<?php

/*

Plugin Name: Linkchomper

Plugin URI: http://enanocms.org/Linkchomper

Description: Allows you to add custom links to the Links section of the sidebar. Includes click-tracking functionality.

Author: Dan Fuhry

Version: 0.1 beta 1

Author URI: http://enanocms.org/

*/

/*

 * Linkchomper for Enano CMS

 * Version 0.1 beta 1

 * Copyright (C) 2006-2007 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

global $db, $session, $paths, $template, $plugins; // Common objects

// Constants

define('LC_LINK_RAW', 1);

define('LC_LINK_TRACK_CLICKS', 2);

define('LC_LINK_DISABLED', 4);

define('LC_LINK_INNER_IMAGE', 8);

define('LC_EDIT', 1);

define('LC_CREATE', 2);

if ( !$version = getConfig('linkchomper_version') )

{

  // Install the table

  $q = $db->sql_query('CREATE TABLE '.table_prefix.'linkchomper(

      link_id mediumint(8) NOT NULL auto_increment,

      link_name varchar(255) NOT NULL,

      link_href text NOT NULL,

      link_inner_html text NOT NULL,

      link_before_html text NOT NULL,

      link_after_html text NOT NULL,

      link_flags tinyint(1) NOT NULL DEFAULT 0,

      link_clicks bigint(15) NOT NULL DEFAULT 0,

      link_order mediumint(8) NOT NULL DEFAULT 0,

      PRIMARY KEY ( link_id )

    );');

  if ( !$q )

  {

    // Prevent Linkchomper from loading again

    $plugin_key = 'plugin_' . basename(__FILE__);

    setConfig($plugin_key, '0');

    $db->_die('The error occurred during an attempt to create the table for Linkchomper. For your site\'s protection, Linkchomper has disabled itself. It can be re-enabled in the administration panel.');

  }

  setConfig('linkchomper_version', '0.1b1');

}

// Hook into the template compiler

$plugins->attachHook('links_widget', 'linkchomper_generate_html($ob);');

// Add our link tracking page

$plugins->attachHook('base_classes_initted', '

  global $paths;

    $paths->add_page(Array(

      \'name\'=>\'LinkChomper click tracker\',

      \'urlname\'=>\'LCClick\',

      \'namespace\'=>\'Special\',

      \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->add_page(Array(

      \'name\'=>\'Administration\',

      \'urlname\'=>\'Linkchomper\',

      \'namespace\'=>\'Admin\',

      \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

      ));

    $paths->addAdminNode(\'Plugin configuration\', \'Linkchomper manager\', \'Linkchomper\');

  ');

// Function to generate HTML for the sidebar widget

function linkchomper_generate_html(&$links_array)

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  $q = $db->sql_query('SELECT link_id, link_name, link_href, link_inner_html, link_before_html, link_after_html, link_flags FROM '.table_prefix.'linkchomper ORDER BY link_order ASC;');

  if ( !$q )

    $db->_die();

  if ( $row = $db->fetchrow() )

  {

    do {

      // Get flags

      $flags =& $row['link_flags'];

      // Is this link disabled? If so, skip the whole painful process

      if ( $flags & LC_LINK_DISABLED )

        continue;

      // First check to see if the inner_html is an image URL. If so, generate a nice img tag for the inner HTML.

      if ( $flags & LC_LINK_INNER_IMAGE )

      {

        $row['link_inner_html'] = '<img alt="' . htmlspecialchars($row['link_name']) . '" src="' . htmlentities($row['link_inner_html']) . '" style="border-width: 0px;" />';

      }

      // If it's raw HTML, just send it through

      if ( $flags & LC_LINK_RAW )

      {

        $links_array[] = $row['link_before_html'] . $row['link_inner_html'] . $row['link_after_html'];

      }

      // If we're supposed to track clicks, send a deceptive anchor

      else if ( $flags & LC_LINK_TRACK_CLICKS )

      {

        $url = makeUrlNS('Special', 'LCClick/' . $row['link_id'], false, true);

        // Escape target URL for Javascript-safety

        $real_url = htmlspecialchars(str_replace(array('\\', '\'', '"'), array('\\\\', '\\\'', '\\"'), $row['link_href']));

        $link = $row['link_before_html'] . '<a href="' . $url . '" title="' . htmlspecialchars($row['link_href']) . '" onmouseover="void(window.status=\'' . $real_url . '\');" onmouseout="void(window.status=\'\');">' . $row['link_inner_html'] . '</a>' . $row['link_after_html'];

        $links_array[] = $link;

      }

      // None of those? OK just send a normal link

      else

      {

        $url = htmlspecialchars($row['link_href']);

        $link = $row['link_before_html'] . '<a href="' . $url . '">' . $row['link_inner_html'] . '</a>' . $row['link_after_html'];

        $links_array[] = $link;

      }

    } while ( $row = $db->fetchrow() );

  }

  $db->free_result();

}

// Special page handler for click tracker

function page_Special_LCClick()

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  $link_id = ( $xx = $paths->getParam(0) ) ? intval($xx) : false;

  if ( !$link_id )

    die_friendly('Nice try', '<p>Hacking attempt</p>');

  $q = $db->sql_query('SELECT link_href,link_flags FROM '.table_prefix.'linkchomper WHERE link_id=' . $link_id . ';');

  if ( !$q )

    $db->_die();

  $row = $db->fetchrow();

  $db->free_result();

  if ( ! ( $row['link_flags'] & LC_LINK_TRACK_CLICKS ) )

  {

    die_friendly('Nice try', '<p>This ain\'t no tracker link...</p>');

  }

  $q = $db->sql_query('UPDATE '.table_prefix.'linkchomper SET link_clicks=link_clicks+1 WHERE link_id=' . $link_id . ';');

  if ( !$q )

    $db->_die();

  redirect($row['link_href'], 'Redirecting', 'Thanks for clicking the link, you are now being transferred to the destination.', 0);

}

function linkchomper_admin_redirect_home($message = 'Your changes have been saved, and you will now be transferred back to the administration panel.')

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  $url = makeUrlComplete('Special', 'Administration', 'module=' . $paths->nslist['Admin'] . 'Linkchomper');

  redirect($url, 'Linkchomper changes saved', $message, 2);

}

function page_Admin_Linkchomper()

{

  //@ini_set('display_errors', 'On') or die('Can\'t set display_errors');

  //error_reporting(E_ALL);

  global $db, $session, $paths, $template, $plugins; // Common objects

  if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

  {

    echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';

    return;

  }

  if ( isset($_POST['action']) )

  {

    if ( isset($_POST['action']['move_up']) || isset($_POST['action']['move_down']) )

    {

      $direction = ( isset($_POST['action']['move_up']) ) ? 'up' : 'down';

      $ordering  = ( isset($_POST['action']['move_up']) ) ? 'ASC' : 'DESC';

      // Move an item up in the list

      // First step: Get IDs of the item to move and the item above it

      $id = array_keys($_POST['action']['move_' . $direction]);

      $id = intval( $id[0] );

      if ( !$id )

      {

        echo 'Hacking attempt';

        return false;

      }

      $q = $db->sql_query('SELECT link_id, link_name, link_order FROM '.table_prefix.'linkchomper ORDER BY link_order ' . $ordering . ';');

      if ( !$q )

        $db->_die();

      $last_id = false;

      $this_id = false;

      $last_order = false;

      $this_order = false;

      $id_to   = false;

      $id_from = false;

      $order_to   = false;

      $order_from = false;

      while ( $row = $db->fetchrow() )

      {

        $this_id = $row['link_id'];

        $this_order = $row['link_order'];

        if ( $this_id == $id && $last_id === false )

        {

          linkchomper_admin_redirect_home('This item is already at the top or bottom of the list.');

        }

        else if ( $this_id == $id )

        {

          $id_from = $last_id;

          $id_to   = $this_id;

          $order_from = $this_order;

          $order_to   = $last_order;

          break;

        }

        $last_id = $this_id;

        $last_order = $this_order;

      }

      unset($this_id, $this_order, $last_id, $last_order);

      if ( $last_order === false || $this_order === false )

      {

        linkchomper_admin_redirect_home('Sanity check failed.');

      }

      $sql1 = 'UPDATE '.table_prefix.'linkchomper SET link_order=' . $order_to . ' WHERE link_id=' . $id_to . ';';

      $sql2 = 'UPDATE '.table_prefix.'linkchomper SET link_order=' . $order_from . ' WHERE link_id=' . $id_from . ';';

      if ( !$db->sql_query($sql1) )

      {

        $db->_die();

      }

      if ( !$db->sql_query($sql2) )

      {

        $db->_die();

      }

      linkchomper_admin_redirect_home('The item "' . $row['link_name'] . '" has been moved ' . $direction . '.');

    }

    else if ( isset($_POST['action']['delete']) )

    {

      // Delete a link

      $id = array_keys($_POST['action']['delete']);

      $id = intval( $id[0] );

      if ( !$id )

      {

        echo 'Hacking attempt';

        return false;

      }

      $q = $db->sql_query('DELETE FROM '.table_prefix."linkchomper WHERE link_id=$id;");

      if ( !$q )

        $db->_die();

      linkchomper_admin_redirect_home('The selected link has been deleted.');

    }

    linkchomper_admin_redirect_home('Invalid or no action defined');

  }

  else if ( isset($_POST['stage2']) )

  {

    $_GET['module'] = $paths->page;

    $_POST['stage2_real'] = $_POST['stage2'];

    unset($_POST['stage2']);

    page_Special_Administration();

    return true;

  }

  else if ( isset($_POST['stage2_real']) )

  {

  /*

  TODO:

  The idea here is to build a template-based unified edit form that will be used both for creating and editing links. Make it have

  intelligent auto-hiding/auto-(un)checking elements and make it use the standard flags field.

  */

    // allow breaking out

    switch(true){case true:

      $stage2 =& $_POST['stage2_real'];

      $err_and_revert = array(

        'error' => false

      );

      if ( isset($stage2['delete']) )

      {

        $id = array_keys($stage2['delete']);

        $id = intval( $id[0] );

        if ( !$id )

        {

          echo 'Hacking attempt';

          return false;

        }

        echo '<form action="' . makeUrlNS('Admin', 'Linkchomper') . '" method="post" enctype="multipart/form-data">';

        echo '<div class="tblholder">

                <table border="0" cellspacing="1" cellpadding="4">';

        echo '  <tr>

                  <th>Confirm deletion</th>

                </tr>

                <td class="row1" style="text-align: center; line-height: 40px;">

                  Are you sure you want to permanently delete this link?

                </td>

                <tr>

                  <th class="subhead">

                    <input type="submit" name="action[delete]['.$id.']" value="Yes, delete link" />

                    <input type="submit" name="stage2[cancel]" value="Cancel" />

                  </th>

                </tr>';

        echo '  </table>

              </div>';

        echo '</form>';

      }

      else if ( isset($stage2['create_new']) )

      {

        $editor = new LinkchomperFormGenerator();

        $editor->echo_html();

      }

      else if ( isset($stage2['edit']) )

      {

        $id = array_keys($stage2['edit']);

        $id = intval( $id[0] );

        if ( !$id )

        {

          echo 'Hacking attempt';

          return false;

        }

        $q = $db->sql_query('SELECT * FROM '.table_prefix."linkchomper WHERE link_id=$id;");

        if ( !$q )

          $db->_die();

        if ( $db->numrows() < 1 )

        {

          echo "Can't find link: $id";

          $db->free_result();

        }

        else

        {

          $row = $db->fetchrow();

          $db->free_result();

          $editor = new LinkchomperFormGenerator();

          $editor->track_clicks = ( $row['link_flags'] & LC_LINK_TRACK_CLICKS );

          $editor->raw_html = ( $row['link_flags'] & LC_LINK_RAW );

          $editor->link_flag_image = ( $row['link_flags'] & LC_LINK_INNER_IMAGE );

          $editor->link_disabled = ( $row['link_flags'] & LC_LINK_DISABLED );

          $editor->link_target = $row['link_href'];

          $editor->link_name = $row['link_name'];

          $editor->mode = LC_EDIT;

          $editor->inner_html = $row['link_inner_html'];

          $editor->before_html = $row['link_before_html'];

          $editor->after_html = $row['link_after_html'];

          $editor->link_id = $row['link_id'];

          $editor->echo_html();

        }

      }

      else if ( isset($stage2['create_new_finish']) )

      {

        $flags = 0;

        // Validation

        $errors = array();

        $link_name = trim($_POST['link_name']);

        if ( empty($link_name) )

          $errors[] = 'Please enter a name for your link.';

        if ( isset($_POST['raw_html']) && isset($_POST['track_clicks']) )

          $errors[] = 'Raw blocks cannot be used with clicktracking.';

        $link_target = trim($_POST['link_target']);

        if ( empty($link_target) && !isset($_POST['raw_html']) )

          $errors[] = 'Please enter a target for your link.';

        if ( $_POST['link_flag_img'] == '1' )

        {

          $inner_html = trim($_POST['link_img_path']);

          if ( empty($inner_html) )

            $errors[] = 'Please enter a path or URL to an image file.';

        }

        else

        {

          $inner_html = trim($_POST['link_inner_html']);

          if ( empty($inner_html) )

            $errors[] = 'Please enter some content to go inside your link.';

        }

        if ( count($errors) > 0 )

        {

          $err_and_revert['error'] = true;

          $err_and_revert['message'] = implode("<br />\n        ", $errors);

        }

        else

        {

          if ( isset($_POST['link_disabled']) )

            $flags = $flags | LC_LINK_DISABLED;

          if ( $_POST['link_flag_img'] == '1' )

            $flags = $flags | LC_LINK_INNER_IMAGE;

          if ( isset($_POST['raw_html']) )

            $flags = $flags | LC_LINK_RAW;

          if ( isset($_POST['track_clicks']) )

            $flags = $flags | LC_LINK_TRACK_CLICKS;

          $before_html = strval(trim($_POST['link_before_html']));

          $after_html  = strval(trim($_POST['link_after_html']));

          if ( !$session->get_permissions('php_in_pages') )

          {

            // Not allowed to embed PHP and Javascript

            $before_html = sanitize_html($before_html);

            $after_html  = sanitize_html($after_html);

            $inner_html  = sanitize_html($inner_html);

          }

          $sanitized = array(

              'link_name' => $db->escape($link_name),

              'link_target' => $db->escape($link_target),

              'link_inner_html' => $db->escape($inner_html),

              'link_before_html' => $db->escape($before_html),

              'link_after_html' => $db->escape($after_html)

            );

          $sql = "INSERT INTO ".table_prefix."linkchomper(link_name, link_href, link_inner_html, link_before_html, link_after_html, link_flags, link_order) VALUES('{$sanitized['link_name']}','{$sanitized['link_target']}','{$sanitized['link_inner_html']}','{$sanitized['link_before_html']}','{$sanitized['link_after_html']}', $flags, ".LC_ADMIN_ORDER_LAST.");";

          if ( !$db->sql_query($sql) )

            $db->_die();

          echo '<div class="info-box">Link created.</div>';

          break;

        }

      }

      else if ( isset($stage2['edit_finish']) )

      {

        $flags = 0;

        // Validation

        $errors = array();

        $link_name = trim($_POST['link_name']);

        if ( empty($link_name) )

          $errors[] = 'Please enter a name for your link.';

        if ( isset($_POST['raw_html']) && isset($_POST['track_clicks']) )

          $errors[] = 'Raw blocks cannot be used with clicktracking.';

        $link_target = trim($_POST['link_target']);

        if ( empty($link_target) && !isset($_POST['raw_html']) )

          $errors[] = 'Please enter a target for your link.';

        if ( $_POST['link_flag_img'] == '1' )

        {

          $inner_html = trim($_POST['link_img_path']);

          if ( empty($inner_html) )

            $errors[] = 'Please enter a path or URL to an image file.';

        }

        else

        {

          $inner_html = trim($_POST['link_inner_html']);

          if ( empty($inner_html) )

            $errors[] = 'Please enter some content to go inside your link.';

        }

        $link_id = intval($_POST['link_id']);

        if ( $link_id < 1 )

          $errors[] = 'Unable to obtain link ID';

        if ( count($errors) > 0 )

        {

          $err_and_revert['error'] = true;

          $err_and_revert['message'] = implode("<br />\n        ", $errors);

        }

        else

        {

          if ( isset($_POST['link_disabled']) )

            $flags = $flags | LC_LINK_DISABLED;

          if ( $_POST['link_flag_img'] == '1' )

            $flags = $flags | LC_LINK_INNER_IMAGE;

          if ( isset($_POST['raw_html']) )

            $flags = $flags | LC_LINK_RAW;

          if ( isset($_POST['track_clicks']) )

            $flags = $flags | LC_LINK_TRACK_CLICKS;

          $before_html = strval(trim($_POST['link_before_html']));

          $after_html  = strval(trim($_POST['link_after_html']));

          if ( !$session->get_permissions('php_in_pages') )

          {

            // Not allowed to embed PHP and Javascript

            $before_html = sanitize_html($before_html);

            $after_html  = sanitize_html($after_html);

            $inner_html  = sanitize_html($inner_html);

          }

          $sanitized = array(

              'link_name' => $db->escape($link_name),

              'link_target' => $db->escape($link_target),

              'link_inner_html' => $db->escape($inner_html),

              'link_before_html' => $db->escape($before_html),

              'link_after_html' => $db->escape($after_html)

            );

          $sql = "UPDATE ".table_prefix."linkchomper SET link_name='{$sanitized['link_name']}',link_href='{$sanitized['link_target']}',link_inner_html='{$sanitized['link_inner_html']}',link_before_html='{$sanitized['link_before_html']}',link_after_html='{$sanitized['link_after_html']}',link_flags=$flags WHERE link_id=$link_id;";

          if ( !$db->sql_query($sql) )