<?php

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Version 1.1.4 (Caoineag alpha 4)

 * Copyright (C) 2006-2008 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

function page_Admin_UserManager()

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  global $lang;

  if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

  {

    $login_link = makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true);

    echo '<h3>' . $lang->get('adm_err_not_auth_title') . '</h3>';

    echo '<p>' . $lang->get('adm_err_not_auth_body', array( 'login_link' => $login_link )) . '</p>';

    return;

  }

  require_once(ENANO_ROOT . '/includes/math.php');

  require_once(ENANO_ROOT . '/includes/diffiehellman.php');

  $GLOBALS['dh_supported'] = $dh_supported;

  //die('<pre>' . htmlspecialchars(print_r($_POST, true)) . '</pre>');

  if ( isset($_POST['action']['save']) )

  {

    #

    # BEGIN VALIDATION

    #

    $errors = array();

    if ( defined('ENANO_DEMO_MODE') )

    {

      $errors[] = $lang->get('acpum_err_nosave_demo');

    }

    $user_id = intval($_POST['user_id']);

    if ( empty($user_id) || $user_id == 1 )

      $errors[] = 'Invalid user ID.';

    if ( isset($_POST['delete_account']) && count($errors) < 1 )

    {

      $q = $db->sql_query('DELETE FROM '.table_prefix."users_extra WHERE user_id=$user_id;");

      if ( !$q )

        $db->_die();

      $q = $db->sql_query('DELETE FROM '.table_prefix."users WHERE user_id=$user_id;");

      if ( !$q )

        $db->_die();

      echo '<div class="info-box">' . $lang->get('acpum_msg_delete_success') . '</div>';

    }

    else

    {

      if ( $session->user_id == $user_id )

      {

        $username = $session->username;

        $password = false;

        $email = $session->email;

        $real_name = $session->real_name;

      }

      else

      {

        $username = $_POST['username'];

        if ( !preg_match('#^'.$session->valid_username.'$#', $username) )

          $errors[] = $lang->get('acpum_err_illegal_username');

        $password = false;

        if ( $_POST['changing_pw'] == 'yes' )

        {

          $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);

          $key_hex_md5 = $_POST['crypt_key'];

          $key_hex = $session->fetch_public_key($key_hex_md5);

          if ( $key_hex )

          {

            $key_bin = hexdecode($key_hex);

            $data_hex = $_POST['crypt_data'];

            $password = $aes->decrypt($data_hex, $key_bin, ENC_HEX);

          }

          else

          {

            $errors[] = $lang->get('acpum_err_no_aes_key');

          }

        }

        $email = $_POST['email'];

        if ( !preg_match('/^(?:[\w\d]+\.?)+@((?:(?:[\w\d]\-?)+\.)+\w{2,4}|localhost)$/', $email) )

          $errors[] = $lang->get('acpum_err_illegal_email');

        $real_name = $_POST['real_name'];

      }

      $signature = RenderMan::preprocess_text($_POST['signature'], true, true);

      $user_level = intval($_POST['user_level']);

      if ( $user_level < USER_LEVEL_MEMBER || $user_level > USER_LEVEL_ADMIN )

        $errors[] = 'Invalid user level';

      $user_rank = $_POST['user_rank'];

      if ( $user_rank !== 'NULL' )

      {

        $user_rank = intval($user_rank);

        if ( !$user_rank )

          $errors[] = 'Invalid user rank';

      }

      $imaddr_aim = htmlspecialchars($_POST['imaddr_aim']);

      $imaddr_msn = htmlspecialchars($_POST['imaddr_msn']);

      $imaddr_yahoo = htmlspecialchars($_POST['imaddr_yahoo']);

      $imaddr_xmpp = htmlspecialchars($_POST['imaddr_xmpp']);

      $homepage = htmlspecialchars($_POST['homepage']);

      $location = htmlspecialchars($_POST['location']);

      $occupation = htmlspecialchars($_POST['occupation']);

      $hobbies = htmlspecialchars($_POST['hobbies']);

      $email_public = ( isset($_POST['email_public']) ) ? '1' : '0';

      if ( !preg_match('/@([a-z0-9-]+)(\.([a-z0-9-\.]+))?/', $imaddr_msn) && !empty($imaddr_msn) )

      {

        $imaddr_msn = "$imaddr_msn@hotmail.com";

      }

      if ( substr($homepage, 0, 7) != 'http://' )

      {

        $homepage = "http://$homepage";

      }

      if ( !preg_match('/^http:\/\/([a-z0-9-.]+)([A-z0-9@#\$%\&:;<>,\.\?=\+\(\)\[\]_\/\\\\]*?)$/i', $homepage) )

      {

        $homepage = '';

      }

      if ( count($errors) < 1 )

      {

        $q = $db->sql_query('SELECT u.user_level, u.user_has_avatar, u.avatar_type FROM '.table_prefix.'users AS u WHERE u.user_id = ' . $user_id . ';');

        if ( !$q )

          $db->_die();

        if ( $db->numrows() < 1 )

        {

          echo 'Couldn\'t select user data: no rows returned';

        }

        $row = $db->fetchrow();

        $existing_level =& $row['user_level'];

        $avi_type =& $row['avatar_type'];

        $has_avi = ( $row['user_has_avatar'] == 1 );

        $db->free_result();

        $to_update_users = array();

        if ( $user_id != $session->user_id )

        {

          $to_update_users['username'] = $username;

          if ( $password )

          {

            $password = $session->pk_encrypt($password, ENC_HEX);

            $to_update_users['password'] = $password;

          }

          $to_update_users['email'] = $email;

          $to_update_users['real_name'] = $real_name;

        }

        $to_update_users['signature'] = $signature;

        $to_update_users['user_level'] = $user_level;

        $to_update_users['user_rank'] = $user_rank;

        if ( isset($_POST['account_active']) )

        {

          $to_update_users['account_active'] = "1";

        }

        else

        {

          $to_update_users['account_active'] = "0";

          $to_update_users['activation_key'] = sha1($session->dss_rand());

        }

        // Avatar validation

        $action = ( isset($_POST['avatar_action']) ) ? $_POST['avatar_action'] : 'keep';

        $avi_path = ENANO_ROOT . '/' . getConfig('avatar_directory') . '/' . $user_id . '.' . $avi_type;

        switch($action)

        {

          case 'keep':

          default:

            break;

          case 'remove':

            if ( $has_avi )

            {

              // First switch the avatar off

              $to_update_users['user_has_avatar'] = '0';

              @unlink($avi_path);

            }

            break;

          case 'set_http':

          case 'set_file':

            // Hackish way to preserve the UNIX philosophy of reusing as much code as possible

            if ( $action == 'set_http' )

            {

              // Check if this action is enabled

              if ( getConfig('avatar_upload_http') !== '1' )

              {

                // non-localized, only appears on hack attempt

                $errors[] = 'Uploads over HTTP are disabled.';

                break;

              }

              // Download the file

              require_once( ENANO_ROOT . '/includes/http.php' );

              if ( !preg_match('/^http:\/\/([a-z0-9-\.]+)(:([0-9]+))?\/(.+)$/', $_POST['avatar_http_url'], $match) )

              {

                $errors[] = $lang->get('usercp_avatar_invalid_url');

                break;

              }

              $hostname = $match[1];

              $uri = '/' . $match[4];

              $port = ( $match[3] ) ? intval($match[3]) : 80;

              $max_size = intval(getConfig('avatar_max_size'));

              // Get temporary file

              $tempfile = tempnam(false, "enanoavatar_{$user_id}");

              if ( !$tempfile )

                $errors[] = 'Error getting temp file.';

              @unlink($tempfile);

              $request = new Request_HTTP($hostname, $uri, 'GET', $port);

              $result = $request->write_response_to_file($tempfile, 50, $max_size);

              if ( !$result || $request->response_code != HTTP_OK )

              {

                @unlink($tempfile);

                $errors[] = $lang->get('usercp_avatar_bad_write');

                break;

              }

              // Response written. Proceed to validation...

            }

            else

            {

              // Check if this action is enabled

              if ( getConfig('avatar_upload_file') !== '1' )

              {

                // non-localized, only appears on hack attempt

                $errors[] = 'Uploads from the browser are disabled.';

                break;

              }

              $max_size = intval(getConfig('avatar_max_size'));

              $file =& $_FILES['avatar_file'];

              $tempfile =& $file['tmp_name'];

              if ( filesize($tempfile) > $max_size )

              {

                @unlink($tempfile);

                $errors[] = $lang->get('usercp_avatar_file_too_large');

                break;

              }

            }

            $file_type = get_image_filetype($tempfile);

            if ( !$file_type )

            {

              unlink($tempfile);

              $errors[] = $lang->get('usercp_avatar_bad_filetype');

              break;

            }

            $avi_path_new = ENANO_ROOT . '/' . getConfig('avatar_directory') . '/' . $user_id . '.' . $file_type;

            // The file type is good - validate dimensions and animation

            switch($file_type)

            {

              case 'png':

                $is_animated = is_png_animated($tempfile);

                $dimensions = png_get_dimensions($tempfile);

                break;

              case 'gif':

                $is_animated = is_gif_animated($tempfile);

                $dimensions = gif_get_dimensions($tempfile);

                break;

              case 'jpg':

                $is_animated = false;

                $dimensions = jpg_get_dimensions($tempfile);

                break;

              default:

                $errors[] = 'API mismatch';

                break 2;

            }

            // Did we get invalid size data? If so the image is probably corrupt.

            if ( !$dimensions )

            {

              @unlink($tempfile);

              $errors[] = $lang->get('usercp_avatar_corrupt_image');

              break;

            }

            // Is the image animated?

            if ( $is_animated && getConfig('avatar_enable_anim') !== '1' )

            {

              @unlink($tempfile);

              $errors[] = $lang->get('usercp_avatar_disallowed_animation');

              break;

            }

            // Check image dimensions

            list($image_x, $image_y) = $dimensions;

            $max_x = intval(getConfig('avatar_max_width'));

            $max_y = intval(getConfig('avatar_max_height'));

            if ( $image_x > $max_x || $image_y > $max_y )

            {

              @unlink($tempfile);

              $errors[] = $lang->get('usercp_avatar_too_large');

              break;

            }

            // All good!

            @unlink($avi_path);

            if ( rename($tempfile, $avi_path_new) )

            {

              $to_update_users['user_has_avatar'] = '1';

              $to_update_users['avatar_type'] = $file_type;

            }

            else

            {

              // move failed - turn avatar off

              $to_update_users['user_has_avatar'] = '0';

            }

            break;

          case 'set_gravatar':

            // set avatar to use Gravatar

            // first, remove old image

            if ( $has_avi )

            {

              @unlink($avi_path);

            }

            // set to gravatar mode

            $to_update_users['user_has_avatar'] = '1';

            $to_update_users['avatar_type'] = 'grv';

            $has_avi = 1;

            break;

        }

        if ( count($errors) < 1 )

        {

          $to_update_users_extra = array();

          $to_update_users_extra['user_aim'] = $imaddr_aim;

          $to_update_users_extra['user_msn'] = $imaddr_msn;

          $to_update_users_extra['user_yahoo'] = $imaddr_yahoo;

          $to_update_users_extra['user_xmpp'] = $imaddr_xmpp;

          $to_update_users_extra['user_homepage'] = $homepage;

          $to_update_users_extra['user_location'] = $location;

          $to_update_users_extra['user_job'] = $occupation;

          $to_update_users_extra['user_hobbies'] = $hobbies;

          $to_update_users_extra['email_public'] = ( $email_public ) ? '1' : '0';

          $update_sql = '';

          foreach ( $to_update_users as $key => $unused_crap )

          {

            $value =& $to_update_users[$key];

            $value = $db->escape($value);

            $update_sql .= ( empty($update_sql) ? '' : ',' ) . "$key='$value'";

          }

          $update_sql = 'UPDATE '.table_prefix."users SET $update_sql WHERE user_id=$user_id;";

          $update_sql_extra = '';

          foreach ( $to_update_users_extra as $key => $unused_crap )

          {

            $value =& $to_update_users_extra[$key];

            $value = $db->escape($value);

            $update_sql_extra .= ( empty($update_sql_extra) ? '' : ',' ) . "$key='$value'";

          }

          $update_sql_extra = 'UPDATE '.table_prefix."users_extra SET $update_sql_extra WHERE user_id=$user_id;";

          if ( !$db->sql_query($update_sql) )

            $db->_die();

          if ( !$db->sql_query($update_sql_extra) )

            $db->_die();

          if ( $existing_level != $user_level )

          {

            // We need to update group memberships

            if ( $existing_level == USER_LEVEL_ADMIN ) 

            {

              $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES(\'security\',\'u_from_admin\',' . time() . ',"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($username) . '");');

              if ( !$q )

                $db->_die();

              $session->remove_user_from_group($user_id, GROUP_ID_ADMIN);

            }

            else if ( $existing_level == USER_LEVEL_MOD ) 

            {

              $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES(\'security\',\'u_from_mod\',' . time() . ',"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($username) . '");');

              if ( !$q )

                $db->_die();

              $session->remove_user_from_group($user_id, GROUP_ID_MOD);

            }

            if ( $user_level == USER_LEVEL_ADMIN )

            {

              $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES(\'security\',\'u_to_admin\',' . time() . ',"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($username) . '");');

              if ( !$q )

                $db->_die();

              $session->add_user_to_group($user_id, GROUP_ID_ADMIN, false);

            }

            else if ( $user_level == USER_LEVEL_MOD )

            {

              $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES(\'security\',\'u_to_mod\',' . time() . ',"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($username) . '");');

              if ( !$q )

                $db->_die();

              $session->add_user_to_group($user_id, GROUP_ID_MOD, false);

            }

          }

          // user level updated, regenerate the ranks cache

          generate_cache_userranks();

          echo '<div class="info-box">' . $lang->get('acpum_msg_save_success') . '</div>';

        }

      }

    }

    if ( count($errors) > 0 )

    {

      echo '<div class="error-box">

              <b>' . $lang->get('acpum_err_validation_fail') . '</b>

              <ul>

                <li>' . implode("</li>\n        <li>", $errors) . '</li>

              </ul>

            </div>';

      $form = new Admin_UserManager_SmartForm();

      $form->user_id = $user_id;

      $form->username = $username;

      $form->email = $email;

      $form->real_name = $real_name;

      $form->signature = $signature;

      $form->user_level = $user_level;

      $form->user_rank = $user_rank;

      $form->im = array(

          'aim' => $imaddr_aim,

          'yahoo' => $imaddr_yahoo,

          'msn' => $imaddr_msn,

          'xmpp' => $imaddr_xmpp

        );

      $form->contact = array(

          'homepage' => $homepage,

          'location' => $location,

          'job' => $occupation,

          'hobbies' => $hobbies

        );

      $form->email_public = ( isset($_POST['email_public']) );

      $form->account_active = ( isset($_POST['account_active']) );

      // This is SAFE. The smartform calls is_valid_ip() on this value, thus preventing XSS

      // attempts from making it into the form HTML. Badly coded templates may still be

      // affected, but if have_reg_ip is checked for, then you're fine.

      $form->reg_ip_addr = $_POST['user_registration_ip'];

      echo $form->render();

      return false;

    }

    #

    # END VALIDATION

    #

  }

  else if ( isset($_POST['action']['go']) || ( isset($_GET['src']) && $_GET['src'] == 'get' ) )

  {

    if ( isset($_GET['user']) )

    {

      $username =& $_GET['user'];

    }

    else if ( isset($_POST['username']) )

    {

      $username =& $_POST['username'];

    }

    else

    {

      echo 'No username provided';

      return false;

    }

                           LEFT JOIN '.table_prefix.'users_extra AS x

                             ON ( u.user_id = x.user_id OR x.user_id IS NULL )

                           WHERE ( ' . ENANO_SQLFUNC_LOWERCASE . '(u.username) = \'' . $db->escape(strtolower($username)) . '\' OR u.username = \'' . $db->escape($username) . '\' ) AND u.user_id != 1;');

    if ( !$q )

      $db->_die();

    if ( $db->numrows() < 1 )

    {

      echo '<div class="error-box">' . $lang->get('acpum_err_bad_username') . '</div>';

    }

    else

    {

      $row = $db->fetchrow();

      $row['user_id'] = $row['authoritative_uid'];