includes/pageutils.php
changeset 228 b0a4d179be85
parent 227 0eca1498a77b
child 238 a78537db2850
equal deleted inserted replaced
197:90b7a52bea45 228:b0a4d179be85
     1 <?php
     1 <?php
       
     2 
     2 /*
     3 /*
     3  * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
     4  * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
     4  * Version 1.0.2 (Coblynau)
     5  * Version 1.1.1
     5  * Copyright (C) 2006-2007 Dan Fuhry
     6  * Copyright (C) 2006-2007 Dan Fuhry
     6  * pageutils.php - a class that handles raw page manipulations, used mostly by AJAX requests or their old-fashioned form-based counterparts
     7  * pageutils.php - a class that handles raw page manipulations, used mostly by AJAX requests or their old-fashioned form-based counterparts
     7  *
     8  *
     8  * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
     9  * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
     9  * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
    10  * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
   518    */
   519    */
   519   
   520   
   520   function histlist($page_id, $namespace)
   521   function histlist($page_id, $namespace)
   521   {
   522   {
   522     global $db, $session, $paths, $template, $plugins; // Common objects
   523     global $db, $session, $paths, $template, $plugins; // Common objects
       
   524     global $lang;
   523     
   525     
   524     if(!$session->get_permissions('history_view'))
   526     if(!$session->get_permissions('history_view'))
   525       return 'Access denied';
   527       return 'Access denied';
   526     
   528     
   527     ob_start();
   529     ob_start();
   530     $wiki = ( ( $paths->pages[$pname]['wiki_mode'] == 2 && getConfig('wiki_mode') == '1') || $paths->pages[$pname]['wiki_mode'] == 1) ? true : false;
   532     $wiki = ( ( $paths->pages[$pname]['wiki_mode'] == 2 && getConfig('wiki_mode') == '1') || $paths->pages[$pname]['wiki_mode'] == 1) ? true : false;
   531     $prot = ( ( $paths->pages[$pname]['protected'] == 2 && $session->user_logged_in && $session->reg_time + 60*60*24*4 < time() ) || $paths->pages[$pname]['protected'] == 1) ? true : false;
   533     $prot = ( ( $paths->pages[$pname]['protected'] == 2 && $session->user_logged_in && $session->reg_time + 60*60*24*4 < time() ) || $paths->pages[$pname]['protected'] == 1) ? true : false;
   532     
   534     
   533     $q = 'SELECT time_id,date_string,page_id,namespace,author,edit_summary,minor_edit FROM ' . table_prefix.'logs WHERE log_type=\'page\' AND action=\'edit\' AND page_id=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\' ORDER BY time_id DESC;';
   535     $q = 'SELECT time_id,date_string,page_id,namespace,author,edit_summary,minor_edit FROM ' . table_prefix.'logs WHERE log_type=\'page\' AND action=\'edit\' AND page_id=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\' ORDER BY time_id DESC;';
   534     if(!$db->sql_query($q)) $db->_die('The history data for the page "' . $paths->cpage['name'] . '" could not be selected.');
   536     if(!$db->sql_query($q)) $db->_die('The history data for the page "' . $paths->cpage['name'] . '" could not be selected.');
   535     echo 'History of edits and actions<h3>Edits:</h3>';
   537     echo $lang->get('history_page_subtitle') . '
       
   538           <h3>' . $lang->get('history_heading_edits') . '</h3>';
   536     $numrows = $db->numrows();
   539     $numrows = $db->numrows();
   537     if($numrows < 1) echo 'No history entries in this category.';
   540     if ( $numrows < 1 )
       
   541     {
       
   542       echo $lang->get('history_no_entries');
       
   543     }
   538     else
   544     else
   539     {
   545     {
   540       
       
   541       echo '<form action="'.makeUrlNS($namespace, $page_id, 'do=diff').'" onsubmit="ajaxHistDiff(); return false;" method="get">
   546       echo '<form action="'.makeUrlNS($namespace, $page_id, 'do=diff').'" onsubmit="ajaxHistDiff(); return false;" method="get">
   542             <input type="submit" value="Compare selected revisions" />
   547             <input type="submit" value="' . $lang->get('history_btn_compare') . '" />
   543             ' . ( urlSeparator == '&' ? '<input type="hidden" name="title" value="' . htmlspecialchars($paths->nslist[$namespace] . $page_id) . '" />' : '' ) . '
   548             ' . ( urlSeparator == '&' ? '<input type="hidden" name="title" value="' . htmlspecialchars($paths->nslist[$namespace] . $page_id) . '" />' : '' ) . '
   544             ' . ( $session->sid_super ? '<input type="hidden" name="auth"  value="' . $session->sid_super . '" />' : '') . '
   549             ' . ( $session->sid_super ? '<input type="hidden" name="auth"  value="' . $session->sid_super . '" />' : '') . '
   545             <input type="hidden" name="do" value="diff" />
   550             <input type="hidden" name="do" value="diff" />
   546             <br /><span>&nbsp;</span>
   551             <br /><span>&nbsp;</span>
   547             <div class="tblholder">
   552             <div class="tblholder">
   548             <table border="0" width="100%" cellspacing="1" cellpadding="4">
   553             <table border="0" width="100%" cellspacing="1" cellpadding="4">
   549             <tr>
   554             <tr>
   550               <th colspan="2">Diff</th>
   555               <th colspan="2">' . $lang->get('history_col_diff') . '</th>
   551               <th>Date/time</th>
   556               <th>' . $lang->get('history_col_datetime') . '</th>
   552               <th>User</th>
   557               <th>' . $lang->get('history_col_user') . '</th>
   553               <th>Edit summary</th>
   558               <th>' . $lang->get('history_col_summary') . '</th>
   554               <th>Minor</th>
   559               <th>' . $lang->get('history_col_minor') . '</th>
   555               <th colspan="3">Actions</th>
   560               <th colspan="3">' . $lang->get('history_col_actions') . '</th>
   556             </tr>'."\n"."\n";
   561             </tr>'."\n"."\n";
   557       $cls = 'row2';
   562       $cls = 'row2';
   558       $ticker = 0;
   563       $ticker = 0;
   559       
   564       
   560       while($r = $db->fetchrow()) {
   565       while ( $r = $db->fetchrow() )
       
   566       {
   561         
   567         
   562         $ticker++;
   568         $ticker++;
   563         
   569         
   564         if($cls == 'row2') $cls = 'row1';
   570         if($cls == 'row2') $cls = 'row1';
   565         else $cls = 'row2';
   571         else $cls = 'row2';
   589         echo '<td class="' . $cls . '">' . $r['date_string'] . '</td class="' . $cls . '">'."\n";
   595         echo '<td class="' . $cls . '">' . $r['date_string'] . '</td class="' . $cls . '">'."\n";
   590         
   596         
   591         // User
   597         // User
   592         if ( $session->get_permissions('mod_misc') && is_valid_ip($r['author']) )
   598         if ( $session->get_permissions('mod_misc') && is_valid_ip($r['author']) )
   593         {
   599         {
   594           $rc = ' style="cursor: pointer;" title="Click cell background for reverse DNS info" onclick="ajaxReverseDNS(this, \'' . $r['author'] . '\');"';
   600           $rc = ' style="cursor: pointer;" title="' . $lang->get('history_tip_rdns') . '" onclick="ajaxReverseDNS(this, \'' . $r['author'] . '\');"';
   595         }
   601         }
   596         else
   602         else
   597         {
   603         {
   598           $rc = '';
   604           $rc = '';
   599         }
   605         }
   603           echo 'class="wikilink-nonexistent"';
   609           echo 'class="wikilink-nonexistent"';
   604         }
   610         }
   605         echo '>' . $r['author'] . '</a></td class="' . $cls . '">'."\n";
   611         echo '>' . $r['author'] . '</a></td class="' . $cls . '">'."\n";
   606         
   612         
   607         // Edit summary
   613         // Edit summary
       
   614         if ( $r['edit_summary'] == 'Automatic backup created when logs were purged' )
       
   615         {
       
   616           $r['edit_summary'] = $lang->get('history_summary_clearlogs');
       
   617         }
   608         echo '<td class="' . $cls . '">' . $r['edit_summary'] . '</td>'."\n";
   618         echo '<td class="' . $cls . '">' . $r['edit_summary'] . '</td>'."\n";
   609         
   619         
   610         // Minor edit
   620         // Minor edit
   611         echo '<td class="' . $cls . '" style="text-align: center;">'. (( $r['minor_edit'] ) ? 'M' : '' ) .'</td>'."\n";
   621         echo '<td class="' . $cls . '" style="text-align: center;">'. (( $r['minor_edit'] ) ? 'M' : '' ) .'</td>'."\n";
   612         
   622         
   613         // Actions!
   623         // Actions!
   614         echo '<td class="' . $cls . '" style="text-align: center;"><a href="'.makeUrlNS($namespace, $page_id, 'oldid=' . $r['time_id']) . '" onclick="ajaxHistView(\'' . $r['time_id'] . '\'); return false;">View revision</a></td>'."\n";
   624         echo '<td class="' . $cls . '" style="text-align: center;"><a href="'.makeUrlNS($namespace, $page_id, 'oldid=' . $r['time_id']) . '" onclick="ajaxHistView(\'' . $r['time_id'] . '\'); return false;">' . $lang->get('history_action_view') . '</a></td>'."\n";
   615         echo '<td class="' . $cls . '" style="text-align: center;"><a href="'.makeUrl($paths->nslist['Special'].'Contributions/' . $r['author']) . '">View user contribs</a></td>'."\n";
   625         echo '<td class="' . $cls . '" style="text-align: center;"><a href="'.makeUrl($paths->nslist['Special'].'Contributions/' . $r['author']) . '">' . $lang->get('history_action_contrib') . '</a></td>'."\n";
   616         echo '<td class="' . $cls . '" style="text-align: center;"><a href="'.makeUrlNS($namespace, $page_id, 'do=rollback&amp;id=' . $r['time_id']) . '" onclick="ajaxRollback(\'' . $r['time_id'] . '\'); return false;">Revert to this revision</a></td>'."\n";
   626         echo '<td class="' . $cls . '" style="text-align: center;"><a href="'.makeUrlNS($namespace, $page_id, 'do=rollback&amp;id=' . $r['time_id']) . '" onclick="ajaxRollback(\'' . $r['time_id'] . '\'); return false;">' . $lang->get('history_action_restore') . '</a></td>'."\n";
   617         
   627         
   618         echo '</tr>'."\n"."\n";
   628         echo '</tr>'."\n"."\n";
   619         
   629         
   620       }
   630       }
   621       echo '</table>
   631       echo '</table>
   622             </div>
   632             </div>
   623             <br />
   633             <br />
   624             <input type="hidden" name="do" value="diff" />
   634             <input type="hidden" name="do" value="diff" />
   625             <input type="submit" value="Compare selected revisions" />
   635             <input type="submit" value="' . $lang->get('history_btn_compare') . '" />
   626             </form>
   636             </form>
   627             <script type="text/javascript">if ( !KILL_SWITCH ) { buildDiffList(); }</script>';
   637             <script type="text/javascript">if ( !KILL_SWITCH ) { buildDiffList(); }</script>';
   628     }
   638     }
   629     $db->free_result();
   639     $db->free_result();
   630     echo '<h3>Other changes:</h3>';
   640     echo '<h3>' . $lang->get('history_heading_other') . '</h3>';
   631     $q = 'SELECT time_id,action,date_string,page_id,namespace,author,edit_summary,minor_edit FROM ' . table_prefix.'logs WHERE log_type=\'page\' AND action!=\'edit\' AND page_id=\'' . $paths->cpage['urlname_nons'] . '\' AND namespace=\'' . $paths->namespace . '\' ORDER BY time_id DESC;';
   641     $q = 'SELECT time_id,action,date_string,page_id,namespace,author,edit_summary,minor_edit FROM ' . table_prefix.'logs WHERE log_type=\'page\' AND action!=\'edit\' AND page_id=\'' . $paths->cpage['urlname_nons'] . '\' AND namespace=\'' . $paths->namespace . '\' ORDER BY time_id DESC;';
   632     if(!$db->sql_query($q)) $db->_die('The history data for the page "' . $paths->cpage['name'] . '" could not be selected.');
   642     if ( !$db->sql_query($q) )
   633     if($db->numrows() < 1) echo 'No history entries in this category.';
   643     {
   634     else {
   644       $db->_die('The history data for the page "' . htmlspecialchars($paths->cpage['name']) . '" could not be selected.');
       
   645     }
       
   646     if ( $db->numrows() < 1 )
       
   647     {
       
   648       echo $lang->get('history_no_entries');
       
   649     }
       
   650     else
       
   651     {
   635       
   652       
   636       echo '<div class="tblholder"><table border="0" width="100%" cellspacing="1" cellpadding="4"><tr><th>Date/time</th><th>User</th><th>Minor</th><th>Action taken</th><th>Extra info</th><th colspan="2"></th></tr>';
   653       echo '<div class="tblholder">
       
   654               <table border="0" width="100%" cellspacing="1" cellpadding="4"><tr>
       
   655                 <th>' . $lang->get('history_col_datetime') . '</th>
       
   656                 <th>' . $lang->get('history_col_user') . '</th>
       
   657                 <th>' . $lang->get('history_col_minor') . '</th>
       
   658                 <th>' . $lang->get('history_col_action_taken') . '</th>
       
   659                 <th>' . $lang->get('history_col_extra') . '</th>
       
   660                 <th colspan="2"></th>
       
   661               </tr>';
   637       $cls = 'row2';
   662       $cls = 'row2';
   638       while($r = $db->fetchrow()) {
   663       while($r = $db->fetchrow()) {
   639         
   664         
   640         if($cls == 'row2') $cls = 'row1';
   665         if($cls == 'row2') $cls = 'row1';
   641         else $cls = 'row2';
   666         else $cls = 'row2';
   655         echo '<td class="' . $cls . '" style="text-align: center;">'. (( $r['minor_edit'] ) ? 'M' : '' ) .'</td>';
   680         echo '<td class="' . $cls . '" style="text-align: center;">'. (( $r['minor_edit'] ) ? 'M' : '' ) .'</td>';
   656         
   681         
   657         // Action taken
   682         // Action taken
   658         echo '<td class="' . $cls . '">';
   683         echo '<td class="' . $cls . '">';
   659         // Some of these are sanitized at insert-time. Others follow the newer Enano policy of stripping HTML at runtime.
   684         // Some of these are sanitized at insert-time. Others follow the newer Enano policy of stripping HTML at runtime.
   660         if    ($r['action']=='prot')     echo 'Protected page</td><td class="' . $cls . '">Reason: ' . $r['edit_summary'];
   685         if    ($r['action']=='prot')     echo $lang->get('history_log_protect') . '</td><td class="' . $cls . '">' . $lang->get('history_extra_reason') . ' ' . $r['edit_summary'];
   661         elseif($r['action']=='unprot')   echo 'Unprotected page</td><td class="' . $cls . '">Reason: ' . $r['edit_summary'];
   686         elseif($r['action']=='unprot')   echo $lang->get('history_log_unprotect') . '</td><td class="' . $cls . '">' . $lang->get('history_extra_reason') . ' ' . $r['edit_summary'];
   662         elseif($r['action']=='semiprot') echo 'Semi-protected page</td><td class="' . $cls . '">Reason: ' . $r['edit_summary'];
   687         elseif($r['action']=='semiprot') echo $lang->get('history_log_semiprotect') . '</td><td class="' . $cls . '">' . $lang->get('history_extra_reason') . ' ' . $r['edit_summary'];
   663         elseif($r['action']=='rename')   echo 'Renamed page</td><td class="' . $cls . '">Old title: '.htmlspecialchars($r['edit_summary']);
   688         elseif($r['action']=='rename')   echo $lang->get('history_log_rename') . '</td><td class="' . $cls . '">' . $lang->get('history_extra_oldtitle') . ' '.htmlspecialchars($r['edit_summary']);
   664         elseif($r['action']=='create')   echo 'Created page</td><td class="' . $cls . '">';
   689         elseif($r['action']=='create')   echo $lang->get('history_log_create') . '</td><td class="' . $cls . '">';
   665         elseif($r['action']=='delete')   echo 'Deleted page</td><td class="' . $cls . '">Reason: ' . $r['edit_summary'];
   690         elseif($r['action']=='delete')   echo $lang->get('history_log_delete') . '</td><td class="' . $cls . '">' . $lang->get('history_extra_reason') . ' ' . $r['edit_summary'];
   666         elseif($r['action']=='reupload') echo 'Uploaded new file version</td><td class="' . $cls . '">Reason: '.htmlspecialchars($r['edit_summary']);
   691         elseif($r['action']=='reupload') echo $lang->get('history_log_uploadnew') . '</td><td class="' . $cls . '">' . $lang->get('history_extra_reason') . ' '.htmlspecialchars($r['edit_summary']);
   667         echo '</td>';
   692         echo '</td>';
   668         
   693         
   669         // Actions!
   694         // Actions!
   670         echo '<td class="' . $cls . '" style="text-align: center;"><a href="'.makeUrl($paths->nslist['Special'].'Contributions/' . $r['author']) . '">View user contribs</a></td>';
   695         echo '<td class="' . $cls . '" style="text-align: center;"><a href="'.makeUrl($paths->nslist['Special'].'Contributions/' . $r['author']) . '">' . $lang->get('history_action_contrib') . '</a></td>';
   671         echo '<td class="' . $cls . '" style="text-align: center;"><a href="'.makeUrlNS($namespace, $page_id, 'do=rollback&amp;id=' . $r['time_id']) . '" onclick="ajaxRollback(\'' . $r['time_id'] . '\'); return false;">Revert action</a></td>';
   696         echo '<td class="' . $cls . '" style="text-align: center;"><a href="'.makeUrlNS($namespace, $page_id, 'do=rollback&amp;id=' . $r['time_id']) . '" onclick="ajaxRollback(\'' . $r['time_id'] . '\'); return false;">' . $lang->get('history_action_revert') . '</a></td>';
   672         
       
   673         //echo '(<a href="#" onclick="ajaxRollback(\'' . $r['time_id'] . '\'); return false;">rollback</a>) <i>' . $r['date_string'] . '</i> ' . $r['author'] . ' (<a href="'.makeUrl($paths->nslist['User'].$r['author']).'">Userpage</a>, <a href="'.makeUrl($paths->nslist['Special'].'Contributions/' . $r['author']) . '">Contrib</a>): ';
       
   674         
       
   675         if($r['minor_edit']) echo '<b> - minor edit</b>';
       
   676         echo '<br />';
       
   677         
   697         
   678         echo '</tr>';
   698         echo '</tr>';
   679       }
   699       }
   680       echo '</table></div>';
   700       echo '</table></div>';
   681     }
   701     }
   894    */
   914    */
   895    
   915    
   896   function comments_raw($page_id, $namespace, $action = false, $flags = Array(), $_ob = '')
   916   function comments_raw($page_id, $namespace, $action = false, $flags = Array(), $_ob = '')
   897   {
   917   {
   898     global $db, $session, $paths, $template, $plugins; // Common objects
   918     global $db, $session, $paths, $template, $plugins; // Common objects
       
   919     global $lang;
   899     
   920     
   900     $pname = $paths->nslist[$namespace] . $page_id;
   921     $pname = $paths->nslist[$namespace] . $page_id;
   901     
   922     
   902     ob_start();
   923     ob_start();
   903     
   924     
   934         $db->free_result();
   955         $db->free_result();
   935         $a = ( $r['approved'] ) ? '0' : '1';
   956         $a = ( $r['approved'] ) ? '0' : '1';
   936         $q = 'UPDATE ' . table_prefix.'comments SET approved=' . $a . ' WHERE page_id=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\' AND ' . $where . ';';
   957         $q = 'UPDATE ' . table_prefix.'comments SET approved=' . $a . ' WHERE page_id=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\' AND ' . $where . ';';
   937         $e=$db->sql_query($q);
   958         $e=$db->sql_query($q);
   938         if(!$e) die('alert(unesape(\''.rawurlencode('Error during query: '.mysql_error().'\n\nQuery:\n' . $q) . '\'));');
   959         if(!$e) die('alert(unesape(\''.rawurlencode('Error during query: '.mysql_error().'\n\nQuery:\n' . $q) . '\'));');
   939         if($a=='1') $v = 'Unapprove';
   960         if($a=='1') $v = $lang->get('comment_btn_mod_unapprove');
   940         else $v = 'Approve';
   961         else $v = $lang->get('comment_btn_mod_approve');
   941         echo 'document.getElementById("mdgApproveLink'.intval($_GET['id']).'").innerHTML="' . $v . '";';
   962         echo 'document.getElementById("mdgApproveLink'.intval($_GET['id']).'").innerHTML="' . $v . '";';
   942         break;
   963         break;
   943       }
   964       }
   944     }
   965     }
   945     
   966     
   963                   LEFT JOIN ' . table_prefix.'users AS u
   984                   LEFT JOIN ' . table_prefix.'users AS u
   964                     ON c.user_id=u.user_id
   985                     ON c.user_id=u.user_id
   965                   WHERE page_id=\'' . $page_id . '\'
   986                   WHERE page_id=\'' . $page_id . '\'
   966                   AND namespace=\'' . $namespace . '\' ORDER BY c.time ASC;');
   987                   AND namespace=\'' . $namespace . '\' ORDER BY c.time ASC;');
   967     if(!$lq) _die('The comment text data could not be selected. '.mysql_error());
   988     if(!$lq) _die('The comment text data could not be selected. '.mysql_error());
   968     $_ob .= '<h3>Article Comments</h3>';
   989     $_ob .= '<h3>' . $lang->get('comment_heading') . '</h3>';
       
   990     
   969     $n = ( $session->get_permissions('mod_comments')) ? $db->numrows() : $num_app;
   991     $n = ( $session->get_permissions('mod_comments')) ? $db->numrows() : $num_app;
   970     if($n==1) $s = 'is ' . $n . ' comment'; else $s = 'are ' . $n . ' comments';
   992     
   971     if($n < 1)
   993     $subst = array(
   972     {
   994         'num_comments' => $n,
   973       $_ob .= '<p>There are currently no comments on this '.strtolower($namespace).'';
   995         'page_type' => $template->namespace_string
   974       if($namespace != 'Article') $_ob .= ' page';
   996       );
   975       $_ob .= '.</p>';
   997     
   976     } else $_ob .= '<p>There ' . $s . ' on this article.';
   998     $_ob .= '<p>';
   977     if($session->get_permissions('mod_comments') && $num_unapp > 0) $_ob .= ' <span style="color: #D84308">' . $num_unapp . ' of those are unapproved.</span>';
   999     $_ob .= ( $n == 0 ) ? $lang->get('comment_msg_count_zero', $subst) : ( $n == 1 ? $lang->get('comment_msg_count_one', $subst) : $lang->get('comment_msg_count_plural', $subst) );
   978     elseif(!$session->get_permissions('mod_comments') && $num_unapp > 0) { $u = ($num_unapp == 1) ? "is $num_unapp comment" : "are $num_unapp comments"; $_ob .= ' However, there ' . $u . ' awating approval.'; }
  1000     
       
  1001     if ( $session->get_permissions('mod_comments') && $num_unapp > 0 )
       
  1002     {
       
  1003       $_ob .= ' <span style="color: #D84308">' . $lang->get('comment_msg_count_unapp_mod', array( 'num_unapp' => $num_unapp )) . '</span>';
       
  1004     }
       
  1005     else if ( !$session->get_permissions('mod_comments') && $num_unapp > 0 )
       
  1006     {
       
  1007       $ls = ( $num_unapp == 1 ) ? 'comment_msg_count_unapp_one' : 'comment_msg_count_unapp_plural';
       
  1008       $_ob .= ' <span>' . $lang->get($ls, array( 'num_unapp' => $num_unapp )) . '</span>';
       
  1009     }
   979     $_ob .= '</p>';
  1010     $_ob .= '</p>';
   980     $list = 'list = { ';
  1011     $list = 'list = { ';
   981     // _die(htmlspecialchars($ttext));
  1012     // _die(htmlspecialchars($ttext));
   982     $i = -1;
  1013     $i = -1;
   983     while($row = $db->fetchrow($lq))
  1014     while ( $row = $db->fetchrow($lq) )
   984     {
  1015     {
   985       $i++;
  1016       $i++;
   986       $strings = Array();
  1017       $strings = Array();
   987       $bool = Array();
  1018       $bool = Array();
   988       if ( $session->get_permissions('mod_comments') || $row['approved'] )
  1019       if ( $session->get_permissions('mod_comments') || $row['approved'] )
   992         // Comment ID (used in the Javascript apps)
  1023         // Comment ID (used in the Javascript apps)
   993         $strings['ID'] = (string)$i;
  1024         $strings['ID'] = (string)$i;
   994         
  1025         
   995         // Determine the name, and whether to link to the user page or not
  1026         // Determine the name, and whether to link to the user page or not
   996         $name = '';
  1027         $name = '';
   997         if($row['user_id'] > 0) $name .= '<a href="'.makeUrlNS('User', str_replace(' ', '_', $row['name'])).'">';
  1028         if($row['user_id'] > 1) $name .= '<a href="'.makeUrlNS('User', str_replace(' ', '_', $row['name'])).'">';
   998         $name .= $row['name'];
  1029         $name .= $row['name'];
   999         if($row['user_id'] > 0) $name .= '</a>';
  1030         if($row['user_id'] > 1) $name .= '</a>';
  1000         $strings['NAME'] = $name; unset($name);
  1031         $strings['NAME'] = $name; unset($name);
  1001         
  1032         
  1002         // Subject
  1033         // Subject
  1003         $s = $row['subject'];
  1034         $s = $row['subject'];
  1004         if(!$row['approved']) $s .= ' <span style="color: #D84308">(Unapproved)</span>';
  1035         if(!$row['approved']) $s .= ' <span style="color: #D84308">' . $lang->get('comment_msg_note_unapp') . '</span>';
  1005         $strings['SUBJECT'] = $s;
  1036         $strings['SUBJECT'] = $s;
  1006         
  1037         
  1007         // Date and time
  1038         // Date and time
  1008         $strings['DATETIME'] = date('F d, Y h:i a', $row['time']);
  1039         $strings['DATETIME'] = date('F d, Y h:i a', $row['time']);
  1009         
  1040         
  1010         // User level
  1041         // User level
  1011         switch($row['user_level'])
  1042         switch($row['user_level'])
  1012         {
  1043         {
  1013           default:
  1044           default:
  1014           case USER_LEVEL_GUEST:
  1045           case USER_LEVEL_GUEST:
  1015             $l = 'Guest';
  1046             $l = $lang->get('user_type_guest');
  1016             break;
  1047             break;
  1017           case USER_LEVEL_MEMBER:
  1048           case USER_LEVEL_MEMBER:
  1018             $l = 'Member';
  1049           case USER_LEVEL_CHPREF:
       
  1050             $l = $lang->get('user_type_member');
  1019             break;
  1051             break;
  1020           case USER_LEVEL_MOD:
  1052           case USER_LEVEL_MOD:
  1021             $l = 'Moderator';
  1053             $l = $lang->get('user_type_mod');
  1022             break;
  1054             break;
  1023           case USER_LEVEL_ADMIN:
  1055           case USER_LEVEL_ADMIN:
  1024             $l = 'Administrator';
  1056             $l = $lang->get('user_type_admin');
  1025             break;
  1057             break;
  1026         }
  1058         }
  1027         $strings['USER_LEVEL'] = $l; unset($l);
  1059         $strings['USER_LEVEL'] = $l; unset($l);
  1028         
  1060         
  1029         // The actual comment data
  1061         // The actual comment data
  1030         $strings['DATA'] = RenderMan::render($row['comment_data']);
  1062         $strings['DATA'] = RenderMan::render($row['comment_data']);
  1031         
  1063         
  1032         if($session->get_permissions('edit_comments'))
  1064         if($session->get_permissions('edit_comments'))
  1033         {
  1065         {
  1034           // Edit link
  1066           // Edit link
  1035           $strings['EDIT_LINK'] = '<a href="'.makeUrlNS($namespace, $page_id, 'do=comments&amp;sub=editcomment&amp;id=' . $row['comment_id']) . '" id="editbtn_' . $i . '">edit</a>';
  1067           $strings['EDIT_LINK'] = '<a href="'.makeUrlNS($namespace, $page_id, 'do=comments&amp;sub=editcomment&amp;id=' . $row['comment_id']) . '" id="editbtn_' . $i . '">' . $lang->get('comment_btn_edit') . '</a>';
  1036         
  1068         
  1037           // Delete link
  1069           // Delete link
  1038           $strings['DELETE_LINK'] = '<a href="'.makeUrlNS($namespace, $page_id, 'do=comments&amp;sub=deletecomment&amp;id=' . $row['comment_id']) . '">delete</a>';
  1070           $strings['DELETE_LINK'] = '<a href="'.makeUrlNS($namespace, $page_id, 'do=comments&amp;sub=deletecomment&amp;id=' . $row['comment_id']) . '">' . $lang->get('comment_btn_delete') . '</a>';
  1039         }
  1071         }
  1040         else
  1072         else
  1041         {
  1073         {
  1042           // Edit link
  1074           // Edit link
  1043           $strings['EDIT_LINK'] = '';
  1075           $strings['EDIT_LINK'] = '';
  1045           // Delete link
  1077           // Delete link
  1046           $strings['DELETE_LINK'] = '';
  1078           $strings['DELETE_LINK'] = '';
  1047         }
  1079         }
  1048         
  1080         
  1049         // Send PM link
  1081         // Send PM link
  1050         $strings['SEND_PM_LINK'] = ( $session->user_logged_in && $row['user_id'] > 0 ) ? '<a href="'.makeUrlNS('Special', 'PrivateMessages/Compose/To/' . $row['name']) . '">Send private message</a><br />' : '';
  1082         $strings['SEND_PM_LINK'] = ( $session->user_logged_in && $row['user_id'] > 1 ) ? '<a href="'.makeUrlNS('Special', 'PrivateMessages/Compose/To/' . $row['name']) . '">' . $lang->get('comment_btn_send_privmsg') . '</a><br />' : '';
  1051         
  1083         
  1052         // Add Buddy link
  1084         // Add Buddy link
  1053         $strings['ADD_BUDDY_LINK'] = ( $session->user_logged_in && $row['user_id'] > 0 ) ? '<a href="'.makeUrlNS('Special', 'PrivateMessages/FriendList/Add/' . $row['name']) . '">Add to buddy list</a>' : '';
  1085         $strings['ADD_BUDDY_LINK'] = ( $session->user_logged_in && $row['user_id'] > 1 ) ? '<a href="'.makeUrlNS('Special', 'PrivateMessages/FriendList/Add/' . $row['name']) . '">' . $lang->get('comment_btn_add_buddy') . '</a>' : '';
  1054         
  1086         
  1055         // Mod links
  1087         // Mod links
  1056         $applink = '';
  1088         $applink = '';
  1057         $applink .= '<a href="'.makeUrlNS($namespace, $page_id, 'do=comments&amp;sub=admin&amp;action=approve&amp;id=' . $row['comment_id']) . '" id="mdgApproveLink' . $i . '">';
  1089         $applink .= '<a href="'.makeUrlNS($namespace, $page_id, 'do=comments&amp;sub=admin&amp;action=approve&amp;id=' . $row['comment_id']) . '" id="mdgApproveLink' . $i . '">';
  1058         if($row['approved']) $applink .= 'Unapprove';
  1090         if($row['approved']) $applink .= $lang->get('comment_btn_mod_unapprove');
  1059         else $applink .= 'Approve';
  1091         else $applink .= $lang->get('comment_btn_mod_approve');
  1060         $applink .= '</a>';
  1092         $applink .= '</a>';
  1061         $strings['MOD_APPROVE_LINK'] = $applink; unset($applink);
  1093         $strings['MOD_APPROVE_LINK'] = $applink; unset($applink);
  1062         $strings['MOD_DELETE_LINK'] = '<a href="'.makeUrlNS($namespace, $page_id, 'do=comments&amp;sub=admin&amp;action=delete&amp;id=' . $row['comment_id']) . '">Delete</a>';
  1094         $strings['MOD_DELETE_LINK'] = '<a href="'.makeUrlNS($namespace, $page_id, 'do=comments&amp;sub=admin&amp;action=delete&amp;id=' . $row['comment_id']) . '">' . $lang->get('comment_btn_mod_delete') . '</a>';
  1063         
  1095         
  1064         // Signature
  1096         // Signature
  1065         $strings['SIGNATURE'] = '';
  1097         $strings['SIGNATURE'] = '';
  1066         if($row['signature'] != '') $strings['SIGNATURE'] = RenderMan::render($row['signature']);
  1098         if($row['signature'] != '') $strings['SIGNATURE'] = RenderMan::render($row['signature']);
  1067         
  1099         
  1075         $_ob .= $tpl->run();
  1107         $_ob .= $tpl->run();
  1076       }
  1108       }
  1077     }
  1109     }
  1078     if(getConfig('comments_need_login') != '2' || $session->user_logged_in)
  1110     if(getConfig('comments_need_login') != '2' || $session->user_logged_in)
  1079     {
  1111     {
  1080       if(!$session->get_permissions('post_comments'))
  1112       if($session->get_permissions('post_comments'))
  1081       {
  1113       {
  1082         $_ob .= '<h3>Got something to say?</h3><p>Access to post comments on this page is denied.</p>';
  1114         $_ob .= '<h3>' . $lang->get('comment_postform_title') . '</h3>';
  1083       }
  1115         $_ob .= $lang->get('comment_postform_blurb');
  1084       else
  1116         if(getConfig('approve_comments')=='1') $_ob .= ' ' . $lang->get('comment_postform_blurb_unapp');
  1085       {
  1117         if(getConfig('comments_need_login') == '1' && !$session->user_logged_in)
  1086         $_ob .= '<h3>Got something to say?</h3>If you have comments or suggestions on this article, you can shout it out here.';
  1118         {
  1087         if(getConfig('approve_comments')=='1') $_ob .= '  Before your comment will be visible to the public, a moderator will have to approve it.';
  1119           $_ob .= ' ' . $lang->get('comment_postform_blurb_captcha');
  1088         if(getConfig('comments_need_login') == '1' && !$session->user_logged_in) $_ob .= ' Because you are not logged in, you will need to enter a visual confirmation before your comment will be posted.';
  1120         }
  1089         $sn = $session->user_logged_in ? $session->username . '<input name="name" id="mdgScreenName" type="hidden" value="' . $session->username . '" />' : '<input name="name" id="mdgScreenName" type="text" size="35" />';
  1121         $sn = $session->user_logged_in ? $session->username . '<input name="name" id="mdgScreenName" type="hidden" value="' . $session->username . '" />' : '<input name="name" id="mdgScreenName" type="text" size="35" />';
  1090         $_ob .= '  <a href="#" id="mdgCommentFormLink" style="display: none;" onclick="document.getElementById(\'mdgCommentForm\').style.display=\'block\';this.style.display=\'none\';return false;">Leave a comment...</a>
  1122         $_ob .= '  <a href="#" id="mdgCommentFormLink" style="display: none;" onclick="document.getElementById(\'mdgCommentForm\').style.display=\'block\';this.style.display=\'none\';return false;">' . $lang->get('comment_postform_blurb_link') . '</a>
  1091         <div id="mdgCommentForm">
  1123         <div id="mdgCommentForm">
  1092         <h3>Comment form</h3>
       
  1093         <form action="'.makeUrlNS($namespace, $page_id, 'do=comments&amp;sub=postcomment').'" method="post" style="margin-left: 1em">
  1124         <form action="'.makeUrlNS($namespace, $page_id, 'do=comments&amp;sub=postcomment').'" method="post" style="margin-left: 1em">
  1094         <table border="0">
  1125         <table border="0">
  1095         <tr><td>Your name or screen name:</td><td>' . $sn . '</td></tr>
  1126         <tr><td>' . $lang->get('comment_postform_field_name') . '</td><td>' . $sn . '</td></tr>
  1096         <tr><td>Comment subject:</td><td><input name="subj" id="mdgSubject" type="text" size="35" /></td></tr>';
  1127         <tr><td>' . $lang->get('comment_postform_field_subject') . '</td><td><input name="subj" id="mdgSubject" type="text" size="35" /></td></tr>';
  1097         if(getConfig('comments_need_login') == '1' && !$session->user_logged_in)
  1128         if(getConfig('comments_need_login') == '1' && !$session->user_logged_in)
  1098         {
  1129         {
  1099           $session->kill_captcha();
  1130           $session->kill_captcha();
  1100           $captcha = $session->make_captcha();
  1131           $captcha = $session->make_captcha();
  1101           $_ob .= '<tr><td>Visual confirmation:<br /><small>Please enter the code you see on the right.</small></td><td><img src="'.makeUrlNS('Special', 'Captcha/' . $captcha) . '" alt="Visual confirmation" style="cursor: pointer;" onclick="this.src = \''.makeUrlNS("Special", "Captcha/".$captcha).'/\'+Math.floor(Math.random() * 100000);" /><input name="captcha_id" id="mdgCaptchaID" type="hidden" value="' . $captcha . '" /><br />Code: <input name="captcha_input" id="mdgCaptchaInput" type="text" size="10" /><br /><small><script type="text/javascript">document.write("If you can\'t read the code, click on the image to generate a new one.");</script><noscript>If you can\'t read the code, please refresh this page to generate a new one.</noscript></small></td></tr>';
  1132           $_ob .= '<tr><td>' . $lang->get('comment_postform_field_captcha_title') . '<br /><small>' . $lang->get('comment_postform_field_captcha_blurb') . '</small></td><td><img src="'.makeUrlNS('Special', 'Captcha/' . $captcha) . '" alt="Visual confirmation" style="cursor: pointer;" onclick="this.src = \''.makeUrlNS("Special", "Captcha/".$captcha).'/\'+Math.floor(Math.random() * 100000);" /><input name="captcha_id" id="mdgCaptchaID" type="hidden" value="' . $captcha . '" /><br />' . $lang->get('comment_postform_field_captcha_label') . ' <input name="captcha_input" id="mdgCaptchaInput" type="text" size="10" /><br /><small><script type="text/javascript">document.write("' . $lang->get('comment_postform_field_captcha_cantread_js') . '");</script><noscript>' . $lang->get('comment_postform_field_captcha_cantread_nojs') . '</noscript></small></td></tr>';
  1102         }
  1133         }
  1103         $_ob .= '
  1134         $_ob .= '
  1104         <tr><td valign="top">Comment text:<br />(most HTML will be stripped)</td><td><textarea name="text" id="mdgCommentArea" rows="10" cols="40"></textarea></td></tr>
  1135         <tr><td valign="top">' . $lang->get('comment_postform_field_comment') . '</td><td><textarea name="text" id="mdgCommentArea" rows="10" cols="40"></textarea></td></tr>
  1105         <tr><td colspan="2" style="text-align: center;"><input type="submit" value="Submit Comment" /></td></tr>
  1136         <tr><td colspan="2" style="text-align: center;"><input type="submit" value="' . $lang->get('comment_postform_btn_submit') . '" /></td></tr>
  1106         </table>
  1137         </table>
  1107         </form>
  1138         </form>
  1108         </div>';
  1139         </div>';
  1109       }
  1140       }
  1110     } else {
  1141     } else {
  1331    */
  1362    */
  1332    
  1363    
  1333   function rename($page_id, $namespace, $name)
  1364   function rename($page_id, $namespace, $name)
  1334   {
  1365   {
  1335     global $db, $session, $paths, $template, $plugins; // Common objects
  1366     global $db, $session, $paths, $template, $plugins; // Common objects
       
  1367     global $lang;
  1336     
  1368     
  1337     $pname = $paths->nslist[$namespace] . $page_id;
  1369     $pname = $paths->nslist[$namespace] . $page_id;
  1338     
  1370     
  1339     $prot = ( ( $paths->pages[$pname]['protected'] == 2 && $session->user_logged_in && $session->reg_time + 60*60*24*4 < time() ) || $paths->pages[$pname]['protected'] == 1) ? true : false;
  1371     $prot = ( ( $paths->pages[$pname]['protected'] == 2 && $session->user_logged_in && $session->reg_time + 60*60*24*4 < time() ) || $paths->pages[$pname]['protected'] == 1) ? true : false;
  1340     $wiki = ( ( $paths->pages[$pname]['wiki_mode'] == 2 && getConfig('wiki_mode') == '1') || $paths->pages[$pname]['wiki_mode'] == 1) ? true : false;
  1372     $wiki = ( ( $paths->pages[$pname]['wiki_mode'] == 2 && getConfig('wiki_mode') == '1') || $paths->pages[$pname]['wiki_mode'] == 1) ? true : false;
  1341     
  1373     
  1342     if( empty($name)) 
  1374     if( empty($name)) 
  1343     {
  1375     {
  1344       die('Name is too short');
  1376       return($lang->get('ajax_rename_too_short'));
  1345     }
  1377     }
  1346     if( ( $session->get_permissions('rename') && ( ( $prot && $session->get_permissions('even_when_protected') ) || !$prot ) ) && ( $paths->namespace != 'Special' && $paths->namespace != 'Admin' ))
  1378     if( ( $session->get_permissions('rename') && ( ( $prot && $session->get_permissions('even_when_protected') ) || !$prot ) ) && ( $paths->namespace != 'Special' && $paths->namespace != 'Admin' ))
  1347     {
  1379     {
  1348       $e = $db->sql_query('INSERT INTO ' . table_prefix.'logs(time_id,date_string,log_type,action,page_id,namespace,author,edit_summary) VALUES('.time().', \''.date('d M Y h:i a').'\', \'page\', \'rename\', \'' . $db->escape($paths->cpage['urlname_nons']) . '\', \'' . $paths->namespace . '\', \'' . $db->escape($session->username) . '\', \'' . $db->escape($paths->cpage['name']) . '\')');
  1380       $e = $db->sql_query('INSERT INTO ' . table_prefix.'logs(time_id,date_string,log_type,action,page_id,namespace,author,edit_summary) VALUES('.time().', \''.date('d M Y h:i a').'\', \'page\', \'rename\', \'' . $db->escape($paths->cpage['urlname_nons']) . '\', \'' . $paths->namespace . '\', \'' . $db->escape($session->username) . '\', \'' . $db->escape($paths->cpage['name']) . '\')');
  1349       if ( !$e )
  1381       if ( !$e )
  1355       {
  1387       {
  1356         $db->_die('The page title could not be updated.');
  1388         $db->_die('The page title could not be updated.');
  1357       }
  1389       }
  1358       else
  1390       else
  1359       {
  1391       {
  1360         return('The page "' . $paths->pages[$pname]['name'] . '" has been renamed to "' . $name . '". You are encouraged to leave a comment explaining your action.' . "\n\n" . 'You will see the change take effect the next time you reload this page.');
  1392         $subst = array(
       
  1393           'page_name_old' => $paths->pages[$pname]['name'],
       
  1394           'page_name_new' => $name
       
  1395           );
       
  1396         return $lang->get('ajax_rename_success', $subst);
  1361       }
  1397       }
  1362     }
  1398     }
  1363     else
  1399     else
  1364     {
  1400     {
  1365       return('Access is denied.');
  1401       return($lang->get('etc_access_denied'));
  1366     }
  1402     }
  1367   }
  1403   }
  1368   
  1404   
  1369   /**
  1405   /**
  1370    * Flushes (clears) the action logs for a given page
  1406    * Flushes (clears) the action logs for a given page
  1374    */
  1410    */
  1375    
  1411    
  1376   function flushlogs($page_id, $namespace)
  1412   function flushlogs($page_id, $namespace)
  1377   {
  1413   {
  1378     global $db, $session, $paths, $template, $plugins; // Common objects
  1414     global $db, $session, $paths, $template, $plugins; // Common objects
  1379     if(!$session->get_permissions('clear_logs')) die('Administrative privileges are required to flush logs, you loser.');
  1415     global $lang;
       
  1416     if(!$session->get_permissions('clear_logs'))
       
  1417     {
       
  1418       return $lang->get('etc_access_denied');
       
  1419     }
  1380     $e = $db->sql_query('DELETE FROM ' . table_prefix.'logs WHERE page_id=\'' . $db->escape($page_id) . '\' AND namespace=\'' . $db->escape($namespace) . '\';');
  1420     $e = $db->sql_query('DELETE FROM ' . table_prefix.'logs WHERE page_id=\'' . $db->escape($page_id) . '\' AND namespace=\'' . $db->escape($namespace) . '\';');
  1381     if(!$e) $db->_die('The log entries could not be deleted.');
  1421     if(!$e) $db->_die('The log entries could not be deleted.');
  1382     
  1422     
  1383     // If the page exists, make a backup of it in case it gets spammed/vandalized
  1423     // If the page exists, make a backup of it in case it gets spammed/vandalized
  1384     // If not, the admin's probably deleting a trash page
  1424     // If not, the admin's probably deleting a trash page
  1389       $row = $db->fetchrow();
  1429       $row = $db->fetchrow();
  1390       $db->free_result();
  1430       $db->free_result();
  1391       $q='INSERT INTO ' . table_prefix.'logs(log_type,action,time_id,date_string,page_id,namespace,page_text,char_tag,author,edit_summary,minor_edit) VALUES(\'page\', \'edit\', '.time().', \''.date('d M Y h:i a').'\', \'' . $page_id . '\', \'' . $namespace . '\', \'' . $db->escape($row['page_text']) . '\', \'' . $row['char_tag'] . '\', \'' . $session->username . '\', \''."Automatic backup created when logs were purged".'\', '.'false'.');';
  1431       $q='INSERT INTO ' . table_prefix.'logs(log_type,action,time_id,date_string,page_id,namespace,page_text,char_tag,author,edit_summary,minor_edit) VALUES(\'page\', \'edit\', '.time().', \''.date('d M Y h:i a').'\', \'' . $page_id . '\', \'' . $namespace . '\', \'' . $db->escape($row['page_text']) . '\', \'' . $row['char_tag'] . '\', \'' . $session->username . '\', \''."Automatic backup created when logs were purged".'\', '.'false'.');';
  1392       if(!$db->sql_query($q)) $db->_die('The history (log) entry could not be inserted into the logs table.');
  1432       if(!$db->sql_query($q)) $db->_die('The history (log) entry could not be inserted into the logs table.');
  1393     }
  1433     }
  1394     return('The logs for this page have been cleared. A backup of this page has been added to the logs table so that this page can be restored in case of vandalism or spam later.');
  1434     return $lang->get('ajax_clearlogs_success');
  1395   }
  1435   }
  1396   
  1436   
  1397   /**
  1437   /**
  1398    * Deletes a page.
  1438    * Deletes a page.
  1399    * @param string $page_id the condemned page ID
  1439    * @param string $page_id the condemned page ID
  1403    */
  1443    */
  1404    
  1444    
  1405   function deletepage($page_id, $namespace, $reason)
  1445   function deletepage($page_id, $namespace, $reason)
  1406   {
  1446   {
  1407     global $db, $session, $paths, $template, $plugins; // Common objects
  1447     global $db, $session, $paths, $template, $plugins; // Common objects
       
  1448     global $lang;
  1408     $perms = $session->fetch_page_acl($page_id, $namespace);
  1449     $perms = $session->fetch_page_acl($page_id, $namespace);
  1409     $x = trim($reason);
  1450     $x = trim($reason);
  1410     if ( empty($x) )
  1451     if ( empty($x) )
  1411     {
  1452     {
  1412       return 'Invalid reason for deletion passed';
  1453       return $lang->get('ajax_delete_need_reason');
  1413     }
  1454     }
  1414     if(!$perms->get_permissions('delete_page')) return('Administrative privileges are required to delete pages, you loser.');
  1455     if(!$perms->get_permissions('delete_page')) return('Administrative privileges are required to delete pages, you loser.');
  1415     $e = $db->sql_query('INSERT INTO ' . table_prefix.'logs(time_id,date_string,log_type,action,page_id,namespace,author,edit_summary) VALUES('.time().', \''.date('d M Y h:i a').'\', \'page\', \'delete\', \'' . $page_id . '\', \'' . $namespace . '\', \'' . $session->username . '\', \'' . $db->escape(htmlspecialchars($reason)) . '\')');
  1456     $e = $db->sql_query('INSERT INTO ' . table_prefix.'logs(time_id,date_string,log_type,action,page_id,namespace,author,edit_summary) VALUES('.time().', \''.date('d M Y h:i a').'\', \'page\', \'delete\', \'' . $page_id . '\', \'' . $namespace . '\', \'' . $session->username . '\', \'' . $db->escape(htmlspecialchars($reason)) . '\')');
  1416     if(!$e) $db->_die('The page log entry could not be inserted.');
  1457     if(!$e) $db->_die('The page log entry could not be inserted.');
  1417     $e = $db->sql_query('DELETE FROM ' . table_prefix.'categories WHERE page_id=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\'');
  1458     $e = $db->sql_query('DELETE FROM ' . table_prefix.'categories WHERE page_id=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\'');
  1422     if(!$e) $db->_die('The page text entry could not be deleted.');
  1463     if(!$e) $db->_die('The page text entry could not be deleted.');
  1423     $e = $db->sql_query('DELETE FROM ' . table_prefix.'pages WHERE urlname=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\'');
  1464     $e = $db->sql_query('DELETE FROM ' . table_prefix.'pages WHERE urlname=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\'');
  1424     if(!$e) $db->_die('The page entry could not be deleted.');
  1465     if(!$e) $db->_die('The page entry could not be deleted.');
  1425     $e = $db->sql_query('DELETE FROM ' . table_prefix.'files WHERE page_id=\'' . $page_id . '\'');
  1466     $e = $db->sql_query('DELETE FROM ' . table_prefix.'files WHERE page_id=\'' . $page_id . '\'');
  1426     if(!$e) $db->_die('The file entry could not be deleted.');
  1467     if(!$e) $db->_die('The file entry could not be deleted.');
  1427     return('This page has been deleted. Note that there is still a log of edits and actions in the database, and anyone with admin rights can raise this page from the dead unless the log is cleared. If the deleted file is an image, there may still be cached thumbnails of it in the cache/ directory, which is inaccessible to users.');
  1468     return $lang->get('ajax_delete_success');
  1428   }
  1469   }
  1429   
  1470   
  1430   /**
  1471   /**
  1431    * Increments the deletion votes for a page by 1, and adds the current username/IP to the list of users that have voted for the page to prevent dual-voting
  1472    * Increments the deletion votes for a page by 1, and adds the current username/IP to the list of users that have voted for the page to prevent dual-voting
  1432    * @param $page_id the page ID
  1473    * @param $page_id the page ID
  1435    */
  1476    */
  1436    
  1477    
  1437   function delvote($page_id, $namespace)
  1478   function delvote($page_id, $namespace)
  1438   {
  1479   {
  1439     global $db, $session, $paths, $template, $plugins; // Common objects
  1480     global $db, $session, $paths, $template, $plugins; // Common objects
       
  1481     global $lang;
  1440     if ( !$session->get_permissions('vote_delete') )
  1482     if ( !$session->get_permissions('vote_delete') )
  1441     {
  1483     {
  1442       return 'Access denied';
  1484       return $lang->get('etc_access_denied');
  1443     }
  1485     }
  1444     
  1486     
  1445     if ( $namespace == 'Admin' || $namespace == 'Special' || $namespace == 'System' )
  1487     if ( $namespace == 'Admin' || $namespace == 'Special' || $namespace == 'System' )
  1446     {
  1488     {
  1447       return 'Special pages and system messages can\'t be voted for deletion.';
  1489       return 'Special pages and system messages can\'t be voted for deletion.';
  1476       }
  1518       }
  1477     }
  1519     }
  1478     
  1520     
  1479     if ( in_array($session->username, $ips['u']) || in_array($_SERVER['REMOTE_ADDR'], $ips['ip']) )
  1521     if ( in_array($session->username, $ips['u']) || in_array($_SERVER['REMOTE_ADDR'], $ips['ip']) )
  1480     {
  1522     {
  1481       return 'It appears that you have already voted to have this page deleted.';
  1523       return $lang->get('ajax_delvote_already_voted');
  1482     }
  1524     }
  1483     
  1525     
  1484     $ips['u'][] = $session->username;
  1526     $ips['u'][] = $session->username;
  1485     $ips['ip'][] = $_SERVER['REMOTE_ADDR'];
  1527     $ips['ip'][] = $_SERVER['REMOTE_ADDR'];
  1486     $ips = $db->escape( serialize($ips) );
  1528     $ips = $db->escape( serialize($ips) );
  1488     $cv++;
  1530     $cv++;
  1489     
  1531     
  1490     $q = 'UPDATE ' . table_prefix.'pages SET delvotes=' . $cv . ',delvote_ips=\'' . $ips . '\' WHERE urlname=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\'';
  1532     $q = 'UPDATE ' . table_prefix.'pages SET delvotes=' . $cv . ',delvote_ips=\'' . $ips . '\' WHERE urlname=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\'';
  1491     $w = $db->sql_query($q);
  1533     $w = $db->sql_query($q);
  1492     
  1534     
  1493     return 'Your vote to have this page deleted has been cast.'."\nYou are encouraged to leave a comment explaining the reason for your vote.";
  1535     return $lang->get('ajax_delvote_success');
  1494   }
  1536   }
  1495   
  1537   
  1496   /**
  1538   /**
  1497    * Resets the number of votes against a page to 0.
  1539    * Resets the number of votes against a page to 0.
  1498    * @param $page_id the page ID
  1540    * @param $page_id the page ID
  1501    */
  1543    */
  1502   
  1544   
  1503   function resetdelvotes($page_id, $namespace)
  1545   function resetdelvotes($page_id, $namespace)
  1504   {
  1546   {
  1505     global $db, $session, $paths, $template, $plugins; // Common objects
  1547     global $db, $session, $paths, $template, $plugins; // Common objects
  1506     if(!$session->get_permissions('vote_reset')) die('You need moderator rights in order to do this, stinkin\' hacker.');
  1548     global $lang;
       
  1549     if(!$session->get_permissions('vote_reset'))
       
  1550     {
       
  1551       return $lang->get('etc_access_denied');
       
  1552     }
  1507     $q = 'UPDATE ' . table_prefix.'pages SET delvotes=0,delvote_ips=\'' . $db->escape(serialize(array('ip'=>array(),'u'=>array()))) . '\' WHERE urlname=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\'';
  1553     $q = 'UPDATE ' . table_prefix.'pages SET delvotes=0,delvote_ips=\'' . $db->escape(serialize(array('ip'=>array(),'u'=>array()))) . '\' WHERE urlname=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\'';
  1508     $e = $db->sql_query($q);
  1554     $e = $db->sql_query($q);
  1509     if(!$e) $db->_die('The number of delete votes was not reset.');
  1555     if(!$e) $db->_die('The number of delete votes was not reset.');
  1510     else return('The number of votes for having this page deleted has been reset to zero.');
  1556     else
       
  1557     {
       
  1558       return $lang->get('ajax_delvote_reset_success');
       
  1559     }
  1511   }
  1560   }
  1512   
  1561   
  1513   /**
  1562   /**
  1514    * Gets a list of styles for a given theme name. As of Banshee, this returns JSON.
  1563    * Gets a list of styles for a given theme name. As of Banshee, this returns JSON.
  1515    * @param $id the name of the directory for the theme
  1564    * @param $id the name of the directory for the theme
  1566    */
  1615    */
  1567    
  1616    
  1568   function catedit_raw($page_id, $namespace)
  1617   function catedit_raw($page_id, $namespace)
  1569   {
  1618   {
  1570     global $db, $session, $paths, $template, $plugins; // Common objects
  1619     global $db, $session, $paths, $template, $plugins; // Common objects
       
  1620     global $lang;
       
  1621     
  1571     ob_start();
  1622     ob_start();
  1572     $_ob = '';
  1623     $_ob = '';
  1573     $e = $db->sql_query('SELECT category_id FROM ' . table_prefix.'categories WHERE page_id=\'' . $paths->cpage['urlname_nons'] . '\' AND namespace=\'' . $paths->namespace . '\'');
  1624     $e = $db->sql_query('SELECT category_id FROM ' . table_prefix.'categories WHERE page_id=\'' . $paths->cpage['urlname_nons'] . '\' AND namespace=\'' . $paths->namespace . '\'');
  1574     if(!$e) jsdie('Error selecting category information for current page: '.mysql_error());
  1625     if(!$e) jsdie('Error selecting category information for current page: '.mysql_error());
  1575     $cat_current = Array();
  1626     $cat_current = Array();
  1603       $un = $cat_info[$i]['urlname_nons'];
  1654       $un = $cat_info[$i]['urlname_nons'];
  1604       $cat_info[$i] = $cat_info[$un];
  1655       $cat_info[$i] = $cat_info[$un];
  1605     }
  1656     }
  1606     
  1657     
  1607     echo 'catlist = new Array();'; // Initialize the client-side category list
  1658     echo 'catlist = new Array();'; // Initialize the client-side category list
  1608     $_ob .= '<h3>Select which categories this page should be included in.</h3>
  1659     $_ob .= '<h3>' . $lang->get('catedit_title') . '</h3>
  1609              <form name="mdgCatForm" action="'.makeUrlNS($namespace, $page_id, 'do=catedit').'" method="post">';
  1660              <form name="mdgCatForm" action="'.makeUrlNS($namespace, $page_id, 'do=catedit').'" method="post">';
  1610     if ( sizeof($cat_info) < 1 )
  1661     if ( sizeof($cat_info) < 1 )
  1611     {
  1662     {
  1612       $_ob .= '<p>There are no categories on this site yet.</p>';
  1663       $_ob .= '<p>' . $lang->get('catedit_no_categories') . '</p>';
  1613     }
  1664     }
  1614     for ( $i = 0; $i < sizeof($cat_info) / 2; $i++ )
  1665     for ( $i = 0; $i < sizeof($cat_info) / 2; $i++ )
  1615     {
  1666     {
  1616       // Protection code added 1/3/07
  1667       // Protection code added 1/3/07
  1617       // Updated 3/4/07
  1668       // Updated 3/4/07
  1628       $_ob .= '/>  <label for="mdgCat_' . $cat_info[$i]['urlname_nons'] . '">' . $cat_info[$i]['name'].$prottext.'</label></span><br />';
  1679       $_ob .= '/>  <label for="mdgCat_' . $cat_info[$i]['urlname_nons'] . '">' . $cat_info[$i]['name'].$prottext.'</label></span><br />';
  1629     }
  1680     }
  1630     
  1681     
  1631     $disabled = ( sizeof($cat_info) < 1 ) ? 'disabled="disabled"' : '';
  1682     $disabled = ( sizeof($cat_info) < 1 ) ? 'disabled="disabled"' : '';
  1632       
  1683       
  1633     $_ob .= '<div style="border-top: 1px solid #CCC; padding-top: 5px; margin-top: 10px;"><input name="__enanoSaveButton" ' . $disabled . ' style="font-weight: bold;" type="submit" onclick="ajaxCatSave(); return false;" value="Save changes" /> <input name="__enanoCatCancel" type="submit" onclick="ajaxReset(); return false;" value="Cancel" /></div></form>';
  1684     $_ob .= '<div style="border-top: 1px solid #CCC; padding-top: 5px; margin-top: 10px;"><input name="__enanoSaveButton" ' . $disabled . ' style="font-weight: bold;" type="submit" onclick="ajaxCatSave(); return false;" value="' . $lang->get('etc_save_changes') . '" /> <input name="__enanoCatCancel" type="submit" onclick="ajaxReset(); return false;" value="' . $lang->get('etc_cancel') . '" /></div></form>';
  1634     
  1685     
  1635     $cont = ob_get_contents();
  1686     $cont = ob_get_contents();
  1636     ob_end_clean();
  1687     ob_end_clean();
  1637     return Array($cont, $_ob);
  1688     return Array($cont, $_ob);
  1638   }
  1689   }
  1743    */
  1794    */
  1744   
  1795   
  1745   function setpass($page_id, $namespace, $pass)
  1796   function setpass($page_id, $namespace, $pass)
  1746   {
  1797   {
  1747     global $db, $session, $paths, $template, $plugins; // Common objects
  1798     global $db, $session, $paths, $template, $plugins; // Common objects
       
  1799     global $lang;
  1748     // Determine permissions
  1800     // Determine permissions
  1749     if($paths->pages[$paths->nslist[$namespace].$page_id]['password'] != '')
  1801     if($paths->pages[$paths->nslist[$namespace].$page_id]['password'] != '')
  1750       $a = $session->get_permissions('password_reset');
  1802       $a = $session->get_permissions('password_reset');
  1751     else
  1803     else
  1752       $a = $session->get_permissions('password_set');
  1804       $a = $session->get_permissions('password_set');
  1753     if(!$a)
  1805     if(!$a)
  1754       return 'Access is denied';
  1806       return $lang->get('etc_access_denied');
  1755     if(!isset($pass)) return('Password was not set on URL');
  1807     if(!isset($pass)) return('Password was not set on URL');
  1756     $p = $pass;
  1808     $p = $pass;
  1757     if ( !preg_match('#([0-9a-f]){40,40}#', $p) )
  1809     if ( !preg_match('#([0-9a-f]){40,40}#', $p) )
  1758     {
  1810     {
  1759       $p = sha1($p);
  1811       $p = sha1($p);
  1767       die('PageUtils::setpass(): Error during update query: '.mysql_error()."\n\nSQL Backtrace:\n".$db->sql_backtrace());
  1819       die('PageUtils::setpass(): Error during update query: '.mysql_error()."\n\nSQL Backtrace:\n".$db->sql_backtrace());
  1768     }
  1820     }
  1769     // Is the new password blank?
  1821     // Is the new password blank?
  1770     if ( $p == '' )
  1822     if ( $p == '' )
  1771     {
  1823     {
  1772       return('The password for this page has been disabled.');
  1824       return $lang->get('ajax_password_disable_success');
  1773     }
  1825     }
  1774     else return('The password for this page has been set.');
  1826     else
       
  1827     {
       
  1828       return $lang->get('ajax_password_success');
       
  1829     }
  1775   }
  1830   }
  1776   
  1831   
  1777   /**
  1832   /**
  1778    * Generates some preview HTML
  1833    * Generates some preview HTML
  1779    * @param $text string the wikitext to use
  1834    * @param $text string the wikitext to use
  1780    * @return string
  1835    * @return string
  1781    */
  1836    */
  1782    
  1837    
  1783   function genPreview($text)
  1838   function genPreview($text)
  1784   {
  1839   {
  1785     $ret = '<div class="info-box"><b>Reminder:</b> This is only a preview - your changes to this page have not yet been saved.</div><div style="background-color: #F8F8F8; padding: 10px; border: 1px dashed #406080; max-height: 250px; overflow: auto; margin: 1em 0 1em 1em;">';
  1840     global $lang;
       
  1841     $ret = '<div class="info-box">' . $lang->get('editor_preview_blurb') . '</div><div style="background-color: #F8F8F8; padding: 10px; border: 1px dashed #406080; max-height: 250px; overflow: auto; margin: 1em 0 1em 1em;">';
  1786     $text = RenderMan::render(RenderMan::preprocess_text($text, false, false));
  1842     $text = RenderMan::render(RenderMan::preprocess_text($text, false, false));
  1787     ob_start();
  1843     ob_start();
  1788     eval('?>' . $text);
  1844     eval('?>' . $text);
  1789     $text = ob_get_contents();
  1845     $text = ob_get_contents();
  1790     ob_end_clean();
  1846     ob_end_clean();
  1815    */
  1871    */
  1816    
  1872    
  1817   function pagediff($page_id, $namespace, $id1, $id2)
  1873   function pagediff($page_id, $namespace, $id1, $id2)
  1818   {
  1874   {
  1819     global $db, $session, $paths, $template, $plugins; // Common objects
  1875     global $db, $session, $paths, $template, $plugins; // Common objects
       
  1876     global $lang;
  1820     if(!$session->get_permissions('history_view'))
  1877     if(!$session->get_permissions('history_view'))
  1821       return 'Access denied';
  1878       return $lang->get('etc_access_denied');
  1822     if(!preg_match('#^([0-9]+)$#', (string)$id1) ||
  1879     if(!preg_match('#^([0-9]+)$#', (string)$id1) ||
  1823        !preg_match('#^([0-9]+)$#', (string)$id2  )) return 'SQL injection attempt';
  1880        !preg_match('#^([0-9]+)$#', (string)$id2  )) return 'SQL injection attempt';
  1824     // OK we made it through security
  1881     // OK we made it through security
  1825     // Safest way to make sure we don't end up with the revisions in wrong columns is to make 2 queries
  1882     // Safest way to make sure we don't end up with the revisions in wrong columns is to make 2 queries
  1826     if(!$q1 = $db->sql_query('SELECT page_text,char_tag,author,edit_summary FROM ' . table_prefix.'logs WHERE time_id=' . $id1 . ' AND log_type=\'page\' AND action=\'edit\' AND page_id=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\';')) return 'MySQL error: '.mysql_error();
  1883     if(!$q1 = $db->sql_query('SELECT page_text,char_tag,author,edit_summary FROM ' . table_prefix.'logs WHERE time_id=' . $id1 . ' AND log_type=\'page\' AND action=\'edit\' AND page_id=\'' . $page_id . '\' AND namespace=\'' . $namespace . '\';')) return 'MySQL error: '.mysql_error();
  1833     $text1 = $row1['page_text'];
  1890     $text1 = $row1['page_text'];
  1834     $text2 = $row2['page_text'];
  1891     $text2 = $row2['page_text'];
  1835     $time1 = date('F d, Y h:i a', $id1);
  1892     $time1 = date('F d, Y h:i a', $id1);
  1836     $time2 = date('F d, Y h:i a', $id2);
  1893     $time2 = date('F d, Y h:i a', $id2);
  1837     $_ob = "
  1894     $_ob = "
  1838     <p>Comparing revisions: {$time1} &rarr; {$time2}</p>
  1895     <p>" . $lang->get('history_lbl_comparingrevisions') . " {$time1} &rarr; {$time2}</p>
  1839     ";
  1896     ";
  1840     // Free some memory
  1897     // Free some memory
  1841     unset($row1, $row2, $q1, $q2);
  1898     unset($row1, $row2, $q1, $q2);
  1842     
  1899     
  1843     $_ob .= RenderMan::diff($text1, $text2);
  1900     $_ob .= RenderMan::diff($text1, $text2);
  1844     return $_ob;
  1901     return $_ob;
  1845   }
  1902   }
  1846   
  1903   
  1847   /**
  1904   /**
  1848    * Gets ACL information about the selected page for target type X and target ID Y.
  1905    * Gets ACL information about the selected page for target type X and target ID Y.
  1849    * @param string $page_id The page ID
       
  1850    * @param string $namespace The namespace
       
  1851    * @param array $parms What to select. This is an array purely for JSON compatibility. It should be an associative array with keys target_type and target_id.
  1906    * @param array $parms What to select. This is an array purely for JSON compatibility. It should be an associative array with keys target_type and target_id.
  1852    * @return array
  1907    * @return array
  1853    */
  1908    */
  1854    
  1909    
  1855   function acl_editor($parms = Array())
  1910   function acl_editor($parms = Array())
  1856   {
  1911   {
  1857     global $db, $session, $paths, $template, $plugins; // Common objects
  1912     global $db, $session, $paths, $template, $plugins; // Common objects
       
  1913     global $lang;
       
  1914     
  1858     if(!$session->get_permissions('edit_acl') && $session->user_level < USER_LEVEL_ADMIN)
  1915     if(!$session->get_permissions('edit_acl') && $session->user_level < USER_LEVEL_ADMIN)
  1859     {
  1916     {
  1860       return Array(
  1917       return Array(
  1861         'mode' => 'error',
  1918         'mode' => 'error',
  1862         'error' => 'You are not authorized to view or edit access control lists.'
  1919         'error' => $lang->get('acl_err_access_denied')
  1863         );
  1920         );
  1864     }
  1921     }
  1865     $parms['page_id'] = ( isset($parms['page_id']) ) ? $parms['page_id'] : false;
  1922     $parms['page_id'] = ( isset($parms['page_id']) ) ? $parms['page_id'] : false;
  1866     $parms['namespace'] = ( isset($parms['namespace']) ) ? $parms['namespace'] : false;
  1923     $parms['namespace'] = ( isset($parms['namespace']) ) ? $parms['namespace'] : false;
  1867     $page_id =& $parms['page_id'];
  1924     $page_id =& $parms['page_id'];
  1875     $return = Array();
  1932     $return = Array();
  1876     if ( !file_exists(ENANO_ROOT . '/themes/' . $session->theme . '/acledit.tpl') )
  1933     if ( !file_exists(ENANO_ROOT . '/themes/' . $session->theme . '/acledit.tpl') )
  1877     {
  1934     {
  1878       return Array(
  1935       return Array(
  1879         'mode' => 'error',
  1936         'mode' => 'error',
  1880         'error' => 'It seems that (a) the file acledit.tpl is missing from these theme, and (b) the JSON response is working.',
  1937         'error' => $lang->get('acl_err_missing_template'),
  1881       );
  1938       );
  1882     }
  1939     }
  1883     $return['template'] = $template->extract_vars('acledit.tpl');
  1940     $return['template'] = $template->extract_vars('acledit.tpl');
  1884     $return['page_id'] = $page_id;
  1941     $return['page_id'] = $page_id;
  1885     $return['namespace'] = $namespace;
  1942     $return['namespace'] = $namespace;
  1936                 $return['type'] = 'new';
  1993                 $return['type'] = 'new';
  1937                 $q = $db->sql_query('SELECT user_id FROM ' . table_prefix.'users WHERE username=\'' . $db->escape($parms['target_id']) . '\';');
  1994                 $q = $db->sql_query('SELECT user_id FROM ' . table_prefix.'users WHERE username=\'' . $db->escape($parms['target_id']) . '\';');
  1938                 if(!$q)
  1995                 if(!$q)
  1939                   return(Array('mode'=>'error','error'=>mysql_error()));
  1996                   return(Array('mode'=>'error','error'=>mysql_error()));
  1940                 if($db->numrows() < 1)
  1997                 if($db->numrows() < 1)
  1941                   return Array('mode'=>'error','error'=>'The username you entered was not found.');
  1998                   return Array('mode'=>'error','error'=>$lang->get('acl_err_user_not_found'));
  1942                 $row = $db->fetchrow();
  1999                 $row = $db->fetchrow();
  1943                 $return['target_name'] = $return['target_id'];
  2000                 $return['target_name'] = $return['target_id'];
  1944                 $return['target_id'] = intval($row['user_id']);
  2001                 $return['target_id'] = intval($row['user_id']);
  1945                 $return['current_perms'] = $session->acl_types;
  2002                 $return['current_perms'] = $session->acl_types;
  1946               }
  2003               }
  1983                 $return['type'] = 'new';
  2040                 $return['type'] = 'new';
  1984                 $q = $db->sql_query('SELECT group_id,group_name FROM ' . table_prefix.'groups WHERE group_id=\''.intval($parms['target_id']).'\';');
  2041                 $q = $db->sql_query('SELECT group_id,group_name FROM ' . table_prefix.'groups WHERE group_id=\''.intval($parms['target_id']).'\';');
  1985                 if(!$q)
  2042                 if(!$q)
  1986                   return(Array('mode'=>'error','error'=>mysql_error()));
  2043                   return(Array('mode'=>'error','error'=>mysql_error()));
  1987                 if($db->numrows() < 1)
  2044                 if($db->numrows() < 1)
  1988                   return Array('mode'=>'error','error'=>'The group ID you submitted is not valid.');
  2045                   return Array('mode'=>'error','error'=>$lang->get('acl_err_bad_group_id'));
  1989                 $row = $db->fetchrow();
  2046                 $row = $db->fetchrow();
  1990                 $return['target_name'] = $row['group_name'];
  2047                 $return['target_name'] = $row['group_name'];
  1991                 $return['target_id'] = intval($row['group_id']);
  2048                 $return['target_id'] = intval($row['group_id']);
  1992                 $return['current_perms'] = $session->acl_types;
  2049                 $return['current_perms'] = $session->acl_types;
  1993               }
  2050               }
  2025           break;
  2082           break;
  2026         case 'save_new':
  2083         case 'save_new':
  2027         case 'save_edit':
  2084         case 'save_edit':
  2028           if ( defined('ENANO_DEMO_MODE') )
  2085           if ( defined('ENANO_DEMO_MODE') )
  2029           {
  2086           {
  2030             return Array('mode'=>'error','error'=>'Editing access control lists is disabled in the administration demo.');
  2087             return Array('mode'=>'error','error'=>$lang->get('acl_err_demo'));
  2031           }
  2088           }
  2032           $q = $db->sql_query('DELETE FROM ' . table_prefix.'acl WHERE target_type='.intval($parms['target_type']).' AND target_id='.intval($parms['target_id']).'
  2089           $q = $db->sql_query('DELETE FROM ' . table_prefix.'acl WHERE target_type='.intval($parms['target_type']).' AND target_id='.intval($parms['target_id']).'
  2033             ' . $page_where_clause_lite . ';');
  2090             ' . $page_where_clause_lite . ';');
  2034           if(!$q)
  2091           if(!$q)
  2035             return Array('mode'=>'error','error'=>mysql_error());
  2092             return Array('mode'=>'error','error'=>mysql_error());
  2036           $rules = $session->perm_to_string($parms['perms']);
  2093           $rules = $session->perm_to_string($parms['perms']);
  2037           if ( sizeof ( $rules ) < 1 )
  2094           if ( sizeof ( $rules ) < 1 )
  2038           {
  2095           {
  2039             return array(
  2096             return array(
  2040                 'mode' => 'error', 
  2097                 'mode' => 'error', 
  2041                 'error' => 'Supplied rule list has a length of zero'
  2098                 'error' => $lang->get('acl_err_zero_list')
  2042               );
  2099               );
  2043           }
  2100           }
  2044           $q = ($page_id && $namespace) ? 'INSERT INTO ' . table_prefix.'acl ( target_type, target_id, page_id, namespace, rules )
  2101           $q = ($page_id && $namespace) ? 'INSERT INTO ' . table_prefix.'acl ( target_type, target_id, page_id, namespace, rules )
  2045                                              VALUES( '.intval($parms['target_type']).', '.intval($parms['target_id']).', \'' . $db->escape($page_id) . '\', \'' . $db->escape($namespace) . '\', \'' . $db->escape($rules) . '\' )' :
  2102                                              VALUES( '.intval($parms['target_type']).', '.intval($parms['target_id']).', \'' . $db->escape($page_id) . '\', \'' . $db->escape($namespace) . '\', \'' . $db->escape($rules) . '\' )' :
  2046                                           'INSERT INTO ' . table_prefix.'acl ( target_type, target_id, rules )
  2103                                           'INSERT INTO ' . table_prefix.'acl ( target_type, target_id, rules )
  2056             );
  2113             );
  2057           break;
  2114           break;
  2058         case 'delete':
  2115         case 'delete':
  2059           if ( defined('ENANO_DEMO_MODE') )
  2116           if ( defined('ENANO_DEMO_MODE') )
  2060           {
  2117           {
  2061             return Array('mode'=>'error','error'=>'Editing access control lists is disabled in the administration demo.');
  2118             return Array('mode'=>'error','error'=>$lang->get('acl_err_demo'));
  2062           }
  2119           }
  2063           $q = $db->sql_query('DELETE FROM ' . table_prefix.'acl WHERE target_type='.intval($parms['target_type']).' AND target_id='.intval($parms['target_id']).'
  2120           $q = $db->sql_query('DELETE FROM ' . table_prefix.'acl WHERE target_type='.intval($parms['target_type']).' AND target_id='.intval($parms['target_id']).'
  2064             ' . $page_where_clause_lite . ';');
  2121             ' . $page_where_clause_lite . ';');
  2065           if(!$q)
  2122           if(!$q)
  2066             return Array('mode'=>'error','error'=>mysql_error());
  2123             return Array('mode'=>'error','error'=>mysql_error());
  2103    */
  2160    */
  2104    
  2161    
  2105   function aclmanager($parms)
  2162   function aclmanager($parms)
  2106   {
  2163   {
  2107     global $db, $session, $paths, $template, $plugins; // Common objects
  2164     global $db, $session, $paths, $template, $plugins; // Common objects
       
  2165     global $lang;
  2108     ob_start();
  2166     ob_start();
  2109     // Convenience
  2167     // Convenience
  2110     $formstart = '<form 
  2168     $formstart = '<form 
  2111                     action="' . makeUrl($paths->page, 'do=aclmanager', true) . '"
  2169                     action="' . makeUrl($paths->page, 'do=aclmanager', true) . '"
  2112                     method="post" enctype="multipart/form-data"
  2170                     method="post" enctype="multipart/form-data"
  2123     {
  2181     {
  2124       case 'debug':
  2182       case 'debug':
  2125         echo '<pre>' . htmlspecialchars($response['text']) . '</pre>';
  2183         echo '<pre>' . htmlspecialchars($response['text']) . '</pre>';
  2126         break;
  2184         break;
  2127       case 'stage1':
  2185       case 'stage1':
  2128         echo '<h3>Manage page access</h3>
  2186         echo '<h3>' . $lang->get('acl_lbl_welcome_title') . '</h3>
  2129               <p>Please select who should be affected by this access rule.</p>';
  2187               <p>' . $lang->get('acl_lbl_welcome_body') . '</p>';
  2130         echo $formstart;
  2188         echo $formstart;
  2131         echo '<p><label><input type="radio" name="data[target_type]" value="' . ACL_TYPE_GROUP . '" checked="checked" /> A usergroup</label></p>
  2189         echo '<p><label><input type="radio" name="data[target_type]" value="' . ACL_TYPE_GROUP . '" checked="checked" /> ' . $lang->get('acl_radio_usergroup') . '</label></p>
  2132               <p><select name="data[target_id_grp]">';
  2190               <p><select name="data[target_id_grp]">';
  2133         foreach ( $response['groups'] as $group )
  2191         foreach ( $response['groups'] as $group )
  2134         {
  2192         {
  2135           echo '<option value="' . $group['id'] . '">' . $group['name'] . '</option>';
  2193           echo '<option value="' . $group['id'] . '">' . $group['name'] . '</option>';
  2136         }
  2194         }
       
  2195         
  2137         // page group selector
  2196         // page group selector
  2138         $groupsel = '';
  2197         $groupsel = '';
  2139         if ( count($response['page_groups']) > 0 )
  2198         if ( count($response['page_groups']) > 0 )
  2140         {
  2199         {
  2141           $groupsel = '<p><label><input type="radio" name="data[scope]" value="page_group" /> A group of pages</label></p>
  2200           $groupsel = '<p><label><input type="radio" name="data[scope]" value="page_group" /> ' . $lang->get('acl_radio_scope_pagegroup') . '</label></p>
  2142                        <p><select name="data[pg_id]">';
  2201                        <p><select name="data[pg_id]">';
  2143           foreach ( $response['page_groups'] as $grp )
  2202           foreach ( $response['page_groups'] as $grp )
  2144           {
  2203           {
  2145             $groupsel .= '<option value="' . $grp['id'] . '">' . htmlspecialchars($grp['name']) . '</option>';
  2204             $groupsel .= '<option value="' . $grp['id'] . '">' . htmlspecialchars($grp['name']) . '</option>';
  2146           }
  2205           }
  2147           $groupsel .= '</select></p>';
  2206           $groupsel .= '</select></p>';
  2148         }
  2207         }
  2149         
  2208         
  2150         echo '</select></p>
  2209         echo '</select></p>
  2151               <p><label><input type="radio" name="data[target_type]" value="' . ACL_TYPE_USER . '" /> A specific user</label></p>
  2210               <p><label><input type="radio" name="data[target_type]" value="' . ACL_TYPE_USER . '" /> ' . $lang->get('acl_radio_user') . '</label></p>
  2152               <p>' . $template->username_field('data[target_id_user]') . '</p>
  2211               <p>' . $template->username_field('data[target_id_user]') . '</p>
  2153               <p>What should this access rule control?</p>
  2212               <p>' . $lang->get('acl_lbl_scope') . '</p>
  2154               <p><label><input name="data[scope]" value="only_this" type="radio" checked="checked" /> Only this page</p>
  2213               <p><label><input name="data[scope]" value="only_this" type="radio" checked="checked" /> ' . $lang->get('acl_radio_scope_thispage') . '</p>
  2155               ' . $groupsel . '
  2214               ' . $groupsel . '
  2156               <p><label><input name="data[scope]" value="entire_site" type="radio" /> The entire site</p>
  2215               <p><label><input name="data[scope]" value="entire_site" type="radio" /> ' . $lang->get('acl_radio_scope_wholesite') . '</p>
  2157               <div style="margin: 0 auto 0 0; text-align: right;">
  2216               <div style="margin: 0 auto 0 0; text-align: right;">
  2158                 <input name="data[mode]" value="seltarget" type="hidden" />
  2217                 <input name="data[mode]" value="seltarget" type="hidden" />
  2159                 <input type="hidden" name="data[page_id]" value="' . $paths->cpage['urlname_nons'] . '" />
  2218                 <input type="hidden" name="data[page_id]" value="' . $paths->cpage['urlname_nons'] . '" />
  2160                 <input type="hidden" name="data[namespace]" value="' . $paths->namespace . '" />
  2219                 <input type="hidden" name="data[namespace]" value="' . $paths->namespace . '" />
  2161                 <input type="submit" value="Next &gt;" />
  2220                 <input type="submit" value="' . htmlspecialchars($lang->get('etc_wizard_next')) . '" />
  2162               </div>';
  2221               </div>';
  2163         echo $formend;
  2222         echo $formend;
  2164         break;
  2223         break;
  2165       case 'success':
  2224       case 'success':
  2166         echo '<div class="info-box">
  2225         echo '<div class="info-box">
  2167                 <b>Permissions updated</b><br />
  2226                 <b>' . $lang->get('acl_lbl_save_success_title') . '</b><br />
  2168                 The permissions for ' . $response['target_name'] . ' on this page have been updated successfully.<br />
  2227                 ' . $lang->get('acl_lbl_save_success_body', array( 'target_name' => $response['target_name'] )) . '<br />
  2169                 ' . $formstart . '
  2228                 ' . $formstart . '
  2170                 <input type="hidden" name="data[mode]" value="seltarget" />
  2229                 <input type="hidden" name="data[mode]" value="seltarget" />
  2171                 <input type="hidden" name="data[target_type]" value="' . $response['target_type'] . '" />
  2230                 <input type="hidden" name="data[target_type]" value="' . $response['target_type'] . '" />
  2172                 <input type="hidden" name="data[target_id_user]" value="' . ( ( intval($response['target_type']) == ACL_TYPE_USER ) ? $response['target_name'] : $response['target_id'] ) .'" />
  2231                 <input type="hidden" name="data[target_id_user]" value="' . ( ( intval($response['target_type']) == ACL_TYPE_USER ) ? $response['target_name'] : $response['target_id'] ) .'" />
  2173                 <input type="hidden" name="data[target_id_grp]"  value="' . ( ( intval($response['target_type']) == ACL_TYPE_USER ) ? $response['target_name'] : $response['target_id'] ) .'" />
  2232                 <input type="hidden" name="data[target_id_grp]"  value="' . ( ( intval($response['target_type']) == ACL_TYPE_USER ) ? $response['target_name'] : $response['target_id'] ) .'" />
  2174                 <input type="hidden" name="data[scope]" value="' . ( ( $response['page_id'] ) ? 'only_this' : 'entire_site' ) . '" />
  2233                 <input type="hidden" name="data[scope]" value="' . ( ( $response['page_id'] ) ? 'only_this' : 'entire_site' ) . '" />
  2175                 <input type="hidden" name="data[page_id]" value="' . ( ( $response['page_id'] ) ? $response['page_id'] : 'false' ) . '" />
  2234                 <input type="hidden" name="data[page_id]" value="' . ( ( $response['page_id'] ) ? $response['page_id'] : 'false' ) . '" />
  2176                 <input type="hidden" name="data[namespace]" value="' . ( ( $response['namespace'] ) ? $response['namespace'] : 'false' ) . '" />
  2235                 <input type="hidden" name="data[namespace]" value="' . ( ( $response['namespace'] ) ? $response['namespace'] : 'false' ) . '" />
  2177                 <input type="submit" value="Return to ACL editor" /> <input type="submit" name="data[act_go_stage1]" value="Return to user/scope selection" />
  2236                 <input type="submit" value="' . $lang->get('acl_btn_returnto_editor') . '" /> <input type="submit" name="data[act_go_stage1]" value="' . $lang->get('acl_btn_returnto_userscope') . '" />
  2178                 ' . $formend . '
  2237                 ' . $formend . '
  2179               </div>';
  2238               </div>';
  2180         break;
  2239         break;
  2181       case 'delete':
  2240       case 'delete':
  2182         echo '<div class="info-box">
  2241         echo '<div class="info-box">
  2183                 <b>Rule deleted</b><br />
  2242                 <b>' . $lang->get('acl_lbl_delete_success_title') . '</b><br />
  2184                 The selected access rule has been successfully deleted.<br />
  2243                 ' . $lang->get('acl_lbl_delete_success_body', array('target_name' => $response['target_name'])) . '<br />
  2185                 ' . $formstart . '
  2244                 ' . $formstart . '
  2186                 <input type="hidden" name="data[mode]" value="seltarget" />
  2245                 <input type="hidden" name="data[mode]" value="seltarget" />
  2187                 <input type="hidden" name="data[target_type]" value="' . $response['target_type'] . '" />
  2246                 <input type="hidden" name="data[target_type]" value="' . $response['target_type'] . '" />
  2188                 <input type="hidden" name="data[target_id_user]" value="' . ( ( intval($response['target_type']) == ACL_TYPE_USER ) ? $response['target_name'] : $response['target_id'] ) .'" />
  2247                 <input type="hidden" name="data[target_id_user]" value="' . ( ( intval($response['target_type']) == ACL_TYPE_USER ) ? $response['target_name'] : $response['target_id'] ) .'" />
  2189                 <input type="hidden" name="data[target_id_grp]"  value="' . ( ( intval($response['target_type']) == ACL_TYPE_USER ) ? $response['target_name'] : $response['target_id'] ) .'" />
  2248                 <input type="hidden" name="data[target_id_grp]"  value="' . ( ( intval($response['target_type']) == ACL_TYPE_USER ) ? $response['target_name'] : $response['target_id'] ) .'" />
  2190                 <input type="hidden" name="data[scope]" value="' . ( ( $response['page_id'] ) ? 'only_this' : 'entire_site' ) . '" />
  2249                 <input type="hidden" name="data[scope]" value="' . ( ( $response['page_id'] ) ? 'only_this' : 'entire_site' ) . '" />
  2191                 <input type="hidden" name="data[page_id]" value="' . ( ( $response['page_id'] ) ? $response['page_id'] : 'false' ) . '" />
  2250                 <input type="hidden" name="data[page_id]" value="' . ( ( $response['page_id'] ) ? $response['page_id'] : 'false' ) . '" />
  2192                 <input type="hidden" name="data[namespace]" value="' . ( ( $response['namespace'] ) ? $response['namespace'] : 'false' ) . '" />
  2251                 <input type="hidden" name="data[namespace]" value="' . ( ( $response['namespace'] ) ? $response['namespace'] : 'false' ) . '" />
  2193                 <input type="submit" value="Return to ACL editor" /> <input type="submit" name="data[act_go_stage1]" value="Return to user/scope selection" />
  2252                 <input type="submit" value="' . $lang->get('acl_btn_returnto_editor') . '" /> <input type="submit" name="data[act_go_stage1]" value="' . $lang->get('acl_btn_returnto_userscope') . '" />
  2194                 ' . $formend . '
  2253                 ' . $formend . '
  2195               </div>';
  2254               </div>';
  2196         break;
  2255         break;
  2197       case 'seltarget':
  2256       case 'seltarget':
  2198         if ( $response['type'] == 'edit' )
  2257         if ( $response['type'] == 'edit' )
  2199         {
  2258         {
  2200           echo '<h3>Editing permissions</h3>';
  2259           echo '<h3>' . $lang->get('acl_lbl_editwin_title_edit') . '</h3>';
  2201         }
  2260         }
  2202         else
  2261         else
  2203         {
  2262         {
  2204           echo '<h3>Create new rule</h3>';
  2263           echo '<h3>' . $lang->get('acl_lbl_editwin_title_create') . '</h3>';
  2205         }
  2264         }
  2206         $type  = ( $response['target_type'] == ACL_TYPE_GROUP ) ? 'group' : 'user';
  2265         $type  = ( $response['target_type'] == ACL_TYPE_GROUP ) ? $lang->get('acl_target_type_group') : $lang->get('acl_target_type_user');
  2207         $scope = ( $response['page_id'] ) ? ( $response['namespace'] == '__PageGroup' ? 'this group of pages' : 'this page' ) : 'this entire site';
  2266         $scope = ( $response['page_id'] ) ? ( $response['namespace'] == '__PageGroup' ? $lang->get('acl_scope_type_pagegroup') : $lang->get('acl_scope_type_thispage') ) : $lang->get('acl_scope_type_wholesite');
  2208         echo 'This panel allows you to edit what the ' . $type . ' "' . $response['target_name'] . '" can do on <b>' . $scope . '</b>. Unless you set a permission to "Deny", these permissions may be overridden by other rules.';
  2267         $subs = array(
       
  2268             'target_type' => $type,
       
  2269             'target' => $response['target_name'],
       
  2270             'scope_type' => $scope
       
  2271           );
       
  2272         echo $lang->get('acl_lbl_editwin_body', $subs);
  2209         echo $formstart;
  2273         echo $formstart;
  2210         $parser = $template->makeParserText( $response['template']['acl_field_begin'] );
  2274         $parser = $template->makeParserText( $response['template']['acl_field_begin'] );
  2211         echo $parser->run();
  2275         echo $parser->run();
  2212         $parser = $template->makeParserText( $response['template']['acl_field_item'] );
  2276         $parser = $template->makeParserText( $response['template']['acl_field_item'] );
  2213         $cls = 'row2';
  2277         $cls = 'row2';
  2237              case AUTH_DENY:
  2301              case AUTH_DENY:
  2238               $vars['FIELD_DENY_CHECKED'] = 'checked="checked"';
  2302               $vars['FIELD_DENY_CHECKED'] = 'checked="checked"';
  2239               break;
  2303               break;
  2240           }
  2304           }
  2241           $vars['FIELD_NAME'] = 'data[perms][' . $acl_type . ']';
  2305           $vars['FIELD_NAME'] = 'data[perms][' . $acl_type . ']';
  2242           $vars['FIELD_DESC'] = $response['acl_descs'][$acl_type];
  2306           if ( preg_match('/^([a-z0-9_]+)$/', $response['acl_descs'][$acl_type]) )
       
  2307           {
       
  2308             $vars['FIELD_DESC'] = $lang->get($response['acl_descs'][$acl_type]);
       
  2309           }
       
  2310           else
       
  2311           {
       
  2312             $vars['FIELD_DESC'] = $response['acl_descs'][$acl_type];
       
  2313           }
  2243           $parser->assign_vars($vars);
  2314           $parser->assign_vars($vars);
  2244           echo $parser->run();
  2315           echo $parser->run();
  2245         }
  2316         }
  2246         $parser = $template->makeParserText( $response['template']['acl_field_end'] );
  2317         $parser = $template->makeParserText( $response['template']['acl_field_end'] );
  2247         echo $parser->run();
  2318         echo $parser->run();
  2250                 <input type="hidden" name="data[page_id]" value="'   . (( $response['page_id']   ) ? $response['page_id']   : 'false') . '" />
  2321                 <input type="hidden" name="data[page_id]" value="'   . (( $response['page_id']   ) ? $response['page_id']   : 'false') . '" />
  2251                 <input type="hidden" name="data[namespace]" value="' . (( $response['namespace'] ) ? $response['namespace'] : 'false') . '" />
  2322                 <input type="hidden" name="data[namespace]" value="' . (( $response['namespace'] ) ? $response['namespace'] : 'false') . '" />
  2252                 <input type="hidden" name="data[target_type]" value="' . $response['target_type'] . '" />
  2323                 <input type="hidden" name="data[target_type]" value="' . $response['target_type'] . '" />
  2253                 <input type="hidden" name="data[target_id]" value="' . $response['target_id'] . '" />
  2324                 <input type="hidden" name="data[target_id]" value="' . $response['target_id'] . '" />
  2254                 <input type="hidden" name="data[target_name]" value="' . $response['target_name'] . '" />
  2325                 <input type="hidden" name="data[target_name]" value="' . $response['target_name'] . '" />
  2255                 ' . ( ( $response['type'] == 'edit' ) ? '<input type="submit" value="Save changes" />&nbsp;&nbsp;<input type="submit" name="data[act_delete_rule]" value="Delete rule" style="color: #AA0000;" onclick="return confirm(\'Do you really want to delete this ACL rule?\');" />' : '<input type="submit" value="Create rule" />' ) . '
  2326                 ' . ( ( $response['type'] == 'edit' ) ? '<input type="submit" value="' . $lang->get('etc_save_changes') . '" />&nbsp;&nbsp;<input type="submit" name="data[act_delete_rule]" value="' . $lang->get('acl_btn_deleterule') . '" style="color: #AA0000;" onclick="return confirm(\'' . addslashes($lang->get('acl_msg_deleterule_confirm')) . '\');" />' : '<input type="submit" value="' . $lang->get('acl_btn_createrule') . '" />' ) . '
  2256               </div>';
  2327               </div>';
  2257         echo $formend;
  2328         echo $formend;
  2258         break;
  2329         break;
  2259       case 'error':
  2330       case 'error':
  2260         ob_end_clean();
  2331         ob_end_clean();