1 <?php

     2 /*

     3 Plugin Name: Group control panel

     4 Plugin URI: http://www.enanocms.org/

     5 Description: Provides group moderators and site administrators with the ability to control who is part of their groups. 

     6 Author: Dan Fuhry

     7 Version: 1.0RC1

     8 Author URI: http://www.enanocms.org/

     9 */

    10 

    11 /*

    12  * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

    13  * Version 1.0 release candidate 2

    14  * Copyright (C) 2007 Dan Fuhry

    15  *

    16  * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

    17  * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

    18  *

    19  * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

    20  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

    21  */

    22 

    23 $plugins->attachHook('base_classes_initted', '

    24   global $paths;

    25     $paths->add_page(Array(

    26       \'name\'=>\'Group Membership\',

    27       \'urlname\'=>\'Usergroups\',

    28       \'namespace\'=>\'Special\',

    29       \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

    30       ));

    31     ');

    32 

    33 function page_Special_Usergroups()

    34 {

    35   global $db, $session, $paths, $template, $plugins; // Common objects

    36   global $email; // Import e-mail encryption functions

    37   

    38   if ( !$session->user_logged_in )

    39   {

    40     header('Location: ' . makeUrlComplete('Special', 'Login/' . $paths->page));

    41     $db->close();

    42     exit;

    43   }

    44   

    45   $template->header();

    46   if ( isset($_POST['do_view']) || isset($_POST['do_view_n']) || ( isset($_GET['act']) && isset($_POST['group_id']) ) )

    47   {

    48     $gid = ( isset ( $_POST['do_view_n'] ) ) ? intval($_POST['group_id_n']) : intval($_POST['group_id']);

    49     if ( empty($gid) || $gid < 1 )

    50     {

    51       die_friendly('Error', '<p>Hacking attempt</p>');

    52     }

    53     $q = $db->sql_query('SELECT group_name,group_type FROM '.table_prefix.'groups WHERE group_id=' . $gid . ';');

    54     if ( !$q )

    55     {

    56       $db->_die();

    57     }

    58     $row = $db->fetchrow();

    59     $db->free_result();

    60     $members = array();

    61     $pending = array();

    62     $q = $db->sql_query('SELECT u.username,u.email,u.reg_time,m.member_id,m.user_id,m.is_mod,m.pending,COUNT(c.comment_id)

    63                            FROM '.table_prefix.'users AS u

    64                            LEFT JOIN '.table_prefix.'group_members AS m

    65                              ON ( m.user_id = u.user_id )

    66                            LEFT JOIN '.table_prefix.'comments AS c

    67                              ON ( c.name = u.username )

    68                            WHERE m.group_id=' . $gid . '

    69                            GROUP BY u.user_id

    70                            ORDER BY m.is_mod DESC,u.username ASC;');

    71     if ( !$q )

    72     {

    73       $db->_die();

    74     }

    75     

    76     $is_member = false;

    77     $is_mod = false;

    78     $is_pending = false;

    79     

    80     while ( $mr = $db->fetchrow() )

    81     {

    82       if ( $mr['pending'] == 1 )

    83       {

    84         $pending[] = $mr;

    85         if ( $mr['user_id'] == $session->user_id )

    86         {

    87           $is_pending = true;

    88         }

    89       }

    90       else

    91       {

    92         $members[] = $mr;

    93         if ( $mr['user_id'] == $session->user_id )

    94         {

    95           $is_member = true;

    96           if ( $mr['is_mod'] == 1 )

    97           {

    98             $is_mod = true;

    99           }

   100         }

   101       }

   102     }

   103     

   104     $status = ( $is_member && $is_mod )

   105       ? 'You are a moderator of this group.'

   106       : ( ( $is_member && !$is_mod ) 

   107         ? 'You are a member of this group.'

   108         : 'You are not a member of this group.'

   109         );

   110       

   111     $can_do_admin_stuff = ( $is_mod || $session->user_level >= USER_LEVEL_ADMIN );

   112       

   113     switch ( $row['group_type'] )

   114     {

   115       case GROUP_HIDDEN:  $g_state = 'Hidden group';                break;

   116       case GROUP_CLOSED:  $g_state = 'Closed group';                break;

   117       case GROUP_REQUEST: $g_state = 'Members can request to join'; break;

   118       case GROUP_OPEN:    $g_state = 'Anyone can join';             break;

   119     }

   120     

   121     if ( isset($_GET['act']) && $can_do_admin_stuff )

   122     {

   123       switch($_GET['act'])

   124       {

   125         case 'update':

   126           if(!in_array(intval($_POST['group_state']), Array(GROUP_CLOSED, GROUP_OPEN, GROUP_HIDDEN, GROUP_REQUEST)))

   127           {

   128             die_friendly('ERROR', '<p>Hacking attempt</p>');

   129           }

   130           $q = $db->sql_query('UPDATE '.table_prefix.'groups SET group_type=' . intval($_POST['group_state']) . ' WHERE group_id=' . intval( $_POST['group_id']) . ';');

   131           if (!$q)

   132             $db->_die();

   133           $row['group_type'] = $_POST['group_state'];

   134           echo '<div class="info-box" style="margin-left: 0;">The group state was updated.</div>';

   135           break;

   136         case 'adduser':

   137           $username = $_POST['add_username'];

   138           $mod = ( isset($_POST['add_mod']) ) ? '1' : '0';

   139           

   140           $q = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\'' . $db->escape($username) . '\';');

   141           if (!$q)

   142             $db->_die();

   143           if ($db->numrows() < 1)

   144           {

   145             echo '<div class="error-box">The username you entered could not be found.</div>';

   146             break;

   147           }

   148           $r = $db->fetchrow();

   149           $db->free_result();

   150           $uid = intval($r['user_id']);

   151 

   152           // Check if the user is already in the group, and if so, only update modship

   153           $q = $db->sql_query('SELECT member_id,is_mod FROM '.table_prefix.'group_members WHERE user_id=' . $uid . ' AND group_id=' . intval($_POST['group_id']) . ';');

   154           if ( !$q )

   155             $db->_die();

   156           if ( $db->numrows() > 0 )

   157           {

   158             $r = $db->fetchrow();

   159             if ( (string) $r['is_mod'] != $mod )

   160             {

   161               $q = $db->sql_query('UPDATE '.table_prefix.'group_members SET is_mod=' . $mod . ' WHERE member_id=' . $r['member_id'] . ';');

   162               if ( !$q )

   163                 $db->_die();

   164               foreach ( $members as $i => $member )

   165               {

   166                 if ( $member['member_id'] == $r['member_id'] )

   167                   $members[$i]['is_mod'] = (int)$mod;

   168               }

   169               echo '<div class="info-box">The user "' . $username . '" is already in this group, so their moderator status was updated.</div>';

   170             }

   171             else

   172             {

   173               echo '<div class="info-box">The user "' . $username . '" is already in this group.</div>';

   174             }

   175             break;

   176           }

   177           

   178           $db->free_result();

   179           

   180           $q = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,is_mod) VALUES(' . intval($_POST['group_id']) . ', ' . $uid . ', ' . $mod . ');');

   181           if (!$q)

   182             $db->_die();

   183           echo '<div class="info-box">The user "' . $username . '" has been added to this usergroup.</div>';

   184           

   185           $q = $db->sql_query('SELECT u.username,u.email,u.reg_time,m.member_id,m.user_id,m.is_mod,COUNT(c.comment_id)

   186                                  FROM '.table_prefix.'users AS u

   187                                  LEFT JOIN '.table_prefix.'group_members AS m

   188                                    ON ( m.user_id = u.user_id )

   189                                  LEFT JOIN '.table_prefix.'comments AS c

   190                                    ON ( c.name = u.username )

   191                                  WHERE m.group_id=' . $gid . '

   192                                    AND m.pending!=1

   193                                    AND u.user_id=' . $uid . '

   194                                  GROUP BY u.user_id

   195                                  ORDER BY m.is_mod DESC,u.username ASC

   196                                  LIMIT 1;');

   197           if ( !$q )

   198             $db->_die();

   199           

   200           $r = $db->fetchrow();

   201           $members[] = $r;

   202           $db->free_result();

   203           

   204           break;

   205         case 'del_users':

   206           foreach ( $members as $i => $member )

   207           {

   208             if ( isset($_POST['del_user'][$member['member_id']]) )

   209             {

   210               $q = $db->sql_query('DELETE FROM '.table_prefix.'group_members WHERE member_id=' . $member['member_id'] . ';');

   211               if (!$q)

   212                 $db->_die();

   213               unset($members[$i]);

   214             }

   215           }

   216           break;

   217         case 'pending':

   218           foreach ( $pending as $i => $member )

   219           {

   220             if ( isset( $_POST['with_user'][$member['member_id']]) )

   221             {

   222               if ( isset ( $_POST['do_appr_pending'] ) )

   223               {

   224                 $q = $db->sql_query('UPDATE '.table_prefix.'group_members SET pending=0 WHERE member_id=' . $member['member_id'] . ';');

   225                 if (!$q)

   226                   $db->_die();

   227                 $members[] = $member;

   228                 unset($pending[$i]);

   229                 continue;

   230               }

   231               elseif ( isset ( $_POST['do_reject_pending'] ) )

   232               {

   233                 $q = $db->sql_query('DELETE FROM '.table_prefix.'group_members WHERE member_id=' . $member['member_id'] . ';');

   234                 if (!$q)

   235                   $db->_die();

   236                 unset($pending[$i]);

   237               }

   238             }

   239           }

   240           echo '<div class="info-box">Pending members status updated successfully.</div>';

   241           break;

   242       }

   243     }

   244     

   245     if ( isset($_GET['act']) && $_GET['act'] == 'update' && !$is_member && $row['group_type'] == GROUP_OPEN )

   246     {

   247       $q = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id) VALUES(' . $gid . ', ' . $session->user_id . ');');

   248       if (!$q)

   249         $db->_die();

   250       echo '<div class="info-box">You have been added to this group.</div>';

   251       

   252       $q = $db->sql_query('SELECT u.username,u.email,u.reg_time,m.member_id,m.user_id,m.is_mod,COUNT(c.comment_id)

   253                              FROM '.table_prefix.'users AS u

   254                              LEFT JOIN '.table_prefix.'group_members AS m

   255                                ON ( m.user_id = u.user_id )

   256                              LEFT JOIN '.table_prefix.'comments AS c

   257                                ON ( c.name = u.username )

   258                              WHERE m.group_id=' . $gid . '

   259                                AND m.pending!=1

   260                                AND u.user_id=' . $session->user_id . '

   261                              GROUP BY u.user_id

   262                              ORDER BY m.is_mod DESC,u.username ASC

   263                              LIMIT 1;');

   264       if ( !$q )

   265         $db->_die();

   266       

   267       $r = $db->fetchrow();

   268       $members[] = $r;

   269       $db->free_result();

   270       

   271     }

   272     

   273     if ( isset($_GET['act']) && $_GET['act'] == 'update' && !$is_member && $row['group_type'] == GROUP_REQUEST && !$is_pending )

   274     {

   275       $q = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,pending) VALUES(' . $gid . ', ' . $session->user_id . ', 1);');

   276       if (!$q)

   277         $db->_die();

   278       echo '<div class="info-box">A request has been sent to the moderator(s) of this group to add you.</div>';

   279     }

   280     

   281     $state_btns = ( $can_do_admin_stuff ) ?

   282                   '<label><input type="radio" name="group_state" value="' . GROUP_HIDDEN . '" ' . (( $row['group_type'] == GROUP_HIDDEN ) ? 'checked="checked"' : '' ) . ' /> Hidden group</label>

   283                    <label><input type="radio" name="group_state" value="' . GROUP_CLOSED . '" ' . (( $row['group_type'] == GROUP_CLOSED ) ? 'checked="checked"' : '' ) . ' /> Closed group</label>

   284                    <label><input type="radio" name="group_state" value="' . GROUP_REQUEST. '" ' . (( $row['group_type'] == GROUP_REQUEST) ? 'checked="checked"' : '' ) . ' /> Members can request to join</label>

   285                    <label><input type="radio" name="group_state" value="' . GROUP_OPEN   . '" ' . (( $row['group_type'] == GROUP_OPEN   ) ? 'checked="checked"' : '' ) . ' /> Anybody can join</label>'

   286                    : $g_state;

   287     if ( !$can_do_admin_stuff && $row['group_type'] == GROUP_REQUEST && !$is_member )

   288     {

   289       if ( $is_pending )

   290         $state_btns .= ' (Your request to join is awaiting approval)';

   291       else

   292         $state_btns .= ' <input type="submit" value="Request membership" />';

   293     }

   294     

   295     if ( !$can_do_admin_stuff && $row['group_type'] == GROUP_OPEN && !$is_member )

   296     {

   297       $state_btns .= ' <input type="submit" value="Join this group" />';

   298     }

   299     

   300     echo '<form action="' . makeUrl($paths->page, 'act=update') . '" method="post" enctype="multipart/form-data">

   301           <div class="tblholder">

   302             <table border="0" cellspacing="1" cellpadding="4">

   303               <tr>

   304                 <th colspan="2">Group information</th>

   305               </tr>

   306               <tr>

   307                 <td class="row2">Group name:</td>

   308                 <td class="row1">' . $row['group_name'] . '</td>

   309               </tr>

   310               <tr>

   311                 <td class="row2">Membership status:</td>

   312                 <td class="row1">' . $status . '</td>

   313               </tr>

   314               <tr>

   315                 <td class="row2">Group state:</td>

   316                 <td class="row1">' . $state_btns . '</td>

   317               </tr>   

   318               ' . ( ( $is_mod || $session->user_level >= USER_LEVEL_ADMIN ) ? '

   319               <tr>

   320                 <th class="subhead" colspan="2">

   321                   <input type="submit" value="Save changes" />

   322                 </th>

   323               </tr>

   324               ' : '' ) . '

   325             </table>

   326           </div>

   327           <input name="group_id" value="' . $gid . '" type="hidden" />

   328           </form>';

   329     if ( sizeof ( $pending ) > 0 && $can_do_admin_stuff )

   330     {

   331       echo '<form action="' . makeUrl($paths->page, 'act=pending') . '" method="post" enctype="multipart/form-data">

   332             <input name="group_id" value="' . $gid . '" type="hidden" />

   333             <h2>Pending memberships</h2>

   334             <div class="tblholder">

   335             <table border="0" cellspacing="1" cellpadding="4">

   336               <tr>

   337                 <th>Username</th>

   338                 <th>E-mail</th>

   339                 <th>Registered</th>

   340                 <th>Total comments</th>

   341                 <th>Select</th>

   342               </tr>';

   343       $cls = 'row2';

   344       foreach ( $pending as $member )

   345       {

   346         

   347         $date = date('F d, Y', $member['reg_time']);

   348         $cls = ( $cls == 'row2' ) ? 'row1' : 'row2';

   349         $addy = $email->encryptEmail($member['email']);

   350         

   351         echo "<tr>

   352                 <td class='{$cls}'>{$member['username']}</td>

   353                 <td class='{$cls}'>{$addy}</td>

   354                 <td class='{$cls}'>{$date}</td>

   355                 <td class='{$cls}'>{$member['COUNT(c.comment_id)']}</td>

   356                 <td class='{$cls}' style='text-align: center;'><input type='checkbox' name='with_user[{$member['member_id']}]' /></td>

   357               </tr>";

   358       }

   359       echo '</table>

   360             </div>

   361             <div style="margin: 10px 0 0 auto;">

   362               With selected: 

   363               <input type="submit" name="do_appr_pending" value="Approve membership" />

   364               <input type="submit" name="do_reject_pending" value="Reject membership" />

   365             </div>

   366             </form>';

   367     }

   368     echo '<form action="' . makeUrl($paths->page, 'act=del_users') . '" method="post" enctype="multipart/form-data">

   369           <h2>Group members</h2>

   370           <div class="tblholder">

   371             <table border="0" cellspacing="1" cellpadding="4">

   372               <tr>

   373                 <th>Username</th>

   374                 <th>E-mail</th>

   375                 <th>Registered</th>

   376                 <th>Total comments</th>

   377                 ' . ( ( $can_do_admin_stuff ) ? "

   378                 <th>Remove?</th>

   379                 " : '' ) . '

   380               </tr>

   381               <tr>

   382                 <th colspan="5" class="subhead">Group moderators</th>

   383               </tr>';

   384     $mod_printed = false;

   385     $mem_printed = false;

   386     $cls = 'row2';

   387     

   388     foreach ( $members as $member )

   389     {

   390       if ( $member['is_mod'] != 1 )

   391         break;

   392       

   393       $date = date('F d, Y', $member['reg_time']);

   394       $cls = ( $cls == 'row2' ) ? 'row1' : 'row2';

   395       $addy = $email->encryptEmail($member['email']);

   396       

   397       $mod_printed = true;

   398       

   399       echo "<tr>

   400               <td class='{$cls}'>{$member['username']}</td>

   401               <td class='{$cls}'>{$addy}</td>

   402               <td class='{$cls}'>{$date}</td>

   403               <td class='{$cls}'>{$member['COUNT(c.comment_id)']}</td>

   404               " . ( ( $can_do_admin_stuff ) ? "

   405               <td class='{$cls}' style='text-align: center;'><input type='checkbox' name='del_user[{$member['member_id']}]' /></td>

   406               " : '' ) . "

   407             </tr>";

   408     }

   409     if (!$mod_printed)

   410       echo '<tr><td class="' . $cls . '" colspan="5">This group has no moderators.</td></th>';

   411     echo '<tr><th class="subhead" colspan="5">Group members</th></tr>';

   412     foreach ( $members as $member )

   413     {

   414       if ( $member['is_mod'] == 1 )

   415         continue;

   416       

   417       $date = date('F d, Y', $member['reg_time']);

   418       $cls = ( $cls == 'row2' ) ? 'row1' : 'row2';

   419       $addy = $email->encryptEmail($member['email']);

   420       

   421       $mem_printed = true;

   422       

   423       echo "<tr>

   424               <td class='{$cls}'>{$member['username']}</td>

   425               <td class='{$cls}'>{$addy}</td>

   426               <td class='{$cls}'>{$date}</td>

   427               <td class='{$cls}'>{$member['COUNT(c.comment_id)']}</td>

   428               " . ( ( $can_do_admin_stuff ) ? "

   429               <td class='{$cls}' style='text-align: center;'><input type='checkbox' name='del_user[{$member['member_id']}]' /></td>

   430               " : '' ) . "

   431             </tr>";

   432     }

   433     if (!$mem_printed)

   434       echo '<tr><td class="' . $cls . '" colspan="5">This group has no members.</td></th>';

   435     echo '  </table>

   436           </div>';

   437     if ( $can_do_admin_stuff )

   438     {

   439       echo "<div style='margin: 10px 0 0 auto;'><input type='submit' name='do_del_user' value='Remove selected users' /></div>";

   440     }

   441     echo '<input name="group_id" value="' . $gid . '" type="hidden" />

   442           </form>';

   443     if ( $can_do_admin_stuff )

   444     {

   445       echo '<form action="' . makeUrl($paths->page, 'act=adduser') . '" method="post" enctype="multipart/form-data" onsubmit="if(!submitAuthorized) return false;">

   446               <div class="tblholder">

   447                 <table border="0" cellspacing="1" cellpadding="4">

   448                   <tr>

   449                     <th colspan="2">Add a new member to this group</th>

   450                   </tr>

   451                   <tr>

   452                     <td class="row2">Username:</td><td class="row1">' . $template->username_field('add_username') . '</td>

   453                   </tr>

   454                   <tr>

   455                     <td class="row2">Group moderator:</td><td class="row1"><label><input type="checkbox" name="add_mod" /> User is a group moderator</label></td>

   456                   </tr>

   457                   <tr>

   458                     <th class="subhead" colspan="2">

   459                       <input type="submit" value="Add member" />

   460                     </th>

   461                   </tr>

   462                 </table>

   463               </div>

   464               <input name="group_id" value="' . $gid . '" type="hidden" />

   465             </form>';

   466     }

   467   }

   468   else

   469   {

   470     echo '<form action="'.makeUrlNS('Special', 'Usergroups').'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';

   471     echo '<div class="tblholder">

   472           <table border="0" style="width: 100%;" cellspacing="1" cellpadding="4">

   473             <tr>

   474               <th colspan="2">Group membership details</th>

   475             </tr>

   476             <tr>

   477               <td class="row2" style="text-align: right;">

   478                 Current group memberships:

   479               </td>

   480               <td class="row1">';

   481     $taboo = Array('Everyone');

   482     if ( sizeof ( $session->groups ) > 0 )

   483     {

   484       echo '<select name="group_id">';

   485       foreach ( $session->groups as $id => $group )

   486       {

   487         $taboo[] = $group;

   488         if ( $group != 'Everyone' )

   489         {

   490           echo '<option value="' . $id . '">' . $group . '</option>';

   491         }

   492       }

   493       echo '</select>

   494             <input type="submit" name="do_view" value="View information" />';

   495     }

   496     else

   497     {

   498       echo 'None';

   499     }

   500     

   501     echo '</td>

   502         </tr>';

   503     $taboo = 'WHERE group_name != \'' . implode('\' AND group_name != \'', $taboo) . '\'';

   504     $q = $db->sql_query('SELECT group_id,group_name FROM '.table_prefix.'groups '.$taboo.' AND group_type != ' . GROUP_HIDDEN . ' ORDER BY group_name ASC;');

   505     if(!$q)

   506     {

   507       echo $db->get_error();

   508       $template->footer();

   509       return;

   510     }

   511     if($db->numrows() > 0)

   512     {

   513       echo '<tr>

   514               <td class="row2" style="text-align: right;">

   515                 Non-memberships:

   516               </td>

   517               <td class="row1">

   518               <select name="group_id_n">';

   519       while ( $row = $db->fetchrow() )

   520       {

   521         if ( $row['group_name'] != 'Everyone' )

   522         {

   523           echo '<option value="' . $row['group_id'] . '">' . $row['group_name'] . '</option>';

   524         }

   525       }

   526       echo '</select>

   527             <input type="submit" name="do_view_n" value="View information" />

   528           </td>

   529         </tr>

   530       ';

   531     }

   532     $db->free_result();

   533     echo '</table>

   534         </div>

   535         </form>';

   536   }

   537   $template->footer();

   538 }

   539 

   540 ?>