=\'' . $db->escape($_POST['page_id']) . '\' AND namespace=\'' . $db->escape($_POST['namespace']) . '\';';
+ − 1487 $e = $db->sql_query($query);
+ − 1488 if(!$e) echo '<div class="warning-box">The page data could not be saved. MySQL said: '.mysql_error().'<br /><br />Query:<br /><pre>'.$query.'</pre></div>';
+ − 1489 else echo '<div class="info-box">Your page has been saved. <a href="'.makeUrlNS($_POST['namespace'], $_POST['page_id']).'">View page...</a></div>';
+ − 1490 } elseif(isset($_POST['preview'])) {
+ − 1491 echo '<h3>Preview</h3><p><b>Reminder:</b> This is only a preview; your changes to this page have not yet been saved.</p><div style="margin: 1em; padding: 10px; border: 1px dashed #606060; background-color: #F8F8F8; max-height: 200px; overflow: auto;">'.RenderMan::render($content).'</div>';
+ − 1492 }
+ − 1493 ?>
+ − 1494 <p>
+ − 1495 <textarea name="content" rows="20" cols="60" style="width: 100%;"><?php echo htmlspecialchars($content); ?></textarea><br />
+ − 1496 Edit summary: <input name="summary" value="<?php if(isset($_POST['summary'])) echo $_POST['summary']; ?>" size="40" /><br />
+ − 1497 <label><input type="checkbox" name="minor" <?php if(isset($_POST['minor'])) echo 'checked="checked" '; ?>/> This is a minor edit</label>
+ − 1498 </p>
+ − 1499 <p>
+ − 1500 <input type="hidden" name="page_id" value="<?php echo $_POST['page_id']; ?>" />
+ − 1501 <input type="hidden" name="namespace" value="<?php echo $_POST['namespace']; ?>" />
+ − 1502 <input type="submit" name="save" value="Save changes" style="font-weight: bold;" /> <input type="submit" name="preview" value="Show preview" /> <input type="submit" name="revert" value="Revert changes" onclick="return confirm('Do you really want to revert your changes?');" /> <input type="submit" name="cancel" value="Cancel" onclick="return confirm('Do you really want to cancel your changes?');" />
+ − 1503 </p>
+ − 1504 <?php
+ − 1505 echo '</form>';
+ − 1506 } else {
+ − 1507 echo '<h3>Please select a page</h3>';
+ − 1508 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1509 ?>
+ − 1510 <p>Search for page title (remember prefixes like User: and File:) <?php echo $template->pagename_field('page_url'); ?> <input type="submit" style="font-weight: bold;" name="search" value="Search" /></p>
+ − 1511 <p>Select page title from a list: <select name="page_force_url">
+ − 1512 <?php
+ − 1513 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1514 {
+ − 1515 if($paths->pages[$i]['namespace'] != 'Admin' && $paths->pages[$i]['namespace'] != 'Special') echo '<option value="'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['urlname_nons'].'">'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['name'].'</option>'."\n";
+ − 1516 }
+ − 1517 ?>
+ − 1518 </select> <input type="submit" name="select" value="Select" /></p>
+ − 1519 <?php
+ − 1520 echo '</form>';
+ − 1521 }
+ − 1522 }
+ − 1523
+ − 1524 function page_Admin_ThemeManager()
+ − 1525 {
+ − 1526
+ − 1527 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1528 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1529 {
+ − 1530 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1531 return;
+ − 1532 }
+ − 1533
+ − 1534
+ − 1535 // Get the list of styles in the themes/ dir
+ − 1536 $h = opendir('./themes');
+ − 1537 $l = Array();
+ − 1538 if(!$h) die('Error opening directory "./themes" for reading.');
+ − 1539 while(false !== ($n = readdir($h))) {
+ − 1540 if($n != '.' && $n != '..' && is_dir('./themes/'.$n))
+ − 1541 $l[] = $n;
+ − 1542 }
+ − 1543 closedir($h);
+ − 1544 echo('
+ − 1545 <h3>Theme Management</h3>
+ − 1546 <p>Install, uninstall, and manage Enano themes.</p>
+ − 1547 ');
+ − 1548 if(isset($_POST['disenable'])) {
+ − 1549 $q = 'SELECT enabled FROM '.table_prefix.'themes WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1550 $s = $db->sql_query($q);
+ − 1551 if(!$s) die('Error selecting enabled/disabled state value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1552 $r = $db->fetchrow_num($s);
+ − 1553 $db->free_result();
+ − 1554 if($r[0] == 1) $e = 0;
+ − 1555 else $e = 1;
+ − 1556 $s=true;
+ − 1557 if($e==0)
+ − 1558 {
+ − 1559 $c = $db->sql_query('SELECT * FROM '.table_prefix.'themes WHERE enabled=1');
+ − 1560 if(!$c) $db->_die('The backup check for having at least on theme enabled failed.');
+ − 1561 if($db->numrows() <= 1) { echo '<div class="warning-box">You cannot disable the last remaining theme.</div>'; $s=false; }
+ − 1562 }
+ − 1563 $db->free_result();
+ − 1564 if($s) {
+ − 1565 $q = 'UPDATE '.table_prefix.'themes SET enabled='.$e.' WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1566 $a = $db->sql_query($q);
+ − 1567 if(!$a) die('Error updating enabled/disabled state value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1568 else echo('<div class="info-box">The theme "'.$_POST['theme_id'].'" has been '. ( ( $e == '1' ) ? 'enabled' : 'disabled' ).'.</div>');
+ − 1569 }
+ − 1570 }
+ − 1571 elseif(isset($_POST['edit'])) {
+ − 1572
+ − 1573 $dir = './themes/'.$_POST['theme_id'].'/css/';
+ − 1574 $list = Array();
+ − 1575 // Open a known directory, and proceed to read its contents
+ − 1576 if (is_dir($dir)) {
+ − 1577 if ($dh = opendir($dir)) {
+ − 1578 while (($file = readdir($dh)) !== false) {
+ − 1579 if(preg_match('#^(.*?)\.css$#is', $file) && $file != '_printable.css') {
+ − 1580 $list[$file] = capitalize_first_letter(substr($file, 0, strlen($file)-4));
+ − 1581 }
+ − 1582 }
+ − 1583 closedir($dh);
+ − 1584 }
+ − 1585 }
+ − 1586 $lk = array_keys($list);
+ − 1587
+ − 1588 $q = 'SELECT theme_name,default_style FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\'';
+ − 1589 $s = $db->sql_query($q);
+ − 1590 if(!$s) die('Error selecting name value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1591 $r = $db->fetchrow_num($s);
+ − 1592 $db->free_result();
+ − 1593 echo('<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">');
+ − 1594 echo('<div class="question-box">
+ − 1595 Theme name displayed to users: <input type="text" name="name" value="'.$r[0].'" /><br /><br />
+ − 1596 Default stylesheet: <select name="defaultcss">');
+ − 1597 foreach ($lk as $l)
+ − 1598 {
+ − 1599 if($r[1] == $l) $v = ' selected="selected"';
+ − 1600 else $v = '';
+ − 1601 echo "<option value='{$l}'$v>{$list[$l]}</option>";
+ − 1602 }
+ − 1603 echo('</select><br /><br />
+ − 1604 <input type="submit" name="editsave" value="OK" /><input type="hidden" name="theme_id" value="'.$_POST['theme_id'].'" />
+ − 1605 </div>');
+ − 1606 echo('</form>');
+ − 1607 }
+ − 1608 elseif(isset($_POST['editsave'])) {
+ − 1609 $q = 'UPDATE '.table_prefix.'themes SET theme_name=\'' . $db->escape($_POST['name']) . '\',default_style=\''.$db->escape($_POST['defaultcss']).'\' WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1610 $s = $db->sql_query($q);
+ − 1611 if(!$s) die('Error updating name value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1612 else echo('<div class="info-box">Theme data updated.</div>');
+ − 1613 }
+ − 1614 elseif(isset($_POST['up'])) {
+ − 1615 // If there is only one theme or if the selected theme is already at the top, do nothing
+ − 1616 $q = 'SELECT theme_order FROM '.table_prefix.'themes ORDER BY theme_order;';
+ − 1617 $s = $db->sql_query($q);
+ − 1618 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1619 $q = 'SELECT theme_order FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\'';
+ − 1620 $sn = $db->sql_query($q);
+ − 1621 if(!$sn) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1622 $r = $db->fetchrow_num($sn);
+ − 1623 if( /* check for only one theme... */ $db->numrows($s) < 2 || $r[0] == 1 /* ...and check if this theme is already at the top */ ) { echo('<div class="warning-box">This theme is already at the top of the list, or there is only one theme installed.</div>'); } else {
+ − 1624 // Get the order IDs of the selected theme and the theme before it
+ − 1625 $q = 'SELECT theme_order FROM '.table_prefix.'themes WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1626 $s = $db->sql_query($q);
+ − 1627 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1628 $r = $db->fetchrow_num($s);
+ − 1629 $r = $r[0];
+ − 1630 $rb = $r - 1;
+ − 1631 // Thank God for jEdit's rectangular selection and the ablity to edit multiple lines at the same time ;)
+ − 1632 $q = 'UPDATE '.table_prefix.'themes SET theme_order=0 WHERE theme_order='.$rb.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1633 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$rb.' WHERE theme_order='.$r.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1634 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$r.' WHERE theme_order=0'; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1635 echo('<div class="info-box">Theme moved up.</div>');
+ − 1636 }
+ − 1637 $db->free_result($s);
+ − 1638 $db->free_result($sn);
+ − 1639 }
+ − 1640 elseif(isset($_POST['down'])) {
+ − 1641 // If there is only one theme or if the selected theme is already at the top, do nothing
+ − 1642 $q = 'SELECT theme_order FROM '.table_prefix.'themes ORDER BY theme_order;';
+ − 1643 $s = $db->sql_query($q);
+ − 1644 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1645 $r = $db->fetchrow_num($s);
+ − 1646 if( /* check for only one theme... */ $db->numrows($s) < 2 || $r[0] == $db->numrows($s) /* ...and check if this theme is already at the bottom */ ) { echo('<div class="warning-box">This theme is already at the bottom of the list, or there is only one theme installed.</div>'); } else {
+ − 1647 // Get the order IDs of the selected theme and the theme before it
+ − 1648 $q = 'SELECT theme_order FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\'';
+ − 1649 $s = $db->sql_query($q);
+ − 1650 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1651 $r = $db->fetchrow_num($s);
+ − 1652 $r = $r[0];
+ − 1653 $rb = $r + 1;
+ − 1654 // Thank God for jEdit's rectangular selection and the ablity to edit multiple lines at the same time ;)
+ − 1655 $q = 'UPDATE '.table_prefix.'themes SET theme_order=0 WHERE theme_order='.$rb.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1656 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$rb.' WHERE theme_order='.$r.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1657 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$r.' WHERE theme_order=0'; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1658 echo('<div class="info-box">Theme moved down.</div>');
+ − 1659 }
+ − 1660 }
+ − 1661 else if(isset($_POST['uninstall']))
+ − 1662 {
+ − 1663 $q = 'SELECT * FROM '.table_prefix.'themes;';
+ − 1664 $s = $db->sql_query($q);
+ − 1665 if ( !$s )
+ − 1666 {
+ − 1667 die('Error getting theme count: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1668 }
+ − 1669 $n = $db->numrows($s);
+ − 1670 $db->free_result();
+ − 1671
+ − 1672 if ( $_POST['theme_id'] == 'oxygen' )
+ − 1673 {
+ − 1674 echo '<div class="error-box">The Oxygen theme is used by Enano for installation, upgrades, and error messages, and cannot be uninstalled.</div>';
+ − 1675 }
+ − 1676 else
+ − 1677 {
+ − 1678 if($n < 2)
+ − 1679 {
+ − 1680 echo '<div class="error-box">The theme could not be uninstalled because it is the only theme left.</div>';
+ − 1681 }
+ − 1682 else
+ − 1683 {
+ − 1684 $q = 'DELETE FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\' LIMIT 1;';
+ − 1685 $s = $db->sql_query($q);
+ − 1686 if ( !$s )
+ − 1687 {
+ − 1688 die('Error deleting theme data: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1689 }
+ − 1690 else
+ − 1691 {
+ − 1692 echo('<div class="info-box">Theme uninstalled.</div>');
+ − 1693 }
+ − 1694 }
+ − 1695 }
+ − 1696 }
+ − 1697 elseif(isset($_POST['install'])) {
+ − 1698 $q = 'SELECT * FROM '.table_prefix.'themes;';
+ − 1699 $s = $db->sql_query($q);
+ − 1700 if(!$s) die('Error getting theme count: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1701 $n = $db->numrows($s);
+ − 1702 $n++;
+ − 1703 $theme_id = $_POST['theme_id'];
+ − 1704 $theme = Array();
+ − 1705 include('./themes/'.$theme_id.'/theme.cfg');
+ − 1706 $q = 'INSERT INTO '.table_prefix.'themes(theme_id,theme_name,theme_order,enabled) VALUES(\''.$theme['theme_id'].'\', \''.$theme['theme_name'].'\', '.$n.', 1)';
+ − 1707 $s = $db->sql_query($q);
+ − 1708 if(!$s) die('Error inserting theme data: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1709 else echo('<div class="info-box">Theme "'.$theme['theme_name'].'" installed.</div>');
+ − 1710 }
+ − 1711 echo('
+ − 1712 <h3>Currently installed themes</h3>
+ − 1713 <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">
+ − 1714 <p>
+ − 1715 <select name="theme_id">
+ − 1716 ');
+ − 1717 $q = 'SELECT theme_id,theme_name,enabled FROM '.table_prefix.'themes ORDER BY theme_order';
+ − 1718 $s = $db->sql_query($q);
+ − 1719 if(!$s) die('Error selecting theme data: '.mysql_error().'<br /><u>Attempted SQL:</u><br />'.$q);
+ − 1720 while ( $r = $db->fetchrow_num($s) ) {
+ − 1721 if($r[2] < 1) $r[1] .= ' (disabled)';
+ − 1722 echo('<option value="'.$r[0].'">'.$r[1].'</option>');
+ − 1723 }
+ − 1724 $db->free_result();
+ − 1725 echo('
+ − 1726 </select> <input type="submit" name="disenable" value="Enable/Disable" /> <input type="submit" name="edit" value="Change settings" /> <input type="submit" name="up" value="Move up" /> <input type="submit" name="down" value="Move down" /> <input type="submit" name="uninstall" value="Uninstall" style="color: #DD3300; font-weight: bold;" />
+ − 1727 </p>
+ − 1728 </form>
+ − 1729 <h3>Install a new theme</h3>
+ − 1730 ');
+ − 1731 $theme = Array();
+ − 1732 $obb = '';
+ − 1733 for($i=0;$i<sizeof($l);$i++) {
+ − 1734 if(is_file('./themes/'.$l[$i].'/theme.cfg') && file_exists('./themes/'.$l[$i].'/theme.cfg')) {
+ − 1735 include('./themes/'.$l[$i].'/theme.cfg');
+ − 1736 $q = 'SELECT * FROM '.table_prefix.'themes WHERE theme_id=\''.$theme['theme_id'].'\'';
+ − 1737 $s = $db->sql_query($q);
+ − 1738 if(!$s) die('Error selecting list of currently installed themes: '.mysql_error().'<br /><u>Attempted SQL:</u><br />'.$q);
+ − 1739 if($db->numrows($s) < 1) {
+ − 1740 $obb .= '<option value="'.$theme['theme_id'].'">'.$theme['theme_name'].'</option>';
+ − 1741 }
+ − 1742 $db->free_result();
+ − 1743 }
+ − 1744 }
+ − 1745 if($obb != '') {
+ − 1746 echo('<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post"><p>');
+ − 1747 echo('<select name="theme_id">');
+ − 1748 echo($obb);
+ − 1749 echo('</select>');
+ − 1750 echo('
+ − 1751 <input type="submit" name="install" value="Install this theme" />
+ − 1752 </p></form>');
+ − 1753 } else echo('<p>All themes are currently installed.</p>');
+ − 1754 }
+ − 1755
+ − 1756 function page_Admin_BanControl()
+ − 1757 {
+ − 1758 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1759 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1760 {
+ − 1761 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1762 return;
+ − 1763 }
+ − 1764
+ − 1765 if(isset($_GET['action']) && $_GET['action'] == 'delete' && isset($_GET['id']) && $_GET['id'] != '')
+ − 1766 {
+ − 1767 $e = $db->sql_query('DELETE FROM '.table_prefix.'banlist WHERE ban_id=' . $db->escape($_GET['id']) . '');
+ − 1768 if(!$e) $db->_die('The ban list entry was not deleted.');
+ − 1769 }
+ − 1770 if(isset($_POST['create']))
+ − 1771 {
+ − 1772 $q = 'INSERT INTO '.table_prefix.'banlist(ban_type,ban_value,reason,is_regex) VALUES( ' . $db->escape($_POST['type']) . ', \'' . $db->escape($_POST['value']) . '\', \''.$db->escape($_POST['reason']).'\'';
+ − 1773 if(isset($_POST['regex'])) $q .= ', 1';
+ − 1774 else $q .= ', 0';
+ − 1775 $q .= ');';
+ − 1776 $e = $db->sql_query($q);
+ − 1777 if(!$e) $db->_die('The banlist could not be updated.');
+ − 1778 }
+ − 1779 $q = $db->sql_query('SELECT ban_id,ban_type,ban_value,is_regex FROM '.table_prefix.'banlist ORDER BY ban_type;');
+ − 1780 if(!$q) $db->_die('The banlist data could not be selected.');
+ − 1781 echo '<table border="0" cellspacing="1" cellpadding="4">';
+ − 1782 echo '<tr><th>Type</th><th>Value</th><th>Regular Expression</th><th></th></tr>';
+ − 1783 if($db->numrows() < 1) echo '<td colspan="4">No ban rules yet.</td>';
+ − 1784 while($r = $db->fetchrow())
+ − 1785 {
+ − 1786 if($r['ban_type']==BAN_IP) $t = 'IP address';
+ − 1787 elseif($r['ban_type']==BAN_USER) $t = 'Username';
+ − 1788 elseif($r['ban_type']==BAN_EMAIL) $t = 'E-mail address';
+ − 1789 if($r['is_regex']) $g = 'Yes'; else $g = 'No';
+ − 1790 echo '<tr><td>'.$t.'</td><td>'.$r['ban_value'].'</td><td>'.$g.'</td><td><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'BanControl&action=delete&id='.$r['ban_id']).'">Delete</a></td></tr>';
+ − 1791 }
+ − 1792 $db->free_result();
+ − 1793 echo '</table>';
+ − 1794 echo '<h3>Create new ban rule</h3>';
+ − 1795 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">';
+ − 1796 ?>
+ − 1797 Type: <select name="type"><option value="<?php echo BAN_IP; ?>">IP address</option><option value="<?php echo BAN_USER; ?>">Username</option><option value="<?php echo BAN_EMAIL; ?>">E-mail address</option></select><br />
+ − 1798 Rule: <input type="text" name="value" size="30" /><br />
+ − 1799 Reason to show to the banned user: <textarea name="reason" rows="7" cols="20"></textarea><br />
+ − 1800 <input type="checkbox" name="regex" id="regex" /> <label for="regex">This rule is a regular expression</label> (advanced users only)<br />
+ − 1801 <input type="submit" style="font-weight: bold;" name="create" value="Create new ban rule" />
+ − 1802 <?php
+ − 1803 echo '</form>';
+ − 1804 }
+ − 1805
+ − 1806 function page_Admin_MassEmail()
+ − 1807 {
+ − 1808 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1809 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1810 {
+ − 1811 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1812 return;
+ − 1813 }
+ − 1814
+ − 1815 global $enano_config;
+ − 1816 if ( isset($_POST['do_send']) )
+ − 1817 {
+ − 1818 $use_smtp = getConfig('smtp_enabled') == '1';
+ − 1819
+ − 1820 //
+ − 1821 // Let's do some checking to make sure that mass mail functions
+ − 1822 // are working in win32 versions of php. (copied from phpBB)
+ − 1823 //
+ − 1824 if ( preg_match('/[c-z]:\\\.*/i', getenv('PATH')) && !$use_smtp)
+ − 1825 {
+ − 1826 $ini_val = ( @phpversion() >= '4.0.0' ) ? 'ini_get' : 'get_cfg_var';
+ − 1827
+ − 1828 // We are running on windows, force delivery to use our smtp functions
+ − 1829 // since php's are broken by default
+ − 1830 $use_smtp = true;
+ − 1831 $enano_config['smtp_server'] = @$ini_val('SMTP');
+ − 1832 }
+ − 1833
+ − 1834 $mail = new emailer( !empty($use_smtp) );
+ − 1835
+ − 1836 // Validate subject/message body
+ − 1837 $subject = stripslashes(trim($_POST['subject']));
+ − 1838 $message = stripslashes(trim($_POST['message']));
+ − 1839
+ − 1840 if ( empty($subject) )
+ − 1841 $errors[] = 'Please enter a subject.';
+ − 1842 if ( empty($message) )
+ − 1843 $errors[] = 'Please enter a message.';
+ − 1844
+ − 1845 // Get list of members
+ − 1846 if ( !empty($_POST['userlist']) )
+ − 1847 {
+ − 1848 $userlist = str_replace(', ', ',', $_POST['userlist']);
+ − 1849 $userlist = explode(',', $userlist);
+ − 1850 foreach ( $userlist as $k => $u )
+ − 1851 {
+ − 1852 if ( $u == $session->username )
+ − 1853 {
+ − 1854 // Message is automatically sent to the sender
+ − 1855 unset($userlist[$k]);
+ − 1856 }
+ − 1857 else
+ − 1858 {
+ − 1859 $userlist[$k] = $db->escape($u);
+ − 1860 }
+ − 1861 }
+ − 1862 $userlist = 'WHERE username=\'' . implode('\' OR username=\'', $userlist) . '\'';
+ − 1863
+ − 1864 $q = $db->sql_query('SELECT email FROM '.table_prefix.'users ' . $userlist . ';');
+ − 1865 if ( !$q )
+ − 1866 $db->_die();
+ − 1867
+ − 1868 if ( $row = $db->fetchrow() )
+ − 1869 {
+ − 1870 do {
+ − 1871 $mail->cc($row['email']);
+ − 1872 } while ( $row = $db->fetchrow() );
+ − 1873 }
+ − 1874
+ − 1875 $db->free_result();
+ − 1876
+ − 1877 }
+ − 1878 else
+ − 1879 {
+ − 1880 // Sending to a usergroup
+ − 1881
+ − 1882 $group_id = intval($_POST['group_id']);
+ − 1883 if ( $group_id < 1 )
+ − 1884 {
+ − 1885 $errors[] = 'Invalid group ID';
+ − 1886 }
+ − 1887 else
+ − 1888 {
+ − 1889 $q = $db->sql_query('SELECT u.email FROM '.table_prefix.'group_members AS g
+ − 1890 LEFT JOIN '.table_prefix.'users AS u
+ − 1891 ON (u.user_id=g.user_id)
+ − 1892 WHERE g.group_id=' . $group_id . ';');
+ − 1893 if ( !$q )
+ − 1894 $db->_die();
+ − 1895
+ − 1896 if ( $row = $db->fetchrow() )
+ − 1897 {
+ − 1898 do {
+ − 1899 $mail->cc($row['email']);
+ − 1900 } while ( $row = $db->fetchrow() );
+ − 1901 }
+ − 1902
+ − 1903 $db->free_result();
+ − 1904 }
+ − 1905 }
+ − 1906
+ − 1907 if ( sizeof($errors) < 1 )
+ − 1908 {
+ − 1909
+ − 1910 $mail->from(getConfig('contact_email'));
+ − 1911 $mail->replyto(getConfig('contact_email'));
+ − 1912 $mail->set_subject($subject);
+ − 1913 $mail->email_address(getConfig('contact_email'));
+ − 1914
+ − 1915 // Copied/modified from phpBB
+ − 1916 $email_headers = 'X-AntiAbuse: Website server name - ' . $_SERVER['SERVER_NAME'] . "\n";
+ − 1917 $email_headers .= 'X-AntiAbuse: User_id - ' . $session->user_id . "\n";
+ − 1918 $email_headers .= 'X-AntiAbuse: Username - ' . $session->username . "\n";
+ − 1919 $email_headers .= 'X-AntiAbuse: User IP - ' . $_SERVER['REMOTE_ADDR'] . "\n";
+ − 1920
+ − 1921 $mail->extra_headers($email_headers);
+ − 1922
+ − 1923 $tpl = 'The following message was mass-mailed by {SENDER}, one of the administrators from {SITE_NAME}. If this message contains spam or any comments which you find abusive or offensive, please contact the administration team at:
+ − 1924
+ − 1925 {CONTACT_EMAIL}
+ − 1926
+ − 1927 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ − 1928 {MESSAGE}
+ − 1929 ';
+ − 1930
+ − 1931 $mail->use_template($tpl);
+ − 1932
+ − 1933 $mail->assign_vars(array(
+ − 1934 'SENDER' => $session->username,
+ − 1935 'SITE_NAME' => getConfig('site_name'),
+ − 1936 'CONTACT_EMAIL' => getConfig('contact_email'),
+ − 1937 'MESSAGE' => $message
+ − 1938 ));
+ − 1939
+ − 1940 //echo '<pre>'.print_r($mail,true).'</pre>';
+ − 1941
+ − 1942 // All done
+ − 1943 $mail->send();
+ − 1944 $mail->reset();
+ − 1945
+ − 1946 echo '<div class="info-box">Your message has been sent.</div>';
+ − 1947
+ − 1948 }
+ − 1949 else
+ − 1950 {
+ − 1951 echo '<div class="warning-box">Could not send message for the following reason(s):<ul><li>' . implode('</li><li>', $errors) . '</li></ul></div>';
+ − 1952 }
+ − 1953
+ − 1954 }
+ − 1955 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">';
+ − 1956 ?>
+ − 1957 <div class="tblholder">
+ − 1958 <table border="0" cellspacing="1" cellpadding="4">
+ − 1959 <tr>
+ − 1960 <th colspan="2">Send mass e-mail</th>
+ − 1961 </tr>
+ − 1962 <tr>
+ − 1963 <td class="row2" rowspan="2" style="width: 30%; min-width: 200px;">
+ − 1964 Send message to:<br />
+ − 1965 <small>
+ − 1966 By default, this message will be sent to the group selected here. You may instead send the message to a specific
+ − 1967 list of users by entering them in the second row, with usernames separated by a single comma (no space).
+ − 1968 </small>
+ − 1969 </td>
+ − 1970 <td class="row1">
+ − 1971 <select name="group_id">
+ − 1972 <?php
+ − 1973 $q = $db->sql_query('SELECT group_name,group_id FROM '.table_prefix.'groups ORDER BY group_name ASC;');
+ − 1974 if ( !$q )
+ − 1975 $db->_die();
+ − 1976 while ( $row = $db->fetchrow() )
+ − 1977 {
+ − 1978 echo '<option value="' . $row['group_id'] . '">' . $row['group_name'] . '</option>';
+ − 1979 }
+ − 1980 ?>
+ − 1981 </select>
+ − 1982 </td>
+ − 1983 </tr>
+ − 1984 <tr>
+ − 1985 <td class="row1">
+ − 1986 Usernames: <input type="text" name="userlist" size="50" />
+ − 1987 </td>
+ − 1988 </tr>
+ − 1989 <tr>
+ − 1990 <td class="row2" style="width: 30%; min-width: 200px;">
+ − 1991 Subject:
+ − 1992 </td>
+ − 1993 <td class="row1">
+ − 1994 <input name="subject" type="text" size="50" />
+ − 1995 </td>
+ − 1996 </tr>
+ − 1997 <tr>
+ − 1998 <td class="row2" style="width: 30%; min-width: 200px;">
+ − 1999 Message:
+ − 2000 </td>
+ − 2001 <td class="row1">
+ − 2002 <textarea name="message" rows="30" cols="60" style="width: 100%;"></textarea>
+ − 2003 </td>
+ − 2004 </tr>
+ − 2005 <tr>
+ − 2006 <th class="subhead" colspan="2" style="text-align: left;" valign="middle">
+ − 2007 <div style="float: right;"><input type="submit" name="do_send" value="Send message" /></div>
+ − 2008 <small style="font-weight: normal;">Please be warned: it may take a LONG time to send this message. <b>Please do not stop the script until the process is finished.</b></small>
+ − 2009 </th>
+ − 2010 </tr>
+ − 2011
+ − 2012 </table>
+ − 2013 </div>
+ − 2014 <?php
+ − 2015 echo '</form>';
+ − 2016 }
+ − 2017
+ − 2018 function page_Admin_DBBackup()
+ − 2019 {
+ − 2020 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2021 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 2022 {
+ − 2023 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 2024 return;
+ − 2025 }
+ − 2026
+ − 2027 global $system_table_list;
+ − 2028 if(isset($_GET['submitting']) && $_GET['submitting'] == 'yes')
+ − 2029 {
+ − 2030
+ − 2031 if(defined('SQL_BACKUP_CRYPT'))
+ − 2032 // Try to increase our time limit
+ − 2033 @set_time_limit(300); // five minutes
+ − 2034 // Do the actual export
+ − 2035 $aesext = ( defined('SQL_BACKUP_CRYPT') ) ? '.tea' : '';
+ − 2036 $filename = 'enano_backup_' . date('dmy') . '.sql' . $aesext;
+ − 2037 ob_start();
+ − 2038 header('Content-disposition: attachment, filename="'.$filename.'";');
+ − 2039 header('Content-type: application/transact-sql');
+ − 2040 // Spew some headers
+ − 2041 $headdate = date('F d, Y \a\t h:i a');
+ − 2042 echo <<<HEADER
+ − 2043 -- Enano CMS SQL backup
+ − 2044 -- Generated on {$headdate} by {$session->username}
+ − 2045
+ − 2046 HEADER;
+ − 2047 // build the table list
+ − 2048 $base = ( isset($_POST['do_system_tables']) ) ? $system_table_list : Array();
+ − 2049 $add = ( isset($_POST['additional_tables'])) ? $_POST['additional_tables'] : Array();
+ − 2050 $tables = array_merge($base, $add);
+ − 2051
+ − 2052 // Log it!
+ − 2053 $e = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'db_backup\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($session->username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', \'' . $db->escape(implode(', ', $tables)) . '\')');
+ − 2054 if ( !$e )
+ − 2055 $db->_die();
+ − 2056
+ − 2057 foreach($tables as $i => $t)
+ − 2058 {
+ − 2059 if(!preg_match('#^([a-z0-9_]+)$#i', $t))
+ − 2060 die('Hacking attempt');
+ − 2061 // if($t == table_prefix.'files' && isset($_POST['do_data']))
+ − 2062 // unset($tables[$i]);
+ − 2063 }
+ − 2064 foreach($tables as $t)
+ − 2065 {
+ − 2066 // Sorry folks - this script CAN'T backup enano_files, enano_search_index, and enano_search_cache due to the sheer size of the tables.
+ − 2067 // If encryption is enabled the log data will be excluded too.
+ − 2068 echo export_table(
+ − 2069 $t,
+ − 2070 isset($_POST['do_struct']),
+ − 2071 ( isset($_POST['do_data']) /* && $t != table_prefix.'files' && $t != table_prefix.'search_index' && $t != table_prefix.'search_cache' && ( !defined('SQL_BACKUP_CRYPT') || ( defined('SQL_BACKUP_CRYPT') && $t != table_prefix.'logs' ) ) */ ),
+ − 2072 false
+ − 2073 ) . "\n";
+ − 2074 }
+ − 2075 $data = ob_get_contents();
+ − 2076 ob_end_clean();
+ − 2077 if(defined('SQL_BACKUP_CRYPT'))
+ − 2078 {
+ − 2079 // Free some memory, we don't need this stuff any more
+ − 2080 $db->close();
+ − 2081 unset($paths, $db, $template, $plugins);
+ − 2082 $tea = new TEACrypt();
+ − 2083 $data = $tea->encrypt($data, $session->private_key);
+ − 2084 }
+ − 2085 header('Content-length: '.strlen($data));
+ − 2086 echo $data;
+ − 2087 exit;
+ − 2088 }
+ − 2089 else
+ − 2090 {
+ − 2091 // Show the UI
+ − 2092 echo '<form action="'.makeUrlNS('Admin', 'DBBackup', 'submitting=yes', true).'" method="post" enctype="multipart/form-data">';
+ − 2093 ?>
+ − 2094 <p>This page allows you to back up your Enano database should something go miserably wrong.</p>
+ − 2095 <p><label><input type="checkbox" name="do_system_tables" checked="checked" /> Export tables that are part of the Enano core</label><p>
+ − 2096 <p>Additional tables to export:</p>
+ − 2097 <p><select name="additional_tables[]" multiple="multiple">
+ − 2098 <?php
+ − 2099 $q = $db->sql_query('SHOW TABLES;') or $db->_die('Somehow we were denied the request to get the list of tables.');
+ − 2100 while($row = $db->fetchrow_num())
+ − 2101 {
+ − 2102 if(!in_array($row[0], $system_table_list)) echo '<option value="'.$row[0].'">'.$row[0].'</option>';
+ − 2103 }
+ − 2104 ?>
+ − 2105 </select>
+ − 2106 </p>
+ − 2107 <p><label><input type="checkbox" name="do_struct" checked="checked" /> Include table structure</label><br />
+ − 2108 <label><input type="checkbox" name="do_data" checked="checked" /> Include table data</label>
+ − 2109 </p>
+ − 2110 <p><input type="submit" value="Create backup" /></p>
+ − 2111 <?php
+ − 2112 echo '</form>';
+ − 2113 }
+ − 2114 }
+ − 2115
+ − 2116 function page_Admin_AdminLogout()
+ − 2117 {
+ − 2118 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2119 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 2120 {
+ − 2121 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 2122 return;
+ − 2123 }
+ − 2124
+ − 2125 $session->logout(USER_LEVEL_ADMIN);
+ − 2126 echo '<h3>You have now been logged out of the administration panel.</h3><p>You will continue to be logged into the website, but you will need to re-authenticate before you can access the administration panel again.</p><p>Return to the <a href="'.makeUrl(getConfig('main_page')).'">Main Page</a>.</p>';
+ − 2127 }
+ − 2128
+ − 2129 function page_Special_Administration()
+ − 2130 {
+ − 2131 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2132
+ − 2133 if($session->auth_level < USER_LEVEL_ADMIN) {
+ − 2134 redirect(makeUrlNS('Special', 'Login/'.$paths->page, 'level='.USER_LEVEL_ADMIN), 'Not authorized', 'You need an authorization level of '.USER_LEVEL_ADMIN.' to use this page, your auth level is: ' . $session->auth_level, 0);
+ − 2135 exit;
+ − 2136 }
+ − 2137 else
+ − 2138 {
+ − 2139 $template->load_theme('admin', 'default');
+ − 2140 $template->init_vars();
+ − 2141 if( !isset( $_GET['noheaders'] ) )
+ − 2142 {
+ − 2143 $template->header();
+ − 2144 }
+ − 2145 echo 'Administer your Enano website.';
+ − 2146 ?>
+ − 2147 <script type="text/javascript">
+ − 2148 function ajaxPage(t)
+ − 2149 {
+ − 2150 if ( t == namespace_list.Admin + 'AdminLogout' )
+ − 2151 {
+ − 2152 var mb = new messagebox(MB_YESNO|MB_ICONQUESTION, 'Are you sure you want to de-authenticate?', 'If you de-authenticate, you will no longer be able to use the administration panel until you re-authenticate again. You may do so at any time using the Administration button on the sidebar.');
+ − 2153 mb.onclick['Yes'] = function() {
+ − 2154 var tigraentry = document.getElementById('i_div0_0').parentNode;
+ − 2155 var tigraobj = $(tigraentry);
+ − 2156 var div = document.createElement('div');
+ − 2157 div.style.backgroundColor = '#FFFFFF';
+ − 2158 domObjChangeOpac(70, div);
+ − 2159 div.style.position = 'absolute';
+ − 2160 var top = tigraobj.Top();
+ − 2161 var left = tigraobj.Left();
+ − 2162 var width = tigraobj.Width();
+ − 2163 var height = tigraobj.Height();
+ − 2164 div.style.top = top + 'px';
+ − 2165 div.style.left = left + 'px';
+ − 2166 div.style.width = width + 'px';
+ − 2167 div.style.height = height + 'px';
+ − 2168 var body = document.getElementsByTagName('body')[0];
+ − 2169 enlighten(true);
+ − 2170 body.appendChild(div);
+ − 2171 ajaxPageBin(namespace_list.Admin + 'AdminLogout');
+ − 2172 }
+ − 2173 return;
+ − 2174 }
+ − 2175 ajaxPageBin(t);
+ − 2176 }
+ − 2177 function ajaxPageBin(t)
+ − 2178 {
+ − 2179 document.getElementById('ajaxPageContainer').innerHTML = '<div class="wait-box">Loading page...</div>';
+ − 2180 ajaxGet('<?php echo scriptPath; ?>/ajax.php?title='+t+'&_mode=getpage&noheaders&auth=<?php echo $session->sid_super; ?>', function() {
+ − 2181 if(ajax.readyState == 4) {
+ − 2182 document.getElementById('ajaxPageContainer').innerHTML = ajax.responseText;
+ − 2183 fadeInfoBoxes();
+ − 2184 }
+ − 2185 });
+ − 2186 }
+ − 2187 function _enanoAdminOnload() { ajaxPage('<?php echo $paths->nslist['Admin']; ?>Home'); }
+ − 2188 var TREE_TPL = {
+ − 2189 'target' : '_self', // name of the frame links will be opened in
+ − 2190 // other possible values are: _blank, _parent, _search, _self and _top
+ − 2191
+ − 2192 'icon_e' : '<?php echo scriptPath; ?>/images/icons/empty.gif', // empty image
+ − 2193 'icon_l' : '<?php echo scriptPath; ?>/images/icons/line.gif', // vertical line
+ − 2194 'icon_32' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root leaf icon normal
+ − 2195 'icon_36' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root leaf icon selected
+ − 2196 'icon_48' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon normal
+ − 2197 'icon_52' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon selected
+ − 2198 'icon_56' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon opened
+ − 2199 'icon_60' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon selected
+ − 2200 'icon_16' : '<?php echo scriptPath; ?>/images/icons/folder.gif', // node icon normal
+ − 2201 'icon_20' : '<?php echo scriptPath; ?>/images/icons/folderopen.gif', // node icon selected
+ − 2202 'icon_24' : '<?php echo scriptPath; ?>/images/icons/folder.gif', // node icon opened
+ − 2203 'icon_28' : '<?php echo scriptPath; ?>/images/icons/folderopen.gif', // node icon selected opened
+ − 2204 'icon_0' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon normal
+ − 2205 'icon_4' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon selected
+ − 2206 'icon_8' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon opened
+ − 2207 'icon_12' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon selected
+ − 2208 'icon_2' : '<?php echo scriptPath; ?>/images/icons/joinbottom.gif', // junction for leaf
+ − 2209 'icon_3' : '<?php echo scriptPath; ?>/images/icons/join.gif', // junction for last leaf
+ − 2210 'icon_18' : '<?php echo scriptPath; ?>/images/icons/plusbottom.gif', // junction for closed node
+ − 2211 'icon_19' : '<?php echo scriptPath; ?>/images/icons/plus.gif', // junction for last closed node
+ − 2212 'icon_26' : '<?php echo scriptPath; ?>/images/icons/minusbottom.gif',// junction for opened node
+ − 2213 'icon_27' : '<?php echo scriptPath; ?>/images/icons/minus.gif' // junction for last opended node
+ − 2214 };
+ − 2215 <?php
+ − 2216 echo $paths->parseAdminTree(); // Make a Javascript array that defines the tree
+ − 2217 if(!isset($_GET['module'])) { echo 'addOnloadHook(_enanoAdminOnload);'; } ?>
+ − 2218 </script>
+ − 2219 <table border="0" width="100%">
+ − 2220 <tr>
+ − 2221 <td class="holder" valign="top">
+ − 2222 <div class="pad" style="padding-right: 20px;">
+ − 2223 <script type="text/javascript">
+ − 2224 new tree(TREE_ITEMS, TREE_TPL);
+ − 2225 </script>
+ − 2226 </div>
+ − 2227 </td>
+ − 2228 <td width="100%" valign="top">
+ − 2229 <div class="pad" id="ajaxPageContainer">
+ − 2230 <?php
+ − 2231 if(isset($_GET['module']))
+ − 2232 {
+ − 2233 // Look for a namespace prefix in the urlname, and assign a different namespace, if necessary
+ − 2234 $k = array_keys($paths->nslist);
+ − 2235 for ( $i = 0; $i < sizeof($paths->nslist); $i++ )
+ − 2236 {
+ − 2237 $ln = strlen( $paths->nslist[ $k[ $i ] ] );
+ − 2238 if ( substr($_GET['module'], 0, $ln) == $paths->nslist[$k[$i]] )
+ − 2239 {
+ − 2240 $ns = $k[$i];
+ − 2241 $nm = substr($_GET['module'], $ln, strlen($_GET['module']));
+ − 2242 }
+ − 2243 }
+ − 2244 $fname = 'page_'.$ns.'_'.$nm;
+ − 2245 $s = strpos($fname, '?noheaders');
+ − 2246 if($s) $fname = substr($fname, 0, $s);
+ − 2247 $paths->cpage['module'] = $_GET['module'];
+ − 2248 if ( function_exists($fname) && $_GET['module'] != $paths->nslist['Special'] . 'Administration' )
+ − 2249 {
+ − 2250 eval($fname.'();');
+ − 2251 }
+ − 2252 }
+ − 2253 else
+ − 2254 {
+ − 2255 echo '<div class="wait-box">Please wait while the administration panel loads. You need to be using a recent browser with AJAX support in order to use Runt.</div>';
+ − 2256 }
+ − 2257 ?>
+ − 2258 </div>
+ − 2259 </td>
+ − 2260 </tr>
+ − 2261 </table>
+ − 2262
+ − 2263 <?php
+ − 2264 }
+ − 2265 if(!isset($_GET['noheaders']))
+ − 2266 {
+ − 2267 $template->footer();
+ − 2268 }
+ − 2269 }
+ − 2270
+ − 2271 function page_Special_EditSidebar()
+ − 2272 {
+ − 2273 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2274
+ − 2275 if($session->auth_level < USER_LEVEL_ADMIN)
+ − 2276 {
+ − 2277 redirect(makeUrlNS('Special', 'Login/'.$paths->page, 'level='.USER_LEVEL_ADMIN), '', '', false);
+ − 2278 exit;
+ − 2279 }
+ − 2280 else
+ − 2281 {
+ − 2282
+ − 2283 $template->add_header('<script type="text/javascript" src="'.scriptPath.'/includes/clientside/dbx.js"></script>');
+ − 2284 $template->add_header('<script type="text/javascript" src="'.scriptPath.'/includes/clientside/dbx-key.js"></script>');
+ − 2285 $template->add_header('<script type="text/javascript" src="'.scriptPath.'/includes/clientside/sbedit.js"></script>');
+ − 2286 $template->add_header('<link rel="stylesheet" type="text/css" href="'.scriptPath.'/includes/clientside/dbx.css" />');
+ − 2287
+ − 2288 // Knock the sidebars dead to keep javascript in plugins from interfering
+ − 2289 $template->tpl_strings['SIDEBAR_LEFT'] = '';
+ − 2290 $template->tpl_strings['SIDEBAR_RIGHT'] = '';
+ − 2291
+ − 2292 $template->load_theme('oxygen', 'bleu');
+ − 2293 $template->init_vars();
+ − 2294
+ − 2295 $template->header();
+ − 2296
+ − 2297 if(isset($_POST['save']))
+ − 2298 {
+ − 2299 // Write the new block order to the database
+ − 2300 // The only way to do this is with tons of queries (one per block + one select query at the start to count everything) but afaik its safe...
+ − 2301 // Anyone know a better way to do this?
+ − 2302 $q = $db->sql_query('SELECT item_order,item_id,sidebar_id FROM '.table_prefix.'sidebar ORDER BY sidebar_id ASC, item_order ASC;');
+ − 2303 if ( !$q )
+ − 2304 {
+ − 2305 $db->_die('The sidebar order data could not be selected.');
+ − 2306 }
+ − 2307 $orders = Array();
+ − 2308 while($row = $db->fetchrow())
+ − 2309 {
+ − 2310 $orders[] = Array(
+ − 2311 count($orders),
+ − 2312 $row['item_id'],
+ − 2313 $row['sidebar_id'],
+ − 2314 );
+ − 2315 }
+ − 2316 $db->free_result();
+ − 2317
+ − 2318 // We now have an array with each sidebar ID in its respective order. Explode the order string in $_POST['order_(left|right)'] and use it to build a set of queries.
+ − 2319 $ol = explode(',', $_POST['order_left']);
+ − 2320 $odr = explode(',', $_POST['order_right']);
+ − 2321 $om = array_merge($ol, $odr);
+ − 2322 unset($ol, $odr);
+ − 2323 $queries = Array();
+ − 2324 foreach($orders as $k => $v)
+ − 2325 {
+ − 2326 $queries[] = 'UPDATE '.table_prefix.'sidebar SET item_order='.$om[$k].' WHERE item_id='.$v[1].';';
+ − 2327 }
+ − 2328 foreach($queries as $sql)
+ − 2329 {
+ − 2330 $q = $db->sql_query($sql);
+ − 2331 if(!$q)
+ − 2332 {
+ − 2333 $t = $db->get_error();
+ − 2334 echo $t;
+ − 2335 $template->footer();
+ − 2336 exit;
+ − 2337 }
+ − 2338 }
+ − 2339 echo '<div class="info-box" style="margin: 10px 0;">The sidebar order information was updated successfully.</div>';
+ − 2340 }
+ − 2341 elseif(isset($_POST['create']))
+ − 2342 {
+ − 2343 switch((int)$_POST['type'])
+ − 2344 {
+ − 2345 case BLOCK_WIKIFORMAT:
+ − 2346 $content = $_POST['wikiformat_content'];
+ − 2347 break;
+ − 2348 case BLOCK_TEMPLATEFORMAT:
+ − 2349 $content = $_POST['templateformat_content'];
+ − 2350 break;
+ − 2351 case BLOCK_HTML:
+ − 2352 $content = $_POST['html_content'];
+ − 2353 break;
+ − 2354 case BLOCK_PHP:
+ − 2355 $content = $_POST['php_content'];
+ − 2356 break;
+ − 2357 case BLOCK_PLUGIN:
+ − 2358 $content = $_POST['plugin_id'];
+ − 2359 break;
+ − 2360 }
+ − 2361 // Get the value of item_order
+ − 2362
+ − 2363 $q = $db->sql_query('SELECT * FROM '.table_prefix.'sidebar WHERE sidebar_id='.$db->escape($_POST['sidebar_id']).';');
+ − 2364 if(!$q) $db->_die('The order number could not be selected');
+ − 2365 $io = $db->numrows();
+ − 2366
+ − 2367 $db->free_result();
+ − 2368
+ − 2369 $q = 'INSERT INTO '.table_prefix.'sidebar(block_name, block_type, sidebar_id, block_content, item_order) VALUES ( \''.$db->escape($_POST['title']).'\', \''.$db->escape($_POST['type']).'\', \''.$db->escape($_POST['sidebar_id']).'\', \''.$db->escape($content).'\', '.$io.' );';
+ − 2370 $result = $db->sql_query($q);
+ − 2371 if(!$result)
+ − 2372 {
+ − 2373 echo $db->get_error();
+ − 2374 $template->footer();
+ − 2375 exit;
+ − 2376 }
+ − 2377
+ − 2378 echo '<div class="info-box" style="margin: 10px 0;">The item was added.</div>';
+ − 2379
+ − 2380 }
+ − 2381
+ − 2382 if(isset($_GET['action']) && isset($_GET['id']))
+ − 2383 {
+ − 2384 if(preg_match('#^([0-9]*)$#', $_GET['id']))
+ − 2385 {
+ − 2386 } else {
+ − 2387 echo '<div class="warning-box">Error with action: $_GET["id"] was not an integer, aborting to prevent SQL injection</div>';
+ − 2388 }
+ − 2389 switch($_GET['action'])
+ − 2390 {
+ − 2391 case 'new':
+ − 2392 ?>
+ − 2393 <script type="text/javascript">
+ − 2394 function setType(input)
+ − 2395 {
+ − 2396 val = input.value;
+ − 2397 if(!val)
+ − 2398 {
+ − 2399 return false;
+ − 2400 }
+ − 2401 var divs = getElementsByClassName(document, 'div', 'sbadd_block');
+ − 2402 for(var i in divs)
+ − 2403 {
+ − 2404 if(divs[i].id == 'blocktype_'+val) divs[i].style.display = 'block';
+ − 2405 else divs[i].style.display = 'none';
+ − 2406 }
+ − 2407 }
+ − 2408 </script>
+ − 2409
+ − 2410 <form action="<?php echo makeUrl($paths->page); ?>" method="post">
+ − 2411
+ − 2412 <p>
+ − 2413 What type of block should this be?
+ − 2414 </p>
+ − 2415 <p>
+ − 2416 <select name="type" onchange="setType(this)"> <?php /* (NOT WORKING, at least in firefox 2) onload="var thingy = this; setTimeout('setType(thingy)', 500);" */ ?>
+ − 2417 <option value="<?php echo BLOCK_WIKIFORMAT; ?>">Wiki-formatted block</option>
+ − 2418 <option value="<?php echo BLOCK_TEMPLATEFORMAT; ?>">Template-formatted block (old pre-beta 3 behavior)</option>
+ − 2419 <option value="<?php echo BLOCK_HTML; ?>">Raw HTML block</option>
+ − 2420 <option value="<?php echo BLOCK_PHP; ?>">PHP code block (danger, Will Robinson!)</option>
+ − 2421 <option value="<?php echo BLOCK_PLUGIN; ?>">Use code from a plugin</option>
+ − 2422 </select>
+ − 2423 </p>
+ − 2424
+ − 2425 <p>
+ − 2426
+ − 2427 Block title: <input name="title" type="text" size="40" /><br />
+ − 2428 Which sidebar: <select name="sidebar_id"><option value="<?php echo SIDEBAR_LEFT; ?>">Left</option><option value="<?php echo SIDEBAR_RIGHT; ?>">Right</option></select>
+ − 2429
+ − 2430 </p>
+ − 2431
+ − 2432 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_WIKIFORMAT; ?>">
+ − 2433 <p>
+ − 2434 Wikitext:
+ − 2435 </p>
+ − 2436 <p>
+ − 2437 <textarea style="width: 98%;" name="wikiformat_content" rows="15" cols="50"></textarea>
+ − 2438 </p>
+ − 2439 </div>
+ − 2440
+ − 2441 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_TEMPLATEFORMAT; ?>">
+ − 2442 <p>
+ − 2443 Template code:
+ − 2444 </p>
+ − 2445 <p>
+ − 2446 <textarea style="width: 98%;" name="templateformat_content" rows="15" cols="50"></textarea>
+ − 2447 </p>
+ − 2448 </div>
+ − 2449
+ − 2450 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_HTML; ?>">
+ − 2451 <p>
+ − 2452 HTML to place inside the sidebar:
+ − 2453 </p>
+ − 2454 <p>
+ − 2455 <textarea style="width: 98%;" name="html_content" rows="15" cols="50"></textarea>
+ − 2456 </p>
+ − 2457 </div>
+ − 2458
+ − 2459 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_PHP; ?>">
+ − 2460 <p>
+ − 2461 <b>WARNING:</b> If you don't know what you're doing, or if you are not fluent in PHP, stop now and choose a different block type. You will brick your Enano installation if you are not careful here.
+ − 2462 ALWAYS remember to write secure code! The Enano team is not responsible if someone drops all your tables because of an SQL injection vulnerability in your sidebar code. You are probably better off using the template-formatted block type.
+ − 2463 </p>
+ − 2464 <p>
+ − 2465 <span style="color: red;">
+ − 2466 It is especially important to note that this code is NOT checked for errors! If there is a syntax error in your code here, it will prevent any pages from loading AT ALL. So you need to use an external PHP editor (like <a href="http://www.jedit.org">jEdit</a>) to check your syntax before you hit save.
+ − 2467 </span> You have been warned.
+ − 2468 </p>
+ − 2469 <p>
+ − 2470 Also, you should avoid using output buffering functions (ob_[start|end|get_contents|clean]) here, because Enano uses those to track output from this script.
+ − 2471 </p>
+ − 2472 <p>
+ − 2473 The standard <?php and ?> tags work here. Don't use an initial "<?php" or it will cause a parse error.
+ − 2474 </p>
+ − 2475 <p>
+ − 2476 PHP code:
+ − 2477 </p>
+ − 2478 <p>
+ − 2479 <textarea style="width: 98%;" name="php_content" rows="15" cols="50"></textarea>
+ − 2480 </p>
+ − 2481 </div>
+ − 2482
+ − 2483 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_PLUGIN; ?>">
+ − 2484 <p>
+ − 2485 Plugin:
+ − 2486 </p>
+ − 2487 <p>
+ − 2488 <select name="plugin_id">
+ − 2489 <?php
+ − 2490 foreach($template->plugin_blocks as $k => $c)
+ − 2491 {
+ − 2492 echo '<option value="'.$k.'">'.$k.'</option>';
+ − 2493 }
+ − 2494 ?>
+ − 2495 </select>
+ − 2496 </p>
+ − 2497 </div>
+ − 2498
+ − 2499 <p>
+ − 2500
+ − 2501 <input type="submit" name="create" value="Create new block" style="font-weight: bold;" />
+ − 2502 <input type="submit" name="cancel" value="Cancel" />
+ − 2503
+ − 2504 </p>
+ − 2505
+ − 2506 </form>
+ − 2507
+ − 2508 <script type="text/javascript">
+ − 2509 var divs = getElementsByClassName(document, 'div', 'sbadd_block');
+ − 2510 for(var i in divs)
+ − 2511 {
+ − 2512 if(divs[i].id != 'blocktype_<?php echo BLOCK_WIKIFORMAT; ?>') setTimeout("document.getElementById('"+divs[i].id+"').style.display = 'none';", 500);
+ − 2513 }
+ − 2514 </script>
+ − 2515
+ − 2516 <?php
+ − 2517 $template->footer();
+ − 2518 return;
+ − 2519 break;
+ − 2520 case 'move':
+ − 2521 if( !isset($_GET['side']) || ( isset($_GET['side']) && !preg_match('#^([0-9]+)$#', $_GET['side']) ) )
+ − 2522 {
+ − 2523 echo '<div class="warning-box" style="margin: 10px 0;">$_GET[\'side\'] contained an SQL injection attempt</div>';
+ − 2524 break;
+ − 2525 }
+ − 2526 $query = $db->sql_query('UPDATE '.table_prefix.'sidebar SET sidebar_id=' . $db->escape($_GET['side']) . ' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2527 if(!$query)
+ − 2528 {
+ − 2529 echo $db->get_error();
+ − 2530 $template->footer();
+ − 2531 exit;
+ − 2532 }
+ − 2533 echo '<div class="info-box" style="margin: 10px 0;">Item moved.</div>';
+ − 2534 break;
+ − 2535 case 'delete':
+ − 2536 $query = $db->sql_query('DELETE FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';'); // Already checked for injection attempts ;-)
+ − 2537 if(!$query)
+ − 2538 {
+ − 2539 echo $db->get_error();
+ − 2540 $template->footer();
+ − 2541 exit;
+ − 2542 }
+ − 2543 if(isset($_GET['ajax']))
+ − 2544 {
+ − 2545 ob_end_clean();
+ − 2546 die('GOOD');
+ − 2547 }
+ − 2548 echo '<div class="error-box" style="margin: 10px 0;">Item deleted.</div>';
+ − 2549 break;
+ − 2550 case 'disenable';
+ − 2551 $q = $db->sql_query('SELECT item_enabled FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2552 if(!$q)
+ − 2553 {
+ − 2554 echo $db->get_error();
+ − 2555 $template->footer();
+ − 2556 exit;
+ − 2557 }
+ − 2558 $r = $db->fetchrow();
+ − 2559 $db->free_result();
+ − 2560 $e = ( $r['item_enabled'] == 1 ) ? '0' : '1';
+ − 2561 $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET item_enabled='.$e.' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2562 if(!$q)
+ − 2563 {
+ − 2564 echo $db->get_error();
+ − 2565 $template->footer();
+ − 2566 exit;
+ − 2567 }
+ − 2568 if(isset($_GET['ajax']))
+ − 2569 {
+ − 2570 ob_end_clean();
+ − 2571 die('GOOD');
+ − 2572 }
+ − 2573 break;
+ − 2574 case 'getsource':
+ − 2575 $q = $db->sql_query('SELECT block_content,block_type FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2576 if(!$q)
+ − 2577 {
+ − 2578 echo $db->get_error();
+ − 2579 $template->footer();
+ − 2580 exit;
+ − 2581 }
+ − 2582 ob_end_clean();
+ − 2583 $r = $db->fetchrow();
+ − 2584 $db->free_result();
+ − 2585 if($r['block_type'] == BLOCK_PLUGIN) die('HOUSTON_WE_HAVE_A_PLUGIN');
+ − 2586 die($r['block_content']);
+ − 2587 break;
+ − 2588 case 'save':
+ − 2589 $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET block_content=\''.$db->escape(rawurldecode($_POST['content'])).'\' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2590 if(!$q)
+ − 2591 {
+ − 2592 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
+ − 2593 exit;
+ − 2594 }
+ − 2595 $q = $db->sql_query('SELECT block_type,block_content FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2596 if(!$q)
+ − 2597 {
+ − 2598 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
+ − 2599 exit;
+ − 2600 }
+ − 2601 $row = $db->fetchrow();
+ − 2602 $db->free_result();
+ − 2603 switch($row['block_type'])
+ − 2604 {
+ − 2605 case BLOCK_WIKIFORMAT:
+ − 2606 default:
+ − 2607 $c = RenderMan::render($row['block_content']);
+ − 2608 break;
+ − 2609 case BLOCK_TEMPLATEFORMAT:
+ − 2610 $c = $template->tplWikiFormat($row['block_content'], false, 'sidebar-editor.tpl');
+ − 2611 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2612 break;
+ − 2613 case BLOCK_HTML:
+ − 2614 $c = $row['block_content'];
+ − 2615 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2616 break;
+ − 2617 case BLOCK_PHP:
+ − 2618 ob_start();
+ − 2619 eval($row['block_content']);
+ − 2620 $c = ob_get_contents();
+ − 2621 ob_end_clean();
+ − 2622 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2623 break;
+ − 2624 case BLOCK_PLUGIN:
+ − 2625 $c = ($template->fetch_block($row['block_content'])) ? $template->fetch_block($row['block_content']) : 'Can\'t find plugin block';
+ − 2626 break;
+ − 2627 }
+ − 2628 die('var status = \'GOOD\'; var content = unescape(\''.hexencode($c).'\');');
+ − 2629 break;
+ − 2630 }
+ − 2631 }
+ − 2632
+ − 2633 $q = $db->sql_query('SELECT item_id,sidebar_id,item_enabled,block_name,block_type,block_content FROM '.table_prefix.'sidebar ORDER BY sidebar_id ASC, item_order ASC;');
+ − 2634 if(!$q) $db->_die('The sidebar text data could not be selected.');
+ − 2635
+ − 2636 $vars = $template->extract_vars('sidebar-editor.tpl');
+ − 2637
+ − 2638 $parser = $template->makeParserText($vars['sidebar_button']);
+ − 2639 $parser->assign_vars(Array(
+ − 2640 'HREF'=>'#',
+ − 2641 'FLAGS'=>'onclick="return false;"',
+ − 2642 'TEXT'=>'Change theme'
+ − 2643 ));
+ − 2644 $template->tpl_strings['THEME_LINK'] = $parser->run();
+ − 2645 $parser->assign_vars(Array(
+ − 2646 'TEXT'=>'Log out',
+ − 2647 ));
+ − 2648 $template->tpl_strings['LOGOUT_LINK'] = $parser->run();
+ − 2649
+ − 2650 $n1 = Array();
+ − 2651 $n2 = Array();
+ − 2652 $n =& $n1;
+ − 2653
+ − 2654 echo '<table border="0"><tr><td valign="top"><div class="dbx-group" id="sbedit_left">';
+ − 2655 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_top']);
+ − 2656
+ − 2657 // Time for the loop
+ − 2658 // what this loop does is fetch the row data, then send it out to the appropriate parser for formatting,
+ − 2659 // then puts the result into $c, which is then sent to the template compiler for insertion into the TPL code.
+ − 2660 while($row = $db->fetchrow())
+ − 2661 {
+ − 2662 if(isset($current_side))
+ − 2663 {
+ − 2664 if($current_side != $row['sidebar_id'])
+ − 2665 {
+ − 2666 // Time to switch!
+ − 2667 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_bottom']);
+ − 2668 echo '</div></td><td valign="top"><div class="dbx-group" id="sbedit_right">';
+ − 2669 //echo '</td><td valign="top">';
+ − 2670 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_top']);
+ − 2671 $n =& $n2;
+ − 2672 }
+ − 2673 }
+ − 2674 $n[] = count($n);
+ − 2675 $current_side = $row['sidebar_id'];
+ − 2676 switch($row['block_type'])
+ − 2677 {
+ − 2678 case BLOCK_WIKIFORMAT:
+ − 2679 default:
+ − 2680 $parser = $template->makeParserText($vars['sidebar_section']);
+ − 2681 $c = RenderMan::render($row['block_content']);
+ − 2682 break;
+ − 2683 case BLOCK_TEMPLATEFORMAT:
+ − 2684 $parser = $template->makeParserText($vars['sidebar_section']);
+ − 2685 $c = $template->tplWikiFormat($row['block_content'], false, 'sidebar-editor.tpl');
+ − 2686 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2687 break;
+ − 2688 case BLOCK_HTML:
+ − 2689 $parser = $template->makeParserText($vars['sidebar_section_raw']);
+ − 2690 $c = $row['block_content'];
+ − 2691 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2692 break;
+ − 2693 case BLOCK_PHP:
+ − 2694 $parser = $template->makeParserText($vars['sidebar_section_raw']);
+ − 2695 ob_start();
+ − 2696 eval($row['block_content']);
+ − 2697 $c = ob_get_contents();
+ − 2698 ob_end_clean();
+ − 2699 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2700 break;
+ − 2701 case BLOCK_PLUGIN:
+ − 2702 $parser = $template->makeParserText($vars['sidebar_section_raw']);
+ − 2703 $c = ($template->fetch_block($row['block_content'])) ? $template->fetch_block($row['block_content']) : 'Can\'t find plugin block';
+ − 2704 break;
+ − 2705 }
+ − 2706 $t = $template->tplWikiFormat($row['block_name']);
+ − 2707 if($row['item_enabled'] == 0) $t .= ' <span id="disabled_'.$row['item_id'].'" style="color: red;">(disabled)</span>';
+ − 2708 else $t .= ' <span id="disabled_'.$row['item_id'].'" style="color: red; display: none;">(disabled)</span>';
+ − 2709 $side = ( $row['sidebar_id'] == SIDEBAR_LEFT ) ? SIDEBAR_RIGHT : SIDEBAR_LEFT;
+ − 2710 $tb = '<a title="Enable or disable this block" href="'.makeUrl($paths->page, 'action=disenable&id='.$row['item_id'].'' , true).'" onclick="ajaxDisenableBlock(\''.$row['item_id'].'\'); return false;" ><img alt="Enable/disable this block" style="border-width: 0;" src="'.scriptPath.'/images/disenable.png" /></a>
+ − 2711 <a title="Edit the contents of this block" href="'.makeUrl($paths->page, 'action=edit&id='.$row['item_id'].'' , true).'" onclick="ajaxEditBlock(\''.$row['item_id'].'\', this); return false;"><img alt="Edit this block" style="border-width: 0;" src="'.scriptPath.'/images/edit.png" /></a>
+ − 2712 <a title="Permanently delete this block" href="'.makeUrl($paths->page, 'action=delete&id='.$row['item_id'].'' , true).'" onclick="if(confirm(\'Do you really want to delete this block?\')) { ajaxDeleteBlock(\''.$row['item_id'].'\', this); } return false;"><img alt="Delete this block" style="border-width: 0;" src="'.scriptPath.'/images/delete.png" /></a>
+ − 2713 <a title="Move this block to the other sidebar" href="'.makeUrl($paths->page, 'action=move&id='.$row['item_id'].'&side='.$side, true).'"><img alt="Move this block" style="border-width: 0;" src="'.scriptPath.'/images/move.png" /></a>';
+ − 2714 $as = '';
+ − 2715 $ae = ' '.$tb;
+ − 2716 $parser->assign_vars(Array('CONTENT'=>$c,'TITLE'=>$t,'ADMIN_START'=>$as,'ADMIN_END'=>$ae));
+ − 2717 echo $parser->run();
+ − 2718 unset($parser);
+ − 2719
+ − 2720 }
+ − 2721 $db->free_result();
+ − 2722 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_bottom']);
+ − 2723 echo '</div></td></tr></table>';
+ − 2724 echo '<form action="'.makeUrl($paths->page).'" method="post">';
+ − 2725 $order = implode(',', $n1);
+ − 2726 echo "<input type='hidden' id='divOrder_Left' name='order_left' value='{$order}' />";
+ − 2727 $order = implode(',', $n2);
+ − 2728 echo "<input type='hidden' id='divOrder_Right' name='order_right' value='{$order}' />";
+ − 2729 echo '
+ − 2730 <div style="margin: 0 auto 0 auto; text-align: center;">
+ − 2731 <input type="submit" name="save" style="font-weight: bold;" value="Save changes" />
+ − 2732 <input type="submit" name="revert" style="font-weight: normal;" value="Revert" onclick="return confirm(\'Do you really want to revert your changes?\nNote: this does not revert edits or deletions, those are saved as soon as you confirm the action.\')" />
+ − 2733 <br />
+ − 2734 <a href="'.makeUrl($paths->page, 'action=new&id=0', true).'">Create new block</a> | <a href="'.makeUrl(getConfig('main_page'), false, true).'">Main Page</a>
+ − 2735 </div>
+ − 2736 </form>
+ − 2737 ';
+ − 2738 }
+ − 2739
+ − 2740 $template->footer();
+ − 2741 }
+ − 2742
+ − 2743 ?>